Error deleting rule during shutdown with -e 2

[Daniel Neuberger]

All,

When stopping auditd during a system shutdown, I see the following error:

Error deleting rule (Operation not permitted)

My audit.rules file looks like:
------------------------
-D
[trimmed]
-a always,exit -F arch=b32 -S open -S openat -F exit=-EPERM -k access4
-w /etc/sudoers -p wa -k actions  -p wax
[trimmed]
-e 2
------------------------

The only ways I've found to fix this is to remove the -e 2 option, but 
we need our rules to be immutable?

Also based on looking at the auditd init script, setting 
AUDITD_CLEAN_STOP=no during shutdown would work, but I don't want to 
modify the script.

Any other ideas?

Thanks.

- Daniel