Comment 8 for bug 1794820

'And for "audit deny @{HOME}/.config/autostart/**", you'll probably have to block write access to ~/.config, if that's possible without breaking things? Otherwise someone could move the whole ~/.config directory as a bypass.'

Yep, working through that, thanks!