Yes, this not a syntax check. The ruleset is passed to the kernel.
Is there any other way we can verify that at least the syntax is valid? Maybe have a --syntax flag that just invokes the scanner and parser without needing any privileged access? I know nothing of the internals, so that might of course be completely impossible given the current architecture.
