As audit is pretty much just a special kind of logging we should treat
it similar, and manage the audit fd in a static variable.

This simplifies the audit fd sharing with the SELinux access checking
code quite a bit.