altering audit_log_start

Hello, I just wanted to get feedback. This would change the audit subsystem such that subsystems like SELinux would have to adapt, but I think it'd be better in the long run if the audit_log_start() function actually returned a ERR_PTR() upon failure. That way we could properly handle/propigate the error in non-void functions that want to use audit_log*. Any opinions on the matter? -- -tim