[PATCH] audit: reduce scope of audit_log_fcaps