audit: ensure that 'audit=1' actually enables audit for PID 1