Merge branch 'stable-3.18' of git://git.infradead.org/users/pcmoore/audit

Pull audit fixes from Paul Moore:
 "After he sent the initial audit pull request for 3.18, Eric asked me
  to take over the management of the audit tree, hence this pull request
  to fix a couple of problems with audit.

  As you can see below, the changes are minimal: adding some whitespace
  to a string so userspace parses it correctly, and fixing a problem
  with audit's usage of fsnotify that was causing audit watch rules to
  be lost.  Neither of these patches were very controversial on the
  mailing lists and they fix real problems, getting them into 3.18 would
  be a good thing"

* 'stable-3.18' of git://git.infradead.org/users/pcmoore/audit:
  audit: keep inode pinned
  audit: AUDIT_FEATURE_CHANGE message format missing delimiting space

diff --combined kernel/audit.c
index 80983df92cd441f981090394252126fbde22cd64,8ee4508f966625ee9b7b261bfb2ad397c3015bb4..cebb11db4d342642efccdc6fdebdea638353324c
--- 1/kernel/audit.c
--- 2/kernel/audit.c
+++ b/kernel/audit.c
@@@ -739,7 -739,7 +739,7 @@@ static void audit_log_feature_change(in
  
        ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_FEATURE_CHANGE);
        audit_log_task_info(ab, current);
-       audit_log_format(ab, "feature=%s old=%u new=%u old_lock=%u new_lock=%u res=%d",
+       audit_log_format(ab, " feature=%s old=%u new=%u old_lock=%u new_lock=%u res=%d",
                         audit_feature_names[which], !!old_feature, !!new_feature,
                         !!old_lock, !!new_lock, res);
        audit_log_end(ab);
@@@ -1667,7 -1667,7 +1667,7 @@@ void audit_log_cap(struct audit_buffer 
        audit_log_format(ab, " %s=", prefix);
        CAP_FOR_EACH_U32(i) {
                audit_log_format(ab, "%08x",
 -                               cap->cap[(_KERNEL_CAPABILITY_U32S-1) - i]);
 +                               cap->cap[CAP_LAST_U32 - i]);
        }
  }