journald-audit: do not control kernel auditing by non-default namespace instances by default

The kernel (thus system-wide) auditing should not be controlled by
non-default namespace instances, unless explicitly requested.

man/journald.conf.xml

@@ -482,7 +482,7 @@
         kernel auditing on start-up. If disabled it will turn it off. If unset it will neither enable nor
         disable it, leaving the previous state unchanged.  This means if another tool turns on auditing even
         if <command>systemd-journald</command> left it off, it will still collect the generated
-        messages. Defaults to on.</para>
+        messages. Defaults to on in the default journal namespace, and unset otherwise.</para>
 
         <para>Note that this option does not control whether <command>systemd-journald</command> collects
         generated audit records, it just controls whether it tells the kernel to generate them. If you need

src/journal/journald-config.c

@@ -49,7 +49,9 @@ static void manager_set_defaults(Manager *m) {
         /* By default, only read from /dev/kmsg if are the main namespace */
         m->read_kmsg = !m->namespace;
 
-        m->set_audit = true;
+        /* By default, kernel auditing is enabled by the main namespace instance, and not controlled by
+         * non-default namespace instances. */
+        m->set_audit = m->namespace ? -1 : true;
 
         m->sync_interval_usec = DEFAULT_SYNC_INTERVAL_USEC;