Module auditd 

auditd file-watch rule actions.

GetAuditRules (auditctl -l) is read-only. AddAuditRule/RemoveAuditRule delegate to the root-owned helper /usr/lib/sysknife/audit-edit, which writes a persistent rule under /etc/audit/rules.d/ and loads it with augenrules.

Scope: file-WATCH rules only (-w <path> -p <perms> -k <key>). Syscall rules are intentionally out of scope (large injection surface).

Network-gated: the auditd package is not on the base cloud image, so the auditctl/augenrules behaviour could not be live-validated in the sandbox — only the helper’s rule-file write was. See the helper header.

Functions

add_audit_rule

Add a persistent file-watch rule via the helper.

get_audit_rules

List the loaded audit rules (auditctl -l). Read-only.

remove_audit_rule

Remove a SysKnife-managed audit rule by key.

specs