Module audit 

Security audit framework

Tracks and logs security-relevant events for compliance and forensics.

Features

• Structured audit events with timestamps, PIDs, UIDs, and action details
• Configurable event filtering via bitmask
• Persistent storage to VFS-backed audit log (/var/log/audit.log)
• Serialization to pipe-delimited text format
• Convenience functions for syscall, capability, and MAC audit logging
• Real-time alert callbacks for critical security events
• Statistics tracking

Structs

AuditEvent

Structured audit event record.

AuditFilter

Configurable audit event filter using a bitmask.

AuditStatistics

Detailed audit statistics snapshot.

Enums

AuditAction

Structured audit action for detailed event logging.

AuditEventType

Audit event type.

Traits

AlertCallback

Trait for real-time audit alert handlers.

Functions

disable

Disable audit logging.

disable_event_type

Disable a specific event type in the filter.

enable

Enable audit logging.

enable_event_type

Enable a specific event type in the filter.

get_detailed_stats

Get detailed audit statistics.

get_filter

Get the current audit event filter.

get_stats

Get audit log statistics: (current_count, max_capacity).

init

Initialize audit system.

log_auth_attempt

Log an authentication attempt.

log_capability

Log a capability operation with a specific action.

log_capability_op

Log a capability operation (create, revoke, derive).

log_event

Log a structured audit event.

log_file_access

Log a file access event.

log_mac_decision

Log a MAC policy decision.

log_permission_denied

Log a permission denial event.

log_process_create

Log a process creation event.

log_process_exit

Log a process exit event.

log_syscall

Log a system call event.

register_alert_callback

Register a real-time alert callback.

set_filter

Set the audit event filter.