pyauditd

Transparent audit daemon. Write files however you want — pyauditd handles integrity.

echo "hello" > $STORE/greeting       # you just write files
# aud sees CLOSE_WRITE via inotify   # ctypes, no subprocess
# → HMAC chain appended              # hmac+hashlib, no fork
# → hooks notified                   # persistent subprocess, hot-reload

Zero pip dependencies. One process. Any language for hooks.

Install

pip install pyauditd

Usage

aud watch [store_dir]            # watch and audit
aud verify [store_dir]           # verify all chains
aud verify [store_dir] <key>     # verify one chain
aud status [store_dir]           # show daemon status
aud install [store_dir]          # set up privilege separation (root)
aud watch-audit [store_dir]      # real-time chain monitor (auditor)

Privilege Separation

aud (daemon)  → writes chains     → uid=aud, 700
agent         → writes data       → gid=aud-agents, 1773 sticky
auditor       → read-only verify  → gid=aud-auditor, 750

Three users, three roles. The auditor and the audited cannot be the same person.

Hooks

Drop any executable into $STORE/hooks/. Hot-reload via inotify.

daemon → stdin:  {"event":"write","path":"doc","sha256":"a948...","size":12}
hook   → stdout: {"skip":true}     (optional, skip default audit)

Part of the pythond ecosystem

See pythond for the core runtime.