rwhod: react to audit pam events to broadcast updates

Listen to read-only audit packets from the kernel to react on user
logins/logouts. This way, we can immediately notify other machines on
the network whenever there is a change to the user session list.

Cargo.toml

@@ -19,7 +19,7 @@ autolib = false
 anyhow = "1.0.104"
 bytes = "1.12.1"
 chrono = { version = "0.4.45", features = ["serde"] }
-clap = { version = "4.6.2", features = ["derive"] }
+clap = { version = "4.6.3", features = ["derive"] }
 futures-util = "0.3.33"
 nix = { version = "0.31.3", features = ["hostname", "net", "fs", "user"] }
 serde = { version = "1.0.229", features = ["derive"] }
@@ -29,7 +29,7 @@ tracing = "0.1.44"
 tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
 # onc-rpc = "0.3.2"
 sd-notify = { version = "0.5.0", optional = true }
-serde_json = "1.0.150"
+serde_json = "1.0.151"
 uucore = { version = "0.9.0", features = ["utmpx"] }
 zlink = { version = "0.7.0", features = ["introspection"] }
 clap_complete = "4.6.7"
@@ -39,6 +39,9 @@ caps = "0.5.6"
 users = { version = "0.11.0", default-features = false }
 tracing-journald = "0.3.2"
 chrono-tz = "0.10.4"
+netlink-proto = "0.12.0"
+netlink-sys = { version = "0.8.8", features = ["tokio_socket"] }
+netlink-packet-audit = "0.6.1"
 
 [dev-dependencies]
 indoc = "2.0.7"