rwhod: react to audit pam events to broadcast updates

Listen to read-only audit packets from the kernel to react on user logins/logouts. This way, we can immediately notify other machines on the network whenever there is a change to the user session list.
2026-07-21 02:04:03 +09:00
parent 026c19acc7
commit 91201d334d
10 changed files with 284 additions and 23 deletions
@@ -0,0 +1,13 @@
+[Unit]
+Description=Roowho2 Audit Netlink Socket
+
+ConditionKernelCommandLine=!audit=0
+ConditionKernelCommandLine=!audit=off
+
+[Socket]
+FileDescriptorName=audit_socket
+ListenNetlink=audit 1
+Service=roowho2.service
+
+[Install]
+WantedBy=sockets.target