Metadata-Version: 2.4
Name: pyauditd
Version: 0.1.0
Summary: Transparent HMAC audit daemon. inotify IS the engine. Zero dependencies.
Project-URL: Homepage, https://github.com/rangersui/pyauditd
Author-email: Ranger Chen <ranger@rangerfoxsolutions.com>
License-Expression: MIT
License-File: LICENSE
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: No Input/Output (Daemon)
Classifier: Intended Audience :: System Administrators
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Classifier: Topic :: System :: Logging
Classifier: Topic :: System :: Systems Administration
Requires-Python: >=3.10
Description-Content-Type: text/markdown

# pyauditd

Transparent audit daemon. Write files however you want — pyauditd handles integrity.

```bash
echo "hello" > $STORE/greeting       # you just write files
# aud sees CLOSE_WRITE via inotify   # ctypes, no subprocess
# → HMAC chain appended              # hmac+hashlib, no fork
# → hooks notified                   # persistent subprocess, hot-reload
```

Zero pip dependencies. One process. Any language for hooks.

## Install

```bash
pip install pyauditd
```

## Usage

```bash
aud watch [store_dir]            # watch and audit
aud verify [store_dir]           # verify all chains
aud verify [store_dir] <key>     # verify one chain
aud status [store_dir]           # show daemon status
aud install [store_dir]          # set up privilege separation (root)
aud watch-audit [store_dir]      # real-time chain monitor (auditor)
```

## Privilege Separation

```
aud (daemon)  → writes chains     → uid=aud, 700
agent         → writes data       → gid=aud-agents, 1773 sticky
auditor       → read-only verify  → gid=aud-auditor, 750
```

Three users, three roles. The auditor and the audited cannot be the same person.

## Hooks

Drop any executable into `$STORE/hooks/`. Hot-reload via inotify.

```
daemon → stdin:  {"event":"write","path":"doc","sha256":"a948...","size":12}
hook   → stdout: {"skip":true}     (optional, skip default audit)
```

## Part of the pythond ecosystem

See [pythond](https://pypi.org/project/pythond/) for the core runtime.
