feat(handlers): audit_rule_set loads rules via AUDIT netlink (Phase 5, PR 1/2)

[remyluslosius]

Phase 5, PR 1 of 2 (rule handler; the engine transaction-phase event emission follows). audit_rule_set now loads each rule line into the running kernel via AUDIT_ADD_RULE (go-libaudit) and writes the /etc/audit/rules.d drop-in atomically (fsatomic), instead of shelling out to augenrules, in agent mode.

New dependency

github.com/elastic/go-libaudit/v2 v2.6.2 (pure-Go netlink + the auditctl-grammar rule parser; go-shellquote pulled in // indirect for its parser). No depguard in .golangci.yml → no allowlist change; go mod tidy verified idempotent (CI drift check passes).

What

• internal/agent/auditnl: BuildRule (flags.Parse + rule.Build → wire format — same grammar as auditctl, not reimplemented) + RuleLines; AuditClient interface + Open (ErrAuditUnavailable on open failure); AuditTransport capability (FileTransport + AuditClient()); FakeAuditTransport.
• local.Transport implements AuditTransport.
• audit_rule_set Apply/Capture/Rollback gain a netlink branch via transport.(auditnl.AuditTransport); ErrAuditUnavailable (no privilege / immutable audit) or a missing capability → augenrules shell fallback (host without netlink behaves exactly as before).

⚠️ Additive-per-rule model (documented divergence)

The netlink path loads this rule's lines into the kernel's flat list — it does not replicate augenrules' whole-rules.d compile-load. To keep rollback safe, Capture records added_rules = the lines NOT already loaded (wire-equality vs AUDIT_LIST_RULES), and Rollback unloads only those — so a rule another drop-in owns survives rollback (unit-tested).

spec auditnl-rule-set (Tier 1, 5 ACs) + parser tests + handler round-trip tests (load+persist, bad-rule→failed-step, unload-what-we-added, keep-preexisting, both fallback paths).

Verification

go test ./... green; go build ./... clean; golangci-lint 0; comment-lint clean; specter sync all pass; go mod tidy idempotent.

Failure-mode analysis

1. Wrong in prod? Unloading an audit rule another drop-in/operator owns. Mitigated: added_rules (wire-equality vs the kernel's current list) → rollback deletes only what this apply added; ENOENT on delete is a no-op.
2. Captured-state sufficiency: rollback consumes file_existed + prior_content (persist) and added_rules (runtime). Capture failure → ErrCaptureIncomplete.
3. Edge case / gated: immutable audit (enabled=2) rejects ADD/DEL until reboot → failed step (or shell fallback, same limitation); malformed rule → failed step (nothing loaded/persisted). ⚠️ LIVE netlink validation needs root + a real audit subsystem (CI is non-root → only the shell-fallback path runs); kensa-fuzz + two-human rollback review (CONTRIBUTING) are the founder's gate.

🤖 Generated with Claude Code