audit-log: support `/dev/null` to disable audit logging

[Tamar-Dinavetsky]

Description

Passing --audit-log /dev/null is a standard unix idiom for discarding output, and a natural way for users to disable audit logging entirely. Currently it fails with:

level=warning msg="Failed to open audit log file /dev/null: chmod /dev/null: operation not permitted"

The failure is caused by NewFileHook calling f.Chmod(0600) unconditionally after opening the file. The chmod syscall fails on device files like /dev/null.

Proposed Solution

Only call Chmod on newly-created regular files, not on pre-existing files. Better yet, create the file with the correct permissions (0600) from the start to avoid needing Chmod in most cases.

Implementation:

1. Check if the file existed before opening it
2. Open the file with mode 0600 (instead of 0644)
3. Call Chmod(0600) only if the file was just created (to ensure pre-existing files also get the correct permissions updated)

This way:

• New files get 0600 directly at creation time
• Pre-existing regular files get updated to 0600 (security fix)
• Device files like /dev/null skip the Chmod call entirely

Changes Required

• File: internal/audit/audit_logger.go — NewFileHook()
  • Check file existence before opening
  • Change initial mode from 0644 to 0600
  • Conditional Chmod based on whether file was newly created

Testing

• Unit test: NewFileHook("/dev/null", ...) succeeds and writes entries without error
• E2E test (tier1): --audit-log /dev/null allows the command to execute normally (audit data is discarded)

Documentation

• Add to docs: "To disable audit logging on unix-like systems, pass --audit-log /dev/null"

[aufi]

Nice report, chmod doesn't work for /dev/null, but I believe the audit log write could be updated to handle this.

[Tamar-Dinavetsky]

@aufi updated the description, thanks