sysusers: emit audit events for user and group creation (#35957)

Background: Fedora/RHEL are switching to sysusers.d metadata for
creation of users and groups for system users defined by packages
(https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers).
Packages carry sysusers files. During package installation, rpm calls an
program to execute on this config. This program may either be
/usr/lib/rpm/sysusers.sh which calls useradd/groupadd, or
/usr/bin/systemd-sysusers. To match the functionality provided by
useradd/groupadd from the shadow-utils project, systemd-sysusers must
emit audit events so that it provides a drop-in replacement.

systemd-sysuers will emit audit events AUDIT_ADD_USER/AUDIT_ADD_GROUP
when adding users and groups. The operation "names" are copied from
shadow-utils, so the format of the events that is generated on success
should be identical. On failure, things are more complicated. We write
the whole file at once, once, so we first generate "success" messages
for each entry, then we try to write the files, and if things fail, we
generate failure messages to all entries that we failed to write.

src/basic/audit-util.h

@@ -1,10 +1,16 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#if HAVE_AUDIT
+#  include <libaudit.h>
+#endif
+
 #include <stdbool.h>
 #include <stdint.h>
 #include <sys/types.h>
 
+#include "errno-util.h"
+#include "log.h"
 #include "pidref.h"
 
 #define AUDIT_SESSION_INVALID UINT32_MAX
@@ -17,3 +23,30 @@ bool use_audit(void);
 static inline bool audit_session_is_valid(uint32_t id) {
         return id > 0 && id != AUDIT_SESSION_INVALID;
 }
+
+/* The wrappers for audit_open() and audit_close() are inline functions so that we don't get a spurious
+ * linkage to libaudit in libbasic, but we also don't need to create a separate source file for two very
+ * short functions. */
+
+static inline int close_audit_fd(int fd) {
+#if HAVE_AUDIT
+        if (fd >= 0)
+                audit_close(fd);
+#else
+        assert(fd < 0);
+#endif
+        return -EBADF;
+}
+
+static inline int open_audit_fd_or_warn(void) {
+        int fd = -EBADF;
+
+#if HAVE_AUDIT
+        /* If the kernel lacks netlink or audit support, don't worry about it. */
+        fd = audit_open();
+        if (fd < 0)
+                return log_full_errno(ERRNO_IS_NOT_SUPPORTED(errno) ? LOG_DEBUG : LOG_WARNING,
+                                      errno, "Failed to connect to audit log, ignoring: %m");
+#endif
+        return fd;
+}