IMO not all configuration files can have admin CLIs/APIs/GUIs without enormous expense, and maybe some can't really have any that are all that great (think pam.conf(4)[*]).
ZFS audit SACLs ought to take care of the auditing issue (though, of
course, turning on file auditing will take care of it now).
[*] PSARC/2005/275 will make it so we can deal with PAM profiles, but
at the end of the day, what tool could really help you edit a PAM
profile? pam.conf is almost a language.
