4f9e98905e
Would otherwise fail with
```
error: A definition for option `systemd.services.auditd.conflicts."[definition 1-entry 1]"' is not of type `string matching the pattern [a-zA-Z0-9@%:_.\-]+[.](service|socket|device|mount|automount|swap|target|path|timer|scope|slice)'. Definition values:
- In `/nix/store/x2khl2yx0vz2i357x7mz5xm1kagql8ag-source/nixos/modules/security/auditd.nix': "shutdown.target "
```
34 lines
832 B
Nix
34 lines
832 B
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
{
|
|
options.security.auditd.enable = mkEnableOption (lib.mdDoc "the Linux Audit daemon");
|
|
|
|
config = mkIf config.security.auditd.enable {
|
|
boot.kernelParams = [ "audit=1" ];
|
|
|
|
environment.systemPackages = [ pkgs.audit ];
|
|
|
|
systemd.services.auditd = {
|
|
description = "Linux Audit daemon";
|
|
wantedBy = [ "basic.target" ];
|
|
before = [ "shutdown.target" ];
|
|
conflicts = [ "shutdown.target" ];
|
|
|
|
unitConfig = {
|
|
ConditionVirtualization = "!container";
|
|
ConditionSecurity = [ "audit" ];
|
|
DefaultDependencies = false;
|
|
};
|
|
|
|
path = [ pkgs.audit ];
|
|
|
|
serviceConfig = {
|
|
ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p /var/log/audit";
|
|
ExecStart = "${pkgs.audit}/bin/auditd -l -n -s nochange";
|
|
};
|
|
};
|
|
};
|
|
}
|