From 1884f0fa52aab905609d3ec3981f1e12f4b28e72 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Thu, 11 Sep 2025 09:50:00 +0200
Subject: [PATCH] nixos/audit: rename service to audit-rules-nixos to avoid
 collisions with the upstream unit

---
 nixos/modules/security/audit.nix | 5 ++++-
 nixos/tests/audit.nix            | 6 +++---
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/security/audit.nix b/nixos/modules/security/audit.nix
index f50c465fde5b..849ff57c662c 100644
--- a/nixos/modules/security/audit.nix
+++ b/nixos/modules/security/audit.nix
@@ -95,7 +95,10 @@ in
 
     environment.systemPackages = [ pkgs.audit ];
 
-    systemd.services.audit-rules = {
+    # upstream contains a audit-rules.service, which uses augenrules.
+    # That script does not handle cleanup correctly and insists on loading from /etc/audit.
+    # So, instead we have our own service for loading rules.
+    systemd.services.audit-rules-nixos = {
       description = "Load Audit Rules";
       wantedBy = [ "sysinit.target" ];
       before = [
diff --git a/nixos/tests/audit.nix b/nixos/tests/audit.nix
index 0d732442ef4b..c5a69cc6e12a 100644
--- a/nixos/tests/audit.nix
+++ b/nixos/tests/audit.nix
@@ -31,7 +31,7 @@
   };
 
   testScript = ''
-    machine.wait_for_unit("audit-rules.service")
+    machine.wait_for_unit("audit-rules-nixos.service")
     machine.wait_for_unit("auditd.service")
 
     with subtest("Audit subsystem gets enabled"):
@@ -46,8 +46,8 @@
       machine.succeed("hello")
       print(machine.succeed("ausearch -k nixos-test -sc exit_group"))
 
-    with subtest("Stopping audit-rules.service disables the audit subsystem"):
-      machine.succeed("systemctl stop audit-rules.service")
+    with subtest("Stopping audit-rules-nixos.service disables the audit subsystem"):
+      machine.succeed("systemctl stop audit-rules-nixos.service")
       t.assertIn("enabled 0", machine.succeed("auditctl -s"))
   '';