From 7d5e1d984bc04f1b13695fbe9ced102ef9bb980e Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Thu, 11 Sep 2025 10:02:44 +0200
Subject: [PATCH] nixos/auditd: use upstream unit

---
 nixos/modules/security/auditd.nix | 44 +++++++++----------------------
 1 file changed, 13 insertions(+), 31 deletions(-)

diff --git a/nixos/modules/security/auditd.nix b/nixos/modules/security/auditd.nix
index 67c661bb4394..49a99ea30354 100644
--- a/nixos/modules/security/auditd.nix
+++ b/nixos/modules/security/auditd.nix
@@ -256,41 +256,23 @@ in
       };
     };
 
-    systemd.services.auditd = {
-      description = "Security Audit Logging Service";
-      documentation = [ "man:auditd(8)" ];
-      wantedBy = [ "sysinit.target" ];
-      after = [
-        "local-fs.target"
-        "systemd-tmpfiles-setup.service"
-      ];
-      before = [
-        "sysinit.target"
-        "shutdown.target"
-      ];
-      conflicts = [ "shutdown.target" ];
+    systemd.tmpfiles.packages = [ pkgs.audit.out ];
+    systemd.packages = [ pkgs.audit.out ];
 
-      unitConfig = {
-        DefaultDependencies = false;
-        RefuseManualStop = true;
-        ConditionVirtualization = "!container";
-        ConditionKernelCommandLine = [
-          "!audit=0"
-          "!audit=off"
-        ];
-      };
+    # will try to look in /etc for rules to load, which we don't set up
+    systemd.services.audit-rules.enable = lib.mkDefault false;
+
+    systemd.services.auditd = {
+      wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
         LogsDirectory = "audit";
-        ExecStart = "${pkgs.audit}/bin/auditd -l -n -s nochange";
-        Restart = "on-failure";
-        # Do not restart for intentional exits. See EXIT CODES section in auditd(8).
-        RestartPreventExitStatus = "2 4 6";
-
-        # Upstream hardening settings
-        MemoryDenyWriteExecute = true;
-        LockPersonality = true;
-        RestrictRealtime = true;
+        RuntimeDirectory = "audit";
+        ExecStart = [
+          # the upstream unit does not allow symlinks, so clear and rewrite the ExecStart
+          ""
+          "${lib.getExe' pkgs.audit "auditd"} -l -s nochange"
+        ];
       };
     };
   };