From f063f32450a5f383e9a45667a576bdddfefd212c Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Tue, 9 Sep 2025 16:59:39 +0200 Subject: [PATCH] nixos/auditd: Use new default socket path The default path of the audisp socket was chanegd in https://github.com/linux-audit/audit-userspace/commit/4ade1466f91dad3c33b2d92596ef8385f3bc5571 --- nixos/modules/security/auditd.nix | 2 +- nixos/tests/audit.nix | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/modules/security/auditd.nix b/nixos/modules/security/auditd.nix index 036ce9c01cae..67c661bb4394 100644 --- a/nixos/modules/security/auditd.nix +++ b/nixos/modules/security/auditd.nix @@ -229,7 +229,7 @@ in path = lib.getExe' pkgs.audit "audisp-af_unix"; args = [ "0640" - "/var/run/audispd_events" + "/run/audit/audispd_events" "string" ]; format = "binary"; diff --git a/nixos/tests/audit.nix b/nixos/tests/audit.nix index c5a69cc6e12a..d3fc558aeec8 100644 --- a/nixos/tests/audit.nix +++ b/nixos/tests/audit.nix @@ -40,7 +40,7 @@ t.assertIn("backlog_limit 512", audit_status) with subtest("unix socket plugin activated"): - machine.succeed("stat /var/run/audispd_events") + machine.succeed("stat /run/audit/audispd_events") with subtest("Custom rule produces audit traces"): machine.succeed("hello")