56 lines
1.4 KiB
Nix
56 lines
1.4 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
|
|
{
|
|
options.security.auditd.enable = lib.mkEnableOption "the Linux Audit daemon";
|
|
|
|
config = lib.mkIf config.security.auditd.enable {
|
|
# Starting auditd should also enable loading the audit rules..
|
|
security.audit.enable = lib.mkDefault true;
|
|
|
|
environment.systemPackages = [ pkgs.audit ];
|
|
|
|
systemd.services.auditd = {
|
|
description = "Security Audit Logging Service";
|
|
documentation = [ "man:auditd(8)" ];
|
|
wantedBy = [ "sysinit.target" ];
|
|
after = [
|
|
"local-fs.target"
|
|
"systemd-tmpfiles-setup.service"
|
|
];
|
|
before = [
|
|
"sysinit.target"
|
|
"shutdown.target"
|
|
];
|
|
conflicts = [ "shutdown.target" ];
|
|
|
|
unitConfig = {
|
|
DefaultDependencies = false;
|
|
RefuseManualStop = true;
|
|
ConditionVirtualization = "!container";
|
|
ConditionKernelCommandLine = [
|
|
"!audit=0"
|
|
"!audit=off"
|
|
];
|
|
};
|
|
|
|
serviceConfig = {
|
|
LogsDirectory = "audit";
|
|
ExecStart = "${pkgs.audit}/bin/auditd -l -n -s nochange";
|
|
Restart = "on-failure";
|
|
# Do not restart for intentional exits. See EXIT CODES section in auditd(8).
|
|
RestartPreventExitStatus = "2 4 6";
|
|
|
|
# Upstream hardening settings
|
|
MemoryDenyWriteExecute = true;
|
|
LockPersonality = true;
|
|
RestrictRealtime = true;
|
|
};
|
|
};
|
|
};
|
|
}
|