Something went wrong. Try again.
What happens if I push all of nixpkgs
Something went wrong. Try again.
Nix
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116{ config, lib, pkgs, ...}:let cfg = config.security.audit;
failureModes = { silent = 0; printk = 1; panic = 2; };
# The order of the fixed rules is determined by augenrules(8) rules = pkgs.writeTextDir "audit.rules" '' -D -b ${toString cfg.backlogLimit} -f ${toString failureModes.${cfg.failureMode}} -r ${toString cfg.rateLimit} ${lib.concatLines cfg.rules} -e ${if cfg.enable == "lock" then "2" else "1"} '';in{ options = { security.audit = { enable = lib.mkOption { type = lib.types.enum [ false true "lock" ]; default = false; description = '' Whether to enable the Linux audit system. The special `lock` value can be used to enable auditing and prevent disabling it until a restart. Be careful about locking this, as it will prevent you from changing your audit configuration until you restart. If possible, test your configuration using build-vm beforehand. ''; };
failureMode = lib.mkOption { type = lib.types.enum [ "silent" "printk" "panic" ]; default = "printk"; description = "How to handle critical errors in the auditing system"; };
backlogLimit = lib.mkOption { type = lib.types.int; default = 64; # Apparently the kernel default description = '' The maximum number of outstanding audit buffers allowed; exceeding this is considered a failure and handled in a manner specified by failureMode. ''; };
rateLimit = lib.mkOption { type = lib.types.int; default = 0; description = '' The maximum messages per second permitted before triggering a failure as specified by failureMode. Setting it to zero disables the limit. ''; };
rules = lib.mkOption { type = lib.types.listOf lib.types.str; # (types.either types.str (types.submodule rule)); default = [ ]; example = [ "-a exit,always -F arch=b64 -S execve" ]; description = '' The ordered audit rules, with each string appearing as one line of the audit.rules file. ''; }; }; };
config = lib.mkIf (cfg.enable == "lock" || cfg.enable) { systemd.services.audit-rules = { description = "Load Audit Rules"; wantedBy = [ "sysinit.target" ]; before = [ "sysinit.target" "shutdown.target" ]; conflicts = [ "shutdown.target" ];
unitConfig = { DefaultDependencies = false; ConditionVirtualization = "!container"; ConditionKernelCommandLine = [ "!audit=0" "!audit=off" ]; };
serviceConfig = { Type = "oneshot"; RemainAfterExit = true; ExecStart = "${lib.getExe' pkgs.audit "auditctl"} -R ${rules}/audit.rules"; ExecStopPost = [ # Disable auditing "${lib.getExe' pkgs.audit "auditctl"} -e 0" # Delete all rules "${lib.getExe' pkgs.audit "auditctl"} -D" ]; }; }; };}