93965870a8
auditd creates an ordering cycle by adding wantedBy = [ "basic.target" ], because of this the job job systemd-update-utmp.service/start is deleted. Adding unitConfig.DefaultDependencies = false; to the auditd service unbreaks the cycle. See also #11864
28 lines
649 B
Nix
28 lines
649 B
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
{
|
|
options.security.auditd.enable = mkEnableOption "the Linux Audit daemon";
|
|
|
|
config = mkIf config.security.auditd.enable {
|
|
systemd.services.auditd = {
|
|
description = "Linux Audit daemon";
|
|
wantedBy = [ "basic.target" ];
|
|
|
|
unitConfig = {
|
|
ConditionVirtualization = "!container";
|
|
ConditionSecurity = [ "audit" ];
|
|
DefaultDependencies = false;
|
|
};
|
|
|
|
path = [ pkgs.audit ];
|
|
|
|
serviceConfig = {
|
|
ExecStartPre="${pkgs.coreutils}/bin/mkdir -p /var/log/audit";
|
|
ExecStart = "${pkgs.audit}/bin/auditd -l -n -s nochange";
|
|
};
|
|
};
|
|
};
|
|
}
|