Dawoox/nixpkgs
1
1
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

nixos/audit: rename service to audit-rules-nixos to avoid collisions with the upstream unit

Browse Source
This commit is contained in:
Grimmauld
2025-09-11 09:50:00 +02:00
parent c98add0012
commit 1884f0fa52
2 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
nixos/modules/security/audit.nix
View File

@@ -95,7 +95,10 @@ in
environment.systemPackages = [ pkgs.audit ];
systemd.services.audit-rules = {
# upstream contains a audit-rules.service, which uses augenrules.
# That script does not handle cleanup correctly and insists on loading from /etc/audit.
# So, instead we have our own service for loading rules.
systemd.services.audit-rules-nixos = {
description = "Load Audit Rules";
wantedBy = [ "sysinit.target" ];
before = [

6
nixos/tests/audit.nix
View File

@@ -31,7 +31,7 @@
};
testScript = ''
machine.wait_for_unit("audit-rules.service")
machine.wait_for_unit("audit-rules-nixos.service")
machine.wait_for_unit("auditd.service")
with subtest("Audit subsystem gets enabled"):
@@ -46,8 +46,8 @@
machine.succeed("hello")
print(machine.succeed("ausearch -k nixos-test -sc exit_group"))
with subtest("Stopping audit-rules.service disables the audit subsystem"):
machine.succeed("systemctl stop audit-rules.service")
with subtest("Stopping audit-rules-nixos.service disables the audit subsystem"):
machine.succeed("systemctl stop audit-rules-nixos.service")
t.assertIn("enabled 0", machine.succeed("auditctl -s"))
'';