let
  enable = false;
in
{
  security = {
    auditd.enable = enable;

    audit = {
      inherit enable;

      rules = [
        "-a exit,always -F arch=b64 -S execve"
        "-a exit,always -F arch=b32 -S execve"
      ];
    };
  };
}