modules/pc/security/audit.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

let
  enable = false;
in
{
  security = {
    auditd.enable = enable;

    audit = {
      inherit enable;

      rules = [
        "-a exit,always -F arch=b64 -S execve"
        "-a exit,always -F arch=b32 -S execve"
      ];
    };
  };
}