1 2 3 4 5 6 7 8 9 10
{ security = { auditd.enable = true; audit = { enable = true; rules = [ "-a exit,always -F arch=b64 -S execve" ]; }; }; }