modules/security/audit.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14

{
  security = {
    auditd.enable = true;

    audit = {
      enable = true;

      rules = [
        "-a exit,always -F arch=b64 -S execve"
        "-a exit,always -F arch=b32 -S execve"
      ];
    };
  };
}