mirror of
https://github.com/NixOS/nixpkgs.git
synced 2025-11-10 17:54:53 +01:00
439d68b58d
Makes the audit module responsible for setting up the audit subsystem of the kernel. The auditd module is now only responsible for setting up the daemon. Enable the audit subsystem early via kernelParams. Increase the default audit backlog limit so that it works out of the box for a normal system. Remove a superfluous and pointless test case.
55 lines
1.5 KiB
Nix
55 lines
1.5 KiB
Nix
{ lib, ... }:
|
|
{
|
|
|
|
name = "audit";
|
|
|
|
meta = {
|
|
maintainers = with lib.maintainers; [ grimmauld ];
|
|
};
|
|
|
|
nodes = {
|
|
machine =
|
|
{ lib, pkgs, ... }:
|
|
{
|
|
security.audit = {
|
|
enable = true;
|
|
rules = [
|
|
"-a always,exit -F exe=${lib.getExe pkgs.hello} -k nixos-test"
|
|
];
|
|
backlogLimit = 512;
|
|
};
|
|
security.auditd = {
|
|
enable = true;
|
|
plugins.af_unix.active = true;
|
|
plugins.syslog.active = true;
|
|
# plugins.remote.active = true; # needs configuring a remote server for logging
|
|
# plugins.filter.active = true; # needs configuring allowlist/denylist
|
|
};
|
|
|
|
environment.systemPackages = [ pkgs.hello ];
|
|
};
|
|
};
|
|
|
|
testScript = ''
|
|
machine.wait_for_unit("audit-rules.service")
|
|
machine.wait_for_unit("auditd.service")
|
|
|
|
with subtest("Audit subsystem gets enabled"):
|
|
audit_status = machine.succeed("auditctl -s")
|
|
t.assertIn("enabled 1", audit_status)
|
|
t.assertIn("backlog_limit 512", audit_status)
|
|
|
|
with subtest("unix socket plugin activated"):
|
|
machine.succeed("stat /var/run/audispd_events")
|
|
|
|
with subtest("Custom rule produces audit traces"):
|
|
machine.succeed("hello")
|
|
print(machine.succeed("ausearch -k nixos-test -sc exit_group"))
|
|
|
|
with subtest("Stopping audit-rules.service disables the audit subsystem"):
|
|
machine.succeed("systemctl stop audit-rules.service")
|
|
t.assertIn("enabled 0", machine.succeed("auditctl -s"))
|
|
'';
|
|
|
|
}
|