audit: Disable in containers

This barfs:

Jan 18 12:46:32 machine 522i0x9l80z7gw56iahxjjsdjp0xi10q-audit-start[506]: The audit system is disabled

Changed files
+6 -1
nixos
modules
security
virtualisation
+3 -1
nixos/modules/security/audit.nix
···
config = mkIf (cfg.enable == "lock" || cfg.enable) {
systemd.services.audit = {
-
description = "pseudo-service representing the kernel audit state";
wantedBy = [ "basic.target" ];
path = [ pkgs.audit ];
···
config = mkIf (cfg.enable == "lock" || cfg.enable) {
systemd.services.audit = {
+
description = "Kernel Auditing";
wantedBy = [ "basic.target" ];
+
+
unitConfig.ConditionVirtualization = "!container";
path = [ pkgs.audit ];
+3
nixos/modules/virtualisation/container-config.nix
···
# Shut up warnings about not having a boot loader.
system.build.installBootLoader = "${pkgs.coreutils}/bin/true";
};
}
···
# Shut up warnings about not having a boot loader.
system.build.installBootLoader = "${pkgs.coreutils}/bin/true";
+
# Not supported in systemd-nspawn containers.
+
security.audit.enable = false;
+
};
}