···

       
93
       
 
       


     

       
94
       
 
       
  config = mkIf (cfg.enable == "lock" || cfg.enable) {

     

       
95
       
 
       
    systemd.services.audit = {

     

       
96
       
-
       
      description = "pseudo-service representing the kernel audit state";

     

       
97
       
 
       
      wantedBy = [ "basic.target" ];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
98
       
 
       


     

       
99
       
 
       
      path = [ pkgs.audit ];

     

       
100
       
 
       


     

···

       
93
       
 
       


     

       
94
       
 
       
  config = mkIf (cfg.enable == "lock" || cfg.enable) {

     

       
95
       
 
       
    systemd.services.audit = {

     

       
96
       
+
       
      description = "Kernel Auditing";

     

       
97
       
 
       
      wantedBy = [ "basic.target" ];

     

       
98
       
+
       


     

       
99
       
+
       
      unitConfig.ConditionVirtualization = "!container";

     

       
100
       
 
       


     

       
101
       
 
       
      path = [ pkgs.audit ];

     

       
102
       
 
       


     

···

       
19
       
 
       
    # Shut up warnings about not having a boot loader.

     

       
20
       
 
       
    system.build.installBootLoader = "${pkgs.coreutils}/bin/true";

     

       
21
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
22
       
 
       
  };

     

       
23
       
 
       


     

       
24
       
 
       
}

     

···

       
19
       
 
       
    # Shut up warnings about not having a boot loader.

     

       
20
       
 
       
    system.build.installBootLoader = "${pkgs.coreutils}/bin/true";

     

       
21
       
 
       


     

       
22
       
+
       
    # Not supported in systemd-nspawn containers.

     

       
23
       
+
       
    security.audit.enable = false;

     

       
24
       
+
       


     

       
25
       
 
       
  };

     

       
26
       
 
       


     

       
27
       
 
       
}