talexander/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Releases Activity

nixos/tests/audit: test plugins

Browse Source
This commit is contained in:
Grimmauld 2025-06-25 23:27:02 +02:00
parent ee774bb624
commit 916d8b65cf
No known key found for this signature in database
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
nixos/tests/audit.nix
View File

@ -12,7 +12,13 @@
"-a always,exit -F exe=${lib.getExe pkgs.hello} -k nixos-test"
];
};
security.auditd.enable = true;
security.auditd = {
enable = true;
plugins.af_unix.active = true;
plugins.syslog.active = true;
# plugins.remote.active = true; # needs configuring a remote server for logging
# plugins.filter.active = true; # needs configuring allowlist/denylist
};
environment.systemPackages = [ pkgs.hello ];
};
@ -25,6 +31,9 @@
with subtest("Audit subsystem gets enabled"):
assert "enabled 1" in machine.succeed("auditctl -s")
with subtest("unix socket plugin activated"):
machine.succeed("stat /var/run/audispd_events")
with subtest("Custom rule produces audit traces"):
machine.succeed("hello")
print(machine.succeed("ausearch -k nixos-test -sc exit_group"))