1{den, ...}: {
 2  den.aspects.core.security.includes = [den.aspects.core.security.audit];
 3  den.aspects.core.security.audit = {
 4    nixos = {
 5      security.auditd.enable = true;
 6
 7      security.audit = {
 8        enable = true;
 9        rules = [
10          "-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change"
11          "-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change"
12          "-a always,exit -F arch=b64 -S clock_settime -k time-change"
13          "-a always,exit -F arch=b32 -S clock_settime -k time-change"
14          "-w /etc/localtime -p wa -k time-change"
15
16          "-w /etc/group -p wa -k identity"
17          "-w /etc/passwd -p wa -k identity"
18
19          "-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale"
20          "-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale"
21          "-w /etc/issue -p wa -k system-locale"
22          "-w /etc/issue.net -p wa -k system-locale"
23          "-w /etc/hosts -p wa -k system-locale"
24          "-w /etc/hostname -p wa -k system-locale"
25
26          "-w /etc/apparmor/ -p wa -k MAC-policy"
27          "-w /etc/apparmor.d/ -p wa -k MAC-policy"
28
29          "-w /var/log/wtmp -p wa -k logins"
30          "-w /var/log/btmp -p wa -k logins"
31
32          "-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod"
33          "-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod"
34          "-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod"
35          "-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod"
36          "-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod"
37          "-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod"
38
39          "-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access"
40          "-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access"
41          "-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access"
42          "-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access"
43
44          "-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts"
45          "-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts"
46
47          "-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete"
48          "-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete"
49
50          "-w /etc/sudoers -p wa -k scope"
51          "-w /etc/sudoers.d/ -p wa -k scope"
52
53          "-a always,exit -F arch=b64 -S execve -F uid=0 -F auid>=1000 -F auid!=4294967295 -k actions"
54          "-a always,exit -F arch=b32 -S execve -F uid=0 -F auid>=1000 -F auid!=4294967295 -k actions"
55
56          "-a always,exit -F arch=b64 -S init_module -S delete_module -k modules"
57          "-a always,exit -F arch=b32 -S init_module -S delete_module -k modules"
58        ];
59      };
60    };
61  };
62}