anchor.diff:  
   let
     cfg = config.security.audit;
  +  enabled = cfg.enable == "lock" || cfg.enable;
   
     failureModes = {
       silent = 0;
       printk = 1;
       panic  = 2;
     };
  +
  +  disableScript = pkgs.writeScript "audit-disable" ''
  +    #!${pkgs.stdenv.shell} -eu
  +    # Explicitly disable everything, as otherwise journald might start it.
  +    auditctl -D
  +    auditctl -e 0 -a task,never
  +  '';
   
     # TODO: it seems like people like their rules to be somewhat secret, yet they will not be if
     # put in the store like this. At the same time, it doesn't feel like a huge deal and working
  
positive.code:     };
    };
  
    config = mkIf (cfg.enable == "lock" || cfg.enable) {
      systemd.services.audit = {
        description = "Kernel Auditing";
        wantedBy = [ "basic.target" ];
  
negative.code:       serviceConfig = {
          Type = "oneshot";
          RemainAfterExit = true;
          ExecStart = "@${if enabled then startScript else disableScript} audit-start";
          ExecStop  = "@${stopScript} audit-stop";
        };
      };
    };
  