anchor.diff:        serviceConfig = {
           Type = "oneshot";
           RemainAfterExit = true;
  -        ExecStart = "@${startScript} audit-start";
  -        ExecStop  = "@${stopScript}  audit-stop";
  +        ExecStart = "@${if enabled then startScript else disableScript} audit-start";
  +        ExecStop  = "@${stopScript} audit-stop";
         };
       };
     };
  
positive.code:     };
    };
  
    config = mkIf (cfg.enable == "lock" || cfg.enable) {
      systemd.services.audit = {
        description = "Kernel Auditing";
        wantedBy = [ "basic.target" ];
  
negative.code: 
  let
    cfg = config.security.audit;
    enabled = cfg.enable == "lock" || cfg.enable;
  
    failureModes = {
      silent = 0;
      printk = 1;
      panic  = 2;
    };
  
    disableScript = pkgs.writeScript "audit-disable" ''
      #!${pkgs.stdenv.shell} -eu
      # Explicitly disable everything, as otherwise journald might start it.
      auditctl -D
      auditctl -e 0 -a task,never
    '';
  
    # TODO: it seems like people like their rules to be somewhat secret, yet they will not be if
    # put in the store like this. At the same time, it doesn't feel like a huge deal and working
  