From: Cristian Rodríguez Subject: If the audit subsystem is disabled in the cmdline, do not start service Date: Fri Aug 15 14:17:53 UTC 2014 Upstream: Not yet , submitted Aug 14 2014 Signed-Off-by: Cristian Rodríguez If the system is booted with audit=0 in the kernel command line the service must not be started as the audit subsystem is permanently disabled until next boot. --- audit-2.3.6.orig/init.d/auditd.service +++ audit-2.3.6/init.d/auditd.service @@ -4,6 +4,7 @@ DefaultDependencies=no After=local-fs.target Conflicts=shutdown.target Before=sysinit.target shutdown.target +ConditionKernelCommandLine=!audit=0 [Service] ExecStart=/sbin/auditd -n