STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS must initiate a session lock after a 10-minute period of inactivity for graphical user logon.

DISA Rule

SV-268086r1130969_rule

Vulnerability Number

V-268086

Group Title

SRG-OS-000029-GPOS-00010

Rule Version

ANIX-00-000110

Severity

CAT II

CCI(s)

CCI-000057 - The information system initiates a session lock after the organization-defined time period of inactivity.

Weight

Fix Recommendation

Configure NixOS to initiate a session lock after a 10-minute period of inactivity for graphical user logon.

Update the NixOS config, typically stored either in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

programs.dconf.profiles.user.databases = with lib.gvariant; lib.mkBefore [
{
settings."org/gnome/desktop/session".idle-delay = (mkUint32 600);
locks = [ "org/gnome/desktop/session/idle-delay" ];
}];
services.logind.extraConfig = ''
IdleAction = lock
IdleActionSec = 600
'';
services.xserver = {
displayManager.gdm.wayland = true;
xautolock = {
enable = true;
time = 10;
locker = "${lib.getExe' config.systemd.package "loginctl"} lock-session";
};
};
};

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify NixOS initiates a session lock after a 10-minute period of inactivity for graphical user logon with the following command:

$ sudo gsettings get org.gnome.desktop.session idle-delay

uint32 600

$ grep "IdleAction" /etc/systemd/logind.conf

IdleAction = lock
IdleActionSec = 600

$ systemctl --user status xautolock.service
xautolock.service - xautolock service
Loaded: loaded (/etc/systemd/user/xautolock.service; enabled; preset: ignored)
Active: active (running) since Wed 2025-03-19 22:56:13 UTC; 6min ago
Invocation: 836d5b6b79444c62aa3c5285e3c8d92e
Main PID: 3233 (xautolock)
Tasks: 1 (limit: 38062)
Memory: 712K (peak: 2.4M)
CPU: 75ms
CGroup: /user.slice/user-1000.slice/user@1000.service/app.slice/xautolock.service
+-3233 /nix/store/4chq53fkkiimbx1qzdbxxs44diiqgj54-xautolock-2.2-7-ga23dd5c/bin/xautolock -noclose -time 10 -locker "/nix/store/w9qcpyhjrxsqrps91wkz8r4mqvg9zrxc-systemd-256.10/bin/loginctl lock-session"

Mar 19 22:56:13 gcs-generic-5-3 systemd[3136]: Started xautolock service.

If "idle-delay" is set to "0" or a value greater than "600", this is a finding.

If "IdleAction" is not "lock" and "IdleActionSec" is not "600", this is a finding.

If the xautolock service is not present or the process line does not contain "-time 10", this is a finding.

Vulnerability Number

V-268086

Documentable

False

Rule Version

ANIX-00-000110

Severity Override Guidance

Check Content Reference

Target Key

5658