STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS must enable auditing of processes that start prior to the audit daemon.

DISA Rule

SV-268092r1130985_rule

Vulnerability Number

V-268092

Group Title

SRG-OS-000042-GPOS-00020

Rule Version

ANIX-00-000250

Severity

CAT II

CCI(s)

• CCI-000135 - Generate audit records containing the organization-defined additional information that is to be included in the audit records.

Weight

10

Fix Recommendation

Configure NixOS to audit processes that start prior to the audit daemon.

Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

boot.kernelParams = [
"audit=1"
];

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify NixOS enables auditing of processes that start prior to the audit daemon with the following command:

$ grep audit=1 /proc/cmdline

BOOT_IMAGE=(hd0,msdos1)/nix/store/glc0midc78caq9sc7pzciymx4c3in7kn-linux-6.1.64/bzImage init=/nix/store/grl4baymr9q60mbcz3sidm4agckn3bx5-nixos-system-nixos-23.1.1.20231129.057f9ae/init audit=1 loglevel=4

If the "audit" entry does not equal "1" or is missing, this is a finding.

Vulnerability Number

V-268092

Documentable

False

Rule Version

ANIX-00-000250

Severity Override Guidance

Verify NixOS enables auditing of processes that start prior to the audit daemon with the following command:

$ grep audit=1 /proc/cmdline

BOOT_IMAGE=(hd0,msdos1)/nix/store/glc0midc78caq9sc7pzciymx4c3in7kn-linux-6.1.64/bzImage init=/nix/store/grl4baymr9q60mbcz3sidm4agckn3bx5-nixos-system-nixos-23.1.1.20231129.057f9ae/init audit=1 loglevel=4

If the "audit" entry does not equal "1" or is missing, this is a finding.

Check Content Reference

M

Target Key

5658