STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon.

DISA Rule

SV-268093r1130988_rule

Vulnerability Number

V-268093

Group Title

SRG-OS-000042-GPOS-00020

Rule Version

ANIX-00-000260

Severity

CAT II

CCI(s)

• CCI-000135 - Generate audit records containing the organization-defined additional information that is to be included in the audit records.
• CCI-001849 - Allocate audit log storage capacity to accommodate organization-defined audit record retention requirements.

Weight

10

Fix Recommendation

Configure NixOS to allocate sufficient audit_backlog_limit to capture processes that start prior to the audit daemon.

Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

boot.kernelParams = [
"audit_backlog_limit=8192"
];
security.audit.backlogLimit = 8192;

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify NixOS allocates a sufficient audit_backlog_limit to capture processes that start prior to the audit daemon with the following command:

$ sudo auditctl -s | grep backlog_limit

backlog_limit 8192

If the "backlog_limit" entry does not equal "8192" or greater or is missing, this is a finding.

Vulnerability Number

V-268093

Documentable

False

Rule Version

ANIX-00-000260

Severity Override Guidance

Verify NixOS allocates a sufficient audit_backlog_limit to capture processes that start prior to the audit daemon with the following command:

$ sudo auditctl -s | grep backlog_limit

backlog_limit 8192

If the "backlog_limit" entry does not equal "8192" or greater or is missing, this is a finding.

Check Content Reference

M

Target Key

5658