STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS audit daemon must generate logs that are group-owned by root.

DISA Rule

SV-268110r1131025_rule

Vulnerability Number

V-268110

Group Title

SRG-OS-000057-GPOS-00027

Rule Version

ANIX-00-000520

Severity

CAT II

CCI(s)

• CCI-000162 - Protect audit information from unauthorized access.
• CCI-001314 - Reveal error messages only to organization-defined personnel or roles.

Weight

10

Fix Recommendation

Configure the audit daemon to generate logs that are group-owned by root.

Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

environment.etc."audit/auditd.conf".text = [
''
log_group = root
''
];

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify the audit daemon is configured to generate logs that are group-owned by root with the following command:

$ sudo grep log_group /etc/audit/auditd.conf

log_group = root

If the audit daemon is not configured to generate logs that are group-owned by "root", this is a finding.

Vulnerability Number

V-268110

Documentable

False

Rule Version

ANIX-00-000520

Severity Override Guidance

Verify the audit daemon is configured to generate logs that are group-owned by root with the following command:

$ sudo grep log_group /etc/audit/auditd.conf

log_group = root

If the audit daemon is not configured to generate logs that are group-owned by "root", this is a finding.

Check Content Reference

M

Target Key

5658