STIGQter STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS audit log directory must have a mode of 0700 or less permissive.

DISA Rule

SV-268113r1039227_rule

Vulnerability Number

V-268113

Group Title

SRG-OS-000057-GPOS-00027

Rule Version

ANIX-00-000550

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the audit log directory to have a mode of "0700" or less permissive.

Using the path of the directory containing the audit logs, configure the audit log directory to have a mode of "0700" or less permissive by using the following command:

$ sudo chmod 0700 /var/log/audit

Check Contents

Verify that the audit log directory has a mode of "0700" or less permissive.

First, determine where the audit logs are stored with the following command:

$ sudo grep log_file /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log

Using the path of the directory containing the audit logs, check if the audit log directory has a mode of "0700" or less by using the following command:

$ sudo find /var/log/audit -type d -exec stat -c "%a %n" {} \;
700 /var/log/audit

If the audit log directory (or any subfolders) has a mode more permissive than "0700", this is a finding.

Vulnerability Number

V-268113

Documentable

False

Rule Version

ANIX-00-000550

Severity Override Guidance

Verify that the audit log directory has a mode of "0700" or less permissive.

First, determine where the audit logs are stored with the following command:

$ sudo grep log_file /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log

Using the path of the directory containing the audit logs, check if the audit log directory has a mode of "0700" or less by using the following command:

$ sudo find /var/log/audit -type d -exec stat -c "%a %n" {} \;
700 /var/log/audit

If the audit log directory (or any subfolders) has a mode more permissive than "0700", this is a finding.

Check Content Reference

M

Target Key

5658