STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS audit system must protect logon UIDs from unauthorized change.

DISA Rule

SV-268119r1131040_rule

Vulnerability Number

V-268119

Group Title

SRG-OS-000058-GPOS-00028

Rule Version

ANIX-00-000610

Severity

CAT II

CCI(s)

• CCI-000163 - Protect audit information from unauthorized modification.
• CCI-000164 - Protect audit information from unauthorized deletion.

Weight

10

Fix Recommendation

Configure NixOS to prevent unauthorized changes to logon UIDs.

Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

security.audit.rules = [
"--loginuid-immutable"
];

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify the audit system prevents unauthorized changes to logon UIDs with the following command:

$ sudo auditctl -s | grep -i immutable

loginuid_immutable 1 locked

If the command does not return "loginuid_immutable 1 locked", this is a finding.

Vulnerability Number

V-268119

Documentable

False

Rule Version

ANIX-00-000610

Severity Override Guidance

Verify the audit system prevents unauthorized changes to logon UIDs with the following command:

$ sudo auditctl -s | grep -i immutable

loginuid_immutable 1 locked

If the command does not return "loginuid_immutable 1 locked", this is a finding.

Check Content Reference

M

Target Key

5658