STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

A sticky bit must be set on all NixOS public directories to prevent unauthorized and unintended information transferred via shared system resources.

DISA Rule

SV-268140r1117267_rule

Vulnerability Number

V-268140

Group Title

SRG-OS-000138-GPOS-00069

Rule Version

ANIX-00-000970

Severity

CAT II

CCI(s)

• CCI-001090 - Prevent unauthorized and unintended information transfer via shared system resources.

Weight

10

Fix Recommendation

Configure all public directories to have the sticky bit set to prevent unauthorized and unintended information transferred via shared system resources.

Set the sticky bit on all public directories using the following command, replacing "[Public Directory]" with any directory path missing the sticky bit:

$ sudo chmod +t [Public Directory]

Check Contents

Verify NixOS is configured with the sticky bit on world-writable directories with the following command:

$ sudo find / -type d \( -perm -0002 -a ! -perm -1000 \) -print 2>/dev/null

If any of the returned directories are world-writable and do not have the sticky bit set, this is a finding.

Vulnerability Number

V-268140

Documentable

False

Rule Version

ANIX-00-000970

Severity Override Guidance

Verify NixOS is configured with the sticky bit on world-writable directories with the following command:

$ sudo find / -type d \( -perm -0002 -a ! -perm -1000 \) -print 2>/dev/null

If any of the returned directories are world-writable and do not have the sticky bit set, this is a finding.

Check Content Reference

M

Target Key

5658