STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS must prohibit user installation of system software without explicit privileged status.

DISA Rule

SV-268152r1131105_rule

Vulnerability Number

V-268152

Group Title

SRG-OS-000362-GPOS-00149

Rule Version

ANIX-00-001450

Severity

CAT II

CCI(s)

• CCI-003980 - Allow user installation of software only with explicit privileged status.

Weight

10

Fix Recommendation

Configure NixOS to prevent unauthorized users from using nix.

Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

nix.settings.allowed-users = [ "root" "@wheel" ];

Note: Extra usergroups may be permitted by adding them with the format "@group" (e.g.: "@users").

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify NixOS prevents unauthorized users from using nix with the following command:

$ grep -R allowed-users /etc/nixos/

/etc/nixos/configuration.nix:nix.settings.allowed-users = [ "root" "@wheel" ];

If any other groups or users are included in "nix.settings.allowed-users" other than "root" and "wheel", or the configuration setting does not exist, this is a finding.

Vulnerability Number

V-268152

Documentable

False

Rule Version

ANIX-00-001450

Severity Override Guidance

Verify NixOS prevents unauthorized users from using nix with the following command:

$ grep -R allowed-users /etc/nixos/

/etc/nixos/configuration.nix:nix.settings.allowed-users = [ "root" "@wheel" ];

If any other groups or users are included in "nix.settings.allowed-users" other than "root" and "wheel", or the configuration setting does not exist, this is a finding.

Check Content Reference

M

Target Key

5658