STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS must be configured to use AppArmor.

DISA Rule

SV-268173r1131154_rule

Vulnerability Number

V-268173

Group Title

SRG-OS-000480-GPOS-00230

Rule Version

ANIX-00-001890

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.
• CCI-001764 - Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.

Weight

10

Fix Recommendation

Configure NixOS to use AppArmor.

Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

security.apparmor.enable = true;

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

A reboot is required for the changes to take effect.

Check Contents

Verify NixOS is configured to use AppArmor with the following command:

$ sudo systemctl status apparmor.service

apparmor.service - Load AppArmor policies
Loaded: loaded (/etc/systemd/system/apparmor.service; enabled; present: enabled)
Active: active (running) since Sat 2022-06-04 02:51:43 UTC; 13min ago

If the "apparmor.service" is not enabled and active, this is a finding.

Vulnerability Number

V-268173

Documentable

False

Rule Version

ANIX-00-001890

Severity Override Guidance

Verify NixOS is configured to use AppArmor with the following command:

$ sudo systemctl status apparmor.service

apparmor.service - Load AppArmor policies
Loaded: loaded (/etc/systemd/system/apparmor.service; enabled; present: enabled)
Active: active (running) since Sat 2022-06-04 02:51:43 UTC; 13min ago

If the "apparmor.service" is not enabled and active, this is a finding.

Check Content Reference

M

Target Key

5658