STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.

DISA Rule

SV-268181r1131169_rule

Vulnerability Number

V-268181

Group Title

SRG-OS-000480-GPOS-00228

Rule Version

ANIX-00-002180

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure the NixOS operating system to change default file permissions so users may only modify their own files.

Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

security.loginDefs.settings.UMASK = "077";

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify the NixOS operating system defines default file permissions so users may only modify their own files.

$ grep "UMASK" /etc/login.defs

UMASK 077

If the UMASK setting is not present, is commented out, or is less restrictive than 077, this is a finding.

Vulnerability Number

V-268181

Documentable

False

Rule Version

ANIX-00-002180

Severity Override Guidance

Verify the NixOS operating system defines default file permissions so users may only modify their own files.

$ grep "UMASK" /etc/login.defs

UMASK 077

If the UMASK setting is not present, is commented out, or is less restrictive than 077, this is a finding.

Check Content Reference

M

Target Key

5658