STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must enable kernel parameters to enforce Discretionary Access Control (DAC) on hardlinks.

DISA Rule

SV-279543r1192595_rule

Vulnerability Number

V-279543

Group Title

SRG-OS-000312-GPOS-00122

Rule Version

NXAC-OS-000024

Severity

CAT II

CCI(s)

• CCI-002165 - Enforce organization-defined discretionary access control policies over defined subjects and objects.
• CCI-002235 - Prevent non-privileged users from executing privileged functions.

Weight

10

Fix Recommendation

Nutanix AOS, Prism Central, and Files OS VMs are designed and engineered to have DAC-enabled hardlinks by default. If the DAC hardlinks setting is missing or not active and running, then some corruption has occurred and the OS must be rebuilt.

1. Configure Nutanix AHV to allow operating system admins to pass information to other operating system admins or users by adding or modifying the following line in the system configuration file /etc/syscrl.d/:

fs.protected_hardlinks = 1

2. After adding the changes, load settings from all system configuration files using the following command.

$ sudo sysctl --system

Check Contents

1. Verify "fs.protected_hardlinks" is set to "1" using the following command.

$ sudo sysctl fs.protected_hardlinks
fs.protected_hardlinks = 1

2. Verify the configuration files are present to enable this kernel parameter using the following command.

$ sudo grep -r fs.protected_hardlinks /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf /etc.sysctl.conf
/usr/lib/sysctl.d/50-default.conf:fs.protected_hardlinks = 1
/lib/sysctl.d/50-default.conf:fs.protected_hardlinks = 1

If "fs.protected_hardlinks" is not set to "1" or is commented out or missing, this is a finding.

Vulnerability Number

V-279543

Documentable

False

Rule Version

NXAC-OS-000024

Severity Override Guidance

1. Verify "fs.protected_hardlinks" is set to "1" using the following command.

$ sudo sysctl fs.protected_hardlinks
fs.protected_hardlinks = 1

2. Verify the configuration files are present to enable this kernel parameter using the following command.

$ sudo grep -r fs.protected_hardlinks /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf /etc.sysctl.conf
/usr/lib/sysctl.d/50-default.conf:fs.protected_hardlinks = 1
/lib/sysctl.d/50-default.conf:fs.protected_hardlinks = 1

If "fs.protected_hardlinks" is not set to "1" or is commented out or missing, this is a finding.

Check Content Reference

M

Target Key

5730