STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must enable kernel parameters to enforce discretionary access control on symlinks.

DISA Rule

SV-279544r1192057_rule

Vulnerability Number

V-279544

Group Title

SRG-OS-000312-GPOS-00123

Rule Version

NXAC-OS-000027

Severity

CAT II

CCI(s)

• CCI-002165 - Enforce organization-defined discretionary access control policies over defined subjects and objects.
• CCI-002235 - Prevent non-privileged users from executing privileged functions.

Weight

10

Fix Recommendation

1. Nutanix AOS, Prism Central, and Files OS VMs are designed and engineered to have DAC-enabled symlinks by default. If the DAC symlinks setting is missing or not active and running, then some corruption has occurred and the OS must be rebuilt.

2. Configure Nutanix AHV to allow operating system admins to pass information to other operating system admins or users adding or modifying the following line in the system configuration file /etc/syscrl.d/:

fs.protected_symlinks = 1

3. After adding the changes, load settings from all system configuration files using the following command.

$ sudo sysctl --system

Check Contents

1. Verify Nutanix AOS enables DAC on symlinks using the following command.

$ sudo sysctl fs.protected_symlinks
fs.protected_symlinks = 1

2. Verify that the configuration files are present to enable this kernel parameter using the following command.

$ sudo grep -r fs.protected_symlinks /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf /etc.sysctl.conf
/usr/lib/sysctl.d/50-default.conf:fs.protected_symlinks = 1
/lib/sysctl.d/50-default.conf:fs.protected_symlinks = 1

If "fs.protected_symlinks" is not set to "1", is missing or commented out, this is a finding.

Vulnerability Number

V-279544

Documentable

False

Rule Version

NXAC-OS-000027

Severity Override Guidance

1. Verify Nutanix AOS enables DAC on symlinks using the following command.

$ sudo sysctl fs.protected_symlinks
fs.protected_symlinks = 1

2. Verify that the configuration files are present to enable this kernel parameter using the following command.

$ sudo grep -r fs.protected_symlinks /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf /etc.sysctl.conf
/usr/lib/sysctl.d/50-default.conf:fs.protected_symlinks = 1
/lib/sysctl.d/50-default.conf:fs.protected_symlinks = 1

If "fs.protected_symlinks" is not set to "1", is missing or commented out, this is a finding.

Check Content Reference

M

Target Key

5730