STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must provide audit record generation for successful and unsuccessful attempts to move, remove, or delete files and directories.

DISA Rule

SV-279553r1192405_rule

Vulnerability Number

V-279553

Group Title

SRG-OS-000062-GPOS-00031

Rule Version

NXAC-OS-000047

Severity

CAT II

CCI(s)

CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.

Weight

Fix Recommendation

Configure the OS to generate audit records for successful/unsuccessful attempts to use the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls by using the following command to check the file system rules in "/etc/audit/audit.rules".

1. For AOS, configure the audit rules.

$ sudo salt-call state.sls security/CVM/auditCVM

2. For Prism Central, configure the audit rules.

$ sudo salt-call state.sls security/PCVM/auditPCVM

3. For Files, configure the audit rules.

$ sudo salt-call state.sls security/AFS/auditAFS

4. For AHV, configure the audit rules.

$ sudo salt-call state.sls security/KVM/auditKVM

Check Contents

Verify Nutanix OS generates an audit record upon successful/unsuccessful attempts to use the "rename", "unlink", "rmdir", "renameat", and "unlinkat" system calls by using the following commands to check the file system rules in "/etc/audit/audit.rules" using the following commands.

$ sudo grep -w "\-S mount" /etc/audit/audit.rules
-a always,exit -F arch=b64 -S mount -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S mount -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete

$ sudo grep -w "rename" /etc/audit/audit.rules
-a always,exit -F arch=b64 -S rename -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b64 -S rename -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S rename -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete

$ sudo grep -w "renameat" /etc/audit/audit.rules
-a always,exit -F arch=b64 -S renameat -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b64 -S renameat -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S renameat -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S renameat -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete

$ sudo grep -w "rmdir" /etc/audit/audit.rules
-a always,exit -F arch=b64 -S rmdir -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b64 -S rmdir -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S rmdir -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S rmdir -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete

$ sudo grep -w "unlink" /etc/audit/audit.rules
-a always,exit -F arch=b64 -S unlink -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b64 -S unlink -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S unlink -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S unlink -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete

$ sudo grep -w "unlinkat" /etc/audit/audit.rules
-a always,exit -F arch=b64 -S unlinkat -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b64 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S unlinkat -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete

$ sudo grep -w chown /etc/audit/audit.rules
-a always,exit -F arch=b64 -S chown -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S chown -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete

$ sudo grep -w chmod /etc/audit/audit.rules
-a always,exit -F arch=b64 -S chmod -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S chmod -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete

$ sudo grep -w lchown /etc/audit/audit.rules
-a always,exit -F arch=b64 -S lchown -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S lchown -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete

$ sudo grep -w fchownat /etc/audit/audit.rules
-a always,exit -F arch=b64 -S fchownat -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S fchownat -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete

$ sudo grep -w fchown /etc/audit/audit.rules
-a always,exit -F arch=b64 -S fchown -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S fchown -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete

$ sudo grep -w fchmodat /etc/audit/audit.rules
-a always,exit -F arch=b64 -S fchmodat -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S fchmodat -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete

$ sudo grep -w fchmod /etc/audit/audit.rules
-a always,exit -F arch=b64 -S fchmod -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S fchmod -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete

If the commands do not return the appropriate response line as indicated above, or if the lines are commented out, this is a finding.

Nutanix OS must provide audit record generation for successful and unsuccessful attempts to move, remove, or delete files and directories.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key