STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must mount /var/log with secure options.

DISA Rule

SV-279591r1192462_rule

Vulnerability Number

V-279591

Group Title

SRG-OS-000368-GPOS-00154

Rule Version

NXAC-OS-000140

Severity

CAT II

CCI(s)

• CCI-001764 - Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.

Weight

10

Fix Recommendation

Nutanix AOS is designed and engineered to have mount option preconfigured by default and changes are not supported. If any mount options are found, then some corruption has occurred and the CVM must be rebuilt.

Check Contents

For AHV, this requirement is Not Applicable.

Verify in Nutanix OS that the "nodev","nosuid", and "noexec" options are configured for /var/log using the following command.

$ sudo cat /etc/fstab | grep /var/log
/root/filesystems/varlog.bin /var/log ext4 defaults,nodev,nosuid,noexec 0 2

If /var/log is mounted without secure options "nodev", "nosuid", and "noexec", this is a finding.

Vulnerability Number

V-279591

Documentable

False

Rule Version

NXAC-OS-000140

Severity Override Guidance

For AHV, this requirement is Not Applicable.

Verify in Nutanix OS that the "nodev","nosuid", and "noexec" options are configured for /var/log using the following command.

$ sudo cat /etc/fstab | grep /var/log
/root/filesystems/varlog.bin /var/log ext4 defaults,nodev,nosuid,noexec 0 2

If /var/log is mounted without secure options "nodev", "nosuid", and "noexec", this is a finding.

Check Content Reference

M

Target Key

5730