STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026: STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:SV-279624r1192609_rule
V-279624
SRG-OS-000138-GPOS-00069
NXAC-OS-000194
CAT II
10
1. For AOS, Prism Central, and Files, note that the Nutanix OS is designed and engineered to have all world-writable directories set correctly with the sticky bit set. If the package is missing or not active and running, then some corruption has occurred and the OS must be rebuilt.
2. For AHV, configure all public directories to be owned by root or a system account to prevent unauthorized and unintended information transferred via shared system resources. Set the owner of all public directories as root or a system account by replacing "[Public Directory]" with any directory path not owned by root or a system account.
Set the sticky bit on all world-writable directories by replacing "[World-Writable Directory]" with any directory path missing the sticky bit.
Example command:
$ sudo chown root [Public Directory]
$ sudo chmod 1777 [World-Writable Directory]
1. For AOS, Prism Central, and Files, verify Nutanix OS provides that all public directories are owned by root using the following command.
$ sudo find / -type d \( -perm -0002 -a ! -perm -1000 \) -print 2>/dev/null
drwxrwxrwxt 7 root root 4096 Jul 26 11:19 /tmp
2. Verify AHV is configured so all public directories are owned by root (or a system account) and all world-writable directories have the sticky bit set using the following command.
$ sudo find / -type d -perm -0002 -exec ls -lLd {} \;
drwxrwxrwt. 2 root root 40 Jun 4 15:21 /dev/mqueue
drwxrwxrwt. 2 root root 40 Jun 4 15:21 /dev/shm
drwxrwxrwt. 7 root root 4096 Jul 28 15:37 /tmp
$ sudo find / -type d \( -perm -0002 -a ! -perm -1000 \) -print 2>/dev/null
drwxrwxrwxt 7 root root 4096 Jul 26 11:19 /tmp
If any of the public directories are not owned by root (or a system account) or are not world-writable and do not have the sticky bit set, this is a finding.
V-279624
False
NXAC-OS-000194
1. For AOS, Prism Central, and Files, verify Nutanix OS provides that all public directories are owned by root using the following command.
$ sudo find / -type d \( -perm -0002 -a ! -perm -1000 \) -print 2>/dev/null
drwxrwxrwxt 7 root root 4096 Jul 26 11:19 /tmp
2. Verify AHV is configured so all public directories are owned by root (or a system account) and all world-writable directories have the sticky bit set using the following command.
$ sudo find / -type d -perm -0002 -exec ls -lLd {} \;
drwxrwxrwt. 2 root root 40 Jun 4 15:21 /dev/mqueue
drwxrwxrwt. 2 root root 40 Jun 4 15:21 /dev/shm
drwxrwxrwt. 7 root root 4096 Jul 28 15:37 /tmp
$ sudo find / -type d \( -perm -0002 -a ! -perm -1000 \) -print 2>/dev/null
drwxrwxrwxt 7 root root 4096 Jul 26 11:19 /tmp
If any of the public directories are not owned by root (or a system account) or are not world-writable and do not have the sticky bit set, this is a finding.
M
5730