Check: ANIX-00-001890
Anduril NixOS STIG:
ANIX-00-001890
(in version v1 r1)
Title
NixOS must be configured to use AppArmor. (Cat II impact)
Discussion
Users' home directories/folders may contain information of a sensitive nature. Nonprivileged users should coordinate any sharing of information with a system administrator (SA) through shared resources. Satisfies: SRG-OS-000480-GPOS-00230, SRG-OS-000368-GPOS-00154
Check Content
Verify NixOS is configured to use AppArmor with the following command: $ sudo systemctl status apparmor.service apparmor.service - Load AppArmor policies Loaded: loaded (/etc/systemd/system/apparmor.service; enabled; present: enabled) Active: active (running) since Sat 2022-06-04 02:51:43 UTC; 13min ago If the "apparmor.service" is not enabled and active, this is a finding.
Fix Text
Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix. security.apparmor.enable = true; Rebuild the NixOS configuration with the following command: $ sudo nixos-rebuild switch && reboot
Additional Identifiers
Rule ID: SV-268173r1039407_rule
Vulnerability ID: V-268173
Group Title: SRG-OS-000480-GPOS-00230
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000366 |
Implement the security configuration settings. |
| CCI-001764 |
Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage. |