Disable Kernel iwlmvm Module

An XCCDF Rule

Description

To configure the system to prevent the iwlmvm kernel module from being loaded, add the following line to the file /etc/modprobe.d/iwlmvm.conf:

install iwlmvm /bin/false

To configure the system to prevent the iwlmvm from being used, add the following line to file /etc/modprobe.d/iwlmvm.conf:

blacklist iwlmvm

Rationale

If Wireless functionality must be disabled, preventing the kernel from loading the kernel module provides an additional safeguard against its activation.

ID: xccdf_org.ssgproject.content_rule_kernel_module_iwlmvm_disabled
Severity: Medium
References: AC-18(3) AC-18(4) AC-18(a) CM-6(a) CM-7(a) CM-7(b) MP-7
Updated: 5 days ago

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if LC_ALL=C grep -q -m 1 "^install iwlmvm" /etc/modprobe.d/iwlmvm.conf ; then
	
	sed -i 's#^install iwlmvm.*#install iwlmvm /bin/false#g' /etc/modprobe.d/iwlmvm.confelse
	echo -e "\n# Disable per security requirements" >> /etc/modprobe.d/iwlmvm.conf
	echo "install iwlmvm /bin/false" >> /etc/modprobe.d/iwlmvm.conf
fi

if ! LC_ALL=C grep -q -m 1 "^blacklist iwlmvm$" /etc/modprobe.d/iwlmvm.conf ; then
	echo "blacklist iwlmvm" >> /etc/modprobe.d/iwlmvm.conf
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-18(3)
  - NIST-800-53-AC-18(4)  - NIST-800-53-AC-18(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - disable_strategy
  - kernel_module_iwlmvm_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure kernel module 'iwlmvm' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/iwlmvm.conf
    regexp: install\s+iwlmvm
    line: install iwlmvm /bin/false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-18(3)
  - NIST-800-53-AC-18(4)
  - NIST-800-53-AC-18(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - disable_strategy
  - kernel_module_iwlmvm_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure kernel module 'iwlmvm' is blacklisted
  lineinfile:
    create: true
    dest: /etc/modprobe.d/iwlmvm.conf
    regexp: ^blacklist iwlmvm$
    line: blacklist iwlmvm
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-18(3)
  - NIST-800-53-AC-18(4)
  - NIST-800-53-AC-18(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - disable_strategy
  - kernel_module_iwlmvm_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20iwlmvm%20/bin/false%0Ablacklist%20iwlmvm%0A
        mode: 0644
        path: /etc/modprobe.d/iwlmvm.conf
        overwrite: true

Disable Kernel iwlmvm Module

Description

Rationale

Remediation - Shell Script

Remediation - Ansible

Remediation - Kubernetes Patch