Skip to content
ATO Pathways
  Log In

Disable Kernel mac80211 Module

An XCCDF Rule

Description

To configure the system to prevent the mac80211 kernel module from being loaded, add the following line to the file /etc/modprobe.d/mac80211.conf: 

install mac80211 /bin/true
To configure the system to prevent the mac80211 from being used, add the following line to file /etc/modprobe.d/mac80211.conf: 
blacklist mac80211

Rationale

If Wireless functionality must be disabled, preventing the kernel from loading the kernel module provides an additional safeguard against its activation.

ID
xccdf_org.ssgproject.content_rule_kernel_module_mac80211_disabled
Severity
Medium
References
Updated



Remediation - Kubernetes Patch

---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:

Remediation - Ansible

- name: Ensure kernel module 'mac80211' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/mac80211.conf
    regexp: install\s+mac80211
    line: install mac80211 /bin/false

Remediation - Shell Script

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install mac80211" /etc/modprobe.d/mac80211.conf ; then
	
	sed -i 's#^install mac80211.*#install mac80211 /bin/true#g' /etc/modprobe.d/mac80211.conf