Skip to content
Log In

Disable Kernel iwlmvm Module

An XCCDF Rule

Description

To configure the system to prevent the iwlmvm kernel module from being loaded, add the following line to the file /etc/modprobe.d/iwlmvm.conf: 
install iwlmvm /bin/false

Rationale

If Wireless functionality must be disabled, preventing the kernel from loading the kernel module provides an additional safeguard against its activation.

ID
xccdf_org.ssgproject.content_rule_kernel_module_iwlmvm_disabled
Severity
Medium
References
Updated

Remediation Templates

An Ansible Snippet

- name: Ensure kernel module 'iwlmvm' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/iwlmvm.conf
    regexp: install\s+iwlmvm
    line: install iwlmvm /bin/false

A Shell Script

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
if LC_ALL=C grep -q -m 1 "^install iwlmvm" /etc/modprobe.d/iwlmvm.conf ; then
	
	sed -i 's#^install iwlmvm.*#install iwlmvm /bin/false#g' /etc/modprobe.d/iwlmvm.conf
else

A Kubernetes Patch

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0