Disable Kernel Support for USB via Bootloader Configuration
Disables kernel USB support through a bootloader parameter so the host rejects USB devices entirely, intended for specialized fixed-function systems.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
The USB subsystem is a common physical attack surface: a malicious USB device can impersonate a keyboard (BadUSB), exploit a buggy class driver, or exfiltrate data the moment it is plugged in. Disabling USB support at the kernel boot level removes that surface entirely, which is only practical on specialized, fixed-function systems (kiosks, appliances, air-gapped hosts) that have no legitimate need for USB peripherals.
What Pavois checks
Pavois reads the live kernel command line from /proc/cmdline rather than /etc/default/grub, so it reflects what the running kernel actually applied, a GRUB edit that was never regenerated would not fool the check. The live boot line is the authoritative source for any kernel parameter governing module/subsystem availability.
describe command('cat /proc/cmdline') do
its('stdout') { should match(/(^| )nousb( |$)/) }
end
describe command("grep -hwsF 'nousb' /etc/default/grub /etc/kernel/cmdline /boot/grub/grub.cfg /boot/grub2/grub.cfg /boot/efi/EFI/*/grub.cfg 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run cat /proc/cmdline and confirm the expected USB-disabling token is present on the boot line. Additionally confirm no USB devices are enumerated with lsusb (should be empty or fail) and that the usbcore module is not loaded via lsmod | grep usbcore.
Inspect & investigate
The kernel logs USB subsystem initialization (or its absence) at boot, inspect dmesg | grep -i usb or journalctl -k | grep -i usb. When USB is disabled, no usbcore/usb 1-1 enumeration messages appear.
Remediation
This rule has no automated harden plan, so it must be applied manually: add the USB-disabling parameter to the bootloader (e.g. via /etc/default/grub then grub2-mkconfig, or blacklist the usb_storage/usbcore modules) and reboot. Pavois will not change USB support automatically because disabling it can lock out the only input device on physical machines.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| param | nousb |
|---|---|
| reboot_required | true |
| resource | kernel_cmdline |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling USB is highly disruptive on physical hardware: it kills USB keyboards, mice, storage, KVM dongles and recovery media. Precautions:
- Never apply on a machine whose only console is a USB keyboard, you will be locked out.
- Use only on headless servers managed over IPMI/serial or VMs with virtio input.
- Keep an out-of-band recovery path (serial console, hypervisor console) to revert the boot parameter if needed.
- Requires a reboot to take effect.