Disable Bluetooth Kernel Module
Ensures the bluetooth kernel module is not loaded and is blacklisted so the wireless Bluetooth stack cannot be activated.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Bluetooth is a short-range wireless stack rarely needed on servers. Its kernel module exposes a wireless attack surface reachable by anyone in radio range, and Bluetooth has a long history of remote vulnerabilities (e.g. BlueBorne). On a system where Bluetooth is not required, blacklisting the module provides an additional safeguard against accidental or malicious activation.
What Pavois checks
Pavois uses kernel_module('bluetooth') to assert the module is not loaded and is disabled in the effective modprobe policy. Reading the live kernel and resolved modprobe config (not a lone .conf) catches the case where Bluetooth is blacklisted in one file yet still loaded, or re-enabled by a drop-in override.
describe kernel_module('bluetooth') do
it { should_not be_loaded }
it { should be_disabled }
endHow to verify it is applied
Run lsmod | grep bluetooth (no output = not loaded) and modprobe -n -v bluetooth (expect install /bin/true or /bin/false). Confirm the service is also off with systemctl is-enabled bluetooth (expect disabled/masked).
Inspect & investigate
Blocked load attempts and the Bluetooth subsystem log to the kernel ring buffer: journalctl -k | grep -i bluetooth or dmesg | grep -i bluetooth. lsmod shows whether the module is resident; modprobe --showconfig shows the policy.
Remediation
pavois harden apply uses the kernel_module resource to blacklist bluetooth: it writes a modprobe rule (install bluetooth /bin/false plus a blacklist entry) preventing auto-load, and unloads it if resident. reboot_required is true to ensure the dependent module stack is fully removed.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | blacklist |
|---|---|
| name | bluetooth |
| reboot_required | true |
| resource | kernel_module |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Failing means a usable wireless attack surface remains. Precaution: on workstations or laptops that rely on Bluetooth (keyboard, mouse, headset, audio), blacklisting will disable those peripherals, apply only to servers or hosts with no Bluetooth need. Verify with lsusb/hciconfig that no Bluetooth peripheral is in use; a reboot is required to unload an active stack.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| NIST | 3.1.16 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.