Disable CAN Support
Ensures the can kernel module is not loaded and is blacklisted so the unused CAN bus protocol cannot be activated.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
CAN (Controller Area Network) is an automotive/industrial bus protocol with no purpose on a general-purpose server. Its kernel module adds protocol-parsing code to the attack surface; a flaw there could be exploited for privilege escalation or denial of service. Disabling the unused module removes that exposure.
What Pavois checks
Pavois uses kernel_module('can') to assert the module is not loaded and is disabled in the effective modprobe policy. Querying the live kernel plus the resolved modprobe config (rather than a single .conf) catches a module blacklisted in one place but still loaded, or re-enabled by an override.
describe kernel_module('can') do
it { should_not be_loaded }
it { should be_disabled }
endHow to verify it is applied
Run lsmod | grep '^can' (no output = not loaded) and modprobe -n -v can (expect install /bin/true or /bin/false). modprobe --showconfig | grep can shows the effective rules.
Inspect & investigate
Blocked load attempts appear in the kernel log: journalctl -k | grep -i can / dmesg | grep -i can. lsmod shows resident modules; modprobe --showconfig shows the policy.
Remediation
pavois harden apply uses the kernel_module resource to blacklist can: it writes a modprobe rule (install can /bin/false plus a blacklist entry) so the module cannot auto-load, and unloads it if resident. reboot_required is true to guarantee removal.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | blacklist |
|---|---|
| name | can |
| reboot_required | true |
| resource | kernel_module |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
On a standard server, disabling can has no functional impact. Precaution: industrial/automotive/IoT gateways that talk to a CAN bus would lose that capability, confirm no can/vcan interface is configured (ip link show type can) before applying. A reboot is needed to unload an already-loaded module.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 3.2.2 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.