Disable Kernel cfg80211 Module
Ensures the cfg80211 kernel module is not loaded and is blacklisted so the 802.11 wireless subsystem cannot be activated.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
cfg80211 is the kernel's 802.11 wireless configuration subsystem that all Wi-Fi drivers depend on. On a server that has no need for wireless networking, loading it exposes a radio-facing attack surface. Blacklisting the module prevents the kernel from bringing up the wireless stack and provides an additional safeguard against its activation.
What Pavois checks
Pavois uses kernel_module('cfg80211') to assert the module is not loaded and is disabled in the effective modprobe policy. Inspecting the live kernel and resolved modprobe config (not a single .conf) catches a module blacklisted in one file yet still loaded, or re-enabled by an override drop-in.
describe kernel_module('cfg80211') do
it { should_not be_loaded }
it { should be_disabled }
endHow to verify it is applied
Run lsmod | grep cfg80211 (no output = not loaded) and modprobe -n -v cfg80211 (expect install /bin/true or /bin/false). Note that blacklisting cfg80211 effectively disables all dependent Wi-Fi drivers.
Inspect & investigate
Blocked load attempts and wireless subsystem messages appear in the kernel log: journalctl -k | grep -i cfg80211 / dmesg | grep -i cfg80211. lsmod shows resident modules; modprobe --showconfig shows the policy.
Remediation
pavois harden apply uses the kernel_module resource to blacklist cfg80211: it writes a modprobe rule (install cfg80211 /bin/false plus a blacklist entry) preventing auto-load, and unloads it if resident. reboot_required is true so the wireless module stack is fully removed.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | blacklist |
|---|---|
| name | cfg80211 |
| reboot_required | true |
| resource | kernel_module |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Blacklisting cfg80211 disables ALL Wi-Fi on the host because every wireless driver depends on it. Precaution: never apply on laptops/workstations or any host whose only network path is Wi-Fi, you would lose connectivity and risk lockout. Verify the host uses wired networking (ip link, iw dev) and has no wireless-only management path before applying; a reboot completes the unload.