Disable Kernel iwlmvm Module
Ensures the iwlmvm Intel wireless kernel module cannot be loaded, keeping the Wi-Fi MAC driver off on systems where wireless must be disabled.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
iwlmvm is the multi-virtual-MAC driver for Intel wireless adapters. On servers and other systems where wireless networking must be off, an active Wi-Fi stack is both an unmanaged network path that can bypass perimeter controls and extra driver code processing untrusted radio frames. Preventing the kernel from loading iwlmvm is an additional safeguard against accidental or malicious activation of wireless connectivity, complementing software that merely disables the radio.
What Pavois checks
Pavois uses the InSpec kernel_module('iwlmvm') resource to confirm the module is not loaded and is disabled (blacklist plus an install ... /bin/true override). This reads the effective kernel state via lsmod and modprobe --showconfig, not just a config-file grep, so a drop-in or hardware-triggered autoload that re-enables wireless is detected.
describe kernel_module('iwlmvm') do
it { should_not be_loaded }
it { should be_disabled }
endHow to verify it is applied
Run modprobe -n -v iwlmvm, it should print install /bin/true. Confirm it is not loaded with lsmod | grep iwlmvm (no output expected). modprobe --showconfig | grep iwlmvm should show a blacklist iwlmvm and an install iwlmvm /bin/true line.
Inspect & investigate
Load attempts and hardware detection appear in the kernel ring buffer: dmesg | grep iwlmvm or journalctl -k | grep -Ei 'iwlmvm|iwlwifi'. The effective modprobe policy is shown by modprobe --showconfig | grep iwlmvm.
Remediation
pavois harden apply uses the kernel_module resource to blacklist iwlmvm: it writes a drop-in under /etc/modprobe.d/ with blacklist iwlmvm and install iwlmvm /bin/true, and unloads the module if loaded. Because the wireless stack may already be active, reboot_required is true to guarantee a clean state.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | blacklist |
|---|---|
| name | iwlmvm |
| reboot_required | true |
| resource | kernel_module |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Risk if not applied: Wi-Fi can be brought up on a host that should be wired-only, opening an unmanaged network path and exposing radio-frame parsing code.
- Do not apply on laptops or any host that legitimately relies on Intel Wi-Fi, blacklisting
iwlmvm(and the relatediwlwifi) will disable wireless networking and could cut off a remote machine that has no wired connectivity. - Verify a working wired/management path before applying.
- A reboot is required for full effect; schedule it in a maintenance window.