Disable Kernel mac80211 Module
Ensures the mac80211 software-MAC kernel module cannot be loaded, disabling the soft-MAC Wi-Fi framework on systems where wireless must be off.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
mac80211 is the kernel's software MAC framework underpinning most soft-MAC Wi-Fi drivers. On systems where wireless networking must be off, keeping this subsystem loadable leaves an unmanaged network path that can bypass perimeter controls and exposes 802.11 frame-handling code to untrusted radio input. Preventing the kernel from loading mac80211 is an additional safeguard against accidental or malicious activation of wireless connectivity and disables the drivers that depend on it.
What Pavois checks
Pavois uses the InSpec kernel_module('mac80211') resource to confirm the module is not loaded and is disabled (blacklist plus an install ... /bin/true override). This reads the effective kernel state via lsmod and modprobe --showconfig, not just a config-file grep, so a drop-in or a dependent driver autoloading it is detected.
describe kernel_module('mac80211') do
it { should_not be_loaded }
it { should be_disabled }
endHow to verify it is applied
Run modprobe -n -v mac80211, it should print install /bin/true. Confirm it is not loaded with lsmod | grep mac80211 (no output expected). modprobe --showconfig | grep mac80211 should show a blacklist mac80211 and an install mac80211 /bin/true line.
Inspect & investigate
Load attempts and Wi-Fi stack activity appear in the kernel ring buffer: dmesg | grep mac80211 or journalctl -k | grep -Ei 'mac80211|cfg80211'. The effective modprobe policy is shown by modprobe --showconfig | grep mac80211.
Remediation
pavois harden apply uses the kernel_module resource to blacklist mac80211: it writes a drop-in under /etc/modprobe.d/ with blacklist mac80211 and install mac80211 /bin/true, and unloads the module if loaded. Because soft-MAC drivers may already have it loaded, reboot_required is true to guarantee a clean state.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | blacklist |
|---|---|
| name | mac80211 |
| reboot_required | true |
| resource | kernel_module |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Risk if not applied: soft-MAC Wi-Fi can be brought up on a host that should be wired-only, opening an unmanaged network path and exposing 802.11 frame parsing.
- Do not apply on laptops or hosts that legitimately use soft-MAC Wi-Fi, blacklisting
mac80211disables the entire soft-MAC wireless stack and could cut off a remote machine with no wired link. - Verify a working wired/management path before applying.
- A reboot is required for full effect; schedule it in a maintenance window.