Disable TIPC Support
Ensures the tipc kernel module is not loaded and is blacklisted so the unused TIPC cluster protocol cannot be auto-loaded.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
TIPC (Transparent Inter-Process Communication) is a cluster networking protocol rarely used outside specialized clusters. Disabling it protects the system against exploitation of any flaws in its implementation, the kernel has shipped several remotely exploitable TIPC CVEs (e.g. CVE-2021-43267). Removing an unused network protocol stack shrinks the remote attack surface.
What Pavois checks
Pavois queries the effective module state: it verifies tipc is absent from the running kernel and that modprobe refuses to load it. A file-only scan of /etc/modprobe.d/ could pass while the module was already loaded at runtime (TIPC auto-loads when a AF_TIPC socket is created); inspecting the live kernel catches that gap.
describe kernel_module('tipc') do
it { should_not be_loaded }
it { should be_disabled }
endHow to verify it is applied
lsmod | grep tipcshould return nothing.modprobe -n -v tipcshould printinstall /bin/true.grep -r tipc /etc/modprobe.d/should showblacklist tipcandinstall tipc /bin/true.
Inspect & investigate
dmesg | grep -i tipcandjournalctl -k | grep tipcshow kernel/module load events.lsmodandmodprobe -n -v tipcreflect the live state.
Remediation
Pavois's harden plan uses the kernel_module resource to blacklist tipc: it writes a modprobe drop-in blacklisting the module and redirecting its load to /bin/true, then unloads it if active. A reboot is required to fully clear an in-use module. Apply with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | blacklist |
|---|---|
| name | tipc |
| reboot_required | true |
| resource | kernel_module |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Negligible on standard servers and desktops, which never use TIPC. Only specialized high-availability/cluster middleware uses it; if such software runs on the host, verify with ss -a -f tipc and lsmod | grep tipc before applying and exclude the rule there.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 3.2.2, 3.2.4, 3.2.6 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.