Disable the uvcvideo module
Ensures the uvcvideo USB-webcam kernel module is not loaded and is blacklisted so cameras cannot be activated.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
The uvcvideo module drives USB webcams (UVC devices). Failing to disconnect from collaborative computing devices such as cameras can lead to compromise of organizational information through covert recording. Blacklisting the driver on hosts that have no legitimate need for a camera removes the device entirely as an attack surface and guarantees it cannot be activated by malware.
What Pavois checks
Pavois queries the effective module state, not config files: it verifies uvcvideo is absent from the running kernel and that modprobe refuses to load it. A file-only scan would miss a module already auto-loaded when a webcam was plugged in; inspecting the live kernel catches both an active module and any drop-in that re-enables it.
describe kernel_module('uvcvideo') do
it { should_not be_loaded }
it { should be_disabled }
endHow to verify it is applied
lsmod | grep uvcvideoshould return nothing.modprobe -n -v uvcvideoshould printinstall /bin/true.grep -r uvcvideo /etc/modprobe.d/should showblacklist uvcvideoandinstall uvcvideo /bin/true.
Inspect & investigate
dmesg | grep -i uvcvideoandjournalctl -k | grep uvcvideoshow load attempts when a camera is connected.lsmodandmodprobe -n -v uvcvideoreflect the live state.
Remediation
Pavois's harden plan uses the kernel_module resource to blacklist uvcvideo: it writes a modprobe drop-in blacklisting the module and redirecting its load to /bin/true, then unloads it if active. A reboot is required to fully clear an in-use module. Apply with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | blacklist |
|---|---|
| name | uvcvideo |
| reboot_required | true |
| resource | kernel_module |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disables all USB webcams. Do not apply to workstations, laptops or conferencing endpoints that legitimately use a camera, video calls and capture software will stop working. Intended for servers and kiosks with no camera role. Verify with lsmod | grep uvcvideo and v4l2-ctl --list-devices before applying.