{"description": "\nTo configure the system to prevent the <code>iwlwifi</code>\nkernel module from being loaded, add the following line to the file <code>/etc/modprobe.d/iwlwifi.conf</code>:\n<pre>install iwlwifi /bin/false</pre>\nThis entry will cause a non-zero return value during a <code>iwlwifi</code> module installation\nand additionally convey the meaning of the entry to the user in form of an error message.\nIf you would like to omit a non-zero return value and an error message, you may want to add a different line instead\n(both <code>/bin/true</code> and <code>/bin/false</code> are allowed by OVAL and will be accepted by the scan):\n<pre>install iwlwifi /bin/true</pre>", "rationale": "If Wireless functionality must be disabled, preventing the kernel\nfrom loading the kernel module provides an additional safeguard against its\nactivation.", "severity": "medium", "references": {"nist": ["AC-18(a)", "AC-18(3)", "CM-7(a)", "CM-7(b)", "CM-6(a)", "MP-7", "AC-18(4)"]}, "control_references": {}, "components": [], "identifiers": {}, "ocil_clause": "no line is returned", "ocil": "\nIf the system is configured to prevent the loading of the <code>iwlwifi</code> kernel module,\nit will contain lines inside any file in <code>/etc/modprobe.d</code> or the deprecated<code> /etc/modprobe.conf</code>.\nThese lines instruct the module loading system to run another program (such as <code>/bin/false</code>) upon a module <code>install</code> event.\n\nRun the following command to search for such lines in all files in <code>/etc/modprobe.d</code> and the deprecated <code>/etc/modprobe.conf</code>:\n<pre>$ grep -r iwlwifi /etc/modprobe.conf /etc/modprobe.d</pre>", "oval_external_content": null, "fixtext": "", "checktext": "", "vuldiscussion": "", "srg_requirement": "", "warnings": [], "conflicts": [], "requires": [], "policy_specific_content": {}, "platform": "system_with_kernel", "platforms": ["system_with_kernel"], "sce_metadata": {}, "inherited_platforms": [], "cpe_platform_names": ["system_with_kernel"], "inherited_cpe_platform_names": [], "bash_conditional": null, "fixes": {}, "title": "Disable Kernel iwlwifi Module", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/system/network/network-wireless/wireless_software/kernel_module_iwlwifi_disabled/rule.yml", "template": {"name": "kernel_module_disabled", "vars": {"kernmodule": "iwlwifi"}, "backends": {}}}