From d5673795ba2f87ae1649c84591ee13d7876af0b2 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Wed, 13 Jan 2021 14:01:03 +0100
Subject: [PATCH 1/3] add rule

---
 .../sysctl_kernel_modules_disabled/rule.yml   | 34 +++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml

diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml
new file mode 100644
index 0000000000..1811c43815
--- /dev/null
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml
@@ -0,0 +1,34 @@
+documentation_complete: true
+
+prodtype: fedora,ol8,rhel7,rhel8
+
+title: 'Disable loading and unloading of kernel modules'
+
+description: '{{{ describe_sysctl_option_value(sysctl="kernel.modules_disabled", value="1") }}}'
+
+rationale: |-
+    Malicious kernel modules can have a significant impact on system security and
+    availability. Disabling loading of kernel modules prevents this threat. Note
+    that once this option has been set, it cannot be reverted without doing a
+    system reboot. Make sure that all needed kernel modules are loaded before
+    setting this option.
+
+severity: medium
+
+identifiers:
+    cce@rhel7: CCE-83392-1
+    cce@rhel8: CCE-83397-0
+
+references:
+    anssi: BP28(R24)
+
+{{{ complete_ocil_entry_sysctl_option_value(sysctl="kernel.modules_disabled", value="1") }}}
+
+platform: machine
+
+template:
+    name: sysctl
+    vars:
+        sysctlvar: kernel.modules_disabled
+        sysctlval: '1'
+        datatype: int

From 5e4f6a4a0b70c07488595080cfd98fdbfb02e352 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Wed, 13 Jan 2021 14:01:15 +0100
Subject: [PATCH 2/3] add rule to anssi profile

---
 controls/anssi.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/controls/anssi.yml b/controls/anssi.yml
index 9e2b899b6d..f435459af3 100644
--- a/controls/anssi.yml
+++ b/controls/anssi.yml
@@ -483,7 +483,8 @@ controls:
       sysctl kernel.modules_disabledconf:
       Prohibition of loading modules (except those already loaded to this point)
       kernel.modules_disabled = 1
-    # rules: TBD
+    rules:
+    - sysctl_kernel_modules_disabled
 
   - id: R25
     level: enhanced