modlock - preventing kernel modules from loading

Several recent linux vulnerabilities are triggered when kernel modules (that are not needed by us) are loaded by non privileged users (see dirty frag and copy fail.

To avoid that in the future, we have installed modlock.

This program, when initially setup (with --setup), creates a list of modules currently loaded and then creates a systemd service that ensures they are loaded on startup before disabling loading of any other modules.

You can reverse it at any time with modlock --unlock, update the list of allowed modules with modlock --update and then put it back with modlock --lock.

This strategy differs from the strategy of adding kernel.modules_disabled=1 which also disables loading of modules. With this strategy, you can undo it without a reboot. With the kernel.modules_disabled=1 strategy, adding a new module requires a reboot.