
Police appear to be something of a problem. Might be better to have no police than to have easily usurped police. Hell, slit the police force up based on tasks and don’t have the group that is happy to “forcibly broke up protest” (keep the “investigate my murder” cops as they are doing a great job).










Clearly you know of lot about this. Here are some comments for the next human.
Deny all modules seems more possible than a whitelist approach. To deny all, the command is likely “sysctl kernel.modules_disabled=1”.
Whitelisting is harder. One could store a list of all loaded modules on a working system. Store a list of all kernel modules currently installed on the system. Compare the lists and remove from the “all” list the “running” list (grep will do this) and write it to the blacklist file.
The problem with the Whitelisting approach is that it needs to run after every kernel module install (which is doable).
If the above is the case, then someone must have automated this already, but I cannot find it quickly. (I checked Debian’s package repository.)