Do we really want more runtime patching?

With disabling modules, I mean /sbin/sysctl -w kernel.modules_disabled = 1, as soon as all relevant modules are loaded at boot.

For what it's worth, we now reconfigured some test systems that way. We had to explicitly load some modules early (before, they were loaded on demand). It seems viable, at least in a virtualized environment.

# no more module loads...
echo 1 > /proc/sys/kernel/modules_disabled

# there's also no point in khelper calling out to modprobe
echo > /proc/sys/kernel/modprobe