Containers

It seems an obviously useful feature would be to prevent unpriviledged users from even load things like xfrm, esp and whatever was required for the last exploit. I realize this is most likely done to support containers, but well, I guess those are less commonly used than, let's say, nf_tables.