Once upon a time (before kernel 2.6.25), one could use
/proc/sys/kernel/cap-bound to drop
CAP_SYS_MODULE system-wide, and be assured that the set of code that was presently loaded into kernel space was all there would ever be, absent exploits or rebooting.
Then it was decided that
CAP_NET_ADMIN would be allowed to load kernel modules even without
CAP_SYS_MODULE(!), and the value of
CAP_SYS_MODULE came to a close -- grepping through a modern kernel, I find no runtime checks for
CAP_SYS_MODULE to still exist.
What's the modern replacement?