/*
 * If you use this configuration you may disable module capability
 * bit in default rule for all other executables.
 */
 
/sbin/insmod {
	uid 0
	gid 0
	groups no
	
	cap effective raise {
		module
	}
	
	exec deny all
}

/sbin/modprobe {
	uid 0
	gid 0
	groups no
	
	cap effective raise {
		module
	}
	
	exec deny all
}

/sbin/rmmod {
	uid 0
	gid 0
	groups no
	
	cap effective raise {
		module
	}
	
	exec deny all
}
