Well you could build a monilithic kernel with module loading turned off entirely, but that doesn't prevent replacing libc which most programs use to make those system calls.
As pointed out elsewhere, modules is not the only way to load kernel code live. Modules is just a cleaner interface for it. Rootkits capable of loading their kernel code without involving the module system has existed for ages.
Could make the filesystem readonly, that would prevent writing a module to load into the kernel, and replacing libc as long as you make it imposible to remount the filesystem at all.
Don't hold your breath - code can be inserted without involving actual files. It just makes things less persistent.
-- Cheers, André Tomt - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
