Hacker News Reader

Oh, it's because it can be set by /proc/sys/kernel/modprobe

There is CONFIG_STATIC_USERMODEHELPER that disables the sysctl you mentioned and actually make modprobe_path read-only.