/etc/rc.local script to lock down some linux kernel settings

rc.local

#!/bin/sh -e
#
# rc.local
#
# This script is executed at the end of each multiuser runlevel.
# Make sure that the script will "exit 0" on success or any other
# value on error.
#
# In order to enable or disable this script just change the execution
# bits.
#
# By default this script does nothing.

# 2 minute opportunity to change settings
sleep 120

# Disallow kernel module loading (cannot be unset until reboot)
echo 1 > /proc/sys/kernel/modules_disabled

# Disabllow live booting of kernel over existing one (cannot be unset until reboot)
echo 1 > /proc/sys/kernel/kexec_load_disabled

exit 0