Linux security product with its own kernel module - yes or no?

Question for all Linux admins / Linux security guys out there –
Would you use a Linux security product that has it own kernel module?
Or do you consider products that use a kernel module as a big no – no?
Thoughts? Reasons?

Depends if it really is a module. Linux has a framework specifically to accommodate this - read the kernel doco here

Tell us more about the specific product that you are now considering ...

Certainly, some systems – such as "plesk" – do use custom kernel modules.

If one had enough resources in this device then they probably ought to avoid LKM's.

"
Security
While loadable kernel modules are a convenient method of modifying the running kernel, this can be abused by attackers on a compromised system to prevent detection of their processes or files, allowing them to maintain control over the system. Many rootkits make use of LKMs in this way. Note that on most operating systems modules do not help privilege elevation in any way, as elevated privilege is required to load a LKM; they merely make it easier for the attacker to hide the break-in.[10]

Linux
Linux allows disabling module loading via sysctl option /proc/sys/kernel/modules_disabled.[11][12] An initramfs system may load specific modules needed for a machine at boot and then disable module loading. This makes the security very similar to a monolithic kernel. If an attacker can change the initramfs, they can change the kernel binary."
https://en.wikipedia.org/wiki/Loadab...ule#Advantages

Don't confuse LSM with LKM.

I am fine with using modules and I tend to prefer that. But I usually stick with whatever security that comes with the distros I use.