In principle, secure boot plus signed kernel modules: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide

In principle, secure boot plus signed kernel modules: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/sect-signing-kernel-modules-for-secure-boot.html https://access.redhat.com/documentation/en-US/Red_Hat_Enterp... Though, I am not sure how vulnerable the key infrastructure is to the CIA.