[Unit]
Description=Lock kernel module loading after graphical boot (veilor-os)
Documentation=https://www.kernel.org/doc/html/latest/admin-guide/sysctl/kernel.html
After=graphical.target network.target local-fs.target
ConditionKernelCommandLine=!module.sig_enforce=1

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStartPre=/bin/sleep 30
ExecStart=/usr/bin/sysctl -w kernel.modules_disabled=1
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=graphical.target