read-only usermodehelper

A common way attackers use to escape confinement is by rewriting the user-mode helper sysctls
 (e.g. /proc/sys/kernel/modprobe) to run something of their choosing in the init namespace. To 
reduce attack surface within the kernel, Greg KH introduced CONFIG_STATIC_USERMODEHELPER,
 which switches all user-mode helper binaries to a single read-only path (which defaults to 
/sbin/usermode-helper). Userspace will need to support this with a new helper tool that can 
demultiplex the kernel request to a set of known binaries.