<listitem><para>Takes a boolean argument. If true, explicit module loading will be denied. This allows to turn
off module load and unload operations on modular kernels. It is recommended to turn this on for most services
- that do not need special file systems or extra kernel modules to work. Default to off. Enabling this option
+ that do not need special file systems or extra kernel modules to work. Defaults to off. Enabling this option
removes <constant>CAP_SYS_MODULE</constant> from the capability bounding set for the unit, and installs a
system call filter to block module system calls, also <filename>/usr/lib/modules</filename> is made
inaccessible. For this setting the same restrictions regarding mount propagation and privileges apply as for