The LSM interface would surely be incomplete if it didn't mediate loading and unloading kernel modules. The LSM module loading hooks, module_security_ops, add permission checks protecting the creation and initialization of loadable kernel modules as well as module removal.