minimal port of grsecurity's DENYUSB feature