qemu: ensure /lib/modules is exported read-only