Like @dylan-reimerink said, you can't use the return value of a kprobe to deny anything. But you can use LSM, bpf_override_return or bpf_send_signal to deny some operations.

Here are some example implementations you can explore:

• LSM: main.bpf.c
• bpf_override_return: main.bpf.c
• bpf_send_signal: main.bpf.c