diff --git a/share/runtime-cleanup.tmpl b/share/runtime-cleanup.tmpl
index 0552669d..8b058c07 100644
--- a/share/runtime-cleanup.tmpl
+++ b/share/runtime-cleanup.tmpl
@@ -74,36 +74,21 @@ remove /var/lib/rpm/* /var/lib/yum
 remove /usr/share/icons/*/icon-theme.cache
 
 ## clean up kernel modules
-<%
-removekmods = """
-sound drivers/media drivers/hwmon drivers/video
-net/atm net/bluetooth net/sched net/sctp
-net/rds net/l2tp net/decnet net/netfilter net/ipv4 net/ipv6
-drivers/watchdog drivers/target drivers/rtc drivers/input/joystick
-drivers/bluetooth drivers/hid drivers/edac
-drivers/usb/serial drivers/usb/host drivers/usb/misc
-fs/ocfs2 fs/ceph fs/nfsd fs/ubifs fs/nilfs2
-arch/x86/kvm
-"""
-%>
-%for kmodpath in removekmods.split():
-    remove lib/modules/*/kernel/${kmodpath}
-%endfor
-remove lib/modules/*/{build,source,*.map}
+removekmod sound drivers/media drivers/hwmon drivers/video \
+           net/atm net/bluetooth net/sched net/sctp \
+           net/rds net/l2tp net/decnet net/netfilter net/ipv4 net/ipv6 \
+           drivers/watchdog drivers/target drivers/rtc drivers/input/joystick \
+           drivers/bluetooth drivers/hid drivers/edac \
+           drivers/usb/serial drivers/usb/host drivers/usb/misc \
+           fs/ocfs2 fs/ceph fs/nfsd fs/ubifs fs/nilfs2 \
+           arch/x86/kvm
 ## Need to keep virtio_console.ko and ipmi stuff in drivers/char
 ## Also keep virtio-rng so that the installer can get sufficient randomness for
 ## LUKS setup.
-runcmd chroot ${root} find /lib/modules \
-                        -regex ".*/kernel/drivers/char/.*" \
-                        \! -name virtio_console.ko\* \
-                        \! -name hw_random \
-                        \! -name virtio-rng.ko\* \
-                        \! -name ipmi\* \
-                        -delete
-runcmd chroot ${root} find /lib/modules \
-                        -regex ".*/kernel/drivers/staging/.*" \
-                        \! -name zram\* \
-                        -delete
+removekmod drivers/char --allbut virtio_console hw_random \
+                                  virtio-rng ipmi
+removekmod drivers/staging --allbut zram
+remove lib/modules/*/{build,source,*.map}
 ## NOTE: depmod gets re-run after cleanup finishes
 
 ## remove unused themes, theme engines, icons, etc.
diff --git a/src/pylorax/ltmpl.py b/src/pylorax/ltmpl.py
index d7165863..4a75bf53 100644
--- a/src/pylorax/ltmpl.py
+++ b/src/pylorax/ltmpl.py
@@ -533,7 +533,63 @@ class LoraxTemplateRunner(object):
                              self._getsize(*remove)/1024, self._getsize(*filelist)/1024)
             self.remove(*remove)
         else:
-            logger.debug("%s: no files to remove!", cmd)
+            logger.debug("removefrom %s: no files to remove!", cmd)
+
+    def removekmod(self, *globs):
+        '''
+        removekmod GLOB [GLOB...] [--allbut] KEEPGLOB [KEEPGLOB...]
+          Remove all files and directories matching the given file globs from the kernel
+          modules directory.
+
+          If '--allbut' is used, all the files from the modules will be removed *except*
+          the ones which match the file globs. There must be at least one initial GLOB
+          to search and one KEEPGLOB to keep. The KEEPGLOB is expanded to be *KEEPGLOB*
+          so that it will match anywhere in the path.
+
+          This only removes files from under /lib/modules/*/kernel/
+
+          Examples:
+            removekmod sound drivers/media drivers/hwmon drivers/video
+            removekmod drivers/char --allbut virtio_console hw_random
+        '''
+        cmd = " ".join(globs)
+        if "--allbut" in globs:
+            idx = globs.index("--allbut")
+            if idx == 0:
+                raise ValueError("removekmod needs at least one GLOB before --allbut")
+
+            # Apply keepglobs anywhere they appear in the path
+            keepglobs = globs[idx+1:]
+            if len(keepglobs) == 0:
+                raise ValueError("removekmod needs at least one GLOB after --allbut")
+
+            globs = globs[:idx]
+        else:
+            # Nothing to keep
+            keepglobs = []
+
+        filelist = set()
+        for g in globs:
+            for top_dir in rglob(self._out("/lib/modules/*/kernel/"+g)):
+                for root, _dirs, files in os.walk(top_dir):
+                    filelist.update(root+"/"+f for f in files)
+
+        # Remove anything matching keepglobs from the list
+        matches = set()
+        for g in keepglobs:
+            globs_re = re.compile(fnmatch.translate("*"+g+"*"))
+            m = filter(globs_re.match, filelist)
+            if m:
+                matches.update(m)
+            else:
+                logger.debug("removekmod %s: no files matched!", g)
+        remove_files = filelist.difference(matches)
+
+        if remove_files:
+            logger.debug("removekmod: removing %d files", len(remove_files))
+            map(remove, remove_files)
+        else:
+            logger.debug("removekmod %s: no files to remove!", cmd)
 
     def createaddrsize(self, addr, src, dest):
         '''