Refactor /etc/modprobe.d/*

[raja-grewal]

Refactor kernel module blacklisting and disabling for clarity, ease-of-use, and future-proofing.

In preparation for future planned changes.

If this PR is approved, I plan on immediately introducing many new additions to our existing module blacklisting and disabling. The splitting of the configuration is necessary to improve readability and not result in a single bewilderingly lengthy configuration file.

Changes

Splits /etc/modprobe.d/30-security-misc.conf into two distinct configuration files, one for blacklisting and one for disabling. Improved documentation of relevant files.

There are no changes to the actual functionality of the code.

Mandatory Checklist

• Legal agreements accepted. By contributing to this organisation, you acknowledge you have read, understood, and agree to be bound by these these agreements:

Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint

Optional Checklist

The following items are optional but might be requested in certain cases.

• I have tested it locally
• I have reviewed and updated any documentation if relevant
• I am providing new code and test(s) for it

[raja-grewal]

https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/34

https://forums.whonix.org/t/kernel-hardening-security-misc/7296/549

[adrelanos]

This line was forgotten.

[adrelanos]

Other forgotten lines:

install firewire_core /usr/bin/disabled-firewire-by-security-misc
install firewire_ohci /usr/bin/disabled-firewire-by-security-misc
install firewire_sbp2 /usr/bin/disabled-firewire-by-security-misc

I guess that was: 275a4ff

So the module always have - not _?

[adrelanos]

Quote man modprobe:

modprobe intelligently adds or removes a module from the Linux kernel: note that for convenience, there is no difference between _ and - in module names (automatic underscore conversion is performed).

[adrelanos]

Quote man modprobe.d:

Note that module and alias names (like other module names) can have - or _ in them: both are interchangeable throughout all the module commands as underscore conversion happens automatically.

So this seems fine. No need to duplicate firewire_core, firewire-core etc.