This has always been a thought of mine. I wanted to replace/remove any non-free kernels with a libre kernel that doesn’t provide non-free binaries. I know some people say it does not matter, but I think it would be a cool idea.
I was thinking about hardening QubesOS by possibly using a deblobbed version of the Kicksecure kernel on all VMs. It would also come with Javascript disabled entirely on all VMs, all non-free binaries removed, everything ran over Tor by default, maybe creating a custom repo with only free software, etc.
This would be inclined towards people who use Libreboot/Canoeboot, specifically those that use systems like OptiPlex 9020 and T440p, that run only 100% free software in the BIOS.
I’ve never attempted it, but I would like to know if anyone would be interested.
I’ve never built a full ISO or Libre kernel specifically. But, For debugging few issues in my laptop I’ve built the kernel for qubes OS and app VMs. But from your description it sounds like you just want to disable certain modules. That can easily be achieved by updating the
.configfor the kernel and if needed you can add the patches to the kernel from Linus (Qubes is already adding few) check out https://github.com/QubesOS/qubes-linux-kernelyou can also use Qubes builder v2 to create rpm packages in secure way.