(EXPERIMENTAL) Nixpkgs patch to only allow explicitly defined kernel modules

nixpkgs-shrink-kmods.patch

diff --git a/nixos/modules/system/boot/kernel.nix b/nixos/modules/system/boot/kernel.nix
index 7f2d388b8af3..c01a349e6568 100644
--- a/nixos/modules/system/boot/kernel.nix
+++ b/nixos/modules/system/boot/kernel.nix
@@ -396,6 +396,17 @@ in
         let
           kernelPath = "${config.boot.kernelPackages.kernel}/" + "${config.system.boot.loader.kernelFile}";
           initrdPath = "${config.system.build.initialRamdisk}/" + "${config.system.boot.loader.initrdFile}";
+
+          shrunkModules = pkgs.makeModulesClosure {
+            rootModules =
+              config.boot.kernelModules
+              ++ config.boot.initrd.kernelModules
+              ++ config.boot.initrd.availableKernelModules;
+            kernel = config.system.modulesTree;
+            firmware = config.hardware.firmware;
+            allowMissing = config.boot.initrd.allowMissingModules;
+            inherit (config.boot.initrd) extraFirmwarePaths;
+          };
         in
         ''
           if [ ! -f ${kernelPath} ]; then
@@ -405,7 +416,7 @@ in
           fi
 
           ln -s ${kernelPath} $out/kernel
-          ln -s ${config.system.modulesTree} $out/kernel-modules
+          ln -s ${shrunkModules} $out/kernel-modules
           ${optionalString (config.hardware.deviceTree.package != null) ''
             ln -s ${config.hardware.deviceTree.package} $out/dtbs
           ''}
diff --git a/pkgs/build-support/kernel/modules-closure.sh b/pkgs/build-support/kernel/modules-closure.sh
index f49c5ca49929..297deeae0cbb 100644
--- a/pkgs/build-support/kernel/modules-closure.sh
+++ b/pkgs/build-support/kernel/modules-closure.sh
@@ -110,8 +110,3 @@ cp $kernel/lib/modules/"$version"/modules.builtin $out/lib/modules/"$version"/.
 cp $kernel/lib/modules/"$version"/modules.builtin.modinfo $out/lib/modules/"$version"/.
 
 depmod -b $out -a $version
-
-# remove original hints from final derivation
-rm $out/lib/modules/"$version"/modules.order
-rm $out/lib/modules/"$version"/modules.builtin
-rm $out/lib/modules/"$version"/modules.builtin.modinfo