Support disabling UEFI USB and network support

[DemiMarie]

In Qubes OS, USB devices are considered untrusted. Allowing USB devices to inject keystroke input is not allowed by default. Furthermore, vulnerabilities in the USB stack and drivers are mitigated by running them in a dedicated Xen VM.

However, Qubes OS cannot isolate the firmware USB stack. Injecting keyboard input into firmware can be used to e.g. change the boot order or edit the kernel command line. Therefore, it is a security risk in the Qubes OS threat model.

Dasharo supports disabling the firmware USB stack, and I would like System76’s open firmware to also do so. This is necessary for secure use of potentially-compromisd USB devices on System76 hardware.