Update kernels to 4.4.167 and remove wireless support

[emkll]

Status

Ready for review

❗ Before merge, please review the following PR (contains the config of the 4.4.167 SecureDrop kernel):

• Review Remove wireless support in securedrop kernel config ansible-role-grsecurity-build#42 and ensure the configuration is valid
• Upload to apt-test.freedom.press (DONE )

Description of Changes

Fixes #2726 .

Removes wireless support from the kernel, bumps version to 4.4.167. Adds tests to ensure the configuration is properly applied.

Testing

0. Review kernel configuration in Remove wireless support in securedrop kernel config ansible-role-grsecurity-build#42
1. Provision staging and run infra tests, and observe no failures:

    ======== 446 passed, 13 skipped, 8 xfailed, 2 xpassed in 135.22 seconds ========

2. Syslog should not contain any error messages
3. If testing on hardware, please report findings on this ticket (I have tested on NUC 5PYH and the Kernel works as expected).
4. Ensure test coverage for configuration is adequate

Deployment

New and existing installs will be handled by the deb packages hosted on the apt server.

Checklist

• Configuration tests pass

If you made non-trivial code changes:

• I have written a test plan and validated it for this PR

[conorsch]

Proceeding with VM-based review now, progress:

• Review kernel configuration in Remove wireless support in securedrop kernel config ansible-role-grsecurity-build#42
• Provision staging and run infra tests, and observe no failures:

    ======== 446 passed, 13 skipped, 8 xfailed, 2 xpassed in 135.22 seconds ========

• Syslog should not contain any error messages
• 🔶 Not testing hardware If testing on hardware, please report findings on this ticket (I have tested on NUC 5PYH and the Kernel works as expected).
• Ensure test coverage for configuration is adequate

Deployment

[conorsch]

Looking good here. Only performed VM-based testing, so a bit more scrutiny is warranted here; tagging @zenmonkeykstop for a follow-up on Mac Mini hardware, to make sure there aren't any surprises.

[zenmonkeykstop]

Did a fresh install from apt-test on 2014 Mac Minis and checked basic server settings:

• uname -r reports kernel 4.4.167-grsec
• paxtest blackhat and meltdown test script results are the same as for previous kernel version
• wireless modules not found under /lib/modules/4.4.162/kernel/
• manual check of grsec config file in /boot matches what's expected from the infra test.
• nothing relevant in syslog
• source submissions, admin user setup and login work.

LGTM!

[emkll]

thanks @zenmonkeykstop and @conorsch for the review/testing, merging this now. As stated previously, debs are live on apt-test.