I am currently using and recommending syntax like install nouveau /bin/false . No, blacklist nouveau is not enough. Reading the manpages (albeit unchanged 13 years), I am concerned about its removal plans:

The long term future of this command as a solution to the problem of providing additional module dependencies is not assured and it is intended to replace this command with a warning about its eventual removal or deprecation at some point in a future release.

The kmod-systemd correspondences look like

The problem is similar. blacklist modulename doesn't guarantee the module doesn't load, just like how systemctl disable doesn't actually guarantee the service doesn't start. There's the problem how both systemctl start example and sudo modprobe modulename still work. systemctl mask is frequently recommended, and similarly I recommend install nouveau /bin/false plus a update-initramfs -u. Only like this does the start/load error out completely.

It's not only the nouveau driver needing this. I also had to use this for other drivers like ipts and bluetooth. Given I don't actually use it for "providing additional module dependencies," but for guaranteeing certain modules don't load, you could remove just install's "dependency information" part without removing the whole thing.

Potential solutions:

• Special-case allowing making /bin/install the command
• Change blacklist's behavior from systemctl disable to systemctl mask
• Add a mask command
• Remove the stale deprecation notice from man modprobe.d