Kernel hardening

Buyer briefs, scanner hygiene, distro fit, and measured evidence.

Overview: Root Lock by HeartSuite runs a custom-built Linux kernel, 6.18.9-hs. Lockdown is the enforcement. This section covers buyer evaluation, support policy, compatibility, scanner hygiene, and reproducible evidence.

For buyers and procurement

Start here if you are evaluating the Root Lock kernel for a regulated or enterprise fleet:

  • Procurement Brief — Comparison table and decision guide at a glance.
  • Enterprise Adoption Guide — CISO and procurement guidance: deployment, fleet operations, Secure Boot status, supply chain, recovery, and honest limitations.
  • Distro Compatibility Matrix — Validated and supported distributions, RHEL-family guidance, workload fit, and HJFS alternative.
  • Kernel Support Policy — LTS strategy, patch targets, update delivery, version-string semantics, and boundaries versus distribution-vendor maintenance models.
  • CVE Hygiene for Scanners — How enterprise Linux security teams verify CVE status without upstream version false positives.
  • Supply Chain and Advisory Feeds — SHA-256 today; published JSON feeds at /advisories/ (CONFIG-gate SBOM, OSV with 279 entries, CycloneDX SBOM for hs-v1.6.4-kernel-6.18.9); roadmap for GPG/cosign signing and OVAL.

Reading guide: Several pages name Red Hat Enterprise Linux (RHEL), RHSA advisories, and OVAL feeds because procurement and vulnerability-management teams already know them. The same errata-first discipline applies on Rocky, AlmaLinux, Ubuntu LTS, Debian, and SUSE, and the Distro Compatibility Matrix lists validated bases across both the RPM and Debian families.

Evidence and technical reference

Every measured number derives from the open-source kernel-hardening-checker tool applied identically to HeartSuite and reference kernels, with no estimates. Raw evidence files and config SHA-256 hashes are included so any qualified team can verify independently.

  • Evidence Status — 6.18.9-hs #43 checker pack published 2026-10-02; the 18 August pack is build #37 and holds the guest boot; 5.19.6 remains the legacy pack.
  • Comparison Matrix (6.18.9) — Scores are the build #43 checker run. Arch and vanilla rows are the 18 August measurement on the same checker.
  • Comparison Matrix (5.19.6) — Legacy stream, fully measured: HeartSuite vs vanilla defconfig, Arch hardened, and KSPP target.
  • Threat model and residual risk — Threat model for the kernel that ships, build #43 checker scores, residual risks, and reproduction commands. The guest boot in that brief is build #37.
  • LSM Comparison — HeartSuite vs SELinux, AppArmor, and TOMOYO: enforcement model, bypass-primitive resistance, and co-existence.
  • Analyst Summary — Non-technical summary for journalists and analysts, with fact-checker citations.
Kernel hardening in one comparison table

Side-by-side hardening of the fielded 6.18.9-hs Root Lock kernel against bundled checker references — for procurement and architecture reviews.

A custom kernel in a regulated fleet

Why the custom kernel exists, who owns vendor risk, Secure Boot status, recovery, and when a no-custom-kernel policy should say no.

Which distros boot the Root Lock kernel

Current lab set for Debian, Ubuntu, Rocky, and other bases — kernel line per distro, workload fit on the shipped 6.18 pin, and how to report a problem.

How long each Root Lock kernel is maintained

LTS streams, patch targets, the legacy 5.19 line, and how Root Lock kernel maintenance differs from a distro vendor’s model.

Your scanner flags CVEs this kernel does not have

Custom kernels false-positive on upstream version compares. The verification workflow, status categories, and evidence auditors accept.

How to verify the kernel you downloaded

SHA-256 bundles, published OSV and CycloneDX feeds, config hashes, and which signing steps are still on the roadmap.

Which kernel evidence is published today

Build #43 is the kernel that ships. Its checker pack has no guest boot. The 18 August 2026 pack is build #37. 5.19.6 remains the legacy measured stream.

Hardening matrix for kernel 6.18.9

Checker scores for the kernel that ships, 6.18.9-hs build #43. Reference rows are the 18 August 2026 run of the same checker.

Hardening scores: 5.19.6 against the field

kernel-hardening-checker comparison of Root Lock 5.19.6 against industry hardened kernels and stock references, with reproduction commands.

What a red team should test on this kernel

Threat model and residual risks for the kernel that ships, 6.18.9-hs build #43. The Debian 12 guest boot is the 18 August build #37 pack. 5.19.6 remains the legacy pack.

SELinux, AppArmor, TOMOYO — a different job

LSM policy can be set permissive by root. Root Lock is compiled in. When each model fits containment, and when it does not.

Kernel hardening in plain language

Checker scores for the legacy 5.19.6 kernel, and how to fact-check them.


Last modified October 2, 2026: docs: score the 6.18.9 matrix on build #43 (3687588)