A smaller kernel, not a thicker agent on Root Lock by HeartSuite

Kernel hardening in one comparison table

Mon, 01 Jan 0001 00:00:00 +0000

Overview: Side-by-side comparison of Root Lock by HeartSuite kernel configuration choices against community hardened kernels and the KSPP benchmark.

Subject: Fielded 6.18.9-hs (packaging 6.18.9-HeartSuite-3, build #37). 5.19.6 is the legacy measured stream.
Evidence: evidence-pack-6.18.9.txt (2026-08-18, checker e870d01). Legacy: 5.19.6 matrix, evidence-pack-5.19.6.txt.

For deployment, Secure Boot, fleet, and “no custom kernel” alternatives see the Enterprise Adoption Guide. Support and scanner notes: Kernel Support Policy, Distro Compatibility Matrix, CVE Hygiene for Scanners.

What this document covers

All numbers below are outputs of kernel-hardening-checker commit e870d0141259f875d3d1b54fef49dec7074e4cac applied to the #37 pin config (SHA-256 3cd1824742b9a15e9467c774c5f62081f9547f730ad7cd9bce464a7d286a7db9) and to configs bundled with that checker.

A custom kernel in a regulated fleet

Mon, 01 Jan 0001 00:00:00 +0000

Overview: Practical guidance for CISOs and procurement teams adopting the Root Lock kernel in regulated fleets — why the custom kernel exists, how vendor risk is owned, deployment and recovery patterns, and honest limitations including alternatives when a custom kernel is not acceptable.

Audience: Fortune 500 CISOs, procurement, risk, and compliance teams evaluating Root Lock by HeartSuite for production and regulated workloads.

Related reading: Start with the Procurement Brief (comparison table and decision guide) and Threat model (threat model and residual risks). Cross-references throughout this guide point to the full set of kernel-hardening, security, operational, and comparison pages.

Which distros boot the Root Lock kernel

Mon, 01 Jan 0001 00:00:00 +0000

Overview: Which Linux distributions Root Lock by HeartSuite currently tests, which kernel line each row uses, and what you still own before production Lockdown. This page follows the live-matrix catalog as of 2026-08-18. It replaces the April 2026 v1.6.4 “Validated” table (Fedora 41, Alpine 3.21 as validated, Ubuntu 22.04 omitted).

Audience: Procurement, security architects, and platform engineers selecting a base OS.

This matrix complements the workload notes in System Requirements and the buyer-facing deployment guidance in the Enterprise Adoption Guide.

How long each Root Lock kernel is maintained

Mon, 01 Jan 0001 00:00:00 +0000

Overview: How HeartSuite maintains, patches, and delivers the Root Lock kernel under subscription — LTS strategy, coordinated update bundles, and how that differs from distribution-vendor errata programs such as RHEL.

Audience: Procurement, risk, compliance, and platform teams evaluating Root Lock kernel maintenance alongside existing distribution patching programs.

What this policy covers

This policy describes how HeartSuite supports the Root Lock kernel — the custom-built Linux kernel that Root Lock by HeartSuite requires for Lockdown enforcement — under a commercial subscription.

Your scanner flags CVEs this kernel does not have

Mon, 01 Jan 0001 00:00:00 +0000

Overview: How to verify kernel CVE status on Root Lock hosts without false positives from upstream version comparison — the workflow vulnerability scanners and auditors should follow instead of matching uname -r to NVD fix versions.

Audience: Security operations, vulnerability management, GRC, and audit teams on enterprise Linux (RHEL and Rocky, Ubuntu LTS, Debian, SUSE) who verify kernel CVEs with distribution errata rather than upstream version strings — and who are evaluating or operating Root Lock by HeartSuite in production.

How to verify the kernel you downloaded

Mon, 01 Jan 0001 00:00:00 +0000

Overview: What supply-chain artefacts HeartSuite publishes today (SHA-256 bundle integrity, CONFIG-gate SBOM, OSV, CycloneDX) and what remains on the roadmap (GPG/cosign signing, OVAL).

Audience: Procurement, vendor risk, GRC, and platform security teams mapping HeartSuite deliverables to supply-chain questionnaires, SOC 2 / ISO evidence requests, and enterprise Linux vulnerability-management programs.

What this page covers

This page states what HeartSuite publishes today for Root Lock kernel supply-chain verification and what is on the roadmap — without overstating availability.

Which kernel evidence is published today

Mon, 01 Jan 0001 00:00:00 +0000

Subject: Root Lock by HeartSuite kernel evidence
Fielded 6.18 pin: 6.18.9-hs / packaging 6.18.9-HeartSuite-3 / build #37
Legacy stream: kernel 5.19.6 (maintenance-only; see Kernel Support Policy)

Summary

Stream	Role	Config SHA-256	Evidence pack	Comparison matrix	Checker run	Runtime verification
6.18.9-hs #37	Fielded pin / new deployments	`3cd18247…` in pack	Published	Published	2026-08-18 (`e870d01`)	2026-08-18 (Debian 12 guest)
5.19.6	Legacy / existing fleets	Published	Published	Published	2026-05-19 (`b9b83a0`)	2026-05-19 (Debian 12 VM)

The two lines do not share the same kernel config. 5.19.6 compiled out BPF/FUSE/OVERLAY/USER_NS/AppArmor/TOMOYO. Fielded 6.18.9-hs #37 compiles those in. Treat 5.19.6 scores as legacy, not as a substitute for 6.18.9-hs.

Hardening matrix for kernel 6.18.9

Mon, 01 Jan 0001 00:00:00 +0000

Subject: Root Lock by HeartSuite, fielded 6.18.9-hs (packaging 6.18.9-HeartSuite-3, build #37)
uname -r: 6.18.9-hs
Config SHA-256 (pin payload): 3cd1824742b9a15e9467c774c5f62081f9547f730ad7cd9bce464a7d286a7db9
vmlinuz SHA-256: 1b44fffb9b570497f19f4c68e170602b542bc84bfe9f49d936c123dc59f5db8a
Tool: kernel-hardening-checker commit e870d0141259f875d3d1b54fef49dec7074e4cac, run 2026-08-18
Source file: evidence-pack-6.18.9.txt
Legacy (published): Hardening scores: 5.19.6, evidence-pack-5.19.6.txt

This page measures the fielded #37 pin. It is not a derived unpublished cut. CONFIG_IO_URING, CONFIG_KEXEC, and CONFIG_KEXEC_FILE are =y. Guest /boot/config-6.18.9-hs is an 11-line RD stub — hash the pin payload config.

Part 1 — Measured comparison

Arch linux-hardened 6.18.16-hardened1 and vanilla 6.18.9 defconfig are era-matched 6.18.x (no 6.18.9-hardened in the Arch archive).

Hardening scores: 5.19.6 against the field

Mon, 01 Jan 0001 00:00:00 +0000

Subject: Root Lock by HeartSuite, kernel 5.19.6
Config SHA-256: d67caa637263c33ce939b7eef867f0695d60d11d285d6694a7f5567e73ba6fbc
Tool: kernel-hardening-checker commit b9b83a0, run 2026-05-19
Source file: evidence-pack-5.19.6.txt

Part 1 — Measured comparison (same kernel era)

All three configs below are built from the 5.19.x kernel tree. Checker scores are directly comparable — same Kconfig namespace, same option universe.

Config	Source	Kernel	Overall	Attack-surface	Exploit-resistance
HS 5.19.6	HS canonical config (SHA256: `d67caa6…`)	5.19.6	129/258 (50.0%)	91/132 (68.9%)	31/109 (28.4%)
Arch linux-hardened	gitlab.archlinux.org/archlinux/packaging/packages/linux-hardened @ tag `5.19.11.hardened1-1`	5.19.11	158/258 (61.2%)	77/132 (58.3%)	69/109 (63.3%)
Vanilla x86_64 defconfig	Bundled in kernel-hardening-checker	5.17.1	126/258 (48.8%)	90/132 (68.2%)	29/109 (26.6%)

Reading the table

Attack-surface measures how many dangerous kernel features are disabled. Higher = more things turned off.
Exploit-resistance measures how many defensive mitigations against memory bugs are enabled. Higher = harder to exploit.
These two axes are largely independent and optimized for different threat models.

What this shows

HS leads on attack-surface (91 vs 77 vs 90): it disables BPF_SYSCALL, FUSE_FS, OVERLAY_FS, SECURITY_APPARMOR, SECURITY_TOMOYO, and USER_NS — all of which Arch linux-hardened keeps enabled for its general-purpose user base.

What a red team should test on this kernel

Mon, 01 Jan 0001 00:00:00 +0000

Subject: Root Lock by HeartSuite — fielded 6.18.9-hs (packaging 6.18.9-HeartSuite-3, build #37); 5.19.6 legacy
Evidence status: Measured config SHA-256, checker output, and runtime verification for 6.18.9-hs #37 are in evidence-pack-6.18.9.txt (2026-08-18). The 5.19.6 pack remains the legacy measured stream.
Primary stream: Hardening matrix for kernel 6.18.9
Legacy stream: Config SHA-256 d67caa637263c33ce939b7eef867f0695d60d11d285d6694a7f5567e73ba6fbc — measured 2026-05-19, checker b9b83a0 — comparison matrix, evidence-pack-5.19.6.txt

This page describes the fielded #37 pin. It does not describe a derived unpublished cut that turns IO_URING / KEXEC off. Those options are =y on the binary that boots.

SELinux, AppArmor, TOMOYO — a different job

Mon, 01 Jan 0001 00:00:00 +0000

Subject: Root Lock by HeartSuite, kernel 5.19.6
Audience: Security engineers familiar with SELinux, AppArmor, or TOMOYO evaluating HeartSuite for containment or appliance deployments.

The core distinction

SELinux, AppArmor, and TOMOYO all answer the same question: given that a kernel feature is present, what should a process be allowed to do with it?

HeartSuite answers a different question: which kernel features should exist on this system at all?

This is not a claim that one approach is universally superior.

Kernel hardening in plain language

Mon, 01 Jan 0001 00:00:00 +0000

Kernel: Root Lock by HeartSuite 5.19.6. Config hash: d67caa637263c33ce939b7eef867f0695d60d11d285d6694a7f5567e73ba6fbc. Measured: 2026-05-19.

Root Lock ships a Linux kernel with 9 loadable modules. A standard Debian Linux system typically ships 3,500 to 4,000.

That count is not a capability cut. The kernel is built for one job. Nothing else is included.

Root Lock also disables the kernel features most often used to bypass security controls: BPF (a programmable kernel interface), FUSE (user-space filesystems), overlay filesystems, and competing security policy engines including AppArmor and SELinux. Each of these has been used in documented real-world attacks to escape software sandboxes or override security policies.