Kernel hardening in one comparison table

Overview: Side-by-side comparison of Root Lock by HeartSuite kernel configuration choices against community hardened kernels and the KSPP benchmark.

Subject: Fielded 6.18.9-hs (packaging 6.18.9-HeartSuite-3, build #37). 5.19.6 is the legacy measured stream.
Evidence: evidence-pack-6.18.9.txt (2026-08-18, checker e870d01). Legacy: 5.19.6 matrix, evidence-pack-5.19.6.txt.

For deployment, Secure Boot, fleet, and “no custom kernel” alternatives see the Enterprise Adoption Guide. Support and scanner notes: Kernel Support Policy, Distro Compatibility Matrix, CVE Hygiene for Scanners.

What this document covers

All numbers below are outputs of kernel-hardening-checker commit e870d0141259f875d3d1b54fef49dec7074e4cac applied to the #37 pin config (SHA-256 3cd1824742b9a15e9467c774c5f62081f9547f730ad7cd9bce464a7d286a7db9) and to configs bundled with that checker.

Arch linux-hardened 6.18.16-hardened1 and vanilla 6.18.9 defconfig are the era-matched 6.18.x peers. Do not mix these percentages with the 5.19.6 pack (checker b9b83a0).

This page measures the fielded pin. It does not describe a derived cut that disables IO_URING or KEXEC.

At a glance (fielded 6.18.9-hs #37)

* KSPP is a recommendation fragment, not a shipping kernel.

Legacy 5.19.6 glance (checker b9b83a0, not comparable item-for-item): attack-surface 68.9% (91/132), exploit-resistance 28.4% (31/109), 0 modules loaded / 9 .ko. See the 5.19.6 matrix.

What this pin is and is not

On 5.19.6, Root Lock compiled out BPF, user namespaces, FUSE, OverlayFS, AppArmor, and TOMOYO, and sat near vanilla on exploit-resistance.

On fielded 6.18.9-hs #37 that story is inverted:

• Bypass primitives above are compiled in (OVERLAY_FS=m).
• Live LSM on the measured guest: lockdown,capability,landlock,yama,apparmor,tomoyo,bpf,ipe,ima,evm.
• Exploit-resistance options INIT_ON_ALLOC_DEFAULT_ON, HARDENED_USERCOPY, FORTIFY_SOURCE, SLAB_FREELIST_RANDOM / _HARDENED, KFENCE, and MODULE_SIG are on.
• IO_URING, KEXEC, and KEXEC_FILE are =y.

Lockdown and the allowlist still constrain unallowlisted programs and (when engaged) new module loads. That is policy, not ENOSYS.

Broader market landscape

Arch 6.18.16 is era-matched. The 5.19.6 row uses the older pack.

Decision guide

Choose Root Lock if your primary concern is:

• Kernel-enforced allowlist and Lockdown on a dedicated host
• A closed, reviewed program set after Setup Mode
• Running as a guest on KVM, VMware, or cloud hypervisors

Do not choose it expecting the 5.19.6 compile-out brochure on a 6.18.9-hs host. BPF, FUSE, OverlayFS, user namespaces, and AppArmor are present on this pin. Local eBPF tooling and FUSE are not ENOSYS.

Consider extra kernel hardening or a future derived cut if you also need:

• The 5.19-style compiled-out bypass list (BPF=n, IO_URING=n, KEXEC=n, …)
• KSPP items still FAIL on this pin (INIT_ON_FREE, KSTACK_ERASE, MODULE_SIG_FORCE, …)

Root Lock is not a replacement for network firewalls, WAFs, SIEM, or EDR hunting. It is host-local kernel enforcement.

Verification

Pin config SHA-256: 3cd1824742b9a15e9467c774c5f62081f9547f730ad7cd9bce464a7d286a7db9
vmlinuz SHA-256:    1b44fffb9b570497f19f4c68e170602b542bc84bfe9f49d936c123dc59f5db8a
uname -r:           6.18.9-hs
file(1) build:      #37
Tool: https://github.com/a13xp0p0v/kernel-hardening-checker (commit e870d0141259f875d3d1b54fef49dec7074e4cac)
Expected checker:   OK 148 / FAIL 111

Do not hash guest /boot/config-6.18.9-hs (11-line RD stub). Full methodology: evidence-pack-6.18.9.txt.