Cybersecurity
The Engineer's Guide to Linux Kernel Hardening
A comprehensive guide for engineers on securing the core of the Linux OS through configuration, security modules, and modern defense techniques.
The Linux kernel is the core of the operating system, managing all hardware and software resources. This central role makes it a primary target for sophisticated attacks, as a compromised kernel grants an attacker complete control. While modern kernels have many built-in security features, default distribution settings are often optimized for compatibility and performance, not maximum security, leaving systems vulnerable.
This guide provides a practical, defense-in-depth approach to kernel hardening. We will cover essential sysctl configurations for network and memory protection, the role of compile-time options, and a deep dive into using Linux Security Modules (LSMs) like AppArmor and SELinux to enforce mandatory access control. You will learn how to reduce your system's attack surface and leverage the kernel's own self-protection mechanisms to build a more resilient infrastructure.
Latest briefings on The Engineer's Guide to Linux Kernel Hardening
Security
Old Virus Secretly Altered Calculations
A newly analyzed computer virus from over 20 years ago, named fast16.sys, reveals an early Stuxnet-style attack. The malware was designed to selectively target high-precision calculation software, subtly altering results in memory. This highlights a long-standing threat of data manipulation in critical systems.
Neeraj Dhiman ·
Infra
Argo CD Now Verifies Your Code’s Origin
The popular cloud deployment tool Argo CD is getting a major security boost. Its latest update adds features to verify that your code is authentic and to encrypt internal traffic, helping to secure your software supply chain.
Ashish Kale ·
Infra
Get a Clearer View of Your Kubernetes AI Jobs
A new plugin for the Headlamp Kubernetes UI now supports Volcano, a popular batch scheduler for AI and high-performance computing. This gives developers a simple web interface to inspect and manage complex batch jobs directly within Kubernetes.
Ashish Kale ·
Infra
Secure Remote Access Just Got a Replay Button
HashiCorp's Boundary 1.0 is now production-ready, adding a key feature: RDP session recording. This helps security and IT teams monitor remote desktop access and meet strict compliance and audit requirements.
Ashish Kale ·
Infra
Cloudflare Tool Migrates Security Setups in Hours
Cloudflare has released a new open-source tool to help companies move to its Zero Trust security platform. It includes automated logic to migrate from competitors like Zscaler and Palo Alto Networks, cutting migration times from months to hours.
Ashish Kale ·
Data
Keep Your Old PostgreSQL Database Secure for Longer
A new service from PGX offers security patches and bug fixes for old, unsupported versions of PostgreSQL. This helps companies that can't upgrade stay secure and maintain data integrity without a costly migration.
Taranpreet Singh ·
Infra
Cloudflare Replaces API Tokens with Secure Logins
Cloudflare now lets all developers use OAuth for third-party app integrations. This offers a more secure alternative to traditional API tokens, giving users granular control over what data and actions an application can access.
Ashish Kale ·
Tech
Ukraine Open-Sources Captured Russian Military Technology
Ukraine's Ministry of Defence has launched TrophyLab, a new platform open-sourcing intelligence on captured Russian military hardware. Verified allies can access technical data, schematics, and even request physical samples to develop countermeasures.
Taranpreet Singh ·
Infra
AI Is Turning Developers Into Code Validators
A new GitLab report finds AI code tools are turning developers into validators, not just writers. This shift creates new risks, as teams struggle to control the quality and security of code they didn't write.
Ashish Kale ·
Infra
Find and Fix Workflow Bugs Faster on Vercel
Vercel has launched a redesigned trace viewer for its Workflows tool. The update helps developers debug complex processes more quickly by making it easier to search, zoom, and inspect each step of a workflow run.
Ashish Kale ·
Infra
Why Azure Says Stop Blaming People for Outages
A post-mortem of Azure's 2023 global outage reveals a crucial lesson: "human error" is a myth. Engineering leaders should instead focus on fixing systemic flaws to build truly resilient systems and protect their teams from blame.
Ashish Kale ·
Infra
Vercel Wants to Replace Your Feature Flag Tool
Vercel has launched its own feature flagging tool, built directly into its platform. This gives developers a native way to safely roll out new features and test changes, potentially replacing third-party services like LaunchDarkly.
Ashish Kale ·
Infra
Vercel Now Lets You Build Real-Time Apps
Vercel now supports WebSockets in its serverless functions, a long-requested feature. This allows developers to build real-time applications like live chats and collaborative tools directly on the platform, paying only for active processing time.
Ashish Kale ·
Infra
eBPF Lets You Safely Extend the Linux Kernel
The technology eBPF allows developers to safely run custom programs inside the Linux kernel. This provides deep system visibility for performance and security monitoring without the risks or slow update cycles of traditional methods.
Ashish Kale ·
AI
Control Ubuntu With Your Voice, No Cloud Needed
Ubuntu is adding a new speech-to-text feature that lets you dictate to your desktop. The tool runs entirely on your local machine, ensuring your voice data remains private and doesn't get sent to the cloud.
Neeraj Dhiman ·
AI
This AI Finds Security Flaws Others Refuse To
A new AI model is designed specifically for security testing, unlike major models that refuse such tasks. It helps smaller companies find and fix vulnerabilities that might otherwise be missed, leveling the playing field against attackers.
Neeraj Dhiman ·
Infra
Keep Your Users Logged In During AWS Outages
Amazon Cognito now automatically copies user data to a backup region. This means if one AWS region fails, your application can still authenticate users from another, improving reliability and simplifying disaster recovery for developers.
Ashish Kale ·
Infra
Amazon ECS Now Scales Your Apps Much Faster
Amazon ECS can now adjust application capacity much faster, thanks to new high-resolution metrics. This allows services to react to traffic spikes in seconds instead of minutes, improving performance and potentially lowering cloud costs.
Ashish Kale ·
Infra
GitHub Is Helping Maintainers Reduce Project Noise
GitHub now lets open-source maintainers limit pull requests from new contributors. This helps them manage high volumes of submissions and focus on quality contributions instead of getting bogged down by spam or low-effort changes.
Ashish Kale ·
Infra
Getting Kubernetes Certified Just Became Much Simpler
The CNCF, Linux Foundation, and Udemy have partnered to offer a unified training and certification path. This makes it much easier for developers to purchase courses and sit for official Kubernetes exams like CKA, CKAD, and CKS.
Ashish Kale ·
Data
Build Elastic Integrations Faster, With or Without Code
Elastic 9.4 now offers two ways to build custom integrations. A new no-code tool makes it faster for anyone, while a developer toolkit provides full control for complex needs, simplifying data ingestion from any source.
Taranpreet Singh ·
Infra
Vercel Unlocks 24-Hour Sessions for Developers
Vercel now allows its Sandboxes to run for up to 24 hours, a major increase from the previous five-hour limit. This change helps developers run complex, long-running tasks like large data processing and extensive testing.
Ashish Kale ·
Infra
Docker Retires Its Original Image Signing Tool
Docker is retiring its original Content Trust (DCT) feature and the Notary v1 service. This change requires developers and security teams to migrate to modern tools to continue verifying the integrity and publisher of their container images.
Ashish Kale ·
Infra
Key Java Frameworks Get Major Summer Updates
The Java ecosystem saw a wave of updates, including progress on Jakarta EE 12 and new releases for GraalVM, Gradle, and Micrometer. These changes bring stability, new features, and performance improvements for developers.
Ashish Kale ·
Tech
AMD Reinstates Free Vivado Linux Support
AMD has reinstated Linux support for the free version of its Vivado design suite. This move reverses an earlier, unpopular decision and is a welcome update for hardware and embedded systems engineers who rely on Linux for developing with FPGAs and adaptive SoCs.
Taranpreet Singh ·
Security
Microsoft Named Leader in Endpoint Protection
For the seventh consecutive time, Microsoft has been recognized as a Leader in the 2026 Gartner Magic Quadrant for Endpoint Protection. The placement highlights the company's strength in the endpoint security market, particularly with its Microsoft Defender product, amid increasingly coordinated and fast-moving cyber threats.
Neeraj Dhiman ·
Security
Critical GDAL Library Vulnerability Discovered
A high-severity vulnerability has been discovered in the Geospatial Data Abstraction Library (GDAL). The flaw, located in its bundled LibTIFF component, could allow an attacker to execute arbitrary code, cause a denial of service, or access sensitive information by using a specially crafted TIFF image file.
Neeraj Dhiman ·
Security
NNCP Flaw Allows Remote File Access
A security vulnerability has been found in the NNCP file transfer utility. The flaw allows a remote attacker to bypass directory restrictions and read or write files anywhere on the system. This is a high-severity path traversal issue affecting users of this specific tool.
Neeraj Dhiman ·
Security
Schneier Hosts Open Security Discussion
The 'Schneier on Security' blog has published its recurring 'Friday Squid Blogging' post. While ostensibly about marine life, the post serves as a well-known open thread for the security community to discuss recent news and topics that were not covered on the blog during the week.
Neeraj Dhiman ·
Security
Over Half of CISOs Would Pay Ransom
A new survey commissioned by Absolute Software reveals a significant trend in ransomware response. It found that 58% of Chief Information Security Officers (CISOs) say their organization would pay a ransom to recover data, highlighting a major shift in incident response strategy.
Neeraj Dhiman ·
Frequently asked questions
What is Linux kernel hardening?
Linux kernel hardening is the process of configuring the kernel and using its built-in security features to reduce its attack surface. This involves applying secure settings via sysctl, enabling security-focused compile-time options, and using Linux Security Modules (LSMs) to enforce mandatory access control. The goal is to make vulnerabilities more difficult to exploit and to contain the impact of any successful breach.
What's the difference between SELinux and AppArmor?
Both are Linux Security Modules (LSMs) that provide Mandatory Access Control (MAC), but they differ in their approach. SELinux is more granular, using security labels on every file and process, which offers immense power but is notoriously complex to manage. AppArmor is path-based, defining permissions for specific executables, which makes it significantly easier to learn and configure for most common use cases.
How do sysctl settings improve kernel security?
The sysctl interface allows engineers to modify kernel parameters at runtime, many of which directly impact security. For example, you can disable unused network protocols, enable TCP SYN cookies to mitigate DoS attacks, or restrict access to kernel pointers and logs via /proc. These tunables provide a powerful way to harden the kernel's networking stack and memory management without recompiling.
What is the Kernel Self Protection Project (KSPP)?
The Kernel Self Protection Project (KSPP) is a community-driven effort to build and enable proactive, defensive technologies directly within the upstream Linux kernel. Its goal is to eliminate entire classes of vulnerabilities and make exploits more difficult, rather than just reacting to individual bugs. Examples of KSPP features include improved Address Space Layout Randomization (ASLR), stack-protector, and control-flow integrity (CFI) mechanisms.