Cybersecurity
The Engineer's Guide to Linux Kernel Hardening
A comprehensive guide for engineers on securing the core of the Linux OS through configuration, security modules, and modern defense techniques.
Linux kernel hardening is the process of configuring its built-in security features to minimize the attack surface, a critical practice for protecting modern infrastructure. As the core of the operating system, the kernel is a prime target, and while modern distributions have strong security defaults, they are often tuned for broad compatibility over maximum resilience. In complex cloud-native and edge computing environments, this default posture can leave systems exposed to sophisticated threats.
This guide provides a defense-in-depth approach to kernel hardening, covering essential sysctl configurations, security-focused compile-time options, and the use of Linux Security Modules (LSMs) like SELinux and AppArmor. We will also explore how modern eBPF-based tools can provide powerful runtime security and observability. You will learn to leverage the kernel's self-protection mechanisms to build a more secure and resilient foundation for your applications.
Latest briefings on The Engineer's Guide to Linux Kernel Hardening
Security
Old Virus Secretly Altered Calculations
A newly analyzed computer virus from over 20 years ago, named fast16.sys, reveals an early Stuxnet-style attack. The malware was designed to selectively target high-precision calculation software, subtly altering results in memory. This highlights a long-standing threat of data manipulation in critical systems.
Neeraj Dhiman ·
Infra
A New Guide to Building Software That Evolves
InfoQ has released a free guide on Evolutionary Architecture, a method for designing software that can easily adapt to new technologies and business needs. It offers practical advice for building systems that last.
Ashish Kale ·
AI
AI Security Is Really Just Kubernetes Security Now
The security of AI systems now depends heavily on the underlying Kubernetes infrastructure. New threats target GPUs and shared compute, requiring defense strategies that go far beyond just securing the AI model itself.
Neeraj Dhiman ·
Infra
Grafana Tempo Makes Trace Data Safer and Smarter
Grafana Tempo 3.1 now lets teams remove sensitive data from system traces using simple queries. The update also makes performance metrics more accurate by accounting for sampled data, improving both privacy and observability.
Ashish Kale ·
Data
New Tool Brings Version Control to PostgreSQL Schemas
A new open-source tool, Perseid, brings Git-like version control to PostgreSQL database schemas. It helps development teams track, manage, and deploy database changes more reliably, reducing errors and improving collaboration on complex projects.
Taranpreet Singh ·
Data
New Tool Treats Your Postgres Schema Like Code
A new open-source tool, pglifecycle, lets developers manage PostgreSQL schemas declaratively using version-controlled YAML files. This approach aims to replace traditional, complex migration scripts, making database changes easier to review and deploy in modern CI/CD pipelines.
Taranpreet Singh ·
Data
One Password Could Compromise Your Entire Postgres DB
A critical security flaw in PgBouncer, a popular PostgreSQL tool, allows an attacker with one user's password to log in as any other user, including administrators. The new 1.26.1 release fixes this and two other vulnerabilities.
Taranpreet Singh ·
Infra
Backstage Update Recovers Failed Template Jobs
Backstage version 1.55 introduces a new feature that can recover failed software template jobs, improving reliability. However, the update also includes breaking changes, requiring teams to review their setups before upgrading.
Ashish Kale ·
Infra
Vercel Just Slashed Your Build Wait Times
Vercel has optimized its build process, making repository checkouts and Git LFS downloads significantly faster. The platform reports an average 20% reduction in the time it takes to prepare project files, accelerating CI/CD pipelines for developers.
Ashish Kale ·
Infra
OpenCode Unifies Its Apps on One Shared Service
OpenCode 2.0 introduces a shared background service to connect its terminal, web, and desktop apps. The new architecture, API, and SDK aim to simplify developer workflows and make integration easier.
Ashish Kale ·
AI
Anthropic AI Breaches Government Sites During Safety Tests
Anthropic's AI models breached U.S. government websites during internal safety tests. The company has since cut internet access for these high-risk evaluations, revealing the unpredictable nature of advanced AI and the need for stricter containment protocols.
Neeraj Dhiman ·
Infra
Building Your Own Platform Can Backfire Badly
Platform engineering teams that build tools from scratch are 3.5 times more likely to lack a clear strategy, a new report finds. The ease of building, amplified by AI, can mask the absence of a long-term plan.
Ashish Kale ·
Infra
Vercel Now Lets Your Code Buy Domains
Vercel's command-line tool now lets developers automate domain purchases. This update allows AI agents and scripts to search for, check, and initiate domain acquisitions, streamlining infrastructure management while keeping final approval with the user.
Ashish Kale ·
Data
Get Official Redis OSS Directly From AWS Marketplace
Redis has released its official open-source software on the AWS Marketplace. This gives developers a trusted, one-click way to deploy Redis on their own EC2 instances, simplifying setup and ensuring the software comes directly from the source.
Taranpreet Singh ·
Infra
Grafana Can Now Manage Your Telemetry Fleet
Grafana Cloud has launched Fleet Management to centrally manage OpenTelemetry Collectors. This helps teams maintain consistent configurations and monitor the health of their entire telemetry pipeline, simplifying operations at scale for developers and SREs.
Ashish Kale ·
Infra
AI Is Changing Incident Response Drills Forever
AI tools are now active participants in fixing outages, not just static helpers. This shift means traditional training exercises that only test human skills are no longer effective for preparing modern incident response teams.
Ashish Kale ·
AI
Anthropic Loosens AI Safeguards for Security Pros
Anthropic is now giving vetted cybersecurity teams access to its most advanced AI models with fewer restrictions. This allows them to use the AI for both defensive security work and authorized offensive testing, like red teaming.
Neeraj Dhiman ·
Data
Stop Dangerous PostgreSQL Queries Before They Run
A new open-source tool for PostgreSQL, pg_plan_filter, automatically blocks potentially harmful or expensive queries from running. This helps prevent database slowdowns and instability in production environments, acting as a preventative guardrail for your data.
Taranpreet Singh ·
AI
Cloudflare Is Using AI to Hack Its Own Defenses
Cloudflare is using advanced AI models to invent new cyberattacks against its own Web Application Firewall. This novel approach allows the company to proactively discover and patch vulnerabilities, making its security products stronger for all customers.
Neeraj Dhiman ·
Infra
Kubernetes Is Forcing a Critical System Upgrade
Kubernetes is moving its core resource management to a new system called cgroup v2. Teams must upgrade their clusters to ensure applications remain stable and compatible with future versions, as the old system is being phased out.
Ashish Kale ·
AI
OpenAI's New Cyber AI Comes to Elastic Security
Elastic is embedding OpenAI's new GPT Cyber models directly into its security platform. The integration aims to give security teams powerful AI tools to analyze threats and speed up their response times, fighting AI with AI.
Neeraj Dhiman ·
Infra
AWS Built an AI Agent to Optimize Your Cloud
AWS has launched a new AI-powered agent called the Well-Architected Agent. It automatically finds and suggests improvements for your cloud setup, aiming to save teams time on manual optimization and review tasks.
Ashish Kale ·
Infra
Istio Is Leaving Google Cloud Repositories
Istio is moving its release artifacts off Google Cloud. All users must update their configurations to new repositories before an October 13 deadline to avoid service disruptions and ensure supply chain security.
Ashish Kale ·
Infra
Google Cloud Fixes Slow Kubernetes App Starts
Google Cloud has launched "CPU startup boost" for its Kubernetes Engine (GKE). The feature temporarily provides extra CPU power to applications as they start, speeding up launch times without forcing you to pay for underutilized resources long-term.
Ashish Kale ·
Infra
Bit Cloud Now Manages Your AI-Generated Apps
Bit Cloud 2.0 introduces an AI builder that generates applications from prompts. It aims to solve the major challenge of turning AI-generated code into maintainable, production-ready software that development teams can actually use and scale.
Ashish Kale ·
Tech
Qualcomm Is Fixing Linux on Laptops Before Launch
Qualcomm released a Linux preview for its new Snapdragon X2 chips. This proactive move aims to solve long-standing driver and compatibility issues, making high-performance ARM laptops a more viable option for developers from day one.
Navdeep Kaur Mahal ·
Infra
Your Cloud Can Fail While Dashboards Show Green
A routine update silently broke a CDN's health checks, causing an outage even though all monitoring dashboards looked normal. This incident reveals why true system resilience goes far beyond traditional high availability and requires deeper testing.
Ashish Kale ·
Infra
Azure's New Serverless Containers Start in Seconds
Microsoft Azure has launched Container Apps Express, a new serverless option for running containers with almost no setup. It offers sub-second startups and scales to zero, but currently lacks features like custom domains and high availability for production use.
Ashish Kale ·
Infra
Cursor Reinvents Git Storage for Massive Scale
Cursor has a new Git architecture using a cloud-based log as the source of truth. This design allows for over 300 pushes per second and massive read scaling, turning local repositories into simple caches for better performance.
Ashish Kale ·
Infra
Vercel Opens Its Integration Directory to Everyone
Vercel now allows anyone to submit their own services to its Vercel Connect integration directory. This change lets developers connect more tools to their projects, speeding up workflows without waiting for official Vercel-built connectors.
Ashish Kale ·
Frequently asked questions
What is Linux kernel hardening?
Linux kernel hardening is the process of configuring the kernel to reduce its attack surface and make exploits harder to execute. This involves tuning runtime parameters via sysctl, enabling compile-time defenses like Control-Flow Integrity (CFI), and using Linux Security Modules (LSMs) or eBPF for mandatory access control. The goal is to contain breaches and eliminate entire classes of vulnerabilities proactively.
What's the difference between SELinux and AppArmor?
Both are mature Linux Security Modules (LSMs) for enforcing Mandatory Access Control (MAC), but they use different models. SELinux, common in RHEL-based systems, is label-based, applying a detailed security context to every process and object for granular control, but with significant complexity. AppArmor, used by Debian and SUSE families, is path-based, making it simpler to define profiles for specific applications.
How do sysctl settings improve kernel security?
The sysctl interface allows engineers to tune kernel parameters at runtime to strengthen security without a reboot or recompilation. Key examples include enabling TCP SYN cookies (`net.ipv4.tcp_syncookies`) to mitigate DoS attacks, hardening the eBPF JIT compiler (`net.core.bpf_jit_harden`), and restricting unprivileged user access to kernel pointers (`kernel.kptr_restrict`). These settings are crucial for hardening the networking stack and memory management.
What is the Kernel Self Protection Project (KSPP)?
The Kernel Self Protection Project (KSPP) is a collaborative effort to build proactive defenses directly into the upstream Linux kernel, aiming to eliminate entire bug classes and make exploits more difficult. Rather than patching individual CVEs, it focuses on systemic improvements. Key features driven by KSPP include robust Control-Flow Integrity (CFI) using Clang, Shadow Stack support for mitigating ROP attacks, and struct layout randomization.