Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThere is no single Linux kernel “hardening enabled” switch. To assess the kernel that is running now, identify its exact release, check that release’s build configuration, and separately inspect runtime controls, lockdown, and boot context. Treat the result as evidence feature by feature—not a certification that the system is secure.
1. Identify the running kernel
Start with the kernel release currently booted:
uname -rUse the release string from this command when selecting a kernel configuration. On some distribution systems it is available at /boot/config-$(uname -r); some kernels also expose it through /proc/config.gz. Neither location is guaranteed to exist on every distribution or build. Check for the file and consult your distribution’s documentation if it is absent.
A configuration for a different installed kernel, a source tree, or a kernel that is not currently running does not establish the configuration of the running kernel.
2. Inspect build-time protections
If the matching configuration file exists and is readable, search for representative options:
#1 Best Overall
grep -E '^(CONFIG_(SECURITY|STRICT_KERNEL_RWX|STRICT_MODULE_RWX|STACKPROTECTOR|RANDOMIZE_BASE|SECURITY_DMESG_RESTRICT)=|# CONFIG_(SECURITY|STRICT_KERNEL_RWX|STRICT_MODULE_RWX|STACKPROTECTOR|RANDOMIZE_BASE|SECURITY_DMESG_RESTRICT) is not set)'
"/boot/config-$(uname -r)"For symbols that appear, =y means built in; =m means provided as a module where that option supports modular builds; and # CONFIG_NAME is not set means it was not selected. A missing symbol is not automatically proof that a feature is off: names, dependencies, and availability can vary by kernel release and architecture.
| Build option or mechanism | What build evidence indicates | What it does not establish by itself |
|---|---|---|
CONFIG_STRICT_KERNEL_RWX and CONFIG_STRICT_MODULE_RWX |
Support for stricter memory permissions, including preventing executable kernel or module memory from also being writable and protecting read-only data. Upstream documents architecture-dependent defaults. Linux Kernel documentation, “Kernel Self-Protection”. | That every related protection is effective in the running configuration on every architecture. |
CONFIG_STACKPROTECTOR |
Stack canaries to detect some stack buffer overflows. Linux Kernel documentation, “Kernel Self-Protection”. | That all memory-corruption flaws are prevented or detectable. |
CONFIG_RANDOMIZE_BASE |
Build support for kernel base relocation used by KASLR, which makes attacks relying on fixed kernel addresses more difficult. Linux Kernel documentation, “Kernel Self-Protection”. | That randomization is effective in every boot or that it prevents attacks on its own. |
CONFIG_SECURITY_DMESG_RESTRICT |
A configuration choice related to the default for kernel.dmesg_restrict in Ubuntu’s documented implementation. Ubuntu kernel protections. |
The current runtime value; inspect the sysctl separately. |
| Module signing, lockdown, and module-loading controls | Distinct build or policy mechanisms that can constrain kernel modification or module loading. Upstream describes signed modules and modules_disabled among the available controls. Linux Kernel documentation, “Kernel Self-Protection”. |
Whether the relevant policy is active now, or whether disabling module loading is operationally suitable for a system that needs modules or drivers. |
These are representative checks, not a universal checklist for every CPU family or kernel flavor. The upstream documentation describes kernel self-protection as a set of mechanisms, with trade-offs that can include debugging and performance considerations.
Rank #2
3. Check runtime sysctl values
Query selected controls on the running system:
sysctl kernel.dmesg_restrict kernel.kptr_restrict kernel.modules_disabledUbuntu documents these controls as follows: kernel.dmesg_restrict=1 restricts kernel log access to privileged users with CAP_SYSLOG; kernel.kptr_restrict=1 restricts exposure of kernel addresses; and kernel.modules_disabled can prevent subsequent module loading. These descriptions and defaults are Ubuntu-scoped; use your distribution’s documentation to interpret values and policy on another system. Ubuntu kernel protections
A sysctl reports a runtime value, which may have been changed after boot. It does not by itself show whether that value will persist across reboots. If a key is unavailable, record it as unavailable rather than treating that result as proof that protection is enabled or disabled. Ubuntu notes that a command-line sysctl change is not persistent unless separately configured. Ubuntu kernel protections
4. Check lockdown and boot context
Lockdown mode
If securityfs is mounted and the interface is present, inspect the active mode:
cat /sys/kernel/security/lockdownThe active mode is more informative than finding CONFIG_SECURITY_LOCKDOWN_LSM in a build configuration alone. Upstream documents that lockdown can be enabled through the kernel command line or through this interface. Integrity mode disables features that would allow the kernel to be modified at runtime; confidentiality mode also restricts user-space reads of confidential kernel material. Upstream Linux lockdown Kconfig
Rank #4
Secure Boot and command line
Check Secure Boot status using the method documented for your distribution, then report it alongside lockdown status. Ubuntu documents lockdown enforcement in its supported configurations as tied to UEFI Secure Boot, with some protections limited by architecture; those details should not be generalized to other distributions or machines. Ubuntu security features overview Ubuntu security features tables
Inspect the effective kernel command line with:
cat /proc/cmdlineCompare its mitigation-related parameters with your distribution’s configuration and documentation. There is no one generic command-line option that demonstrates that all mitigations are active.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →5. Record evidence feature by feature
Keep build support, active runtime state, distribution defaults, and unverified items separate. A practical record can use these columns:
- Protection: name the specific mechanism, such as address randomization or restricted kernel logs.
- Evidence source and value: record the matching config symbol, sysctl output, lockdown interface, or boot context you checked.
- What it demonstrates: distinguish a compiled-in capability from an active policy or runtime setting.
- Scope and caveat: note relevant architecture, kernel flavor, distribution, module needs, or persistence uncertainty.
Use “not verified” when a file, interface, or value is unavailable. Ubuntu’s release documentation is a useful example of vendor-specific defaults and feature availability, not a universal Linux defaults table. Ubuntu security features overview Ubuntu security features tables
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
