Linux kernel security tunables everyone should consider adopting

Cloudflare describes Linux kernel hardening practices to maintain system integrity: enforcing signed kernel modules with per-build ephemeral keys, disabling legacy kexec_load while using kexec_file_load with signature verification to retain crashdump support, enabling KASLR, restricting kernel pointer leaks (kptr_restrict, dmesg_restrict), and enforcing the Lockdown LSM (integrity by default). A demonstration shows how an unsigned module can flip SELinux to permissive on a stock Debian kernel, illustrating the need for these controls and emphasizing secure boot continuity and regular kernel updates.