hardened-x86.config

## https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings

## On 32-bit kernels, require PAE for NX bit support.
# CONFIG_M486 is not set
# CONFIG_HIGHMEM4G is not set
CONFIG_HIGHMEM64G=y
CONFIG_X86_PAE=y

## Disallow allocating the first 64k of memory.
CONFIG_DEFAULT_MMAP_MIN_ADDR=65536

## Disable Model-Specific Register writes.
# CONFIG_X86_MSR is not set

## Randomize position of kernel.
CONFIG_RANDOMIZE_BASE=y

## Enable Kernel Page Table Isolation to remove an entire class of cache timing side-channels.
CONFIG_PAGE_TABLE_ISOLATION=y

## Don't allow for 16-bit program emulation and associated LDT tricks.
# CONFIG_MODIFY_LDT_SYSCALL is not set