linux-hardened-unredacted: a hardened kernel for Debian
unredacted.org
We built linux-hardened-unredacted, a hardened Linux kernel for Debian: signed .deb packages, reproducible builds, and fast turnaround on kernel CVEs.

Hardened debian kernel built on top of graphene os patches by the redacted non profit . Details for apt repo are here.

https://git.unredacted.org/unredacted/linux-hardened-unredacted

Figured Id share for those interested. Text below copied from git readme.

What this kernel changes

On top of upstream Linux, this build applies the anthraxx/linux-hardened patch set under a kernel .config composed from anthraxx’s own Arch packaging config.x86_64 (pinned by sha256 + signed-commit-verified in configs/upstream-seed.toml) layered with our project overlay (configs/intent.common.config plus the x86-only configs/intent.x86_64.config; per-symbol rationale in configs/POLICY.md). Each build re-fetches the pinned seed, verifies its signature, merges our intent, runs olddefconfig, and aborts unless every intent line lands — so new hardening features anthraxx adopts flow through automatically, while regressions on the symbols we explicitly pin fail fast at configure time. Full design in docs/operators/config-architecture.md. The hardening falls into four buckets: memory-safety (heap and stack zero-init, stack-erase-on-return, hardened usercopy, FORTIFY_SOURCE, slab freelist hardening and canaries, KASLR, KFENCE); integrity (W^X for kernel and module text, forced module-signature verification, integrity-mode lockdown under Secure Boot); attack-surface reduction (/dev/mem, /proc/kcore, kexec, and several legacy syscalls removed); and restrictive sysctl defaults (unprivileged user namespaces off; perf, BPF, and ptrace restricted to root).

That hardening comes with friction worth knowing before you install:

  • Out-of-tree modules (NVIDIA, ZFS, VirtualBox) must be rebuilt against our headers and signed. DKMS is designed to do this with a machine-local MOK key you enroll once at reboot (not yet validated against a published release — see docs/users/dkms.md).
  • Rootless containers (Docker, Podman), the Chromium sandbox, Snap, and Flatpak depend on unprivileged user namespaces, which are off by default. Re-enable them via the opt-in in docs/users/incompatibilities.md.
  • kexec/kdump, hibernation, and /dev/mem-based tools do not work.
  • Every module must be signed. An unsigned out-of-tree module will not load (MODULE_SIG_FORCE).

Per-symptom workarounds are in docs/users/incompatibilities.md. Keep your distro’s stock kernel installed as a recovery fallback; both coexist and GRUB lists both.