Prior art, and the gap
The Linux hardening space is not empty, and pretending otherwise would be the fastest way to lose a security-competent reviewer. Each tool below is good at the question it asks. None of them asks who is holding the surface open, or what is safe to remove because nothing touches it.
01 / landscape
What exists
kconfig-hardened-check / kernel-hardening-checker
asks: Is this kernel built with the recommended hardening options?
gap: Config-only and host-blind. It cannot tell you whether an option matters on this machine, who is using the surface it leaves open, or what would break if you changed it.
Lynis / CIS benchmarks
asks: Does this host match a checklist of accepted practice?
gap: A flat pass/fail list with no reachability model and no ordering. Every item weighs the same, so operators triage by guessing.
CVE scanners (Trivy, Grype, vendor feeds)
asks: Which known vulnerabilities apply to the installed kernel version?
gap: Version matching, not exposure. A CVE in a module that cannot be autoloaded on this host scores the same as one any local user can reach.
Falco / auditd / Tetragon
asks: What is happening on this host right now?
gap: Runtime detection, not surface reduction. They tell you a syscall was used; they do not tell you which surface nothing has used and could therefore be removed for free.
seccomp profile generators (oci-seccomp-bpf-hook, docker-slim)
asks: Which syscalls does this one container need?
gap: Per-container and per-syscall. No host-level attribution, no CVE weighting, no cross-workload sharing analysis, no ranked plan.
02 / the delta
Three things ksl adds
Each is checkable against the report, not a claim about ambition.
Attribution
Reachable surface is divided across the live workloads that touch it, with sole-owned surface separated from shared. Hardening becomes a conversation about a specific service, not about the host in the abstract.
Orphaned surface
Surface that is present, unprivileged-reachable, and touched by nothing during the observation window. Removing it has provably zero functional impact, which makes it the only hardening nobody has to argue about.
Counterfactual plan
A ranked, reversible plan from a weighted set cover — CVE mass killed per unit of predicted breakage — with the artifact, the detection command and the revert attached to every step.
03 / scope
What ksl deliberately is not
Not a CVE database, not a runtime detector, not a config linter, and not a kernel module. It consumes those categories' outputs where useful and answers the question none of them do.
The measurement limits are stated in full on the method page, because a hardening tool that overclaims gets uninstalled the first time it breaks production.