A practical 2026 guide to fapolicyd on RHEL and Fedora: how it uses fanotify to gate execve, how to write rules that don't lock you out, the safe permissive-to-enforce rollout, and how it maps to CIS, STIG, and PCI DSS compliance.
Learn YARA and YARA-X on Linux for malware detection and threat hunting. Covers rule writing, ELF/hash modules, Wazuh integration, Volatility 3 memory scans, and fleet-wide scanning.
Deploy Keylime continuous remote attestation on Linux with TPM 2.0: registrar, verifier, Rust agent, IMA runtime policies, and revocation webhooks in 2026.
Use BPF LSM (KRSI) to write dynamic kernel security policies in eBPF. Enable it on Linux 6.x, ship your first enforcement program, and stage audit-to-enforce rollouts safely.
Deploy Linux IMA and EVM for kernel-enforced file integrity. Learn appraisal policy, EVM key sealing to TPM 2.0, IMA digest lists, and Keylime remote attestation with working configs.