a linux-libre kernel with all standard Linux Security Modules enabled, plus hardened or Knock patches - see https://wiki.parabola.nu/Xtreme