Custom Security-Centric Linux Platform with Automated Build Infrastructure, Kernel-Level Hardening, and CIS-Aligned Secure Deployment

Modern Linux distributions offer flexibility and performance but often lack security-by-default configurations, making systems vulnerable to misconfigurations, privilege escalation, and post-deployment attacks. While existing security-focused solutions rely heavily on manual hardening or post-installation controls, they frequently fail to provide consistent compliance, reproducibility, and kernel-level protection. To address these limitations, this work proposes a custom security-centric Linux platform that integrates automated build infrastructure, kernel-level hardening, and CIS benchmark–aligned secure deployment within a unified security-by-design framework. The proposed system is built from a minimal Linux base and employs an automated build pipeline to enforce secure package management, deterministic system configuration, and reproducible deployments. Kernel-level protections are incorporated through Linux Security Modules (LSMs), attack surface reduction, sysctl tuning, memory protection mechanisms, and compiler-based hardening. Additionally, CIS benchmark recommendations are translated into build-time policies covering user management, filesystem permissions, service minimization, logging, and network security. Experimental evaluation demonstrates a significantly reduced attack surface and high CIS compliance with minimal performance overhead compared to standard Linux installations. The proposed platform provides a scalable, auditable, and efficient foundation for secure enterprise, cloud, and cybersecurity-focused operating system deployments.