This is sort of on an as-needed basis, at the moment. Should there be coverage for every option? Ideally, that would be the case. But there are a [lot of options](https://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity_and_PaX_Configuration_Options).

Second, RANDSTRUCT is here because as I said above it breaks the vbox guest networking drivers, meaning it's impossible to do things like test grsec kernels in VirtualBox. I have not yet discovered why this is the case (in particular other modules are compiled with the correct entropy string as a part of `RANDSTRUCT`). However, it does *not* break other modules, meaning RANDSTRUCT can be deployed successfully e.g. on Hetzner (where it works great).

I don't know how to predicate this on whether or not we're being deployed inside a VirtualBox guest - does anyone know how to do that? Then RANDSTRUCT can be an option, but optionally toggled if it might break something for the moment.

This also brings up a good point in that duplicated `kernelExtraConfig` options will be ignored (or possibly error) the kernel configuration script. So maybe we should make everything an actual option...