add hardened kernel config