I haven't really explored this but I remember a few years ago I liked the idea of using grsecurity on my VPSs. Unfortunately I couldn't come up with a good way to do it.

I believe the idea I stumbled onto was to use kexec to load a hardened kernel after boot, which seems doable but I am not sure it would be a good route to go.

Have you/anyone ever tried anything like this?