One security expert a while back recommended grsecurity. From what I gather, it prevents permission exploitation in the first place and does so in a way that is pretty robust (can't remember the principle on how it does so)

Otherwise, I'd say forget about trying to secure Linux and just go with QubesOS unless you need 3D graphics acceleration

Edit: QubesOS allows you to run at least some conventional brands of Linux out of the box, but it allows memory efficient VM isolation between them, and some other really cool features, overall making securing stuff much simpler than installing a bunch of of random tools from different parties