You didn't misunderstand at all! When I stated that, I mean two different things:
- Kernel hardening
Kernel hardening is when you take the kernel and add patches/configure it to be more secure, like grsecurity.
- Userland hardening This is when you do exactly what you're talking about: you restrict what the userland can do and configure userland programs to be more secure (ie turning off insecure Apache options). This could also mean jailing or containerizing them.