An XCCDF Rule
/boot/config-*
CONFIG_SECURITY_WRITABLE_HOOKS
grep CONFIG_SECURITY_WRITABLE_HOOKS /boot/config-*