"A new system.conf setting NoNewPrivileges= is now available which may be used to turn off acquisition of new privileges system-wide (i.e. set Linux' PR_SET_NO_NEW_PRIVS for PID 1 itself, and thus also for all its children). Note that turning this option on means setuid binaries and file system capabilities lose their special powers. While turning on this option is a big step towards a more secure system, doing so is likely to break numerous pre-existing UNIX tools, in particular su and sudo."
Strongly trimmed linux kernel + minimal userspace based on klibc will certainly fit on 1.44MB. The dash (x86) built with klibc occupies something with <50kB in memory, below 100kB on disk.
Just 2 and a half years ago I was running the kernel 4.10 on such equipment - AMD K6-2 300MHz, 3DFx Banshee (AGP2x), Trident 9440 (PCI), television card bt878, sound card Maestro, SoundBlaster Creative.
Everything worked. I am sure that it would also move under the latest 5.3-rc2.
A bigger problem is with the right (ready) userland (i486, i586) than using old hardware with the latest kernel.
It's easier to create a new user account and run firefox from it. Something like:
xhost +si:localuser:firefox && su - firefox -c 'DISPLAY=:0 HOME=/home/firefox firefox 2>/dev/null' && xhost -
In this list, I see more than 40 ARM-based models. This is very, very much compared to the list of commercially available M$ Surface. In comparison with the number of Android devices it's a drop in the sea.
NoNewPrivileges=yes
"A new system.conf setting NoNewPrivileges= is now available which may be used to turn off acquisition of new privileges system-wide (i.e. set Linux' PR_SET_NO_NEW_PRIVS for PID 1 itself, and thus also for all its children). Note that turning this option on means setuid binaries and file system capabilities lose their special powers. While turning on this option is a big step towards a more secure system, doing so is likely to break numerous pre-existing UNIX tools, in particular su and sudo."