Recommended kernel options for grsec + xen (as dom0)