With the obvious understanding that all work is done by people who are willing to pitch in... who's domain does this fall under? Would this be something that the Fedora Security Team would focus on? Would this be done by the maintainers of the individual 'services'. I realize a lot of what people would consider 'sane default' configurations are going to vary greatly based on a person's needs, but there's probably some pretty simple baseline ones. Like for instance... should the apache service be loading kernel modules... imma say no on that one... im sure there's probably some reason out there why someone would want that, but i dont think its crazy to suggest that most people using apache won't be wanting that.
So where does one start? File a ticket against the package for the maintainer to solve? That seems like we'd end up with no cohesive plan for the overall issue.
I'd be willing to do the leg work and go down the list and reach out to the maintainers, but it seems like there should be some sort of plan or vision for how this would go by either fesco or the security team.