diff --git a/libc/cmake/modules/LLVMLibCObjectRules.cmake b/libc/cmake/modules/LLVMLibCObjectRules.cmake
--- a/libc/cmake/modules/LLVMLibCObjectRules.cmake
+++ b/libc/cmake/modules/LLVMLibCObjectRules.cmake
@@ -144,7 +144,7 @@
     ${objects_target_name}
     BEFORE
     PRIVATE
-      -fpie ${LLVM_CXX_STD_default}
+      -fpie ${LLVM_CXX_STD_default} -ffreestanding
   )
   target_include_directories(
     ${objects_target_name}
@@ -217,10 +217,18 @@
       #     X warnings generated.
       # Until this is fixed upstream, we use -fno-caret-diagnostics to surpress
       # these.
-      COMMAND $<TARGET_FILE:clang-tidy> "--extra-arg=-fno-caret-diagnostics" --quiet
+      COMMAND $<TARGET_FILE:clang-tidy>
+              "--extra-arg=-fno-caret-diagnostics" --quiet
               # Path to directory containing compile_commands.json
               -p ${PROJECT_BINARY_DIR}
               ${ADD_ENTRYPOINT_OBJ_SRCS}
+      # We run restrict-system-libc-headers with --system-headers to prevent
+      # transitive inclusion through compler provided headers.
+      COMMAND $<TARGET_FILE:clang-tidy> --system-headers
+              --checks="-*,llvmlibc-restrict-system-libc-headers"
+              --quiet
+              -p ${PROJECT_BINARY_DIR}
+              ${ADD_ENTRYPOINT_OBJ_SRCS}
       # We have two options for running commands, add_custom_command and
       # add_custom_target. We don't want to run the linter unless source files
       # have changed. add_custom_target explicitly runs everytime therefore we
diff --git a/libc/src/.clang-tidy b/libc/src/.clang-tidy
--- a/libc/src/.clang-tidy
+++ b/libc/src/.clang-tidy
@@ -3,4 +3,4 @@
 WarningsAsErrors: 'llvmlibc-*'
 CheckOptions:
   - key:             llvmlibc-restrict-system-libc-headers.Includes
-    value:           '-*, linux/*, asm/unistd.h'
+    value:           '-*, linux/*, asm/*.h, asm-generic/*.h'