I don't think that it makes sense in a technical point of view to try to observe something if an attacker has already compromised your kernel. As soon as this h

I don't think that it makes sense in a technical point of view to try to observe something if an attacker has already compromised your kernel. As soon as this happens, there is nothing you can do, which is foolproof as long we don't have kernels which are separating privileges within the system. If you want to observer something you have to depend on a trust anchor. In most today systems you don't have a trust anchor when the kernel is compromised.