There's three things we really want here: 1) Prevent people gaining inappropriate privileges 2) Detect if people have gained inappropriate privileges 3) Prevent

There's three things we really want here: 1) Prevent people gaining inappropriate privileges 2) Detect if people have gained inappropriate privileges 3) Prevent those inappropriate privileges form being persisted If we can achieve (1) then (2) and (3) are irrelevant. If we can't, then (2) depends on the kernel being trustworthy (things like IMA and audit can give strong indications of compromise, but if the attacker can get into the kernel then they can just hide themselves), and (3) is much easier for an attacker to undetectably pull off if they can switch out the on-disk kernel.