What's the purpose of things like the
kexec_load_disabled sysctls and the locking down of
/dev/kmem? The idea behind them seems to be to prevent root from taking over the kernel, but I'm not sure why this is useful. If an attacker gets root, don't they pretty much own the machine even without kernel access, by doing things like modifying binaries?
I understand that in combination with Secure Boot, this can keep the kernel in a guaranteed good state, but again, if the whole userspace is compromised, why is this useful?