Suppose that there were a security system in an Android kernel meant to prevent exploits that have arbitrary kernel memory read/write from getting root privileges. This system,
- Kills a process by using force_sig() with SIGKILL if the process UID or GID is 0 and if the system decides it shouldn't be.
- Depends on kernel variables that are read-only after init. (on/off status)
If we assume that the system decides with complete accuracy in  above, and KASLR is not present on the device, what can an exploit do to counter this system and get root IDs?
What I can think of:
- Disabling SIGKILL temporarily:
If SIGKILL can be disabled temporarily (or even permanently until reboot) then the system is essentially useless, but I have yet to find a way to disable SIGKILL through kernel memory write.
- Disabling the system by flipping the read-only bits somehow:
This is unlikely to be possible but included for the sake of completeness.
- Editing the text sections of kernel memory to patch the functions:
Also unlikely to be possible because the text section is read-only.