This seems worryingly easy to misuse if you've got any sort of confused deputy problem with a CAP_SYS_ADMIN program or a vulnerability that could substitute a struct file_operations or call its write member. It's not directly a problem, but it does seem like it would make a lot of defense-in-depth measures ineffective if you can just make "capable()" return 1 unconditionally for a little while with relatively little complexity.

I think it would be a lot safer to have something that makes all of a struct file_operations return ENOSYS, and similar for other kinds of object, where the killed functionality is a coherent unit with defined behavior for not being present.