You are locked down to a small subset of site-licensed applications your domain administrator has deemed appropriate for the least common denominator in your age group. All forms of customization are disabled with Group Policy. Novell and Citrix application delivery are common, so you don't even have a Start menu but a proprietary launcher. Extremely aggressive Internet filtering bans large swaths of content about networking to prevent students from learning how to bypass the filter.
Our IT department enabled access to the hilariously antiquated QBasic environment only for students currently enrolled in a programming course and revoked it the next semester. You had to sign a special waiver saying you promised to only write code directly in fulfillment of course requirements and not do any independent experimentation or goofing around.
I get it, but K12 students on non-iPads aren't getting Linux, they're definitely not getting root, and they're probably not getting user-mode code execution either. You'd need to change the entire culture around K12 IT to make that happen.
The best way for kids to learn to be hackers is on their hardware, free from school or parental controls.