If I were installing a custom kernel would adding selinux limit risk, or would a compromised kernel simply laugh at it?