Running anything as nobody.kmem allows any "nobody" process to get into the kmem group through ptrace(). Kmem is a privileged enough group that we might as well just run identd as root.
dm