While a kernel could theoretically have backdoors creating such files anywhere in the millions of lines of code, it usually only has one (or a few at most) place where filenames are validated.

We assume you trust the code in your kernel, because otherwise why would you use it? If you don't trust the kernel, don't use the computer; there's nothing you can do safely in such a situation.

It's not like you're auditing a random user-space program.

I also had a question about this. I think the argument is

You can't just read the source code of all your programs and figure out which ones will create files.

Which is theoretically true. In practice, the vast majority probably use a handful of system API calls for file creation.

However, aren't virtually all requests for file creation handled by the kernel? Then you would just have to modify the kernel implementation (as in alx's answer), rather than trying to intercept the call from every single program. In that case you don't have to contend with Rice.

You could also apply Rice to kernel code and say it's impossible. But the kernel already needs to do various checks when creating files, so surely there is a centralized place in the kernel code that controls file creation.