Yes, but for it to actually be enforced in a meaningful way (which it
   needs to be, even at securelevel 1, or the rest of the securelevel
   framework is inconsistent) disklabel writing needs to be moved entirely
   into the kernel.  This has been discussed over and over, but nobody
   (myself included) has stepped up to do the fairly small amount of work.



... which leaves us in an even worse position for cross-disklabel.


can someone implement wedges for userland & kernel?  please?