Nathan J. Williams wrote:

> Yes. Why is it less important than yours?

It's not; I'm just stating this for the record as people might think
this is not what sysctl(3) was designed for. :)


> This is a similarly religious position.

My position is that having a program with access to read raw kernel
memory is bad, and using an existing solution to achieve the same
goal with less hazard is better.

> I don't know. 

More than a few over the years...

> How many are you planning to introduce? Complicated
> interfaces are exactly where trouble occurs, and you're about to add a
> complicated interface into sysctl().

I'm certainly not. I took the code we have in sys/dev/verified_exec.c,
divided it to functions with appropriate names, and added three calls
to sysctl_createv() to create appropriate nodes. Then, I added the
sysctl objects for tablesize/load/delete to the rest of existing
Veriexec knobs in the Veriexec sysctl handler, and made each call the
relevant function.

The code remained the same, it's just called from sysctl context instead
of pseudo device.

-e.

-- 
Elad Efrat