> > collecting security related knobs under the node sounds a bad idea to me.
> 
> Can you explain why? What might be a better way to do this?

the reason i stated earlier in this thread ("it isn't a subsystem")
isn't enough?

"security" node doesn't seem to fit to the way how the rest of tree is
currently organized.
do you want to create "performance" top level node, which collects
performance related knobs?  to me, "security" node seems something like that.

IMO, kern.xxx is a better choice, given that we have
kern.defcorename already.  if it seems too flat, i'd suggest
kern.core.xxx.

YAMAMOTO Takashi