> hi,
> 
> attached diff does, well, what the subject line says.
> 
> it works here, but I'd like some more eyes on it (locking issues? I
> dunno), so please review.
> 
> if no one objects, I'll just go ahead and commit it.
> 
> -e.

- it introduces more overhead for non veriexec users...

- it seems quite racy.  i don't know if it's a problem for veriexec, tho.
  first and second namei() can see different
  pathnames (if userland pathname buffer is modified) and/or
  vnode (if any components in the pathname is renamed).

YAMAMOTO Takashi