In message <20041130200652.GA16371@panix.com>,

Thor Lancelot Simon writes:
[ snip lots ]

>3) Make the simple kernel change I described earlier, such that no device
>   node on any _writable_ filesystem can be used; that is, embed this
>   policy in the kernel.


Hmm.  Did you do that above VFS, or as a filesystem-dependent change
(if the latter, presumably in the UFS/FFS code?)  How about committing
that patch (or a reworked version, if the original is not committable)
as a configurable options(4) option?

That way, more eyes get to see and check over the code. Plus we can
all share that particular wheel, instead of us each reinventing fresh
wheels, each one of less-well-proven circularity.

Just a thought.