Subject: Re: Getting rid of /dev/veriexec
To: Elad Efrat <>
From: Nathan J. Williams <>
List: tech-kern
Date: 12/02/2005 09:56:29
Elad Efrat <> writes:

> Nathan J. Williams wrote:
> > The same reason; I don't like sysctl being used for things other than
> > individual knobs. I'm OK with sysctl(8) as a UI, but I don't think
> > that sysctl(3) does much but duplicate other infrastructure - namely,
> > the filesystem.
> I understand your point, though let me point out some things:
> 1. This is *your* view of sysctl(3);

Yes. Why is it less important than yours?

> 2. Removing a sgid kmem binary *NOW* is better than "coming up with a
>    better solution in the future";

This is a similarly religious position.

> 3. How many locally exploitable root holes procfs (on BSD/Linux) and/or
>    kernfs have? how many our sysctl(9) have?

I don't know. How many are you planning to introduce? Complicated
interfaces are exactly where trouble occurs, and you're about to add a
complicated interface into sysctl().

        - Nathan