On Sun, Oct 29, 2006 at 01:42:15AM +0900, YAMAMOTO Takashi wrote:
> > > 
> > > i'm not sure what you are talking about.
> > > are you talking about how bsd44 listener should interact with these requests? 
> 
> for bsd44 securelevel listener, i think something like this is enough.
> 
> 	case passthru:
> 		if (securelevel < 1) {
> 			return allow;
> 		} else {
> 			return deny;
> 		}
> 
> alternatively you can probably iterate devices on the bus,
> but i don't think it's worth to do.

I don't think you can iterate devices on the bus because, on some
buses, the devices can directly access one another.

Also, I wonder about Elad's original suggestion that we might want to
treat access here like access to raw system memory.  I actually think
that is appropriate, because I can think of situations where one might
want to allow mediated access to some disk devices (e.g. devices known
not to contain system executables or configuration files) but not to
RAM -- and in some cases the passthrough ioctls can be abused to allow
access to RAM, I think.