YAMAMOTO Takashi wrote:

> isn't it better to make KAUTH_REQ_MACHDEP_xxx actions?

do you mean, so that there's only one 'set' of machdep requests, and
there are no arch-specific actions/requests?

> ie. define __HAVE_KAUTH_MACHDEP_xxx in MD headers, say, machine/kauth.h,
> so that listeners can do something like the following.
> 
> 	switch (action) {
> 	case KAUTH_MACHDEP_UNMANAGEDMEM
> #if defined(__HAVE_KAUTH_MACHDEP_UNMANAGEDMEM)
> 			:
> 			:
> 		break;
> #else
> 		panic();
> #endif
> 	case KAUTH_MACHDEP_IOPL
> #if defined(__HAVE_KAUTH_MACHDEP_IOPL)
> 			:
> 			:
> 		break;
> #else
> 		panic();
> #endif
> 	}

I'd rather keep it as it is now, and avoid #ifdef mess.

-e.