YAMAMOTO Takashi wrote:

> how about something like the attached patch?

this looks okay. what I dislike is that it's a bit more complicated than
I wanted (create + open, use, unuse, close+ destroy).

> "query" part is not yet, but it shouldn't be too hard.

I'd like to see this implemented first, and how it should be used.

also: do you think we could use this interface to solve another problem
I mentioned a while ago? see comment in:

http://nxr.netbsd.org/source/xref/sys/kern/kern_verifiedexec.c#835

-e.