oh, and perhaps on dev mode systems, we don't lock it ... or we make it a kernel cmdline option like we do with module loading

It's certainly possible to do this and the idea has crossed my mind before. I'm doubtful on whether this buys us anything though: In order to lift the symlink traversal exceptions, an attacker will already need to have arbitrary file write permissions to access the /sys/kernel/security. Assuming they have that, why would they bother about symlink traversal? Do you have a specific attack scenario in mind?

i agree on the limitedness of it, and i don't have an attack scenario in mind.  it just came up as a cheap change.

wrt writing arbitrary files, we've seen clever attacks that rely on tricking programs to write their output elsewhere, and abusing their limited output (like the modprobe stuff).  in this case, we just need like an errant /.

What is the next step here? Should this work be done, or is it not worthwhile?