I've been auditing the LSM stuff a bit more..

They have registered an implemented a syscall, sys_security
that does nothing but switch into the individual modules
based on the first argument, i.e. it's ioctl() switching
on the security module instead of device node.  Yuck.

Patch below removes it (no intree users), maybe selinux/etc
folks should send their actual syscall for review instead..