ioctl() forever?

One other issue with ioctl: it can mean different things to different devices, and there's no guarantee of non-overlap (even though the kernel does attempt to avoid it).

So if a filter mechanism needs to allow a particular ioctl, used with a particular device, it might also be allowing other unrelated and problematic ioctls on other devices that use the same ioctl number.