script safety - no outside calls

[Chen, Brad]

I assume that a module loaded with insmod() can any kernel
subroutine it cares to. In the case of modules loaded for stap,
we might choose not to support calls into arbitrary OS routines, 
similar to DTrace. By not support calls into kernel code you 
create a clean separation (at least conceptually) between kernel
code and systemtap code, and avoid invocation of instrumented 
kernel code by scripts.

For these reasons I'm assuming that systemtap scripts can only 
call into a designated systemtap runtime. Any strong feelings 
to the contrary?

Brad