When exposing kernel functionality, there are several alternatives for kernel developers. They can either create a new system call or expose the functionality through /sys, or /proc entries.
Is there a reason to prefer one over another?
Do kernel developers avoid adding new system calls, unless it offers a considerable advantage, or do they add calls freely, as and when required ?
EDIT: I am working on a project to expose netfilter functionality to a Linux container (LXC). The functionality must be exposed in a controlled way, for example, when a container (say c1), want to place a netfilter hook, the hook must be called only when the packets are for the network interfaces in c1.
I can either create new system calls, or allow containers to install a module, and provide a translation layer in the kernel, which protects the host kernel from the kernel module installed by the guest. (The implementation of this translation module, or security implications of allowing containers to install a module can be a topic for another discussion).
Adding a new system call would ensure better isolation, while allowing guests to install module will have better performance. The latter can also expose functionality which cannot be exposed by systems calls, for example if guest wants to use its own version of TCP/IP stack.
What would a seasoned Linux kernel developer prefer?