link_elf_obj: Apply protection based on section flags.

[markj]

Summary

Unlike the case of DSOs, we cannot assume that protection boundaries are
page-aligned. In this case, we must take the union of the protections
for the sections sharing a page.

There may also be gaps between sections. For instance, the VNET and
DPCPU sections are allocated separately and do not lie within the linker
file mapping. Such gaps are mapped with VM_PROT_READ.

As for link_elf.c, we initially map the file with VM_PROT_ALL and
downgrade once all relocations are processed.

[kib]

sys/kern/link_elf_obj.c

213

This relies on KERN_SUCCES == 0, I always want more explicitness in handling Mach<->errno translation.

Also, when could vm_map_protect() above fail ?

[markj]

sys/kern/link_elf_obj.c

213

In fact, it should be impossible for vm_map_protect() to fail here.

[markj]

Assert that vm_map_protect() returns KERN_SUCCESS.