This new diff is everything needed to support mac_curtain (https://github.com/Math2/freebsd-pledge).
(Previous diff was D34761)
Sysfils are gone. Now syscalls have only one category ("syscat") and it's independent from the Capsicum flag. The general idea behind the categorization is still the same, I just broke them down a bit more.
Some notes on the kernel changes:
Not all syscats are needed for pledge() compatibility (and some of them might not be worth the noise it adds to the code).
The mac_vnode_walk_*() functions must be called when unveil permissions might need to propagate to another vnode (e.g. after VOP_LOOKUP()/VOP_CREATE(), or when traversing a vnode's mount points, etc), or whenever bringing in a new vnode for which unveil permissions must be determined. They update the thread's "unveil tracker" which the mac_vnode_check_*() functions use. fget() and namei() fill the tracker automatically and that's enough for nearly all callers.
The change in linux_file_stat() is needed to make sandboxed DRM work. It's consistent with how vn_statfile() does it.
The changes in zfs_vnops_os.c aren't just so that the unveil permissions carry down to the extattr sub-files, it's also to stop mac_curtain from trying to find the "covering" directory (by ascending the directory hierarchy, when needed) because namei() is called while holding a vnode lock on the parent.
mac_cred_trim() needs to be called when a ucred is no longer being referenced from processes or threads (mac_curtain needs to free some stuff then).
I added a mac_socket_check_create_pair() separate from mac_socket_check_create() (like was suggested in an existing code comment). It's useful for pledge() compat. This could be a compatibility issue with existing MAC policies, but the stock policies don't use it.