Add fchroot(2) and chroot -d

[trasz]

Summary

This adds a new system call, fchroot(2). The idea is to use it
with Capsicum for oblivious sandboxing, but for now it's just
a chroot(2) that takes a fd instead of path.

This also modifies chroot(8) utility to add "-d", so one can
do eg "chroot -nd 5 /bin/bash 5< /compat/jammy".

[brooks]

I wonder if a chrootat(fd, path) that allows a NULL path would be more general?

Should there be a flags argument?

We do need to spend a capability bit on this?

I'm skeptical of the chroot(8) change. I don't see how it's useful in practice. If committed it should be separate from the syscall addition.

sys/kern/vfs_syscalls.c

1033

Need a struct fchroot_args definition. for consistency with the rest of the file.

usr.sbin/chroot/chroot.8

58–60

[trasz]

In D41564#950112, @brooks wrote:

I wonder if a chrootat(fd, path) that allows a NULL path would be more general?

Should there be a flags argument?

I'm not sure if I want to semantically mix "make this fd the new root" and "look up this path" bits. As it is now, it mimics fchdir(2). It's also compatible with NetBSD.

We do need to spend a capability bit on this?

Excellent question. I have no idea - my guess would be no, but because there already is CAP_FCHDIR, the purpose of which is also unclear to me, I simply followed suit.

I'm skeptical of the chroot(8) change. I don't see how it's useful in practice. If committed it should be separate from the syscall addition.

Agree - as it is now, it's mostly so that I can test the syscall by hand. Might become more useful in the future.