bhyveload: use a dirfd to support -h

[kevans]

Summary

Don't allow lookups from the loader scripts, which in rare cases may be
in guest control depending on the setup, to leave the specified host
root. Open the root dir and strictly do RESOLVE_BENEATH lookups from
there.

cb_open() has been restructured a bit to work nicely with this, using
fdopendir() in the directory case and just using the fd we already
opened in the regular file case.

hostbase_open() was split out to provide an obvious place to apply
rights(4) if that's something we care to do.

[allanjude]

reviewed-by: allanjude

[markj]

Looks good, just a couple of nits.

usr.sbin/bhyveload/bhyveload.c

205

Why not handle the error properly? fdopendir() could fail due to a malloc() failure, and we do try to handle that above.

783

Since the function is called hostbase_open(), it'd be a bit more logical to handle all of this there. Currently the function just opens a file, there is nothing specific to "hostbase" about it.

[kevans]

usr.sbin/bhyveload/bhyveload.c

205

Whoops- I had only glanced at the manpage and noted that the only possible errors were EBADF and ENOTDIR, it didn't occur to me that it naturally does need to allocate some memory.

[kevans]

Address review feedback