bhyveload: hold /boot and do relative lookups for the loader

[kevans]

Summary

The next change will push bhyveload into capability mode right after we
allocate vcpu state, before we've setup or entered the loader, to limit
the surface area that a rogue loader script can touch.

With an explicit -l loader, we don't need to preopen /boot because
changing interpreters isn't allwoed. We'll just dlopen() entirely in
advance in that case to eliminate some complexity.

[allanjude]

reviewed-by: allanjude

[kevans]

Move need_reinit back into main

It should've likely never moved out in the first place, but now that we're using
the return value of setjmp() for managing the loader handle we'll just
consolidate back there.

[markj]

usr.sbin/bhyveload/bhyveload.c

771

Check for errors?

814

Why do we dlopen() so early here? In general we want to do that after having entered the sandbox, since dlopen() will invoke constructors and initializers in the DSO if they exist.

816

dlopen() doesn't set errno.

[markj]

usr.sbin/bhyveload/bhyveload.c

771

Oh, the caller does that. (But it'd make more sense to do it here I think?)

[kevans]

Address review feedback

[kevans]

usr.sbin/bhyveload/bhyveload.c

816

Propagated to error handling later that's now moved into loader_open