netstat: strip the binary of sgid

[kevans]

Summary

Everything in the live path seems to use sysctls these days, with kvm
only being used for pulling information from core dumps. Strip the
binary of /dev/{k,}mem access to reduce the surface area with access
to kmem.

[markj]

There are some calls setgid(getgid()) in netstat which aim to drop privileges. I guess those should be removed too?

[kevans]

Drop setgid(2) calls meant to drop privileges, now that we don't have privs

[kevans]

In D47210#1076527, @markj wrote:

There are some calls setgid(getgid()) in netstat which aim to drop privileges. I guess those should be removed too?

I also found one other call to kresolve_list() that I thought could go away, but it turns out that we actually still need /dev/mem for netstat -rs. Shelving this for the time being, but reimplementing rt_stats() for the live case doesn't seem like it'd be too difficult.

[kevans]

I intend to commit this on the 21st if nobody objects -- the one month anniversary to netstat(1) switching to sysctl for routing stats.