Some tweaks to kern_chroot(2)

[kib]

Summary

vfs_syscall.c: do not take process lock around the read of P2_NO_NEW_PRIVS

The flag is write-only, and if we raced with reading the action of
setting the flag, we can as well get it under the lock.


vfs_syscall.c: EXTERROR-ise EPERM from chroot(2)

[emaste]

Maybe be explicit that unprivileged_chroot is a sysctl/tunable, e.g. security.bsd.unprivileged_chroot sysctl not enabled

[kib]

EXTERROR msg for disabled sysctl

[kevans]

sys/kern/vfs_syscalls.c

994

I don't feel that strongly here, but I think if I were to read this as someone unfamiliar, my question would be: "How does P2_NO_NEW_PRIVS get set?" -> a string that appears in a manpage to answer that would probably curtail that.

[kevans]

sys/kern/vfs_syscalls.c

994

s/PROCS/PROC/, of course. bah.

[kib]

Use API flag name, not kernel internal flag.