chroot(2) can be used by unprivileged users if the security.bsd.allow_unprivileged_chroot sysctl is set, but requires that the -n command line flag be specified so that chroot(8) will set the PROC_NO_NEW_PRIVS_CTL process control. Provide an explicit error for this case.

Before:

$ chroot / /bin/sh
chroot: /: Operation not permitted

After:

$ chroot / /bin/sh 
chroot: unprivileged use requires -n