kern: do not allow unprivileged chroot when pwd is shared

Unprivileged chroot(2), fchroot(2), chaltroot(2), and fchaltroot(2)
rely on PROC_NO_NEW_PRIVS to make set-ID images harmless under the
new root.  But the pwddesc can be shared by rfork(2) without RFFDG
with a process that has not enabled PROC_NO_NEW_PRIVS, and the
change of the root affects that process as well.  It can then
execute a set-ID image whose ELF interpreter is resolved under the
root controlled by the caller.

Refuse the unprivileged operations when the pwddesc is shared.
Processes that start sharing it later are created by the caller and
inherit PROC_NO_NEW_PRIVS.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D60035



pwddesc: add sharecount

The pd_refcount field counts both sharing processes and the transient
pdhold() references taken by sysctls and mountcheckdirs(), so it
cannot answer "is this pwddesc shared".  As a result pdunshare() made
needless copies while the pwddesc was held, and a copy made while
mountcheckdirs() held it lost the cwd/root update.

Add pd_sharecount, counting only processes using the pwddesc, and use
it for the sharing decision. Existing pd_refcount still manages the
lifetime.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D60035


cap_enter(2): stricter checks

- single-thread the process
  Make cap_enter() a serialization point, ensuring that no threads are
  executing with old credentials cached after the syscall returned.

- disallow entering capability mode if the file descriptor table or pwd
  are shared. They are shared after rfork(2), and allowing it lets another
  process grant additional privileges to the process in capability mode.


cap_enter.2: document new behavior, in particular EBUSY

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D60035