Add utmp group (45) from OpenBSD
Use root:utmp when creating utmpx files
Install last(1) as setgid (utmp) and drop setgid ASAP
Only allow root to see all entries for last(1).
Users will only see their own entries.
Allow user to see system events in last(1).

Use a whitelist to avoid accidentally leaking information in the future if new types
are added relating to user events.
Allow utmp/wheel group members to see all entries in last(1)
Allow security.bsd.see_other_uids to override functionality