capsicum: invoke Capsicum on FD/file conversion

Add calls to Capsicum to intercept FD/file conversion in the following
situations:
 - Any place where a file descriptor is converted to a struct file.
 - Any place where a new file descriptor that is derived from an
   existing file descriptor is installed into the fdtable.

For the first of these, Capsicum checks for a Capsicum capability
wrapper file and unwraps it to the underlying file, provided the
appropriate rights are available (otherwise, ERR_PTR(-ENOTCAPABLE)
is returned).

For the second, Capsicum checks whether the original file has
restricted rights associated with it.  If it does, it is replaced
with a Capsicum capability wrapper file before installation into
the fdtable.  This propagates the rights from the original FD to
the new FD, and particularly affects accept(2) and openat(2).

For openat(2) rights propagation in particular, the rights
associated with the dfd need to make their way through the code
in fs/namei.c to allow this.

The path walking code in fs/namei.c is also modified to enable
the O_BENEATH flag if the dfd is a Capsicum capability.

Signed-off-by: David Drysdale <drysdale@google.com>
capsicum: add syscalls to limit FD rights

Add the cap_rights_get(2) and cap_rights_set(2) syscalls to
allow retrieval and modification of the rights associated with
a file descriptor.

When a normal file descriptor has its rights restricted in any
way, it becomes a Capsicum capability file descriptor.  This is
a wrapper struct file that is installed in the fdtable in place
of the original file.  From this point on, when the FD is converted
to a struct file by fget() (or equivalent), the wrapper is checked
for the appropriate rights and the wrapped inner normal file is
returned.

When a Capsicum capability file descriptor has its rights restricted
further (they cannot be expanded), a new wrapper is created with
the restricted rights, also wrapping the same inner normal file.
In other words, the .underlying field in a struct capsicum_capability
is always a normal file, never another Capsicum capability file.

These syscalls specify the different components of the compound
rights structure separately, allowing components to be unspecified
for no change.

Note that in FreeBSD 10.x the function of this pair of syscalls
is implemented as 3 distinct pairs of syscalls, one pair for each
component of the compound rights (primary/fcntl/ioctl).

Signed-off-by: David Drysdale <drysdale@google.com>
capsicum: prctl(2) to force use of O_BENEATH

Add a per-task flag that indicates all openat(2) operations
should implicitly have the O_BENEATH flag set.

Add a prctl(2) command to set this flag (irrevocably). Include
an option to force the flag set to be synchronized across all
tasks in the thread group.
seccomp: Add tgid and tid into seccomp_data

Add the current thread and thread group IDs into the data
available for seccomp-bpf programs to work on.  This allows
installation of filters that police syscalls based on thread
or process ID, e.g. tgkill(2)/kill(2)/prctl(2).