and de-escalate to $BUILDUSER.
Much help from natano and tb.

Based on patch from yuanjie.huang at windriver.com via OpenSSH bz#2608,
with & ok millert, ok deraadt.

additional actions before printing it.  OK rzalamena@

recomputing it all the time

error cases for -1 and 0 explicitly (it initially only checked for -1,
I updated it to also check for 0, and rzalamena@ figured out that 0
has to be checked in a differently).
OK millert@ rzalamena@

filesystem permissions are required.
requested by deraadt

down and enforce reasonable permissions for RELEASEDIR.
prodded by and ok deraadt
ok tb

instead of chunk itself; does not change actual allocated size; ok tedu@

max, it won't be set. noted by Evgeny Grin; ok millert@

OK deraadt@

OK mlarkin@ deraadt@

of the target to the message to be more descriptive.
ok deraadt tb

when the source tree is not owned by ${BUILDUSER}.
ok deraadt

ok natano

wireless in station mode is not supported.

- If you start make build as root, everything will be run as root.
Nothing new here. New is, that you can set BUILDUSER=somebody and the
unprived parts will be run as somebody.
- If you start make build with sudo, the unprived parts will be run as
the real user (meaning YOU). You can still set BUILDUSER=somebody and
the uprived parts will run as somebody.
- If you start make build as a normal user it will error out. "I'm sorry
Dave."
Note that DESTDIR must be on partition with the noperm flag set for make
release to work correctly as an unprivileged user.
idea and ok deraadt
input and ok tb ratchov millert
rpe, halex and probably others where part of the conversation to make
this happen, thanks!

See vm.conf(5) for more details.
OK mlarkin@

align everyone who is using SUDO builds towards the new strategy.
ok natano

case the dup2() would fail silently and the descriptor would remain with
the CLOEXEC flag causing the exec*()d child process to have unexpected
behavior.
ok guenther@

/var/db/acpi directory. Later sendbug(1) will use this data in
bug reports. That directory is created by mtree.
idea from and OK deraadt
OK kettenis

like vether(4).
nits from and ok benno@, phessler@

Input deraadt@
OK benno@, sthen@

with this change we get the pledge() ability back to the parent process.
some tweaks from and ok reyk@

it, remove some verbose shutdown messages that we had before with pipe
close.
ok reyk@

OK natano on a previous diff which used a different uid/gid.
naddy@ pointed out that uid/gid was already taken on "important" systems.
Turns out we cannot easily recycle freed up uids/gids so settle on 51.

ok deraadt@ sthen@ florian@

or prototypes.  Ditto for some of the char* and void* casts too.
verified no change to instructions on ILP32 (i386) and LP64 (amd64)
ok natano@ abluhm@ deraadt@ millert@

OK guenther@

ok guenther@

it can be worked on in the tree).
ok florian@ deraadt@

ok tedu@

reported by brynet

ok florian

OK halex

ok reyk@, bcook@

obvious why it is implemented this way.  The whole idea of constraints
is to isolate them as much as possible, in a semi-paranoid way.
OK rzalamena@

OK from the original author Alexander Guy

ok deraadt@ millert@