kexec: Disallow kexec_load if securelevel > 0

kexec_load() + reboot is intended to be equivalent to a system reboot.
However kexec_load() can load arbitrary data as the target kernel,
leading to execution of arbitrary code, even though it's effectively in
a new context.  Rather than being equivalent to a system reboot, it's
also equivalent to kldload(), which loads arbitrary code into the
running kernel.  Since kldload() is blocked at securelevel 1, also block
kexec_load().

Reported by:	markj
Fixes:		e02c57ff3 ("kern: Introduce kexec system feature (MI)")
Sponsored by:	Hewlett Packard Enterprise
Differential Revision:	https://reviews.freebsd.org/D56580

sys/kern/kern_kexec.c

@@ -342,6 +342,9 @@ sys_kexec_load(struct thread *td, struct kexec_load_args *uap)
 {
 	int error;
 
+	error = securelevel_gt(td->td_ucred, 0);
+	if (error != 0)
+		return (error);
 	// FIXME: Do w need a better privilege check than PRIV_REBOOT here?
 	error = priv_check(td, PRIV_REBOOT);
 	if (error != 0)