Currently, sysctls which enable KDB in some way are flagged with
CTLFLAG_SECURE, meaning that you can't modify them if securelevel > 0.
This is so that KDB cannot be used to lower a running system's
securelevel. However, mac_ddb prohibits DDB operations which could be
abused to lower securelevel while retaining some ability to gather
useful information.
To enable the use of KDB (specifically, DDB) with a raised securelevel,
change the policy a bit following a suggestion from mhorne. Rather than
relying on CTLFLAG_SECURE, add a check of the current securelevel to
kdb_trap(). If the securelevel is raised, only pass control to the
backend if MAC specifically grants access; otherwise simply check to see
if mac_ddb vetoes the request, as before.
Add a new secure sysctl, debug.kdb.enter_securelevel, to override this
behaviour. That is, the sysctl lets one enter a KDB backend even with a
raised securelevel, so long as it is set before the securelevel is
raised.