> What sysctl variables does one typically need inside the chroot(2) box, anyway?

Run ktrace on just about anything and look at the results.  You'll
find that the first thing it does is a sysctl:

 17540 echo     EMUL  "netbsd"
 17540 echo     RET   execve JUSTRETURN
 17540 echo     CALL  __fstat13(0x1,0xbfbfd4c0)
 17540 echo     RET   __fstat13 0
 17540 echo     CALL  __sysctl(0xbfbfd498,0x2,0xbfbfd490,0xbfbfd494,0,0)
 17540 echo     RET   __sysctl 0
 17540 echo     CALL  readlink(0x804fd74,0xbfbfd4cc,0x3f)

I did a quick `grep sysctl */*.[ch]' of src/libc and this is what I found:

compat-43/gethostid.c:#include <sys/sysctl.h>
compat-43/gethostid.c:  if (sysctl(mib, 2, &value, &size, NULL, 0) == -1)
compat-43/sethostid.c:#include <sys/sysctl.h>
compat-43/sethostid.c:  if (sysctl(mib, 2, NULL, NULL, &hostid, sizeof hostid) == -1)
gen/confstr.c:#include <sys/sysctl.h>
gen/confstr.c:          if (sysctl(mib, 2, NULL, &tlen, NULL, 0) == -1)
gen/confstr.c:                  if (sysctl(mib, 2, p, &tlen, NULL, 0) == -1) {
gen/getdomainname.c:#include <sys/sysctl.h>
gen/getdomainname.c:    if (sysctl(mib, 2, name, &size, NULL, 0) == -1) {
gen/gethostname.c:#include <sys/sysctl.h>
gen/gethostname.c:      if (sysctl(mib, 2, name, &size, NULL, 0) == -1) {
gen/getloadavg.c:#include <sys/sysctl.h>
gen/getloadavg.c:       if (sysctl(mib, 2, &loadinfo, &size, NULL, 0) < 0)
gen/getpagesize.c:#include <sys/sysctl.h>
gen/getpagesize.c:              if (sysctl(mib, 2, &pagsz, &size, NULL, 0) == -1)
gen/setdomainname.c:#include <sys/sysctl.h>
gen/setdomainname.c:    if (sysctl(mib, 2, NULL, NULL, name, namelen) == -1)
gen/sethostname.c:#include <sys/sysctl.h>
gen/sethostname.c:      if (sysctl(mib, 2, NULL, NULL, name, namelen) == -1)
gen/sysconf.c:#include <sys/sysctl.h>
gen/sysconf.c:yesno:            if (sysctl(mib, 2, &value, &len, NULL, 0) == -1)
gen/sysconf.c:  return (sysctl(mib, 2, &value, &len, NULL, 0) == -1 ? -1 : value); 
gen/sysctl.c:/* $NetBSD: sysctl.c,v 1.11 2000/01/22 22:19:12 mycroft Exp $      */
gen/sysctl.c:static char sccsid[] = "@(#)sysctl.c       8.2 (Berkeley) 1/4/94";
gen/sysctl.c:__RCSID("$NetBSD: sysctl.c,v 1.11 2000/01/22 22:19:12 mycroft Exp $");
gen/sysctl.c:#include <sys/sysctl.h>
gen/sysctl.c:__weak_alias(sysctl,_sysctl)
gen/sysctl.c:sysctl(name, namelen, oldp, oldlenp, newp, newlen)
gen/sysctl.c:           /* LINTED will fix when sysctl interface gets corrected */
gen/sysctl.c:           return (__sysctl(name, namelen, oldp, oldlenp,
gen/uname.c:#include <sys/sysctl.h>
gen/uname.c:    if (sysctl(mib, 2, &name->sysname, &len, NULL, 0) == -1)
gen/uname.c:    if (sysctl(mib, 2, &name->nodename, &len, NULL, 0) == -1)
gen/uname.c:    if (sysctl(mib, 2, &name->release, &len, NULL, 0) == -1)
gen/uname.c:    if (sysctl(mib, 2, &name->version, &len, NULL, 0) == -1)
gen/uname.c:    if (sysctl(mib, 2, &name->machine, &len, NULL, 0) == -1)
gmon/gmon.c:#include <sys/sysctl.h>
gmon/gmon.c:    if (sysctl(mib, 2, &clockinfo, &size, NULL, 0) < 0) {
include/extern.h:int __sysctl __P((int *, unsigned int, void *, size_t *, void *, size_t));
include/namespace.h:#define sysctl                      _sysctl
net/__cmsg_alignbytes.c:#include <sys/sysctl.h>
net/__cmsg_alignbytes.c:        ret = sysctl(mib, sizeof(mib)/sizeof(mib[0]), (void *)&alignbytes,
net/getifaddrs.c:#include <sys/sysctl.h>
net/getifaddrs.c:       if (sysctl(mib, 6, NULL, &needed, NULL, 0) < 0)
net/getifaddrs.c:       if (sysctl(mib, 6, buf, &needed, NULL, 0) < 0) {
net/ifname.c:#include <sys/sysctl.h>
net/ifname.c:   if (sysctl(mib, 6, NULL, &needed, NULL, 0) < 0)
net/ifname.c:   if (sysctl(mib, 6, buf, &needed, NULL, 0) < 0) {
net/ifname.c:           /* sysctl has set errno */
obj.i386/LintSysNormal.c:__sysctl(int * arg1, u_int arg2, void * arg3, size_t * arg4, void * arg5, size_t arg6)
obj.i386/LintSysNormal.c:__sysctl(arg1, arg2, arg3, arg4, arg5, arg6)
obj.sparc64/LintSysNormal.c:__sysctl(int * arg1, u_int arg2, void * arg3, size_t * arg4, void * arg5, size_t arg6)
obj.sparc64/LintSysNormal.c:__sysctl(arg1, arg2, arg3, arg4, arg5, arg6)

While a few of these actually implement the sysctl(2) system call,
most of these provide other functionality by querying the kernel.

I suppose you could make /kern writeable only to root.  But if you use
it to replace sysctl you would need to remember to mount it or lots of
things will start to break.

=========================================================================
Eduardo Horvath				eeh@netbsd.org
	"I need to find a pithy new quote." -- me