> unless anyone objects, i'll make kauth_cred_set*() return
> a new credential and remove kauth_cred_copy.

a person asked me privately why i want to make this change.
i thought it was obvious, but anyway, here's an answer.

- in this way, a caller doesn't have to worry if kauth_cred_copy is
  necessary or not.  it's easier to use, at least for me.

- afaik, there's no demand to modify a shared credential and let
  others see the modification.
  an api which can't do unnecessary things is a better one, IMO.

- i don't think it can cause noticable performance loss.

YAMAMOTO Takashi