hats
of EACCESS when an unconfined process calls changehat. This enables applications using the changehat api to detect that the application is not confined so probing for a matching hat can be aborted.
Makefile will invoke Kbuild for external (out of tree) builds.