Add a 'Installing the new kernel fails' section to Trouble-shooting.

Reviewed by:	dd
Approved by:	silence on -doc

en_US.ISO8859-1/books/handbook/kernelconfig/chapter.sgml

@@ -1,7 +1,7 @@
 <!--
      The FreeBSD Documentation Project
 
-     $FreeBSD: doc/en_US.ISO8859-1/books/handbook/kernelconfig/chapter.sgml,v 1.64 2001/09/22 18:47:35 tom Exp $
+     $FreeBSD$
 -->
 
 <chapter id="kernelconfig">
@@ -1206,7 +1206,7 @@ pseudo-device   bpf           # Berkeley packet filter</programlisting>
   <sect1 id="kernelconfig-trouble">
     <title>If Something Goes Wrong</title>
 
-    <para>There are four categories of trouble that can occur when
+    <para>There are five categories of trouble that can occur when
       building a custom kernel.  They are:</para>
 
     <variablelist>
@@ -1244,6 +1244,23 @@ pseudo-device   bpf           # Berkeley packet filter</programlisting>
 	</listitem>
       </varlistentry>
 
+      <varlistentry>
+	<term>Installing the new kernel fails</term>
+	
+	<listitem>
+	  <para>If the kernel compiled fine, but failed to install
+	    (the <command>make install</command> or
+	    <command>make installkernel</command> command failed),
+	    the first thing to check is if your system is running at
+	    securelevel 1 or higher (see &man.init.8;).  The kernel
+	    installation tries to remove the immutable flag from
+	    your kernel and set the immutable flag on the new one.
+	    Since securelevel 1 or higher prevents unsetting the immutable
+	    flag for any files on the system, the kernel installation needs
+	    to be performed at securelevel 0 or lower.</para>
+	</listitem>
+      </varlistentry>
+
       <varlistentry>
 	<term>The kernel will not boot:<anchor
 	  id="kernelconfig-noboot"></term>