The branch stable/14 has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=7399eb45406874f35e736f105d7d6ff0516c7a2e
commit 7399eb45406874f35e736f105d7d6ff0516c7a2e Author: Kyle Evans <[email protected]> AuthorDate: 2026-08-08 04:06:33 +0000 Commit: Kyle Evans <[email protected]> CommitDate: 2026-09-04 15:39:55 +0000 kern: fix oversight in security.bsd.unprivileged_kenv_read It was intended that one could close the hole back in loader, but the sysctl was actually not marked TUNABLE. The hardening menu option thus did nothing, because we wouldn't read the value from kenv. Reported by: markj Fixes: 6e81fbf5833d ("bsdinstall: add a hardening knob [...]") Fixes: 4fd518fcb2bb ("kern: add a security knob to disable [...]") (cherry picked from commit 8befc9e8b194d874d00239568584552279bebddd) --- sys/kern/kern_environment.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/kern/kern_environment.c b/sys/kern/kern_environment.c index 01d80911ab5b..2ffc0524e9ef 100644 --- a/sys/kern/kern_environment.c +++ b/sys/kern/kern_environment.c @@ -91,7 +91,7 @@ bool dynamic_kenv; panic("%s: called before SI_SUB_KMEM", __func__) static int unprivileged_kenv_read = 1; -SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RW, +SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RWTUN, &unprivileged_kenv_read, 1, "Unprivileged processes can read the kernel environment");
