Date: Sat, 08 Aug 2026 04:10:07 +0000 From: Kyle Evans <kevans@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 8befc9e8b194 - main - kern: fix oversight in security.bsd.unprivileged_kenv_read Message-ID: <6a76ac1f.264a4.4d514d67@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=8befc9e8b194d874d00239568584552279bebddd commit 8befc9e8b194d874d00239568584552279bebddd Author: Kyle Evans <kevans@FreeBSD.org> AuthorDate: 2026-08-08 04:06:33 +0000 Commit: Kyle Evans <kevans@FreeBSD.org> CommitDate: 2026-08-08 04:07:24 +0000 kern: fix oversight in security.bsd.unprivileged_kenv_read It was intended that one could close the hole back in loader, but the sysctl was actually not marked TUNABLE. The hardening menu option thus did nothing, because we wouldn't read the value from kenv. Reported by: markj Fixes: 6e81fbf5833d ("bsdinstall: add a hardening knob [...]") Fixes: 4fd518fcb2bb ("kern: add a security knob to disable [...]") --- sys/kern/kern_environment.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/kern/kern_environment.c b/sys/kern/kern_environment.c index 72c7544b4bac..acbb94067457 100644 --- a/sys/kern/kern_environment.c +++ b/sys/kern/kern_environment.c @@ -93,7 +93,7 @@ bool dynamic_kenv; panic("%s: called before SI_SUB_KMEM", __func__) static int unprivileged_kenv_read = 1; -SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RW, +SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RWTUN, &unprivileged_kenv_read, 1, "Unprivileged processes can read the kernel environment");home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a76ac1f.264a4.4d514d67>