From nobody Sat Aug 8 04:10:07 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hH6xC6scGz6mvHF for ; Sat, 08 Aug 2026 04:10:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hH6xC57tpz3V1F for ; Sat, 08 Aug 2026 04:10:07 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786162207; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9tuHHljcah9Y1euYhiTcpcOeMwYbSCcZj7wAglIbUMc=; b=AQ//0WtClxGi/L7Z+PBLWSDsL40+YBWrhvmdJlyq6Bob2/4R3VUGYGs440AABEWvYS/xEK dpD9y3dfTixDk9eLoeTtILJWyBoDm/CIHF1Htaz+EmaMulL/whVbpAMnZtOMyJjXe7cLSN T6R0F+knLbaKmKFww+HgL8V8ncNfVWmCkeS4dXk++FH8tL5Sj/7f/9Rlaz3kCqG9R/Hg9J 67AGXDSaalts02X0E9kBrwjyikmmOZC8I/IpOtETlFqln81XU4JePNii5FAJSKdcdVI2bz W4GPDQkxcBLOrCuOaUubPWyW8VNWTJhjjAGIlxyA4DW6UchrZBuxO3jAMtrr8A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1786162207; a=rsa-sha256; cv=none; b=A+SEVzO94JvvASrGG4LpSl+S2bFcjn+bWU3/ozGYgMFND3DH3vNAU2+erjhIfNT+Rd1yAO toJm4cgl/DBL9MP4VbTGwQk3idqcwVuYmUxwgLYIEFHa9aT8hnUE4Vo3lSe1onM7ngGXKN jyP3NtO2FAbuWm1kXzldaoB1qvwTwQIfP72qoSOi+IwUiWTram1oYWeXfQT1aPBvg+vyWx o8Ov2XU/Z0xkCEjDDk9phVlQcK7JX7y4SK8YRwt7rpa+xdlE5aeYjd5A2E1tUfjkHAAcFJ pLOSF0AhfiCDMnXlHRcH/ecWVTagKCsbPB1TmteliLknGbelOArN/WSMVHPWdA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786162207; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9tuHHljcah9Y1euYhiTcpcOeMwYbSCcZj7wAglIbUMc=; b=WfupSHCtE6AQO/R1JGx4eSpuxZqu5DkvnqGO500O7iHN5s0BHxAMR05g3i83P4lRe6E5Gn hk39w4NGWsNpte54gqJbu2ZS/ByalZl7fi96olDN/w77URR3xNFebu9mAi3NKVRt6+J5uT DoZgc2qzxZbkmgOgXaphbBerw+/jbfIugZDGi5wXfUe0VIwpOpHPOUhhv4Ivfd+zVTHt+1 984WDFZwl71Ch+Ec1Y9x36vEqSP+vcLA4TMhxL0BpigoZ472Kworjf+fPodK2cSK3+a9l7 jXg4mTo+Nx1hB8+Xu+SDS1rFeHQvfY4GX7U58gNFep+2UEAvaAmAwqUG1gdgvA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hH6xC3G1Yz6S7 for ; Sat, 08 Aug 2026 04:10:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 264a4 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sat, 08 Aug 2026 04:10:07 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kyle Evans Subject: git: 8befc9e8b194 - main - kern: fix oversight in security.bsd.unprivileged_kenv_read List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kevans X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 8befc9e8b194d874d00239568584552279bebddd Auto-Submitted: auto-generated Date: Sat, 08 Aug 2026 04:10:07 +0000 Message-Id: <6a76ac1f.264a4.4d514d67@gitrepo.freebsd.org> The branch main has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=8befc9e8b194d874d00239568584552279bebddd commit 8befc9e8b194d874d00239568584552279bebddd Author: Kyle Evans AuthorDate: 2026-08-08 04:06:33 +0000 Commit: Kyle Evans CommitDate: 2026-08-08 04:07:24 +0000 kern: fix oversight in security.bsd.unprivileged_kenv_read It was intended that one could close the hole back in loader, but the sysctl was actually not marked TUNABLE. The hardening menu option thus did nothing, because we wouldn't read the value from kenv. Reported by: markj Fixes: 6e81fbf5833d ("bsdinstall: add a hardening knob [...]") Fixes: 4fd518fcb2bb ("kern: add a security knob to disable [...]") --- sys/kern/kern_environment.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/kern/kern_environment.c b/sys/kern/kern_environment.c index 72c7544b4bac..acbb94067457 100644 --- a/sys/kern/kern_environment.c +++ b/sys/kern/kern_environment.c @@ -93,7 +93,7 @@ bool dynamic_kenv; panic("%s: called before SI_SUB_KMEM", __func__) static int unprivileged_kenv_read = 1; -SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RW, +SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RWTUN, &unprivileged_kenv_read, 1, "Unprivileged processes can read the kernel environment");