From nobody Thu Aug 6 23:21:37 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hGNZp2BBYz6nQZV for ; Thu, 06 Aug 2026 23:21:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hGNZn5SzVz3Y4V for ; Thu, 06 Aug 2026 23:21:37 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786058497; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OzbvYztB9QpXYwc3CTbDmYzI7zmP0wMw4VZXJRHClXo=; b=NubapzhlHcF/F18pAmrkCj1fy6xtVrwDEXtDyJYqjn7hvodCVKff8ebYJDmLWCpeW0oR4H ypzI1/O2dNz1oH/0ntiV0E31QkbvV+2qY0/c2qhiCLoZ6YeOEHaVyb1RjS1mFLEyYHfexa KCJVSadUYLFbIYe89K0zGZzxQQw9jPI2czIIqCDQmSTosX4vg3ddHWkoqk+ZLE/RNqbCPC yhoyU456Jyaj3CbB3wLFFMd4o51WD2T5dS4iJb6iWKXg7N7Xh7vosb0peKBqyDlIlH480J OACkpGyg1jpE4gfGyy2N+1nNcs9qGDVjefsnmzukljdRT+hlzdQbVvuqEMzzvg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1786058497; a=rsa-sha256; cv=none; b=i2Eo2dlh8bE0YmZGDsRCh89MsA94UMKnaHtqF6O7FpYBao1b/W0H9mvnX7VNdvmw+tKrFG 8jXV4loTlyJMwizQv1/byNgSlWk1wSZdCMmDmn/TGO7tPdg0iNkNnsEymFSVyvfw6gIadV DV7X2nVG8EDwooEzPcXeKAwalaVbZNaxxpe/BobnLdxDsPFRaLkGgFGYl+tYxeoL6oZ+Yp EY3Hudfxpxkg6DuT1NvhBRq5/Uc5QUQtIimI5EP1b4MCIDtGtUuivGnz0dwaN22pQ6DyHK tCx9z4NiqZH8gy127p1gysCU84Sa+57Fyw8N7i4LLBnJy4FK48jc7okAO5iBEA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786058497; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OzbvYztB9QpXYwc3CTbDmYzI7zmP0wMw4VZXJRHClXo=; b=KLYTgTs3Gwh+IQY2EM0wEJuZ8m1RlZWq8urenRdSXzqkn22jDhrjNBzzkcxCQgCH98KUSk r1Z6ldokEo8pIsxh9LhDkCXceAhIgpIaycnbxUjQQ79do1PhXMv2nwk3Zy+ZCVgudZShn8 3v/47JD19gymMwadAwXbAWcXtD8tU20YLi3JMdjQWIcEOMQwhkQQxHoTYt7aH/3v1OQRd4 afzw06pcItiz1CeBiB1jNvgmnfdD2NSpSql5JM4xT4iFPDNJP1Nz3M++bXs8feOozcCD+O c/JpEzNFj/Hmnrg6a5FGOmtXRTuNGJt5KkvvOQ6g/2vkGwpIxjkvOmRGvGmwbg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hGNZn4SCGzjHN for ; Thu, 06 Aug 2026 23:21:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 24e19 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 06 Aug 2026 23:21:37 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kyle Evans Subject: git: c839c1566147 - stable/14 - kern: add a security knob to disable unprivileged access to kenv List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kevans X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: c839c1566147cc2d255aab1f7a1f8ed3f86299a8 Auto-Submitted: auto-generated Date: Thu, 06 Aug 2026 23:21:37 +0000 Message-Id: <6a751701.24e19.f47ebca@gitrepo.freebsd.org> The branch stable/14 has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=c839c1566147cc2d255aab1f7a1f8ed3f86299a8 commit c839c1566147cc2d255aab1f7a1f8ed3f86299a8 Author: Kyle Evans AuthorDate: 2026-06-22 20:22:25 +0000 Commit: Kyle Evans CommitDate: 2026-08-06 22:52:29 +0000 kern: add a security knob to disable unprivileged access to kenv We sometimes store sensitive things in the kenv that get zapped, but we really shouldn't rely on that zapping to actually happen. Most unprivileged processes don't really need to read from the kernel environment in the first place, so add a knob that allows it to be disabled. Note that we consider jailed root to be unprivileged from this perspective; they have their own meta/env concepts and we should encourage users to take advantage of those for passing information to jails. Relnotes: yes (The capability to disable unpriv access exists) "Hey we should do something about that": dch Reviewed by: imp, ziaee, zlei (all slightly previous version) Differential Revision: https://reviews.freebsd.org/D57697 (cherry picked from commit 4fd518fcb2bbee4c8c41215d6993b923ef57a0e5) --- bin/kenv/kenv.1 | 10 +++++++++- lib/libc/sys/kenv.2 | 7 ++++++- share/man/man7/security.7 | 4 +++- sys/kern/kern_environment.c | 46 +++++++++++++++++++++++++++++++++++++++------ sys/sys/priv.h | 1 + 5 files changed, 59 insertions(+), 9 deletions(-) diff --git a/bin/kenv/kenv.1 b/bin/kenv/kenv.1 index 9b6d0e0b33f2..c0cf0c29cabe 100644 --- a/bin/kenv/kenv.1 +++ b/bin/kenv/kenv.1 @@ -22,7 +22,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd June 20, 2021 +.Dd June 22, 2026 .Dt KENV 1 .Os .Sh NAME @@ -166,3 +166,11 @@ The .Nm utility appeared in .Fx 4.1.1 . +.Sh SECURITY CONSIDERATIONS +Note that unprivileged users are allowed to read from the kernel environment, +unless the +.Va security.bsd.unprivileged_kenv_read +sysctl is set to 0. +This includes both listing the kernel environment, as well as getting a specific +.Va variable +from the environment. diff --git a/lib/libc/sys/kenv.2 b/lib/libc/sys/kenv.2 index 9f179ff2faa6..bdf4dd7f1386 100644 --- a/lib/libc/sys/kenv.2 +++ b/lib/libc/sys/kenv.2 @@ -24,7 +24,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH .\" DAMAGE. .\" -.Dd June 20, 2021 +.Dd June 22, 2026 .Dt KENV 2 .Os .Sh NAME @@ -161,6 +161,11 @@ The kernel is configured to destroy these environments by default. .It Bq Er EPERM A user other than the superuser attempted to set or unset a kernel environment variable. +.It Bq Er EPERM +A user other than the superuser attempted to get a variable from or dump the +kernel environment, and the +.Va security.bsd.unprivileged_kenv_read +sysctl is set to 0. .It Bq Er EFAULT A bad address was encountered while attempting to copy in user arguments or copy out value(s). diff --git a/share/man/man7/security.7 b/share/man/man7/security.7 index af6d3ee9ba8f..7d30a3e14aca 100644 --- a/share/man/man7/security.7 +++ b/share/man/man7/security.7 @@ -26,7 +26,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd March 22, 2026 +.Dd June 22, 2026 .Dt SECURITY 7 .Os .Sh NAME @@ -988,6 +988,8 @@ and usual termination signals like and .Dv SIGTERM , to the processes executing programs with changed uids. +.It Va security.bsd.unprivileged_kenv_read +Controls availability of kernel environment variables to non-root users. .It Va security.bsd.unprivileged_proc_debug Controls availability of the process debugging facilities to non-root users. See also diff --git a/sys/kern/kern_environment.c b/sys/kern/kern_environment.c index 985ce49de001..01d80911ab5b 100644 --- a/sys/kern/kern_environment.c +++ b/sys/kern/kern_environment.c @@ -49,6 +49,7 @@ #include #include #include +#include #include #include @@ -89,6 +90,11 @@ bool dynamic_kenv; #define KENV_CHECK if (!dynamic_kenv) \ panic("%s: called before SI_SUB_KMEM", __func__) +static int unprivileged_kenv_read = 1; +SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RW, + &unprivileged_kenv_read, 1, + "Unprivileged processes can read the kernel environment"); + static int kenv_dump(struct thread *td, char **envp, int what, char *value, int len) { @@ -153,6 +159,33 @@ kenv_dump(struct thread *td, char **envp, int what, char *value, int len) return (error); } +static int +kenv_read_allowed(struct thread *td, int which) +{ + int error; + + if (!unprivileged_kenv_read) { + error = priv_check(td, PRIV_KENV_READ); + if (error) + return (error); + } + + switch (which) { + case KENV_DUMP: + case KENV_DUMP_LOADER: + case KENV_DUMP_STATIC: +#ifdef MAC + error = mac_kenv_check_dump(td->td_ucred); +#endif + break; + default: + error = 0; + break; + } + + return (error); +} + int sys_kenv(struct thread *td, struct kenv_args *uap) { @@ -166,19 +199,15 @@ sys_kenv(struct thread *td, struct kenv_args *uap) switch (uap->what) { case KENV_DUMP: -#ifdef MAC - error = mac_kenv_check_dump(td->td_ucred); + error = kenv_read_allowed(td, uap->what); if (error) return (error); -#endif return (kenv_dump(td, kenvp, uap->what, uap->value, uap->len)); case KENV_DUMP_LOADER: case KENV_DUMP_STATIC: -#ifdef MAC - error = mac_kenv_check_dump(td->td_ucred); + error = kenv_read_allowed(td, uap->what); if (error) return (error); -#endif #ifdef PRESERVE_EARLY_KENV return (kenv_dump(td, uap->what == KENV_DUMP_LOADER ? (char **)md_envp : @@ -197,6 +226,11 @@ sys_kenv(struct thread *td, struct kenv_args *uap) if (error) return (error); break; + case KENV_GET: + error = kenv_read_allowed(td, uap->what); + if (error) + return (error); + break; } name = malloc(KENV_MNAMELEN + 1, M_TEMP, M_WAITOK); diff --git a/sys/sys/priv.h b/sys/sys/priv.h index 090e2b25ce5d..f0b01294ca82 100644 --- a/sys/sys/priv.h +++ b/sys/sys/priv.h @@ -141,6 +141,7 @@ */ #define PRIV_KENV_SET 120 /* Set kernel env. variables. */ #define PRIV_KENV_UNSET 121 /* Unset kernel env. variables. */ +#define PRIV_KENV_READ 122 /* Get/dump kernel env. variables. */ /* * Loadable kernel module privileges.