From nobody Tue Oct 24 18:05:57 2023
X-Original-To: freebsd-security@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4SFKlv15mbz4yKZr
	for <freebsd-security@mlmmj.nyi.freebsd.org>; Tue, 24 Oct 2023 18:07:39 +0000 (UTC)
	(envelope-from security@lordcow.org)
Received: from mail.lordcow.org (lordcow.org [IPv6:2c0f:fb18:402:5::2])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature ECDSA (P-256) client-digest SHA256)
	(Client CN "devaux.za.net", Issuer "R3" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4SFKlt3DQkz3TVk
	for <freebsd-security@freebsd.org>; Tue, 24 Oct 2023 18:07:38 +0000 (UTC)
	(envelope-from security@lordcow.org)
Authentication-Results: mx1.freebsd.org;
	none
Received: from lordcow.org (localhost [127.0.0.1])
	by mail.lordcow.org (8.17.2/8.17.2) with ESMTPS id 39OI63AJ000578
	(version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT);
	Tue, 24 Oct 2023 20:06:18 +0200 (SAST)
	(envelope-from lordcow@lordcow.org)
X-Authentication-Warning: lordcow.org: Host localhost [127.0.0.1] claimed to be lordcow.org
Received: (from lordcow@localhost)
	by lordcow.org (8.17.2/8.17.2/Submit) id 39OI5wYD099343;
	Tue, 24 Oct 2023 20:05:58 +0200 (SAST)
	(envelope-from lordcow)
Date: Tue, 24 Oct 2023 20:05:57 +0200
From: Gareth de Vaux <security@lordcow.org>
To: void <void@f-m.fm>
Cc: freebsd-security@freebsd.org
Subject: Re: securelevel 1
Message-ID: <ZTgHhRybLnDdhVst@lordcow.org>
References: <ZTeaGFZjvcsKfbOW@int21h>
 <6638DADD-FCDB-492C-B1E8-441C6622038B@FreeBSD.org>
 <663fd243-94ec-40c1-ac66-ca8e3d5f278d@quip.cz>
 <35f733cc-a6c2-46a4-b564-b1ef87893fc5@app.fastmail.com>
List-Id: Security issues <freebsd-security.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-security
List-Help: <mailto:freebsd-security+help@freebsd.org>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Subscribe: <mailto:freebsd-security+subscribe@freebsd.org>
List-Unsubscribe: <mailto:freebsd-security+unsubscribe@freebsd.org>
Sender: owner-freebsd-security@freebsd.org
X-BeenThere: freebsd-security@freebsd.org
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <35f733cc-a6c2-46a4-b564-b1ef87893fc5@app.fastmail.com>
X-Spam-Status: No, score=-1.0 required=5.0 tests=ALL_TRUSTED autolearn=ham
	autolearn_force=no version=4.0.0
X-Spam-Checker-Version: SpamAssassin 4.0.0 (2022-12-14) on lordcow.org
X-Spamd-Bar: ----
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:37199, ipnet:2c0f:fb18::/32, country:ZA]
X-Rspamd-Queue-Id: 4SFKlt3DQkz3TVk

On Tue 2023-10-24 (17:33), void wrote:
> In order to accomplish what I'd like, I understand that I'd need to set +schg
> on the individual logs, then set the securelevel afterwards and reboot.

You don't need to reboot when raising the securelevel, only to lower it.