From nobody Sat Aug 8 04:10:07 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hH6xJ70zHz6mvL9 for ; Sat, 08 Aug 2026 04:10:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hH6xJ4qBCz3VWS for ; Sat, 08 Aug 2026 04:10:12 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786162212; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9tuHHljcah9Y1euYhiTcpcOeMwYbSCcZj7wAglIbUMc=; b=LN+2UOc/FHWt+dhX4/W4J06rj7BYKg8uJK0jkTwE6FCkPbVSkf4f1DbHqdfZ9XdONbjfko 0CwG5YUDDwMHQMZS7WdSSg9IDaNu6NrsnUC0CWo68Zh+toeMyfoeKyjaLpsTl9M+7D/Xaz faVvmOnS7HYfDNzUglhIxvp8bsPpcSuKNGKQyaL/n78fKB+EgXq53x/4Cj5Zs2IDbA8caY wkUd9lcCi60UENxMQj0Clpwk73eAajQyu1nDLWDuZluWdsHWGdyL3Fhg7Rpy4ciQYaQzrf q2NDe8Y8FS5tl/2JWWdV2mCM/cQ2mEY2wVK/+9Q/KoMM7AISe7zYG0rvTgCoPA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1786162212; a=rsa-sha256; cv=none; b=ul8AxJKwIsTZGjlOEKWitPWY3R1Xwq3r7niJhOUA4NMAkDDsxQrlWm8lFqpsYOpBz5ztZd Tjk2T8M8kzkcMzPJT9W9Y8jNB2TUHGdHmEyo8EZSSIlaCjAjDfQleU3qxqvwck3f+7pwJw DbNMrj3p/4iGsc4c1JIetUZELZlk/iZ17Y2epAmPjMJg0aRQPSTwOXDIp4ZogXpCvT458p 39esd6eaaHUTO9Unmrv1arBfNMXFCXeUb9ZeZTBOzhbg6zS7fOXcagfPh45FcIoX4ZjAqR iFiPKvN+SdrE8qLtPga2zhT31FAsk91ozGZJ4KMOvfHJPpCpjcwOwAllsDRGtQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786162212; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9tuHHljcah9Y1euYhiTcpcOeMwYbSCcZj7wAglIbUMc=; b=UaNSdVLuqQmX9gpGz9sa5fFpUHVZanebmfuQ3LC6cO80Ah+ikq9HTncM/xi05d5kIOih83 9X0q61UJhcp9NkHRqsyD5ZHa9CLOYAQuTa9M0aouRVK3Qih2odYiPa0VFel5eOEdFN+am8 ze+tEM/9v1QwbVbRakjOclMtuDzxa24kIl52NphoGaZKbTUjVYuFf54Pna73HsI05iISJw R2ZndVS+mZUoG2ms2ARmj7jXEsBgcZ/sTdiiUHEhKeOY4DBDGmkYaMDMNA6w/6dYWcNv+D e8Po2qwPAMcp8OPHaqDeZLTN3W2IfV2ICezzvWHGHW5CDDUdimJH5B1Sn2v56w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hH6xJ2Wzxz6S8 for ; Sat, 08 Aug 2026 04:10:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 264a4 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sat, 08 Aug 2026 04:10:07 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kyle Evans Subject: git: 8befc9e8b194 - main - kern: fix oversight in security.bsd.unprivileged_kenv_read List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kevans X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 8befc9e8b194d874d00239568584552279bebddd Auto-Submitted: auto-generated Date: Sat, 08 Aug 2026 04:10:07 +0000 Message-Id: <6a76ac1f.264a4.4d514d67@gitrepo.freebsd.org> The branch main has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=8befc9e8b194d874d00239568584552279bebddd commit 8befc9e8b194d874d00239568584552279bebddd Author: Kyle Evans AuthorDate: 2026-08-08 04:06:33 +0000 Commit: Kyle Evans CommitDate: 2026-08-08 04:07:24 +0000 kern: fix oversight in security.bsd.unprivileged_kenv_read It was intended that one could close the hole back in loader, but the sysctl was actually not marked TUNABLE. The hardening menu option thus did nothing, because we wouldn't read the value from kenv. Reported by: markj Fixes: 6e81fbf5833d ("bsdinstall: add a hardening knob [...]") Fixes: 4fd518fcb2bb ("kern: add a security knob to disable [...]") --- sys/kern/kern_environment.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/kern/kern_environment.c b/sys/kern/kern_environment.c index 72c7544b4bac..acbb94067457 100644 --- a/sys/kern/kern_environment.c +++ b/sys/kern/kern_environment.c @@ -93,7 +93,7 @@ bool dynamic_kenv; panic("%s: called before SI_SUB_KMEM", __func__) static int unprivileged_kenv_read = 1; -SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RW, +SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RWTUN, &unprivileged_kenv_read, 1, "Unprivileged processes can read the kernel environment");