Date: Thu, 06 Aug 2026 23:41:55 +0000 From: Kyle Evans <kevans@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 6e81fbf5833d - main - bsdinstall: add a hardening knob for unprivileged kenv access Message-ID: <6a751bc3.252e1.5ffab15a@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=6e81fbf5833d43529fd8a253b592af9666b04e8e commit 6e81fbf5833d43529fd8a253b592af9666b04e8e Author: Kyle Evans <kevans@FreeBSD.org> AuthorDate: 2026-08-06 23:41:43 +0000 Commit: Kyle Evans <kevans@FreeBSD.org> CommitDate: 2026-08-06 23:41:43 +0000 bsdinstall: add a hardening knob for unprivileged kenv access It makes sense. Reviewed by: zleei Differental Revision: https://reviews.freebsd.org/D57755 --- usr.sbin/bsdinstall/scripts/hardening | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/usr.sbin/bsdinstall/scripts/hardening b/usr.sbin/bsdinstall/scripts/hardening index a77fcdeaf540..9f5639ee7c99 100755 --- a/usr.sbin/bsdinstall/scripts/hardening +++ b/usr.sbin/bsdinstall/scripts/hardening @@ -49,6 +49,7 @@ FEATURES=$( bsddialog --backtitle "$OSNAME Installer" \ "7 disable_syslogd" "Disable opening Syslogd network socket (disables remote logging)" ${disable_syslogd:-off} \ "8 secure_console" "Enable console password prompt" ${secure_console:-off} \ "9 disable_ddtrace" "Disallow DTrace destructive-mode" ${disable_ddtrace:-off} \ + "10 disable_unpriv_kenv" "Disable unprivileged reading of kenv" ${disable_unpriv_kenv:-off} \ 2>&1 1>&5 ) retval=$? exec 5>&- @@ -89,5 +90,8 @@ for feature in $FEATURES; do disable_ddtrace) echo 'security.bsd.allow_destructive_dtrace=0' >> $BSDINSTALL_TMPBOOT/loader.conf.hardening ;; + disable_unpriv_kenv) + echo 'security.bsd.unprivileged_kenv_read=0' >> $BSDINSTALL_TMPBOOT/loader.conf.hardening + ;; esac donehome | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a751bc3.252e1.5ffab15a>