git: 6e81fbf5833d - main - bsdinstall: add a hardening knob for unprivileged kenv access

The branch main has been updated by kevans:

URL: https://cgit.FreeBSD.org/src/commit/?id=6e81fbf5833d43529fd8a253b592af9666b04e8e

commit 6e81fbf5833d43529fd8a253b592af9666b04e8e
Author:     Kyle Evans <kevans@FreeBSD.org>
AuthorDate: 2026-08-06 23:41:43 +0000
Commit:     Kyle Evans <kevans@FreeBSD.org>
CommitDate: 2026-08-06 23:41:43 +0000

    bsdinstall: add a hardening knob for unprivileged kenv access
    
    It makes sense.
    
    Reviewed by:    zleei
    Differental Revision:   https://reviews.freebsd.org/D57755
---
 usr.sbin/bsdinstall/scripts/hardening | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/usr.sbin/bsdinstall/scripts/hardening b/usr.sbin/bsdinstall/scripts/hardening
index a77fcdeaf540..9f5639ee7c99 100755
--- a/usr.sbin/bsdinstall/scripts/hardening
+++ b/usr.sbin/bsdinstall/scripts/hardening
@@ -49,6 +49,7 @@ FEATURES=$( bsddialog --backtitle "$OSNAME Installer" \
 	"7 disable_syslogd" "Disable opening Syslogd network socket (disables remote logging)" ${disable_syslogd:-off} \
 	"8 secure_console" "Enable console password prompt" ${secure_console:-off} \
 	"9 disable_ddtrace" "Disallow DTrace destructive-mode" ${disable_ddtrace:-off} \
+	"10 disable_unpriv_kenv" "Disable unprivileged reading of kenv" ${disable_unpriv_kenv:-off} \
 2>&1 1>&5 )
 retval=$?
 exec 5>&-
@@ -89,5 +90,8 @@ for feature in $FEATURES; do
 	disable_ddtrace)
 		echo 'security.bsd.allow_destructive_dtrace=0' >> $BSDINSTALL_TMPBOOT/loader.conf.hardening
 		;;
+	disable_unpriv_kenv)
+		echo 'security.bsd.unprivileged_kenv_read=0' >> $BSDINSTALL_TMPBOOT/loader.conf.hardening
+		;;
 	esac
 done