git: 8befc9e8b194 - main - kern: fix oversight in security.bsd.unprivileged_kenv_read

The branch main has been updated by kevans:

URL: https://cgit.FreeBSD.org/src/commit/?id=8befc9e8b194d874d00239568584552279bebddd

commit 8befc9e8b194d874d00239568584552279bebddd
Author:     Kyle Evans <kevans@FreeBSD.org>
AuthorDate: 2026-08-08 04:06:33 +0000
Commit:     Kyle Evans <kevans@FreeBSD.org>
CommitDate: 2026-08-08 04:07:24 +0000

    kern: fix oversight in security.bsd.unprivileged_kenv_read
    
    It was intended that one could close the hole back in loader, but the
    sysctl was actually not marked TUNABLE.  The hardening menu option thus
    did nothing, because we wouldn't read the value from kenv.
    
    Reported by:    markj
    Fixes:  6e81fbf5833d ("bsdinstall: add a hardening knob [...]")
    Fixes:  4fd518fcb2bb ("kern: add a security knob to disable [...]")
---
 sys/kern/kern_environment.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/kern/kern_environment.c b/sys/kern/kern_environment.c
index 72c7544b4bac..acbb94067457 100644
--- a/sys/kern/kern_environment.c
+++ b/sys/kern/kern_environment.c
@@ -93,7 +93,7 @@ bool	dynamic_kenv;
 			    panic("%s: called before SI_SUB_KMEM", __func__)
 
 static int unprivileged_kenv_read = 1;
-SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RW,
+SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RWTUN,
     &unprivileged_kenv_read, 1,
     "Unprivileged processes can read the kernel environment");