From nobody Fri Sep 04 18:49:09 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hc5973FDgz6r5ds for ; Fri, 04 Sep 2026 18:49:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hc5970wDXz3Br1 for ; Fri, 04 Sep 2026 18:49:15 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788547755; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OdMGjM3J+MhcyhpEzxC9k0PlBV13y3HAwemTxnXxaO4=; b=S95LPIat0fA+Z7UCn+UX2/MUVFSQvqywZZ013mvdOLXvKyUiZwrrVw0ETD+n0uYF3VEtRC ZOc44Fr+ArQ/Jw2R7Ae/8qJmcPmoz19VhkHQPba3NHlvCGgHi0Z3s9X2inkthD0mTt36ue 4taJT+0wwE0A+6KBjGZvZPm67yyvKE/QXKnqxF7GrGz074Ukq2KrLjfGi5uaHwgTc2EJ7c OhHukAHuD5t2a3qVri5zNsdh5p9a4q0C7c1hkzo+aIyVVoOJ8X9bZGDA50XhpU/jaPo1sV HDXoDAR8Cz4DLqYC38Jom2oi0vqxAmCszZIjcczm1ALx28pKlUMSXCfbZejklA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1788547755; a=rsa-sha256; cv=none; b=clh2l4oAyDjFej1WUT+9z1NYk5v5K5+39MH+6s/3jXrk5aHAVpd7ZXtwZ/dli+unxxAxsw ITHcDb3zgPfUhxfIcJCcaDJTcbemwhRikOkCCu9mmsjwPpVx7BEs5uqR/f/EpNOmNkicnC g8N0emzCiYWfaVDqsAyWkUK2hzlT8sSgFbQQsIEUUqo6eddDbK2UhdXXwxIzET8+HqkA+/ cjehlGEesrEGtO9oMTUrfywhWW28amDyB5e60hu4abexFHJIJgT2OBKSnpZz98FbqUpsoO 1m0n3HdlVD0rhUilZIhYmQqJqyvrO+2snvh5/S5WNWC2IQfXXJYvBl9G38tBLA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788547755; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OdMGjM3J+MhcyhpEzxC9k0PlBV13y3HAwemTxnXxaO4=; b=SpXbQhnOOqHuxMwdXGqDUX7cIZ/SPdgbAW7yjqrJ49D5JQjC6Ty6DpMpAJYIqgl2J4VlhQ 6DzGF3lv6ZsLWRPzKtGHoe+n3nrDW21uhpo/kxmeKCRwfUcbmgHzI2wP0co2gBRKFsl84b l9dti0c6H7oCecM8x4iDgO84sbeY0B4jKfISRyIytzap83BFCHTR4w9A8ICVbKzZT0/lU/ s0PfgVFM57s98L3MF1VHVOayKIo1crb5d4lEOyWQ7KrY8e9u6suaCdHQORjMAPWXJvgEvH GYVVD1GE0t3kCX4x61G3Su5WrfJ4wzSqdYYmoOY96cVmP+/nAaFlf2BMWRBYSA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hc5966pS7z1BHD for ; Fri, 04 Sep 2026 18:49:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 2298f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 04 Sep 2026 18:49:09 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kyle Evans Subject: git: 240bea933ddd - stable/15 - bsdinstall: add a hardening knob for unprivileged kenv access List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kevans X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 240bea933ddd3ad296695fc520405bcc4d92be75 Auto-Submitted: auto-generated Date: Fri, 04 Sep 2026 18:49:09 +0000 Message-Id: <6a9b12a5.2298f.84d603f@gitrepo.freebsd.org> The branch stable/15 has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=240bea933ddd3ad296695fc520405bcc4d92be75 commit 240bea933ddd3ad296695fc520405bcc4d92be75 Author: Kyle Evans AuthorDate: 2026-08-06 23:41:43 +0000 Commit: Kyle Evans CommitDate: 2026-09-04 15:32:21 +0000 bsdinstall: add a hardening knob for unprivileged kenv access It makes sense. Reviewed by: zleei (cherry picked from commit 6e81fbf5833d43529fd8a253b592af9666b04e8e) --- usr.sbin/bsdinstall/scripts/hardening | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/usr.sbin/bsdinstall/scripts/hardening b/usr.sbin/bsdinstall/scripts/hardening index a77fcdeaf540..9f5639ee7c99 100755 --- a/usr.sbin/bsdinstall/scripts/hardening +++ b/usr.sbin/bsdinstall/scripts/hardening @@ -49,6 +49,7 @@ FEATURES=$( bsddialog --backtitle "$OSNAME Installer" \ "7 disable_syslogd" "Disable opening Syslogd network socket (disables remote logging)" ${disable_syslogd:-off} \ "8 secure_console" "Enable console password prompt" ${secure_console:-off} \ "9 disable_ddtrace" "Disallow DTrace destructive-mode" ${disable_ddtrace:-off} \ + "10 disable_unpriv_kenv" "Disable unprivileged reading of kenv" ${disable_unpriv_kenv:-off} \ 2>&1 1>&5 ) retval=$? exec 5>&- @@ -89,5 +90,8 @@ for feature in $FEATURES; do disable_ddtrace) echo 'security.bsd.allow_destructive_dtrace=0' >> $BSDINSTALL_TMPBOOT/loader.conf.hardening ;; + disable_unpriv_kenv) + echo 'security.bsd.unprivileged_kenv_read=0' >> $BSDINSTALL_TMPBOOT/loader.conf.hardening + ;; esac done