git: 48c56b559248 - stable/15 - kern: fix oversight in security.bsd.unprivileged_kenv_read

The branch stable/15 has been updated by kevans:

URL: https://cgit.FreeBSD.org/src/commit/?id=48c56b559248295da78ce2a8ec5549afd8cd4d20

commit 48c56b559248295da78ce2a8ec5549afd8cd4d20
Author:     Kyle Evans <kevans@FreeBSD.org>
AuthorDate: 2026-08-08 04:06:33 +0000
Commit:     Kyle Evans <kevans@FreeBSD.org>
CommitDate: 2026-09-04 15:32:45 +0000

    kern: fix oversight in security.bsd.unprivileged_kenv_read
    
    It was intended that one could close the hole back in loader, but the
    sysctl was actually not marked TUNABLE.  The hardening menu option thus
    did nothing, because we wouldn't read the value from kenv.
    
    Reported by:    markj
    Fixes:  6e81fbf5833d ("bsdinstall: add a hardening knob [...]")
    Fixes:  4fd518fcb2bb ("kern: add a security knob to disable [...]")
    
    (cherry picked from commit 8befc9e8b194d874d00239568584552279bebddd)
---
 sys/kern/kern_environment.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/kern/kern_environment.c b/sys/kern/kern_environment.c
index 72c7544b4bac..acbb94067457 100644
--- a/sys/kern/kern_environment.c
+++ b/sys/kern/kern_environment.c
@@ -93,7 +93,7 @@ bool	dynamic_kenv;
 			    panic("%s: called before SI_SUB_KMEM", __func__)
 
 static int unprivileged_kenv_read = 1;
-SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RW,
+SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RWTUN,
     &unprivileged_kenv_read, 1,
     "Unprivileged processes can read the kernel environment");