From nobody Fri Sep 04 18:49:11 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hc5946l2fz6r5tq for ; Fri, 04 Sep 2026 18:49:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hc5942yrkz4B8G for ; Fri, 04 Sep 2026 18:49:12 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788547752; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=3S7gu37px2WSXFppEkDTLvl2XVFlUj1WKN0l9JtejFY=; b=tFfCpg/ufx4NqtVaiP+92X8/ihJ5VE1CsQmtO9kK6KhxXFqt672Vq/Oo685oH9va2XUcZu lmiLj7Vc9ZwqTVZo988r6XzPWTcB9a7DFoArnyAymtAAPKFRNtsvBvV7ABWpjuCprjtNgg ufMvNtMw1hBh+WnMzL8TdEJcy601Vl/2e5rGGS6KE+/y3dHktq6/QWytsBekQiQTliiOlj mYWXweD3j6WfClffa/XzVIggsAg78xVi4n7G2eWsnfCwvD+PYLIHPZrekFW/wONoe2QaN7 Otmg5xWBZNPTCFzLdbQT+bpEB5xusKBv0dvjTUJnhuo0HRxP9Sa/+DP8f1VfTg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1788547752; a=rsa-sha256; cv=none; b=jjocbeZbu92xHaR++so+5nkkTC3M6Zkat40G1oEC+kZ9P5OCird4bw9gI0qSQ/ssl2vuxl 08Rd+mAQjT9fEV/n3yKaRjrNo7/scuZwxrPDfAzCuDBjG3ckBvBX9nx4VOp7wVwwFdIAvq /gZOKmKTYlJsxRnpvSTARN8Hf/sVVqIrg4oYplq/1OyCzYbEXEKChs5gHA7XKjW2FGZCDr ypAmSoWaCpgdAXEY0MqoZMuvpp17sZiDWKSi2NR7K75H+z+5NvMKjWSbd5ZeaWaFm9QViW tGCiSVWGaGsj2sQk6iCWopiv911NLOR3AAq2yb2tVqoPuYqJ4dS1si+rJimPvQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788547752; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=3S7gu37px2WSXFppEkDTLvl2XVFlUj1WKN0l9JtejFY=; b=oPmCx14QgbsNJhYZJLdpW5r2vhFPJnGmW1Nl4bfdB4uvBN8H7fxCuZLbfrTiPtMKdi+lje Vy3Kr0JvuZdw5fwIYZKVsnj6nm9hR0DMK8bOOQCNsj1H+mXjMUCYGWbRV29kZZecN9hl38 RJPgkljeVfzF4LZdMK2w3VeoeoOeYVy5WvBzJ1J3LbPe8nVZlrXDvxTut8GxmDqKHgfQTV fRPC2x2ZrwpF876ruYIaF0hjCo8iaGR5GoTAGbNhYB9VipxCIt8GxLutzz+lrpq73+iGbX ICW3VrRypl5gLVjBfmFMZ75Tqi1VZsgzlFvYJ8tm7on6y5IpXVzgGDN+FYx29Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hc5936DF3z1B9j for ; Fri, 04 Sep 2026 18:49:11 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 2156c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 04 Sep 2026 18:49:11 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kyle Evans Subject: git: 48c56b559248 - stable/15 - kern: fix oversight in security.bsd.unprivileged_kenv_read List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kevans X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 48c56b559248295da78ce2a8ec5549afd8cd4d20 Auto-Submitted: auto-generated Date: Fri, 04 Sep 2026 18:49:11 +0000 Message-Id: <6a9b12a7.2156c.ff7ef1c@gitrepo.freebsd.org> The branch stable/15 has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=48c56b559248295da78ce2a8ec5549afd8cd4d20 commit 48c56b559248295da78ce2a8ec5549afd8cd4d20 Author: Kyle Evans AuthorDate: 2026-08-08 04:06:33 +0000 Commit: Kyle Evans CommitDate: 2026-09-04 15:32:45 +0000 kern: fix oversight in security.bsd.unprivileged_kenv_read It was intended that one could close the hole back in loader, but the sysctl was actually not marked TUNABLE. The hardening menu option thus did nothing, because we wouldn't read the value from kenv. Reported by: markj Fixes: 6e81fbf5833d ("bsdinstall: add a hardening knob [...]") Fixes: 4fd518fcb2bb ("kern: add a security knob to disable [...]") (cherry picked from commit 8befc9e8b194d874d00239568584552279bebddd) --- sys/kern/kern_environment.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/kern/kern_environment.c b/sys/kern/kern_environment.c index 72c7544b4bac..acbb94067457 100644 --- a/sys/kern/kern_environment.c +++ b/sys/kern/kern_environment.c @@ -93,7 +93,7 @@ bool dynamic_kenv; panic("%s: called before SI_SUB_KMEM", __func__) static int unprivileged_kenv_read = 1; -SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RW, +SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RWTUN, &unprivileged_kenv_read, 1, "Unprivileged processes can read the kernel environment");