git: 7399eb454068 - stable/14 - kern: fix oversight in security.bsd.unprivileged_kenv_read

The branch stable/14 has been updated by kevans:

URL: https://cgit.FreeBSD.org/src/commit/?id=7399eb45406874f35e736f105d7d6ff0516c7a2e

commit 7399eb45406874f35e736f105d7d6ff0516c7a2e
Author:     Kyle Evans <kevans@FreeBSD.org>
AuthorDate: 2026-08-08 04:06:33 +0000
Commit:     Kyle Evans <kevans@FreeBSD.org>
CommitDate: 2026-09-04 15:39:55 +0000

    kern: fix oversight in security.bsd.unprivileged_kenv_read
    
    It was intended that one could close the hole back in loader, but the
    sysctl was actually not marked TUNABLE.  The hardening menu option thus
    did nothing, because we wouldn't read the value from kenv.
    
    Reported by:    markj
    Fixes:  6e81fbf5833d ("bsdinstall: add a hardening knob [...]")
    Fixes:  4fd518fcb2bb ("kern: add a security knob to disable [...]")
    
    (cherry picked from commit 8befc9e8b194d874d00239568584552279bebddd)
---
 sys/kern/kern_environment.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/kern/kern_environment.c b/sys/kern/kern_environment.c
index 01d80911ab5b..2ffc0524e9ef 100644
--- a/sys/kern/kern_environment.c
+++ b/sys/kern/kern_environment.c
@@ -91,7 +91,7 @@ bool	dynamic_kenv;
 			    panic("%s: called before SI_SUB_KMEM", __func__)
 
 static int unprivileged_kenv_read = 1;
-SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RW,
+SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RWTUN,
     &unprivileged_kenv_read, 1,
     "Unprivileged processes can read the kernel environment");