From nobody Fri Sep 04 18:49:26 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hc59M2yzdz6r5V9 for ; Fri, 04 Sep 2026 18:49:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hc59M13Y1z3CF6 for ; Fri, 04 Sep 2026 18:49:27 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788547767; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LqrXlJJc+wxAqHPgwkzPTVFaG5mvesoklSvPRIYFAbs=; b=RxvBxoQsCnI6MEE2CarVbEmIK+z6qgTnKErgcy1qTNi7g/csz9M51A+GZlB/N/QE1Xp3Ap PgUNfa7i/fEomdDbm5Rjl/M6F9eZqeXmRDDQMN3jEnYv6Qi/Q4Z83i7wUxkNPPkOl/nMkd bs7wmWzYPG+1100EPqmvQt67Qhl5ZkvlfzAcqg2h5qLqanFG8lqbMxHMmh6Urav0bzKg/2 PWY6oKq+WGTAWSyr4brSAqcAxq9dlwFTUfgINJyEIBP3SOSw6qzvTrpzkyi4LGdLSHQAAt HYXWhtYr24GIu7oYSSmoEA+zueUEY48MC8uUnqL74E0Ef8xdZfZAdm4+bcaDpw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1788547767; a=rsa-sha256; cv=none; b=jvFbp4qwH79jntKH2FQcLXCJsTj+bAvR0w2nH47PCDzuWRtinELBOS0CXPD3/1HTKF9iWm ULG6xXUrxT8qziJU2zREaAzNfBAfGNAfHKFYlQEnzBKzaSIS2q3J3fhgCDH7KIR/fQ2cVr WypvIFRBIf/M2KWbZXswWNR/gDF3ChS3s0M1FbS06f7uR/jZlH+aHJri3by5PI4LVFBV82 Ttu35P0pV6ZdNc5wG6ZtnhCbGm+eqqvydpHZkZd+ofBthtDcBL6JpNfk1pFatOklFQokb/ JIUZCaptr/6bT71kFbjYkyO45uIgrLqvznhzCv7Qa59zYUVorh2s6uRXvMfMLw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788547767; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LqrXlJJc+wxAqHPgwkzPTVFaG5mvesoklSvPRIYFAbs=; b=lUp71P5+WOH2/L1qB+XS9ERQucyGr7Ee9PMPFF/XihWf4QQNpmnAt7wz3qBIfEA8jdTC0r bidaHwJDxS0HpwNLAqpyJgqykK5MAOXR3aQkCDBguIY6Ns+1aRA/Afkql5UktQIeQH8PV6 KpFU1ZlYPlY7kNCmpTQYAVOVddxDtsGjxYvn+LXU8SHNIMyJSFbSYcBfR0/a/xuz0V+Ewm JZbx993fGPt53gL4RvfVgXufbHf7DUlYlPcotVWrvIDhUFtdnASEhPkXfLkbwmdNQ/6yiB hi9XQPPaWAjSVnMG729h1DTPzB539hH+M4eNvrJcpim67Uimpk6aAKmPTUq7WA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hc59L6pV3z1BHJ for ; Fri, 04 Sep 2026 18:49:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 22a29 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 04 Sep 2026 18:49:26 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kyle Evans Subject: git: 7399eb454068 - stable/14 - kern: fix oversight in security.bsd.unprivileged_kenv_read List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kevans X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 7399eb45406874f35e736f105d7d6ff0516c7a2e Auto-Submitted: auto-generated Date: Fri, 04 Sep 2026 18:49:26 +0000 Message-Id: <6a9b12b6.22a29.25c936e1@gitrepo.freebsd.org> The branch stable/14 has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=7399eb45406874f35e736f105d7d6ff0516c7a2e commit 7399eb45406874f35e736f105d7d6ff0516c7a2e Author: Kyle Evans AuthorDate: 2026-08-08 04:06:33 +0000 Commit: Kyle Evans CommitDate: 2026-09-04 15:39:55 +0000 kern: fix oversight in security.bsd.unprivileged_kenv_read It was intended that one could close the hole back in loader, but the sysctl was actually not marked TUNABLE. The hardening menu option thus did nothing, because we wouldn't read the value from kenv. Reported by: markj Fixes: 6e81fbf5833d ("bsdinstall: add a hardening knob [...]") Fixes: 4fd518fcb2bb ("kern: add a security knob to disable [...]") (cherry picked from commit 8befc9e8b194d874d00239568584552279bebddd) --- sys/kern/kern_environment.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/kern/kern_environment.c b/sys/kern/kern_environment.c index 01d80911ab5b..2ffc0524e9ef 100644 --- a/sys/kern/kern_environment.c +++ b/sys/kern/kern_environment.c @@ -91,7 +91,7 @@ bool dynamic_kenv; panic("%s: called before SI_SUB_KMEM", __func__) static int unprivileged_kenv_read = 1; -SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RW, +SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RWTUN, &unprivileged_kenv_read, 1, "Unprivileged processes can read the kernel environment");