svn commit: r314036 - head/usr.sbin/bsdinstall/scripts

[Alexey Dokuchaev]

On Tue, Feb 21, 2017 at 08:34:29AM -0600, Eric Badger wrote:
> Thanks for working on making it easier to harden FreeBSD. While
> defaulting some of these options to "on" seem pretty harmless (e.g.
> random_pid), others are likely to cause confusion for new and
> experienced users alike (e.g. proc_debug. I've never used that option
> before, so I gave it a try. It simply causes gdb to hang when attempting
> to start a process, with no obvious indication of why).

I concur.  In fact, harmless knobs should probably be turned on by default
in FreeBSD itself (i.e., without any "hardening" help from the installer),
while more intrusive ones should be opt-in, not opt-out.

./danfe