Page MenuHomeFreeBSD
Differential D57755

bsdinstall: add a hardening knob for unprivileged kenv access
ClosedPublic
Actions

Authored by kevans on Jun 22 2026, 8:27 PM.
Tags
None
Referenced Files
F170003192: D57755.id.diff
Thu, Sep 3, 5:43 AM
Unknown Object (File)
Wed, Sep 2, 1:28 PM
Unknown Object (File)
Wed, Sep 2, 12:32 PM
Unknown Object (File)
Wed, Sep 2, 9:16 AM
Unknown Object (File)
Tue, Sep 1, 7:16 PM
Unknown Object (File)
Tue, Sep 1, 1:38 PM
Unknown Object (File)
Tue, Sep 1, 9:29 AM
Unknown Object (File)
Mon, Aug 31, 8:47 PM
View All 48 Files
Subscribers
jrtc27

Details

Reviewers
freebsd_igalic.co
imp
zlei
jrtc27
Commits
rG6e81fbf5833d: bsdinstall: add a hardening knob for unprivileged kenv access
Summary

It makes sense.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 74118
Build 71001: arc lint + arc unit

Event Timeline

kevans created this revision.Jun 22 2026, 8:27 PM
Herald added a subscriber: jrtc27. · View Herald TranscriptJun 22 2026, 8:27 PM
kevans requested review of this revision.Jun 22 2026, 8:27 PM
Harbormaster completed remote builds in B74118: Diff 180329.Jun 22 2026, 8:27 PM
kevans added a comment.Jun 29 2026, 8:05 PM

Ping- this is relatively simple, so I may just commit it later this week, unless someone has time to give it a once-over.

jrtc27 added a comment.Jun 29 2026, 8:08 PM

Implementation-wise it seems reasonable, but every time bsdinstall hardening gains an option the security world cries out in pain over having sensible defaults and good UX :')

kevans added a reviewer: jrtc27.Jun 29 2026, 8:25 PM
In D57755#1328574, @jrtc27 wrote:

Implementation-wise it seems reasonable, but every time bsdinstall hardening gains an option the security world cries out in pain over having sensible defaults and good UX :')

Ah shit, sorry, I should have added you as well. My hope is that I can MFC the original change and this one, then try to convince -arch@ that this should just be the default behavior for 16.0 and the knob can go away again.

zlei accepted this revision.Jun 30 2026, 1:58 AM

Looks good to me.

This revision is now accepted and ready to land.Jun 30 2026, 1:58 AM
kevans mentioned this in rG6e81fbf5833d: bsdinstall: add a hardening knob for unprivileged kenv access.Thu, Aug 6, 11:42 PM
kevans closed this revision.Thu, Aug 6, 11:48 PM
kevans added a commit: rG6e81fbf5833d: bsdinstall: add a hardening knob for unprivileged kenv access.

Sigh, I typo'ed "Differential". This has landed now.

Revision Contents
Changeset List

PathSize
usr.sbin/
bsdinstall/
scripts/
4 lines

Diff 180329

View Options

usr.sbin/bsdinstall/scripts/hardening

Loading...