kern: add a security knob to disable unprivileged access to kenv

We sometimes store sensitive things in the kenv that get zapped, but we
really shouldn't rely on that zapping to actually happen.  Most
unprivileged processes don't really need to read from the kernel
environment in the first place, so add a knob that allows it to be
disabled.

Note that we consider jailed root to be unprivileged from this
perspective; they have their own meta/env concepts and we should
encourage users to take advantage of those for passing information to
jails.

"Hey we should do something about that":	dch
Reviewed by:	imp, ziaee, zlei (all slightly previous version)
Differential Revision:	https://reviews.freebsd.org/D57697

1 files changed, 9 insertions, 1 deletions

diff --git a/bin/kenv/kenv.1 b/bin/kenv/kenv.1
index 9b6d0e0b33f2..c0cf0c29cabe 100644
--- a/bin/kenv/kenv.1
+++ b/bin/kenv/kenv.1
@@ -22,7 +22,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd June 20, 2021
+.Dd June 22, 2026
 .Dt KENV 1
 .Os
 .Sh NAME
@@ -166,3 +166,11 @@ The
 .Nm
 utility appeared in
 .Fx 4.1.1 .
+.Sh SECURITY CONSIDERATIONS
+Note that unprivileged users are allowed to read from the kernel environment,
+unless the
+.Va security.bsd.unprivileged_kenv_read
+sysctl is set to 0.
+This includes both listing the kernel environment, as well as getting a specific
+.Va variable
+from the environment.