kern: add a security knob to disable unprivileged access to kenv

We sometimes store sensitive things in the kenv that get zapped, but we
really shouldn't rely on that zapping to actually happen.  Most
unprivileged processes don't really need to read from the kernel
environment in the first place, so add a knob that allows it to be
disabled.

Note that we consider jailed root to be unprivileged from this
perspective; they have their own meta/env concepts and we should
encourage users to take advantage of those for passing information to
jails.

"Hey we should do something about that":	dch
Reviewed by:	imp, ziaee, zlei (all slightly previous version)
Differential Revision:	https://reviews.freebsd.org/D57697

1 files changed, 6 insertions, 1 deletions

diff --git a/lib/libsys/kenv.2 b/lib/libsys/kenv.2
index 9f179ff2faa6..bdf4dd7f1386 100644
--- a/lib/libsys/kenv.2
+++ b/lib/libsys/kenv.2
@@ -24,7 +24,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
 .\" DAMAGE.
 .\"
-.Dd June 20, 2021
+.Dd June 22, 2026
 .Dt KENV 2
 .Os
 .Sh NAME
@@ -161,6 +161,11 @@ The kernel is configured to destroy these environments by default.
 .It Bq Er EPERM
 A user other than the superuser attempted to set or unset a kernel
 environment variable.
+.It Bq Er EPERM
+A user other than the superuser attempted to get a variable from or dump the
+kernel environment, and the
+.Va security.bsd.unprivileged_kenv_read
+sysctl is set to 0.
 .It Bq Er EFAULT
 A bad address was encountered while attempting to copy in user arguments
 or copy out value(s).