Laoise Nic Giolla Uidhir on Nostr: a user is arguing with me that setting securelevel on FreeBSD prevents an attacker ...

a user is arguing with me that setting securelevel on FreeBSD prevents an attacker gaining persistence, which... is not even remotely true, but i'm sure we still ship documentation that suggests it is.

i don't think we should remove securelevel, since the basic functionality it provides is fine, but perhaps it needs to be split into a few different sysctls. like one for enforcing file flags, one for device access, one for memory access... the firewall stuff can probably just be ditched.

is there a reason we didn't already do that? it seems like a fairly obvious thing to do.