Re: permission 0444 vs 0555 on /boot/kernel/*

I originally posted:

'freebsd-update IDS' reports that most (all?) of the files in
/boot/kernel/, including /boot/kernel/kernel, should have
permission 0444, not 0555.
>
Really?
>
AFAIK, those files were written by freebsd-upgrade -r when the system
was upgraded from 14.0 to 14.1 and have only been touched since then by
freebsd-upgrade for patches, so I assume the files were installed with
0555.

to which Robin Haberkorn <robin.haberkorn@googlemail.com> replied:

They are all 0444 on my system.

The answer turned out to be:

If the files with matching names are old enough (and in older releases
of FreeBSD, those files used to be 0555) and KeepModifiedMetadata in
/etc/freebsd-update.conf is yes, then the old permissions get retained.
freebsd-upgrade didn't distinguish distribution-modified from
user-modified.  The Bugzilla discussion is at:

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=283110

 -WBE