--- a/sys/kern/kern_sysctl.c
+++ b/sys/kern/kern_sysctl.c
@@ -50,6 +50,7 @@
 #include <sys/sysmsg.h>
 #include <sys/lock.h>
 #include <sys/sbuf.h>
+#include <sys/jail.h>
 #ifdef KTRACE
 #include <sys/ktrace.h>
 #endif
@@ -1449,6 +1450,18 @@
 		return (error);
 	}
 
+	/*
+	 * A jailed root may only write oids explicitly marked
+	 * CTLFLAG_PRISON, whose handlers scope the write to the prison
+	 * (e.g. kern.hostname -> pr_host).  Every other RW oid references
+	 * host-global state (kern.securelevel, kern.hostid, kern.domainname,
+	 * kern.maxprocperuid, ...) and must not be writable from a jail.
+	 */
+	if (req->newptr && p && jailed(td->td_ucred) &&
+	    (oid->oid_kind & CTLFLAG_PRISON) == 0) {
+		return (EPERM);
+	}
+
 	if (oid->oid_handler == NULL)
 		return EINVAL;