CRYPT_SOFT_ALLOW
sysctlbyname(CRYPT_SOFT_ALLOW, NULL, NULL, &off, sizeof(off));
if (sysctlbyname(CRYPT_SOFT_ALLOW, &curstate, &cursize,
err(1, "sysctl(%s)", CRYPT_SOFT_ALLOW);