Re: Operator, Information, give me geom.ctl on the line

--wxxq2xopz7xyonhw
Content-Type: text/plain; protected-headers=v1; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Subject: Re: Operator, Information, give me geom.ctl on the line
MIME-Version: 1.0

On Wed, Jul 29, 2026 at 06:20:17PM +0000, Shawn Webb wrote:
> On Tue, Jul 28, 2026 at 07:57:50PM +0000, Poul-Henning Kamp wrote:
> > I have been pondering this ticket for a couple of years:
> >=20
> > https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D277228
> >=20
> > The short version of the story is that:
> >=20
> > 	crw-r-----  1 root operator 0xa Jul 28 15:47 /dev/geom.ctl
> >=20
> > allows anybody in the operator group to issue ioctls, which, for
> > instance, can nuke all partitioning from a disk.
> >=20
> > Kyle, Warner and I agree that:
> >=20
> > 	crw-r-----  1 root wheel 0xa Jul 28 15:47 /dev/geom.ctl
> >=20
> > Would make more sense, but we have no idea if, or to what extent,
> > anything depends on operator issuing geom ioctls.
> >=20
> > The plan, such as it is, is to make that change in current to find out.
> >=20
> > Before I do that, I want to give any interested parties a chance to
> > sandbox it for themselves, all you have to do edit geom_ctl.c
> > and change:
> >=20
> > 	void
> > 	g_ctl_init(void)
> > 	{
> >=20
> > 		make_dev_credf(MAKEDEV_ETERNAL, &g_ctl_cdevsw, 0, NULL,
> > 		    UID_ROOT, GID_OPERATOR, 0640, PATH_GEOM_CTL);
> > 	}
> >=20
> > To GID_WHEEL instead.
> >=20
> > If I receive no emails indicating disasters, I will make the change in
> > current in a couple of weeks, and wait for fireworks.
>=20
> I would be happy to test out not only GID_WHEEL, but also 0600. If you
> want a wider testing audience, I can commit the change and have
> HardenedBSD users help test.
>=20
> I noticed FreeBSD just pushed some security advisory fixes, so I might
> make the change on HardenedBSD's side regardless and include it in the
> next build I'll do after I address those fixes downstream.

Change committed and pushed[1] and will included in the next build I
publish over the weekend.

[1]: https://radicle.network/nodes/rad.hardenedbsd.org/src/commits/40e739df=
c16a38af0346865a5f6253b7e7974a50

Thanks,

--=20
Shawn Webb
Cofounder / Security Engineer
HardenedBSD

Signal Username:  shawn_webb.74
Tor-ified Signal: +1 (719) 756-1197 / activist_opsec.27
https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/raw/master/Shawn_Webb/03A=
4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc

--wxxq2xopz7xyonhw
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQJPBAABCAA5FiEEA6TL67gupaZ9nzhT/y5nonf44foFAmpqTIAbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMiwzAAoJEP8uZ6J3+OH6VEoP/RjY8zR39TeHd80qxuwp
sScMg1OlqChvA/p3je/p3lmBYf6VE/+pebD2bgq7UhG+ORbcVAvy1llLnpmwGR+o
LqEjtoaTk2N6Cx/+rLJo4TUpurz8ajP0p3yPWDMw8fpAy9BiCIM3hkPEBKUCxv65
wg5VSpHQTfNhDi5bO1L18h1XuN9BwpcsHR8S8qo+RsUbKIm/td1TkbeGSqGCbgaI
TizUQgvA0hF1s7wGu6gLRG2XiuDdZ3eYbsrk1ZJSAs90v8evs95Mq/ujl9Xx1agi
14aCi6BwEd5a0xtJ42e4ofvX+Fo2vmDKRSfmbvuHBXzPBs4geemtFjmuKUTqjC8c
L7RuAuBV8NQhELZsVfiIkoVifbect8JJFhVWDXUlvOlMZW+eHnulj2l5uvhw3b4N
ms/wfOvZGEntDXns5NQZ87o9xaRzMuTHcHXh2LENIwS0i5DOSyKAmIu89sHJz0hR
UbsWk0CIYjTJXtVN5wkd8yT+s+UZmKBv3OHXXFC0F6WCwXDd7+NoFngJ88p/9N+p
591+9t1xX62TNda4eO1NDEYKBnvnrlHFVLU5EIR+0A4BNTMASGijSNBtJbB9vZ+d
URJPWhrxAhNmcHpruizSeZoJ3uWwKreLdh80HJX7mRAtyymb7QS+ZRsQlZ4JQzVV
/8LnY5s+z/W80AoEuF/YZ5fe
=l2X/
-----END PGP SIGNATURE-----

--wxxq2xopz7xyonhw--