[Bug 295485] need a way to block zfs.ko from being autoloaded by tools like puppet and facter

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295485

--- Comment #9 from Mark Millard <[email protected]> ---
(In reply to Dan Mahoney from comment #8)


If you want the CVE status to drive the timing, the one line
summary in use gives no hint about that being involved. It
probably should.

I assume that ZFS can be useful, otherwise it would seem that
FreeBSD OS builds based on using all of:

             WITHOUT_LOADER_ZFS
             WITHOUT_ZFS
             WITHOUT_ZFS_TESTS

would be the most effective at avoiding such a CVE in all
cases. Also: just removing from the ports what causes ZFS
to be involved would then be an option --but that is not
the direction you are going.

Should the ports tolerate zfs simply not being present?
Do they already tolerate such?

Have you tested what happens on such a system context?
As stands, none of the notes reference the various port's
error handling for any technique of preventing zfs.ko
being loaded. A pure system-side change may well be
insufficient. A system based on the WITHOUT_*'s could
allow some testing of that form of disable, before other
changes are made. It could be done now for contexts were
ZFS is known to not be of use.

-- 
You are receiving this mail because:
You are the assignee for the bug.