[Bug 295485] need a way to block zfs.ko from being autoloaded by tools like puppet and facter (FatGID Vuln / CVE-2026-45250)

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295485

--- Comment #16 from Dan Mahoney <[email protected]> ---
(In reply to Gordon Tetlow from comment #14)

Side Note: I get it that the FreeBSD announcements are not trying to be
"marketing" materials, but it would be useful if they at least mentioned the
"popular" names of known issues such as FatGID or the like.  The FatGid site
covers the fact that it's "setcred" but having a note in the other direction,
even if you don't link to their site, would be helpful. (/Side Note)

When we were trying to patch for setcred and others, we came across the exploit
path and found "wow, this is on everywhere", and started kldunloading it until
we could schedule reboots for things like database servers we couldn't take out
immediately.

At any rate, the BSD team did a great job of managing this one and getting the
fix out fast, but when the number one reproducer for this leverages a kernel
module that's only loaded via an annoying (to us) behavior, I got asked
questions about "why was that loaded at all?".  It was behavior I already knew
about, but from a security standpoint (Hi, we run root DNS servers), it was
absolutely a reasonable question.  It pushed it past the "annoying" threshold
and felt like the right time to mention this.

If I run "zpool status" on a pure-UFS system (or puppet runs it for me), my
expectation is that at that point that *I don't have any zpools*, not that
*that* is how I want to go launch into using ZFS from a cold start (which
should have been started by rc.d at boot, or in the weird space that I'm on a
UFS system but just adding zfs stuff now...that I'd manually load the module or
do `service zfs onestart`).  

And if someone's relying on that autoload behavior (who?  Maybe someone who
just plugged in an USB ZFS array -- it's the only use-case I can think of?),
then (pretty please) make it an on-by-default knob that we can turn off.

-- 
You are receiving this mail because:
You are the assignee for the bug.