[Bug 295485] need a way to block zfs.ko from being autoloaded by tools like puppet and facter (FatGID Vuln / CVE-2026-45250)

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295485

Olivier Certner <[email protected]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[email protected]

--- Comment #17 from Olivier Certner <[email protected]> ---
(In reply to Mark Millard from comment #15)
(In reply to Dan Mahoney from comment #16)

Not sure which exploits you are actually referring to, but concerning
setcred()'s, mentioned in FreeBSD-SA-26:18.setcred, ZFS has nothing whatsoever
to do with it.

setcred(2) is a system call part of the base kernel, not a module, and thus is
always loaded and cannot be unloaded.

Nothing in ZFS uses setcred(2).  Actually, nothing in the base system (kernel
or userland) at all uses setcred(2), except mdo(1).

So I hope any confusion has been cleared now.  Could someone remove the
above-mentioned CVE from this bug's title?

As for the "FatGID" marketing name, it came after the SA so obviously could not
have been mentioned there.  IMHO, this name anyway is not informative and looks
more like a gimmick.  The vulnerability description on the website is fine
though (but doesn't mention all the details I posted to freebsd-security@).

Regards.

-- 
You are receiving this mail because:
You are the assignee for the bug.