[Bug 295485] need a way to block zfs.ko from being autoloaded by tools like puppet and facter (FatGID Vuln / CVE-2026-45250)

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295485

--- Comment #25 from Mark Millard <[email protected]> ---
FYI: truss output for zpool list and for zpool status
when zfs.ko is not already loaded at the time has:

# tail -14 ~/zpool_list_truss_output.log
28825: modfind("zfs")                            ERR#2 'No such file or
directory'
28825: kldload("zfs")                            = 9 (0x9)
28825: openat(AT_FDCWD,"/dev/zfs",O_RDWR|O_EXCL|O_CLOEXEC,00) = 3 (0x3)
28825: openat(AT_FDCWD,"/dev/zfs",O_RDWR|O_CLOEXEC,00) = 4 (0x4)
28825:
__sysctlbyname("vfs.zfs.version.ioctl",21,0x31309501d77c,0x31309501d780,0x0,0)
= 0 (0x0)
28825: ioctl(3,0xc0185a04 { IORW 0x5a('Z'), 4, 24 },0x31309501d780) = 0 (0x0)
28825: fstat(1,{ mode=crw--w---- ,inode=85,size=0,blksize=4096 }) = 0 (0x0)
28825: ioctl(1,TIOCGETA,0x31309501e82c)          = 0 (0x0)
28825: write(1,"no pools available\n",19)        = 19 (0x13)
28825: ioctl(3,0xc0185a3f { IORW 0x5a('Z'), 63, 24 },0x31309501dab0) ERR#1
'Operation not permitted'
28825: close(3)                                  = 0 (0x0)
28825: close(4)                                  = 0 (0x0)
28825: _exit(0x0)                               
28825: process exit, rval = 0

# tail -14 ~/zpool_status_truss_output.log
28843: close(3)                                  = 0 (0x0)
28843: munmap(0x33166cc2c000,54560)              = 0 (0x0)
28843: modfind("zfs")                            ERR#2 'No such file or
directory'
28843: kldload("zfs")                            = 9 (0x9)
28843: openat(AT_FDCWD,"/dev/zfs",O_RDWR|O_EXCL|O_CLOEXEC,00) = 3 (0x3)
28843: openat(AT_FDCWD,"/dev/zfs",O_RDWR|O_CLOEXEC,00) = 4 (0x4)
28843:
__sysctlbyname("vfs.zfs.version.ioctl",21,0x3316601c8b3c,0x3316601c8b40,0x0,0)
= 0 (0x0)
28843: ioctl(3,0xc0185a04 { IORW 0x5a('Z'), 4, 24 },0x3316601c8b40) = 0 (0x0)
28843: write(2,"no pools available\n",19)        = 19 (0x13)
28843: ioctl(3,0xc0185a3f { IORW 0x5a('Z'), 63, 24 },0x3316601c8f50) ERR#1
'Operation not permitted'
28843: close(3)                                  = 0 (0x0)
28843: close(4)                                  = 0 (0x0)
28843: _exit(0x0)                               
28843: process exit, rval = 0


By contrast when zfs.ko has been renamed to not be found:

# tail -14 ~/zpool_list_truss_output-no-zfs_ko.log
28997: mmap(0x0,54560,PROT_READ,MAP_PRIVATE,3,0x0) = 94191666626560
(0x55aab4d48000)
28997: close(3)                                  = 0 (0x0)
28997: munmap(0x55aab4d48000,54560)              = 0 (0x0)
28997: modfind("zfs")                            ERR#2 'No such file or
directory'
28997: kldload("zfs")                            ERR#2 'No such file or
directory'
28997: modfind("zfs")                            ERR#2 'No such file or
directory'
28997: issetugid()                               = 0 (0x0)
28997: fstatat(AT_FDCWD,"/usr/share/nls/C.UTF-8/libc.cat",0x55aaa8c0bec0,0x0)
ERR#2 'No such file or directory'
28997: fstatat(AT_FDCWD,"/usr/share/nls/libc/C.UTF-8",0x55aaa8c0bec0,0x0) ERR#2
'No such file or directory'
28997:
fstatat(AT_FDCWD,"/usr/local/share/nls/C.UTF-8/libc.cat",0x55aaa8c0bec0,0x0)
ERR#2 'No such file or directory'
28997: fstatat(AT_FDCWD,"/usr/local/share/nls/libc/C.UTF-8",0x55aaa8c0bec0,0x0)
ERR#2 'No such file or directory'
28997: write(2,"Failed to load zfs module: No su"...,53) = 53 (0x35)
28997: _exit(0x1)                               
28997: process exit, rval = 1

# tail -14 ~/zpool_status_truss_output-no-zfs_ko.log
29014: mmap(0x0,54560,PROT_READ,MAP_PRIVATE,3,0x0) = 58922469687296
(0x3596f4e00000)
29014: close(3)                                  = 0 (0x0)
29014: munmap(0x3596f4e00000,54560)              = 0 (0x0)
29014: modfind("zfs")                            ERR#2 'No such file or
directory'
29014: kldload("zfs")                            ERR#2 'No such file or
directory'
29014: modfind("zfs")                            ERR#2 'No such file or
directory'
29014: issetugid()                               = 0 (0x0)
29014: fstatat(AT_FDCWD,"/usr/share/nls/C.UTF-8/libc.cat",0x3596e85078b0,0x0)
ERR#2 'No such file or directory'
29014: fstatat(AT_FDCWD,"/usr/share/nls/libc/C.UTF-8",0x3596e85078b0,0x0) ERR#2
'No such file or directory'
29014:
fstatat(AT_FDCWD,"/usr/local/share/nls/C.UTF-8/libc.cat",0x3596e85078b0,0x0)
ERR#2 'No such file or directory'
29014: fstatat(AT_FDCWD,"/usr/local/share/nls/libc/C.UTF-8",0x3596e85078b0,0x0)
ERR#2 'No such file or directory'
29014: write(2,"Failed to load zfs module: No su"...,53) = 53 (0x35)
29014: _exit(0x1)                               
29014: process exit, rval = 1

-- 
You are receiving this mail because:
You are the assignee for the bug.