[Bug 295485] need a way to block zfs.ko from being autoloaded by tools like puppet and facter (FatGID Vuln / CVE-2026-45250)

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295485

--- Comment #30 from Mark Millard <[email protected]> ---
FYI:

Dan provided example information that is apparently saved
from zfs/zpool and it is not a match to having been extracted
from "zpool status" or "zfs list". More like: "zpool get all"
for some sample imported pool. Possibly for: an internal zfs
image that is used via mdconfig or the like. (The information
from Dan was provided upstream.)

I'd say that until someone tracks down the actual way(s)
in which puppet/Facter causes zfs.ko to load in detail,
nothing should be done. If even one command involved is one
that obviously requires zfs.ko to be loaded, there is
nothing to do other than to possibly change puppet/Facter
to change the requirements.

Note: The above is without having tracked anything down. If
the information Dan referenced from the files he referenced
was not actually live data, the above could be wrong. This
is more reason to have first actually tracked down the
actual zfs/zpool command usage or the like that would lead
to zfs.ko being loaded.

-- 
You are receiving this mail because:
You are the assignee for the bug.