[Bug 295485] need a way to block zfs.ko from being autoloaded by tools like puppet and facter (FatGID Vuln / CVE-2026-45250)

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295485

--- Comment #33 from Dan Mahoney <[email protected]> ---
Here's the actual point in the code where they are called:

https://github.com/puppetlabs/facter/blob/main/lib/facter/resolvers/zfs.rb
https://github.com/puppetlabs/facter/blob/main/lib/facter/resolvers/zpool.rb

There are several other calling routines that invoke those resolvers (to
populate the facts arrays) at:

https://github.com/puppetlabs/facter/blob/main/lib/facter/facts/freebsd/zfs_version.rb
https://github.com/puppetlabs/facter/blob/main/lib/facter/facts/freebsd/zfs_featurenumbers.rb
https://github.com/puppetlabs/facter/blob/main/lib/facter/facts/freebsd/zpool_version.rb
https://github.com/puppetlabs/facter/blob/main/lib/facter/facts/freebsd/zpool_featurenumbers.rb
https://github.com/puppetlabs/facter/blob/main/lib/facter/facts/freebsd/zpool_featureflags.rb

I had bad initial information, I apologize.  The net result is the same: these
two commands are informational-only, and shouldn't autoload things.  You're not
going to be upgrading zfs pools on a system where you can't even see them.

-Dan

-- 
You are receiving this mail because:
You are the assignee for the bug.