[Bug 295485] need a way to block zfs.ko from being autoloaded by tools like puppet and facter (FatGID Vuln / CVE-2026-45250)

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295485

--- Comment #36 from Mark Millard <[email protected]> ---
(In reply to Allan Jude from comment #35)

Yep.

The upstream change that was proposed is limited to avoiding
the load just for the 2 commands ( zpool upgrade -v and
zfs upgrade -v ), with zpool upgrade -v being avoided for
the FreeBSD context only. You can see how there. (It is not
my code and was not an idea of mine.)

As far as upstream goes, my impression is that such might be
a narrow/limited enough context to get an upstream consensus
to adopt the change. My impression for spanning more (such
as the commands that were originally thought to be involved),
is such does not seem as likely to be adopted upstream.

I've little clue about how much the FreeBSD folks are willing
to maintain as different than the openzfs upstream.

I doubt my background being sufficient to judge generalization
beyond the (correctly understood) original problem context.
That is one of the reasons I was glad when the actual commands
for the original requesting became known with verification in
the source code involved.

I do not see the upstream proposal as technically preventing
a generalization as well.

-- 
You are receiving this mail because:
You are the assignee for the bug.