On Tue, Jul 28, 2026 at 07:57:50PM +0000, Poul-Henning Kamp wrote: > I have been pondering this ticket for a couple of years: > > https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=277228 > > The short version of the story is that: > > crw-r----- 1 root operator 0xa Jul 28 15:47 /dev/geom.ctl > > allows anybody in the operator group to issue ioctls, which, for > instance, can nuke all partitioning from a disk. > > Kyle, Warner and I agree that: > > crw-r----- 1 root wheel 0xa Jul 28 15:47 /dev/geom.ctl > > Would make more sense, but we have no idea if, or to what extent, > anything depends on operator issuing geom ioctls. > > The plan, such as it is, is to make that change in current to find out. > > Before I do that, I want to give any interested parties a chance to > sandbox it for themselves, all you have to do edit geom_ctl.c > and change: > > void > g_ctl_init(void) > { > > make_dev_credf(MAKEDEV_ETERNAL, &g_ctl_cdevsw, 0, NULL, > UID_ROOT, GID_OPERATOR, 0640, PATH_GEOM_CTL); > } > > To GID_WHEEL instead. > > If I receive no emails indicating disasters, I will make the change in > current in a couple of weeks, and wait for fireworks.
I would be happy to test out not only GID_WHEEL, but also 0600. If you want a wider testing audience, I can commit the change and have HardenedBSD users help test. I noticed FreeBSD just pushed some security advisory fixes, so I might make the change on HardenedBSD's side regardless and include it in the next build I'll do after I address those fixes downstream. > That way lies GID_BIKESHED. I don't have any strong feelings on what it should be if it changes, but GID_WHEEL does seem logical to me. Though, if the permissions are changed to 0600, the GID doesn't really matter. I wonder if there are accounts that are members of operator but not wheel. Server accounts get added to the wheel group. So changing it to GID_WHEEL without including the permissions change opens up the same issue to server accounts (huge caveat: on my servers, though I suspect plenty of others are in the same boat.) > > We also have devfs(8) and devd(8) now. > > Given that the vast majory of all FreeBSD systems are single user, > or more likely "no-user", how many of them actually have any users > in the "operator" group, besides "root" ? The main account on pretty much all my laptops is a member of the operator group. Mainly just so I don't have to type my password when I want to shutdown from a terminal. Server accounts do not get the same treatment, just laptop accounts. Thanks, -- Shawn Webb Cofounder / Security Engineer HardenedBSD Signal Username: shawn_webb.74 Tor-ified Signal: +1 (719) 756-1197 / activist_opsec.27 https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/raw/master/Shawn_Webb/03A4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc
signature.asc
Description: PGP signature
