On Wed, Jul 29, 2026 at 06:20:17PM +0000, Shawn Webb wrote: > On Tue, Jul 28, 2026 at 07:57:50PM +0000, Poul-Henning Kamp wrote: > > I have been pondering this ticket for a couple of years: > > > > https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=277228 > > > > The short version of the story is that: > > > > crw-r----- 1 root operator 0xa Jul 28 15:47 /dev/geom.ctl > > > > allows anybody in the operator group to issue ioctls, which, for > > instance, can nuke all partitioning from a disk. > > > > Kyle, Warner and I agree that: > > > > crw-r----- 1 root wheel 0xa Jul 28 15:47 /dev/geom.ctl > > > > Would make more sense, but we have no idea if, or to what extent, > > anything depends on operator issuing geom ioctls. > > > > The plan, such as it is, is to make that change in current to find out. > > > > Before I do that, I want to give any interested parties a chance to > > sandbox it for themselves, all you have to do edit geom_ctl.c > > and change: > > > > void > > g_ctl_init(void) > > { > > > > make_dev_credf(MAKEDEV_ETERNAL, &g_ctl_cdevsw, 0, NULL, > > UID_ROOT, GID_OPERATOR, 0640, PATH_GEOM_CTL); > > } > > > > To GID_WHEEL instead. > > > > If I receive no emails indicating disasters, I will make the change in > > current in a couple of weeks, and wait for fireworks. > > I would be happy to test out not only GID_WHEEL, but also 0600. If you > want a wider testing audience, I can commit the change and have > HardenedBSD users help test. > > I noticed FreeBSD just pushed some security advisory fixes, so I might > make the change on HardenedBSD's side regardless and include it in the > next build I'll do after I address those fixes downstream.
Change committed and pushed[1] and will included in the next build I publish over the weekend. [1]: https://radicle.network/nodes/rad.hardenedbsd.org/src/commits/40e739dfc16a38af0346865a5f6253b7e7974a50 Thanks, -- Shawn Webb Cofounder / Security Engineer HardenedBSD Signal Username: shawn_webb.74 Tor-ified Signal: +1 (719) 756-1197 / activist_opsec.27 https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/raw/master/Shawn_Webb/03A4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc
signature.asc
Description: PGP signature
