[Bug 296554] pfctl no longer can open /dev/pf in read only mode

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296554

            Bug ID: 296554
           Summary: pfctl no longer can open /dev/pf in read only mode
           Product: Base System
           Version: 15.1-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: bin
          Assignee: bugs@FreeBSD.org
          Reporter: pirzyk@FreeBSD.org

After an upgrade from FreeBSD 14.4-RELEASE-p7 to 15.1-RELEASE-p1 I found that
the command:

pfctl -T show -t f2b

no longer works as a member of the network group.  I have tweaked the device
/dev/pf permission to be 640 root:network and the user running it is in the
network group.

ktrace shows that the device is being opened RDONLY mode in 14.4 and RDWR mode
in 15.1

14.4:

 64017 pfctl    CALL  openat(AT_FDCWD,0x1d14f5962104,0<O_RDONLY>)
 64017 pfctl    NAMI  "/dev/pf"

15.1:

  8223 pfctl    CALL  openat(AT_FDCWD,0x52808cc779e,0x2<O_RDWR>)
  8223 pfctl    NAMI  "/dev/pf"

There is code in pfctl to determine what commands are being run and use the
RDONLY when applicable:

        if (tblcmdopt != NULL) {
                argc -= optind;
                argv += optind;
                ch = *tblcmdopt;
                if (ch == 'l') {
                        loadopt |= PFCTL_FLAG_TABLE;
                        tblcmdopt = NULL;
                } else
                        mode = strchr("st", ch) ? O_RDONLY : O_RDWR;

This mode variable is being ignore by pfctl_open() call:

        pfh = pfctl_open(pf_device);
        if (pfh == NULL)
                err(1, "Failed to open netlink");

and I believe this is due to the conversion to netlink and is the same root
cause as Bug 294871

I thought it was useful to show another case where moving to netlink has broken
existing functionality.

-- 
You are receiving this mail because:
You are the assignee for the bug.