Re: Operator, Information, give me geom.ctl on the line

On Wed, Jul 29, 2026 at 06:20:17PM +0000, Shawn Webb wrote:
> On Tue, Jul 28, 2026 at 07:57:50PM +0000, Poul-Henning Kamp wrote:
> > I have been pondering this ticket for a couple of years:
> > 
> > https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=277228
> > 
> > The short version of the story is that:
> > 
> > 	crw-r-----  1 root operator 0xa Jul 28 15:47 /dev/geom.ctl
> > 
> > allows anybody in the operator group to issue ioctls, which, for
> > instance, can nuke all partitioning from a disk.
> > 
> > Kyle, Warner and I agree that:
> > 
> > 	crw-r-----  1 root wheel 0xa Jul 28 15:47 /dev/geom.ctl
> > 
> > Would make more sense, but we have no idea if, or to what extent,
> > anything depends on operator issuing geom ioctls.
> > 
> > The plan, such as it is, is to make that change in current to find out.
> > 
> > Before I do that, I want to give any interested parties a chance to
> > sandbox it for themselves, all you have to do edit geom_ctl.c
> > and change:
> > 
> > 	void
> > 	g_ctl_init(void)
> > 	{
> > 
> > 		make_dev_credf(MAKEDEV_ETERNAL, &g_ctl_cdevsw, 0, NULL,
> > 		    UID_ROOT, GID_OPERATOR, 0640, PATH_GEOM_CTL);
> > 	}
> > 
> > To GID_WHEEL instead.
> > 
> > If I receive no emails indicating disasters, I will make the change in
> > current in a couple of weeks, and wait for fireworks.
> 
> I would be happy to test out not only GID_WHEEL, but also 0600. If you
> want a wider testing audience, I can commit the change and have
> HardenedBSD users help test.
> 
> I noticed FreeBSD just pushed some security advisory fixes, so I might
> make the change on HardenedBSD's side regardless and include it in the
> next build I'll do after I address those fixes downstream.

Change committed and pushed[1] and will included in the next build I
publish over the weekend.

[1]: https://radicle.network/nodes/rad.hardenedbsd.org/src/commits/40e739dfc16a38af0346865a5f6253b7e7974a50

Thanks,

-- 
Shawn Webb
Cofounder / Security Engineer
HardenedBSD

Signal Username:  shawn_webb.74
Tor-ified Signal: +1 (719) 756-1197 / activist_opsec.27
https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/raw/master/Shawn_Webb/03A4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc