{"action":"created","issue":{"url":"https://api.github.com/repos/zfsonlinux/zfs/issues/4100","labels_url":"https://api.github.com/repos/zfsonlinux/zfs/issues/4100/labels{/name}","comments_url":"https://api.github.com/repos/zfsonlinux/zfs/issues/4100/comments","events_url":"https://api.github.com/repos/zfsonlinux/zfs/issues/4100/events","html_url":"https://github.com/zfsonlinux/zfs/issues/4100","id":122030531,"number":4100,"title":"Security issue: /dev/zfs has mode 0666 when 60-fprint-autosuspend.rules is installed","user":{"login":"ilovezfs","id":5268928,"avatar_url":"https://avatars.githubusercontent.com/u/5268928?v=3","gravatar_id":"","url":"https://api.github.com/users/ilovezfs","html_url":"https://github.com/ilovezfs","followers_url":"https://api.github.com/users/ilovezfs/followers","following_url":"https://api.github.com/users/ilovezfs/following{/other_user}","gists_url":"https://api.github.com/users/ilovezfs/gists{/gist_id}","starred_url":"https://api.github.com/users/ilovezfs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ilovezfs/subscriptions","organizations_url":"https://api.github.com/users/ilovezfs/orgs","repos_url":"https://api.github.com/users/ilovezfs/repos","events_url":"https://api.github.com/users/ilovezfs/events{/privacy}","received_events_url":"https://api.github.com/users/ilovezfs/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-12-14T12:10:59Z","updated_at":"2015-12-17T14:33:33Z","closed_at":null,"body":"The udev rule 60-fprint-autosuspend.rules causes /dev/zfs, among other devices, to have the mode 0666 instead of whatever mode they would otherwise have, which in /dev/zfs's case is 0600:\r\nhttps://gist.github.com/ilovezfs/2854a6d59ee6b2ae7e6b#file-dev-with-and-without-fprint-txt\r\n\r\nThis causes security issues such as the ability for unprivileged users to create zfs datasets. \r\n\r\nIs there some change that can be made to ZoL to prevent it from getting ensnared by this bug, rather than waiting for a libfprint upstream fix?\r\n\r\nhttps://gist.github.com/ilovezfs/f232703e70b610aa6ae7#file-60-fprint-autosuspend-rules\r\nhttp://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint\r\nhttp://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/fprint-list-udev-rules.c"},"comment":{"url":"https://api.github.com/repos/zfsonlinux/zfs/issues/comments/165466823","html_url":"https://github.com/zfsonlinux/zfs/issues/4100#issuecomment-165466823","issue_url":"https://api.github.com/repos/zfsonlinux/zfs/issues/4100","id":165466823,"user":{"login":"ryao","id":1386373,"avatar_url":"https://avatars.githubusercontent.com/u/1386373?v=3","gravatar_id":"","url":"https://api.github.com/users/ryao","html_url":"https://github.com/ryao","followers_url":"https://api.github.com/users/ryao/followers","following_url":"https://api.github.com/users/ryao/following{/other_user}","gists_url":"https://api.github.com/users/ryao/gists{/gist_id}","starred_url":"https://api.github.com/users/ryao/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ryao/subscriptions","organizations_url":"https://api.github.com/users/ryao/orgs","repos_url":"https://api.github.com/users/ryao/repos","events_url":"https://api.github.com/users/ryao/events{/privacy}","received_events_url":"https://api.github.com/users/ryao/received_events","type":"User","site_admin":false},"created_at":"2015-12-17T14:33:32Z","updated_at":"2015-12-17T14:33:32Z","body":"@behlendorf That is why it would be customizable as a module parameter."}}