Description Jim Pirzyk 2026-07-06 15:15:03 UTC

After an upgrade from FreeBSD 14.4-RELEASE-p7 to 15.1-RELEASE-p1 I found that the command:

pfctl -T show -t f2b

no longer works as a member of the network group.  I have tweaked the device /dev/pf permission to be 640 root:network and the user running it is in the network group.

ktrace shows that the device is being opened RDONLY mode in 14.4 and RDWR mode in 15.1

14.4:

 64017 pfctl    CALL  openat(AT_FDCWD,0x1d14f5962104,0<O_RDONLY>)
 64017 pfctl    NAMI  "/dev/pf"

15.1:

  8223 pfctl    CALL  openat(AT_FDCWD,0x52808cc779e,0x2<O_RDWR>)
  8223 pfctl    NAMI  "/dev/pf"

There is code in pfctl to determine what commands are being run and use the RDONLY when applicable:

        if (tblcmdopt != NULL) {
                argc -= optind;
                argv += optind;
                ch = *tblcmdopt;
                if (ch == 'l') {
                        loadopt |= PFCTL_FLAG_TABLE;
                        tblcmdopt = NULL;
                } else
                        mode = strchr("st", ch) ? O_RDONLY : O_RDWR;

This mode variable is being ignore by pfctl_open() call:

        pfh = pfctl_open(pf_device);
        if (pfh == NULL)
                err(1, "Failed to open netlink");

and I believe this is due to the conversion to netlink and is the same root cause as Bug 294871

I thought it was useful to show another case where moving to netlink has broken existing functionality.