From patchwork Sun Mar 5 22:00:04 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Vegard Nossum X-Patchwork-Id: 64359 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp1549827wrd; Sun, 5 Mar 2023 14:08:55 -0800 (PST) X-Google-Smtp-Source: AK7set8EaSpOmvQ+zfmiIWRyBH/IxAesjJYYYYYmj9wHYj6DYePrTZSOaRr/J2TiW5Ncx4SWahVE X-Received: by 2002:a05:6a20:69a3:b0:cd:49a4:305d with SMTP id t35-20020a056a2069a300b000cd49a4305dmr15804173pzk.11.1678054134753; Sun, 05 Mar 2023 14:08:54 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1678054134; cv=none; d=google.com; s=arc-20160816; b=upFd6RtwMfQ36JFVp7PmrLln3Im63CcGTW5GsP2XsYwbBS+H9dbj8tvH/KkYowDJPp JEjWYgjA23869yut2GmPbBEZs1zI2EbOlsSS3O33tZxXmZF44f9KEdLUoX45nN5pQ3uX LG/vyaYhaY/saapo0zMlCXWtRoK8WkAXD9F6ZbV7K/wRnjB4X1zbcyMNALwcKPOF2dzK FxyZBjNYZIE/8pMAcngUEbbAd0qwivqI+RwMITHg7Cjgydg2YtYafOp9Rgl2ljPONMgq b7fKQm5fP6rZe0gEMWq2k+jvHBx3+DWeRI4ycGLXhcuHWu1Jsr2WAExnkdDhlZPoAk10 9uHA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=bjWeEMifOcD55Rxlec89GpiaL0XwVoZZhbZxR7kTiHY=; b=mf82doakBaphjs5jG9SJs+g/Fe6RhAk0phWenjSoCoPgkbRFyW5ik9a3tYc3B4ko5a Alv2dMdtmfVBAATz2CWsTXvebLMj2PV1HpPZqDdMOoWm8izeEWwtCTdpmBD896PV4kM2 sjMV8ZfPC9f4EVsr4yaIg/AKxxtsxt0GDbfjsYwkdA7bILLHlFBIP2L1Jx6JAsTW6tH6 8QUXJo4GdPeqIJo67GYX8LiB7rAUYHmgSTdDUlYzx3Kde4dttqwlPb6oQO+aoGtbuOhb Mtjiu/c598VVcj5+QPrXH7KBhd2Xr2zdtvQ6+4OvKnoHKp88NiQW8Wv71L1chdIW5t3s YOSw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@oracle.com header.s=corp-2022-7-12 header.b=lrOk9QqK; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=oracle.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id e14-20020a63e00e000000b0050308edbd50si3651253pgh.453.2023.03.05.14.08.41; Sun, 05 Mar 2023 14:08:54 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@oracle.com header.s=corp-2022-7-12 header.b=lrOk9QqK; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=oracle.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229955AbjCEWCQ (ORCPT + 99 others); Sun, 5 Mar 2023 17:02:16 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58562 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229699AbjCEWCG (ORCPT ); Sun, 5 Mar 2023 17:02:06 -0500 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A74B5166C2; Sun, 5 Mar 2023 14:01:56 -0800 (PST) Received: from pps.filterd (m0246627.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 325JgEhd019526; Sun, 5 Mar 2023 22:00:35 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-type : content-transfer-encoding; s=corp-2022-7-12; bh=bjWeEMifOcD55Rxlec89GpiaL0XwVoZZhbZxR7kTiHY=; b=lrOk9QqK6PIN32ZZSJfCKjMMRAq5NoywosbiGgWoIPiX+r3NHypVKi/pK8G8vM4qD7mX QZT8n90uHgTUlkG2ycmbDYjZlQfJKhGwOQBmRcpdtou7ncr8on54x8RawKBVRxL8is4L 3sEa2cslcQc0jWJkIBZezHKy6xAzG9oD3K0H0SCW9HkM1F33JHYhBV7QrOzOMIzuH2Q/ dNDfRriMvgngQEHQ0ea3OTjNt37H2g4cw3eAK35cQtvgf87lSCTJFR9QvSWTn0+dDybX EC2Dpn15Q/sztBj9y8SgFVWrFAtps9GDhNU/JXyY6lEMoGs/TJipejUdBBcVi5O9vCes Dg== Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.appoci.oracle.com [138.1.114.2]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3p41561rr4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:35 +0000 Received: from pps.filterd (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 325I1ZH0023251; Sun, 5 Mar 2023 22:00:34 GMT Received: from pps.reinject (localhost [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3p4u040m80-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:34 +0000 Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 325M0Nr1013622; Sun, 5 Mar 2023 22:00:33 GMT Received: from t460.home (dhcp-10-175-35-7.vpn.oracle.com [10.175.35.7]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTP id 3p4u040ktj-2; Sun, 05 Mar 2023 22:00:33 +0000 From: Vegard Nossum To: Jonathan Corbet , linux-doc@vger.kernel.org, Jiri Kosina , Solar Designer , Will Deacon , Willy Tarreau Cc: Greg Kroah-Hartman , linux-kernel@vger.kernel.org, Amit Shah , Dave Hansen , David Woodhouse , "Gustavo A. R. Silva" , Kees Cook , Laura Abbott , Linus Torvalds , Mauro Carvalho Chehab , Paolo Bonzini , Peter Zijlstra , Thomas Gleixner , Thorsten Leemhuis , Tyler Hicks , Vegard Nossum , Jiri Kosina , Alex Shi , Yanteng Si , Hu Haowen , Federico Vaga , Tsugikazu Shibata , Minchan Kim , Jeimi Lee , Carlos Bilbao , Akira Yokosawa Subject: [PATCH v3 1/7] Documentation/security-bugs: move from admin-guide/ to process/ Date: Sun, 5 Mar 2023 23:00:04 +0100 Message-Id: <20230305220010.20895-2-vegard.nossum@oracle.com> X-Mailer: git-send-email 2.23.0.718.g5ad94255a8 In-Reply-To: <20230305220010.20895-1-vegard.nossum@oracle.com> References: <20230305220010.20895-1-vegard.nossum@oracle.com> MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-05_12,2023-03-03_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxlogscore=999 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 malwarescore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303050192 X-Proofpoint-GUID: g0x6rYn1b-RDa9pCgqgx6CgD9j-XqeVE X-Proofpoint-ORIG-GUID: g0x6rYn1b-RDa9pCgqgx6CgD9j-XqeVE X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1759567292023454261?= X-GMAIL-MSGID: =?utf-8?q?1759567292023454261?= Jiri Kosina, Jonathan Corbet, and Willy Tarreau all expressed a desire to move this document under process/. Create a new section for security issues in the index and group it with embargoed-hardware-issues. I'm doing this at the start of the series to make all the subsequent changes show up in 'git blame'. Existing references were updated using: git grep -l security-bugs ':!Documentation/translations/' | xargs sed -i 's|admin-guide/security-bugs|process/security-bugs|g' git grep -l security-bugs Documentation/translations/ | xargs sed -i 's|Documentation/admin-guide/security-bugs|Documentation/process/security-bugs|g' git grep -l security-bugs Documentation/translations/ | xargs sed -i '/Original:/s|\.\./admin-guide/security-bugs|\.\./process/security-bugs|g' Notably, the page is not moved in the translations (due to my lack of knowledge of these languages), but the translations have been updated to point to the new location of the original document where these references exist. Link: https://lore.kernel.org/all/nycvar.YFH.7.76.2206062326230.10851@cbobk.fhfr.pm/ Suggested-by: Jiri Kosina Cc: Alex Shi Cc: Yanteng Si Cc: Hu Haowen Cc: Federico Vaga Cc: Tsugikazu Shibata Cc: Minchan Kim Cc: Jeimi Lee Cc: Carlos Bilbao Cc: Akira Yokosawa Signed-off-by: Vegard Nossum Acked-by: Federico Vaga Acked-by: Carlos Bilbao Reviewed-by: Akira Yokosawa Reviewed-by: Yanteng Si --- Documentation/admin-guide/index.rst | 1 - Documentation/admin-guide/reporting-issues.rst | 4 ++-- Documentation/process/howto.rst | 2 +- Documentation/process/index.rst | 9 ++++++++- Documentation/process/researcher-guidelines.rst | 2 +- Documentation/{admin-guide => process}/security-bugs.rst | 0 Documentation/process/stable-kernel-rules.rst | 2 +- Documentation/process/submitting-patches.rst | 2 +- .../translations/it_IT/admin-guide/security-bugs.rst | 2 +- .../translations/it_IT/process/submitting-patches.rst | 2 +- Documentation/translations/ja_JP/howto.rst | 2 +- Documentation/translations/ko_KR/howto.rst | 2 +- Documentation/translations/sp_SP/howto.rst | 2 +- .../translations/sp_SP/process/submitting-patches.rst | 2 +- .../translations/zh_CN/admin-guide/security-bugs.rst | 2 +- Documentation/translations/zh_CN/process/howto.rst | 2 +- .../translations/zh_TW/admin-guide/security-bugs.rst | 2 +- Documentation/translations/zh_TW/process/howto.rst | 2 +- MAINTAINERS | 4 ++-- 19 files changed, 26 insertions(+), 20 deletions(-) rename Documentation/{admin-guide => process}/security-bugs.rst (100%) diff --git a/Documentation/admin-guide/index.rst b/Documentation/admin-guide/index.rst index 0ad7e7ec0d27..09a563bbe3e7 100644 --- a/Documentation/admin-guide/index.rst +++ b/Documentation/admin-guide/index.rst @@ -36,7 +36,6 @@ problems and bugs in particular. reporting-issues reporting-regressions - security-bugs bug-hunting bug-bisect tainted-kernels diff --git a/Documentation/admin-guide/reporting-issues.rst b/Documentation/admin-guide/reporting-issues.rst index ec62151fe672..2fd5a030235a 100644 --- a/Documentation/admin-guide/reporting-issues.rst +++ b/Documentation/admin-guide/reporting-issues.rst @@ -395,7 +395,7 @@ might want to be aware of; it for example explains how to add your issue to the list of tracked regressions, to ensure it won't fall through the cracks. What qualifies as security issue is left to your judgment. Consider reading -Documentation/admin-guide/security-bugs.rst before proceeding, as it +Documentation/process/security-bugs.rst before proceeding, as it provides additional details how to best handle security issues. An issue is a 'really severe problem' when something totally unacceptably bad @@ -1269,7 +1269,7 @@ them when sending the report by mail. If you filed it in a bug tracker, forward the report's text to these addresses; but on top of it put a small note where you mention that you filed it with a link to the ticket. -See Documentation/admin-guide/security-bugs.rst for more information. +See Documentation/process/security-bugs.rst for more information. Duties after the report went out diff --git a/Documentation/process/howto.rst b/Documentation/process/howto.rst index cb6abcb2b6d0..deb8235e20ff 100644 --- a/Documentation/process/howto.rst +++ b/Documentation/process/howto.rst @@ -138,7 +138,7 @@ required reading: philosophy and is very important for people moving to Linux from development on other Operating Systems. - :ref:`Documentation/admin-guide/security-bugs.rst ` + :ref:`Documentation/process/security-bugs.rst ` If you feel you have found a security problem in the Linux kernel, please follow the steps in this document to help notify the kernel developers, and help solve the issue. diff --git a/Documentation/process/index.rst b/Documentation/process/index.rst index d4b6217472b0..565df595152e 100644 --- a/Documentation/process/index.rst +++ b/Documentation/process/index.rst @@ -35,6 +35,14 @@ Below are the essential guides that every developer should read. kernel-enforcement-statement kernel-driver-statement +For security issues, see: + +.. toctree:: + :maxdepth: 1 + + security-bugs + embargoed-hardware-issues + Other guides to the community that are of interest to most developers are: .. toctree:: @@ -47,7 +55,6 @@ Other guides to the community that are of interest to most developers are: submit-checklist kernel-docs deprecated - embargoed-hardware-issues maintainers researcher-guidelines diff --git a/Documentation/process/researcher-guidelines.rst b/Documentation/process/researcher-guidelines.rst index afc944e0e898..9fcfed3c350b 100644 --- a/Documentation/process/researcher-guidelines.rst +++ b/Documentation/process/researcher-guidelines.rst @@ -68,7 +68,7 @@ Before contributing, carefully read the appropriate documentation: * Documentation/process/development-process.rst * Documentation/process/submitting-patches.rst * Documentation/admin-guide/reporting-issues.rst -* Documentation/admin-guide/security-bugs.rst +* Documentation/process/security-bugs.rst Then send a patch (including a commit log with all the details listed below) and follow up on any feedback from other developers. diff --git a/Documentation/admin-guide/security-bugs.rst b/Documentation/process/security-bugs.rst similarity index 100% rename from Documentation/admin-guide/security-bugs.rst rename to Documentation/process/security-bugs.rst diff --git a/Documentation/process/stable-kernel-rules.rst b/Documentation/process/stable-kernel-rules.rst index 2fd8aa593a28..51df1197d5ab 100644 --- a/Documentation/process/stable-kernel-rules.rst +++ b/Documentation/process/stable-kernel-rules.rst @@ -39,7 +39,7 @@ Procedure for submitting patches to the -stable tree Security patches should not be handled (solely) by the -stable review process but should follow the procedures in - :ref:`Documentation/admin-guide/security-bugs.rst `. + :ref:`Documentation/process/security-bugs.rst `. For all other submissions, choose one of the following procedures ----------------------------------------------------------------- diff --git a/Documentation/process/submitting-patches.rst b/Documentation/process/submitting-patches.rst index eac7167dce83..7b223f306efa 100644 --- a/Documentation/process/submitting-patches.rst +++ b/Documentation/process/submitting-patches.rst @@ -254,7 +254,7 @@ If you have a patch that fixes an exploitable security bug, send that patch to security@kernel.org. For severe bugs, a short embargo may be considered to allow distributors to get the patch out to users; in such cases, obviously, the patch should not be sent to any public lists. See also -Documentation/admin-guide/security-bugs.rst. +Documentation/process/security-bugs.rst. Patches that fix a severe bug in a released kernel should be directed toward the stable maintainers by putting a line like this:: diff --git a/Documentation/translations/it_IT/admin-guide/security-bugs.rst b/Documentation/translations/it_IT/admin-guide/security-bugs.rst index 18a5822c7d9a..20994f4bfa31 100644 --- a/Documentation/translations/it_IT/admin-guide/security-bugs.rst +++ b/Documentation/translations/it_IT/admin-guide/security-bugs.rst @@ -1,6 +1,6 @@ .. include:: ../disclaimer-ita.rst -:Original: :ref:`Documentation/admin-guide/security-bugs.rst ` +:Original: :ref:`Documentation/process/security-bugs.rst ` .. _it_securitybugs: diff --git a/Documentation/translations/it_IT/process/submitting-patches.rst b/Documentation/translations/it_IT/process/submitting-patches.rst index c2cfa0948b2b..167fce813032 100644 --- a/Documentation/translations/it_IT/process/submitting-patches.rst +++ b/Documentation/translations/it_IT/process/submitting-patches.rst @@ -272,7 +272,7 @@ embargo potrebbe essere preso in considerazione per dare il tempo alle distribuzioni di prendere la patch e renderla disponibile ai loro utenti; in questo caso, ovviamente, la patch non dovrebbe essere inviata su alcuna lista di discussione pubblica. Leggete anche -Documentation/admin-guide/security-bugs.rst. +Documentation/process/security-bugs.rst. Patch che correggono bachi importanti su un kernel già rilasciato, dovrebbero essere inviate ai manutentori dei kernel stabili aggiungendo la seguente riga:: diff --git a/Documentation/translations/ja_JP/howto.rst b/Documentation/translations/ja_JP/howto.rst index 9b0b3436dfcf..8d856ebe873c 100644 --- a/Documentation/translations/ja_JP/howto.rst +++ b/Documentation/translations/ja_JP/howto.rst @@ -167,7 +167,7 @@ linux-api@vger.kernel.org に送ることを勧めます。 このドキュメントは Linux 開発の思想を理解するのに非常に重要です。 そして、他のOSでの開発者が Linux に移る時にとても重要です。 - :ref:`Documentation/admin-guide/security-bugs.rst ` + :ref:`Documentation/process/security-bugs.rst ` もし Linux カーネルでセキュリティ問題を発見したように思ったら、こ のドキュメントのステップに従ってカーネル開発者に連絡し、問題解決を 支援してください。 diff --git a/Documentation/translations/ko_KR/howto.rst b/Documentation/translations/ko_KR/howto.rst index 969e91a95bb0..34f14899c155 100644 --- a/Documentation/translations/ko_KR/howto.rst +++ b/Documentation/translations/ko_KR/howto.rst @@ -157,7 +157,7 @@ mtk.manpages@gmail.com의 메인테이너에게 보낼 것을 권장한다. 리눅스로 전향하는 사람들에게는 매우 중요하다. - :ref:`Documentation/admin-guide/security-bugs.rst ` + :ref:`Documentation/process/security-bugs.rst ` 여러분들이 리눅스 커널의 보안 문제를 발견했다고 생각한다면 이 문서에 나온 단계에 따라서 커널 개발자들에게 알리고 그 문제를 해결할 수 있도록 도와 달라. diff --git a/Documentation/translations/sp_SP/howto.rst b/Documentation/translations/sp_SP/howto.rst index f9818d687b54..f1629738b49d 100644 --- a/Documentation/translations/sp_SP/howto.rst +++ b/Documentation/translations/sp_SP/howto.rst @@ -135,7 +135,7 @@ de obligada lectura: de Linux y es muy importante para las personas que se mudan a Linux tras desarrollar otros sistemas operativos. - :ref:`Documentation/admin-guide/security-bugs.rst ` + :ref:`Documentation/process/security-bugs.rst ` Si cree que ha encontrado un problema de seguridad en el kernel de Linux, siga los pasos de este documento para ayudar a notificar a los desarrolladores del kernel y ayudar a resolver el problema. diff --git a/Documentation/translations/sp_SP/process/submitting-patches.rst b/Documentation/translations/sp_SP/process/submitting-patches.rst index bf95ceb5e865..c2757d9ab216 100644 --- a/Documentation/translations/sp_SP/process/submitting-patches.rst +++ b/Documentation/translations/sp_SP/process/submitting-patches.rst @@ -276,7 +276,7 @@ parche a security@kernel.org. Para errores graves, se debe mantener un poco de discreción y permitir que los distribuidores entreguen el parche a los usuarios; en esos casos, obviamente, el parche no debe enviarse a ninguna lista pública. Revise también -Documentation/admin-guide/security-bugs.rst. +Documentation/process/security-bugs.rst. Los parches que corrigen un error grave en un kernel en uso deben dirigirse hacia los maintainers estables poniendo una línea como esta:: diff --git a/Documentation/translations/zh_CN/admin-guide/security-bugs.rst b/Documentation/translations/zh_CN/admin-guide/security-bugs.rst index b8120391755d..d6b8f8a4e7f6 100644 --- a/Documentation/translations/zh_CN/admin-guide/security-bugs.rst +++ b/Documentation/translations/zh_CN/admin-guide/security-bugs.rst @@ -1,6 +1,6 @@ .. include:: ../disclaimer-zh_CN.rst -:Original: :doc:`../../../admin-guide/security-bugs` +:Original: :doc:`../../../process/security-bugs` :译者: diff --git a/Documentation/translations/zh_CN/process/howto.rst b/Documentation/translations/zh_CN/process/howto.rst index 10254751df6a..cc47be356dd3 100644 --- a/Documentation/translations/zh_CN/process/howto.rst +++ b/Documentation/translations/zh_CN/process/howto.rst @@ -125,7 +125,7 @@ Linux内核代码中包含有大量的文档。这些文档对于学习如何与 这篇文档对于理解Linux的开发哲学至关重要。对于将开发平台从其他操作系 统转移到Linux的人来说也很重要。 - :ref:`Documentation/admin-guide/security-bugs.rst ` + :ref:`Documentation/process/security-bugs.rst ` 如果你认为自己发现了Linux内核的安全性问题，请根据这篇文档中的步骤来 提醒其他内核开发者并帮助解决这个问题。 diff --git a/Documentation/translations/zh_TW/admin-guide/security-bugs.rst b/Documentation/translations/zh_TW/admin-guide/security-bugs.rst index eed260ef0c37..15f8e9005071 100644 --- a/Documentation/translations/zh_TW/admin-guide/security-bugs.rst +++ b/Documentation/translations/zh_TW/admin-guide/security-bugs.rst @@ -2,7 +2,7 @@ .. include:: ../disclaimer-zh_TW.rst -:Original: :doc:`../../../admin-guide/security-bugs` +:Original: :doc:`../../../process/security-bugs` :譯者: diff --git a/Documentation/translations/zh_TW/process/howto.rst b/Documentation/translations/zh_TW/process/howto.rst index 8fb8edcaee66..ea2f468d3e58 100644 --- a/Documentation/translations/zh_TW/process/howto.rst +++ b/Documentation/translations/zh_TW/process/howto.rst @@ -128,7 +128,7 @@ Linux內核代碼中包含有大量的文檔。這些文檔對於學習如何與 這篇文檔對於理解Linux的開發哲學至關重要。對於將開發平台從其他操作系 統轉移到Linux的人來說也很重要。 - :ref:`Documentation/admin-guide/security-bugs.rst ` + :ref:`Documentation/process/security-bugs.rst ` 如果你認爲自己發現了Linux內核的安全性問題，請根據這篇文檔中的步驟來 提醒其他內核開發者並幫助解決這個問題。 diff --git a/MAINTAINERS b/MAINTAINERS index b0db911207ba..ed84d41353a7 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -73,7 +73,7 @@ Tips for patch submitters and ideally, should come with a patch proposal. Please do not send automated reports to this list either. Such bugs will be handled better and faster in the usual public places. See - Documentation/admin-guide/security-bugs.rst for details. + Documentation/process/security-bugs.rst for details. 8. Happy hacking. @@ -18807,7 +18807,7 @@ F: include/uapi/linux/sed* SECURITY CONTACT M: Security Officers S: Supported -F: Documentation/admin-guide/security-bugs.rst +F: Documentation/process/security-bugs.rst SECURITY SUBSYSTEM M: Paul Moore From patchwork Sun Mar 5 22:00:05 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vegard Nossum X-Patchwork-Id: 64360 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp1550760wrd; Sun, 5 Mar 2023 14:12:01 -0800 (PST) X-Google-Smtp-Source: AK7set8VpFjkswSqO2wPPvnuUsVhX2QY79jhiRXiy37DjrzC2YwkIf1JS0c9hlgzw6tFY+2m50CJ X-Received: by 2002:a05:6402:135a:b0:4c8:2a1d:5086 with SMTP id y26-20020a056402135a00b004c82a1d5086mr8489191edw.8.1678054320866; Sun, 05 Mar 2023 14:12:00 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1678054320; cv=none; d=google.com; s=arc-20160816; b=kR9HuakIv8zJFs3z2iwOxXMg6fFyj77aD2C9Ob0XS/qSZ8mP19MQS9Dt/piW2q5qvC j2ShSTOUMzCv2h7DNgs5gFAiISXnVed1H8kNNTfSZVajFswtgOpy7DsuSPjBKVS+izrW x6/ZghJgNh4pJDK/TbFoa6OTPRWLS8CksJDx0MTvgSMV5qphgvVt5jf26ZpwOlt2SSbQ MHOHt9Qu9zzF/u5O3R6FA1CKXes2iCXF7D/a09qgZ/wBny5OfDQmBwktOI2EVhWuDRUz Rb1addwOTGVFOOl6+soDfAt3ol7QPStqXEbqUg5kqnxRjq3BUVqfEf0XSHw+3ekW+Am5 CQwg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=2m8H1ke5jWQAt4IxFD9cHEaOxnH7XK15MYG59dTVxBA=; b=Oa05GMUopntdPPNd0OSxzqYzneraHPIquK27f4QC1SChNM4TivMA7qlZ5W5kZ605Av xIjwJJsybtXA/53AjSYTqjeC1JMMyUWU5e7H2JQsQ8R1S8HCHVUIug6UpNsc2MMsP+bd c37hxD4KA/Z5sEkQT3BXn8HWw5NmptIdvprcmLTLnYkbkqxkbXxOqHDCS1wX1rVkykO3 9HLGQhPkNQ+NcmwXZRpOVdYc/Vv5iX4vyYgbJP8XSj+nEdGxSG63/MqQMc1/Evs28az3 Rgy698+3C4jfaVAYDVLbd9t8VWriyFCjejVV8Wpk7XUY9k9twKMw5nAXfkrrWUb8mBUd xbTA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@oracle.com header.s=corp-2022-7-12 header.b=lnWapAxQ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=oracle.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id t16-20020a170906179000b008f668e7dc24si5021452eje.244.2023.03.05.14.11.37; Sun, 05 Mar 2023 14:12:00 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@oracle.com header.s=corp-2022-7-12 header.b=lnWapAxQ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=oracle.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229676AbjCEWB6 (ORCPT + 99 others); Sun, 5 Mar 2023 17:01:58 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57976 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229753AbjCEWBo (ORCPT ); Sun, 5 Mar 2023 17:01:44 -0500 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7C89C1025B; Sun, 5 Mar 2023 14:01:43 -0800 (PST) Received: from pps.filterd (m0333521.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 325LvtUB020022; Sun, 5 Mar 2023 22:00:42 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=corp-2022-7-12; bh=2m8H1ke5jWQAt4IxFD9cHEaOxnH7XK15MYG59dTVxBA=; b=lnWapAxQhx6qROlmQNLILRj3Lyaenfxxspvjkim7ogFdWZ2BVpHZ92h6GxENzpnZ7TkT RcrG8EWdtfztZCe8fJFgsP512afTzaUEvQTTXv7lUtqSWjFMY/EG8hwM4ObqeYsvDYDV wVilh1tRS1XFfvSTNefoHeFvbVHLrvibotjS6K4yGF2ElqQ3m1SVG3/n9qx4DwWrjqNQ L51UQh6G/L00tVu7PDywEiU0JQ5rv/gW7jHI0mPwdaXLATz46yVOJ390d6CG/U8u3z+q KOA5wuZQIgnIGKGCHpvCEbWxvzeP48pzjg2AyfrjNEtL+qhQBW1PAv515d9tfEvCoUSH eg== Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.appoci.oracle.com [138.1.114.2]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3p418xss7n-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:41 +0000 Received: from pps.filterd (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 325IAIjd023468; Sun, 5 Mar 2023 22:00:40 GMT Received: from pps.reinject (localhost [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3p4u040mb8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:40 +0000 Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 325M0Nr3013622; Sun, 5 Mar 2023 22:00:40 GMT Received: from t460.home (dhcp-10-175-35-7.vpn.oracle.com [10.175.35.7]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTP id 3p4u040ktj-3; Sun, 05 Mar 2023 22:00:39 +0000 From: Vegard Nossum To: Jonathan Corbet , linux-doc@vger.kernel.org, Jiri Kosina , Solar Designer , Will Deacon , Willy Tarreau Cc: Greg Kroah-Hartman , linux-kernel@vger.kernel.org, Amit Shah , Dave Hansen , David Woodhouse , "Gustavo A. R. Silva" , Kees Cook , Laura Abbott , Linus Torvalds , Mauro Carvalho Chehab , Paolo Bonzini , Peter Zijlstra , Thomas Gleixner , Thorsten Leemhuis , Tyler Hicks , Vegard Nossum Subject: [PATCH v3 2/7] Documentation/security-bugs: misc. improvements Date: Sun, 5 Mar 2023 23:00:05 +0100 Message-Id: <20230305220010.20895-3-vegard.nossum@oracle.com> X-Mailer: git-send-email 2.23.0.718.g5ad94255a8 In-Reply-To: <20230305220010.20895-1-vegard.nossum@oracle.com> References: <20230305220010.20895-1-vegard.nossum@oracle.com> MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-05_12,2023-03-03_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxlogscore=999 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 malwarescore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303050192 X-Proofpoint-GUID: U5MPE3nB2NxnvuXxJgZF8zImAwqkISXj X-Proofpoint-ORIG-GUID: U5MPE3nB2NxnvuXxJgZF8zImAwqkISXj X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1759567487447080480?= X-GMAIL-MSGID: =?utf-8?q?1759567487447080480?= This mostly just clarifies things and moves a few things around in preparation for the subsequent changes. Most notably, pull the "security@kernel.org" address up into the first paragraph as this the most vital piece of information in the whole document. Also fix a few markup issues. Signed-off-by: Vegard Nossum --- Documentation/process/security-bugs.rst | 37 ++++++++++++++----------- 1 file changed, 21 insertions(+), 16 deletions(-) diff --git a/Documentation/process/security-bugs.rst b/Documentation/process/security-bugs.rst index 82e29837d589..f1326d4e9718 100644 --- a/Documentation/process/security-bugs.rst +++ b/Documentation/process/security-bugs.rst @@ -1,36 +1,41 @@ .. _securitybugs: -Security bugs -============= +Reporting security bugs +======================= Linux kernel developers take security very seriously. As such, we'd like to know when a security bug is found so that it can be fixed and disclosed as quickly as possible. Please report security bugs to the -Linux kernel security team. +Linux kernel security team at security@kernel.org, henceforth +"the security list". This is a closed list of trusted developers who +will help verify the bug report and develop a patch in case none was +already proposed. -Contact -------- +While the security list is closed, the security team may bring in extra +help from the relevant maintainers to understand and fix the security +vulnerability. -The Linux kernel security team can be contacted by email at -. This is a private list of security officers -who will help verify the bug report and develop and release a fix. -If you already have a fix, please include it with your report, as -that can speed up the process considerably. It is possible that the -security team will bring in extra help from area maintainers to -understand and fix the security vulnerability. +Note that the main interest of the kernel security list is in getting +bugs fixed and getting patches reviewed, tested, and merged; CVE +assignment, disclosure to distributions, and public disclosure happen on +different lists with different people. + +Contacting the security list +---------------------------- As it is with any bug, the more information provided the easier it will be to diagnose and fix. Please review the procedure outlined in -'Documentation/admin-guide/reporting-issues.rst' if you are unclear about what +Documentation/admin-guide/reporting-issues.rst if you are unclear about what information is helpful. Any exploit code is very helpful and will not be released without consent from the reporter unless it has already been -made public. +made public. Reporters are encouraged to propose patches, participate in the +discussions of a fix, and test patches. Please send plain text emails without attachments where possible. It is much harder to have a context-quoted discussion about a complex issue if all the details are hidden away in attachments. Think of it like a -:doc:`regular patch submission <../process/submitting-patches>` -(even if you don't have a patch yet): describe the problem and impact, list +regular patch submission (see Documentation/process/submitting-patches.rst) +even if you don't have a patch yet; describe the problem and impact, list reproduction steps, and follow it with a proposed fix, all in plain text. Disclosure and embargoed information From patchwork Sun Mar 5 22:00:06 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vegard Nossum X-Patchwork-Id: 64365 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp1551283wrd; Sun, 5 Mar 2023 14:13:42 -0800 (PST) X-Google-Smtp-Source: AK7set9Aey9V5lXypL6/duLpAGvUY02hpd59zzXLkVKldUBF8TeiAfdAms+yCWT7eQnEo+OQegFQ X-Received: by 2002:a50:fb85:0:b0:4ab:4d3c:7e99 with SMTP id e5-20020a50fb85000000b004ab4d3c7e99mr8529382edq.2.1678054421915; Sun, 05 Mar 2023 14:13:41 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1678054421; cv=none; d=google.com; s=arc-20160816; b=lMWbnl4QpIHzNqnbIqlxlXXRK0Mr961OzHwnsb3uT2IH8SppeY3fKeI9QOhya7/xrv yqO5kX9JCrLXuLjRb1xTCzHYDfipb4YkicE4uUk1a1/dIQwfaei9PThVk6iYcQfX2H5p F3uJLseRM3X+foaGrKB4yf/rsVR9OCOcUJJ1OmC7wHbHYelnWgJvNDAag5q7tkCn5Gfq 1EIZHQcjVSus+C+bPOM3i077YfXdDAMNLC7VIqk7nMyBcEiGi+BOXWp/gliyZT+1zt54 3Ekp7foPvcRz24/fi7uqQqUXziiGyTjX7WpMoRb9Zyq2iLLvEY2dhpJQKr1uHtnEw1T6 ceWA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=s5QEM3O9yco3rfSMLPvmSRUwpK8LPcoIhYEXAZCgp2Q=; b=Pw8AgJhpqoMD1Zim2jofFxPoMhdz7TkpTACKLPxVgO7cKMm7cmOKRX1ka38sou4sjk YSOub2FKO5G6xRq7wLdD1VarZtQ5bXuT2idCiuJ8LL5MH0zDACyl9t5WYk1x2fnNupSz hOpDzPswRXYzlMD7cV8PJEiKj6GA9b6YJlA8iU2KPcSgx5VnINkKK5dFYjKYWZ5gCA8d 8ZHtrozpWF1RsZabdpX6ZsFaUccrSMdwU5CbCTsltfjNuqtZ7A8R1K/DC7DZ5c2atb6H mZLdOLS4Ufddts4Ta+n0f4ds6T0iCXboAn1i6EOIDBDGkmLnm3DCXB0a8q7P26BX+UAT bT5A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@oracle.com header.s=corp-2022-7-12 header.b="cB/utHz/"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=oracle.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id qf6-20020a1709077f0600b008b1ce6f5811si10850357ejc.345.2023.03.05.14.13.18; Sun, 05 Mar 2023 14:13:41 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@oracle.com header.s=corp-2022-7-12 header.b="cB/utHz/"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=oracle.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229899AbjCEWBw (ORCPT + 99 others); Sun, 5 Mar 2023 17:01:52 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57966 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229636AbjCEWBn (ORCPT ); Sun, 5 Mar 2023 17:01:43 -0500 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 10BECCDE9; Sun, 5 Mar 2023 14:01:42 -0800 (PST) Received: from pps.filterd (m0246629.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 325LjBdc030101; Sun, 5 Mar 2023 22:00:48 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=corp-2022-7-12; bh=s5QEM3O9yco3rfSMLPvmSRUwpK8LPcoIhYEXAZCgp2Q=; b=cB/utHz/zVlpMJsBcOrRJmkT+ohGekJrNDV5Hl+nGcxETn9+GdYyeq58OnSHdV8X3861 n/XmL8nFQy6UGVABYgYC220JxJ2lJn8vPTbfnm0un6cwWQ1zqU7J2AWpB/Dl262L60Bg +/+bpu0E0pVxhONQjiOpc9aUeYMBhX7EqF8oD4+MkhUqt8SRFFxP5RSBPo2sH4FacT3s VS82tQp0zY8NWMKFegKM2NZh0Q44aXC0FnFCS0OjTBqXjdP3iYcMqGAzKJ6Vsj1FJ+pA iT/JcjRhK+0BjAJommzGAokqTIJdIDXpDcBRQ66q/HXpsAyURxbCsRlm1kYNnGBRjTna Pw== Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.appoci.oracle.com [138.1.114.2]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3p4161srk7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:47 +0000 Received: from pps.filterd (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 325IHbd4024351; Sun, 5 Mar 2023 22:00:47 GMT Received: from pps.reinject (localhost [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3p4u040me5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:47 +0000 Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 325M0Nr5013622; Sun, 5 Mar 2023 22:00:46 GMT Received: from t460.home (dhcp-10-175-35-7.vpn.oracle.com [10.175.35.7]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTP id 3p4u040ktj-4; Sun, 05 Mar 2023 22:00:46 +0000 From: Vegard Nossum To: Jonathan Corbet , linux-doc@vger.kernel.org, Jiri Kosina , Solar Designer , Will Deacon , Willy Tarreau Cc: Greg Kroah-Hartman , linux-kernel@vger.kernel.org, Amit Shah , Dave Hansen , David Woodhouse , "Gustavo A. R. Silva" , Kees Cook , Laura Abbott , Linus Torvalds , Mauro Carvalho Chehab , Paolo Bonzini , Peter Zijlstra , Thomas Gleixner , Thorsten Leemhuis , Tyler Hicks , Vegard Nossum Subject: [PATCH v3 3/7] Documentation/security-bugs: improve security list section Date: Sun, 5 Mar 2023 23:00:06 +0100 Message-Id: <20230305220010.20895-4-vegard.nossum@oracle.com> X-Mailer: git-send-email 2.23.0.718.g5ad94255a8 In-Reply-To: <20230305220010.20895-1-vegard.nossum@oracle.com> References: <20230305220010.20895-1-vegard.nossum@oracle.com> MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-05_12,2023-03-03_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxlogscore=999 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 malwarescore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303050192 X-Proofpoint-GUID: nrEHFdUaOsNn5k35GpBZd05EQv--aiOV X-Proofpoint-ORIG-GUID: nrEHFdUaOsNn5k35GpBZd05EQv--aiOV X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1759567593569925655?= X-GMAIL-MSGID: =?utf-8?q?1759567593569925655?= Make this section about the security list easier to parse by: 1) reordering the content to make more sense, 2) adding "paragraph names" to make it visually easier to find exactly the information that you need for a given step (this will also be applied to the other sections for consistency in subsequent patches), 3) pulling some of the information that is relevant to contacting security@kernel.org specifically into the section about that list. The remaining sections are about CVE assignment, coordinated disclosure, etc., which are things the security list _doesn't_ deal with. (These sections will be expanded and clarified in subsequent patches.) This patch is not meant to introduce any semantic changes, so in case of a dispute the previous version will be authoritative. Link: https://lore.kernel.org/all/20220601031254.GB26318@1wt.eu/ Link: https://lore.kernel.org/all/20220607090726.GB32282@willie-the-truck/ Cc: Willy Tarreau Cc: Will Deacon Signed-off-by: Vegard Nossum --- Documentation/process/security-bugs.rst | 76 ++++++++++++------------- 1 file changed, 35 insertions(+), 41 deletions(-) diff --git a/Documentation/process/security-bugs.rst b/Documentation/process/security-bugs.rst index f1326d4e9718..fb156d146c42 100644 --- a/Documentation/process/security-bugs.rst +++ b/Documentation/process/security-bugs.rst @@ -31,42 +31,42 @@ be released without consent from the reporter unless it has already been made public. Reporters are encouraged to propose patches, participate in the discussions of a fix, and test patches. -Please send plain text emails without attachments where possible. -It is much harder to have a context-quoted discussion about a complex -issue if all the details are hidden away in attachments. Think of it like a -regular patch submission (see Documentation/process/submitting-patches.rst) -even if you don't have a patch yet; describe the problem and impact, list -reproduction steps, and follow it with a proposed fix, all in plain text. +**Disclosure.** Once a robust patch or patchset has been developed, the +release process starts. The security list strongly prefers to have these +posted for review and testing on public mailing lists and merged into the +appropriate public git repository as soon as possible. However, you or an +affected party may request that the patch be withheld for some days; as a +rule, the maximum is 7 calendar days. An exceptional extension to 14 +calendar days is possible if it is agreed that the criticality of the bug +requires more time. The only valid reason for deferring the publication +of a fix is to accomodate the logistics of QA and large scale rollouts +which require release coordination. + +Please note that although a fix is public, there may still be value in +withholding the details of its security relevance and/or how to exploit +it for another while; see below for when and how to properly disclose +the security impact of your findings publicly. + +**List rules.** Please send plain text emails without attachments where +possible. It is much harder to have a context-quoted discussion about a +complex issue if all the details are hidden away in attachments. Think +of it like regular patch submission (see +Documentation/process/submitting-patches.rst) even if you don't have a +patch yet; describe the problem and impact, list reproduction steps, and +follow it with a proposed fix, all in plain text. + +**Confidentiality.** While embargoed information may be shared with +trusted individuals in order to develop a fix, such information will not +be published alongside the fix or on any other disclosure channel +without the permission of the reporter. This includes but is not +limited to the original bug report and followup discussions (if any), +exploits, CVE information or the identity of the reporter. All such +other information submitted to the security list and any follow-up +discussions of the report are treated confidentially even after the +embargo has been lifted, in perpetuity. -Disclosure and embargoed information ------------------------------------- - -The security list is not a disclosure channel. For that, see Coordination -below. - -Once a robust fix has been developed, the release process starts. Fixes -for publicly known bugs are released immediately. - -Although our preference is to release fixes for publicly undisclosed bugs -as soon as they become available, this may be postponed at the request of -the reporter or an affected party for up to 7 calendar days from the start -of the release process, with an exceptional extension to 14 calendar days -if it is agreed that the criticality of the bug requires more time. The -only valid reason for deferring the publication of a fix is to accommodate -the logistics of QA and large scale rollouts which require release -coordination. - -While embargoed information may be shared with trusted individuals in -order to develop a fix, such information will not be published alongside -the fix or on any other disclosure channel without the permission of the -reporter. This includes but is not limited to the original bug report -and followup discussions (if any), exploits, CVE information or the -identity of the reporter. - -In other words our only interest is in getting bugs fixed. All other -information submitted to the security list and any followup discussions -of the report are treated confidentially even after the embargo has been -lifted, in perpetuity. +The Linux kernel security team is not a formal body and therefore unable +to enter any non-disclosure agreements. Coordination ------------ @@ -93,9 +93,3 @@ assigned ahead of public disclosure, they will need to contact the private linux-distros list, described above. When such a CVE identifier is known before a patch is provided, it is desirable to mention it in the commit message if the reporter agrees. - -Non-disclosure agreements -------------------------- - -The Linux kernel security team is not a formal body and therefore unable -to enter any non-disclosure agreements. From patchwork Sun Mar 5 22:00:07 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vegard Nossum X-Patchwork-Id: 64357 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp1548777wrd; Sun, 5 Mar 2023 14:05:13 -0800 (PST) X-Google-Smtp-Source: AK7set8M2mWh714RyPBwvk5N7w5ZKccU1h+T+mkeRhmaJbHtnwGnKLUbZckmPr6wVcJK+PljTmYq X-Received: by 2002:a17:90b:3a84:b0:237:161e:33bc with SMTP id om4-20020a17090b3a8400b00237161e33bcmr9242451pjb.16.1678053913411; Sun, 05 Mar 2023 14:05:13 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1678053913; cv=none; d=google.com; s=arc-20160816; b=xrxouNFfNu/YMnpzZvG90He4WecsVkguGcQLXInhXUAPlzP1F5NeZoY3qVlXyxkwFn lB+xdeFYNRgT9Zav2YkBZO4INXH8tzk4THz2PFjcbRq2YbZKufWMUC2XXZa8PuDdmUQ7 K0OejVVTQxo/HrGkMizMCx8ZccXOCLmzG+1G7KfFoww8coBN/3dWbNWR9eVNI3iOHCBP NhP5iSi1ikpjhgIgKKsFaMSnWIQ4Gz/3u8xs+oiv7/4ork07Y/dlEpxNdXwRHehtJ3qK Jx71JfzUy1o8xdVElIU80ZqjewUiHZmqVP2N2HZAozkMiWM+pzSnglG2WFbnf9MM2WE/ Al0g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=3x2IB5WMGDPKO44R1fstih3EObkOoy7v9hScUddrClo=; b=m3N/3yStHGb1sePC4V/uOfsgPXfidM/eAGbJ7y+qVqkb3LBMhjV2UyAFDBtkf8csrt PjhoI1VFOV8XMLOlcpdqeCNosBQ3DStAjnNgvNpaqyWNYGV1k68Rf89wIJOS9ipD8KcU aniu2ybPCXRQoTgXVenykkpP4XlGQvweS9CH0kthIDTRdKhBMO/Tclwy7JYjpYNmIEKM QFqA4IIpEeViifaXfJqJdw1FCvdshsqMxJUag38SwTJZ8/4ziskQfXsbEgzZHXx09XQ+ +Eld0T8tlU3FFRJtxlNf/oDH/BCvJcp0ez2pMLmWg62AgCRscSXEzj4trircuDg2R0Gb 7t8w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@oracle.com header.s=corp-2022-7-12 header.b=lGQ4t8w0; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=oracle.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id s1-20020a17090a764100b0023493354f31si11565223pjl.119.2023.03.05.14.04.58; Sun, 05 Mar 2023 14:05:13 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@oracle.com header.s=corp-2022-7-12 header.b=lGQ4t8w0; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=oracle.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229960AbjCEWCX (ORCPT + 99 others); Sun, 5 Mar 2023 17:02:23 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58650 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229932AbjCEWCH (ORCPT ); Sun, 5 Mar 2023 17:02:07 -0500 Received: from mx0b-00069f02.pphosted.com (mx0b-00069f02.pphosted.com [205.220.177.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6291D199D8; Sun, 5 Mar 2023 14:01:58 -0800 (PST) Received: from pps.filterd (m0246632.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 325LvTMH004167; Sun, 5 Mar 2023 22:00:54 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=corp-2022-7-12; bh=3x2IB5WMGDPKO44R1fstih3EObkOoy7v9hScUddrClo=; b=lGQ4t8w0S/jxZuyK9DHUQGBV0K+JKgoJ6hbXwpxQ77A4neO8YFrByUK8fd62dQYgnyw4 4j6HDXyhZhOV9bTlIn3qLFDhSAB/dfJUZSGCtm0+juKdO/MbSDNWGgpnNd1+HoHF9CqH MYi4gVFH1X+YJvhYWF9CL3ekaPSa14VCNgpuFFoF2jeEAQ3iUFMNPPiUtbpxOtxSDwgt Yxmu+6yq94sRdjZewBsGLs1Cb9Tnp55+gS65EI0btySSzkgSPnH6VF2hfS1nZXKaSpM2 NuT+LU9guDBo9bnt/991cTuLqQNW5lYTZQ0MqmkqCmD6/LSa1iKuu/PQUs75jSzDziXd 8w== Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.appoci.oracle.com [138.1.114.2]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3p417c9rjf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:53 +0000 Received: from pps.filterd (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 325IAIji023468; Sun, 5 Mar 2023 22:00:52 GMT Received: from pps.reinject (localhost [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3p4u040mgh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:52 +0000 Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 325M0Nr7013622; Sun, 5 Mar 2023 22:00:51 GMT Received: from t460.home (dhcp-10-175-35-7.vpn.oracle.com [10.175.35.7]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTP id 3p4u040ktj-5; Sun, 05 Mar 2023 22:00:51 +0000 From: Vegard Nossum To: Jonathan Corbet , linux-doc@vger.kernel.org, Jiri Kosina , Solar Designer , Will Deacon , Willy Tarreau Cc: Greg Kroah-Hartman , linux-kernel@vger.kernel.org, Amit Shah , Dave Hansen , David Woodhouse , "Gustavo A. R. Silva" , Kees Cook , Laura Abbott , Linus Torvalds , Mauro Carvalho Chehab , Paolo Bonzini , Peter Zijlstra , Thomas Gleixner , Thorsten Leemhuis , Tyler Hicks , Vegard Nossum Subject: [PATCH v3 4/7] Documentation/security-bugs: add linux-distros and oss-security sections Date: Sun, 5 Mar 2023 23:00:07 +0100 Message-Id: <20230305220010.20895-5-vegard.nossum@oracle.com> X-Mailer: git-send-email 2.23.0.718.g5ad94255a8 In-Reply-To: <20230305220010.20895-1-vegard.nossum@oracle.com> References: <20230305220010.20895-1-vegard.nossum@oracle.com> MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-05_12,2023-03-03_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxlogscore=999 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 malwarescore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303050192 X-Proofpoint-GUID: pVldTcCYvm2QtnxvReBedPNPIgluSSxC X-Proofpoint-ORIG-GUID: pVldTcCYvm2QtnxvReBedPNPIgluSSxC X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1759567060246448720?= X-GMAIL-MSGID: =?utf-8?q?1759567060246448720?= The existing information about CVE assignment requests and coordinated disclosure fits much better in these new sections, since that's what these lists are for. Keep just a reminder in the security list section. Signed-off-by: Vegard Nossum --- Documentation/process/security-bugs.rst | 92 ++++++++++++++++++------- 1 file changed, 67 insertions(+), 25 deletions(-) diff --git a/Documentation/process/security-bugs.rst b/Documentation/process/security-bugs.rst index fb156d146c42..2dd6569a7abb 100644 --- a/Documentation/process/security-bugs.rst +++ b/Documentation/process/security-bugs.rst @@ -31,6 +31,10 @@ be released without consent from the reporter unless it has already been made public. Reporters are encouraged to propose patches, participate in the discussions of a fix, and test patches. +The security team does not assign CVEs, nor does it require them for reports +or fixes. CVEs may be requested when the issue is reported to the +linux-distros list. + **Disclosure.** Once a robust patch or patchset has been developed, the release process starts. The security list strongly prefers to have these posted for review and testing on public mailing lists and merged into the @@ -68,28 +72,66 @@ embargo has been lifted, in perpetuity. The Linux kernel security team is not a formal body and therefore unable to enter any non-disclosure agreements. -Coordination ------------- - -Fixes for sensitive bugs, such as those that might lead to privilege -escalations, may need to be coordinated with the private - mailing list so that distribution vendors -are well prepared to issue a fixed kernel upon public disclosure of the -upstream fix. Distros will need some time to test the proposed patch and -will generally request at least a few days of embargo, and vendor update -publication prefers to happen Tuesday through Thursday. When appropriate, -the security team can assist with this coordination, or the reporter can -include linux-distros from the start. In this case, remember to prefix -the email Subject line with "[vs]" as described in the linux-distros wiki: - - -CVE assignment --------------- - -The security team does not normally assign CVEs, nor do we require them -for reports or fixes, as this can needlessly complicate the process and -may delay the bug handling. If a reporter wishes to have a CVE identifier -assigned ahead of public disclosure, they will need to contact the private -linux-distros list, described above. When such a CVE identifier is known -before a patch is provided, it is desirable to mention it in the commit -message if the reporter agrees. +Once a patch has been developed, you are encouraged to contact the +linux-distros list. + +Contacting the linux-distros list +--------------------------------- + +Fixes for particularly sensitive bugs (such as those that might lead to +privilege escalations) may need to be coordinated with the private +linux-distros mailing list (linux-distros@vs.openwall.org) so that +distribution vendors are well prepared to release a fixed kernel as soon as +possible after the public disclosure of the upstream fix. This includes +verifying the reported issue, testing proposed fixes, developing a fix (if +none is known yet), and backporting to older kernels and other versions. + +The linux-distros list can also help with assigning a CVE for your issue. + +**Disclosure.** The linux-distros list has a strict policy of requiring +reporters to post about the security issue on oss-security within 14 +calendar days of the list being contacted regardless of whether a patch is +available or not. It is therefore preferable that you don't send your +initial bug report to the linux-distros list unless you already have a patch +for the issue. + +**List rules.** The main rules to be aware of when contacting the +linux-distros list are: + +* Don't post about issues that are already public. If your issue has a + public patch, but the security impact is not generally known, then you may + still post about it. + +* The submitter can suggest an embargo end-date, but as a rule, embargoes + should not be longer than 7 calendar days, or at most 14 calendar days in + exceptional cases. Keep in mind that vendors may prefer to release new + kernel packages and/or updates Tuesday through Thursday. + +* When the embargo ends, the issue must be disclosed immediately on the + oss-security list (see below). + +* Prefix your subject with the string "[vs]" to avoid getting rejected by + the spam filter. + +For the full list of rules, see: +https://oss-security.openwall.org/wiki/mailing-lists/distros#list-policy-and-instructions-for-reporters + +**Confidentiality.** Please note that, as opposed to the security list, any +and all material submitted to the list must be made public once the security +issue is publicly disclosed, so please do not post information to the +linux-distros list that cannot be made public. + +Contacting the oss-security list +-------------------------------- + +When your security issue is public, or you wish to make your issue public, +you can write to the oss-security list (oss-security@lists.openwall.com). +This is a public list (anybody can subscribe and view the list archives) and +it is not restricted to Linux kernel issues. + +The oss-security list typically does not assign CVEs or accept requests for +CVE assignments. + +**List rules.** Please do not cross-post to other lists when writing to this +list. Make sure to read the other list rules before posting: +https://oss-security.openwall.org/wiki/mailing-lists/oss-security. From patchwork Sun Mar 5 22:00:08 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vegard Nossum X-Patchwork-Id: 64361 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp1550828wrd; Sun, 5 Mar 2023 14:12:13 -0800 (PST) X-Google-Smtp-Source: AK7set8h0i+ub7xxdw6IHzhh5ZcPuZzm5kdsmqeX8y33leq/GyUt+iz/bsyGScPQ2IUlHK31xNMO X-Received: by 2002:a17:906:da89:b0:8b1:7de6:e292 with SMTP id xh9-20020a170906da8900b008b17de6e292mr11611204ejb.9.1678054333834; Sun, 05 Mar 2023 14:12:13 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1678054333; cv=none; d=google.com; s=arc-20160816; b=NLtMaLNlBR4fGRVdjD9ECom/jLBJTK+ibew6mbCF4ddXy4pIq5+yapEJ5BE1gVEkD7 PW7SnYBBnyNvwKyMToyXLTxfQrKjcfQ44F+cG2/WFXcUdf9AvolTRQslBaGCk7EMsdRI 1saRlOrJO5pxLCzNnjJ8pehf7yVqwFjSp6169ejfKOPlPuIJU9yCTXgvtlAKg6c0EVW2 9xfeQkpocf0++uOZzImEZIRrCqQ9Z1HuJdO6LXRZLR/Sbpl2HE19XZM+CcgbMzMGDNc5 EVppVNl6cmj0i3QI+5cdMU/HPKg6bEUSLheHPfaX44JK07SOnivQ77EC/qiHsCLgaL8u VLPQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=ZJ90aWPPj9zyH+6Oh/z2dY9oamLu7+DAooQEywdRR2k=; b=PM6FAbIUnJsCwKunyi4dt08hvmtnpLPfEvwKn5Nn7FwtXLP7X4PckEgIjOrgISYVvd 5z6Kw8V8dmnGdNWpxdTtwKpUhNvGoNDbDXz3ya/Fv6RTkyphdDvwuAHEdS1M6qaA40np CgmRyg7M76TKJdqMl+xCpvmdNWj5N/83O24+xHZAw5f5KIeJp0+ywULfqcEmizti5XYr HRtbb9Ez82E5/NFMFWuRk0LCHTiIig1fXeRx/QIfgKeDtFUnf4JJAksbXT7RERKL0bPU BTD8WZ+Th3vwdL921AZ2oeIIfTio+Ayla0yCmFopx1KQrx2w4aS2EhVlyB0u3IXZLDBC l3nA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@oracle.com header.s=corp-2022-7-12 header.b=SICo2nL9; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=oracle.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id b15-20020a17090636cf00b008d92efb7984si7816263ejc.999.2023.03.05.14.11.50; Sun, 05 Mar 2023 14:12:13 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@oracle.com header.s=corp-2022-7-12 header.b=SICo2nL9; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=oracle.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229726AbjCEWCH (ORCPT + 99 others); Sun, 5 Mar 2023 17:02:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58096 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229905AbjCEWBz (ORCPT ); Sun, 5 Mar 2023 17:01:55 -0500 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 53F1715C87; Sun, 5 Mar 2023 14:01:52 -0800 (PST) Received: from pps.filterd (m0246629.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 325Li8bh029218; Sun, 5 Mar 2023 22:00:59 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=corp-2022-7-12; bh=ZJ90aWPPj9zyH+6Oh/z2dY9oamLu7+DAooQEywdRR2k=; b=SICo2nL9tZx9cte4XlAj+zXinR5gu7L7nDGiZsK8gB2yCxqc/MD1yufrXT9uZYOPKnXx +kabGXjEbYVYBo7oIYHQOJNNrBX6oAxjhb0f4SctHcTpL/fvfV4tXE3Qig71GOJngOnt hZO5f95QELZ1nWInN4XUbaUKJDbEegsUCDKAUbhNb+IVAM5ZW05xT1CyiB9AMtH2h7Kx nwOJzzJh/U7vlX7ClFBLepvhVtoyEe+TLM1PpiEVtmvHcZzH3jBKdfpuKbkrKPK0Zdv2 Fi8minNpOTrSGA7Fya98weBgO1IIviN6OAmUOJ0BkMviBs1PNSSu968sP+PicSCUEkhy wQ== Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.appoci.oracle.com [138.1.114.2]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3p4161srk8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:59 +0000 Received: from pps.filterd (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 325IJ9Aj023424; Sun, 5 Mar 2023 22:00:58 GMT Received: from pps.reinject (localhost [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3p4u040mjx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:58 +0000 Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 325M0Nr9013622; Sun, 5 Mar 2023 22:00:58 GMT Received: from t460.home (dhcp-10-175-35-7.vpn.oracle.com [10.175.35.7]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTP id 3p4u040ktj-6; Sun, 05 Mar 2023 22:00:57 +0000 From: Vegard Nossum To: Jonathan Corbet , linux-doc@vger.kernel.org, Jiri Kosina , Solar Designer , Will Deacon , Willy Tarreau Cc: Greg Kroah-Hartman , linux-kernel@vger.kernel.org, Amit Shah , Dave Hansen , David Woodhouse , "Gustavo A. R. Silva" , Kees Cook , Laura Abbott , Linus Torvalds , Mauro Carvalho Chehab , Paolo Bonzini , Peter Zijlstra , Thomas Gleixner , Thorsten Leemhuis , Tyler Hicks , Vegard Nossum Subject: [PATCH v3 5/7] Documentation/security-bugs: add table of lists Date: Sun, 5 Mar 2023 23:00:08 +0100 Message-Id: <20230305220010.20895-6-vegard.nossum@oracle.com> X-Mailer: git-send-email 2.23.0.718.g5ad94255a8 In-Reply-To: <20230305220010.20895-1-vegard.nossum@oracle.com> References: <20230305220010.20895-1-vegard.nossum@oracle.com> MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-05_12,2023-03-03_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxlogscore=999 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 malwarescore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303050192 X-Proofpoint-GUID: N7-WzzRgDuS3YD56U5kcF6iEdSapv_G- X-Proofpoint-ORIG-GUID: N7-WzzRgDuS3YD56U5kcF6iEdSapv_G- X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1759567500841093824?= X-GMAIL-MSGID: =?utf-8?q?1759567500841093824?= Give an overview of the full process the start of the document. This makes it clear 1) in what order the lists should be contacted, and 2) the purpose of each list. Thanks to Jonathan Corbet and Mauro Carvalho Chehab for providing the readable markup for the table. Link: https://lore.kernel.org/all/20220604014317.79eb23db@sal.lan/ Suggested-by: Jonathan Corbet Suggested-by: Mauro Carvalho Chehab Signed-off-by: Vegard Nossum --- Documentation/process/security-bugs.rst | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/Documentation/process/security-bugs.rst b/Documentation/process/security-bugs.rst index 2dd6569a7abb..61742dcfea50 100644 --- a/Documentation/process/security-bugs.rst +++ b/Documentation/process/security-bugs.rst @@ -18,7 +18,26 @@ vulnerability. Note that the main interest of the kernel security list is in getting bugs fixed and getting patches reviewed, tested, and merged; CVE assignment, disclosure to distributions, and public disclosure happen on -different lists with different people. +different lists with different people, as described below. + +Here is a quick overview of the various lists: + + =============================== ===== =================== =============== + List address Open? Purpose Members + =============================== ===== =================== =============== + security@kernel.org no | Reporting Trusted kernel + | Patch development developers + ------------------------------- ----- ------------------- --------------- + linux-distros@vs.openwall.org no | Coordination Distribution + | CVE assignment representatives + | Backporting + | Testing + ------------------------------- ----- ------------------- --------------- + oss-security@lists.openwall.com yes | Disclosure General public + =============================== ===== =================== =============== + +The following sections give a step-by-step guide to reporting and +disclosure. Contacting the security list ---------------------------- From patchwork Sun Mar 5 22:00:09 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vegard Nossum X-Patchwork-Id: 64358 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp1549830wrd; Sun, 5 Mar 2023 14:08:55 -0800 (PST) X-Google-Smtp-Source: AK7set9da3i3XbWH33mI4wsGIFHk3dP7ctxjgZ/IegCv9hNWEYrClgEN0jsX2lFqR4Afyxf/TLGU X-Received: by 2002:a17:90a:1946:b0:233:c9e7:c885 with SMTP id 6-20020a17090a194600b00233c9e7c885mr9111039pjh.36.1678054134977; Sun, 05 Mar 2023 14:08:54 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1678054134; cv=none; d=google.com; s=arc-20160816; b=TyxsjCXeYR0Xkw4kITFAkYtg33I3lp+QIccw0bjF+XkJTAtizGmjDxtLLCnN8DmV17 Ux66r7lrPAyub3yEW0P33Ww+lCtKmN7hKPOEceS9m7K8pjRI/AP7WmRmtm0XSnQiZcR6 dLFHFgZIl3+lrV/iPzH/nF06GCci+72b9MlT3nIduC6kjWu4ob4zGx97c/GUnrfRTcaq WzyewzbYzlE4tkQqLmycDJewPekOgTzqWxVN4/6Wae8Fyxk3/D6EVYNWdUjn1CUOKYE6 JWRjNBypf7LLk5T2lxxC+KGdZeCMqdMsH3xi38TQYRBB0AS2V+U3GimBuHhRkFbNJ/TA 26sw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=K4J/PSEjpfD1bARxkY3stp5xTVHHyV6U8fEH33L8wKY=; b=A4zoBcSiFJZUbre23Tr+mljCTGSghfPliPuBkIQbIYUM4F0UWB05zPkeUAeJPxwZ8w fRCU3qdwITHBU6auREmlSTHGh40370PDGqedXtWC0JrdNAfh5qT4wPqCJAIcnYiQ5AqM ftDdxsfulWNmCUVmQjYuY58qdqEZFP2fR0Pz2mv3J3LWIERhq0hfokZIuDYd0Jjo+2cA hqERfIka4vgfCkQ12BbaA0VrSUAnAZgsT0ZzPDSdFS0HwzguMziZs7vbqhLh/A0htfTv 8UYL/nPPfrriGG+4SdkCaI29KKgq+nJHRu4gF9m8dCvSG61p8JsceFYPT7Ka/GZ52eY2 7Etg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@oracle.com header.s=corp-2022-7-12 header.b=LwKkKp8Y; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=oracle.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id x11-20020a17090a294b00b00234e6cd59absi10736482pjf.117.2023.03.05.14.08.41; Sun, 05 Mar 2023 14:08:54 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@oracle.com header.s=corp-2022-7-12 header.b=LwKkKp8Y; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=oracle.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229934AbjCEWCU (ORCPT + 99 others); Sun, 5 Mar 2023 17:02:20 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58636 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229927AbjCEWCH (ORCPT ); Sun, 5 Mar 2023 17:02:07 -0500 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D223C1969F; Sun, 5 Mar 2023 14:01:57 -0800 (PST) Received: from pps.filterd (m0246627.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 325LU3P0022560; Sun, 5 Mar 2023 22:01:04 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=corp-2022-7-12; bh=K4J/PSEjpfD1bARxkY3stp5xTVHHyV6U8fEH33L8wKY=; b=LwKkKp8YcJMTi58DlbwGfKmn5JRhDCFCsEes3ju2Hbs/AH6kvI3gJ7Q8ynoV/nsEqVzI 1A1n3BRFoXqsug8qJF3pa0y1a38S7StDfswvCV0Sov+DYSgoLbQw3sgssTZZdvIuX7Bs 3IuVuWpYiKpFMmBIGbxMn/cLq7jsqviodszzc9YdCihx6gH+nD2LCzwb4CmoR8ZoCKGk miXRUOVJGHJjCwQm5zW6XwOr6gbx94m3kmCYjpCh2+92z2MsldgQMAVmRjN/N7W+wfeP +ax9jkwf9yadE+ArvOJFQlpW5GmWdwBe0YzFWs2NrM7FnZMMHt05zbHHqPAp9l5dE8HZ 6g== Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.appoci.oracle.com [138.1.114.2]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3p41561rre-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:01:04 +0000 Received: from pps.filterd (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 325I2GKT023367; Sun, 5 Mar 2023 22:01:03 GMT Received: from pps.reinject (localhost [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3p4u040mmc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:01:03 +0000 Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 325M0NrB013622; Sun, 5 Mar 2023 22:01:03 GMT Received: from t460.home (dhcp-10-175-35-7.vpn.oracle.com [10.175.35.7]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTP id 3p4u040ktj-7; Sun, 05 Mar 2023 22:01:02 +0000 From: Vegard Nossum To: Jonathan Corbet , linux-doc@vger.kernel.org, Jiri Kosina , Solar Designer , Will Deacon , Willy Tarreau Cc: Greg Kroah-Hartman , linux-kernel@vger.kernel.org, Amit Shah , Dave Hansen , David Woodhouse , "Gustavo A. R. Silva" , Kees Cook , Laura Abbott , Linus Torvalds , Mauro Carvalho Chehab , Paolo Bonzini , Peter Zijlstra , Thomas Gleixner , Thorsten Leemhuis , Tyler Hicks , Vegard Nossum , Jiri Kosina Subject: [PATCH v3 6/7] Documentation/security-bugs: clarify hardware vs. software vulnerabilities Date: Sun, 5 Mar 2023 23:00:09 +0100 Message-Id: <20230305220010.20895-7-vegard.nossum@oracle.com> X-Mailer: git-send-email 2.23.0.718.g5ad94255a8 In-Reply-To: <20230305220010.20895-1-vegard.nossum@oracle.com> References: <20230305220010.20895-1-vegard.nossum@oracle.com> MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-05_12,2023-03-03_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxlogscore=999 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 malwarescore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303050192 X-Proofpoint-GUID: pZOQdTeOzVF_YsAwqYS63qIc2SWXfctH X-Proofpoint-ORIG-GUID: pZOQdTeOzVF_YsAwqYS63qIc2SWXfctH X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1759567292751197470?= X-GMAIL-MSGID: =?utf-8?q?1759567292751197470?= We should emphasize the fact that we have a separate document for reporting hardware vulnerabilities. Link: https://lore.kernel.org/all/nycvar.YFH.7.76.2206062326230.10851@cbobk.fhfr.pm/ Suggested-by: Jiri Kosina Signed-off-by: Vegard Nossum --- Documentation/process/security-bugs.rst | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Documentation/process/security-bugs.rst b/Documentation/process/security-bugs.rst index 61742dcfea50..7bd59587332a 100644 --- a/Documentation/process/security-bugs.rst +++ b/Documentation/process/security-bugs.rst @@ -15,6 +15,10 @@ While the security list is closed, the security team may bring in extra help from the relevant maintainers to understand and fix the security vulnerability. +The security list is mainly for software vulnerabilities. For hardware +security vulnerabilities, see +Documentation/process/embargoed-hardware-issues.rst instead. + Note that the main interest of the kernel security list is in getting bugs fixed and getting patches reviewed, tested, and merged; CVE assignment, disclosure to distributions, and public disclosure happen on From patchwork Sun Mar 5 22:00:10 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vegard Nossum X-Patchwork-Id: 64362 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp1550985wrd; Sun, 5 Mar 2023 14:12:48 -0800 (PST) X-Google-Smtp-Source: AK7set/6biCRzrG/tS+deelkli7/ugBZqruYWqwkwjU70DJdmfkUVfEtWz9qIHEQD0hKXv6SqdgW X-Received: by 2002:a17:907:1c15:b0:8af:2fa1:2226 with SMTP id nc21-20020a1709071c1500b008af2fa12226mr11410255ejc.6.1678054368593; Sun, 05 Mar 2023 14:12:48 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1678054368; cv=none; d=google.com; s=arc-20160816; b=RgD5zqxRJnceK9yvoNFyUf2JnoeWMskWIuNg74u5BN32i8jVrlgj11JrLjsHY5rc+b vvf6vr8jvrqC6cLShHoGoMEQiCBrIGSd02aZACGGiR67FiNzxJBNRb85R+6dk8Hkm+zG +z2/xCs4d1y6d+teCJZc/RPcg+aIkP9BJizmbgW+CtFhmc6QHFcsO3NvVwPMqcCFUKkl /va0u/anfhadLVKun+OaRKn3CVOx99kFzHF9t75iXHVmTMSrDAk08rpKf3Q1ybBp4c1u FW+obdBm0WXXwYqP5ZkcjQ2Qljwn3X0HURggegfOKTJFxo9cJtxLJNTUCZGvJk5BdH3I Umog== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=lOlMiJgwc+kBqQXXTCcgaFuxE3qu5j6thK/9P2DSJx4=; b=DA6qcVMyP+qXVs/vEum5J23iSyczpc0X9nK9IX0s4PrcJTM22cWbOFNIVn5QeDX7ec nKZAKuX8XS0fbcKTs1qtc6yQ9SSwylncJAaEDeUVkM1PWN6rFMkm5BtARdDaepWOlhx+ OscIrDledwINzPTJpHZHyZIW/D4zNzqa5mMH1jSfoB7MrGSWY3b+8Me9+iq4dngNi+GT aiE4Z5Iak2kEeGs6dtQgpozS1TLbjCgFtMsE2ddmpEd8IRNH+7PeBJDFTqKg5U1s50ul hhzjA8LXr4WJYhl4KZhEEFb6c6/zPA/ZP4AoLlzvkwOsiZdztWzjvAmgv8RXk7uHAmDF qapw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@oracle.com header.s=corp-2022-7-12 header.b=zSrye9ym; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=oracle.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id k24-20020a1709065fd800b008e15a1c1946si8667410ejv.403.2023.03.05.14.12.25; Sun, 05 Mar 2023 14:12:48 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@oracle.com header.s=corp-2022-7-12 header.b=zSrye9ym; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=oracle.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229897AbjCEWCo (ORCPT + 99 others); Sun, 5 Mar 2023 17:02:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59116 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229947AbjCEWCf (ORCPT ); Sun, 5 Mar 2023 17:02:35 -0500 Received: from mx0b-00069f02.pphosted.com (mx0b-00069f02.pphosted.com [205.220.177.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3BB6B166DA; Sun, 5 Mar 2023 14:02:07 -0800 (PST) Received: from pps.filterd (m0246630.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 325KWTxZ008283; Sun, 5 Mar 2023 22:01:10 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=corp-2022-7-12; bh=lOlMiJgwc+kBqQXXTCcgaFuxE3qu5j6thK/9P2DSJx4=; b=zSrye9ymLu00GaO+u0li0nC+/tmt9DptGSP+v6plVBabrP6Vn4euoW80iFL4SDNYj9U8 xFHTaXdSTzFW+muJ9Q5FFRSINa6vbXFyRlzZtM+ggVHyWWDn/BF2vWl+t/SCyAV3ihiG HdyMzR1ZuZhUN3IztBx6Xuig62CPDueXWm+SnUQ8CPvOSCd1iegXmw/x61v58EkVhp4w gQrpAbPn1BpeWhVUm5vcimBftLSMk6JBuE8Rlt777CFO1lPLty+FWyKGQiP/0s9aoqHs StEkFyuAhlq6r6jtOCADTa07ip6K2NZq7OQifiVfMZIWGOdRGT5Er0/TgOFjaazF51nA UA== Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.appoci.oracle.com [138.1.114.2]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3p4180sr34-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:01:09 +0000 Received: from pps.filterd (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 325I8Al5023260; Sun, 5 Mar 2023 22:01:08 GMT Received: from pps.reinject (localhost [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3p4u040mpe-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:01:08 +0000 Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 325M0NrD013622; Sun, 5 Mar 2023 22:01:08 GMT Received: from t460.home (dhcp-10-175-35-7.vpn.oracle.com [10.175.35.7]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTP id 3p4u040ktj-8; Sun, 05 Mar 2023 22:01:07 +0000 From: Vegard Nossum To: Jonathan Corbet , linux-doc@vger.kernel.org, Jiri Kosina , Solar Designer , Will Deacon , Willy Tarreau Cc: Greg Kroah-Hartman , linux-kernel@vger.kernel.org, Amit Shah , Dave Hansen , David Woodhouse , "Gustavo A. R. Silva" , Kees Cook , Laura Abbott , Linus Torvalds , Mauro Carvalho Chehab , Paolo Bonzini , Peter Zijlstra , Thomas Gleixner , Thorsten Leemhuis , Tyler Hicks , Vegard Nossum Subject: [PATCH v3 7/7] Documentation/security-bugs: document document design Date: Sun, 5 Mar 2023 23:00:10 +0100 Message-Id: <20230305220010.20895-8-vegard.nossum@oracle.com> X-Mailer: git-send-email 2.23.0.718.g5ad94255a8 In-Reply-To: <20230305220010.20895-1-vegard.nossum@oracle.com> References: <20230305220010.20895-1-vegard.nossum@oracle.com> MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-05_12,2023-03-03_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxlogscore=999 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 malwarescore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303050192 X-Proofpoint-ORIG-GUID: G2DtmlHrWbALHEC_iI446HGKZlSc_dr1 X-Proofpoint-GUID: G2DtmlHrWbALHEC_iI446HGKZlSc_dr1 X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1759567537740630946?= X-GMAIL-MSGID: =?utf-8?q?1759567537740630946?= I think there is value in expressing the high-level design of this document so that it will not get lost with future revisions. This section is an rST comment and will not be part of rendered documentation (e.g. the html version). Link: https://lore.kernel.org/all/87ilpk5wsi.fsf@meer.lwn.net/ Signed-off-by: Vegard Nossum --- Documentation/process/security-bugs.rst | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/Documentation/process/security-bugs.rst b/Documentation/process/security-bugs.rst index 7bd59587332a..8d9adc02cd49 100644 --- a/Documentation/process/security-bugs.rst +++ b/Documentation/process/security-bugs.rst @@ -158,3 +158,24 @@ CVE assignments. **List rules.** Please do not cross-post to other lists when writing to this list. Make sure to read the other list rules before posting: https://oss-security.openwall.org/wiki/mailing-lists/oss-security. + +.. + If you modify this document, please consider the following: + + 1) The most important information should be at the top (preferably in + the opening paragraph). This means contacting ; + if somebody doesn't read any further than that, at least the security + team will have the report. + + 2) Make the differences between the lists extremely clear. The old + version did make an attempt at this, but the lines were not drawn + clearly enough. + + 3) Emphasize some of the posting rules which can be confusing to new + people (e.g. the fact that posting to linux-distros means you must + propose an embargo date and that this cannot under any circumstances + be more than 14 days). + + 4) The document should be a "step-by-step process" as much as possible, + so that you can use it as a guide while reporting an issue instead of + having to search back and forth for the thing you're looking for.