From: Willy Tarreau <w@1wt.eu>
To: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, security@kernel.org,
corbet@lwn.net, workflows@vger.kernel.org,
Willy Tarreau <w@1wt.eu>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Kees Cook <keescook@chromium.org>,
Solar Designer <solar@openwall.com>,
Vegard Nossum <vegard.nossum@oracle.com>
Subject: [RFC PATCH] Documentation: security-bugs.rst: linux-distros relaxed their rules
Date: Sat, 7 Oct 2023 16:04:54 +0200 [thread overview]
Message-ID: <20231007140454.25419-1-w@1wt.eu> (raw)
The linux-distros list relaxed their rules to try to adapt better to
how the Linux kernel works. Let's update the Coordination part to
explain why and when to contact them or not to and how to avoid trouble
in the future.
Link: https://www.openwall.com/lists/oss-security/2023/09/08/4
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Solar Designer <solar@openwall.com>
Cc: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
Documentation/process/security-bugs.rst | 33 ++++++++++++++++++-------
1 file changed, 24 insertions(+), 9 deletions(-)
diff --git a/Documentation/process/security-bugs.rst b/Documentation/process/security-bugs.rst
index 5a6993795bd2..8bbad669af1f 100644
--- a/Documentation/process/security-bugs.rst
+++ b/Documentation/process/security-bugs.rst
@@ -66,15 +66,30 @@ lifted, in perpetuity.
Coordination with other groups
------------------------------
-The kernel security team strongly recommends that reporters of potential
-security issues NEVER contact the "linux-distros" mailing list until
-AFTER discussing it with the kernel security team. Do not Cc: both
-lists at once. You may contact the linux-distros mailing list after a
-fix has been agreed on and you fully understand the requirements that
-doing so will impose on you and the kernel community.
-
-The different lists have different goals and the linux-distros rules do
-not contribute to actually fixing any potential security problems.
+While the kernel security team solely focuses on getting bugs fixed,
+other groups focus on fixing issues in distros and coordinating
+disclosure between operating system vendors. Coordination is usually
+handled by the "linux-distros" mailing list and disclosure by the
+public "oss-security" mailing list, both of which are closely related
+and presented in the linux-distros wiki:
+<https://oss-security.openwall.org/wiki/mailing-lists/distros>
+
+Please note that the respective policies and rules are different since
+the 3 lists pursue different goals. Coordinating between the kernel
+security team and other teams is difficult since occasional embargoes
+start from the availability of a fix for the kernel security team, while
+for other lists they generally start from the initial post to the list,
+regardless of the availability of a fix.
+
+As such, the kernel security team strongly recommends that reporters of
+potential security issues DO NOT contact the "linux-distros" mailing
+list BEFORE a fix is accepted by the affected code's maintainers and you
+have read the linux-distros wiki page above and you fully understand the
+requirements that doing so will impose on you and the kernel community.
+This also means that in general it doesn't make sense to Cc: both lists
+at once, except for coordination if a fix remains under embargo. And in
+general, please do not Cc: the kernel security list about fixes that
+have already been merged.
CVE assignment
--------------
--
2.17.5
next reply other threads:[~2023-10-07 14:06 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-07 14:04 Willy Tarreau [this message]
2023-10-07 16:30 ` [RFC PATCH] Documentation: security-bugs.rst: linux-distros relaxed their rules Vegard Nossum
2023-10-07 16:39 ` Willy Tarreau
2023-10-12 21:51 ` Solar Designer
2023-10-13 3:47 ` Willy Tarreau
2023-10-13 6:54 ` Jiri Kosina
2023-10-13 7:08 ` Willy Tarreau
2023-10-12 16:06 ` Jiri Kosina
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231007140454.25419-1-w@1wt.eu \
--to=w@1wt.eu \
--cc=corbet@lwn.net \
--cc=gregkh@linuxfoundation.org \
--cc=keescook@chromium.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=security@kernel.org \
--cc=solar@openwall.com \
--cc=vegard.nossum@oracle.com \
--cc=workflows@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).