linux-hardening - Re: Coverity Scan model file, license, public access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 16 Jul 2021 12:26:26 +0200
From:   Norbert Manthey <nmanthey@...zon.de>
To:     Kees Cook <keescook@...omium.org>
CC:     Kroah-Hartman <greg@...ah.com>,
        LKML <linux-kernel@...r.kernel.org>,
        "Woodhouse, David" <dwmw@...zon.co.uk>,
        "foersleo@...zon.de" <foersleo@...zon.de>,
        Gustavo Pimentel <gustavo.pimentel@...opsys.com>,
        "Gustavo A. R. Silva" <garsilva@...eddedor.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Colin Ian King <colin.king@...onical.com>,
        Dave Jones <davej@...emonkey.org.uk>,
        <linux-hardening@...r.kernel.org>
Subject: Re: Coverity Scan model file, license, public access

On 7/15/21 8:25 PM, Kees Cook wrote:
> CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.
> 
> 
> 
> On Thu, Jul 15, 2021 at 03:12:04PM +0200, Norbert Manthey wrote:
>> On 7/6/21 6:54 PM, Kroah-Hartman wrote:
>>>
>>>
>>> On Tue, Jul 06, 2021 at 09:45:47AM +0200, Norbert Manthey wrote:
>>>> Dear all,
>>>>
>>>> I would like to work with code analysis on the Linux kernel. The
>>>> currently used Coverity setup already uses a model file [1] to improve
>>>> the precision of the analysis. To the best of my knowledge, this model
>>>> file is currently not publicly accessible. I did not find a license
>>>> attached to  [1], nor any information about licensing.
>>>
>>> I have no idea who wrote that thing, sorry.
>>
>> Is there anybody else who knows more about the history of the used
>> Coverity model? Thanks.
> 
> As far as I know, the model was written originally by Dave Jones, with
> further changes from myself and, I think, Colin Ian King.
> 
> I thought it was visible through the Coverity dashboard, once you're
> logged in:
> https://scan.coverity.com/projects/linux-next-weekly-scan?tab=analysis_settings
> (See 'Modeling file loaded [View]')
> 
> Regardless, I keep a copy in git since I'd been tweaking it (mostly to
> no meaningful benefit: the model file doesn't work with macros, which is
> where the bulk of the false positives in Coverity come from):
> https://github.com/kees/coverity-linux

Thanks! This repo comes with a license, so I can start from there.

Best,
Norbert



Amazon Development Center Germany GmbH
Krausenstr. 38
10117 Berlin
Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss
Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B
Sitz: Berlin
Ust-ID: DE 289 237 879