linux-kernel - Re: [stable] Linux 2.6.25.10 (resume)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080723143125.GB4684@khazad-dum.debian.net>
Date:	Wed, 23 Jul 2008 11:31:25 -0300
From:	Henrique de Moraes Holschuh <hmh@....eng.br>
To:	pageexec@...email.hu
Cc:	"Rodrigo Rubira Branco (BSDaemon)" <rbranco@...checkpoint.com>,
	Greg KH <gregkh@...e.de>, Alan Cox <alan@...hat.com>,
	linux-kernel@...r.kernel.org, stable@...nel.org, greg@...ah.com,
	'Justin Forbes' <jmforbes@...uxtx.org>,
	'Zwane Mwaikambo' <zwane@....linux.org.uk>,
	'Theodore Ts'o' <tytso@....edu>,
	'Randy Dunlap' <rdunlap@...otime.net>,
	'Dave Jones' <davej@...hat.com>,
	'Chuck Wolber' <chuckw@...ntumlinux.com>,
	'Chris Wedgwood' <reviews@...cw.f00f.org>,
	'Michael Krufky' <mkrufky@...uxtv.org>,
	'Chuck Ebbert' <cebbert@...hat.com>,
	'Domenico Andreoli' <cavokz@...il.com>,
	'Willy Tarreau' <w@....eu>, torvalds@...ux-foundation.org,
	akpm@...ux-foundation.org, alan@...rguk.ukuu.org.uk,
	caglar@...dus.org.tr, casey@...aufler-ca.com,
	spender@...ecurity.net, rodrigo@...nelhacking.com
Subject: Re: [stable] Linux 2.6.25.10 (resume)

On Wed, 23 Jul 2008, pageexec@...email.hu wrote:
> On 22 Jul 2008 at 21:27, Greg KH wrote:
> > >  2) Disclosure
> > >  
> > >  The goal of the Linux kernel security team is to work with the
> > >  bug submitter to bug resolution as well as disclosure.  We prefer
> > > -to fully disclose the bug as soon as possible.  It is reasonable to
> > > +to not disclose the bug, since we believe any kind of bug deserves the
> > > +same attention and will be quickly patched.  It is reasonable to
> > 
> > No, again, you are using the word "disclose" in an odd way here.
> > 
> > Of course the bug is "disclosed" in that it is made public, "here's a
> > fix for foo breaking".
> 
> it's apparently not true when foo = "kernel's security model", hence the
> suggested change to reflect reality.

I heavily suggest using something else than "disclose".  

For the security community, "disclose" doesn't mean you have the source code
for the buggy code and the source code for the fix.  It means you have the
information that it is a "foo = kernel's security model" bug, and a
description of the consequences of the bug for foo (the security model).

This is NOT what "disclose" means for the Linux kernel, right now.  Here,
"disclose" means "you know there is a bug, you have the code, you have the
bug fix".  But you don't know that "foo = kernel's security bug", or the
consequences of the bug for the security model.

So just use another word, or properly qualify WHAT is going to be disclosed,
(and in this case, WHAT is not going to be *usually* disclosed).

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/