linux-kernel - Re: Please create the email alias do-not-apply-to-stable@...nel.org -> /dev/null

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <99fe129c-d836-4a81-92df-f87a281ed799@leemhuis.info>
Date: Tue, 23 Apr 2024 09:28:42 +0200
From: Thorsten Leemhuis <linux@...mhuis.info>
To: Mauro Carvalho Chehab <mchehab@...nel.org>,
 Greg KH <gregkh@...uxfoundation.org>
Cc: Konstantin Ryabitsev <konstantin@...uxfoundation.org>,
 Sasha Levin <sashal@...nel.org>, helpdesk@...nel.org,
 "workflows@...r.kernel.org" <workflows@...r.kernel.org>,
 LKML <linux-kernel@...r.kernel.org>
Subject: Re: Please create the email alias do-not-apply-to-stable@...nel.org
 -> /dev/null



On 23.04.24 00:15, Mauro Carvalho Chehab wrote:
>> stable@...nel.org is there to route to /dev/null on purpose so that
>> developers/maintainers who only want their patches to get picked up when
>> they hit Linus's tree, will have happen and not notify anyone else.
>> This is especially good when dealing with security-related things as we
>> have had MANY people accidentally leak patches way too early by having
>>  cc: stable@...r.kernel.org in their signed-off-by areas, and forgetting
>> to tell git send-email to suppress cc: when sending them out for
>> internal review.
> Nice! didn't know about that. On a quick check, the only place at
> documentation mentioning it without vger is at checkpatch.rst.
> 
> Perhaps it would make sense to document that as well.

Maybe something like the below?

Will add that to my next patch set unless I hear complaints. 

Ciao, Thorsten

---

diff --git a/Documentation/process/stable-kernel-rules.rst b/Documentation/process/stable-kernel-rules.rst
index 727ad7f758e3e0..5a47ed06081e41 100644
--- a/Documentation/process/stable-kernel-rules.rst
+++ b/Documentation/process/stable-kernel-rules.rst
@@ -72,6 +72,10 @@ for stable trees, add this tag in the sign-off area::
 
      Cc: stable@...r.kernel.org
 
+Use ``Cc: stable@...nel.org`` instead when fixing an unpublished vulnerability:
+it reduces the chance of someone exposing the fix to the public by way of
+'git send-email', as mails sent to that address are not delivered anywhere.
+
 Once the patch is mainlined it will be applied to the stable tree without
 anything else needing to be done by the author or subsystem maintainer.