From: Jiri Kosina <jikos@kernel.org>
To: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Jonathan Corbet <corbet@lwn.net>,
linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
Amit Shah <aams@amazon.com>,
Dave Hansen <dave.hansen@linux.intel.com>,
David Woodhouse <dwmw@amazon.co.uk>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
"Gustavo A . R . Silva" <gustavoars@kernel.org>,
Kees Cook <keescook@chromium.org>,
Laura Abbott <labbott@kernel.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
Mauro Carvalho Chehab <mchehab@kernel.org>,
Paolo Bonzini <pbonzini@redhat.com>,
Peter Zijlstra <peterz@infradead.org>,
Solar Designer <solar@openwall.com>,
Thomas Gleixner <tglx@linutronix.de>,
Thorsten Leemhuis <linux@leemhuis.info>,
Tyler Hicks <tyhicks@linux.microsoft.com>,
Will Deacon <will@kernel.org>, Willy Tarreau <w@1wt.eu>
Subject: Re: [PATCH v2] Documentation/security-bugs: overhaul
Date: Mon, 6 Jun 2022 23:31:19 +0200 (CEST) [thread overview]
Message-ID: <nycvar.YFH.7.76.2206062326230.10851@cbobk.fhfr.pm> (raw)
In-Reply-To: <20220606194850.26122-1-vegard.nossum@oracle.com>
On Mon, 6 Jun 2022, Vegard Nossum wrote:
> The current instructions for reporting security vulnerabilities in the
> kernel are not clear enough, in particular the process of disclosure
> and requesting CVEs, and what the roles of the different lists are and
> how exactly to report to each of them.
>
> Let's give this document an overhaul. Goals are stated as a comment at
> the bottom of the document; these will not appear in the rendered HTML
> document.
>
> v2: address feedback from Willy Tarreau and Jonathan Corbet
>
> Link: https://seclists.org/oss-sec/2022/q2/133
> Cc: Amit Shah <aams@amazon.com>
> Cc: Dave Hansen <dave.hansen@linux.intel.com>
> Cc: David Woodhouse <dwmw@amazon.co.uk>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
> Cc: Jiri Kosina <jkosina@suse.cz>
> Cc: Jonathan Corbet <corbet@lwn.net>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Laura Abbott <labbott@kernel.org>
> Cc: Linus Torvalds <torvalds@linux-foundation.org>
> Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Solar Designer <solar@openwall.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Thorsten Leemhuis <linux@leemhuis.info>
> Cc: Tyler Hicks <tyhicks@linux.microsoft.com>
> Cc: Will Deacon <will@kernel.org>
> Cc: Willy Tarreau <w@1wt.eu>
> Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
> ---
> Documentation/admin-guide/security-bugs.rst | 252 +++++++++++++-------
> 1 file changed, 167 insertions(+), 85 deletions(-)
>
> v1 thread:
> https://lore.kernel.org/all/20220531230309.9290-1-vegard.nossum@oracle.com/T/#u
>
> Updated rendered HTML:
> https://vegard.github.io/security/Documentation/output/admin-guide/security-bugs-v2.html
>
> diff --git a/Documentation/admin-guide/security-bugs.rst b/Documentation/admin-guide/security-bugs.rst
> index 82e29837d5898..c63eeb1e89ffd 100644
> --- a/Documentation/admin-guide/security-bugs.rst
> +++ b/Documentation/admin-guide/security-bugs.rst
Thanks for investing time into fixing this aged document.
Two rather minor things come to my mind, but as you are touching that
document anyway ...
- what sense does it make to have embargoed-hardware-issues.rst and
security-bugs.rst live in different Documentation/ subdirectories
(admin-guide/ vs process/)? It'd seem to make sense to me to have them
in one common place?
- would it make sense to briefly reference embargoed-hardware-issues.rst
somewhere in this text, to make the distinction as obvious as possible?
It's referenced the other way around.
Thanks,
--
Jiri Kosina
SUSE Labs
next prev parent reply other threads:[~2022-06-06 21:31 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-06-06 19:48 [PATCH v2] Documentation/security-bugs: overhaul Vegard Nossum
2022-06-06 21:31 ` Jiri Kosina [this message]
2022-06-07 13:30 ` Jonathan Corbet
2022-06-07 14:00 ` Willy Tarreau
2022-06-07 9:07 ` Will Deacon
2022-06-07 13:06 ` Vegard Nossum
2022-06-09 14:51 ` Will Deacon
2022-06-09 17:01 ` Willy Tarreau
2023-03-05 14:38 ` Vegard Nossum
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=nycvar.YFH.7.76.2206062326230.10851@cbobk.fhfr.pm \
--to=jikos@kernel.org \
--cc=aams@amazon.com \
--cc=corbet@lwn.net \
--cc=dave.hansen@linux.intel.com \
--cc=dwmw@amazon.co.uk \
--cc=gregkh@linuxfoundation.org \
--cc=gustavoars@kernel.org \
--cc=keescook@chromium.org \
--cc=labbott@kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@leemhuis.info \
--cc=mchehab@kernel.org \
--cc=pbonzini@redhat.com \
--cc=peterz@infradead.org \
--cc=solar@openwall.com \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
--cc=tyhicks@linux.microsoft.com \
--cc=vegard.nossum@oracle.com \
--cc=w@1wt.eu \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).