From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B6A5C001B3 for ; Fri, 30 Jun 2023 07:14:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232236AbjF3HOg (ORCPT ); Fri, 30 Jun 2023 03:14:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45272 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231824AbjF3HOd (ORCPT ); Fri, 30 Jun 2023 03:14:33 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E71B61FE8; Fri, 30 Jun 2023 00:14:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 84B12616DA; Fri, 30 Jun 2023 07:14:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 65E79C433C8; Fri, 30 Jun 2023 07:14:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1688109269; bh=Zdprq0YUnfUvu95kY3UJZFl9wG79vBDtun14mBUAIa0=; h=From:To:Cc:Subject:Date:From; b=W8zHCNdzi7qka4Xk8ff1PuhnGYV+VIEY0+LJDsmoO8FpA9qProSFWNcoWMyzyw0Ez 6EYxIRjo2tPLjntGJj1eIXR0WlbJs+/VF7YmvnoX6uIgZJqw26r9wKriMVmoAHmMBo 6ZJMsfp/YjKswNzhZu8WI+T/CkaAv+OWlvMu9T4c= From: Greg Kroah-Hartman To: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org, security@kernel.org, corbet@lwn.net, workflows@vger.kernel.org, Greg Kroah-Hartman Subject: [PATCH 1/2] Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group Date: Fri, 30 Jun 2023 09:14:20 +0200 Message-ID: <2023063020-throat-pantyhose-f110@gregkh> X-Mailer: git-send-email 2.41.0 MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2511; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=Zdprq0YUnfUvu95kY3UJZFl9wG79vBDtun14mBUAIa0=; b=owGbwMvMwCRo6H6F97bub03G02pJDCnzGs7U5+Qo8YQdNk73SZmzcNXPLx5PH3Hdcdy7eM/qr Ye+b7ye3xHLwiDIxCArpsjyZRvP0f0VhxS9DG1Pw8xhZQIZwsDFKQATqShgmKe674Nui2HQvfxp EwV/O/5//LKoKZNhweqQxlYBW4n3aauFV/35as2puVfLEAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: workflows@vger.kernel.org Because the linux-distros group forces reporters to release information about reported bugs, and they impose arbitrary deadlines in having those bugs fixed despite not actually being kernel developers, the kernel security team recommends not interacting with them at all as this just causes confusion and the early-release of reported security problems. Signed-off-by: Greg Kroah-Hartman --- Documentation/process/security-bugs.rst | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/Documentation/process/security-bugs.rst b/Documentation/process/security-bugs.rst index 82e29837d589..f12ac2316ce7 100644 --- a/Documentation/process/security-bugs.rst +++ b/Documentation/process/security-bugs.rst @@ -63,20 +63,18 @@ information submitted to the security list and any followup discussions of the report are treated confidentially even after the embargo has been lifted, in perpetuity. -Coordination ------------- +Coordination with other groups +------------------------------ -Fixes for sensitive bugs, such as those that might lead to privilege -escalations, may need to be coordinated with the private - mailing list so that distribution vendors -are well prepared to issue a fixed kernel upon public disclosure of the -upstream fix. Distros will need some time to test the proposed patch and -will generally request at least a few days of embargo, and vendor update -publication prefers to happen Tuesday through Thursday. When appropriate, -the security team can assist with this coordination, or the reporter can -include linux-distros from the start. In this case, remember to prefix -the email Subject line with "[vs]" as described in the linux-distros wiki: - +The kernel security team strongly recommends that reporters of potential +security issues NEVER contact the "linux-distros" mailing list until +AFTER discussing it with the kernel security team. Do not Cc: both +lists at once. You may contact the linux-distros mailing list after a +fix has been agreed on and you fully understand the requirements that +doing so will impose on you and the kernel community. + +The different lists have different goals and the linux-distros rules do +not contribute to actually fixing any potential security problems. CVE assignment -------------- -- 2.41.0