Messages in this thread | | | Date | Mon, 6 Jun 2022 23:31:19 +0200 (CEST) | From | Jiri Kosina <> | Subject | Re: [PATCH v2] Documentation/security-bugs: overhaul |
| |
On Mon, 6 Jun 2022, Vegard Nossum wrote:
> The current instructions for reporting security vulnerabilities in the > kernel are not clear enough, in particular the process of disclosure > and requesting CVEs, and what the roles of the different lists are and > how exactly to report to each of them. > > Let's give this document an overhaul. Goals are stated as a comment at > the bottom of the document; these will not appear in the rendered HTML > document. > > v2: address feedback from Willy Tarreau and Jonathan Corbet > > Link: https://seclists.org/oss-sec/2022/q2/133 > Cc: Amit Shah <aams@amazon.com> > Cc: Dave Hansen <dave.hansen@linux.intel.com> > Cc: David Woodhouse <dwmw@amazon.co.uk> > Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > Cc: Gustavo A. R. Silva <gustavoars@kernel.org> > Cc: Jiri Kosina <jkosina@suse.cz> > Cc: Jonathan Corbet <corbet@lwn.net> > Cc: Kees Cook <keescook@chromium.org> > Cc: Laura Abbott <labbott@kernel.org> > Cc: Linus Torvalds <torvalds@linux-foundation.org> > Cc: Mauro Carvalho Chehab <mchehab@kernel.org> > Cc: Paolo Bonzini <pbonzini@redhat.com> > Cc: Peter Zijlstra <peterz@infradead.org> > Cc: Solar Designer <solar@openwall.com> > Cc: Thomas Gleixner <tglx@linutronix.de> > Cc: Thorsten Leemhuis <linux@leemhuis.info> > Cc: Tyler Hicks <tyhicks@linux.microsoft.com> > Cc: Will Deacon <will@kernel.org> > Cc: Willy Tarreau <w@1wt.eu> > Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com> > --- > Documentation/admin-guide/security-bugs.rst | 252 +++++++++++++------- > 1 file changed, 167 insertions(+), 85 deletions(-) > > v1 thread: > https://lore.kernel.org/all/20220531230309.9290-1-vegard.nossum@oracle.com/T/#u > > Updated rendered HTML: > https://vegard.github.io/security/Documentation/output/admin-guide/security-bugs-v2.html > > diff --git a/Documentation/admin-guide/security-bugs.rst b/Documentation/admin-guide/security-bugs.rst > index 82e29837d5898..c63eeb1e89ffd 100644 > --- a/Documentation/admin-guide/security-bugs.rst > +++ b/Documentation/admin-guide/security-bugs.rst
Thanks for investing time into fixing this aged document.
Two rather minor things come to my mind, but as you are touching that document anyway ...
- what sense does it make to have embargoed-hardware-issues.rst and security-bugs.rst live in different Documentation/ subdirectories (admin-guide/ vs process/)? It'd seem to make sense to me to have them in one common place?
- would it make sense to briefly reference embargoed-hardware-issues.rst somewhere in this text, to make the distinction as obvious as possible? It's referenced the other way around.
Thanks,
-- Jiri Kosina SUSE Labs
| |