From nobody Sat Apr 11 10:12:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EE645C6FA8E for ; Sun, 5 Mar 2023 22:02:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229933AbjCEWCS (ORCPT ); Sun, 5 Mar 2023 17:02:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58562 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229699AbjCEWCG (ORCPT ); Sun, 5 Mar 2023 17:02:06 -0500 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A74B5166C2; Sun, 5 Mar 2023 14:01:56 -0800 (PST) Received: from pps.filterd (m0246627.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 325JgEhd019526; Sun, 5 Mar 2023 22:00:35 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-type : content-transfer-encoding; s=corp-2022-7-12; bh=bjWeEMifOcD55Rxlec89GpiaL0XwVoZZhbZxR7kTiHY=; b=lrOk9QqK6PIN32ZZSJfCKjMMRAq5NoywosbiGgWoIPiX+r3NHypVKi/pK8G8vM4qD7mX QZT8n90uHgTUlkG2ycmbDYjZlQfJKhGwOQBmRcpdtou7ncr8on54x8RawKBVRxL8is4L 3sEa2cslcQc0jWJkIBZezHKy6xAzG9oD3K0H0SCW9HkM1F33JHYhBV7QrOzOMIzuH2Q/ dNDfRriMvgngQEHQ0ea3OTjNt37H2g4cw3eAK35cQtvgf87lSCTJFR9QvSWTn0+dDybX EC2Dpn15Q/sztBj9y8SgFVWrFAtps9GDhNU/JXyY6lEMoGs/TJipejUdBBcVi5O9vCes Dg== Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.appoci.oracle.com [138.1.114.2]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3p41561rr4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:35 +0000 Received: from pps.filterd (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 325I1ZH0023251; Sun, 5 Mar 2023 22:00:34 GMT Received: from pps.reinject (localhost [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3p4u040m80-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:34 +0000 Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 325M0Nr1013622; Sun, 5 Mar 2023 22:00:33 GMT Received: from t460.home (dhcp-10-175-35-7.vpn.oracle.com [10.175.35.7]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTP id 3p4u040ktj-2; Sun, 05 Mar 2023 22:00:33 +0000 From: Vegard Nossum To: Jonathan Corbet , linux-doc@vger.kernel.org, Jiri Kosina , Solar Designer , Will Deacon , Willy Tarreau Cc: Greg Kroah-Hartman , linux-kernel@vger.kernel.org, Amit Shah , Dave Hansen , David Woodhouse , "Gustavo A. R. Silva" , Kees Cook , Laura Abbott , Linus Torvalds , Mauro Carvalho Chehab , Paolo Bonzini , Peter Zijlstra , Thomas Gleixner , Thorsten Leemhuis , Tyler Hicks , Vegard Nossum , Jiri Kosina , Alex Shi , Yanteng Si , Hu Haowen , Federico Vaga , Tsugikazu Shibata , Minchan Kim , Jeimi Lee , Carlos Bilbao , Akira Yokosawa Subject: [PATCH v3 1/7] Documentation/security-bugs: move from admin-guide/ to process/ Date: Sun, 5 Mar 2023 23:00:04 +0100 Message-Id: <20230305220010.20895-2-vegard.nossum@oracle.com> X-Mailer: git-send-email 2.23.0.718.g5ad94255a8 In-Reply-To: <20230305220010.20895-1-vegard.nossum@oracle.com> References: <20230305220010.20895-1-vegard.nossum@oracle.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-05_12,2023-03-03_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxlogscore=999 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 malwarescore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303050192 X-Proofpoint-GUID: g0x6rYn1b-RDa9pCgqgx6CgD9j-XqeVE X-Proofpoint-ORIG-GUID: g0x6rYn1b-RDa9pCgqgx6CgD9j-XqeVE Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Jiri Kosina, Jonathan Corbet, and Willy Tarreau all expressed a desire to move this document under process/. Create a new section for security issues in the index and group it with embargoed-hardware-issues. I'm doing this at the start of the series to make all the subsequent changes show up in 'git blame'. Existing references were updated using: git grep -l security-bugs ':!Documentation/translations/' | xargs sed -i = 's|admin-guide/security-bugs|process/security-bugs|g' git grep -l security-bugs Documentation/translations/ | xargs sed -i 's|D= ocumentation/admin-guide/security-bugs|Documentation/process/security-bugs|= g' git grep -l security-bugs Documentation/translations/ | xargs sed -i '/Or= iginal:/s|\.\./admin-guide/security-bugs|\.\./process/security-bugs|g' Notably, the page is not moved in the translations (due to my lack of knowledge of these languages), but the translations have been updated to point to the new location of the original document where these references exist. Link: https://lore.kernel.org/all/nycvar.YFH.7.76.2206062326230.10851@cbobk= .fhfr.pm/ Suggested-by: Jiri Kosina Cc: Alex Shi Cc: Yanteng Si Cc: Hu Haowen Cc: Federico Vaga Cc: Tsugikazu Shibata Cc: Minchan Kim Cc: Jeimi Lee Cc: Carlos Bilbao Cc: Akira Yokosawa Signed-off-by: Vegard Nossum Acked-by: Carlos Bilbao Acked-by: Federico Vaga Reviewed-by: Akira Yokosawa Reviewed-by: Bagas Sanjaya Reviewed-by: Yanteng Si --- Documentation/admin-guide/index.rst | 1 - Documentation/admin-guide/reporting-issues.rst | 4 ++-- Documentation/process/howto.rst | 2 +- Documentation/process/index.rst | 9 ++++++++- Documentation/process/researcher-guidelines.rst | 2 +- Documentation/{admin-guide =3D> process}/security-bugs.rst | 0 Documentation/process/stable-kernel-rules.rst | 2 +- Documentation/process/submitting-patches.rst | 2 +- .../translations/it_IT/admin-guide/security-bugs.rst | 2 +- .../translations/it_IT/process/submitting-patches.rst | 2 +- Documentation/translations/ja_JP/howto.rst | 2 +- Documentation/translations/ko_KR/howto.rst | 2 +- Documentation/translations/sp_SP/howto.rst | 2 +- .../translations/sp_SP/process/submitting-patches.rst | 2 +- .../translations/zh_CN/admin-guide/security-bugs.rst | 2 +- Documentation/translations/zh_CN/process/howto.rst | 2 +- .../translations/zh_TW/admin-guide/security-bugs.rst | 2 +- Documentation/translations/zh_TW/process/howto.rst | 2 +- MAINTAINERS | 4 ++-- 19 files changed, 26 insertions(+), 20 deletions(-) rename Documentation/{admin-guide =3D> process}/security-bugs.rst (100%) diff --git a/Documentation/admin-guide/index.rst b/Documentation/admin-guid= e/index.rst index 0ad7e7ec0d27..09a563bbe3e7 100644 --- a/Documentation/admin-guide/index.rst +++ b/Documentation/admin-guide/index.rst @@ -36,7 +36,6 @@ problems and bugs in particular. =20 reporting-issues reporting-regressions - security-bugs bug-hunting bug-bisect tainted-kernels diff --git a/Documentation/admin-guide/reporting-issues.rst b/Documentation= /admin-guide/reporting-issues.rst index ec62151fe672..2fd5a030235a 100644 --- a/Documentation/admin-guide/reporting-issues.rst +++ b/Documentation/admin-guide/reporting-issues.rst @@ -395,7 +395,7 @@ might want to be aware of; it for example explains how = to add your issue to the list of tracked regressions, to ensure it won't fall through the cracks. =20 What qualifies as security issue is left to your judgment. Consider reading -Documentation/admin-guide/security-bugs.rst before proceeding, as it +Documentation/process/security-bugs.rst before proceeding, as it provides additional details how to best handle security issues. =20 An issue is a 'really severe problem' when something totally unacceptably = bad @@ -1269,7 +1269,7 @@ them when sending the report by mail. If you filed it= in a bug tracker, forward the report's text to these addresses; but on top of it put a small note wh= ere you mention that you filed it with a link to the ticket. =20 -See Documentation/admin-guide/security-bugs.rst for more information. +See Documentation/process/security-bugs.rst for more information. =20 =20 Duties after the report went out diff --git a/Documentation/process/howto.rst b/Documentation/process/howto.= rst index cb6abcb2b6d0..deb8235e20ff 100644 --- a/Documentation/process/howto.rst +++ b/Documentation/process/howto.rst @@ -138,7 +138,7 @@ required reading: philosophy and is very important for people moving to Linux from development on other Operating Systems. =20 - :ref:`Documentation/admin-guide/security-bugs.rst ` + :ref:`Documentation/process/security-bugs.rst ` If you feel you have found a security problem in the Linux kernel, please follow the steps in this document to help notify the kernel developers, and help solve the issue. diff --git a/Documentation/process/index.rst b/Documentation/process/index.= rst index d4b6217472b0..565df595152e 100644 --- a/Documentation/process/index.rst +++ b/Documentation/process/index.rst @@ -35,6 +35,14 @@ Below are the essential guides that every developer shou= ld read. kernel-enforcement-statement kernel-driver-statement =20 +For security issues, see: + +.. toctree:: + :maxdepth: 1 + + security-bugs + embargoed-hardware-issues + Other guides to the community that are of interest to most developers are: =20 .. toctree:: @@ -47,7 +55,6 @@ Other guides to the community that are of interest to mos= t developers are: submit-checklist kernel-docs deprecated - embargoed-hardware-issues maintainers researcher-guidelines =20 diff --git a/Documentation/process/researcher-guidelines.rst b/Documentatio= n/process/researcher-guidelines.rst index afc944e0e898..9fcfed3c350b 100644 --- a/Documentation/process/researcher-guidelines.rst +++ b/Documentation/process/researcher-guidelines.rst @@ -68,7 +68,7 @@ Before contributing, carefully read the appropriate docum= entation: * Documentation/process/development-process.rst * Documentation/process/submitting-patches.rst * Documentation/admin-guide/reporting-issues.rst -* Documentation/admin-guide/security-bugs.rst +* Documentation/process/security-bugs.rst =20 Then send a patch (including a commit log with all the details listed below) and follow up on any feedback from other developers. diff --git a/Documentation/admin-guide/security-bugs.rst b/Documentation/pr= ocess/security-bugs.rst similarity index 100% rename from Documentation/admin-guide/security-bugs.rst rename to Documentation/process/security-bugs.rst diff --git a/Documentation/process/stable-kernel-rules.rst b/Documentation/= process/stable-kernel-rules.rst index 2fd8aa593a28..51df1197d5ab 100644 --- a/Documentation/process/stable-kernel-rules.rst +++ b/Documentation/process/stable-kernel-rules.rst @@ -39,7 +39,7 @@ Procedure for submitting patches to the -stable tree =20 Security patches should not be handled (solely) by the -stable review process but should follow the procedures in - :ref:`Documentation/admin-guide/security-bugs.rst `. + :ref:`Documentation/process/security-bugs.rst `. =20 For all other submissions, choose one of the following procedures ----------------------------------------------------------------- diff --git a/Documentation/process/submitting-patches.rst b/Documentation/p= rocess/submitting-patches.rst index eac7167dce83..7b223f306efa 100644 --- a/Documentation/process/submitting-patches.rst +++ b/Documentation/process/submitting-patches.rst @@ -254,7 +254,7 @@ If you have a patch that fixes an exploitable security = bug, send that patch to security@kernel.org. For severe bugs, a short embargo may be considered to allow distributors to get the patch out to users; in such cases, obviously, the patch should not be sent to any public lists. See also -Documentation/admin-guide/security-bugs.rst. +Documentation/process/security-bugs.rst. =20 Patches that fix a severe bug in a released kernel should be directed toward the stable maintainers by putting a line like this:: diff --git a/Documentation/translations/it_IT/admin-guide/security-bugs.rst= b/Documentation/translations/it_IT/admin-guide/security-bugs.rst index 18a5822c7d9a..20994f4bfa31 100644 --- a/Documentation/translations/it_IT/admin-guide/security-bugs.rst +++ b/Documentation/translations/it_IT/admin-guide/security-bugs.rst @@ -1,6 +1,6 @@ .. include:: ../disclaimer-ita.rst =20 -:Original: :ref:`Documentation/admin-guide/security-bugs.rst ` +:Original: :ref:`Documentation/process/security-bugs.rst ` =20 .. _it_securitybugs: =20 diff --git a/Documentation/translations/it_IT/process/submitting-patches.rs= t b/Documentation/translations/it_IT/process/submitting-patches.rst index c2cfa0948b2b..167fce813032 100644 --- a/Documentation/translations/it_IT/process/submitting-patches.rst +++ b/Documentation/translations/it_IT/process/submitting-patches.rst @@ -272,7 +272,7 @@ embargo potrebbe essere preso in considerazione per dar= e il tempo alle distribuzioni di prendere la patch e renderla disponibile ai loro utenti; in questo caso, ovviamente, la patch non dovrebbe essere inviata su alcuna lista di discussione pubblica. Leggete anche -Documentation/admin-guide/security-bugs.rst. +Documentation/process/security-bugs.rst. =20 Patch che correggono bachi importanti su un kernel gi=C3=A0 rilasciato, do= vrebbero essere inviate ai manutentori dei kernel stabili aggiungendo la seguente r= iga:: diff --git a/Documentation/translations/ja_JP/howto.rst b/Documentation/tra= nslations/ja_JP/howto.rst index 9b0b3436dfcf..8d856ebe873c 100644 --- a/Documentation/translations/ja_JP/howto.rst +++ b/Documentation/translations/ja_JP/howto.rst @@ -167,7 +167,7 @@ linux-api@vger.kernel.org =E3=81=AB=E9=80=81=E3=82=8B= =E3=81=93=E3=81=A8=E3=82=92=E5=8B=A7=E3=82=81=E3=81=BE=E3=81=99=E3=80=82 =E3=81=93=E3=81=AE=E3=83=89=E3=82=AD=E3=83=A5=E3=83=A1=E3=83=B3=E3=83= =88=E3=81=AF Linux =E9=96=8B=E7=99=BA=E3=81=AE=E6=80=9D=E6=83=B3=E3=82=92= =E7=90=86=E8=A7=A3=E3=81=99=E3=82=8B=E3=81=AE=E3=81=AB=E9=9D=9E=E5=B8=B8=E3= =81=AB=E9=87=8D=E8=A6=81=E3=81=A7=E3=81=99=E3=80=82 =E3=81=9D=E3=81=97=E3=81=A6=E3=80=81=E4=BB=96=E3=81=AEOS=E3=81=A7=E3= =81=AE=E9=96=8B=E7=99=BA=E8=80=85=E3=81=8C Linux =E3=81=AB=E7=A7=BB=E3=82= =8B=E6=99=82=E3=81=AB=E3=81=A8=E3=81=A6=E3=82=82=E9=87=8D=E8=A6=81=E3=81=A7= =E3=81=99=E3=80=82 =20 - :ref:`Documentation/admin-guide/security-bugs.rst ` + :ref:`Documentation/process/security-bugs.rst ` =E3=82=82=E3=81=97 Linux =E3=82=AB=E3=83=BC=E3=83=8D=E3=83=AB=E3=81=A7= =E3=82=BB=E3=82=AD=E3=83=A5=E3=83=AA=E3=83=86=E3=82=A3=E5=95=8F=E9=A1=8C=E3= =82=92=E7=99=BA=E8=A6=8B=E3=81=97=E3=81=9F=E3=82=88=E3=81=86=E3=81=AB=E6=80= =9D=E3=81=A3=E3=81=9F=E3=82=89=E3=80=81=E3=81=93 =E3=81=AE=E3=83=89=E3=82=AD=E3=83=A5=E3=83=A1=E3=83=B3=E3=83=88=E3=81= =AE=E3=82=B9=E3=83=86=E3=83=83=E3=83=97=E3=81=AB=E5=BE=93=E3=81=A3=E3=81=A6= =E3=82=AB=E3=83=BC=E3=83=8D=E3=83=AB=E9=96=8B=E7=99=BA=E8=80=85=E3=81=AB=E9= =80=A3=E7=B5=A1=E3=81=97=E3=80=81=E5=95=8F=E9=A1=8C=E8=A7=A3=E6=B1=BA=E3=82= =92 =E6=94=AF=E6=8F=B4=E3=81=97=E3=81=A6=E3=81=8F=E3=81=A0=E3=81=95=E3=81= =84=E3=80=82 diff --git a/Documentation/translations/ko_KR/howto.rst b/Documentation/tra= nslations/ko_KR/howto.rst index 969e91a95bb0..34f14899c155 100644 --- a/Documentation/translations/ko_KR/howto.rst +++ b/Documentation/translations/ko_KR/howto.rst @@ -157,7 +157,7 @@ mtk.manpages@gmail.com=EC=9D=98 =EB=A9=94=EC=9D=B8=ED= =85=8C=EC=9D=B4=EB=84=88=EC=97=90=EA=B2=8C =EB=B3=B4=EB=82=BC =EA=B2=83=EC= =9D=84 =EA=B6=8C=EC=9E=A5=ED=95=9C=EB=8B=A4. =EB=A6=AC=EB=88=85=EC=8A=A4=EB=A1=9C =EC=A0=84=ED=96=A5=ED=95=98=EB=8A= =94 =EC=82=AC=EB=9E=8C=EB=93=A4=EC=97=90=EA=B2=8C=EB=8A=94 =EB=A7=A4=EC=9A= =B0 =EC=A4=91=EC=9A=94=ED=95=98=EB=8B=A4. =20 =20 - :ref:`Documentation/admin-guide/security-bugs.rst ` + :ref:`Documentation/process/security-bugs.rst ` =EC=97=AC=EB=9F=AC=EB=B6=84=EB=93=A4=EC=9D=B4 =EB=A6=AC=EB=88=85=EC=8A= =A4 =EC=BB=A4=EB=84=90=EC=9D=98 =EB=B3=B4=EC=95=88 =EB=AC=B8=EC=A0=9C=EB=A5= =BC =EB=B0=9C=EA=B2=AC=ED=96=88=EB=8B=A4=EA=B3=A0 =EC=83=9D=EA=B0=81=ED=95= =9C=EB=8B=A4=EB=A9=B4 =EC=9D=B4 =EB=AC=B8=EC=84=9C=EC=97=90 =EB=82=98=EC=98=A8 =EB=8B=A8=EA=B3=84=EC=97=90 =EB=94=B0=EB=9D=BC=EC= =84=9C =EC=BB=A4=EB=84=90 =EA=B0=9C=EB=B0=9C=EC=9E=90=EB=93=A4=EC=97=90=EA= =B2=8C =EC=95=8C=EB=A6=AC=EA=B3=A0 =EA=B7=B8 =EB=AC=B8=EC=A0=9C=EB=A5=BC = =ED=95=B4=EA=B2=B0=ED=95=A0 =EC=88=98 =EC=9E=88=EB=8F=84=EB=A1=9D =EB=8F=84=EC=99=80 =EB=8B=AC=EB=9D=BC. diff --git a/Documentation/translations/sp_SP/howto.rst b/Documentation/tra= nslations/sp_SP/howto.rst index f9818d687b54..f1629738b49d 100644 --- a/Documentation/translations/sp_SP/howto.rst +++ b/Documentation/translations/sp_SP/howto.rst @@ -135,7 +135,7 @@ de obligada lectura: de Linux y es muy importante para las personas que se mudan a Linux tras desarrollar otros sistemas operativos. =20 - :ref:`Documentation/admin-guide/security-bugs.rst ` + :ref:`Documentation/process/security-bugs.rst ` Si cree que ha encontrado un problema de seguridad en el kernel de Linux, siga los pasos de este documento para ayudar a notificar a los desarrolladores del kernel y ayudar a resolver el problema. diff --git a/Documentation/translations/sp_SP/process/submitting-patches.rs= t b/Documentation/translations/sp_SP/process/submitting-patches.rst index bf95ceb5e865..c2757d9ab216 100644 --- a/Documentation/translations/sp_SP/process/submitting-patches.rst +++ b/Documentation/translations/sp_SP/process/submitting-patches.rst @@ -276,7 +276,7 @@ parche a security@kernel.org. Para errores graves, se d= ebe mantener un poco de discreci=C3=B3n y permitir que los distribuidores entreguen el par= che a los usuarios; en esos casos, obviamente, el parche no debe enviarse a ninguna lista p=C3=BAblica. Revise tambi=C3=A9n -Documentation/admin-guide/security-bugs.rst. +Documentation/process/security-bugs.rst. =20 Los parches que corrigen un error grave en un kernel en uso deben dirigirse hacia los maintainers estables poniendo una l=C3=ADnea como esta:: diff --git a/Documentation/translations/zh_CN/admin-guide/security-bugs.rst= b/Documentation/translations/zh_CN/admin-guide/security-bugs.rst index b8120391755d..d6b8f8a4e7f6 100644 --- a/Documentation/translations/zh_CN/admin-guide/security-bugs.rst +++ b/Documentation/translations/zh_CN/admin-guide/security-bugs.rst @@ -1,6 +1,6 @@ .. include:: ../disclaimer-zh_CN.rst =20 -:Original: :doc:`../../../admin-guide/security-bugs` +:Original: :doc:`../../../process/security-bugs` =20 :=E8=AF=91=E8=80=85: =20 diff --git a/Documentation/translations/zh_CN/process/howto.rst b/Documenta= tion/translations/zh_CN/process/howto.rst index 10254751df6a..cc47be356dd3 100644 --- a/Documentation/translations/zh_CN/process/howto.rst +++ b/Documentation/translations/zh_CN/process/howto.rst @@ -125,7 +125,7 @@ Linux=E5=86=85=E6=A0=B8=E4=BB=A3=E7=A0=81=E4=B8=AD=E5= =8C=85=E5=90=AB=E6=9C=89=E5=A4=A7=E9=87=8F=E7=9A=84=E6=96=87=E6=A1=A3=E3=80= =82=E8=BF=99=E4=BA=9B=E6=96=87=E6=A1=A3=E5=AF=B9=E4=BA=8E=E5=AD=A6=E4=B9=A0= =E5=A6=82=E4=BD=95=E4=B8=8E =E8=BF=99=E7=AF=87=E6=96=87=E6=A1=A3=E5=AF=B9=E4=BA=8E=E7=90=86=E8=A7= =A3Linux=E7=9A=84=E5=BC=80=E5=8F=91=E5=93=B2=E5=AD=A6=E8=87=B3=E5=85=B3=E9= =87=8D=E8=A6=81=E3=80=82=E5=AF=B9=E4=BA=8E=E5=B0=86=E5=BC=80=E5=8F=91=E5=B9= =B3=E5=8F=B0=E4=BB=8E=E5=85=B6=E4=BB=96=E6=93=8D=E4=BD=9C=E7=B3=BB =E7=BB=9F=E8=BD=AC=E7=A7=BB=E5=88=B0Linux=E7=9A=84=E4=BA=BA=E6=9D=A5= =E8=AF=B4=E4=B9=9F=E5=BE=88=E9=87=8D=E8=A6=81=E3=80=82 =20 - :ref:`Documentation/admin-guide/security-bugs.rst ` + :ref:`Documentation/process/security-bugs.rst ` =E5=A6=82=E6=9E=9C=E4=BD=A0=E8=AE=A4=E4=B8=BA=E8=87=AA=E5=B7=B1=E5=8F= =91=E7=8E=B0=E4=BA=86Linux=E5=86=85=E6=A0=B8=E7=9A=84=E5=AE=89=E5=85=A8=E6= =80=A7=E9=97=AE=E9=A2=98=EF=BC=8C=E8=AF=B7=E6=A0=B9=E6=8D=AE=E8=BF=99=E7=AF= =87=E6=96=87=E6=A1=A3=E4=B8=AD=E7=9A=84=E6=AD=A5=E9=AA=A4=E6=9D=A5 =E6=8F=90=E9=86=92=E5=85=B6=E4=BB=96=E5=86=85=E6=A0=B8=E5=BC=80=E5=8F= =91=E8=80=85=E5=B9=B6=E5=B8=AE=E5=8A=A9=E8=A7=A3=E5=86=B3=E8=BF=99=E4=B8=AA= =E9=97=AE=E9=A2=98=E3=80=82 =20 diff --git a/Documentation/translations/zh_TW/admin-guide/security-bugs.rst= b/Documentation/translations/zh_TW/admin-guide/security-bugs.rst index eed260ef0c37..15f8e9005071 100644 --- a/Documentation/translations/zh_TW/admin-guide/security-bugs.rst +++ b/Documentation/translations/zh_TW/admin-guide/security-bugs.rst @@ -2,7 +2,7 @@ =20 .. include:: ../disclaimer-zh_TW.rst =20 -:Original: :doc:`../../../admin-guide/security-bugs` +:Original: :doc:`../../../process/security-bugs` =20 :=E8=AD=AF=E8=80=85: =20 diff --git a/Documentation/translations/zh_TW/process/howto.rst b/Documenta= tion/translations/zh_TW/process/howto.rst index 8fb8edcaee66..ea2f468d3e58 100644 --- a/Documentation/translations/zh_TW/process/howto.rst +++ b/Documentation/translations/zh_TW/process/howto.rst @@ -128,7 +128,7 @@ Linux=E5=85=A7=E6=A0=B8=E4=BB=A3=E7=A2=BC=E4=B8=AD=E5= =8C=85=E5=90=AB=E6=9C=89=E5=A4=A7=E9=87=8F=E7=9A=84=E6=96=87=E6=AA=94=E3=80= =82=E9=80=99=E4=BA=9B=E6=96=87=E6=AA=94=E5=B0=8D=E6=96=BC=E5=AD=B8=E7=BF=92= =E5=A6=82=E4=BD=95=E8=88=87 =E9=80=99=E7=AF=87=E6=96=87=E6=AA=94=E5=B0=8D=E6=96=BC=E7=90=86=E8=A7= =A3Linux=E7=9A=84=E9=96=8B=E7=99=BC=E5=93=B2=E5=AD=B8=E8=87=B3=E9=97=9C=E9= =87=8D=E8=A6=81=E3=80=82=E5=B0=8D=E6=96=BC=E5=B0=87=E9=96=8B=E7=99=BC=E5=B9= =B3=E5=8F=B0=E5=BE=9E=E5=85=B6=E4=BB=96=E6=93=8D=E4=BD=9C=E7=B3=BB =E7=B5=B1=E8=BD=89=E7=A7=BB=E5=88=B0Linux=E7=9A=84=E4=BA=BA=E4=BE=86= =E8=AA=AA=E4=B9=9F=E5=BE=88=E9=87=8D=E8=A6=81=E3=80=82 =20 - :ref:`Documentation/admin-guide/security-bugs.rst ` + :ref:`Documentation/process/security-bugs.rst ` =E5=A6=82=E6=9E=9C=E4=BD=A0=E8=AA=8D=E7=88=B2=E8=87=AA=E5=B7=B1=E7=99= =BC=E7=8F=BE=E4=BA=86Linux=E5=85=A7=E6=A0=B8=E7=9A=84=E5=AE=89=E5=85=A8=E6= =80=A7=E5=95=8F=E9=A1=8C=EF=BC=8C=E8=AB=8B=E6=A0=B9=E6=93=9A=E9=80=99=E7=AF= =87=E6=96=87=E6=AA=94=E4=B8=AD=E7=9A=84=E6=AD=A5=E9=A9=9F=E4=BE=86 =E6=8F=90=E9=86=92=E5=85=B6=E4=BB=96=E5=85=A7=E6=A0=B8=E9=96=8B=E7=99= =BC=E8=80=85=E4=B8=A6=E5=B9=AB=E5=8A=A9=E8=A7=A3=E6=B1=BA=E9=80=99=E5=80=8B= =E5=95=8F=E9=A1=8C=E3=80=82 =20 diff --git a/MAINTAINERS b/MAINTAINERS index b0db911207ba..ed84d41353a7 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -73,7 +73,7 @@ Tips for patch submitters and ideally, should come with a patch proposal. Please do not send automated reports to this list either. Such bugs will be handled better and faster in the usual public places. See - Documentation/admin-guide/security-bugs.rst for details. + Documentation/process/security-bugs.rst for details. =20 8. Happy hacking. =20 @@ -18807,7 +18807,7 @@ F: include/uapi/linux/sed* SECURITY CONTACT M: Security Officers S: Supported -F: Documentation/admin-guide/security-bugs.rst +F: Documentation/process/security-bugs.rst =20 SECURITY SUBSYSTEM M: Paul Moore --=20 2.40.0.rc1.2.gd15644fe02 From nobody Sat Apr 11 10:12:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A6CF0C6FA8E for ; Sun, 5 Mar 2023 22:02:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229743AbjCEWB6 (ORCPT ); Sun, 5 Mar 2023 17:01:58 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57976 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229753AbjCEWBo (ORCPT ); Sun, 5 Mar 2023 17:01:44 -0500 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7C89C1025B; Sun, 5 Mar 2023 14:01:43 -0800 (PST) Received: from pps.filterd (m0333521.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 325LvtUB020022; Sun, 5 Mar 2023 22:00:42 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=corp-2022-7-12; bh=2m8H1ke5jWQAt4IxFD9cHEaOxnH7XK15MYG59dTVxBA=; b=lnWapAxQhx6qROlmQNLILRj3Lyaenfxxspvjkim7ogFdWZ2BVpHZ92h6GxENzpnZ7TkT RcrG8EWdtfztZCe8fJFgsP512afTzaUEvQTTXv7lUtqSWjFMY/EG8hwM4ObqeYsvDYDV wVilh1tRS1XFfvSTNefoHeFvbVHLrvibotjS6K4yGF2ElqQ3m1SVG3/n9qx4DwWrjqNQ L51UQh6G/L00tVu7PDywEiU0JQ5rv/gW7jHI0mPwdaXLATz46yVOJ390d6CG/U8u3z+q KOA5wuZQIgnIGKGCHpvCEbWxvzeP48pzjg2AyfrjNEtL+qhQBW1PAv515d9tfEvCoUSH eg== Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.appoci.oracle.com [138.1.114.2]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3p418xss7n-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:41 +0000 Received: from pps.filterd (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 325IAIjd023468; Sun, 5 Mar 2023 22:00:40 GMT Received: from pps.reinject (localhost [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3p4u040mb8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:40 +0000 Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 325M0Nr3013622; Sun, 5 Mar 2023 22:00:40 GMT Received: from t460.home (dhcp-10-175-35-7.vpn.oracle.com [10.175.35.7]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTP id 3p4u040ktj-3; Sun, 05 Mar 2023 22:00:39 +0000 From: Vegard Nossum To: Jonathan Corbet , linux-doc@vger.kernel.org, Jiri Kosina , Solar Designer , Will Deacon , Willy Tarreau Cc: Greg Kroah-Hartman , linux-kernel@vger.kernel.org, Amit Shah , Dave Hansen , David Woodhouse , "Gustavo A. R. Silva" , Kees Cook , Laura Abbott , Linus Torvalds , Mauro Carvalho Chehab , Paolo Bonzini , Peter Zijlstra , Thomas Gleixner , Thorsten Leemhuis , Tyler Hicks , Vegard Nossum Subject: [PATCH v3 2/7] Documentation/security-bugs: misc. improvements Date: Sun, 5 Mar 2023 23:00:05 +0100 Message-Id: <20230305220010.20895-3-vegard.nossum@oracle.com> X-Mailer: git-send-email 2.23.0.718.g5ad94255a8 In-Reply-To: <20230305220010.20895-1-vegard.nossum@oracle.com> References: <20230305220010.20895-1-vegard.nossum@oracle.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-05_12,2023-03-03_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxlogscore=999 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 malwarescore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303050192 X-Proofpoint-GUID: U5MPE3nB2NxnvuXxJgZF8zImAwqkISXj X-Proofpoint-ORIG-GUID: U5MPE3nB2NxnvuXxJgZF8zImAwqkISXj Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" This mostly just clarifies things and moves a few things around in preparation for the subsequent changes. Most notably, pull the "security@kernel.org" address up into the first paragraph as this the most vital piece of information in the whole document. Also fix a few markup issues. Signed-off-by: Vegard Nossum Reviewed-by: Bagas Sanjaya --- Documentation/process/security-bugs.rst | 37 ++++++++++++++----------- 1 file changed, 21 insertions(+), 16 deletions(-) diff --git a/Documentation/process/security-bugs.rst b/Documentation/proces= s/security-bugs.rst index 82e29837d589..f1326d4e9718 100644 --- a/Documentation/process/security-bugs.rst +++ b/Documentation/process/security-bugs.rst @@ -1,36 +1,41 @@ .. _securitybugs: =20 -Security bugs -=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D +Reporting security bugs +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =20 Linux kernel developers take security very seriously. As such, we'd like to know when a security bug is found so that it can be fixed and disclosed as quickly as possible. Please report security bugs to the -Linux kernel security team. +Linux kernel security team at security@kernel.org, henceforth +"the security list". This is a closed list of trusted developers who +will help verify the bug report and develop a patch in case none was +already proposed. =20 -Contact -------- +While the security list is closed, the security team may bring in extra +help from the relevant maintainers to understand and fix the security +vulnerability. =20 -The Linux kernel security team can be contacted by email at -. This is a private list of security officers -who will help verify the bug report and develop and release a fix. -If you already have a fix, please include it with your report, as -that can speed up the process considerably. It is possible that the -security team will bring in extra help from area maintainers to -understand and fix the security vulnerability. +Note that the main interest of the kernel security list is in getting +bugs fixed and getting patches reviewed, tested, and merged; CVE +assignment, disclosure to distributions, and public disclosure happen on +different lists with different people. + +Contacting the security list +---------------------------- =20 As it is with any bug, the more information provided the easier it will be to diagnose and fix. Please review the procedure outlined in -'Documentation/admin-guide/reporting-issues.rst' if you are unclear about = what +Documentation/admin-guide/reporting-issues.rst if you are unclear about wh= at information is helpful. Any exploit code is very helpful and will not be released without consent from the reporter unless it has already been -made public. +made public. Reporters are encouraged to propose patches, participate in = the +discussions of a fix, and test patches. =20 Please send plain text emails without attachments where possible. It is much harder to have a context-quoted discussion about a complex issue if all the details are hidden away in attachments. Think of it like= a -:doc:`regular patch submission <../process/submitting-patches>` -(even if you don't have a patch yet): describe the problem and impact, list +regular patch submission (see Documentation/process/submitting-patches.rst) +even if you don't have a patch yet; describe the problem and impact, list reproduction steps, and follow it with a proposed fix, all in plain text. =20 Disclosure and embargoed information --=20 2.40.0.rc1.2.gd15644fe02 From nobody Sat Apr 11 10:12:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8AF38C6FA8E for ; Sun, 5 Mar 2023 22:01:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229755AbjCEWBw (ORCPT ); Sun, 5 Mar 2023 17:01:52 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57966 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229636AbjCEWBn (ORCPT ); Sun, 5 Mar 2023 17:01:43 -0500 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 10BECCDE9; Sun, 5 Mar 2023 14:01:42 -0800 (PST) Received: from pps.filterd (m0246629.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 325LjBdc030101; Sun, 5 Mar 2023 22:00:48 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=corp-2022-7-12; bh=s5QEM3O9yco3rfSMLPvmSRUwpK8LPcoIhYEXAZCgp2Q=; b=cB/utHz/zVlpMJsBcOrRJmkT+ohGekJrNDV5Hl+nGcxETn9+GdYyeq58OnSHdV8X3861 n/XmL8nFQy6UGVABYgYC220JxJ2lJn8vPTbfnm0un6cwWQ1zqU7J2AWpB/Dl262L60Bg +/+bpu0E0pVxhONQjiOpc9aUeYMBhX7EqF8oD4+MkhUqt8SRFFxP5RSBPo2sH4FacT3s VS82tQp0zY8NWMKFegKM2NZh0Q44aXC0FnFCS0OjTBqXjdP3iYcMqGAzKJ6Vsj1FJ+pA iT/JcjRhK+0BjAJommzGAokqTIJdIDXpDcBRQ66q/HXpsAyURxbCsRlm1kYNnGBRjTna Pw== Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.appoci.oracle.com [138.1.114.2]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3p4161srk7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:47 +0000 Received: from pps.filterd (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 325IHbd4024351; Sun, 5 Mar 2023 22:00:47 GMT Received: from pps.reinject (localhost [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3p4u040me5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:47 +0000 Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 325M0Nr5013622; Sun, 5 Mar 2023 22:00:46 GMT Received: from t460.home (dhcp-10-175-35-7.vpn.oracle.com [10.175.35.7]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTP id 3p4u040ktj-4; Sun, 05 Mar 2023 22:00:46 +0000 From: Vegard Nossum To: Jonathan Corbet , linux-doc@vger.kernel.org, Jiri Kosina , Solar Designer , Will Deacon , Willy Tarreau Cc: Greg Kroah-Hartman , linux-kernel@vger.kernel.org, Amit Shah , Dave Hansen , David Woodhouse , "Gustavo A. R. Silva" , Kees Cook , Laura Abbott , Linus Torvalds , Mauro Carvalho Chehab , Paolo Bonzini , Peter Zijlstra , Thomas Gleixner , Thorsten Leemhuis , Tyler Hicks , Vegard Nossum Subject: [PATCH v3 3/7] Documentation/security-bugs: improve security list section Date: Sun, 5 Mar 2023 23:00:06 +0100 Message-Id: <20230305220010.20895-4-vegard.nossum@oracle.com> X-Mailer: git-send-email 2.23.0.718.g5ad94255a8 In-Reply-To: <20230305220010.20895-1-vegard.nossum@oracle.com> References: <20230305220010.20895-1-vegard.nossum@oracle.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-05_12,2023-03-03_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxlogscore=999 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 malwarescore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303050192 X-Proofpoint-GUID: nrEHFdUaOsNn5k35GpBZd05EQv--aiOV X-Proofpoint-ORIG-GUID: nrEHFdUaOsNn5k35GpBZd05EQv--aiOV Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Make this section about the security list easier to parse by: 1) reordering the content to make more sense, 2) adding "paragraph names" to make it visually easier to find exactly the information that you need for a given step (this will also be applied to the other sections for consistency in subsequent patches), 3) pulling some of the information that is relevant to contacting security@kernel.org specifically into the section about that list. The remaining sections are about CVE assignment, coordinated disclosure, etc., which are things the security list _doesn't_ deal with. (These sections will be expanded and clarified in subsequent patches.) This patch is not meant to introduce any semantic changes, so in case of a dispute the previous version will be authoritative. Link: https://lore.kernel.org/all/20220601031254.GB26318@1wt.eu/ Link: https://lore.kernel.org/all/20220607090726.GB32282@willie-the-truck/ Cc: Willy Tarreau Cc: Will Deacon Signed-off-by: Vegard Nossum Reviewed-by: Bagas Sanjaya --- Documentation/process/security-bugs.rst | 76 ++++++++++++------------- 1 file changed, 35 insertions(+), 41 deletions(-) diff --git a/Documentation/process/security-bugs.rst b/Documentation/proces= s/security-bugs.rst index f1326d4e9718..fb156d146c42 100644 --- a/Documentation/process/security-bugs.rst +++ b/Documentation/process/security-bugs.rst @@ -31,42 +31,42 @@ be released without consent from the reporter unless it= has already been made public. Reporters are encouraged to propose patches, participate in = the discussions of a fix, and test patches. =20 -Please send plain text emails without attachments where possible. -It is much harder to have a context-quoted discussion about a complex -issue if all the details are hidden away in attachments. Think of it like= a -regular patch submission (see Documentation/process/submitting-patches.rst) -even if you don't have a patch yet; describe the problem and impact, list -reproduction steps, and follow it with a proposed fix, all in plain text. +**Disclosure.** Once a robust patch or patchset has been developed, the +release process starts. The security list strongly prefers to have these +posted for review and testing on public mailing lists and merged into the +appropriate public git repository as soon as possible. However, you or an +affected party may request that the patch be withheld for some days; as a +rule, the maximum is 7 calendar days. An exceptional extension to 14 +calendar days is possible if it is agreed that the criticality of the bug +requires more time. The only valid reason for deferring the publication +of a fix is to accomodate the logistics of QA and large scale rollouts +which require release coordination. + +Please note that although a fix is public, there may still be value in +withholding the details of its security relevance and/or how to exploit +it for another while; see below for when and how to properly disclose +the security impact of your findings publicly. + +**List rules.** Please send plain text emails without attachments where +possible. It is much harder to have a context-quoted discussion about a +complex issue if all the details are hidden away in attachments. Think +of it like regular patch submission (see +Documentation/process/submitting-patches.rst) even if you don't have a +patch yet; describe the problem and impact, list reproduction steps, and +follow it with a proposed fix, all in plain text. + +**Confidentiality.** While embargoed information may be shared with +trusted individuals in order to develop a fix, such information will not +be published alongside the fix or on any other disclosure channel +without the permission of the reporter. This includes but is not +limited to the original bug report and followup discussions (if any), +exploits, CVE information or the identity of the reporter. All such +other information submitted to the security list and any follow-up +discussions of the report are treated confidentially even after the +embargo has been lifted, in perpetuity. =20 -Disclosure and embargoed information ------------------------------------- - -The security list is not a disclosure channel. For that, see Coordination -below. - -Once a robust fix has been developed, the release process starts. Fixes -for publicly known bugs are released immediately. - -Although our preference is to release fixes for publicly undisclosed bugs -as soon as they become available, this may be postponed at the request of -the reporter or an affected party for up to 7 calendar days from the start -of the release process, with an exceptional extension to 14 calendar days -if it is agreed that the criticality of the bug requires more time. The -only valid reason for deferring the publication of a fix is to accommodate -the logistics of QA and large scale rollouts which require release -coordination. - -While embargoed information may be shared with trusted individuals in -order to develop a fix, such information will not be published alongside -the fix or on any other disclosure channel without the permission of the -reporter. This includes but is not limited to the original bug report -and followup discussions (if any), exploits, CVE information or the -identity of the reporter. - -In other words our only interest is in getting bugs fixed. All other -information submitted to the security list and any followup discussions -of the report are treated confidentially even after the embargo has been -lifted, in perpetuity. +The Linux kernel security team is not a formal body and therefore unable +to enter any non-disclosure agreements. =20 Coordination ------------ @@ -93,9 +93,3 @@ assigned ahead of public disclosure, they will need to co= ntact the private linux-distros list, described above. When such a CVE identifier is known before a patch is provided, it is desirable to mention it in the commit message if the reporter agrees. - -Non-disclosure agreements -------------------------- - -The Linux kernel security team is not a formal body and therefore unable -to enter any non-disclosure agreements. --=20 2.40.0.rc1.2.gd15644fe02 From nobody Sat Apr 11 10:12:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61BFCC61DA4 for ; Sun, 5 Mar 2023 22:02:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229834AbjCEWCY (ORCPT ); Sun, 5 Mar 2023 17:02:24 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58650 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229932AbjCEWCH (ORCPT ); Sun, 5 Mar 2023 17:02:07 -0500 Received: from mx0b-00069f02.pphosted.com (mx0b-00069f02.pphosted.com [205.220.177.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6291D199D8; Sun, 5 Mar 2023 14:01:58 -0800 (PST) Received: from pps.filterd (m0246632.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 325LvTMH004167; Sun, 5 Mar 2023 22:00:54 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=corp-2022-7-12; bh=3x2IB5WMGDPKO44R1fstih3EObkOoy7v9hScUddrClo=; b=lGQ4t8w0S/jxZuyK9DHUQGBV0K+JKgoJ6hbXwpxQ77A4neO8YFrByUK8fd62dQYgnyw4 4j6HDXyhZhOV9bTlIn3qLFDhSAB/dfJUZSGCtm0+juKdO/MbSDNWGgpnNd1+HoHF9CqH MYi4gVFH1X+YJvhYWF9CL3ekaPSa14VCNgpuFFoF2jeEAQ3iUFMNPPiUtbpxOtxSDwgt Yxmu+6yq94sRdjZewBsGLs1Cb9Tnp55+gS65EI0btySSzkgSPnH6VF2hfS1nZXKaSpM2 NuT+LU9guDBo9bnt/991cTuLqQNW5lYTZQ0MqmkqCmD6/LSa1iKuu/PQUs75jSzDziXd 8w== Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.appoci.oracle.com [138.1.114.2]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3p417c9rjf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:53 +0000 Received: from pps.filterd (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 325IAIji023468; Sun, 5 Mar 2023 22:00:52 GMT Received: from pps.reinject (localhost [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3p4u040mgh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:52 +0000 Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 325M0Nr7013622; Sun, 5 Mar 2023 22:00:51 GMT Received: from t460.home (dhcp-10-175-35-7.vpn.oracle.com [10.175.35.7]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTP id 3p4u040ktj-5; Sun, 05 Mar 2023 22:00:51 +0000 From: Vegard Nossum To: Jonathan Corbet , linux-doc@vger.kernel.org, Jiri Kosina , Solar Designer , Will Deacon , Willy Tarreau Cc: Greg Kroah-Hartman , linux-kernel@vger.kernel.org, Amit Shah , Dave Hansen , David Woodhouse , "Gustavo A. R. Silva" , Kees Cook , Laura Abbott , Linus Torvalds , Mauro Carvalho Chehab , Paolo Bonzini , Peter Zijlstra , Thomas Gleixner , Thorsten Leemhuis , Tyler Hicks , Vegard Nossum Subject: [PATCH v3 4/7] Documentation/security-bugs: add linux-distros and oss-security sections Date: Sun, 5 Mar 2023 23:00:07 +0100 Message-Id: <20230305220010.20895-5-vegard.nossum@oracle.com> X-Mailer: git-send-email 2.23.0.718.g5ad94255a8 In-Reply-To: <20230305220010.20895-1-vegard.nossum@oracle.com> References: <20230305220010.20895-1-vegard.nossum@oracle.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-05_12,2023-03-03_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxlogscore=999 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 malwarescore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303050192 X-Proofpoint-GUID: pVldTcCYvm2QtnxvReBedPNPIgluSSxC X-Proofpoint-ORIG-GUID: pVldTcCYvm2QtnxvReBedPNPIgluSSxC Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" The existing information about CVE assignment requests and coordinated disclosure fits much better in these new sections, since that's what these lists are for. Keep just a reminder in the security list section. Signed-off-by: Vegard Nossum Reviewed-by: Bagas Sanjaya --- Documentation/process/security-bugs.rst | 92 ++++++++++++++++++------- 1 file changed, 67 insertions(+), 25 deletions(-) diff --git a/Documentation/process/security-bugs.rst b/Documentation/proces= s/security-bugs.rst index fb156d146c42..2dd6569a7abb 100644 --- a/Documentation/process/security-bugs.rst +++ b/Documentation/process/security-bugs.rst @@ -31,6 +31,10 @@ be released without consent from the reporter unless it = has already been made public. Reporters are encouraged to propose patches, participate in = the discussions of a fix, and test patches. =20 +The security team does not assign CVEs, nor does it require them for repor= ts +or fixes. CVEs may be requested when the issue is reported to the +linux-distros list. + **Disclosure.** Once a robust patch or patchset has been developed, the release process starts. The security list strongly prefers to have these posted for review and testing on public mailing lists and merged into the @@ -68,28 +72,66 @@ embargo has been lifted, in perpetuity. The Linux kernel security team is not a formal body and therefore unable to enter any non-disclosure agreements. =20 -Coordination ------------- - -Fixes for sensitive bugs, such as those that might lead to privilege -escalations, may need to be coordinated with the private - mailing list so that distribution vendors -are well prepared to issue a fixed kernel upon public disclosure of the -upstream fix. Distros will need some time to test the proposed patch and -will generally request at least a few days of embargo, and vendor update -publication prefers to happen Tuesday through Thursday. When appropriate, -the security team can assist with this coordination, or the reporter can -include linux-distros from the start. In this case, remember to prefix -the email Subject line with "[vs]" as described in the linux-distros wiki: - - -CVE assignment --------------- - -The security team does not normally assign CVEs, nor do we require them -for reports or fixes, as this can needlessly complicate the process and -may delay the bug handling. If a reporter wishes to have a CVE identifier -assigned ahead of public disclosure, they will need to contact the private -linux-distros list, described above. When such a CVE identifier is known -before a patch is provided, it is desirable to mention it in the commit -message if the reporter agrees. +Once a patch has been developed, you are encouraged to contact the +linux-distros list. + +Contacting the linux-distros list +--------------------------------- + +Fixes for particularly sensitive bugs (such as those that might lead to +privilege escalations) may need to be coordinated with the private +linux-distros mailing list (linux-distros@vs.openwall.org) so that +distribution vendors are well prepared to release a fixed kernel as soon as +possible after the public disclosure of the upstream fix. This includes +verifying the reported issue, testing proposed fixes, developing a fix (if +none is known yet), and backporting to older kernels and other versions. + +The linux-distros list can also help with assigning a CVE for your issue. + +**Disclosure.** The linux-distros list has a strict policy of requiring +reporters to post about the security issue on oss-security within 14 +calendar days of the list being contacted regardless of whether a patch is +available or not. It is therefore preferable that you don't send your +initial bug report to the linux-distros list unless you already have a pat= ch +for the issue. + +**List rules.** The main rules to be aware of when contacting the +linux-distros list are: + +* Don't post about issues that are already public. If your issue has a + public patch, but the security impact is not generally known, then you m= ay + still post about it. + +* The submitter can suggest an embargo end-date, but as a rule, embargoes + should not be longer than 7 calendar days, or at most 14 calendar days in + exceptional cases. Keep in mind that vendors may prefer to release new + kernel packages and/or updates Tuesday through Thursday. + +* When the embargo ends, the issue must be disclosed immediately on the + oss-security list (see below). + +* Prefix your subject with the string "[vs]" to avoid getting rejected by + the spam filter. + +For the full list of rules, see: +https://oss-security.openwall.org/wiki/mailing-lists/distros#list-policy-a= nd-instructions-for-reporters + +**Confidentiality.** Please note that, as opposed to the security list, any +and all material submitted to the list must be made public once the securi= ty +issue is publicly disclosed, so please do not post information to the +linux-distros list that cannot be made public. + +Contacting the oss-security list +-------------------------------- + +When your security issue is public, or you wish to make your issue public, +you can write to the oss-security list (oss-security@lists.openwall.com). +This is a public list (anybody can subscribe and view the list archives) a= nd +it is not restricted to Linux kernel issues. + +The oss-security list typically does not assign CVEs or accept requests for +CVE assignments. + +**List rules.** Please do not cross-post to other lists when writing to th= is +list. Make sure to read the other list rules before posting: +https://oss-security.openwall.org/wiki/mailing-lists/oss-security. --=20 2.40.0.rc1.2.gd15644fe02 From nobody Sat Apr 11 10:12:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 315AEC61DA4 for ; Sun, 5 Mar 2023 22:02:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229912AbjCEWCK (ORCPT ); Sun, 5 Mar 2023 17:02:10 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58096 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229905AbjCEWBz (ORCPT ); Sun, 5 Mar 2023 17:01:55 -0500 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 53F1715C87; Sun, 5 Mar 2023 14:01:52 -0800 (PST) Received: from pps.filterd (m0246629.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 325Li8bh029218; Sun, 5 Mar 2023 22:00:59 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=corp-2022-7-12; bh=ZJ90aWPPj9zyH+6Oh/z2dY9oamLu7+DAooQEywdRR2k=; b=SICo2nL9tZx9cte4XlAj+zXinR5gu7L7nDGiZsK8gB2yCxqc/MD1yufrXT9uZYOPKnXx +kabGXjEbYVYBo7oIYHQOJNNrBX6oAxjhb0f4SctHcTpL/fvfV4tXE3Qig71GOJngOnt hZO5f95QELZ1nWInN4XUbaUKJDbEegsUCDKAUbhNb+IVAM5ZW05xT1CyiB9AMtH2h7Kx nwOJzzJh/U7vlX7ClFBLepvhVtoyEe+TLM1PpiEVtmvHcZzH3jBKdfpuKbkrKPK0Zdv2 Fi8minNpOTrSGA7Fya98weBgO1IIviN6OAmUOJ0BkMviBs1PNSSu968sP+PicSCUEkhy wQ== Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.appoci.oracle.com [138.1.114.2]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3p4161srk8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:59 +0000 Received: from pps.filterd (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 325IJ9Aj023424; Sun, 5 Mar 2023 22:00:58 GMT Received: from pps.reinject (localhost [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3p4u040mjx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:00:58 +0000 Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 325M0Nr9013622; Sun, 5 Mar 2023 22:00:58 GMT Received: from t460.home (dhcp-10-175-35-7.vpn.oracle.com [10.175.35.7]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTP id 3p4u040ktj-6; Sun, 05 Mar 2023 22:00:57 +0000 From: Vegard Nossum To: Jonathan Corbet , linux-doc@vger.kernel.org, Jiri Kosina , Solar Designer , Will Deacon , Willy Tarreau Cc: Greg Kroah-Hartman , linux-kernel@vger.kernel.org, Amit Shah , Dave Hansen , David Woodhouse , "Gustavo A. R. Silva" , Kees Cook , Laura Abbott , Linus Torvalds , Mauro Carvalho Chehab , Paolo Bonzini , Peter Zijlstra , Thomas Gleixner , Thorsten Leemhuis , Tyler Hicks , Vegard Nossum Subject: [PATCH v3 5/7] Documentation/security-bugs: add table of lists Date: Sun, 5 Mar 2023 23:00:08 +0100 Message-Id: <20230305220010.20895-6-vegard.nossum@oracle.com> X-Mailer: git-send-email 2.23.0.718.g5ad94255a8 In-Reply-To: <20230305220010.20895-1-vegard.nossum@oracle.com> References: <20230305220010.20895-1-vegard.nossum@oracle.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-05_12,2023-03-03_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxlogscore=999 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 malwarescore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303050192 X-Proofpoint-GUID: N7-WzzRgDuS3YD56U5kcF6iEdSapv_G- X-Proofpoint-ORIG-GUID: N7-WzzRgDuS3YD56U5kcF6iEdSapv_G- Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Give an overview of the full process the start of the document. This makes it clear 1) in what order the lists should be contacted, and 2) the purpose of each list. Thanks to Jonathan Corbet and Mauro Carvalho Chehab for providing the readable markup for the table. Link: https://lore.kernel.org/all/20220604014317.79eb23db@sal.lan/ Suggested-by: Jonathan Corbet Suggested-by: Mauro Carvalho Chehab Signed-off-by: Vegard Nossum Reviewed-by: Bagas Sanjaya --- Documentation/process/security-bugs.rst | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/Documentation/process/security-bugs.rst b/Documentation/proces= s/security-bugs.rst index 2dd6569a7abb..61742dcfea50 100644 --- a/Documentation/process/security-bugs.rst +++ b/Documentation/process/security-bugs.rst @@ -18,7 +18,26 @@ vulnerability. Note that the main interest of the kernel security list is in getting bugs fixed and getting patches reviewed, tested, and merged; CVE assignment, disclosure to distributions, and public disclosure happen on -different lists with different people. +different lists with different people, as described below. + +Here is a quick overview of the various lists: + + =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + List address Open? Purpose Members + =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + security@kernel.org no | Reporting Trusted kernel + | Patch development developers + ------------------------------- ----- ------------------- --------------- + linux-distros@vs.openwall.org no | Coordination Distribution + | CVE assignment representatives + | Backporting + | Testing + ------------------------------- ----- ------------------- --------------- + oss-security@lists.openwall.com yes | Disclosure General public + =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + +The following sections give a step-by-step guide to reporting and +disclosure. =20 Contacting the security list ---------------------------- --=20 2.40.0.rc1.2.gd15644fe02 From nobody Sat Apr 11 10:12:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0FB34C6FA99 for ; Sun, 5 Mar 2023 22:02:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229829AbjCEWCU (ORCPT ); Sun, 5 Mar 2023 17:02:20 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58636 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229927AbjCEWCH (ORCPT ); Sun, 5 Mar 2023 17:02:07 -0500 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D223C1969F; Sun, 5 Mar 2023 14:01:57 -0800 (PST) Received: from pps.filterd (m0246627.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 325LU3P0022560; Sun, 5 Mar 2023 22:01:04 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=corp-2022-7-12; bh=K4J/PSEjpfD1bARxkY3stp5xTVHHyV6U8fEH33L8wKY=; b=LwKkKp8YcJMTi58DlbwGfKmn5JRhDCFCsEes3ju2Hbs/AH6kvI3gJ7Q8ynoV/nsEqVzI 1A1n3BRFoXqsug8qJF3pa0y1a38S7StDfswvCV0Sov+DYSgoLbQw3sgssTZZdvIuX7Bs 3IuVuWpYiKpFMmBIGbxMn/cLq7jsqviodszzc9YdCihx6gH+nD2LCzwb4CmoR8ZoCKGk miXRUOVJGHJjCwQm5zW6XwOr6gbx94m3kmCYjpCh2+92z2MsldgQMAVmRjN/N7W+wfeP +ax9jkwf9yadE+ArvOJFQlpW5GmWdwBe0YzFWs2NrM7FnZMMHt05zbHHqPAp9l5dE8HZ 6g== Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.appoci.oracle.com [138.1.114.2]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3p41561rre-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:01:04 +0000 Received: from pps.filterd (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 325I2GKT023367; Sun, 5 Mar 2023 22:01:03 GMT Received: from pps.reinject (localhost [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3p4u040mmc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:01:03 +0000 Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 325M0NrB013622; Sun, 5 Mar 2023 22:01:03 GMT Received: from t460.home (dhcp-10-175-35-7.vpn.oracle.com [10.175.35.7]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTP id 3p4u040ktj-7; Sun, 05 Mar 2023 22:01:02 +0000 From: Vegard Nossum To: Jonathan Corbet , linux-doc@vger.kernel.org, Jiri Kosina , Solar Designer , Will Deacon , Willy Tarreau Cc: Greg Kroah-Hartman , linux-kernel@vger.kernel.org, Amit Shah , Dave Hansen , David Woodhouse , "Gustavo A. R. Silva" , Kees Cook , Laura Abbott , Linus Torvalds , Mauro Carvalho Chehab , Paolo Bonzini , Peter Zijlstra , Thomas Gleixner , Thorsten Leemhuis , Tyler Hicks , Vegard Nossum , Jiri Kosina Subject: [PATCH v3 6/7] Documentation/security-bugs: clarify hardware vs. software vulnerabilities Date: Sun, 5 Mar 2023 23:00:09 +0100 Message-Id: <20230305220010.20895-7-vegard.nossum@oracle.com> X-Mailer: git-send-email 2.23.0.718.g5ad94255a8 In-Reply-To: <20230305220010.20895-1-vegard.nossum@oracle.com> References: <20230305220010.20895-1-vegard.nossum@oracle.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-05_12,2023-03-03_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxlogscore=999 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 malwarescore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303050192 X-Proofpoint-GUID: pZOQdTeOzVF_YsAwqYS63qIc2SWXfctH X-Proofpoint-ORIG-GUID: pZOQdTeOzVF_YsAwqYS63qIc2SWXfctH Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" We should emphasize the fact that we have a separate document for reporting hardware vulnerabilities. Link: https://lore.kernel.org/all/nycvar.YFH.7.76.2206062326230.10851@cbobk= .fhfr.pm/ Suggested-by: Jiri Kosina Signed-off-by: Vegard Nossum Reviewed-by: Bagas Sanjaya --- Documentation/process/security-bugs.rst | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Documentation/process/security-bugs.rst b/Documentation/proces= s/security-bugs.rst index 61742dcfea50..7bd59587332a 100644 --- a/Documentation/process/security-bugs.rst +++ b/Documentation/process/security-bugs.rst @@ -15,6 +15,10 @@ While the security list is closed, the security team may= bring in extra help from the relevant maintainers to understand and fix the security vulnerability. =20 +The security list is mainly for software vulnerabilities. For hardware +security vulnerabilities, see +Documentation/process/embargoed-hardware-issues.rst instead. + Note that the main interest of the kernel security list is in getting bugs fixed and getting patches reviewed, tested, and merged; CVE assignment, disclosure to distributions, and public disclosure happen on --=20 2.40.0.rc1.2.gd15644fe02 From nobody Sat Apr 11 10:12:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 79D6CC61DA4 for ; Sun, 5 Mar 2023 22:02:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229911AbjCEWCp (ORCPT ); Sun, 5 Mar 2023 17:02:45 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59116 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229947AbjCEWCf (ORCPT ); Sun, 5 Mar 2023 17:02:35 -0500 Received: from mx0b-00069f02.pphosted.com (mx0b-00069f02.pphosted.com [205.220.177.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3BB6B166DA; Sun, 5 Mar 2023 14:02:07 -0800 (PST) Received: from pps.filterd (m0246630.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 325KWTxZ008283; Sun, 5 Mar 2023 22:01:10 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=corp-2022-7-12; bh=lOlMiJgwc+kBqQXXTCcgaFuxE3qu5j6thK/9P2DSJx4=; b=zSrye9ymLu00GaO+u0li0nC+/tmt9DptGSP+v6plVBabrP6Vn4euoW80iFL4SDNYj9U8 xFHTaXdSTzFW+muJ9Q5FFRSINa6vbXFyRlzZtM+ggVHyWWDn/BF2vWl+t/SCyAV3ihiG HdyMzR1ZuZhUN3IztBx6Xuig62CPDueXWm+SnUQ8CPvOSCd1iegXmw/x61v58EkVhp4w gQrpAbPn1BpeWhVUm5vcimBftLSMk6JBuE8Rlt777CFO1lPLty+FWyKGQiP/0s9aoqHs StEkFyuAhlq6r6jtOCADTa07ip6K2NZq7OQifiVfMZIWGOdRGT5Er0/TgOFjaazF51nA UA== Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.appoci.oracle.com [138.1.114.2]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3p4180sr34-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:01:09 +0000 Received: from pps.filterd (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 325I8Al5023260; Sun, 5 Mar 2023 22:01:08 GMT Received: from pps.reinject (localhost [127.0.0.1]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3p4u040mpe-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 05 Mar 2023 22:01:08 +0000 Received: from phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 325M0NrD013622; Sun, 5 Mar 2023 22:01:08 GMT Received: from t460.home (dhcp-10-175-35-7.vpn.oracle.com [10.175.35.7]) by phxpaimrmta01.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTP id 3p4u040ktj-8; Sun, 05 Mar 2023 22:01:07 +0000 From: Vegard Nossum To: Jonathan Corbet , linux-doc@vger.kernel.org, Jiri Kosina , Solar Designer , Will Deacon , Willy Tarreau Cc: Greg Kroah-Hartman , linux-kernel@vger.kernel.org, Amit Shah , Dave Hansen , David Woodhouse , "Gustavo A. R. Silva" , Kees Cook , Laura Abbott , Linus Torvalds , Mauro Carvalho Chehab , Paolo Bonzini , Peter Zijlstra , Thomas Gleixner , Thorsten Leemhuis , Tyler Hicks , Vegard Nossum Subject: [PATCH v3 7/7] Documentation/security-bugs: document document design Date: Sun, 5 Mar 2023 23:00:10 +0100 Message-Id: <20230305220010.20895-8-vegard.nossum@oracle.com> X-Mailer: git-send-email 2.23.0.718.g5ad94255a8 In-Reply-To: <20230305220010.20895-1-vegard.nossum@oracle.com> References: <20230305220010.20895-1-vegard.nossum@oracle.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-03-05_12,2023-03-03_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxlogscore=999 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 malwarescore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2303050192 X-Proofpoint-ORIG-GUID: G2DtmlHrWbALHEC_iI446HGKZlSc_dr1 X-Proofpoint-GUID: G2DtmlHrWbALHEC_iI446HGKZlSc_dr1 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" I think there is value in expressing the high-level design of this document so that it will not get lost with future revisions. This section is an rST comment and will not be part of rendered documentation (e.g. the html version). Link: https://lore.kernel.org/all/87ilpk5wsi.fsf@meer.lwn.net/ Signed-off-by: Vegard Nossum Reviewed-by: Bagas Sanjaya --- Documentation/process/security-bugs.rst | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/Documentation/process/security-bugs.rst b/Documentation/proces= s/security-bugs.rst index 7bd59587332a..8d9adc02cd49 100644 --- a/Documentation/process/security-bugs.rst +++ b/Documentation/process/security-bugs.rst @@ -158,3 +158,24 @@ CVE assignments. **List rules.** Please do not cross-post to other lists when writing to th= is list. Make sure to read the other list rules before posting: https://oss-security.openwall.org/wiki/mailing-lists/oss-security. + +.. + If you modify this document, please consider the following: + =20 + 1) The most important information should be at the top (preferably in + the opening paragraph). This means contacting ; + if somebody doesn't read any further than that, at least the security + team will have the report. + =20 + 2) Make the differences between the lists extremely clear. The old + version did make an attempt at this, but the lines were not drawn + clearly enough. + =20 + 3) Emphasize some of the posting rules which can be confusing to new + people (e.g. the fact that posting to linux-distros means you must + propose an embargo date and that this cannot under any circumstances + be more than 14 days). + =20 + 4) The document should be a "step-by-step process" as much as possible, + so that you can use it as a guide while reporting an issue instead of + having to search back and forth for the thing you're looking for. --=20 2.40.0.rc1.2.gd15644fe02