Gentoo Archives: gentoo-security

From: Arthur Bispo de Castro <arthur@××××××××××××××.br>
To: gentoo-security@l.g.o
Subject: Re: [gentoo-security] Kernel Security + KISS
Date: Thu, 21 Feb 2008 07:03:35
Message-Id: 20080221070213.GA6385@quasar.las
In Reply to: Re: [gentoo-security] Kernel Security + KISS by Juan Pablo Olivera
1 I'm interested... little C knowledge, very curious about kernel, strong
2 linux background...
3
4 is there another prereq to join this?
5
6 On Thu, Feb 21, 2008 at 04:20:02AM -0200, Juan Pablo Olivera wrote:
7 > I am interested too :)
8 >
9 > No C knowledge but strong linux background and very organized guy.
10 >
11 > On Thu, 2008-02-21 at 01:05 -0500, Casey Link wrote:
12 > > It would probably help if we knew how many people were interested.
13 > >
14 > > I am. +1
15 > >
16 > > Casey
17 > >
18 > > On Wed, Feb 20, 2008 at 10:16 PM, Eduardo Tongson <propolice@×××××.com> wrote:
19 > > > Alright how do we proceed to get this team started.
20 > > >
21 > > > ed*eonsec
22 > > >
23 > > >
24 > > >
25 > > > On Thu, Feb 21, 2008 at 6:55 AM, Ned Ludd <solar@g.o> wrote:
26 > > > >
27 > > > >
28 > > > > On Wed, 2008-02-20 at 13:59 -0500, Harlan Lieberman-Berg wrote:
29 > > > > > On Sunday 17 February 2008 23:12:35 Robert Buchholz wrote:
30 > > > > > > On Sunday, 17. February 2008, Eduardo Tongson wrote:
31 > > > > > > > What specific kernel knowledge is needed to get a Kernel advisory up
32 > > > > > > > and running ?
33 > > > > > >
34 > > > > > > Between becoming aware of a vulnerability in Linux and drafting an advisory
35 > > > > > > for one or all kernel sources comes the part where you review which
36 > > > > > > versions of which kernel sources are affected and unaffected. You also
37 > > > > > > need to pay attention to specifics of the added patchsets, which might
38 > > > > > > duplicate vulnerabilities.
39 > > > > > >
40 > > > > > > Parts of the job can indeed be done without Kernel and C knowledge, but
41 > > > > > > some cannot. So if we draft a new kernel security *team*, people without C
42 > > > > > > and kernel knowledge are helpful -- some others need to have it, though.
43 > > > > > >
44 > > > > > > Robert
45 > > > > >
46 > > > > > To be honest, 99% of what is done in the kernel security team can be done with
47 > > > > > no C knowledge at all.
48 > > > > >
49 > > > > > I'm not an expert C person - far from it - but I eventually became the head of
50 > > > > > Kernel Security until I retired a few months ago.
51 > > > > >
52 > > > > > Most of it is bug handling. The major problem is a social, not a technical
53 > > > > > one. Because of the manner in which our kernels are organized, a single
54 > > > > > vulnerability involves checking upstream version numbers, coordinating them
55 > > > > > into our downstream version numbers for all sources, checking to see if the
56 > > > > > sources are effected, figuring out who to CC for the bugs, then harassing
57 > > > > > them until they do it.
58 > > > > >
59 > > > > > Unlike other security sources, any attempt to hardmask the package is shutdown
60 > > > > > instantly. The chaos that would result from a kernel hardmask, even one of
61 > > > > > the lesser used ones, caused me to only successfully order one over my entire
62 > > > > > career in Gentoo Kernsec... even though more around 30 would have been
63 > > > > > needed. It is not infrequently that bugs will last six months without any
64 > > > > > action coming about them, and users are blissfully unaware.
65 > > > > >
66 > > > > > I am happy to give my input as the former head of Kernel Security, but it is
67 > > > > > my personal opinion that any advances in kernel security will require the
68 > > > > > full cooperation of security, and letting the head of kernel security be able
69 > > > > > to actually enforce threats, as that seems to be the only way bugs ever get
70 > > > > > resolved. Pleading didn't work - I tried.
71 > > > > >
72 > > > > > -Harlan Lieberman-Berg
73 > > > > > Gentoo Developer Emeritus
74 > > > >
75 > > > >
76 > > > > Every word of what you said is painfully true. The only way to
77 > > > > accomplish this would be with an Iron Fist(fail) or a team of ~15 guys
78 > > > > who do nothing but patch and push new kernels and the PR that goes along
79 > > > > with them every few days.
80 > > > > --
81 > > > > Ned Ludd <solar@g.o>
82 > > > >
83 > > > >
84 > > > >
85 > > > > --
86 > > > > gentoo-security@l.g.o mailing list
87 > > > >
88 > > > >
89 > > > --
90 > > > gentoo-security@l.g.o mailing list
91 > > >
92 > > >
93 >
94 > --
95 > gentoo-security@l.g.o mailing list
96
97 --
98 Arthur Bispo de Castro
99 Laboratório de Administração e Segurança (LAS/IC)
100 Universidade Estadual de Campinas (UNICAMP)
101 --
102 gentoo-security@l.g.o mailing list

Replies

Subject Author
Re: [gentoo-security] Kernel Security + KISS nick loeve <trickie@×××××.com>
Re: [gentoo-security] Kernel Security + KISS Marcin Dylewski <marcin.dylewski@×××××××××.pl>