| 1 |
On Sunday 17 February 2008 23:12:35 Robert Buchholz wrote: |
| 2 |
> On Sunday, 17. February 2008, Eduardo Tongson wrote: |
| 3 |
> > What specific kernel knowledge is needed to get a Kernel advisory up |
| 4 |
> > and running ? |
| 5 |
> |
| 6 |
> Between becoming aware of a vulnerability in Linux and drafting an advisory |
| 7 |
> for one or all kernel sources comes the part where you review which |
| 8 |
> versions of which kernel sources are affected and unaffected. You also |
| 9 |
> need to pay attention to specifics of the added patchsets, which might |
| 10 |
> duplicate vulnerabilities. |
| 11 |
> |
| 12 |
> Parts of the job can indeed be done without Kernel and C knowledge, but |
| 13 |
> some cannot. So if we draft a new kernel security *team*, people without C |
| 14 |
> and kernel knowledge are helpful -- some others need to have it, though. |
| 15 |
> |
| 16 |
> Robert |
| 17 |
|
| 18 |
To be honest, 99% of what is done in the kernel security team can be done with |
| 19 |
no C knowledge at all. |
| 20 |
|
| 21 |
I'm not an expert C person - far from it - but I eventually became the head of |
| 22 |
Kernel Security until I retired a few months ago. |
| 23 |
|
| 24 |
Most of it is bug handling. The major problem is a social, not a technical |
| 25 |
one. Because of the manner in which our kernels are organized, a single |
| 26 |
vulnerability involves checking upstream version numbers, coordinating them |
| 27 |
into our downstream version numbers for all sources, checking to see if the |
| 28 |
sources are effected, figuring out who to CC for the bugs, then harassing |
| 29 |
them until they do it. |
| 30 |
|
| 31 |
Unlike other security sources, any attempt to hardmask the package is shutdown |
| 32 |
instantly. The chaos that would result from a kernel hardmask, even one of |
| 33 |
the lesser used ones, caused me to only successfully order one over my entire |
| 34 |
career in Gentoo Kernsec... even though more around 30 would have been |
| 35 |
needed. It is not infrequently that bugs will last six months without any |
| 36 |
action coming about them, and users are blissfully unaware. |
| 37 |
|
| 38 |
I am happy to give my input as the former head of Kernel Security, but it is |
| 39 |
my personal opinion that any advances in kernel security will require the |
| 40 |
full cooperation of security, and letting the head of kernel security be able |
| 41 |
to actually enforce threats, as that seems to be the only way bugs ever get |
| 42 |
resolved. Pleading didn't work - I tried. |
| 43 |
|
| 44 |
-Harlan Lieberman-Berg |
| 45 |
Gentoo Developer Emeritus |
| 46 |
-- |
| 47 |
gentoo-security@l.g.o mailing list |
Archives