Gentoo Archives: gentoo-security

From: Robert Joslyn <rjmars97@×××××.com>
To: gentoo-security@l.g.o
Subject: Re: [gentoo-security] Kernel Security + KISS
Date: Thu, 21 Feb 2008 13:11:16
Message-Id: 2d11f51c0802210509w770934c1wf52e3d6ce5d1d3a7@mail.gmail.com
In Reply to: Re: [gentoo-security] Kernel Security + KISS by George Prowse
I would like to help as well.  I have limited C experience unfortunately,
and most of that is programming PIC microcontrollers.  Been using Gentoo for
years, and would love to give something back.


Robert


On Thu, Feb 21, 2008 at 4:34 AM, George Prowse <cokehabit@×××××.com> wrote:

> Im interested, no C knowledge but plenty of time, passed the dev exam > and a willingness to learn. It's been on my agenda for a long time. > > nick loeve wrote: > > I can help also... i have limited free time but am willing to put in > > some hours... > > > > I have medium C knowledge, reasonable kernel experience, and also a > > strong linux background > > > > On Thu, Feb 21, 2008 at 8:02 AM, Arthur Bispo de Castro > > <arthur@××××××××××××××.br> wrote: > >> I'm interested... little C knowledge, very curious about kernel, strong > >> linux background... > >> > >> is there another prereq to join this? > >> > >> > >> > >> On Thu, Feb 21, 2008 at 04:20:02AM -0200, Juan Pablo Olivera wrote: > >> > I am interested too :) > >> > > >> > No C knowledge but strong linux background and very organized guy. > >> > > >> > On Thu, 2008-02-21 at 01:05 -0500, Casey Link wrote: > >> > > It would probably help if we knew how many people were interested. > >> > > > >> > > I am. +1 > >> > > > >> > > Casey > >> > > > >> > > On Wed, Feb 20, 2008 at 10:16 PM, Eduardo Tongson < > propolice@×××××.com> wrote: > >> > > > Alright how do we proceed to get this team started. > >> > > > > >> > > > ed*eonsec > >> > > > > >> > > > > >> > > > > >> > > > On Thu, Feb 21, 2008 at 6:55 AM, Ned Ludd <solar@g.o> > wrote: > >> > > > > > >> > > > > > >> > > > > On Wed, 2008-02-20 at 13:59 -0500, Harlan Lieberman-Berg > wrote: > >> > > > > > On Sunday 17 February 2008 23:12:35 Robert Buchholz wrote: > >> > > > > > > On Sunday, 17. February 2008, Eduardo Tongson wrote: > >> > > > > > > > What specific kernel knowledge is needed to get a > Kernel advisory up > >> > > > > > > > and running ? > >> > > > > > > > >> > > > > > > Between becoming aware of a vulnerability in Linux and > drafting an advisory > >> > > > > > > for one or all kernel sources comes the part where you > review which > >> > > > > > > versions of which kernel sources are affected and > unaffected. You also > >> > > > > > > need to pay attention to specifics of the added > patchsets, which might > >> > > > > > > duplicate vulnerabilities. > >> > > > > > > > >> > > > > > > Parts of the job can indeed be done without Kernel and C > knowledge, but > >> > > > > > > some cannot. So if we draft a new kernel security > *team*, people without C > >> > > > > > > and kernel knowledge are helpful -- some others need to > have it, though. > >> > > > > > > > >> > > > > > > Robert > >> > > > > > > >> > > > > > To be honest, 99% of what is done in the kernel security > team can be done with > >> > > > > > no C knowledge at all. > >> > > > > > > >> > > > > > I'm not an expert C person - far from it - but I > eventually became the head of > >> > > > > > Kernel Security until I retired a few months ago. > >> > > > > > > >> > > > > > Most of it is bug handling. The major problem is a > social, not a technical > >> > > > > > one. Because of the manner in which our kernels are > organized, a single > >> > > > > > vulnerability involves checking upstream version numbers, > coordinating them > >> > > > > > into our downstream version numbers for all sources, > checking to see if the > >> > > > > > sources are effected, figuring out who to CC for the bugs, > then harassing > >> > > > > > them until they do it. > >> > > > > > > >> > > > > > Unlike other security sources, any attempt to hardmask the > package is shutdown > >> > > > > > instantly. The chaos that would result from a kernel > hardmask, even one of > >> > > > > > the lesser used ones, caused me to only successfully order > one over my entire > >> > > > > > career in Gentoo Kernsec... even though more around 30 > would have been > >> > > > > > needed. It is not infrequently that bugs will last six > months without any > >> > > > > > action coming about them, and users are blissfully > unaware. > >> > > > > > > >> > > > > > I am happy to give my input as the former head of Kernel > Security, but it is > >> > > > > > my personal opinion that any advances in kernel security > will require the > >> > > > > > full cooperation of security, and letting the head of > kernel security be able > >> > > > > > to actually enforce threats, as that seems to be the only > way bugs ever get > >> > > > > > resolved. Pleading didn't work - I tried. > >> > > > > > > >> > > > > > -Harlan Lieberman-Berg > >> > > > > > Gentoo Developer Emeritus > >> > > > > > >> > > > > > >> > > > > Every word of what you said is painfully true. The only way > to > >> > > > > accomplish this would be with an Iron Fist(fail) or a team > of ~15 guys > >> > > > > who do nothing but patch and push new kernels and the PR > that goes along > >> > > > > with them every few days. > >> > > > > -- > >> > > > > Ned Ludd <solar@g.o> > >> > > > > > >> > > > > > >> > > > > > >> > > > > -- > >> > > > > gentoo-security@l.g.o mailing list > >> > > > > > >> > > > > > >> > > > -- > >> > > > gentoo-security@l.g.o mailing list > >> > > > > >> > > > > >> > > >> > -- > >> > gentoo-security@l.g.o mailing list > >> > >> -- > >> Arthur Bispo de Castro > >> Laboratório de Administração e Segurança (LAS/IC) > >> Universidade Estadual de Campinas (UNICAMP) > >> -- > >> > >> > >> gentoo-security@l.g.o mailing list > >> > >> > > > > > > > > -- > gentoo-security@l.g.o mailing list > >

Replies

Subject Author
Re: [gentoo-security] Kernel Security + KISS Casey Link <unnamedrambler@×××××.com>