public inbox for gentoo-security@lists.gentoo.org
 help / color / mirror / Atom feed
From: Juan Pablo Olivera <jolivera@ucu.edu.uy>
To: gentoo-security@lists.gentoo.org
Subject: Re: [gentoo-security] Kernel Security + KISS
Date: Thu, 21 Feb 2008 04:20:02 -0200	[thread overview]
Message-ID: <1203574802.6841.14.camel@notebook> (raw)
In-Reply-To: <fb3727060802202205n1e86c89es3a37034cc1abb240@mail.gmail.com>

I am interested too :)

No C knowledge but strong linux background and very organized guy.

On Thu, 2008-02-21 at 01:05 -0500, Casey Link wrote:
> It would probably help if we knew how many people were interested.
> 
> I am. +1
> 
> Casey
> 
> On Wed, Feb 20, 2008 at 10:16 PM, Eduardo Tongson <propolice@gmail.com> wrote:
> > Alright how do we proceed to get this team started.
> >
> >   ed*eonsec
> >
> >
> >
> >  On Thu, Feb 21, 2008 at 6:55 AM, Ned Ludd <solar@gentoo.org> wrote:
> >  >
> >  >
> >  >  On Wed, 2008-02-20 at 13:59 -0500, Harlan Lieberman-Berg wrote:
> >  >  > On Sunday 17 February 2008 23:12:35 Robert Buchholz wrote:
> >  >  > > On Sunday, 17. February 2008, Eduardo Tongson wrote:
> >  >  > > > What specific kernel knowledge is needed to get a Kernel advisory up
> >  >  > > > and running ?
> >  >  > >
> >  >  > > Between becoming aware of a vulnerability in Linux and drafting an advisory
> >  >  > > for one or all kernel sources comes the part where you review which
> >  >  > > versions of which kernel sources are affected and unaffected. You also
> >  >  > > need to pay attention to specifics of the added patchsets, which might
> >  >  > > duplicate vulnerabilities.
> >  >  > >
> >  >  > > Parts of the job can indeed be done without Kernel and C knowledge, but
> >  >  > > some cannot. So if we draft a new kernel security *team*, people without C
> >  >  > > and kernel knowledge are helpful -- some others need to have it, though.
> >  >  > >
> >  >  > > Robert
> >  >  >
> >  >  > To be honest, 99% of what is done in the kernel security team can be done with
> >  >  > no C knowledge at all.
> >  >  >
> >  >  > I'm not an expert C person - far from it - but I eventually became the head of
> >  >  > Kernel Security until I retired a few months ago.
> >  >  >
> >  >  > Most of it is bug handling.  The major problem is a social, not a technical
> >  >  > one.  Because of the manner in which our kernels are organized, a single
> >  >  > vulnerability involves checking upstream version numbers, coordinating them
> >  >  > into our downstream version numbers for all sources, checking to see if the
> >  >  > sources are effected, figuring out who to CC for the bugs, then harassing
> >  >  > them until they do it.
> >  >  >
> >  >  > Unlike other security sources, any attempt to hardmask the package is shutdown
> >  >  > instantly.  The chaos that would result from a kernel hardmask, even one of
> >  >  > the lesser used ones, caused me to only successfully order one over my entire
> >  >  > career in Gentoo Kernsec... even though more around 30 would have been
> >  >  > needed.  It is not infrequently that bugs will last six months without any
> >  >  > action coming about them, and users are blissfully unaware.
> >  >  >
> >  >  > I am happy to give my input as the former head of Kernel Security, but it is
> >  >  > my personal opinion that any advances in kernel security will require the
> >  >  > full cooperation of security, and letting the head of kernel security be able
> >  >  > to actually enforce threats, as that seems to be the only way bugs ever get
> >  >  > resolved.  Pleading didn't work - I tried.
> >  >  >
> >  >  > -Harlan Lieberman-Berg
> >  >  > Gentoo Developer Emeritus
> >  >
> >  >
> >  >  Every word of what you said is painfully true. The only way to
> >  >  accomplish this would be with an Iron Fist(fail) or a team of ~15 guys
> >  >  who do nothing but patch and push new kernels and the PR that goes along
> >  >  with them every few days.
> >  >  --
> >  >  Ned Ludd <solar@gentoo.org>
> >  >
> >  >
> >  >
> >  >  --
> >  >  gentoo-security@lists.gentoo.org mailing list
> >  >
> >  >
> >  --
> >  gentoo-security@lists.gentoo.org mailing list
> >
> >

-- 
gentoo-security@lists.gentoo.org mailing list



  reply	other threads:[~2008-02-21  6:20 UTC|newest]

Thread overview: 28+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2008-02-16 22:57 [gentoo-security] Kernel Security + KISS Casey Link
2008-02-17  0:42 ` Calum
2008-02-17 17:46 ` Sune Kloppenborg Jeppesen
2008-02-17 21:43   ` Eduardo Tongson
2008-02-18  4:12     ` Robert Buchholz
2008-02-20 18:59       ` Harlan Lieberman-Berg
2008-02-20 19:28         ` C. Bergström
2008-02-20 22:55         ` Ned Ludd
2008-02-21  3:16           ` Eduardo Tongson
2008-02-21  6:05             ` Casey Link
2008-02-21  6:20               ` Juan Pablo Olivera [this message]
2008-02-21  7:02                 ` Arthur Bispo de Castro
2008-02-21  9:14                   ` nick loeve
2008-02-21  9:34                     ` George Prowse
2008-02-21 13:09                       ` Robert Joslyn
2008-02-21 13:35                         ` Casey Link
2008-02-21 13:52                           ` Eduardo Tongson
2008-02-21 16:22                             ` George Prowse
2008-02-21 19:28                               ` doppelgaenger
2008-02-22  2:26                                 ` Eduardo Tongson
2008-02-22  3:55                                   ` Casey Link
2008-02-23  0:48                                     ` Marc Riemer
2008-02-24 13:43                                     ` Sune Kloppenborg Jeppesen
2008-02-21  9:30                   ` Marcin Dylewski
2008-02-21  9:54             ` Peter Hjalmarsson
2008-02-21 12:35               ` Eduardo Tongson
2008-02-21 13:32                 ` Sune Kloppenborg Jeppesen
2008-02-25 18:10 ` Simon Zehntner

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1203574802.6841.14.camel@notebook \
    --to=jolivera@ucu.edu.uy \
    --cc=gentoo-security@lists.gentoo.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox