From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([69.77.167.62] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1JSBCl-0004Nd-Fo for garchives@archives.gentoo.org; Thu, 21 Feb 2008 13:11:16 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id C2DE9E03EB; Thu, 21 Feb 2008 13:09:56 +0000 (UTC) Received: from wa-out-1112.google.com (wa-out-1112.google.com [209.85.146.178]) by pigeon.gentoo.org (Postfix) with ESMTP id 95F8AE027C for ; Thu, 21 Feb 2008 13:09:55 +0000 (UTC) Received: by wa-out-1112.google.com with SMTP id k34so28478wah.10 for ; Thu, 21 Feb 2008 05:09:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:references; bh=3ph1LsDIS5EtygoUBZL1vE6wasQwDLOBmK4LQeElIxw=; b=drDWBxdNmkhN6RTwchyZKObwDQdmCCOgp9NX2fRklSHkOLV4KOZULIW0V0gKTVtGAaLreh2wlPqsSNS/a7CL3oj5RInvcjk0fS1VHYNYjZchSU7FtM0qpV0n/Pdziki7VPYNtAzgtcWkegTJe5RccDRiq4/c43Mq970CffvTFXU= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:in-reply-to:mime-version:content-type:references; b=Tt/Tn2BwDKjhbDDRiJ26nQFd7+dkBkfZ41cUoUoZiqSKoe7p3Qnb4nOIEyLulbJr9uqYea2UfRvxmxzoT3UeicUG/k8wq3Z1gPQLsYZ11bl5sjL5ZVPKW+f7xe64ObmnJnIYea4LAtJMvdQSVKOpgYi649WVz1oULtmDNzBcMMw= Received: by 10.114.194.1 with SMTP id r1mr2731003waf.40.1203599394960; Thu, 21 Feb 2008 05:09:54 -0800 (PST) Received: by 10.114.179.15 with HTTP; Thu, 21 Feb 2008 05:09:54 -0800 (PST) Message-ID: <2d11f51c0802210509w770934c1wf52e3d6ce5d1d3a7@mail.gmail.com> Date: Thu, 21 Feb 2008 08:09:54 -0500 From: "Robert Joslyn" To: gentoo-security@lists.gentoo.org Subject: Re: [gentoo-security] Kernel Security + KISS In-Reply-To: <47BD458E.3010906@gmail.com> Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-security@lists.gentoo.org Reply-to: gentoo-security@lists.gentoo.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_3106_4415446.1203599394948" References: <200802180512.35888.rbu@gentoo.org> <200802201359.55663.sysadmin@tacticalbusinesspartners.com> <1203548143.26804.29.camel@media> <1203574802.6841.14.camel@notebook> <20080221070213.GA6385@quasar.las> <83c2b2e00802210114q1d5beba5gcaa478df808020d6@mail.gmail.com> <47BD458E.3010906@gmail.com> X-Archives-Salt: f46ad038-fa03-4a11-90c7-445be7c7c062 X-Archives-Hash: 4f4ed38f2fa6ff900b7bfeefe3fe03b4 ------=_Part_3106_4415446.1203599394948 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline I would like to help as well. I have limited C experience unfortunately, and most of that is programming PIC microcontrollers. Been using Gentoo fo= r years, and would love to give something back. Robert On Thu, Feb 21, 2008 at 4:34 AM, George Prowse wrote: > Im interested, no C knowledge but plenty of time, passed the dev exam > and a willingness to learn. It's been on my agenda for a long time. > > nick loeve wrote: > > I can help also... i have limited free time but am willing to put in > > some hours... > > > > I have medium C knowledge, reasonable kernel experience, and also a > > strong linux background > > > > On Thu, Feb 21, 2008 at 8:02 AM, Arthur Bispo de Castro > > wrote: > >> I'm interested... little C knowledge, very curious about kernel, stron= g > >> linux background... > >> > >> is there another prereq to join this? > >> > >> > >> > >> On Thu, Feb 21, 2008 at 04:20:02AM -0200, Juan Pablo Olivera wrote: > >> > I am interested too :) > >> > > >> > No C knowledge but strong linux background and very organized guy. > >> > > >> > On Thu, 2008-02-21 at 01:05 -0500, Casey Link wrote: > >> > > It would probably help if we knew how many people were interested= . > >> > > > >> > > I am. +1 > >> > > > >> > > Casey > >> > > > >> > > On Wed, Feb 20, 2008 at 10:16 PM, Eduardo Tongson < > propolice@gmail.com> wrote: > >> > > > Alright how do we proceed to get this team started. > >> > > > > >> > > > ed*eonsec > >> > > > > >> > > > > >> > > > > >> > > > On Thu, Feb 21, 2008 at 6:55 AM, Ned Ludd > wrote: > >> > > > > > >> > > > > > >> > > > > On Wed, 2008-02-20 at 13:59 -0500, Harlan Lieberman-Berg > wrote: > >> > > > > > On Sunday 17 February 2008 23:12:35 Robert Buchholz wrote= : > >> > > > > > > On Sunday, 17. February 2008, Eduardo Tongson wrote: > >> > > > > > > > What specific kernel knowledge is needed to get a > Kernel advisory up > >> > > > > > > > and running ? > >> > > > > > > > >> > > > > > > Between becoming aware of a vulnerability in Linux and > drafting an advisory > >> > > > > > > for one or all kernel sources comes the part where you > review which > >> > > > > > > versions of which kernel sources are affected and > unaffected. You also > >> > > > > > > need to pay attention to specifics of the added > patchsets, which might > >> > > > > > > duplicate vulnerabilities. > >> > > > > > > > >> > > > > > > Parts of the job can indeed be done without Kernel and = C > knowledge, but > >> > > > > > > some cannot. So if we draft a new kernel security > *team*, people without C > >> > > > > > > and kernel knowledge are helpful -- some others need to > have it, though. > >> > > > > > > > >> > > > > > > Robert > >> > > > > > > >> > > > > > To be honest, 99% of what is done in the kernel security > team can be done with > >> > > > > > no C knowledge at all. > >> > > > > > > >> > > > > > I'm not an expert C person - far from it - but I > eventually became the head of > >> > > > > > Kernel Security until I retired a few months ago. > >> > > > > > > >> > > > > > Most of it is bug handling. The major problem is a > social, not a technical > >> > > > > > one. Because of the manner in which our kernels are > organized, a single > >> > > > > > vulnerability involves checking upstream version numbers, > coordinating them > >> > > > > > into our downstream version numbers for all sources, > checking to see if the > >> > > > > > sources are effected, figuring out who to CC for the bugs= , > then harassing > >> > > > > > them until they do it. > >> > > > > > > >> > > > > > Unlike other security sources, any attempt to hardmask th= e > package is shutdown > >> > > > > > instantly. The chaos that would result from a kernel > hardmask, even one of > >> > > > > > the lesser used ones, caused me to only successfully orde= r > one over my entire > >> > > > > > career in Gentoo Kernsec... even though more around 30 > would have been > >> > > > > > needed. It is not infrequently that bugs will last six > months without any > >> > > > > > action coming about them, and users are blissfully > unaware. > >> > > > > > > >> > > > > > I am happy to give my input as the former head of Kernel > Security, but it is > >> > > > > > my personal opinion that any advances in kernel security > will require the > >> > > > > > full cooperation of security, and letting the head of > kernel security be able > >> > > > > > to actually enforce threats, as that seems to be the only > way bugs ever get > >> > > > > > resolved. Pleading didn't work - I tried. > >> > > > > > > >> > > > > > -Harlan Lieberman-Berg > >> > > > > > Gentoo Developer Emeritus > >> > > > > > >> > > > > > >> > > > > Every word of what you said is painfully true. The only way > to > >> > > > > accomplish this would be with an Iron Fist(fail) or a team > of ~15 guys > >> > > > > who do nothing but patch and push new kernels and the PR > that goes along > >> > > > > with them every few days. > >> > > > > -- > >> > > > > Ned Ludd > >> > > > > > >> > > > > > >> > > > > > >> > > > > -- > >> > > > > gentoo-security@lists.gentoo.org mailing list > >> > > > > > >> > > > > > >> > > > -- > >> > > > gentoo-security@lists.gentoo.org mailing list > >> > > > > >> > > > > >> > > >> > -- > >> > gentoo-security@lists.gentoo.org mailing list > >> > >> -- > >> Arthur Bispo de Castro > >> Laborat=F3rio de Administra=E7=E3o e Seguran=E7a (LAS/IC) > >> Universidade Estadual de Campinas (UNICAMP) > >> -- > >> > >> > >> gentoo-security@lists.gentoo.org mailing list > >> > >> > > > > > > > > -- > gentoo-security@lists.gentoo.org mailing list > > ------=_Part_3106_4415446.1203599394948 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline I would like to help as well.  I have limited C experience unfortunate= ly, and most of that is programming PIC microcontrollers.  Been using = Gentoo for years, and would love to give something back.


Robert<= br>

On Thu, Feb 21, 2008 at 4:34 AM, George Prow= se <cokehabit@gmail.com> w= rote:
Im interested, no C knowledge but plenty of time, passed the dev exam
and a willingness to learn. It's been on my agenda for a long time.

nick loeve wrote:
> I can help also... i have limited free time but am willing to put in > some hours...
>
> I have medium C knowledge, reasonable kernel experience, and also a > strong linux background
>
> On Thu, Feb 21, 2008 at 8:02 AM, Arthur Bispo de Castro
> <arthur@las.ic.unicamp.= br> wrote:
>> I'm interested... little C knowledge, very curious about kerne= l, strong
>>  linux background...
>>
>>  is there another prereq to join this?
>>
>>
>>
>>  On Thu, Feb 21, 2008 at 04:20:02AM -0200, Juan Pablo Olivera= wrote:
>>  > I am interested too :)
>>  >
>>  > No C knowledge but strong linux background and very org= anized guy.
>>  >
>>  > On Thu, 2008-02-21 at 01:05 -0500, Casey Link wrote: >>  > > It would probably help if we knew how many people = were interested.
>>  > >
>>  > > I am. +1
>>  > >
>>  > > Casey
>>  > >
>>  > > On Wed, Feb 20, 2008 at 10:16 PM, Eduardo Tongson = <propolice@gmail.com> wrot= e:
>>  > > > Alright how do we proceed to get this team st= arted.
>>  > > >
>>  > > >   ed*eonsec
>>  > > >
>>  > > >
>>  > > >
>>  > > >  On Thu, Feb 21, 2008 at 6:55 AM, Ned Lu= dd <solar@gentoo.org> wrote:<= br> >>  > > >  >
>>  > > >  >
>>  > > >  >  On Wed, 2008-02-20 at 13:59 = -0500, Harlan Lieberman-Berg wrote:
>>  > > >  >  > On Sunday 17 February 2= 008 23:12:35 Robert Buchholz wrote:
>>  > > >  >  > > On Sunday, 17. Feb= ruary 2008, Eduardo Tongson wrote:
>>  > > >  >  > > > What specific= kernel knowledge is needed to get a Kernel advisory up
>>  > > >  >  > > > and running ?=
>>  > > >  >  > >
>>  > > >  >  > > Between becoming a= ware of a vulnerability in Linux and drafting an advisory
>>  > > >  >  > > for one or all ker= nel sources comes the part where you review which
>>  > > >  >  > > versions of which = kernel sources are affected and unaffected. You also
>>  > > >  >  > > need to pay attent= ion to specifics of the added patchsets, which might
>>  > > >  >  > > duplicate vulnerab= ilities.
>>  > > >  >  > >
>>  > > >  >  > > Parts of the job c= an indeed be done without Kernel and C knowledge, but
>>  > > >  >  > > some cannot. So if= we draft a new kernel security *team*, people without C
>>  > > >  >  > > and kernel knowled= ge are helpful -- some others need to have it, though.
>>  > > >  >  > >
>>  > > >  >  > > Robert
>>  > > >  >  >
>>  > > >  >  > To be honest, 99% of wh= at is done in the kernel security team can be done with
>>  > > >  >  > no C knowledge at all.<= br> >>  > > >  >  >
>>  > > >  >  > I'm not an expert C= person - far from it - but I eventually became the head of
>>  > > >  >  > Kernel Security until I= retired a few months ago.
>>  > > >  >  >
>>  > > >  >  > Most of it is bug handl= ing.  The major problem is a social, not a technical
>>  > > >  >  > one.  Because of t= he manner in which our kernels are organized, a single
>>  > > >  >  > vulnerability involves = checking upstream version numbers, coordinating them
>>  > > >  >  > into our downstream ver= sion numbers for all sources, checking to see if the
>>  > > >  >  > sources are effected, f= iguring out who to CC for the bugs, then harassing
>>  > > >  >  > them until they do it.<= br> >>  > > >  >  >
>>  > > >  >  > Unlike other security s= ources, any attempt to hardmask the package is shutdown
>>  > > >  >  > instantly.  The ch= aos that would result from a kernel hardmask, even one of
>>  > > >  >  > the lesser used ones, c= aused me to only successfully order one over my entire
>>  > > >  >  > career in Gentoo Kernse= c... even though more around 30 would have been
>>  > > >  >  > needed.  It is not= infrequently that bugs will last six months without any
>>  > > >  >  > action coming about the= m, and users are blissfully unaware.
>>  > > >  >  >
>>  > > >  >  > I am happy to give my i= nput as the former head of Kernel Security, but it is
>>  > > >  >  > my personal opinion tha= t any advances in kernel security will require the
>>  > > >  >  > full cooperation of sec= urity, and letting the head of kernel security be able
>>  > > >  >  > to actually enforce thr= eats, as that seems to be the only way bugs ever get
>>  > > >  >  > resolved.  Pleadin= g didn't work - I tried.
>>  > > >  >  >
>>  > > >  >  > -Harlan Lieberman-Berg<= br> >>  > > >  >  > Gentoo Developer Emerit= us
>>  > > >  >
>>  > > >  >
>>  > > >  >  Every word of what you said = is painfully true. The only way to
>>  > > >  >  accomplish this would be wit= h an Iron Fist(fail) or a team of ~15 guys
>>  > > >  >  who do nothing but patch and= push new kernels and the PR that goes along
>>  > > >  >  with them every few days. >>  > > >  >  --
>>  > > >  >  Ned Ludd <solar@gentoo.org>
>>  > > >  >
>>  > > >  >
>>  > > >  >
>>  > > >  >  --
>>  > > >  >  gentoo-security@lists.gentoo.org mailing list >>  > > >  >
>>  > > >  >
>>  > > >  --
>>  > > >  gentoo-security@lists.gentoo.org mailing list
>>  > > >
>>  > > >
>>  >
>>  > --
>>  > gen= too-security@lists.gentoo.org mailing list
>>
>>  --
>>  Arthur Bispo de Castro
>>  Laborat=F3rio de Administra=E7=E3o e Seguran=E7a (LAS/IC) >>  Universidade Estadual de Campinas (UNICAMP)
>>  --
>>
>>
>> gentoo-securit= y@lists.gentoo.org mailing list
>>
>>
>
>
>

--
gentoo-security@lists.g= entoo.org mailing list


------=_Part_3106_4415446.1203599394948-- -- gentoo-security@lists.gentoo.org mailing list