From mboxrd@z Thu Jan 1 00:00:00 1970
Received: from pigeon.gentoo.org ([69.77.167.62] helo=lists.gentoo.org)
by finch.gentoo.org with esmtp (Exim 4.60)
(envelope-from <gentoo-security+bounces-826-garchives=archives.gentoo.org@lists.gentoo.org>)
id 1JS1w6-0004fx-VM
for garchives@archives.gentoo.org; Thu, 21 Feb 2008 03:17:27 +0000
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
by pigeon.gentoo.org (Postfix) with SMTP id 3ED2AE0650;
Thu, 21 Feb 2008 03:16:42 +0000 (UTC)
Received: from wx-out-0506.google.com (wx-out-0506.google.com [66.249.82.225])
by pigeon.gentoo.org (Postfix) with ESMTP id 90CE1E046B
for <gentoo-security@lists.gentoo.org>; Thu, 21 Feb 2008 03:16:41 +0000 (UTC)
Received: by wx-out-0506.google.com with SMTP id h30so9076474wxd.10
for <gentoo-security@lists.gentoo.org>; Wed, 20 Feb 2008 19:16:41 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma;
h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
bh=cDhWXtkLa+YGseVjeQGn86z/0kNq+nn/Ag1M7ISd2Qw=;
b=AS/DOgteX75TrrjJcNuQq1GCK3Na1bbo+jH/RAoqCYCvdEE6njJfoZQJ8M7uuGuX1BuXBaLGK5bePBx1eK6+4gNq5fMEvht9UtQxdcn6OX6uwzDqJbp8cs/tpyAAZzm7c3LA20qlsQqQy0kkYAhiMiGPKL3aHiQ3MmtamCn9B30=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=gmail.com; s=gamma;
h=message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
b=X80+mc85h+/JUT8h4yFKqEPD5njExs8Onj0Rze4ZlNzgLnRTYjzHtM7R2yfeA6/lYk1SMSpNaOVspM5M0OvmMMuenb12L+NhLfCb+rTZiIoRVXBJwJ1QZ2NM6IM/9NzhJVU4QjUIOXDr4n8hxjBkt+B3jvZZIVh0E6zAWb1Z/Dw=
Received: by 10.115.108.1 with SMTP id k1mr5861956wam.42.1203563800282;
Wed, 20 Feb 2008 19:16:40 -0800 (PST)
Received: by 10.115.111.19 with HTTP; Wed, 20 Feb 2008 19:16:40 -0800 (PST)
Message-ID: <b18fbe3c0802201916v17ae9f9fn800d8da2b01eee9f@mail.gmail.com>
Date: Thu, 21 Feb 2008 11:16:40 +0800
From: "Eduardo Tongson" <propolice@gmail.com>
To: gentoo-security@lists.gentoo.org
Subject: Re: [gentoo-security] Kernel Security + KISS
In-Reply-To: <1203548143.26804.29.camel@media>
Precedence: bulk
List-Post: <mailto:gentoo-security@lists.gentoo.org>
List-Help: <mailto:gentoo-security+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-security+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-security+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-security.gentoo.org>
X-BeenThere: gentoo-security@lists.gentoo.org
Reply-to: gentoo-security@lists.gentoo.org
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <fb3727060802161457x30472ff2v970bd41902bc8de2@mail.gmail.com>
<b18fbe3c0802171343t2c6999c2l3a7efe57f9fd589f@mail.gmail.com>
<200802180512.35888.rbu@gentoo.org>
<200802201359.55663.sysadmin@tacticalbusinesspartners.com>
<1203548143.26804.29.camel@media>
X-Archives-Salt: c5e4a625-ad46-45df-8d54-5fcf2a81862c
X-Archives-Hash: 3bca1140c895f8d851800c9df504acce
Alright how do we proceed to get this team started.
ed*eonsec
On Thu, Feb 21, 2008 at 6:55 AM, Ned Ludd <solar@gentoo.org> wrote:
>
>
> On Wed, 2008-02-20 at 13:59 -0500, Harlan Lieberman-Berg wrote:
> > On Sunday 17 February 2008 23:12:35 Robert Buchholz wrote:
> > > On Sunday, 17. February 2008, Eduardo Tongson wrote:
> > > > What specific kernel knowledge is needed to get a Kernel advisory up
> > > > and running ?
> > >
> > > Between becoming aware of a vulnerability in Linux and drafting an advisory
> > > for one or all kernel sources comes the part where you review which
> > > versions of which kernel sources are affected and unaffected. You also
> > > need to pay attention to specifics of the added patchsets, which might
> > > duplicate vulnerabilities.
> > >
> > > Parts of the job can indeed be done without Kernel and C knowledge, but
> > > some cannot. So if we draft a new kernel security *team*, people without C
> > > and kernel knowledge are helpful -- some others need to have it, though.
> > >
> > > Robert
> >
> > To be honest, 99% of what is done in the kernel security team can be done with
> > no C knowledge at all.
> >
> > I'm not an expert C person - far from it - but I eventually became the head of
> > Kernel Security until I retired a few months ago.
> >
> > Most of it is bug handling. The major problem is a social, not a technical
> > one. Because of the manner in which our kernels are organized, a single
> > vulnerability involves checking upstream version numbers, coordinating them
> > into our downstream version numbers for all sources, checking to see if the
> > sources are effected, figuring out who to CC for the bugs, then harassing
> > them until they do it.
> >
> > Unlike other security sources, any attempt to hardmask the package is shutdown
> > instantly. The chaos that would result from a kernel hardmask, even one of
> > the lesser used ones, caused me to only successfully order one over my entire
> > career in Gentoo Kernsec... even though more around 30 would have been
> > needed. It is not infrequently that bugs will last six months without any
> > action coming about them, and users are blissfully unaware.
> >
> > I am happy to give my input as the former head of Kernel Security, but it is
> > my personal opinion that any advances in kernel security will require the
> > full cooperation of security, and letting the head of kernel security be able
> > to actually enforce threats, as that seems to be the only way bugs ever get
> > resolved. Pleading didn't work - I tried.
> >
> > -Harlan Lieberman-Berg
> > Gentoo Developer Emeritus
>
>
> Every word of what you said is painfully true. The only way to
> accomplish this would be with an Iron Fist(fail) or a team of ~15 guys
> who do nothing but patch and push new kernels and the PR that goes along
> with them every few days.
> --
> Ned Ludd <solar@gentoo.org>
>
>
>
> --
> gentoo-security@lists.gentoo.org mailing list
>
>
--
gentoo-security@lists.gentoo.org mailing list