From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from pigeon.gentoo.org ([69.77.167.62] helo=lists.gentoo.org)
	by finch.gentoo.org with esmtp (Exim 4.60)
	(envelope-from <gentoo-security+bounces-827-garchives=archives.gentoo.org@lists.gentoo.org>)
	id 1JS4Z6-0002sF-Dl
	for garchives@archives.gentoo.org; Thu, 21 Feb 2008 06:05:52 +0000
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
	by pigeon.gentoo.org (Postfix) with SMTP id B7CB4E05DE;
	Thu, 21 Feb 2008 06:05:11 +0000 (UTC)
Received: from rv-out-0910.google.com (rv-out-0910.google.com [209.85.198.186])
	by pigeon.gentoo.org (Postfix) with ESMTP id EEED4E05D9
	for <gentoo-security@lists.gentoo.org>; Thu, 21 Feb 2008 06:05:10 +0000 (UTC)
Received: by rv-out-0910.google.com with SMTP id b22so2018423rvf.46
        for <gentoo-security@lists.gentoo.org>; Wed, 20 Feb 2008 22:05:10 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=gamma;
        h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
        bh=J3Eimkwu7e37hz2HglJw66d0JiO+y0cj4XiWqkc6AUA=;
        b=YGjtNbb/pjx1MEnD5S0iku0mozMZ2bMZx/bXcn+eu2JT6a4mMi5LE0ypMYCksg49s3TpuzyBoFqZv037muiltoM0+h8wUDD8AmQ/df5oPDkWUnycvLMn+BCG9KnRRS9lBH/5kz56guuUZvf4BkYTzDp57L5Lo9dYZJjCJcl53Jc=
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
        b=DR07DUXX0Z5hDJ5RP+967CsMABbmsvSKKSpQ19Cd9rmnwwAz7m80wJ8Gi1FK/380AIZXnZtagsIRA6FTZaevZzrUHHSdAX25soqY+vZadAMquRKxvbOhimB4ZTvjIBsNkc4o4GS0ePGoGXYDu4llnHYuYXMFAysP2ddNVOGF5Lo=
Received: by 10.141.18.14 with SMTP id v14mr6026226rvi.242.1203573910218;
        Wed, 20 Feb 2008 22:05:10 -0800 (PST)
Received: by 10.141.114.9 with HTTP; Wed, 20 Feb 2008 22:05:10 -0800 (PST)
Message-ID: <fb3727060802202205n1e86c89es3a37034cc1abb240@mail.gmail.com>
Date: Thu, 21 Feb 2008 01:05:10 -0500
From: "Casey Link" <unnamedrambler@gmail.com>
To: gentoo-security@lists.gentoo.org
Subject: Re: [gentoo-security] Kernel Security + KISS
In-Reply-To: <b18fbe3c0802201916v17ae9f9fn800d8da2b01eee9f@mail.gmail.com>
Precedence: bulk
List-Post: <mailto:gentoo-security@lists.gentoo.org>
List-Help: <mailto:gentoo-security+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-security+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-security+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-security.gentoo.org>
X-BeenThere: gentoo-security@lists.gentoo.org
Reply-to: gentoo-security@lists.gentoo.org
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <fb3727060802161457x30472ff2v970bd41902bc8de2@mail.gmail.com>
	 <b18fbe3c0802171343t2c6999c2l3a7efe57f9fd589f@mail.gmail.com>
	 <200802180512.35888.rbu@gentoo.org>
	 <200802201359.55663.sysadmin@tacticalbusinesspartners.com>
	 <1203548143.26804.29.camel@media>
	 <b18fbe3c0802201916v17ae9f9fn800d8da2b01eee9f@mail.gmail.com>
X-Archives-Salt: eb76a612-3900-4609-b9d7-083552d6b9fe
X-Archives-Hash: e68c2604b3534099635514610c3e33c4

It would probably help if we knew how many people were interested.

I am. +1

Casey

On Wed, Feb 20, 2008 at 10:16 PM, Eduardo Tongson <propolice@gmail.com> wrote:
> Alright how do we proceed to get this team started.
>
>   ed*eonsec
>
>
>
>  On Thu, Feb 21, 2008 at 6:55 AM, Ned Ludd <solar@gentoo.org> wrote:
>  >
>  >
>  >  On Wed, 2008-02-20 at 13:59 -0500, Harlan Lieberman-Berg wrote:
>  >  > On Sunday 17 February 2008 23:12:35 Robert Buchholz wrote:
>  >  > > On Sunday, 17. February 2008, Eduardo Tongson wrote:
>  >  > > > What specific kernel knowledge is needed to get a Kernel advisory up
>  >  > > > and running ?
>  >  > >
>  >  > > Between becoming aware of a vulnerability in Linux and drafting an advisory
>  >  > > for one or all kernel sources comes the part where you review which
>  >  > > versions of which kernel sources are affected and unaffected. You also
>  >  > > need to pay attention to specifics of the added patchsets, which might
>  >  > > duplicate vulnerabilities.
>  >  > >
>  >  > > Parts of the job can indeed be done without Kernel and C knowledge, but
>  >  > > some cannot. So if we draft a new kernel security *team*, people without C
>  >  > > and kernel knowledge are helpful -- some others need to have it, though.
>  >  > >
>  >  > > Robert
>  >  >
>  >  > To be honest, 99% of what is done in the kernel security team can be done with
>  >  > no C knowledge at all.
>  >  >
>  >  > I'm not an expert C person - far from it - but I eventually became the head of
>  >  > Kernel Security until I retired a few months ago.
>  >  >
>  >  > Most of it is bug handling.  The major problem is a social, not a technical
>  >  > one.  Because of the manner in which our kernels are organized, a single
>  >  > vulnerability involves checking upstream version numbers, coordinating them
>  >  > into our downstream version numbers for all sources, checking to see if the
>  >  > sources are effected, figuring out who to CC for the bugs, then harassing
>  >  > them until they do it.
>  >  >
>  >  > Unlike other security sources, any attempt to hardmask the package is shutdown
>  >  > instantly.  The chaos that would result from a kernel hardmask, even one of
>  >  > the lesser used ones, caused me to only successfully order one over my entire
>  >  > career in Gentoo Kernsec... even though more around 30 would have been
>  >  > needed.  It is not infrequently that bugs will last six months without any
>  >  > action coming about them, and users are blissfully unaware.
>  >  >
>  >  > I am happy to give my input as the former head of Kernel Security, but it is
>  >  > my personal opinion that any advances in kernel security will require the
>  >  > full cooperation of security, and letting the head of kernel security be able
>  >  > to actually enforce threats, as that seems to be the only way bugs ever get
>  >  > resolved.  Pleading didn't work - I tried.
>  >  >
>  >  > -Harlan Lieberman-Berg
>  >  > Gentoo Developer Emeritus
>  >
>  >
>  >  Every word of what you said is painfully true. The only way to
>  >  accomplish this would be with an Iron Fist(fail) or a team of ~15 guys
>  >  who do nothing but patch and push new kernels and the PR that goes along
>  >  with them every few days.
>  >  --
>  >  Ned Ludd <solar@gentoo.org>
>  >
>  >
>  >
>  >  --
>  >  gentoo-security@lists.gentoo.org mailing list
>  >
>  >
>  --
>  gentoo-security@lists.gentoo.org mailing list
>
>
-- 
gentoo-security@lists.gentoo.org mailing list