xfs
[Top] [All Lists]

Re: XFS security fix never sent to -stable?

To: Dave Chinner <david@xxxxxxxxxxxxx>
Subject: Re: XFS security fix never sent to -stable?
From: Kees Cook <keescook@xxxxxxxxxx>
Date: Tue, 10 Dec 2013 18:45:54 -0800
Cc: Josh Boyer <jwboyer@xxxxxxxxxxxxxxxxx>, Luis Henriques <luis.henriques@xxxxxxxxxxxxx>, Dwight Engen <dwight.engen@xxxxxxxxxx>, LKML <linux-kernel@xxxxxxxxxxxxxxx>, Brian Foster <bfoster@xxxxxxxxxx>, Dave Chinner <dchinner@xxxxxxxxxx>, Gao feng <gaofeng@xxxxxxxxxxxxxx>, Ben Myers <bpm@xxxxxxx>, Greg KH <gregkh@xxxxxxxxxxxxxxxxxxx>, xfs@xxxxxxxxxxx, "stable@xxxxxxxxxxxxxxx" <stable@xxxxxxxxxxxxxxx>, Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Delivered-to: xfs@xxxxxxxxxxx
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=FsXNR0q/l3YdWVpIDvXGhFa8XcgDBe4hkmtLR4L/eZk=; b=h1pk47xnDJaWBCe0xsfAP2jG8h+707U1xo+25Ll5Q6QUE462o8v4auqsFSKzCWAwbL JX10dAD4Dos59YNghnRI7o3Sz+B4tI9w6I3A0gRyihx05Ifj7ynzGK9Iw2HQZ76+Dapu YdAuogSLb1lS1MaFHYSe7AyRHWPtuOswWnZRQPbUMGQxyk8D4uJTs7cDV6rbxnIMfsr/ SOD4sQmDwpniO3tIEkFyGxxOZ0dQ62wS8183rbEUAdf08qhLaNNrAFPrZqqfFOs1kBgs UEmwHG62Lig+cN8yRxIwR37cfaWdghsmjeUMmThSIdryMa25JFKXXqPmz1eJCT6Mvykc 4DNA==
In-reply-to: <20131211020007.GH10988@dastard>
References: <CAGXu5jLKkgYg5UWJc8xBGN5NgDh68Q3YRxO--zmDL86BWPH78A@xxxxxxxxxxxxxx> <20131209121534.GE4278@hercules> <CA+5PVA4ychvLEi1ZZ6rYy2=5-wZAbQ_a-aoy8=1w3+tr-pt3Fg@xxxxxxxxxxxxxx> <20131209235523.GW31386@dastard> <CA+5PVA5rUmWYQiPwkN15CnfqckmEjVukXz3mU75CiUBVzfERqA@xxxxxxxxxxxxxx> <20131211010326.GF10988@dastard> <CA+5PVA7wso5fo11xX9kCUdbrqBQMzUnYwTOB_Qe3K7LDY4z_Cw@xxxxxxxxxxxxxx> <20131211020007.GH10988@dastard>
On Tue, Dec 10, 2013 at 6:00 PM, Dave Chinner <david@xxxxxxxxxxxxx> wrote:
> On Tue, Dec 10, 2013 at 08:10:51PM -0500, Josh Boyer wrote:
>> On Tue, Dec 10, 2013 at 8:03 PM, Dave Chinner <david@xxxxxxxxxxxxx> wrote:
>> > Security processes are not something that should be hidden away in
>> > it's own private corner - if there's a problem upstream needs to
>> > take action on, then direct contact with upstream is necessary. We
>> > need to know about security issues - even ones that are classified
>> > post-commit as security issues - so we are operating with full
>> > knowledge of the issues in our code and the impact of our fixes....
>>
>> Agreed.  I'm going to interpret your comments at being directed to the
>> general audience because otherwise you're just shooting the messenger
>> :).
>
> Right, they are not aimed at you - they are aimed at those on the
> security side of the fence. I'm tired of learning about CVEs in XFS
> code through chinese whispers and/or luck.

Mostly I try to shield anyone not interested in CVEs from the boring
process, and try to focus on just getting things marked as needing to
go into stable. I don't think anyone needs to read the oss-security
list if they don't want to.

In this case, the fix Dan sent was part of a larger collection of
security issues reported by Nico. I think the communication error here
was Dan accidentally forgetting to add the Cc: stable tag. But beyond
that, it was sent to the xfs list and Cc: to security, so I'm not sure
it's fair to say it was hidden away. :)

Besides the missing Cc: stable tag, what should future patch senders
do to call attention to an issue being a security problem at the time
it is being reported?

-Kees

-- 
Kees Cook
Chrome OS Security

<Prev in Thread] Current Thread [Next in Thread>