forked from torvalds/linux
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge tag 'char-misc-6.5-rc4' of git://git.kernel.org/pub/scm/linux/k…
…ernel/git/gregkh/char-misc Pull char driver and Documentation fixes from Greg KH: "Here is a char driver fix and some documentation updates for 6.5-rc4 that contain the following changes: - sram/genalloc bugfix for reported problem - security-bugs.rst update based on recent discussions - embargoed-hardware-issues minor cleanups and then partial revert for the project/company lists All of these have been in linux-next for a while with no reported problems, and the documentation updates have all been reviewed by the relevant developers" * tag 'char-misc-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: misc/genalloc: Name subpools by of_node_full_name() Documentation: embargoed-hardware-issues.rst: add AMD to the list Documentation: embargoed-hardware-issues.rst: clean out empty and unused entries Documentation: security-bugs.rst: clarify CVE handling Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group
- Loading branch information
Showing
4 changed files
with
20 additions
and
26 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -254,7 +254,6 @@ an involved disclosed party. The current ambassadors list: | |
Samsung Javier González <[email protected]> | ||
|
||
Microsoft James Morris <[email protected]> | ||
VMware | ||
Xen Andrew Cooper <[email protected]> | ||
|
||
Canonical John Johansen <[email protected]> | ||
|
@@ -263,10 +262,8 @@ an involved disclosed party. The current ambassadors list: | |
Red Hat Josh Poimboeuf <[email protected]> | ||
SUSE Jiri Kosina <[email protected]> | ||
|
||
Amazon | ||
Google Kees Cook <[email protected]> | ||
|
||
GCC | ||
LLVM Nick Desaulniers <[email protected]> | ||
============= ======================================================== | ||
|
||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -63,31 +63,28 @@ information submitted to the security list and any followup discussions | |
of the report are treated confidentially even after the embargo has been | ||
lifted, in perpetuity. | ||
|
||
Coordination | ||
------------ | ||
|
||
Fixes for sensitive bugs, such as those that might lead to privilege | ||
escalations, may need to be coordinated with the private | ||
<[email protected]> mailing list so that distribution vendors | ||
are well prepared to issue a fixed kernel upon public disclosure of the | ||
upstream fix. Distros will need some time to test the proposed patch and | ||
will generally request at least a few days of embargo, and vendor update | ||
publication prefers to happen Tuesday through Thursday. When appropriate, | ||
the security team can assist with this coordination, or the reporter can | ||
include linux-distros from the start. In this case, remember to prefix | ||
the email Subject line with "[vs]" as described in the linux-distros wiki: | ||
<http://oss-security.openwall.org/wiki/mailing-lists/distros#how-to-use-the-lists> | ||
Coordination with other groups | ||
------------------------------ | ||
|
||
The kernel security team strongly recommends that reporters of potential | ||
security issues NEVER contact the "linux-distros" mailing list until | ||
AFTER discussing it with the kernel security team. Do not Cc: both | ||
lists at once. You may contact the linux-distros mailing list after a | ||
fix has been agreed on and you fully understand the requirements that | ||
doing so will impose on you and the kernel community. | ||
|
||
The different lists have different goals and the linux-distros rules do | ||
not contribute to actually fixing any potential security problems. | ||
|
||
CVE assignment | ||
-------------- | ||
|
||
The security team does not normally assign CVEs, nor do we require them | ||
for reports or fixes, as this can needlessly complicate the process and | ||
may delay the bug handling. If a reporter wishes to have a CVE identifier | ||
assigned ahead of public disclosure, they will need to contact the private | ||
linux-distros list, described above. When such a CVE identifier is known | ||
before a patch is provided, it is desirable to mention it in the commit | ||
message if the reporter agrees. | ||
The security team does not assign CVEs, nor do we require them for | ||
reports or fixes, as this can needlessly complicate the process and may | ||
delay the bug handling. If a reporter wishes to have a CVE identifier | ||
assigned, they should find one by themselves, for example by contacting | ||
MITRE directly. However under no circumstances will a patch inclusion | ||
be delayed to wait for a CVE identifier to arrive. | ||
|
||
Non-disclosure agreements | ||
------------------------- | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters