Documentation: Document the Linux Kernel CVE process

The Linux kernel project now has the ability to assign CVEs to fixed
issues, so document the process and how individual developers can get a
CVE

Documentation: Document the Linux Kernel CVE process

The Linux kernel project now has the ability to assign CVEs to fixed
issues, so document the process and how individual developers can get a
CVE if one is not automatically assigned for their fixes.

Reviewed-by: Kees Cook <[email protected]>
Reviewed-by: Konstantin Ryabitsev <[email protected]>
Reviewed-by: Krzysztof Kozlowski <[email protected]>
Reviewed-by: Lukas Bulwahn <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
Signed-off-by: Lee Jones <[email protected]>
Link: https://lore.kernel.org/r/2024021731-essence-sadness-28fd@gregkh
Signed-off-by: Greg Kroah-Hartman <[email protected]>

show more ...

Documentation: security-bugs.rst: linux-distros relaxed their rules

The linux-distros list relaxed their rules to try to adapt better to
how the Linux kernel works. Let's update the Coordination par

Documentation: security-bugs.rst: linux-distros relaxed their rules

The linux-distros list relaxed their rules to try to adapt better to
how the Linux kernel works. Let's update the Coordination part to
explain why and when to contact them or not to and how to avoid trouble
in the future.

Link: https://www.openwall.com/lists/oss-security/2023/09/08/4
Cc: Kees Cook <[email protected]>
Cc: Solar Designer <[email protected]>
Cc: Vegard Nossum <[email protected]>
Acked-by: Jiri Kosina <[email protected]>
Signed-off-by: Willy Tarreau <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>

show more ...

Documentation: security-bugs.rst: clarify CVE handling

The kernel security team does NOT assign CVEs, so document that properly
and provide the "if you want one, ask MITRE for it" response that we
g

Documentation: security-bugs.rst: clarify CVE handling

The kernel security team does NOT assign CVEs, so document that properly
and provide the "if you want one, ask MITRE for it" response that we
give on a weekly basis in the document, so we don't have to constantly
say it to everyone who asks.

Link: https://lore.kernel.org/r/2023063022-retouch-kerosene-7e4a@gregkh
Signed-off-by: Greg Kroah-Hartman <[email protected]>

show more ...

Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group

Because the linux-distros group forces reporters to release information
about reported bugs, and they i

Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group

Because the linux-distros group forces reporters to release information
about reported bugs, and they impose arbitrary deadlines in having those
bugs fixed despite not actually being kernel developers, the kernel
security team recommends not interacting with them at all as this just
causes confusion and the early-release of reported security problems.

Reviewed-by: Kees Cook <[email protected]>
Link: https://lore.kernel.org/r/2023063020-throat-pantyhose-f110@gregkh
Signed-off-by: Greg Kroah-Hartman <[email protected]>

show more ...

Documentation/security-bugs: move from admin-guide/ to process/

Jiri Kosina, Jonathan Corbet, and Willy Tarreau all expressed a desire
to move this document under process/.

Create a new section for

Documentation/security-bugs: move from admin-guide/ to process/

Jiri Kosina, Jonathan Corbet, and Willy Tarreau all expressed a desire
to move this document under process/.

Create a new section for security issues in the index and group it with
embargoed-hardware-issues.

I'm doing this at the start of the series to make all the subsequent
changes show up in 'git blame'.

Existing references were updated using:

git grep -l security-bugs ':!Documentation/translations/' | xargs sed -i 's|admin-guide/security-bugs|process/security-bugs|g'
git grep -l security-bugs Documentation/translations/ | xargs sed -i 's|Documentation/admin-guide/security-bugs|Documentation/process/security-bugs|g'
git grep -l security-bugs Documentation/translations/ | xargs sed -i '/Original:/s|\.\./admin-guide/security-bugs|\.\./process/security-bugs|g'

Notably, the page is not moved in the translations (due to my lack of
knowledge of these languages), but the translations have been updated
to point to the new location of the original document where these
references exist.

Link: https://lore.kernel.org/all/[email protected]/
Suggested-by: Jiri Kosina <[email protected]>
Cc: Alex Shi <[email protected]>
Cc: Yanteng Si <[email protected]>
Cc: Hu Haowen <[email protected]>
Cc: Federico Vaga <[email protected]>
Cc: Tsugikazu Shibata <[email protected]>
Cc: Minchan Kim <[email protected]>
Cc: Jeimi Lee <[email protected]>
Cc: Carlos Bilbao <[email protected]>
Cc: Akira Yokosawa <[email protected]>
Signed-off-by: Vegard Nossum <[email protected]>
Acked-by: Carlos Bilbao <[email protected]>
Reviewed-by: Yanteng Si <[email protected]>
Reviewed-by: Akira Yokosawa <[email protected]>
Acked-by: Federico Vaga <[email protected]>
Reviewed-by: Bagas Sanjaya <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>

show more ...