mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-26 04:16:39 +00:00
[PATCH] Security contact info
Add security contact info and relevant documentation. Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
parent
378856d119
commit
655fc9d49d
3 changed files with 47 additions and 0 deletions
38
Documentation/SecurityBugs
Normal file
38
Documentation/SecurityBugs
Normal file
|
@ -0,0 +1,38 @@
|
|||
Linux kernel developers take security very seriously. As such, we'd
|
||||
like to know when a security bug is found so that it can be fixed and
|
||||
disclosed as quickly as possible. Please report security bugs to the
|
||||
Linux kernel security team.
|
||||
|
||||
1) Contact
|
||||
|
||||
The Linux kernel security team can be contacted by email at
|
||||
<security@kernel.org>. This is a private list of security officers
|
||||
who will help verify the bug report and develop and release a fix.
|
||||
It is possible that the security team will bring in extra help from
|
||||
area maintainers to understand and fix the security vulnerability.
|
||||
|
||||
As it is with any bug, the more information provided the easier it
|
||||
will be to diagnose and fix. Please review the procedure outlined in
|
||||
REPORTING-BUGS if you are unclear about what information is helpful.
|
||||
Any exploit code is very helpful and will not be released without
|
||||
consent from the reporter unless it has already been made public.
|
||||
|
||||
2) Disclosure
|
||||
|
||||
The goal of the Linux kernel security team is to work with the
|
||||
bug submitter to bug resolution as well as disclosure. We prefer
|
||||
to fully disclose the bug as soon as possible. It is reasonable to
|
||||
delay disclosure when the bug or the fix is not yet fully understood,
|
||||
the solution is not well-tested or for vendor coordination. However, we
|
||||
expect these delays to be short, measurable in days, not weeks or months.
|
||||
A disclosure date is negotiated by the security team working with the
|
||||
bug submitter as well as vendors. However, the kernel security team
|
||||
holds the final say when setting a disclosure date. The timeframe for
|
||||
disclosure is from immediate (esp. if it's already publically known)
|
||||
to a few weeks. As a basic default policy, we expect report date to
|
||||
disclosure date to be on the order of 7 days.
|
||||
|
||||
3) Non-disclosure agreements
|
||||
|
||||
The Linux kernel security team is not a formal body and therefore unable
|
||||
to enter any non-disclosure agreements.
|
|
@ -1966,6 +1966,11 @@ M: christer@weinigel.se
|
|||
W: http://www.weinigel.se
|
||||
S: Supported
|
||||
|
||||
SECURITY CONTACT
|
||||
P: Security Officers
|
||||
M: security@kernel.org
|
||||
S: Supported
|
||||
|
||||
SELINUX SECURITY MODULE
|
||||
P: Stephen Smalley
|
||||
M: sds@epoch.ncsc.mil
|
||||
|
|
|
@ -16,6 +16,10 @@ code relevant to what you were doing. If it occurs repeatably try and
|
|||
describe how to recreate it. That is worth even more than the oops itself.
|
||||
The list of maintainers is in the MAINTAINERS file in this directory.
|
||||
|
||||
If it is a security bug, please copy the Security Contact listed
|
||||
in the MAINTAINERS file. They can help coordinate bugfix and disclosure.
|
||||
See Documentation/SecurityBugs for more infomation.
|
||||
|
||||
If you are totally stumped as to whom to send the report, send it to
|
||||
linux-kernel@vger.kernel.org. (For more information on the linux-kernel
|
||||
mailing list see http://www.tux.org/lkml/).
|
||||
|
|
Loading…
Reference in a new issue