<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
On 7/16/2018 5:19 AM, <a class="moz-txt-link-abbreviated" href="mailto:openbmc-request@lists.ozlabs.org">openbmc-request@lists.ozlabs.org</a> wrote:<br>
<blockquote type="cite"
cite="mid:mailman.985.1531736364.32318.openbmc@lists.ozlabs.org">
<pre wrap="">Message: 1
Date: Sun, 15 Jul 2018 22:11:18 -0400
From: Brad Bishop <a class="moz-txt-link-rfc2396E" href="mailto:bradleyb@fuzziesquirrel.com" moz-do-not-send="true"><bradleyb@fuzziesquirrel.com></a>
To: Andrew Jeffery <a class="moz-txt-link-rfc2396E" href="mailto:andrew@aj.id.au" moz-do-not-send="true"><andrew@aj.id.au></a>
Cc: <a class="moz-txt-link-abbreviated" href="mailto:openbmc@lists.ozlabs.org" moz-do-not-send="true">openbmc@lists.ozlabs.org</a>
Subject: Re: How to handle security vulnerabilities (was: OpenBMC
security workgroup status)
Message-ID: <a class="moz-txt-link-rfc2396E" href="mailto:AC6EEF0D-8D17-4936-A6DD-4059CB459EBC@fuzziesquirrel.com" moz-do-not-send="true"><AC6EEF0D-8D17-4936-A6DD-4059CB459EBC@fuzziesquirrel.com></a>
Content-Type: text/plain; charset=us-ascii
</pre>
<blockquote type="cite" style="color: #000000;">
<pre wrap="">On Jul 13, 2018, at 2:56 AM, Andrew Jeffery <a class="moz-txt-link-rfc2396E" href="mailto:andrew@aj.id.au" moz-do-not-send="true"><andrew@aj.id.au></a> wrote:
On Fri, 13 Jul 2018, at 07:49, Joseph Reynolds wrote:
</pre>
<blockquote type="cite" style="color: #000000;">
<blockquote type="cite" style="color: #000000;">
<pre wrap="">What's the short-term strategy for handling [security] vulnerability
reports received in the gap between now and getting some formal
process in place?
</pre>
</blockquote>
<pre wrap="">We don't have a strategy. Let's discuss it here.
Officially (<a class="moz-txt-link-freetext" href="https://github.com/openbmc/openbmc/" moz-do-not-send="true">https://github.com/openbmc/openbmc/</a> section "Bug Reporting")
issues are managed on GitHub.
Unofficially, Brad volunteered to accept one batch of security
vulnerability reports and distribute them, presumably to the OpenBMC TSC
members (<a class="moz-txt-link-freetext" href="https://github.com/openbmc/docs" moz-do-not-send="true">https://github.com/openbmc/docs</a> section "Technical Steering
Committee ") or their delegates. I assume they would privately contact
a trusted OpenBMC contributor who could address the problem.
We could adapt the Linux model
(<a class="moz-txt-link-freetext" href="https://www.kernel.org/doc/html/v4.16/admin-guide/security-bugs.html" moz-do-not-send="true">https://www.kernel.org/doc/html/v4.16/admin-guide/security-bugs.html</a>),
although I am still looking for information on what the Linux security
team does with the bug report. For example, how security group members
track and discuss problems among themselves, how they pull in additional
resources to fix or mitigate the problem, and how they inform downstream
distros before announcing the problem, etc.
</pre>
</blockquote>
<pre wrap="">I thought the documention described most of this? <a class="moz-txt-link-abbreviated" href="mailto:security@kernel.org" moz-do-not-send="true">security@kernel.org</a> is a private list, so discussions can happen there freely. With respect to informing downstream distros, as mentioned that's done via the <a class="moz-txt-link-abbreviated" href="mailto:linux-distros@vs.openwall.org" moz-do-not-send="true">linux-distros@vs.openwall.org</a> list. As for how they pull in additional resources to fix or mitigate the problem, that's going to depend on the affected parties. No-one can order anyone to fix a particular problem, but the developers/maintainers/vendors involved have skin in the game so should be motivated to fix the issue.
</pre>
<blockquote type="cite" style="color: #000000;">
<pre wrap="">I think the first step for the OpenBMC team is to establish an email
address (like <a class="moz-txt-link-abbreviated" href="mailto:security@openbmc.org" moz-do-not-send="true">security@openbmc.org</a>), subscribe only trusted people to
that email list, and update the docs to explain that you should email
the security team for security questions, and use issues for everything
else.
</pre>
</blockquote>
<pre wrap="">Sounds good to me. Who can sort out security@? Brad? I'm sure we could sort out list hosting on ozlabs.org if necessary (like we use for this list).
</pre>
</blockquote>
<pre wrap="">Unless someone replies in the negative in the next couple days, lets just
do another list on ozlabs.org, if ozlabs.org is ok with that <span class="moz-smiley-s1" title=":-)"><span>:-)</span></span>
</pre>
<blockquote type="cite" style="color: #000000;">
<blockquote type="cite" style="color: #000000;">
<pre wrap="">Presumably, the security team would communicate privately among
themselves and the submitter to assess the situation, and contact
OpenBMC community members privately to address the problem.
This would be an easy step to take, and would move the team in the right
direction. What do you think?
</pre>
</blockquote>
<pre wrap="">Sounds good enough for the moment!
Andrew
</pre>
</blockquote>
</blockquote>
The description of the OpenBMC security vulnerability reporting
program we agreed to during the community call is now in review:
<a class="moz-txt-link-freetext" href="https://gerrit.openbmc-project.xyz/#/c/11511">https://gerrit.openbmc-project.xyz/#/c/11511</a>, so please review it.<br>
<br>
</body>
</html>