OpenBMC community telecon - 11/20 Agenda

[Andrew Jeffery]

On Tue, 2017-11-21 at 01:04 +0000, Tanous, Ed wrote:
> > A minimal starting point would be to run every code repository through
> > Coverity Scan. Setting this up with travs-ci isn't too hard (we do it for parts of
> > host firmware today).
> > 
> > Efforts to limit the damage could also be good, like strict SELinux policy. After
> > all, much of the current design would work quite well for that.
> 
> I meant more along the lines of "would the community be ok with this"
> more than "is it technically possible".  I think the tooling story
> has come a long ways in the last few years, especially for open
> source tools, but I know any attempt to limit what's allowed tends to
> lead to controversy, so I wanted to see where we all stand.

I don't follow your points here - limiting the damage by defining
SELinux profiles for the distributed set of applications doesn't strike
me as anything that's controversial. Stopping applications from doing
things that they shouldn't under the guise of them "being allowed"
despite it not being intended behaviour seems like a stretch. Can you
elaborate?

Also being relatively clean with respect to Coverity seems like a
decent goal - we certainly shouldn't be using patterns that trigger it.
Why do you think this would be controversial?

Cheers,

Andrew
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: This is a digitally signed message part
URL: <http://lists.ozlabs.org/pipermail/openbmc/attachments/20171121/fe861614/attachment.sig>