Gentoo Linux Security Advisories

Presentation at FOSDEM

Sunday, 27th February 2005, 15:00

Jochen Maes (SeJo), PPC Security liaison, GLSA Apprentice

Thierry Carrez (Koon), Lead GLSA

Sune Kloppenborg Jeppesen (jaervosz), Lead GLSA

Agenda

Objectives

Tasks

Procedure

Gentoo Linux Vulnerability Treatment Policy

Drafting / reviewing

Overview 2004 - 2005

Help wanted

Objectives

Finding and fixing vulnerabilities in time

Coordination upstream/downstream

Coordination arches

Release advisories on time

Write advisory, approve advisory

Send out the GLSA to all major security lists

Tasks

Scouting

Searching websites and mailinglists for vulnerabilities

Submitting bugs and follow-up

Auditing

Code in the Portage tree is scanned for flaws

Submitting bugs and follow-up

Tasks

Kernel security

Patching the kernel for known vulnerabilities

Resulting in gentoo-sources

Procedure

Scouting, audit, users input provide vulnerability report

Bug wrangling

Gentoo Linux Vulnerability Treatment Policy

Submitting bug to supported arches

Writing and releasing the GLSA

Gentoo Linux Vulnerability Treatment Policy

Goal

Quick and thorough follow-up of the vulnerabilities

Scope

Supported arches, GLSA will be released when fixed on these arches:

x86, ppc, sparc, amd64, alpha

Unsupported arches will be notified but if not fixed GLSA will still be released

Gentoo Linux Vulnerability Treatment Policy

Feed

Bugzilla is our main bug feed for GLSA

Public for all, unless vulnerability is restricted by upstream

Restricted bugs will go public on fix

Gentoo Linux Vulnerability Treatment Policy

Impact level

Gentoo Linux Vulnerability Treatment Policy

Impact level (continued)

Gentoo Linux Vulnerability Treatment Policy

Severity level table

Drafting / reviewing

GLSAs are drafted by a coordinator

Reviewed and approved by at least two other coordinators before release

2004 Statistics

2005 Statistics

Help wanted

Scouts and coordinators needed

How to proceed if interested?

Submit application to security@gentoo.org

Join #gentoo-security on IRC (Freenode)

Start working on security bugs

Provide lots of free time to the GLSA

Pay Koon, jaervosz, SeJo a beer or two :-)

Gentoo Linux Security Advisories

Presentation at FOSDEM

Sunday, 27th February 2005, 15:00

Jochen Maes (SeJo), PPC Security liaison, GLSA Apprentice

Thierry Carrez (Koon), Lead GLSA

Sune Kloppenborg Jeppesen (jaervosz), Lead GLSA

Jochen Maes

2005-02-14T10:47:45