The netdev maintainer profile asks reporters of bugs with possible
security implications to use the public lists, which is consistent with
the way most of these bugs are handled, but it says nothing about
reproducers, and its suggested alternatives contradict security-bugs.rst:
it points to the security team's address, and to the linux-distros list
which must not be contacted before a fix is accepted. This text has been
left unchanged since 2013 when security reports were not yet a problem,
just because it remained unnoticed during the security doc refactoring.
Let's not change the rule (list first), just remind that repros are not
meant to be publicly shared, and suggest to defer to security-bugs.rst
now.
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
Documentation/process/maintainer-netdev.rst | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/Documentation/process/maintainer-netdev.rst b/Documentation/process/maintainer-netdev.rst
index 0c155adccfac9..2d1be16c498ec 100644
--- a/Documentation/process/maintainer-netdev.rst
+++ b/Documentation/process/maintainer-netdev.rst
@@ -334,10 +334,15 @@ Security fixes
Do not email netdev maintainers directly if you think you discovered
a bug that might have possible security implications.
The current netdev maintainer has consistently requested that
-people use the mailing lists and not reach out directly. If you aren't
-OK with that, then perhaps consider mailing security@kernel.org or
-reading about http://oss-security.openwall.org/wiki/mailing-lists/distros
-as possible alternative mechanisms.
+people use the mailing lists and not reach out directly. Fixes for such
+bugs are posted to the lists like any other fix, with a commit message
+that does not detail how to exploit the bug. Never post reproducers or
+exploits publicly: maintainers will ask for them privately if needed.
+
+Only for the rare bugs that constitute a vulnerability according to
+Documentation/process/threat-model.rst and that were not found using
+AI-based tools, follow the process described in
+Documentation/process/security-bugs.rst instead.
Co-posting changes to user space components
--
2.52.0