Skip to content

L
libvirt

openeuler / libvirt

通知 3
Star 0
Fork 0
L
libvirt

体验新版 GitCode，发现更多精彩内容 >>

切换分支/标签
查找文件 普通视图历史永久链接Permalink
securityprocess.html.in 4.6 KB
Newer Older
D
Document security reporting & handling process  
Daniel P. Berrange 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
  <body>

    <h1>Security Process</h1>

    <ul id="toc"></ul>

    <p>
      The libvirt project believes in responsible disclosure of
      security problems, to allow vendors time to prepare and
      distribute patches for problems ahead of their publication.
      This page describes how the process works and how to report
      potential security issues.
    </p>

    <h2><a name="reporting">Reporting security issues</a></h2>

    <p>
      In the event that a bug in libvirt is found which is
      believed to have (potential) security implications there
      is a dedicated contact to which a bug report / notification
      should be directed. Send an email with as many details of
      the problem as possible (ideally with steps to reproduce)
      to the following email address:
    </p>

    <pre>
<a href="mailto:libvirt-security@redhat.com">libvirt-security@redhat.com</a></pre>

    <p>
      NB. while this email address is backed by a mailing list, it
      is invitation only and moderated for non-members. As such you
      will receive an auto-reply indicating the report is held for
      moderation. Postings by non-members will be approved by a
      moderator and the reporter copied on any replies.
    </p>

    <h2><a name="seclist">Security team</a></h2>

    <p>
      The libvirt security team is made up of a subset of the libvirt
      core development team which covers the various distro maintainers
      of libvirt, along with nominated security engineers representing
      the various vendors who distribute libvirt. The team is responsible
      for analysing incoming reports from users to identify whether a
      security problem exists and its severity. It then works to produce
      a fix for all official stable branches of libvirt and co-ordinate
      embargo dates between vendors to allow simultaneous release of the
      fix by all affected parties.
    </p>

    <p>
      If you are a security representative of a vendor distributing
      libvirt and would like to join the security team, send an email
      to the afore-mentioned security address. Typically an existing
      member of the security team will have to vouch for your credentials
      before membership is approved. All members of the security team
      are <strong>required to respect the embargo policy</strong>
      described below.
    </p>

    <h2><a name="embargo">Publication embargo policy</a></h2>

    <p>
      The libvirt security team operates a policy of
      <a href="http://en.wikipedia.org/wiki/Responsible_disclosure">responsible disclosure</a>.
M
Fix common misspellings  
Martin Kletzander 已提交
69 
      As such any security issue reported, that is not already publicly disclosed
Y
Fix three minor typos  
Yuri Chornoivan 已提交
70 
      elsewhere, will have an embargo date assigned. Members of the security team agree
M
Fix common misspellings  
Martin Kletzander 已提交
71 
      not to publicly disclose any details of the security issue until the embargo
D
Document security reporting & handling process  
Daniel P. Berrange 已提交
72 73 74 75 76 77 78 79 
      date expires.
    </p>

    <p>
      The general aim of the team is to have embargo dates which
      are two weeks or less in duration. If a problem is identified
      with a proposed patch for a security issue, requiring further
      investigation and bug fixing, the embargo clock may be restarted.
M
Fix common misspellings  
Martin Kletzander 已提交
80 
      In exceptional circumstances longer initial embargoes may be
D
Document security reporting & handling process  
Daniel P. Berrange 已提交
81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 
      negotiated by mutual agreement between members of the security
      team and other relevant parties to the problem. Any such extended
      embargoes will aim to be at most one month in duration.
    </p>


    <h2><a name="cve">CVE allocation</a></h2>

    <p>
      The libvirt security team will associate each security issue with
      a CVE number. The CVE numbers will usually be allocated by one of
      the vendor security engineers on the security team.
    </p>

    <h2><a name="branches">Branch fixing policy</a></h2>

    <p>
      The libvirt community maintains one or more stable release branches
      at any given point in time. The security team will aim to publish
      fixes for GIT master (which will become the next major release) and
      each currently maintained stable release branch. The distro maintainers
      will be responsible for backporting the officially published fixes to
      other release branches where applicable.
    </p>

    <h2><a name="notification">Notification of issues</a></h2>

    <p>
      When an embargo expires, security issues will be announced on both
      the libvirt development and announcement <a href="http://libvirt.org/contact.html#email">mailing lists</a>.
    </p>
  </body>
</html>