[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH 0/1] MAINTAINERS: add security quotient field
From: |
Michael S. Tsirkin |
Subject: |
Re: [PATCH 0/1] MAINTAINERS: add security quotient field |
Date: |
Tue, 14 Jul 2020 05:46:06 -0400 |
On Tue, Jul 14, 2020 at 02:06:30PM +0530, P J P wrote:
> From: Prasad J Pandit <pjp@fedoraproject.org>
>
> Hello,
>
> QEMU supports numerous virtualisation and emulation use cases.
> It offers many features to support guest's function(s).
>
> All of these use cases and features are not always security relevant.
> Because some maybe used in trusted environments only. Some may still
> be in experimental stage. While other could be very old and not
> used or maintained actively.
>
> Recently we received multiple security issue reports against VVFAT
> and VirtFS host directory sharing system. After discussing with the
> respective maintainers, it turned out that
>
> * VVFAT -> https://bugs.launchpad.net/qemu/+bug/1883083
> VVFAT is quite old and is available for testing purposes only.
> Ie. It is not suitable for production environments.
>
> * VirtFS/9pfs -> https://wiki.qemu.org/Documentation/9psetup
> VirtFS implementation though better, it is most commonly used for
> automated testing under sand-boxed server environments, ie. no
> malicious party there. It is also not mature enough for cloud services.
> It is supported on 'Odd Fixes' basis atm.
>
> So these turned out to be issues which can be fixed as regular bugs.
>
> For security bug analysis we generally consider use cases wherein
> QEMU is used in conjunction with the KVM hypervisor, which enables
> guest to use hardware processor's virtualisation features.
>
> This patch introduces the CVE (or Security or Trust) Quotient field
> in the MAINTAINERS file. It tries to capture the security sensitivity
> pertaining to a feature or section of the QEMU's code base.
>
> It indicates whether a potential issue should be treated as a security
> one OR it could be fixed as a regular non-security bug.
>
> If Quotient == High, triage issues as potential security ones.
> if Quotient == Low, triage issues as regular non-security bugs.
>
> I have tagged each section in the MAINTAINERS file as High or Low on best
> guess basis. I request respective maintainers to kindly review it please.
>
> If you have any inputs/suggestions, I'd really appreciate them.
>
> Thank you.
So this attempts to specify a security aspect of specific files.
Which works for some use-cases (e.g. devices) but not others
(common utility functions).
I'd like to propose add a flag that limits QEMU to a secured subset
of functionality at runtime instead.
Then we can just tell security researchers "reproduce this with
-security=high or it's not a security issue".
> --
> Prasad J Pandit (1):
> MAINTAINERS: introduce cve or security quotient field
>
> MAINTAINERS | 324 ++++++++++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 324 insertions(+)
>
> --
> 2.26.2
Re: [PATCH 1/1] MAINTAINERS: introduce cve or security quotient field, Philippe Mathieu-Daudé, 2020/07/14
Re: [PATCH 1/1] MAINTAINERS: introduce cve or security quotient field, Cornelia Huck, 2020/07/14
Re: [PATCH 1/1] MAINTAINERS: introduce cve or security quotient field, Dr. David Alan Gilbert, 2020/07/16
Re: [PATCH 0/1] MAINTAINERS: add security quotient field,
Michael S. Tsirkin <=