Linux-Kernel Archive: [ANNOUNCE] Linux-Stable-Security Kernel Tree Announced

jeremy · 04-12-2016, 10:05 AM

Quote:

I'd like to announce the linux-stable security tree project. The purpose
is to create a derivative tree from the regular stable tree that would
contain only commits that fix security vulnerabilities.

Quite a few users of the stable trees pointed out that on complex deployments,
where validation is non-trivial, there is little incentive to follow the
stable tree after the product has been deployed to production. There is no
interest in "random" kernel fixes and the only requirements are to keep up
with security vulnerabilities.

Given this, a few projects preferred to delay important kernel updates, and
a few even stopped updating the tree altogether, exposing them to critical
vulnerabilities.

This project provides an easy way to receive only important security commits,
which are usually only a few in each release, and makes it easy to incorporate
them into existing projects.

The tree is available at:

https://git.kernel.org/cgit/linux/ke...-security.git/

--jeremy

jeremy · 04-13-2016, 09:16 AM

An update from El Reg:

Quote:

In response to a question from another developer, Levin says the Linux-stable security tree project will be to catch “anything exploitable by a local unprivileged user (or better),” whether or not it's attracted the attention of Mitre and been issued a CVE.

Levin notes that he hopes to be able to maintain a security tree for all -stable branch versions that are still maintained – that is, he won't only be following the very latest kernel revision.

The project has sparked a lively discussion over at the Linux Kernel Mailing List. The two main lines of criticism so far, El Reg would summarise as: “all bug fixes are potentially security fixes if they affect the stability of the system”, and “those responsible for patching systems should have processes good enough to handle pulling the full -stable branch when they need to patch”.

On the other hand, as this post from Linux consultant Eddie Chapman notes: “if I may offer one criticism of the kernel stable trees in general, it is that it is very hard to find and identify fixes for known security vulnerabilities.”

In other words, even if Levin can't get 100 per cent coverage of security fixes, by offering users a single source for security patches only, security overall is improved the more people run those patches.

What do LQ members think?

--jeremy