From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ian Campbell Subject: Re: [PATCH SECURITY-POLICY 3/9] Deployment with Security Team Permission Date: Mon, 19 Jan 2015 12:35:29 +0000 Message-ID: <1421670929.10440.75.camel@citrix.com> References: <21689.27383.339939.319567@chiark.greenend.org.uk> <1421437941-10997-1-git-send-email-ijackson@chiark.greenend.org.uk> <1421437941-10997-3-git-send-email-ijackson@chiark.greenend.org.uk> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail6.bemta4.messagelabs.com ([85.158.143.247]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1YDBYf-0007ow-Nn for xen-devel@lists.xenproject.org; Mon, 19 Jan 2015 12:35:53 +0000 In-Reply-To: <1421437941-10997-3-git-send-email-ijackson@chiark.greenend.org.uk> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Ian Jackson Cc: lars.kurth.xen@gmail.com, xen-devel@lists.xenproject.org, Ian Jackson List-Id: xen-devel@lists.xenproject.org On Fri, 2015-01-16 at 19:52 +0000, Ian Jackson wrote: > Permitting deployment during embargo seemed to have rough consensus on > the principle. We seemed to be converging on the idea that the > Security Team should explicitly set deployment restrictions for each > set of patches. > > Signed-off-by: Ian Jackson > Signed-off-by: Ian Jackson > --- > security_vulnerability_process.html | 11 +++++++++++ > 1 file changed, 11 insertions(+) > > diff --git a/security_vulnerability_process.html b/security_vulnerability_process.html > index 010cf76..de5e83e 100644 > --- a/security_vulnerability_process.html > +++ b/security_vulnerability_process.html > @@ -212,6 +212,17 @@ following:

>
  • The assigned XSA number
    • >
  • The planned disclosure date
    • > > +

    List members may, if (and only if) the Security Team grants > +permission, deploy fixed versions during the embargo. Permission for > +deployment, and any restrictions, will be stated in the embargoed > +advisory text.

    Do you have a corresponding patch to our advisory template to add a section with an XXX for this? > +

    The Security Team will normally permit such deployment, even for > +systems where VMs are managed or used by non-members of the > +predisclosure list. The Security Team will impose deployment > +restrictions only insofar as it is necessary to prevent the exposure > +of technicalities (for example, differences in behaviour) which > +present a significant risk of rediscovery of the vulnerability. Such > +situations are expected to be rare.

    >

    NOTE: Prior v2.2 of this policy (25 June 2014) it was > permitted to also make available the allocated CVE number. This is no > longer permitted in accordance with MITRE policy.