Re: [PATCH 3/3] RFC: SECURITY.md: Rough draft of codifying the maintainer process

On Wed, Jul 29, 2026 at 8:45 AM Stephen Smalley
<[email protected]> wrote:
>
> On Thu, Jul 23, 2026 at 9:30 AM Stephen Smalley
> <[email protected]> wrote:
> >
> > On Thu, Jul 23, 2026 at 2:25 AM Jason Zaman <[email protected]> wrote:
> > > +If unsure about whether an issue is in kernel or userspace, feel free to send
> > > +to any and the maintainers will handle it internally.
> >
> > I'd recommend sending to both rather than any to avoid potential loss/delay.
> > We should also mention that private vulnerability reporting is now
> > enabled on GitHub,
> > so another option is to submit via:
> > https://github.com/SELinuxProject/selinux/security/advisories
>
> We may also want to add something like the following to SECURITY.md:
> Bugs in libsepol that only affect policy compilers (checkpolicy,
> checkmodule, secilc) are not considered

I would also add the semodule-utils (semodule_expand/link/package) as
well to the list above.

> security vulnerabilities. The policy compilers are typically run
> without any privileges and attackers who
> can feed them arbitrary inputs can do more interesting things. We will
> fix such bugs but will not create
> security advisories for them.