Re: [PATCH 3/3] RFC: SECURITY.md: Rough draft of codifying the maintainer process

Johannes Segitz <[email protected]> Wed, 29 Jul 2026 15:33:41 +0200

Newsgroups	org.kernel.vger.selinux
Message-ID	<[email protected]>

On Wed, Jul 29, 2026 at 09:06:39AM -0400, Stephen Smalley wrote:
> On Wed, Jul 29, 2026 at 8:45 AM Stephen Smalley
> <[email protected]> wrote:
> >
> > On Thu, Jul 23, 2026 at 9:30 AM Stephen Smalley
> > <[email protected]> wrote:
> > >
> > > On Thu, Jul 23, 2026 at 2:25 AM Jason Zaman <[email protected]> wrote:
> > > > +If unsure about whether an issue is in kernel or userspace, feel free to send
> > > > +to any and the maintainers will handle it internally.
> > >
> > > I'd recommend sending to both rather than any to avoid potential loss/delay.
> > > We should also mention that private vulnerability reporting is now
> > > enabled on GitHub,
> > > so another option is to submit via:
> > > https://github.com/SELinuxProject/selinux/security/advisories
> >
> > We may also want to add something like the following to SECURITY.md:
> > Bugs in libsepol that only affect policy compilers (checkpolicy,
> > checkmodule, secilc) are not considered
> 
> I would also add the semodule-utils (semodule_expand/link/package) as
> well to the list above.

Maybe don't list any components, but just state that issues that require an
attacker controlled policy source are bugs, but not security issues

Johannes
-- 
GPG Key                EE16 6BCE AD56 E034 BFB3  3ADD 7BF7 29D5 E7C8 1FA0
Subkey fingerprint:    250F 43F5 F7CE 6F1E 9C59  4F95 BC27 DD9D 2CC4 FD66
SUSE Software Solutions Germany GmbH, Frankenstr. 146, 90461 Nürnberg, Germany
www.suse.com, Geschäftsführer: Jochen Jaser, Andrew McDonald, Abhinav Puri, (HRB 36809, AG Nürnberg)

signature.asc (application/pgp-signature, 870 B)