From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTPS id 0FA423858D38 for ; Mon, 12 Feb 2024 17:07:08 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 0FA423858D38 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 0FA423858D38 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1707757629; cv=none; b=hD/Mgg9JNRdl9JA75XLnTVkzkOog9MOZg4BUcePIVGpfAcoR73p4BKXOpji7Shjag+JYEYXJcRHu3+6w3fE/7O1HC7pCOI+e+3AOUB27iMmB3OZsAssZRR5+Nz8sc+qlgvkcd+L2WG2SpnPYoK5m8a9YAcl6zCoKPEWjjstJ0eA= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1707757629; c=relaxed/simple; bh=rpNcgU/1h7QHe2ddvfOFVZFjC7d4V5XGsxPXuFjZXNg=; h=DKIM-Signature:Message-ID:Date:MIME-Version:Subject:To:From; b=SkQ0X5nKq76275rvSpk7iXfhatC0kl4/BZUmWlGBsarF2jv6cYzpPmL5/v85Njiwp1pbu3dVUX1VPghANUTyL4nmXd2vsqVznLhmx20ftbUTBMJSy7qWgI6tINTade8Mje7hAhBkf1J3uapcYKXkO6tPqnMUzDc/5ZZm4Qdc0Zo= ARC-Authentication-Results: i=1; server2.sourceware.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1707757627; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=FkT/SBj2RCLOOUP8Wj1KMI9zwIPUU2i5TN1SYMjf/uU=; b=K4k/fBE70H/KeXvf0SN8fei4EKxuu8UPn7JGUxVVP+nuLJnr00lyBElcZCEewtZU9I55He wr2qZMFf+ocViXlloGuNKhFhH28/H5Ii3rt4IKeL9j26TRCaQ0KfaRwcHLhZJDS2o6nm34 EaZ9UWTQIlmJKeQ+ybb0zB2rc3DTtS0= Received: from mail-qv1-f70.google.com (mail-qv1-f70.google.com [209.85.219.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-29-9cWrDQghP2y2lFv-MrcyPA-1; Mon, 12 Feb 2024 12:07:06 -0500 X-MC-Unique: 9cWrDQghP2y2lFv-MrcyPA-1 Received: by mail-qv1-f70.google.com with SMTP id 6a1803df08f44-68c4f2aca5dso64022166d6.3 for ; Mon, 12 Feb 2024 09:07:06 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1707757625; x=1708362425; h=content-transfer-encoding:in-reply-to:from:references:cc:to :content-language:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=FkT/SBj2RCLOOUP8Wj1KMI9zwIPUU2i5TN1SYMjf/uU=; b=HvmdsfhOpSXvJp3D5JMeoF7Wn39sgU6m8CyI7yRpOApzf/CHnAjfw2u6eLR85OQpcb pbPUQioo9nEh8QhZ407w1JKm7sfdemF8D9mlTDifn9zRvLyT0w5vVTq1tsXfE0RDNl3i tvjeOI350LKzyLrSUZmbgEpkml5jKDTRUD6NbWQdjMVY7lHlUMkYPWb77yUxLka6seH9 ETw99GICM/lIotrgrr5w22UEMnUDQ7G2UMhp76GYkj5lKBsxNXW8gelM/Gw9n4Hc2YSz VJfYD1OJqetZ65eNqkf5Suh1uqyuhO8c0ha+MXPqB4oSIj7bnA9IhdbN+bxJtmk76Ay5 kKMw== X-Forwarded-Encrypted: i=1; AJvYcCXQI41vcbq+FikPGkgNagXn4l2tTAvVwVtk5ZvvlERNHUnVUYpp3M5zJVKmbAtWXcvVpXgEmArKXRCxw+Ud87dPt+qkUWHEn7gtJQ== X-Gm-Message-State: AOJu0YzqECcgPWM7iEPFNVRU32FsdY07NPJFuuLiP8cZXc4wOxTSuRi4 Lt+JLgb1R3pi5D83JUm+qwxvmvw3apVZFLZ6gzrck214edVoG/X5zkcvuO3sAqnVfjqOV2LlHf3 2VnJVXpABsIA1pwS5b90AeLBsE+u5OpqPKp/iwtszGCEv4xrYbc30lNs4W2CcC6nxj6c= X-Received: by 2002:a05:6214:529b:b0:68c:7a7e:d59f with SMTP id kj27-20020a056214529b00b0068c7a7ed59fmr11262530qvb.15.1707757625643; Mon, 12 Feb 2024 09:07:05 -0800 (PST) X-Google-Smtp-Source: AGHT+IFiW9/p+a+onYudvMX+zIdySmH526PdOP0FQOxOGaxU/Hle7qhBKuqJ/c6WJVIqMoQkz1T8zg== X-Received: by 2002:a05:6214:529b:b0:68c:7a7e:d59f with SMTP id kj27-20020a056214529b00b0068c7a7ed59fmr11262502qvb.15.1707757625340; Mon, 12 Feb 2024 09:07:05 -0800 (PST) X-Forwarded-Encrypted: i=1; AJvYcCXrIggmWH4Gc7Jh+uAHAmb+dS+ekD8R7ljj/QZeCffcuh0I9vnE5AfD5SkW4F/CfXw5WHxGcYLaL42AjJ2Yzz3u4qtzP0ywpRwV/Cz77vgT1/bDteA9PPBFDk1qxqJNyj6PtkHA4J4jps3kDY3ZP5DN3mQ0Zb2nNxEoRRRVV/HL6tZ9d0BNucQjxVwc+5MVBvip/RFaR1xCwpEeBDYQlnhCWoucGBA= Received: from [192.168.0.182] ([76.68.24.30]) by smtp.gmail.com with ESMTPSA id oh9-20020a056214438900b0068e473530bbsm104130qvb.33.2024.02.12.09.07.04 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 12 Feb 2024 09:07:04 -0800 (PST) Message-ID: Date: Mon, 12 Feb 2024 12:06:55 -0500 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [RFC] Adding a SECURITY policy for GDB To: Guinevere Larsen , Andrew Burgess , gdb-patches@sourceware.org Cc: Kevin Buettner , Simon Marchi , felix.willgerodt@intel.com, Paul Koning References: <877cmvui64.fsf@redhat.com> <87wmtog2f4.fsf@redhat.com> From: Siddhesh Poyarekar In-Reply-To: X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-15.7 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,TXREP,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: On 2024-02-12 11:43, Guinevere Larsen wrote: > On 08/12/2023 16:05, Andrew Burgess wrote: >> One last thing, while writing this, I did wonder if this text would be >> better moved into the GDB manual, and the gdb/SECURITY.txt document >> should just say "See the GDB manual", but I figure that's a problem for >> future me, for now I just need to find some words we can all agree on. >> >> Thanks, >> Andrew > > Would it be possible to do the opposite and have the docs pull from the > txt document? I like the idea of having specific files that are easy to > check as a developer or end user, and I think having a file that says > "look at that other file" that contains everything GDB (and thus makes > it harder to quickly find what you're looking for) would muddle that a > little bit. Not to mention the fact that $topsrcdir/SECURITY* is the first place where people tend to look to report potential security issues. This is similar in principle to "Reporting bugs"; the manual is usually the last place one would look, although it makes sense to *also* put it in the manual. Thanks, Sid