Re: [PATCH 0/1] MAINTAINERS: add security quotient field

[Michael S. Tsirkin]

On Tue, Jul 14, 2020 at 02:06:30PM +0530, P J P wrote:
> From: Prasad J Pandit <pjp@fedoraproject.org>
> 
> Hello,
> 
> QEMU supports numerous virtualisation and emulation use cases.
> It offers many features to support guest's function(s).
> 
> All of these use cases and features are not always security relevant.
> Because some maybe used in trusted environments only. Some may still
> be in experimental stage. While other could be very old and not
> used or maintained actively.
> 
> Recently we received multiple security issue reports against VVFAT
> and VirtFS host directory sharing system. After discussing with the
> respective maintainers, it turned out that
> 
> * VVFAT -> https://bugs.launchpad.net/qemu/+bug/1883083
>   VVFAT is quite old and is available for testing purposes only.
>   Ie. It is not suitable for production environments.
> 
> * VirtFS/9pfs -> https://wiki.qemu.org/Documentation/9psetup
>   VirtFS implementation though better, it is most commonly used for
>   automated testing under sand-boxed server environments, ie. no
>   malicious party there. It is also not mature enough for cloud services.
>   It is supported on 'Odd Fixes' basis atm.
> 
> So these turned out to be issues which can be fixed as regular bugs.
> 
> For security bug analysis we generally consider use cases wherein
> QEMU is used in conjunction with the KVM hypervisor, which enables
> guest to use hardware processor's virtualisation features.
> 
> This patch introduces the CVE (or Security or Trust) Quotient field
> in the MAINTAINERS file. It tries to capture the security sensitivity
> pertaining to a feature or section of the QEMU's code base.
> 
> It indicates whether a potential issue should be treated as a security
> one OR it could be fixed as a regular non-security bug.
> 
>     If Quotient == High, triage issues as potential security ones.
>     if Quotient == Low,  triage issues as regular non-security bugs.
> 
> I have tagged each section in the MAINTAINERS file as High or Low on best
> guess basis. I request respective maintainers to kindly review it please.
> 
> If you have any inputs/suggestions, I'd really appreciate them.
> 
> Thank you.

So this attempts to specify a security aspect of specific files.
Which works for some use-cases (e.g. devices) but not others
(common utility functions).

I'd like to propose add a flag that limits QEMU to a secured subset
of functionality at runtime instead.
Then we can just tell security researchers "reproduce this with
-security=high or it's not a security issue".


> --
> Prasad J Pandit (1):
>   MAINTAINERS: introduce cve or security quotient field
> 
>  MAINTAINERS | 324 ++++++++++++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 324 insertions(+)
> 
> --
> 2.26.2