Re: [Xen-devel] [PATCH for-4.9] livepatch: Declare live patching as a supported feature

[George Dunlap <george.dunlap@xxxxxxxxxx>]

On 26/06/17 16:36, Ross Lagerwall wrote:
> Xen Live Patching has been available as tech preview feature since Xen
> 4.7 and has now had a couple of releases to stabilize. Xen Live patching
> has been used by multiple vendors to fix several real-world security
> issues without any severe bugs encountered. Additionally, there are now
> tests in OSSTest that test live patching to ensure that no regressions
> are introduced.
> 
> Based on the amount of testing and usage it has had, we are ready to
> declare live patching as a 'Supported' feature.

Great write-up, Ross, thanks.  I more or less agree with everything
except...

> * Bugs in livepatch-build-tools creating incorrect live patch that
>   results in an insecure host:
>     If livepatch-build-tools creates an incorrect live patch that
>     results in an insecure host, this shall not be considered a security
>     issue. There are too many OSes and toolchains to consider supporting
>     this. A live patch should be checked to verify that it is valid
>     before loading.

I'm not sure I follow the argument here.  Suppose in one months' time it
is discovered that livepatch-build-tools, under some circumstances,
creates patches that open up a side vulnerability.  Do you really think
we should just post a fix to the mailing list, without alerting anybody
who may be affected by it?

Rememeber, "security support" doesn't mean, "We promise there are no
bugs".  It means, "If bugs are discovered, we will notify people
according to the XenProject Security Response Process"; and this is not
only for people on the pre-disclosure list, but for everyone *not* on
the list as well, to have one place to find all security-related issues
relevant to Xen.

 -George


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel