docs/linux: updated reporting security bugs guide

[novitoll]

Updated the documentation with:

• vulnerability definition and kernel security bug description
• reporting security procedure per https://docs.kernel.org/process/security-bugs.html
• CVE assignment per https://www.kernel.org/doc/html/latest/process/cve.html, and recent Greg K-H video from the recent conference, https://www.youtube.com/watch?v=KumwRn1BA6s
• reporting to linux-distros per https://oss-security.openwall.org/wiki/mailing-lists/distros

Removed minor, major security bug classifications as now, CVE is assigned to the issue even it triggers WARN_ON with panic_on_warn enabled and reboots the system.

Since there are 4 different parties with own interests:

• [email protected] wants to release the fix ASAP, but can be postponed if the reporter asks an embargo period to let linux-distros update their kernels.

• [email protected] is included in the mailing list, once the fix is developed, but NOT merged in the stable tree

Once the fix lands on the stable tree, [email protected] should not be mentioned in the conversation as they don't have any further interests.

• [email protected] is notified once the fix is publicly merged to the stable tree

• [email protected] is notified if the CVE should be assigned to the fix which is publicly merged to the stable tree.

reporting_kernel_bugs.png generation:

• Go to https://draw.io/
• Click "Open the existing diagram" -> "Upload" tab
• Browse to the repository's docs/linux/reporting_kernel_bugs.drawio
• Make necessary changes
• Click "Export as" -> PNG -> disable "Include a copy of my diagram"
  as we've already included the draw.io scheme as the separate
  file
• Press "Ctrl-Shift-S" or "Cmd-Shift-S" on macOS to save ".drawio"
  format (draw.io scheme)

Fixes: #4714

CC: @xairy , @dvyukov , @ramosian-glider , @a-nogikh , @tarasmadan

[novitoll]

This can be also sent for the confirmation to [email protected] and CC with [email protected] before PR merge

[ramosian-glider]

I love the graph, thanks a lot for making it!

A couple of nits:

• can you please add an instruction for generating it to the commit message?
• there are two arrows going from the reporter to [email protected] and oss-security, but it is not clear from the picture at which point the letter to oss-security should be sent. If the blue numbers 1-4 on the picture correspond to steps 1-4 below, maybe the second arrow should be marked with the number 2?

[novitoll]

Thanks for the comments! I've updated the .md with syntax/grammar corrections, updated .drawio scheme and .png graph with the addressed comments. PTAL

[a-nogikh]

Thanks for updating the docs!

[novitoll]

PTAL. I'd like to have the confirmation that the updated instructions and diagram are accurate from @xairy , [email protected] and CC with [email protected] before PR merge. I can send the email referring to this PR after @ramosian-glider , @a-nogikh reviews (thanks again for the comments!)

[ramosian-glider]

s/embargo/Embargo (please capitalize the phrases in the white blocks)

It is also unclear who is requesting the extension, and what is the maximum possible embargo period (is it 14 or 7+14 days?)

[novitoll]

I've clarified with the following:

Embargo period is up to 7 calendar days, with the maximum additional 7 calendar days extension (14 days in total) which should be requested by the reporter with [email protected] and
linux-distros coordination.

[ramosian-glider]

Why does the font change before "after-the-fact"?

Also, we can make it shorter:

CVEs are typically assigned after the fix is merged (see linux-cve-announce list). If a CVE is missing or needed before the fix reaches upstream, contact [email protected].

[novitoll]

Fixed the font size to 12 px for all the most right comment boxes. Changed the description for the proposed shorter version.

[novitoll]

@ramosian-glider , @a-nogikh I've resolved all reviews, thanks! PTAL. I will send this current version to Greg for the confirmation that the graph is logically correct. Will update this message with the posted lore link.

UPDT1: Posted here in lore.

UPDT2: Updated the diagram with the most recent version.

UPDT3: Received Greg's comments and recommendations not to contact linux-distros. Please let me know how to proceed further as I'm confused.

[novitoll]

UPDT3: Received Greg's comments and recommendations not to contact linux-distros. Please let me know how to proceed further as I'm confused.

I should've started with the conversation with Greg first as it seems, linux-distros shouldn't be contacted at all as it's not recommended by the Linux security team. Please check the lore thread in UPDT1:
https://lore.kernel.org/all/2024111153-percent-arbitrate-3c6a@gregkh/T/#t

So I think we should just remove all security guidelines so as not to confuse syzkaller users and just point them to kernel docs. Hence, the "nicely" drawn diagram is not needed here maybe(?), perhaps, we can leave only [email protected] as the only reporting party.

I'll wait for any comments related to this and send here the adjusted guideline version tomorrow, where Greg's recommendations are followed.

UPDT:
We need to choose either option:

• docs/linux: updated reporting security bugs - strictly follow [email protected] #5502 - the updated, alternative, strict version without other parties' involvement in security bugs reporting process. The same reviewed sections as in this PR but with emphasizing that it's recommended to follow kernel.org reporting policy.

• docs/linux: updated reporting security bugs guide #5461 - current PR which as it seems, brings confusions with linux-distros involvement and contradictions of [email protected] recommendation.