linux-hardening - Re: Linux kernel Coverity model file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 21 Jun 2023 11:36:06 -0700
From:   Kees Cook <keescook@...omium.org>
To:     "Manthey, Norbert" <nmanthey@...zon.de>
Cc:     "Woodhouse, David" <dwmw@...zon.co.uk>,
        "Stieger, Andreas" <astieger@...zon.de>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        linux-hardening@...r.kernel.org
Subject: Re: Linux kernel Coverity model file

On Fri, Jun 16, 2023 at 01:44:01PM +0000, Manthey, Norbert wrote:
> some time ago you pointed me at the github copy of the Coverity model
> that is used for the Linux kernel analysis [1].

Hi!

> I investigated the effect of using this model, and compared defects
> reported with and without the model. Before I deep dive into
> modifications, I wanted to understand whether there is a more recent
> version (the current one is about 4 years old). I currently have no
> access to the public linux dashboard to directly check the effect
> there.
> 
> In case there is a more recent model file, can you please update the
> github repository?

This model file is current -- we haven't changed it in quite some time.

> In case I find additions, is the following a good procedure to share
> model updates? I would run an analysis on a defined Linux commit with
> the current model and the proposed additions, and would report the
> effect on the reported defects. Is there anything else I am missing?

Yes please! Either send a patch to the linux-hardening@...r.kernel.org
mailing list or send a PR to the github repo.

-Kees

> [1] https://github.com/kees/coverity-linux

-- 
Kees Cook