Incident reporting: clarify the role of the OP-TEE project #147
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jbech-linaro
force-pushed
the
reference-imp-clarifications-2
branch
from
f613054 to
15d0975
Compare
|
Thanks for adding this @jbech-linaro
|
We have recently had a couple of security incidents being reported to the OP-TEE project. With these reports it's clear that there is a need to clarify the role of the OP-TEE project as well as adding some extra pointers to the vulnerability reporting. All in all it boils down to that the OP-TEE project serves as a reference implementation for developers and device manufacturers. A consequence of using a reference implementation is that the one using it in end products must understand that there are certain changes that needs to be done for the final product. These changes are not always available nor applicable in the vanilla and default OP-TEE reference implementation. It is important to understand that for two reasons. First is to make sure that the end product is configured to be secure. The second reason is that when there are security issues, the issue might, or might not be applicable in the OP-TEE reference implementation, in the platform code or in some cases just in a particular device or in a mix of all of them. Hence the reporter should give an extra thought regarding that before filing a security report. Signed-off-by: Joakim Bech <joakim.bech@linaro.org> Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org> Reviewed-by: Ruchika Gupta <ruchika.gupta@linaro.org>
jbech-linaro
force-pushed
the
reference-imp-clarifications-2
branch
from
15d0975 to
7e38447
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We have recently had a couple of security incidents being reported to
the OP-TEE project. With these reports it's clear that there is a need
to clarify the role of the OP-TEE project as well as adding some extra
pointers to the vulnerability reporting.
All in all it boils down to that the OP-TEE project serves as a
reference implementation for developers and device manufacturers. A
consequence of using a reference implementation is that the one using it
in end products must understand that there are certain changes that
needs to be done for the final product. These changes are not always
available nor applicable in the vanilla and default OP-TEE reference
implementation.
It is important to understand that for two reasons. First is to make
sure that the end product is configured to be secure. The second reason
is that when there are security issues, the issue might, or might not be
applicable in the OP-TEE reference implementation, in the platform code
or in some cases just in a particular device or in a mix of all of them.
Hence the reported should give an extra thought regarding the before
filing a security report.
Signed-off-by: Joakim Bech joakim.bech@linaro.org