<div dir="ltr"><div>On behalf of the board, I'd like to acknowledge that given the growing usage of LLVM in wildly different areas, having some structure or process to address security aspects is important, if not critical, for the health and success of the LLVM project as a whole.</div><div><br></div><div>The board will fully support this group, but will not "run" it, as this does not fall in the Foundation's remits.</div><div><br></div><div>We believe this is mostly an entity thing (companies, distributions, ...), and these are notoriously slow to react. It has to interact with their own security groups and their internal processes (SDL, ...) ; the usually active people on the mailing list are not necessarily the ones interested in this topic.</div><div><br></div><div>Each security advisory being very specific (spectre is quite different from stack protection), plus the LLVM projects spectrum growing overtime (f18, mlir, libc, ...) makes us think that the people in that group are rather well identified security aware / knowledgeable / trusted contacts points in the entities (and used to deal with coordination amongst entities) rather than deep technical experts (the former is mandatory, the second is nice to have). Actual technical experts spot-on the advisory under work will need to be brought in on a need be basis by the security group. The board believes the real benefit with this group is the coordination of the security fix investigation and deployment amongst the different community entity-members.<br></div><div><br></div><div>Finally, we believe it's best to begin with a small & motivated group, laying the foundations, and then extend it on a need be basis.<br></div><div><br></div><div>On behalf of the board, I'd like to invite those who think their entity should care about this proposal to prod the relevant person(s) in their entity to comment on this proposal, preferably on the mailing list or phabricator, but worst case directly to JF or myself.</div><div><br></div><div>Once we have some more comments / feedback, we can think of committing this policy, and forming an initial group.</div><div><br></div><div>Kind regards,</div><div>Arnaud</div><div><br></div><br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_quote"><div dir="ltr" class="gmail_attr">From: <strong class="gmail_sendername" dir="auto">Serge Guelton via llvm-dev</strong> <span dir="auto"><<a href="mailto:llvm-dev@lists.llvm.org" target="_blank">llvm-dev@lists.llvm.org</a>></span><br>Date: Thu, Jan 9, 2020 at 4:55 PM<br>Subject: Re: [llvm-dev] [RFC] LLVM Security Group and Process<br>To: JF Bastien <<a href="mailto:jfbastien@apple.com" target="_blank">jfbastien@apple.com</a>><br>Cc: llvm-dev <<a href="mailto:llvm-dev@lists.llvm.org" target="_blank">llvm-dev@lists.llvm.org</a>><br></div><br><br><div dir="ltr">Hi JF,<br><br> Answering your question both as an individual and with a red hat:<br> <br>> Should we create a security group and process?<br><br>Yes! That's a good starter, and some bits of formalization are likely to be beneficial.<br><br>> Do you agree with the goals listed in the proposal?<br><br>Yes.<br><br>> At a high-level, what do you think should be done differently, and what do you think is exactly right in the draft proposal?<br><br>I like the non-intrusive coordination aspect. It also helps to have a group to speak with for responsible disclosure.<br><br>The dispatch mechanism to actual developers is unclear. Do they need to be part of the group? How are thy contacted / based on which criteria?<br><br> <br>> Our approach to this issue:<br><br>> 1. Are you an LLVM contributor (individual or representing a company)?<br><br>yes and yes (Red Hat)<br><br><br>> 2. Are you involved with security aspects of LLVM (if so, which)?<br><br>In the past: yes, building an obfuscating compiler based on LLVM.<div>In my current role: yes, trying to implement / catch-up with some of the gcc hardening feature clang doesn't have (e.g. -fstack-clash-protection and _FORTIFY_SOURCE improvement recently)<br><br> <br>> 3. Do you maintain significant downstream LLVM changes?<br><br></div><div>We're trying to have as few patches as possible, so that's a small yes.<br></div><div><br> <br>> 4. Do you package and deploy LLVM for others to use (if so, to how many people)?<br><br>Yes (Fedora and RHEL)</div><div><br>> 5. Is your LLVM distribution based on the open-source releases?<br><br>Yes., with a larger delay for RHEL.<br><br> <br>> 6. How often do you usually deploy LLVM?<br><br>At least one for each Major and minor update (Fedora) and then backports + RHEL.<br><br>> 7. How fast can you deploy an update?<br><br>For fedora, it can be a matter of days. For RHEL it takes longer but it can be ~ 1 week.<br> <br><br>> 8.Does your LLVM distribution handle untrusted inputs, and what kind?<br>> 9. What’s the threat model for your LLVM distribution?<br><br>I don't think we have something specific to LLVM in the threat model, especially as gcc is the system compiler for both distributions.<br><br>--</div><div>Serge</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jan 8, 2020 at 6:36 AM JF Bastien via llvm-dev <<a href="mailto:llvm-dev@lists.llvm.org" target="_blank">llvm-dev@lists.llvm.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>Hi folks!<div><br></div><div>I want to ping this discussion again, now that the holidays are over. I’ve updated the patch to address the comments I’ve received.</div><div><br></div><div>Overall it seems the feedback is positive, with some worries about parts that aren’t defined yet. I’m trying to get things started, so not everything needs to be defined yet! I’m glad folks have ideas of *how* we should define what’s still open.</div><div><br></div><div><br></div><div>Thanks,</div><div><br></div><div>JF</div><div><br><div><br><blockquote type="cite"><div>On Nov 15, 2019, at 10:58 AM, JF Bastien via llvm-dev <<a href="mailto:llvm-dev@lists.llvm.org" target="_blank">llvm-dev@lists.llvm.org</a>> wrote:</div><br><div><div><h1><span style="font-weight:normal;font-size:12px"><font face="HelveticaNeue">Hello compiler enthusiasts,</font></span></h1><font face="HelveticaNeue"><span><div><font face="HelveticaNeue"><span><br></span></font></div>The Apple LLVM team would like to propose that a new a security process and an associated private LLVM Security Group be created under the umbrella of the LLVM project.</span><br><br><span>A draft proposal for how we could organize such a group and what its process could be is </span></font><a href="https://reviews.llvm.org/D70326" target="_blank">available on Phabricator</a><font face="HelveticaNeue"><span>. The proposal starts with a list of goals for the process and Security Group, repeated here:</span><br><br><span>The LLVM Security Group has the following goals:</span><br></font><ol><li><font face="HelveticaNeue">Allow LLVM contributors and security researchers to disclose security-related issues affecting the LLVM project to members of the LLVM community.</font></li><li><font face="HelveticaNeue">Organize fixes, code reviews, and release management for said issues.</font></li><li><font face="HelveticaNeue">Allow distributors time to investigate and deploy fixes before wide dissemination of vulnerabilities or mitigation shortcomings.</font></li><li><font face="HelveticaNeue">Ensure timely notification and release to vendors who package and distribute LLVM-based toolchains and projects.</font></li><li><font face="HelveticaNeue">Ensure timely notification to users of LLVM-based toolchains whose compiled code is security-sensitive, through <a href="https://cve.mitre.org/" target="_blank">the CVE process</a>.</font></li></ol><font face="HelveticaNeue"><br><span>We’re looking for answers to the following questions:</span><br></font><ol><li><font face="HelveticaNeue"><u>On this list</u>: Should we create a security group and process?</font></li><li><font face="HelveticaNeue"><u>On this list</u>: Do you agree with the goals listed in the proposal?</font></li><li><font face="HelveticaNeue"><u>On this list</u>: at a high-level, what do you think should be done differently, and what do you think is exactly right in the draft proposal?</font></li><li><font face="HelveticaNeue"><u>On the Phabricator code review</u>: going into specific details, what do you think should be done differently, and what do you think is exactly right in the draft proposal?</font></li><li><font face="HelveticaNeue"><u>On this list</u>: to help understand where you’re coming from with your feedback, it would be helpful to state how you personally approach this issue:</font></li><ol><li><font face="HelveticaNeue">Are you an LLVM contributor (individual or representing a company)?</font></li><li><font face="HelveticaNeue">Are you involved with security aspects of LLVM (if so, which)?</font></li><li><font face="HelveticaNeue">Do you maintain significant downstream LLVM changes?</font></li><li><font face="HelveticaNeue">Do you package and deploy LLVM for others to use (if so, to how many people)?</font></li><li><font face="HelveticaNeue">Is your LLVM distribution based on the open-source releases?</font></li><li><font face="HelveticaNeue">How often do you usually deploy LLVM?</font></li><li><font face="HelveticaNeue">How fast can you deploy an update?</font></li><li><font face="HelveticaNeue">Does your LLVM distribution handle untrusted inputs, and what kind?</font></li><li><font face="HelveticaNeue">What’s the threat model for your LLVM distribution?</font></li></ol></ol><font face="HelveticaNeue"><br><span>Other open-source projects have security-related groups and processes. They structure their group very differently from one another. This proposal borrows from some of these projects’ processes. A few examples:</span><br></font><ul><li><a href="https://webkit.org/security-policy/" target="_blank"><font face="HelveticaNeue">https://webkit.org/security-policy/</font></a></li><li><a href="https://chromium.googlesource.com/chromium/src/+/lkgr/docs/security/faq.md" target="_blank"><font face="HelveticaNeue">https://chromium.googlesource.com/chromium/src/+/lkgr/docs/security/faq.md</font></a></li><li><a href="https://wiki.mozilla.org/Security" target="_blank"><font face="HelveticaNeue">https://wiki.mozilla.org/Security</font></a></li><li><a href="https://www.openbsd.org/security.html" target="_blank"><font face="HelveticaNeue">https://www.openbsd.org/security.html</font></a></li><li><a href="https://security-team.debian.org/security_tracker.html" target="_blank"><font face="HelveticaNeue">https://security-team.debian.org/security_tracker.html</font></a></li><li><a href="https://www.python.org/news/security/" target="_blank"><font face="HelveticaNeue">https://www.python.org/news/security/</font></a></li></ul><font face="HelveticaNeue"><span>When providing feedback, it would be great to hear if you’ve dealt with these or other projects’ processes, what works well, and what can be done better.</span><br><br><br><span>I’ll go first in answering my own questions above:</span><br></font><ol><li><font face="HelveticaNeue">Yes! We should create a security group and process.</font></li><li><font face="HelveticaNeue">We agree with the goals listed.</font></li><li><font face="HelveticaNeue">We think the proposal is exactly right, but would like to hear the community’s opinions.</font></li><li><font face="HelveticaNeue">Here’s how we approach the security of LLVM:</font></li><ol><li><font face="HelveticaNeue">I contribute to LLVM as an Apple employee.</font></li><li><font face="HelveticaNeue">I’ve been involved in a variety of LLVM security issues, from automatic variable initialization to security-related diagnostics, as well as deploying these mitigations to internal codebases.</font></li><li><font face="HelveticaNeue">We maintain significant downstream changes.</font></li><li><font face="HelveticaNeue">We package and deploy LLVM, both internally and externally, for a variety of purposes, including the clang, Swift, and mobile GPU shader compilers.</font></li><li><font face="HelveticaNeue">Our LLVM distribution is not directly derived from the open-source release. In all cases, all non-upstream public patches for our releases are available in repository branches at <a href="https://github.com/apple" target="_blank">https://github.com/apple</a>.</font></li><li><font face="HelveticaNeue">We have many deployments of LLVM whose release schedules vary significantly. The LLVM build deployed as part of Xcode historically has one major release per year, followed by roughly one minor release every 2 months. Other releases of LLVM are also security-sensitive and don’t follow the same schedule.</font></li><li><font face="HelveticaNeue">This depends on which release of LLVM is affected.</font></li><li><font face="HelveticaNeue">Yes, our distribution sometimes handles untrusted input.</font></li><li><font face="HelveticaNeue">The threat model is highly variable depending on the particular language front-ends being considered.</font></li></ol></ol><font face="HelveticaNeue"><span>Apple is involved with a variety of open-source projects and their disclosures. For example, we frequently work with the WebKit community to handle security issues through their process.</span><br><br><br><span>Thanks,</span><br><br><span>JF</span></font><br><div><font face="HelveticaNeue"><span><br></span></font></div></div>_______________________________________________<br>LLVM Developers mailing list<br><a href="mailto:llvm-dev@lists.llvm.org" target="_blank">llvm-dev@lists.llvm.org</a><br><a href="https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev" target="_blank">https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev</a><br></div></blockquote></div><br></div></div>_______________________________________________<br>
LLVM Developers mailing list<br>
<a href="mailto:llvm-dev@lists.llvm.org" target="_blank">llvm-dev@lists.llvm.org</a><br>
<a href="https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev" rel="noreferrer" target="_blank">https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev</a><br>
</blockquote></div>
_______________________________________________<br>
LLVM Developers mailing list<br>
<a href="mailto:llvm-dev@lists.llvm.org" target="_blank">llvm-dev@lists.llvm.org</a><br>
<a href="https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev" rel="noreferrer" target="_blank">https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev</a><br>
</div></div>
</blockquote></div></div>