os/doc
3
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
doc/en/security/security.sgml
Brad Davis 1b1897d38c - 7.0 is now not supported officially by secteam. 
- Add the release/EoL dates for 7.2.

Submitted by:	pluknet@gmail via -doc@
Approved by:	cperciva@
2009-05-06 19:58:24 +00:00

316 lines
12 KiB
Text
Raw Blame History

<!DOCTYPE HTML PUBLIC "-//FreeBSD//DTD HTML 4.01 Transitional-Based Extension//EN" [
<!ENTITY base CDATA "..">
<!ENTITY date "$FreeBSD: www/en/security/security.sgml,v 1.206 2009/05/02 01:48:41 cperciva Exp $">
<!ENTITY title "FreeBSD Security Information">
<!ENTITY % navinclude.support "INCLUDE">
<!ENTITY % developers SYSTEM "../developers.sgml"> %developers;
<!ENTITY advisories.html.inc SYSTEM "advisories.html.inc">
]>
<!-- $FreeBSD: www/en/security/security.sgml,v 1.206 2009/05/02 01:48:41 cperciva Exp $ -->
<html>
&header;
<h2>Introduction</h2>
<p>This web page is designed to assist both new and experienced
users in the area of FreeBSD security. FreeBSD takes security
very seriously and is constantly working on making the operating
system as secure as possible.</p>
<h2>Table of Contents</h2>
<ul>
<li><a href="#how">How and where to report a FreeBSD security issue</a></li>
<li><a href="#sec">Information about the FreeBSD Security Officer</a></li>
<li><a href="#pol">Information handling policies</a></li>
<li><a href="#sup">Supported FreeBSD Releases</a></li>
</ul>
<h2>Other Security Links</h2>
<ul>
<li><a href="charter.html">Charter for the Security Officer and Team</a></li>
<li><a href="advisories.html">List of FreeBSD Security Advisories</a></li>
<li><a href="&base;/doc/en_US.ISO8859-1/books/handbook/security-advisories.html">
Reading FreeBSD Security Advisories</a></li>
</ul>
<a name="how"></a>
<h2>How and where to report a FreeBSD security issue</h2>
<p>All FreeBSD security issues should be reported to the <a
href="mailto:secteam@FreeBSD.org">FreeBSD Security Team</a>
or, if a higher level of confidentiality is required, PGP encrypted to the <a
href="mailto:security-officer@FreeBSD.org">Security Officer Team</a>
using the <a href="so_public_key.asc">Security Officer PGP key</a>.
All reports should at least contain:</p>
<ul>
<li>A description of the vulnerability.</li>
<li>What versions of FreeBSD seem to be affected if possible.</li>
<li>Any plausible workaround.</li>
<li>Example code if possible.</li>
</ul>
<p>After this information has been reported the Security Officer or
a Security Team delegate will get back with you.</p>
<h3>Spam filters</h3>
<p>Due to high volume of spam the main security contact mail
addresses are subject to spam filtering. If you cannot contact
the FreeBSD Security Officers or Security Team due to spam filters
(or suspect your mail has been filtered), please send mail to
<tt>security-officer-<em>XXXX</em>@FreeBSD.org</tt> with
<em>XXXX</em> replaced with <tt>3432</tt> instead of the normal
addresses. Note that this address will be changed periodically so
check back here for the latest address. Mails to this address
will go to the FreeBSD Security Officer Team.</p>
<a name=sec></a>
<h2>The FreeBSD Security Officer Team and the FreeBSD Security Team</h2>
<p>In order that the FreeBSD Project may respond to vulnerability
reports in a timely manner, there are three members of the Security
Officer mail alias: the Security Officer, Security Officer
Deputy Security Officer, and one Core Team member.
Therefore, messages sent to the <a
href="mailto:security-officer@FreeBSD.org">&lt;security-officer@FreeBSD.org&gt;</a>
mail alias are currently delivered to:</p>
<table>
<tr valign="top">
<td>&a.cperciva; <a
href="mailto:cperciva@FreeBSD.org">&lt;cperciva@FreeBSD.org&gt;</a></td>
<td>Security Officer</td>
</tr>
<tr valign="top">
<td>&a.simon; <a
href="mailto:simon@FreeBSD.org">&lt;simon@FreeBSD.org&gt;</a></td>
<td>Deputy Security Officer</td>
</tr>
<tr valign="top">
<td>&a.rwatson; <a
href="mailto:rwatson@FreeBSD.org">&lt;rwatson@FreeBSD.org&gt;</a></td>
<td>FreeBSD Core Team liaison, Release Engineering liaison,<br>
TrustedBSD Project liaison, system security architecture expert</td>
</tr>
</table>
<p>The Security Officer is supported by the <a
href="&base;/administration.html#t-secteam" >FreeBSD Security
Team</a> <a
href="mailto:secteam@FreeBSD.org">&lt;secteam@FreeBSD.org&gt;</a>,
a small group of committers vetted by the Security Officer.</p>
<a name="pol"></a>
<h2>Information handling policies</h2>
<p>As a general policy, the FreeBSD Security Officer favors full
disclosure of vulnerability information after a reasonable delay
to permit safe analysis and correction of a vulnerability, as well
as appropriate testing of the correction, and appropriate
coordination with other affected parties.</p>
<p>The Security Officer <em>will</em> notify one or more of the
FreeBSD Cluster Admins of
vulnerabilities that put the FreeBSD Project's resources under
immediate danger.</p>
<p>The Security Officer may bring additional FreeBSD developers or
outside developers into discussion of a submitted security
vulnerability if their expertise is required to fully understand
or correct the problem. Appropriate discretion will be exercised
to minimize unnecessary distribution of information about the
submitted vulnerability, and any experts brought in will act in
accordance of Security Officer policies. In the past, experts
have been brought in based on extensive experience with highly
complex components of the operating system, including FFS, the VM
system, and the network stack.</p>
<p>If a FreeBSD release process is underway, the FreeBSD Release
Engineer may also be notified that a vulnerability exists, and its
severity, so that informed decisions may be made regarding the
release cycle and any serious security bugs present in software
associated with an up-coming release. If requested, the Security
Officer will not share information regarding the nature of the
vulnerability with the Release Engineer, limiting information flow
to existence and severity.</p>
<p>The FreeBSD Security Officer has close working relationships with
a number of other organizations, including third-party vendors
that share code with FreeBSD (the OpenBSD, NetBSD and DragonFlyBSD
projects, Apple, and other vendors deriving software from FreeBSD,
as well as the Linux vendor security list), as well as
organizations that track vulnerabilities and security incidents,
such as CERT. Frequently vulnerabilities may extend beyond the
scope of the FreeBSD implementation, and (perhaps less frequently)
may have broad implications for the global networking community.
Under such circumstances, the Security Officer may wish to
disclose vulnerability information to these other organizations:
if you do not wish the Security Officer to do this, please
indicate so explicitly in any submissions.</p>
<p>Submitters should be careful to explicitly document any special
information handling requirements.</p>
<p>If the submitter of a vulnerability is interested in a
coordinated disclosure process with the submitter and/or other
vendors, this should be indicated explicitly in any submissions.
In the absence of explicit requests, the FreeBSD Security Officer
will select a disclosure schedule that reflects both a desire for
timely disclosure and appropriate testing of any solutions.
Submitters should be aware that if the vulnerability is being
actively discussed in public forums (such as bugtraq), and
actively exploited, the Security Officer may choose not to follow
a proposed disclosure timeline in order to provide maximum
protection for the user community.</p>
<p>Submissions may be protected using PGP. If desired, responses
will also be protected using PGP.</p>
<a name="sup"></a>
<h2>Supported FreeBSD Releases</h2>
<p>The FreeBSD Security Officer provides security advisories for
several branches of FreeBSD development. These are the
<em>-STABLE Branches</em> and the <em>Security Branches</em>.
(Advisories are not issued for the <em>-CURRENT Branch</em>.)</p>
<ul>
<li><p>The -STABLE branch tags have
names like <tt>RELENG_7</tt>. The corresponding builds have
names like <tt>FreeBSD 7.0-STABLE</tt>.</p></li>
<li><p>Each FreeBSD Release has an associated Security Branch.
The Security Branch tags have names like <tt>RELENG_7_0</tt>.
The corresponding builds have names like <tt>FreeBSD
7.0-RELEASE-p1</tt>.</p></li>
</ul>
<p>Issues affecting the FreeBSD Ports Collection are covered in <a
href="http://vuxml.FreeBSD.org/">the FreeBSD VuXML
document</a>.</p>
<p>Each branch is supported by the Security Officer for a limited
time only, and is designated as one of `<em>Early adopter</em>',
`<em>Normal</em>', or `<em>Extended</em>'. The designation is
used as a guideline for determining the lifetime of the branch as
follows.</p>
<dl>
<dt>Early adopter</dt>
<dd>Releases which are published from the -CURRENT branch will be
supported by the Security Officer for a minimum of 6 months after
the release.</dd>
<dt>Normal</dt>
<dd>Releases which are published from a -STABLE branch will be
supported by the Security Officer for a minimum of 12 months after the
release, and for sufficient additional time (if needed) to ensure
that there is a newer release for at least 3 months before the
older Normal release expires.
</dd>
<dt>Extended</dt>
<dd>Selected releases (normally every second release plus the last
release from each -STABLE branch) will be supported by the
Security Officer for a minimum of 24 months after the release,
and for sufficient additional time (if needed) to ensure that
there is a newer Extended release for at least 3 months before the
older Extended release expires.
</dd>
</dl>
<a name="supported-branches"></a>
<p>The current designation and estimated lifetimes of the currently
supported branches are given below. The <em>Estimated EoL
(end-of-life)</em> column gives the earliest date on which that
branch is likely to be dropped. Please note that these dates may
be extended into the future, but only extenuating circumstances
would lead to a branch's support being dropped earlier than the
date listed.</p>
<!--
Please also update www/en/releng/index.sgml when updating this
list of supported branches.
-->
<table class="tblbasic">
<tr>
<th>Branch</th>
<th>Release</th>
<th>Type</th>
<th>Release Date</th>
<th>Estimated EoL</th>
</tr>
<tr>
<td>RELENG_6</td>
<td>n/a</td>
<td>n/a</td>
<td>n/a</td>
<td>November 30, 2010</td>
</tr>
<tr>
<td>RELENG_6_3</td>
<td>6.3-RELEASE</td>
<td>Extended</td>
<td>January 18, 2008</td>
<td>January 31, 2010</td>
</tr>
<tr>
<td>RELENG_6_4</td>
<td>6.4-RELEASE</td>
<td>Extended</td>
<td>November 28, 2008</td>
<td>November 30, 2010</td>
</tr>
<tr>
<td>RELENG_7</td>
<td>n/a</td>
<td>n/a</td>
<td>n/a</td>
<td>last release + 2 years</td>
</tr>
<tr>
<td>RELENG_7_1</td>
<td>7.1-RELEASE</td>
<td>Extended</td>
<td>January 4, 2009</td>
<td>January 31, 2011</td>
</tr>
<tr>
<td>RELENG_7_2</td>
<td>7.2-RELEASE</td>
<td>Normal</td>
<td>May 4, 2009</td>
<td>May 31, 2010</td>
</tr>
</table>
<p>Older releases are not maintained and users are strongly
encouraged to upgrade to one of the supported releases mentioned
above.</p>
<p>Advisories are sent to the following FreeBSD mailing lists:</p>
<ul>
<li>FreeBSD-security-notifications@FreeBSD.org</li>
<li>FreeBSD-security@FreeBSD.org</li>
<li>FreeBSD-announce@FreeBSD.org</li>
</ul>
<p>The list of released advisories can be found on the <a
href="advisories.html">FreeBSD Security Advisories</a> page.</p>
<p>Advisories are always signed using the FreeBSD Security Officer
<a href="so_public_key.asc">PGP
key</a> and are archived, along with their associated patches, at
the <a href="http://security.FreeBSD.org/">http://security.FreeBSD.org/</a>
web server in the <a
href="http://security.FreeBSD.org/advisories/">advisories</a> and <a
href="http://security.FreeBSD.org/patches/">patches</a>
subdirectories.</p>
&footer;
</body>
</html>
Reference in a new issue View git blame Copy permalink