[binutils-gdb] Update the SECURITY.txt document. Clarify what is meant by a "direct compromise of security", emphas

[Nick Clifton]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=e1428067748d6b713637241855d1c315fb657c8b

commit e1428067748d6b713637241855d1c315fb657c8b
Author: Nick Clifton <nickc@redhat.com>
Date:   Thu May 7 10:53:46 2026 +0100

    Update the SECURITY.txt document. Clarify what is meant by a "direct compromise of security", emphasise that the tools do not provide a sevrice of any kind, and show that bugs that rely upon untrusted input must be able to cross a trust boundary in order to be considered as a security issue.

Diff:
---
 binutils/SECURITY.txt | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/binutils/SECURITY.txt b/binutils/SECURITY.txt
index 18d711c8252..41065131d93 100644
--- a/binutils/SECURITY.txt
+++ b/binutils/SECURITY.txt
@@ -8,9 +8,11 @@ What is a binutils security bug?
     network, or might compromise the security of data stored on it.
     In the context of GNU Binutils there are two ways in which such
     bugs might occur.  In the first, the programs themselves might be
-    tricked into a direct compromise of security.  In the second, the
-    tools might introduce a vulnerability in the generated output that
-    was not already present in the files used as input.
+    tricked into a direct compromise of security, allowing operations
+    with elevated or unauthorized permissions than the executing
+    user.  In the second, the tools might introduce a vulnerability in
+    the generated output that was not already present in the files
+    used as input.
 
     Other than that, all other bugs will be treated as non-security
     issues.  This does not mean that they will be ignored, just that
@@ -34,6 +36,20 @@ Notes:
     they should be appropriately sandboxed if they are used to examine
     malicious or potentially malicious input files.
 
+    The tools assume that the input is to be trusted.  If this is not
+    the case then the tools should be run inside a sandboxed
+    environment to ensure that they do not compromise the host
+    environment.  In the context of this document then a bug which
+    relies upon using untrusted input, eg a crafted binary, must show
+    that the result is a breach of trust boundary, e.g. being able to
+    execute code as another user or root, or escape from the sandboxed
+    environment.  If this is not possible then the bug will not be
+    considered a security bug.
+
+    All the tools in binutils are command line programs or internal
+    libraries used to build those programs.  None of them are intended
+    to provide a network accessible service.
+
 Reporting private security bugs
 ===============================