Review of a secure software development process for glibc.

[Carlos O'Donell]

Community,

We have been looking at how glibc is developed for a long time
and as a community we have been improving that process with respect
to security.

The improvements are incremental, starting with a security policy, and
then a security team and glibc CNA to handle security issues.

Security is important. We implement the core C library on the GNU system,
GNU/Linux systems, as well as many other systems that use Linux as the kernel.
The project should be as secure as we can make it by default, while allowing
users to harden it even further based on their requirements.

I have written up a secure software development process (SSDLC) for glibc.
Such a document should help us talk about our current development practices,
where there are gaps in our security and how to improve them.

While we're talking about secure software development, I want to be clear
that I'm not talking about where to host such infrastructure, though the
document I wrote does carry notes about CTI, Sourceware, and the GNU
Project hosting. I'm happy to update the document based on feedback.

I'm starting this thread not to discuss any hosting change, instead it is
to discuss the what and the why around improving security regardless of
hosting.

I've written a broader document about the GNU Toolchain as a whole to see
if any security requirements from the top-level would apply to glibc:
https://sourceware.org/glibc/wiki/SSDLC

The "What is being suggested and why?" applies broadly to all our
security work, and I encourage you to read the top-level document for
context.

This document is glibc specific:
https://sourceware.org/glibc/wiki/SSDLC/Policy/glibc

The specifics here are about glibc and defining what we expect from the
infrastructure, developer end points, and our process, and how that
creates something that is sustainably secure and what services we need
for that process.

Some of the items in the writeup are the same as in Mark's writeup in
"Suggested secure development policies for projects"
https://sourceware.org/cyber-security-faq.html, but structured
into NIST SP 800-218-based buckets and applied specifically to glibc.

Please have a look through the documents and provide any feedback.

-- 
Cheers,
Carlos.