[prev in list] [next in list] [prev in thread] [next in thread] 

List:       kde-core-devel
Subject:    RFC: Performing code security audits before releases...
From:       Dawit Alemayehu <adawit () kde ! org>
Date:       2002-02-25 7:10:03
[Download RAW message or body]


Hello,

I want to begin a discussion on performing proactive security audits of the our codebase before
each release.  I am by no means a security expert, but some of the common security problems like 
buffer overruns/overflows can be checked and tested for with minimal effort using tools like RATS.
This way our code is at least checked for some of these common flaws in software design.  No 
matter the tool or the effort put forth we cannot obviously catch all such problem, but that does not 
mean we should not attempt to find the ones we can.  

For starters I generated and attached below a report for the entire kdelibs directory using RATS 
(http://www.securesw.com/rats/).  Perhaps using the lessons we learn from using tools like this we can
write a HOWTO article or create methods to avoid the pitfalls.  I encourage everyone who is responsible
for some piece of code in kdelibs to go through the report and see if there is anything they need to fix 
based on it.  I personally plan to go through the entire report and verify things.  If I come accross something
questionable, I will send email to author(s) listed in the source code.  Please note that the report is not 
necessarily correct all the time.  It will have false positives where the code is being reported as being a 
potential problem when in actuality it might not be.

Hopefully this will start good discussion about code security in general and along with the memory profiling
 tool (valgrind) make KDE even much better than it current is.  In the future I would love to see a period 
(perhaps few days) built into the release schedule for performing such audits in the future.

Regards,
Dawit A.
["kdelibs-audit.gz" (application/x-gzip)]

[prev in list] [next in list] [prev in thread] [next in thread]