Re: A place to start

[Michael Grice <grice@berbee.com>]

At this point, I probably fit into the 3/4 too, but I do have a few
thoughts on the topic:

1) Group the .c and .h files so that:
   a) Files are logically grouped according to function wherever possible
   b) Each group is roughly the same size (i.e., x thousand lines of code,
      where the size is ideally small enough that those of us in the 3/4
      are more likely to be able to contribute)

2) Assign the first set of groups based on priority to the folks in the 1/4

3) Maintain a list of unassigned groups and assign them to the folks who've
   finished their first assignment and anybody else who would like to help

It may also be beneficial to have multiple people look at each section
of code, especially if people are looking at the code from different
perspectives.

I suspect gathering documentation on how to audit kernel code would help
many of us (including me). I have done auditing before in other fields
(I audited pesticide and toxicology studies before they were submitted to
the EPA and FDA), but I've never audited code before. Some of it seems
fairly straightforward (don't use strcpy(), do use boundary checking,
a la the Secure Unix Programming FAQ), but I am not especially clear on
where to start in auditing a particular section of code.

I am willing, however, to compile or help compile a list of guidelines,
especially given some pointers, with the goal of helping people get
started (including myself).  
--Michael

On Sun, 11 Jun 2000, Tom Vogt wrote:

> Daniel Taylor <dante@plethora.net> wrote:
> > 200 people, 4500 .c and .h files, that's about 23 files per person.
> 
> 200 is the number of subscribers. expect that a quarter or less are both
> capable and willing to contribute.
> 
> I include myself in the 3/4, most likely. I have a large project of my own,
> so between that and my job and the rest of my life there isn't much time
> left.
> 
> -- 
> Welcome to the Information Superspyway
> 
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/
> 


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/