---
# System prepended metadata

title: 'Security WG, December 16, 2022'
tags: [' security', unikraft]

---

---
title: "Security WG, December 16, 2022"
tags: unikraft, security
datetime: 2022-12-16T15:00:00+02:00
location: Online, Discord (https://bit.ly/UnikraftDiscord), the `#monkey-business` voice channel
teams:
- security
participants:
- TODO
---

## :dart: Agenda

- Discuss "official take on security" of Unikraft as brought up by @nderjung:
  + Discuss disclosure policy (posted in the Discord chat)
  + Where to we release security fixes? Obviously staging, but do we want to backport them to stable? That's for post-1.0 releases right?
  + Should we start taking CVEs? Do we all agree that that's for post-1.0 too?
- Status updates from the GH Security Project: https://github.com/orgs/unikraft/projects/32/views/1
  + Is there any new project, or any update to the projects listed here?
  + Are there any technical difficulties with the ongoing work?
  + Are there any outstanding PRs that require external attention? A review, a merge, or simply
- Student projects: clarify scope, as we were missing @razvand in the previous meeting
  + @Alex Apostolescu: working on randomization support (in concert with @Michalis Pappas)
  + @Serban Sorohan: ASLR / memory randomization
  + @Carol Bontas: security assessment / auditing / checking

## :closed_book: Discussions

AJ: We would create a `SECURITY.md` file linking to a documentation time.

RD: For backporting, we need to first settle on the way versions are managed.
This is something left as a future step.

HL: Is the idea to have a `staging` and a `stable` branch.

AJ: Yes, a reviewed / approved PR will be merged in `staging`.
Once integration tests are done, the contribution is passed

AJ: I suggest we put this document public.

For the security@unikraft.org, Hugo is already part of.

MP: I would remove the instructions on receiving swag.

### ASLR

SS: I made it work.
I was able to make it work on the 

HL: Coccinelle could be used to learn from PRs / bugs we already fixed.

MP: SS's PR creates an entropy pool.

MR: You can go into the multiboot code.
The shadow stack feature could be activated later.
There is no chance for the attacker to do something with it.

MR: It's OK to enable it just before main, after the end of the boot process.
We can use the standard heap and just use that heap.

## :wrench: TODOs and Decisions

HL: I will update the document.
Create a page on the `docs` repository.
