Gentoo Logo

Gentoo Linux Security

Content:

1.  Security in Gentoo Linux

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. The Gentoo Linux Security Project is tasked with providing timely information about security vulnerabilities in Gentoo Linux, along with patches to secure those vulnerabilities. We work directly with vendors, end users and other OSS projects to ensure all security incidents are responded to quickly and professionally.

You can find a document describing the policy the security team follows to treat the vulnerabilities found in the Gentoo Linux distribution on the Vulnerability Treatment Policy page.

Installing a secure Gentoo system

The Gentoo Security Handbook gives information and tips for building a secure system and hardening existing systems.

Keeping your Gentoo system secure

To stay up-to-date with the security fixes you should subscribe to receive GLSAs and apply GLSA instructions whenever you have an affected package installed. Alternatively, syncing your portage tree and upgrading every package should also keep you up-to-date security-wise.

Integration of security-only updates in Portage tools is underway. In the mean time, you can try our experimental glsa-check tool (part of the gentoolkit package) to check if a specific GLSA applies to your system (-p option), list all GLSAs with applied/affected/unaffected status (-l option) or apply a given GLSA to your system (-f option).

2.  Gentoo Linux Security Announcements (GLSAs)

Gentoo Linux Security Announcements are notifications that we send out to the community to inform them of security vulnerabilities related to Gentoo Linux or the packages contained in our portage repository.

Recent Advisories

GLSA Severity Package Description Bug
201408-18 Normal net-analyzer/nrpe NRPE: Multiple Vulnerabilities 397603
201408-17 High app-emulation/qemu QEMU: Multiple vulnerabilities 505946
201408-16 Normal www-client/chromium Chromium: Multiple vulnerabilities 504328
201408-15 Normal dev-db/postgresql-server PostgreSQL: Multiple vulnerabilities 456080
201408-14 Normal net-misc/stunnel stunnel: Information disclosure 503506
201408-13 Normal dev-python/jinja Jinja2: Multiple vulnerabilities 497690
201408-12 High www-servers/apache Apache HTTP Server: Multiple vulnerabilities 504990
201408-11 High dev-lang/php PHP: Multiple vulnerabilities 459904
201408-10 Normal dev-libs/libgcrypt Libgcrypt: Side-channel attack 519396

For a full list of all published GLSAs, please see our GLSA index page.

How to receive GLSAs

GLSA announcements are sent to the gentoo-announce@gentoo.org mailing-list, and as a RDF feed available at http://www.gentoo.org/rdf/en/glsa-index.rdf.

3.  Security Team contact information

Gentoo Linux takes security vulnerability reports very seriously. Please file new vulnerability reports on Gentoo Bugzilla and assign them to the Gentoo Security product and Vulnerabilities component. Click here to directly submit a new security vulnerability. The Gentoo Linux Security Team will ensure all security-related bug reports are responded to in a timely fashion.

If you find errors or omissions in published GLSAs, you should also file a bug in Gentoo Bugzilla in the Gentoo Security product, but with GLSA Errors component. Click here to directly submit a new GLSA bug.

Confidential contacts

You have two options to submit non-public vulnerabilities to the Gentoo Linux Security Team. You may submit a bug in Gentoo Bugzilla using the New-Expert action, or the Enter a new bug report (advanced) link, and check the Gentoo Security checkbox in the Only users in all of the selected groups can view this bug section. You may also contact directly using encrypted mail one of the following security contacts:

Name Responsability Email GPG keyID (click to retrieve public key)
Alex Legler Operational co-manager a3li@gentoo.org 0x12EE3000
Tobias Heinlein Operational co-manager keytoaster@gentoo.org 0xDC33B0EE

Note: You can see a full list of Gentoo developers, including their GPG key ID on our list of active developers.

4.  Resources

Security pages

Links



Print

Page updated September 1, 2010

Summary: This page is the entry point for all Gentoo Linux security concerns.

Ned Ludd
Author

Kurt Lieber
Author

Thierry Carrez
Author

Donate to support our development efforts.

Copyright 2001-2014 Gentoo Foundation, Inc. Questions, Comments? Contact us.