Update the SECURITY.txt document. Clarify what is meant by a "direct compromise of...

diff --git a/binutils/SECURITY.txt b/binutils/SECURITY.txt
index 18d711c8252a42a247110be182ddee3b254f0815..41065131d93d69a2ae0a6ab93ad3fde19d8782f1 100644 (file)
--- a/binutils/SECURITY.txt
+++ b/binutils/SECURITY.txt
@@ -8,9 +8,11 @@ What is a binutils security bug?
     network, or might compromise the security of data stored on it.
     In the context of GNU Binutils there are two ways in which such
     bugs might occur.  In the first, the programs themselves might be
-    tricked into a direct compromise of security.  In the second, the
-    tools might introduce a vulnerability in the generated output that
-    was not already present in the files used as input.
+    tricked into a direct compromise of security, allowing operations
+    with elevated or unauthorized permissions than the executing
+    user.  In the second, the tools might introduce a vulnerability in
+    the generated output that was not already present in the files
+    used as input.
 
     Other than that, all other bugs will be treated as non-security
     issues.  This does not mean that they will be ignored, just that
@@ -34,6 +36,20 @@ Notes:
     they should be appropriately sandboxed if they are used to examine
     malicious or potentially malicious input files.
 
+    The tools assume that the input is to be trusted.  If this is not
+    the case then the tools should be run inside a sandboxed
+    environment to ensure that they do not compromise the host
+    environment.  In the context of this document then a bug which
+    relies upon using untrusted input, eg a crafted binary, must show
+    that the result is a breach of trust boundary, e.g. being able to
+    execute code as another user or root, or escape from the sandboxed
+    environment.  If this is not possible then the bug will not be
+    considered a security bug.
+
+    All the tools in binutils are command line programs or internal
+    libraries used to build those programs.  None of them are intended
+    to provide a network accessible service.
+
 Reporting private security bugs
 ===============================