[PATCH 5/5] gdb: improve SECURITY.txt relating to embedded language bugs

[Andrew Burgess <aburgess@redhat.com>]

The SECURITY.txt document has some text about how GDB provides access
to Python, Guile, and Shell interpreters, and how security bugs are
only a GDB security bug if the bug is specifically caused by GDB's
implementation, rather than being a consequence of having access to
these languages.

However, the existing language was maybe not as clear as it could be.
Currently we say:

  "...and the effect can only be reproduced when executed in the GDB
  environment."

I think it is clearer if we instead say:

  "...and the effect is caused by a bug in GDB's implementation rather
  than being an inherent consequence of the executed code, or being a
  bug in the underlying language."

This tries to split the problem space into 3 cases:

  (1) A bug in the underlying language is not a GDB bug.

  (2) That GDB allows you to run harmful code via the extension
      languages is not a GDB bug.

  (3) A bug that only exists because of a bug in GDB's implementation
      of the extension languages is a GDB bug.
---
 gdb/SECURITY.txt | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/gdb/SECURITY.txt b/gdb/SECURITY.txt
index b484a1f65a1..f4bcc656406 100644
--- a/gdb/SECURITY.txt
+++ b/gdb/SECURITY.txt
@@ -122,9 +122,10 @@ What Is Not A Security Bug
   GDB provides 3 different turing complete languages, Guile, Python
   and direct access to the shell.  Making use of these languages can
   have unknown effects, including outside of the GDB process.  Such
-  effects will only be considered security bugs if they fit some of the
-  definitions in this document and the effect can only be reproduced
-  when executed in the GDB environment.
+  effects will only be considered security bugs if they fit some of
+  the definitions in this document and the effect is caused by a bug
+  in GDB's implementation rather than being an inherent consequence of
+  the executed code, or being a bug in the underlying language.
 
   Any issues that arise from running an untrusted program outside of a
   secure environment are not security bugs in GDB.  Any issues that
-- 
2.25.4