Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Thu, 15 Jul 2021 11:25:53 -0700
From:   Kees Cook <keescook@chromium.org>
To:     Norbert Manthey <nmanthey@amazon.de>
Cc:     Kroah-Hartman <greg@kroah.com>,
        LKML <linux-kernel@vger.kernel.org>,
        "Woodhouse, David" <dwmw@amazon.co.uk>,
        "foersleo@amazon.de" <foersleo@amazon.de>,
        Gustavo Pimentel <gustavo.pimentel@synopsys.com>,
        "Gustavo A. R. Silva" <garsilva@embeddedor.com>,
        Thomas Gleixner <tglx@linutronix.de>,
        Colin Ian King <colin.king@canonical.com>,
        Dave Jones <davej@codemonkey.org.uk>,
        linux-hardening@vger.kernel.org
Subject: Re: Coverity Scan model file, license, public access
Message-ID: <202107151111.23BA48F99@keescook>
References: <d7f096ee-7a9b-684e-433a-f8f3f0e6288d@amazon.de>
 <YOSKuEcPoy/dw0st@kroah.com>
 <a41221c8-86e5-494d-68fd-0a0b87c99e83@amazon.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <a41221c8-86e5-494d-68fd-0a0b87c99e83@amazon.de>
Precedence: bulk

On Thu, Jul 15, 2021 at 03:12:04PM +0200, Norbert Manthey wrote:
> On 7/6/21 6:54 PM, Kroah-Hartman wrote:
> > 
> > 
> > On Tue, Jul 06, 2021 at 09:45:47AM +0200, Norbert Manthey wrote:
> >> Dear all,
> >>
> >> I would like to work with code analysis on the Linux kernel. The
> >> currently used Coverity setup already uses a model file [1] to improve
> >> the precision of the analysis. To the best of my knowledge, this model
> >> file is currently not publicly accessible. I did not find a license
> >> attached to  [1], nor any information about licensing.
> > 
> > I have no idea who wrote that thing, sorry.
> 
> Is there anybody else who knows more about the history of the used
> Coverity model? Thanks.

As far as I know, the model was written originally by Dave Jones, with
further changes from myself and, I think, Colin Ian King.

I thought it was visible through the Coverity dashboard, once you're
logged in:
https://scan.coverity.com/projects/linux-next-weekly-scan?tab=analysis_settings
(See 'Modeling file loaded [View]')

Regardless, I keep a copy in git since I'd been tweaking it (mostly to
no meaningful benefit: the model file doesn't work with macros, which is
where the bulk of the false positives in Coverity come from):
https://github.com/kees/coverity-linux

-- 
Kees Cook