Adding Security audit

[amye]

Adding security audit, editing readme with new security.md file.
This would be super to pass the DCO bot as everything matches now. :)

[cyphar]

LGTM, though I guess publishing the report counts as public disclosure of the double-volume issue.

[caniszczyk]

@cyphar is there a fix in flight for the issue yet?

[cyphar]

@caniszczyk I'm still working on it. I'll try to arrange a hotfix, but as mentioned on the mailing list the only real solution is to wholesale port everything to libpathrs (which is going to take a while).

EDIT: Also this report has a slight inaccuracy when talking about the double-volume bug -- there are actually two ways to mount over a file descriptor (you just mount over /proc/self/fd/... or you can use the new mount API's move_mount which actually has a MOVE_MOUNT_T_EMPTY_PATH flag).

[cyphar]

CVE-2019-19921 has been assigned for the issue.

[carnil]

@cyphar, when will be details on CVE-2019-19921 be public? I see the CVE is as well mentioned in https://lore.kernel.org/stable/20191230052036.8765-2-cyphar@cyphar.com/

Edit: nevermind, I see the Security-Audit.pdf contains the report and is accessible.

[cyphar]

@carnil I plan to (re)publish the details on the relevant security mailing lists after I have a PR open for the issue (there won't be an embargo because it was publicly disclosed by this PR).

[leoluk]

Here's the original report: #2197

[estesp]

needs a rebase

[caniszczyk]

LGTM

[cyphar]

@caniszczyk You merged master, rather than rebasing. Fixed.

LGTM.

[cyphar]

Travis failure was because @amye's Signed-off-by lines were lowercase (pushed fixed commits). To be honest, I think we should disable git-validation because this is getting to be a pain in the ass. Who cares if the Signed-off-by is not capitalised!?

[cyphar]

LGTM.

[amye]

Removing redundant checks++

[cyphar]

And now PullApprove is broken. 😡 Screw it, I'm just going to merge once Travis succeeds and count @caniszczyk's LGTM as applying to the newest commits.