Privilege escalation policy: third draft

[Matthias Clasen]

On Mon, 2010-01-25 at 22:00 -0800, Adam Williamson wrote:
> 
> == New and changed privilege escalation mechanisms ==
> 
> Any new privilege escalation mechanisms (where mechanism is defined as
> "the code that directly causes privilege escalation") must be submitted
> to, and approved by, the Fedora packaging committee. The development and
> QA mailing lists must be notified of the approval of new privilege
> escalation mechanisms. Any significant changes to the semantics of
> existing privilege escalation mechanisms (except for changes that are
> obviously not security-relevant) must be announced to the development
> and QA mailing lists.

Not to sound disrespectful, but why should the packaging committee have
and special say in privilege escalation mechanisms ? How does a special
interest in spec file syntax qualify for security audits ?

I propose to s/packaging committee/FESCo/ there.