5 ms·
Linux distributions do need to reboot on a regular basis to apply security patches. In particular any kernel changes need a restart to take effect. The last s
by calpaterson 11y ago
Linux distributions do need to reboot on a regular basis to apply security patches. In particular any kernel changes need a restart to take effect.
The last security advisory affecting the linux kernel for Debian was 5 days ago (https://www.debian.org/security/2015/dsa-3426 https://www.debian.org/security/2015/dsa-3426). There was another one about a month before that (https://www.debian.org/security/2015/dsa-3426 https://www.debian.org/security/2015/dsa-3426).
Additionally because of the way shared libraries are loaded in Linux after you apply the patches you might have old, unpatched versions of (eg openssl) linked into currently running processes. There are a few ways to handle this but a restart is one very simple one that is guaranteed to work.
Consequently any Linux machine that has more than about a month of uptime is probably missing patches. 500 days of uptime corresponds to a huge number of unpatched vulnerabilities. So restarting is quite important and is unlikely to go away soon.
- pdkl95 11y agoYou don't need to restart to patch openssl. Kernel-patches are usually the only reason a restart is needed. This idea that a restart is needed is Windows-style thinking. > more than about a month of uptime is probably missing patches Only when you don't know how to properly maintain a Linux box. A reboot is one way to handle patches. It is even recommended when you are changing anything related to the startup process. For everything else, you simply need to restart any process using the old libs. If it wasn't a security patch, you can often simply wait for processes to finish normally.
- calpaterson 11y agoI did mention that there are multiple options for dealing with out-of-date libraries. I implied it but I didn't make it clear: debian's security team releases a kernel patch about once a month. This is where the ceiling on uptime comes from.
- regularfry 11y agoOnly because ksplice got borged. Which, in a funny way, makes this Oracle's fault...
- calpaterson 11y agoThere seems to have been some progress on this front recently though - kgraft and kpatch or whatever they are called currently.
- jamespo 11y agoWhat you often find when reboots are avoided like the plague however is the system doesn't come up cleanly on boot, init scripts weren't configured etc.
- Xylakant 11y agoWe regularly reboot machines exactly for that reason: by doing so we know they'll come back up when we need them to.