3 ms·
You don't need to restart to patch openssl. Kernel-patches are usually the only reason a restart is needed. This idea that a restart is needed is Windows-style
by pdkl95 11y ago
You don't need to restart to patch openssl. Kernel-patches are usually the only reason a restart is needed.
This idea that a restart is needed is Windows-style thinking.
> more than about a month of uptime is probably missing patches
Only when you don't know how to properly maintain a Linux box. A reboot is one way to handle patches. It is even recommended when you are changing anything related to the startup process.
For everything else, you simply need to restart any process using the old libs. If it wasn't a security patch, you can often simply wait for processes to finish normally.
- calpaterson 11y agoI did mention that there are multiple options for dealing with out-of-date libraries. I implied it but I didn't make it clear: debian's security team releases a kernel patch about once a month. This is where the ceiling on uptime comes from.
- regularfry 11y agoOnly because ksplice got borged. Which, in a funny way, makes this Oracle's fault...
- calpaterson 11y agoThere seems to have been some progress on this front recently though - kgraft and kpatch or whatever they are called currently.
- jamespo 11y agoWhat you often find when reboots are avoided like the plague however is the system doesn't come up cleanly on boot, init scripts weren't configured etc.
- Xylakant 11y agoWe regularly reboot machines exactly for that reason: by doing so we know they'll come back up when we need them to.