5 ms·

>Patch ASAP What exactly do you patch? Say you have a TCP server, written in Python or in Go. Do you have to update Python and Go ASAP then and recompile the G

by cft 11y ago

>Patch ASAP What exactly do you patch? Say you have a TCP server, written in Python or in Go. Do you have to update Python and Go ASAP then and recompile the Go server? Custom compiled Apache, Nginx? Recompile those? That's a lot of work..

r1ch 11y ago
Unless you statically link glibc, updating glibc is enough.
nitrogen 11y ago
If you have dynamically linked libc (which you should), you only need to upgrade libc and restart all network processes. [Does anyone know if systemd in pid1 calls getaddrinfo? If so, this is another good reason for a minimal pid1, as you will need to reboot]
- Xylakant 11y ago
  you need to restart all processes that might do a network address lookup. That's pretty much every daemon.
- noselasd 11y ago
  You don't need to reboot to restart systemd, you can run systemctl daemon-reexec
- the_why_of_y 11y ago
  No reboot needed: man systemctl daemon-reexec Reexecute the systemd manager. This will serialize the manager state, reexecute the process and deserialize the state again. This command is of little use except for debugging and package upgrades. Sometimes, it might be helpful as a heavy-weight daemon-reload. While the daemon is being reexecuted, all sockets systemd listening on behalf of user configuration will stay accessible.
asveikau 11y ago
Unless you are linking statically (and I don't really understand why you would) you update glibc and that's it. This question had me feeling kind of old. Does nobody learn what shared libraries are anymore?
- mentat 11y ago
  That isn't it, see siblings here. You have to restart all processes that load glibc and interact with the affected services.
  - w8rbt 11y ago
    Debian does this automatically and alerts the user what services are being restarted.
    - muppetman 11y ago
      I updated this morning and nothing got restarted. Shouldn't pretty much every network service I have gotten a restart? sshd, postfix, apache, icecast2, dovecot None of them restarted. So I restarted them all myself...
    - drummer32 11y ago
      It doesnt't. There's the needsrestart package that does this though.
- cdelsolar 11y ago
  Go?
- rspeer 11y ago
  Well, now, a lot of people are making containers, which are static linking turned up to 11. I bet this bug will live on forever in people's Docker stacks.
- yxhuvud 11y ago
  Does libc even support static linking?
msbarnett 11y ago
You patch glibc. Everything else is dynamically linking it.
- muraiki 11y ago
  I think it's possible to statically link glibc in Go, but I don't recall the particular compiler incantations offhand.
kyrra 11y ago
For Go, depending on your compile settings, you don't need to recompile. Go 1.5+ uses a pure Go DNS resolver [1], you have to force Go to use glibc. And even if you use glibc, it is not statically linked. [0] https://golang.org/pkg/net/ https://golang.org/pkg/net/ (see "netdns" setting) [1] https://go-review.googlesource.com/#/c/11584/ https://go-review.googlesource.com/#/c/11584/
peterwwillis 11y ago
Here's how to find packages on your system with statically linked applications (that probably use glibc): [root@server ~]# find /bin/ /sbin/ /usr/bin/ /usr/sbin/ /usr/lib* /usr/local/bin/ /usr/local/sbin/ /usr/local/lib* -type f -perm /u+x -exec file {} \; | grep statically | cut -d : -f 1 | xargs rpm -qf | sort -u busybox-1.2.0-7.el5.x86_64 cryptsetup-luks-1.0.3-5.el5.i386 cryptsetup-luks-1.0.3-5.el5.x86_64 device-mapper-1.02.39-1.el5.i386 device-mapper-1.02.39-1.el5.x86_64 device-mapper-multipath-0.4.7-34.el5_5.1.x86_64 dmraid-1.0.0.rc13-63.el5.x86_64 dump-0.4b41-4.el5.x86_64 e2fsprogs-1.39-23.el5.x86_64 glibc-2.5-123.el5_11.1.i686 glibc-2.5-123.el5_11.1.x86_64 glibc-common-2.5-123.el5_11.1.x86_64 grub-0.97-13.5.x86_64 ... etc. And yes, it can be a lot of work. It's easier to only use your distro's official packages and update the patched ones they release. Luckily most software devs are smart and compile dynamically.
saturn_vk 11y ago
But go dynamically links against libc by default

by cft 11y ago

r1ch 11y ago

Unless you statically link glibc, updating glibc is enough.

nitrogen 11y ago

If you have dynamically linked libc (which you should), you only need to upgrade libc and restart all network processes. [Does anyone know if systemd in pid1 calls getaddrinfo? If so, this is another good reason for a minimal pid1, as you will need to reboot]

Xylakant 11y ago
you need to restart all processes that might do a network address lookup. That's pretty much every daemon.
noselasd 11y ago
You don't need to reboot to restart systemd, you can run systemctl daemon-reexec
the_why_of_y 11y ago
No reboot needed: man systemctl daemon-reexec Reexecute the systemd manager. This will serialize the manager state, reexecute the process and deserialize the state again. This command is of little use except for debugging and package upgrades. Sometimes, it might be helpful as a heavy-weight daemon-reload. While the daemon is being reexecuted, all sockets systemd listening on behalf of user configuration will stay accessible.

asveikau 11y ago

Unless you are linking statically (and I don't really understand why you would) you update glibc and that's it. This question had me feeling kind of old. Does nobody learn what shared libraries are anymore?

mentat 11y ago
That isn't it, see siblings here. You have to restart all processes that load glibc and interact with the affected services.
- w8rbt 11y ago
  Debian does this automatically and alerts the user what services are being restarted.
  - muppetman 11y ago
    I updated this morning and nothing got restarted. Shouldn't pretty much every network service I have gotten a restart? sshd, postfix, apache, icecast2, dovecot None of them restarted. So I restarted them all myself...
  - drummer32 11y ago
    It doesnt't. There's the needsrestart package that does this though.
cdelsolar 11y ago
Go?
rspeer 11y ago
Well, now, a lot of people are making containers, which are static linking turned up to 11. I bet this bug will live on forever in people's Docker stacks.
yxhuvud 11y ago
Does libc even support static linking?

msbarnett 11y ago

You patch glibc. Everything else is dynamically linking it.

muraiki 11y ago
I think it's possible to statically link glibc in Go, but I don't recall the particular compiler incantations offhand.

kyrra 11y ago

For Go, depending on your compile settings, you don't need to recompile. Go 1.5+ uses a pure Go DNS resolver [1], you have to force Go to use glibc. And even if you use glibc, it is not statically linked. [0] https://golang.org/pkg/net/ https://golang.org/pkg/net/ (see "netdns" setting) [1] https://go-review.googlesource.com/#/c/11584/ https://go-review.googlesource.com/#/c/11584/

peterwwillis 11y ago

Here's how to find packages on your system with statically linked applications (that probably use glibc): [root@server ~]# find /bin/ /sbin/ /usr/bin/ /usr/sbin/ /usr/lib* /usr/local/bin/ /usr/local/sbin/ /usr/local/lib* -type f -perm /u+x -exec file {} \; | grep statically | cut -d : -f 1 | xargs rpm -qf | sort -u busybox-1.2.0-7.el5.x86_64 cryptsetup-luks-1.0.3-5.el5.i386 cryptsetup-luks-1.0.3-5.el5.x86_64 device-mapper-1.02.39-1.el5.i386 device-mapper-1.02.39-1.el5.x86_64 device-mapper-multipath-0.4.7-34.el5_5.1.x86_64 dmraid-1.0.0.rc13-63.el5.x86_64 dump-0.4b41-4.el5.x86_64 e2fsprogs-1.39-23.el5.x86_64 glibc-2.5-123.el5_11.1.i686 glibc-2.5-123.el5_11.1.x86_64 glibc-common-2.5-123.el5_11.1.x86_64 grub-0.97-13.5.x86_64 ... etc. And yes, it can be a lot of work. It's easier to only use your distro's official packages and update the patched ones they release. Luckily most software devs are smart and compile dynamically.

saturn_vk 11y ago

But go dynamically links against libc by default