4 ms·
On Linux, you can absolutely overwrite libraries that are still used by running applications. The OS will just not reclaim the disk space until all those proces
by fencepost 8y ago
On Linux, you can absolutely overwrite libraries that are still used by running applications. The OS will just not reclaim the disk space until all those processes end (e.g. by means of reboot), but new processes will start using the new libs immediately.
Which if you're not careful could lead to undetectably unpatched systems - installed version is up to date, files on disk match if you check to verify, but some process that didn't get properly restarted is still using the (effectively) undetectable old version. Combine that with taking pride in triple digit uptime days and you could have something sticking around for a long time.
- icebraining 8y agoIt's not undetectable; just run "pmap [pid]" and it will show the loaded libraries with "(deleted)" at the front if the original file no longer exists: https://stackoverflow.com/questions/4786975/what-is-a-deleted-segment-in-linux-pmap-output https://stackoverflow.com/questions/4786975/what-is-a-delete...
- fencepost 8y agoThat's both a correct and useful answer and one that proves my point in practical terms. If you know enough to run pmap over the process space of the server to look for issues like this, you also know enough to force restarts of the affected services post-update. I could see this being something to add to automated monitoring tools run on a schedule, but I don't know enough to estimate the viability or usefulness of actually doing so - would it end up being a rule that in 99.999% of cases would only actually match if it happened to fire as the server was in the process of shutting down?
- icebraining 8y agoTooling around that already exists: if you install the needrestart package on Debian, it will check every time apt upgrades something, so that you can restart daemons and such.