5 ms·

Maybe I'm missing what's ancient about Fedora or RHEL, care to share?

by NAK21 5y ago

CoolGuySteve 5y ago
RHEL 7 came out 6 years ago with Linux 3.10 and is still getting patched. Somebody has to manage and integrate all those security fixes in all those packages without breaking the old codebases.
- chasil 5y ago
  ...it's not just getting patched. Kernelcare has given me 48 hotfixes on a 3.10 kernel that I booted last year. kcarectl --patch-info | awk '/^kpatch-name/{print ++n};{print}' .... 48 kpatch-name: 3.10.0/proc-restrict-pagemap-access-1062.patch kpatch-description: Restrict access to pagemap/kpageflags/kpagecount kpatch-kernel: kpatch-cve: kpatch-cvss: kpatch-cve-url: http://googleprojectzero.blogspot.ru/2015/03/exploiting-dram-rowhammer-bug-to-gain.html kpatch-patch-url: uname: 3.10.0-1160.25.1.el7
  - jaboutboul 5y ago
    +1 for KernelCare.
  - gnufx 5y ago
    Is "kpatch" there actually the same thing as RHEL's kpatch? I thought Kernelcare used something proprietary.
    - chasil 5y ago
      The Kernelcare front end tool is kcarectl. Ksplice (Oracle) was first, followed by kgraft (Suse), and kpatch (RedHat). According to the article below, kpatch is x86/64 only, uses ftrace, provides runtime patches only until the next minor kernel release on a standard license, does not address all CVEs, and cannot be used with "SystemTop or kprobe." "KernelCare has no such limitations." https://blog.kernelcare.com/competitors/kpatch-overview-of-enterprise-live-patching-services https://blog.kernelcare.com/competitors/kpatch-overview-of-e...
      - gnufx 5y ago
        I asked because the listing said "kpatch" in the output of the command. I've never used Kernelcare, only suggested investigating it, despite it being proprietary. Ksplice was done by MIT students, not Oracle. I used it long before Oracle bought it, initially with my own patches (and actually after that as a "legacy" customer). kpatch isn't just x86_64; it's in at least ppc64le RHEL 7, although not for the "alt kernel" on the POWER9 systems I use. I don't know whether it's the case, but their comparison rather suggests Kernelcare is based on Ksplice.
- gnufx 5y ago
  Actually, POWER9 RHEL7 has Linux 4.x, where x depends on the minor release -- unfortunately not the latest on the system I use. I think aarch64 is similar, but I'd have to look for rpm to check. They need similar attention, of course. Anyway, RHEL kernels have various features backported to the vanilla version on which it was originally based, not just security patches, which probably makes the job harder. It is a major effort.

Maybe I'm missing what's ancient about Fedora or RHEL, care to share?

by NAK21 5y ago

Maybe I'm missing what's ancient about Fedora or RHEL, care to share?

RHEL 7 came out 6 years ago with Linux 3.10 and is still getting patched. Somebody has to manage and integrate all those security fixes in all those packages without breaking the old codebases.

chasil 5y ago
...it's not just getting patched. Kernelcare has given me 48 hotfixes on a 3.10 kernel that I booted last year. kcarectl --patch-info | awk '/^kpatch-name/{print ++n};{print}' .... 48 kpatch-name: 3.10.0/proc-restrict-pagemap-access-1062.patch kpatch-description: Restrict access to pagemap/kpageflags/kpagecount kpatch-kernel: kpatch-cve: kpatch-cvss: kpatch-cve-url: http://googleprojectzero.blogspot.ru/2015/03/exploiting-dram-rowhammer-bug-to-gain.html kpatch-patch-url: uname: 3.10.0-1160.25.1.el7
- jaboutboul 5y ago
  +1 for KernelCare.
- gnufx 5y ago
  Is "kpatch" there actually the same thing as RHEL's kpatch? I thought Kernelcare used something proprietary.
  - chasil 5y ago
    The Kernelcare front end tool is kcarectl. Ksplice (Oracle) was first, followed by kgraft (Suse), and kpatch (RedHat). According to the article below, kpatch is x86/64 only, uses ftrace, provides runtime patches only until the next minor kernel release on a standard license, does not address all CVEs, and cannot be used with "SystemTop or kprobe." "KernelCare has no such limitations." https://blog.kernelcare.com/competitors/kpatch-overview-of-enterprise-live-patching-services https://blog.kernelcare.com/competitors/kpatch-overview-of-e...
    - gnufx 5y ago
      I asked because the listing said "kpatch" in the output of the command. I've never used Kernelcare, only suggested investigating it, despite it being proprietary. Ksplice was done by MIT students, not Oracle. I used it long before Oracle bought it, initially with my own patches (and actually after that as a "legacy" customer). kpatch isn't just x86_64; it's in at least ppc64le RHEL 7, although not for the "alt kernel" on the POWER9 systems I use. I don't know whether it's the case, but their comparison rather suggests Kernelcare is based on Ksplice.
gnufx 5y ago
Actually, POWER9 RHEL7 has Linux 4.x, where x depends on the minor release -- unfortunately not the latest on the system I use. I think aarch64 is similar, but I'd have to look for rpm to check. They need similar attention, of course. Anyway, RHEL kernels have various features backported to the vanilla version on which it was originally based, not just security patches, which probably makes the job harder. It is a major effort.