4 ms·

you CAN lock files under linux, it's just not the default.

shakow 4y ago
But locks are suggestive, not mandatory. So if the other process does not take them into account, they just have no effect.
- chasil 4y ago
  Mandatory locking has profound security impacts. I can update glibc or other core system libraries on Linux without rebooting. Processes using the old library will show "(deleted)" in their /proc/self/maps files, but they will continue to use the old code. New processes will use the new library, and downtime was not required. This is not possible on Windows because of mandatory locking on core system libraries. As a consequence, Windows must reboot for every Patch Tuesday. There are only a few places that Linux has mandatory locking, and this is a good thing. Here is a script that will show you all the deleted libraries that are still in use on Linux: # cat stale_libraries.sh #!/bin/sh awk '$NF=="(deleted)" && $(NF-1) ~ /[.]so/ { sub(/;.*$/,"",$(NF-1)) print $(NF-1), $NF}' /proc/*/maps | sort -u Here is a script that will show you all PIDs that are running with deleted libraries: # cat stale_programs.sh #!/bin/sh grep '[.]so.*deleted)' /proc/*/maps | sed 's/[:][^/]*//' | sort -u | while read -r line do pid=${line#/} pid=${pid#*/} pid=${pid%%/*} xargs -0 printf '%s ' < "/proc/$pid/cmdline" | sed 's/[ ]$//' printf :%s\\n "$line" done Some of the maps files can only be read by root.
  - 323 4y ago
    I don't know about Windows core system libraries, but for user libraries you can do the same thing - rename old library, and put new library in it's place. Running processes will continue using the old library, and new ones will pick up the new library. The only difference is that instead of deleting the old library you need to rename it (and then delete it later). Linux doesn't need reboots only in theory. I have an Ubuntu server box and not a week passes in which I don't see a "system reboot is required" prompt when I SSH into it.
    - chasil 4y ago
      Right - POSIX is generally "advisory locking" rather than "mandatory locking," so an update process is free to overwrite any library. Windows does not allow this, which is why we have Patch Tuesday outages. Also, Oracle KSplice was the first free tool to apply updates to a running Linux kernel without rebooting. KSplice is free on Ubuntu. I think other free services have become available since. https://ksplice.oracle.com/try/desktop https://ksplice.oracle.com/try/desktop
    - P5fRxh5kUvp2th 4y ago
      then stop updating the kernel once/week. There are mechanisms for updating the kernel in-place, and I believe canonical is one of the leaders in that domain, but if you're choosing not to use it and you don't want to reboot once/week, you can still keep your system level libraries up to date without rebooting. The above poster didn't say you could update absolutely everything in linux without a reboot, just that the locking mechanisms in windows means you have to reboot to update things that don't require a reboot in linux.
      - 323 4y ago
        I didn't choose anything, it's the default Ubuntu 22 image from a big cloud provider. They enabled auto-updates, including for the kernel. They didn't enable whatever update kernel in-place mechanism Ubuntu has. I assume they know what they're doing. My point was that in theory Linux doesn't need reboots and Windows does, but in practice my Ubuntu box needs a weekly reboot, while my Windows box just once a month.
        P5fRxh5kUvp2th 4y ago
        There was never any theory that Linux doesn't need reboots to update the kernel. That's never been a general understanding in the more than 20 years that I've personally been working with Linux. What's true is that you can update everything BUT the kernel without a reboot. Any understanding of theory that involved a belief that Linux never needed a reboot to update the kernel is a flaw in your understanding rather than a problem with the theory. And in fact, the reason people have been working on being able to update the kernel without a reboot is finally put to rest that final mile. Personally I don't think it will ever come to full fruition, but the list of things that does require a reboot will become smaller and smaller over time. https://cloud7.news/article/how-to-update-linux-kernel-without-rebooting/ https://cloud7.news/article/how-to-update-linux-kernel-witho... > Rebootless Kernel updates are not a replacement for full kernel upgrades but it allows you to patch critical security vulnerabilities and bug fixes. With these methods, you can keep your servers safe and running without outage for years. > Several Linux vendors offer rebootless kernel updates. Your solution mostly depends on the distribution you are running. And finally, a bit more info about canonical's solution https://cloud7.news/article/how-to-update-linux-kernel-without-rebooting/#Canonical-Livepatch https://cloud7.news/article/how-to-update-linux-kernel-witho...

But locks are suggestive, not mandatory. So if the other process does not take them into account, they just have no effect.

chasil 4y ago
Mandatory locking has profound security impacts. I can update glibc or other core system libraries on Linux without rebooting. Processes using the old library will show "(deleted)" in their /proc/self/maps files, but they will continue to use the old code. New processes will use the new library, and downtime was not required. This is not possible on Windows because of mandatory locking on core system libraries. As a consequence, Windows must reboot for every Patch Tuesday. There are only a few places that Linux has mandatory locking, and this is a good thing. Here is a script that will show you all the deleted libraries that are still in use on Linux: # cat stale_libraries.sh #!/bin/sh awk '$NF=="(deleted)" && $(NF-1) ~ /[.]so/ { sub(/;.*$/,"",$(NF-1)) print $(NF-1), $NF}' /proc/*/maps | sort -u Here is a script that will show you all PIDs that are running with deleted libraries: # cat stale_programs.sh #!/bin/sh grep '[.]so.*deleted)' /proc/*/maps | sed 's/[:][^/]*//' | sort -u | while read -r line do pid=${line#/} pid=${pid#*/} pid=${pid%%/*} xargs -0 printf '%s ' < "/proc/$pid/cmdline" | sed 's/[ ]$//' printf :%s\\n "$line" done Some of the maps files can only be read by root.
- 323 4y ago
  I don't know about Windows core system libraries, but for user libraries you can do the same thing - rename old library, and put new library in it's place. Running processes will continue using the old library, and new ones will pick up the new library. The only difference is that instead of deleting the old library you need to rename it (and then delete it later). Linux doesn't need reboots only in theory. I have an Ubuntu server box and not a week passes in which I don't see a "system reboot is required" prompt when I SSH into it.
  - chasil 4y ago
    Right - POSIX is generally "advisory locking" rather than "mandatory locking," so an update process is free to overwrite any library. Windows does not allow this, which is why we have Patch Tuesday outages. Also, Oracle KSplice was the first free tool to apply updates to a running Linux kernel without rebooting. KSplice is free on Ubuntu. I think other free services have become available since. https://ksplice.oracle.com/try/desktop https://ksplice.oracle.com/try/desktop
  - P5fRxh5kUvp2th 4y ago
    then stop updating the kernel once/week. There are mechanisms for updating the kernel in-place, and I believe canonical is one of the leaders in that domain, but if you're choosing not to use it and you don't want to reboot once/week, you can still keep your system level libraries up to date without rebooting. The above poster didn't say you could update absolutely everything in linux without a reboot, just that the locking mechanisms in windows means you have to reboot to update things that don't require a reboot in linux.
    - 323 4y ago
      I didn't choose anything, it's the default Ubuntu 22 image from a big cloud provider. They enabled auto-updates, including for the kernel. They didn't enable whatever update kernel in-place mechanism Ubuntu has. I assume they know what they're doing. My point was that in theory Linux doesn't need reboots and Windows does, but in practice my Ubuntu box needs a weekly reboot, while my Windows box just once a month.
      - P5fRxh5kUvp2th 4y ago
        There was never any theory that Linux doesn't need reboots to update the kernel. That's never been a general understanding in the more than 20 years that I've personally been working with Linux. What's true is that you can update everything BUT the kernel without a reboot. Any understanding of theory that involved a belief that Linux never needed a reboot to update the kernel is a flaw in your understanding rather than a problem with the theory. And in fact, the reason people have been working on being able to update the kernel without a reboot is finally put to rest that final mile. Personally I don't think it will ever come to full fruition, but the list of things that does require a reboot will become smaller and smaller over time. https://cloud7.news/article/how-to-update-linux-kernel-without-rebooting/ https://cloud7.news/article/how-to-update-linux-kernel-witho... > Rebootless Kernel updates are not a replacement for full kernel upgrades but it allows you to patch critical security vulnerabilities and bug fixes. With these methods, you can keep your servers safe and running without outage for years. > Several Linux vendors offer rebootless kernel updates. Your solution mostly depends on the distribution you are running. And finally, a bit more info about canonical's solution https://cloud7.news/article/how-to-update-linux-kernel-without-rebooting/#Canonical-Livepatch https://cloud7.news/article/how-to-update-linux-kernel-witho...