4 ms·
Mandatory locking has profound security impacts. I can update glibc or other core system libraries on Linux without rebooting. Processes using the old library
by chasil 4y ago
Mandatory locking has profound security impacts.
I can update glibc or other core system libraries on Linux without rebooting. Processes using the old library will show "(deleted)" in their /proc/self/maps files, but they will continue to use the old code. New processes will use the new library, and downtime was not required.
This is not possible on Windows because of mandatory locking on core system libraries. As a consequence, Windows must reboot for every Patch Tuesday.
There are only a few places that Linux has mandatory locking, and this is a good thing.
Here is a script that will show you all the deleted libraries that are still in use on Linux:
# cat stale_libraries.sh
#!/bin/sh
awk '$NF=="(deleted)" && $(NF-1) ~ /[.]so/ {
sub(/;.*$/,"",$(NF-1))
print $(NF-1), $NF}' /proc/*/maps | sort -u
Here is a script that will show you all PIDs that are running with deleted libraries:
# cat stale_programs.sh
#!/bin/sh
grep '[.]so.*deleted)' /proc/*/maps |
sed 's/[:][^/]*//' |
sort -u |
while read -r line
do pid=${line#/} pid=${pid#*/} pid=${pid%%/*}
xargs -0 printf '%s ' < "/proc/$pid/cmdline" | sed 's/[ ]$//'
printf :%s\\n "$line"
done
Some of the maps files can only be read by root.
- 323 4y agoI don't know about Windows core system libraries, but for user libraries you can do the same thing - rename old library, and put new library in it's place. Running processes will continue using the old library, and new ones will pick up the new library. The only difference is that instead of deleting the old library you need to rename it (and then delete it later). Linux doesn't need reboots only in theory. I have an Ubuntu server box and not a week passes in which I don't see a "system reboot is required" prompt when I SSH into it.
- chasil 4y agoRight - POSIX is generally "advisory locking" rather than "mandatory locking," so an update process is free to overwrite any library. Windows does not allow this, which is why we have Patch Tuesday outages. Also, Oracle KSplice was the first free tool to apply updates to a running Linux kernel without rebooting. KSplice is free on Ubuntu. I think other free services have become available since. https://ksplice.oracle.com/try/desktop https://ksplice.oracle.com/try/desktop
- P5fRxh5kUvp2th 4y agothen stop updating the kernel once/week. There are mechanisms for updating the kernel in-place, and I believe canonical is one of the leaders in that domain, but if you're choosing not to use it and you don't want to reboot once/week, you can still keep your system level libraries up to date without rebooting. The above poster didn't say you could update absolutely everything in linux without a reboot, just that the locking mechanisms in windows means you have to reboot to update things that don't require a reboot in linux.
- 323 4y agoI didn't choose anything, it's the default Ubuntu 22 image from a big cloud provider. They enabled auto-updates, including for the kernel. They didn't enable whatever update kernel in-place mechanism Ubuntu has. I assume they know what they're doing. My point was that in theory Linux doesn't need reboots and Windows does, but in practice my Ubuntu box needs a weekly reboot, while my Windows box just once a month.
- P5fRxh5kUvp2th 4y agoThere was never any theory that Linux doesn't need reboots to update the kernel. That's never been a general understanding in the more than 20 years that I've personally been working with Linux. What's true is that you can update everything BUT the kernel without a reboot. Any understanding of theory that involved a belief that Linux never needed a reboot to update the kernel is a flaw in your understanding rather than a problem with the theory. And in fact, the reason people have been working on being able to update the kernel without a reboot is finally put to rest that final mile. Personally I don't think it will ever come to full fruition, but the list of things that does require a reboot will become smaller and smaller over time. https://cloud7.news/article/how-to-update-linux-kernel-without-rebooting/ https://cloud7.news/article/how-to-update-linux-kernel-witho... > Rebootless Kernel updates are not a replacement for full kernel upgrades but it allows you to patch critical security vulnerabilities and bug fixes. With these methods, you can keep your servers safe and running without outage for years. > Several Linux vendors offer rebootless kernel updates. Your solution mostly depends on the distribution you are running. And finally, a bit more info about canonical's solution https://cloud7.news/article/how-to-update-linux-kernel-without-rebooting/#Canonical-Livepatch https://cloud7.news/article/how-to-update-linux-kernel-witho...
- WorldMaker 4y agoAlso, in theory Windows doesn't need reboots because like you said, the rename and replace works just fine for hot patches. Windows reboots as often as it does in part for "backwards compatibility" and the long tail of applications built under the broken 90s assumption that windows "doesn't" hot patch things. Linux assumes that long running processes just randomly exploding because they are living in a pre-hotfix ghost state is fine (and usually free of security concerns). Windows assumes users notice and get frustrated when long running apps start acting "weird" and don't know why and that there are too many security implications if you just leave unpatched apps running alongside patched ones. It's another one of those things on the list that the NT Kernel has the raw design to do a lot of smart, deliberate things, but at the end of the day can't trust user space to play nice with them happening and is maybe a little too safety conscious of that. (My understanding too is that Ubuntu is an interesting example here because Canonical now explicitly uses a more Microsoft-influenced security model in user-focused distributions for when to require reboots. Under the same general concerns: avoid user-noticeable "weirdness" and avoid unpatched CVEs remaining long running in user space. While it could just kill unpatched processes, that creates "user noticeable weirdness", and for better and worse a full "restart" is much less shocking to the average user than long running processes getting killed "weirdly".)