this post was submitted on 12 Jan 2024
67 points (98.6% liked)

Linux

48186 readers
1181 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
nooter692@lemmy.ml
AgreeableLandscape@lemmy.ml
MarcellusDrum@lemmy.ml
cypherpunks@lemmy.ml
cyclohexane@lemmy.ml
d3Xt3r@lemmy.nz
67
How to use the Linux kernel's live patching feature (wirekat.com)
submitted 10 months ago by Chewy7324@discuss.tchncs.de to c/linux@lemmy.ml
11 comments fedilink hide all child comments
top 11 comments
sorted by: hot top controversial new old
[–] henfredemars@infosec.pub 21 points 10 months ago* (last edited 10 months ago) (2 children)

It's a cool feature, and I played with it some, but I don't really see how to use it in a home or small office environment unless you're willing to subscribe to someone who can generate the live patches for you.

I can certainly generate the patches myself, but it's much faster to let the maintainer of my distro's kernel handle shipping new packages and accepting the reboot. My system reboots really quickly.

If high reliability is a concern, I would suggest load balancing or some other horizontally scaled solution such that you're not impacted by one machine going down. Because they will go down for things other than updates!

[–] Chewy7324@discuss.tchncs.de 16 points 10 months ago* (last edited 10 months ago) (1 children)

Not rebooting for a long time makes me nervous once I actually reboot, as I might've changed something but didn't make it persistent. Luckily I've become much better with documenting chabges after switching to NixOS.

[–] taladar@sh.itjust.works 4 points 10 months ago

It also means booting is untested until something like a hardware fault or a power outage forces it onto you and you have to deal with any reboot issues at the worst possible time and a time you did not choose.

[–] agressivelyPassive@feddit.de 5 points 10 months ago

There are some cases, where scaling is relatively hard to achieve in a sane manner. Especially when you're in that weird place where you've grown out of the SME solutions, but can't really justify the enterprise solution yet. I've worked on such a project, switching to the big boy DB cluster was pushed back again and again because of very high upfront costs (licenses and staff).

[–] taanegl@beehaw.org 7 points 10 months ago* (last edited 10 months ago) (2 children)

I can see this being useful for NixOS. It's still a glimmer in the postman's eye, and we're WAITING for systemd src to come with certain options to make the attaching and reattaching of systemd easier.

But I could easily see nixpkgs implement functions that allow nixos-rebuild switch to use either live patching method, or even implementing one specifically for NixOS.

This would be twice as neat, because switch is already magical in how it shifts from one system to another. If you could then also live patch the kernel? It just adds another super power.

[–] BlanK0@lemmy.ml 2 points 10 months ago

That actually would be really cool ngl

[–] Atemu@lemmy.ml 2 points 9 months ago

But I could easily see nixpkgs implement functions that allow nixos-rebuild switch to use either live patching method, or even implementing one specifically for NixOS.

Sadly, I could not. Live patching requires extensive knowledge of the previous system state and that is the antithesis to NixOS where any system state is fully independent of any other possible system state.

nixos-rebuild switch isn't very magical at all once you understand this principle.

Live patching is also not really something you want to use or use frequently. It's more intended for "this super critical box can only be taken down next Saturday but there's a fix for a 0-day in the kernel today that we need ASAP". If it's at all possible to simply reboot, simply reboot (or kexec).

[–] RotatingParts@lemmy.ml 6 points 10 months ago

If you are using Ubuntu, they have live patch available. You have to sign up for Ubuntu Pro, but that is free for individuals. I just heard about this and haven't tried it yet https://ubuntu.com/security/livepatch

[–] fl42v@lemmy.ml 3 points 10 months ago (1 children)

Mandatory link to one of the best suse parodies:

https://www.youtube.com/watch?v=SYRlTISvjww

Alternative links:

[–] PipedLinkBot@feddit.rocks 2 points 10 months ago (1 children)

Here is an alternative Piped link(s):

https://www.piped.video/watch?v=SYRlTISvjww

Piped is a privacy-respecting open-source alternative frontend to YouTube.

I'm open-source; check me out at GitHub.

[–] fl42v@lemmy.ml 2 points 10 months ago

Wtf, guys, don't be mean to the bot: they're doing the job to the best of their ability. Besides, I've linked to farside that redirects to piped, and it's kinda weird to expect the bot's dev to know of all the possible redirecters (or whatever they're called).