![canonical-livepatch,它是如何工作的?](https://linux22.com/image/1001288/canonical-livepatch%EF%BC%8C%E5%AE%83%E6%98%AF%E5%A6%82%E4%BD%95%E5%B7%A5%E4%BD%9C%E7%9A%84%EF%BC%9F.png)
当我尝试更新/升级我的系统时(apt-get full-upgrade
):
The following NEW packages will be installed:
linux-headers-4.4.0-85 linux-headers-4.4.0-85-generic linux-image-4.4.0-85-generic linux-image-extra-4.4.0-85-generic
更新后,我获得了 Linux 内核本身的版本:
$ uname -a
Linux xubuntu 4.4.0-81-generic #104-Ubuntu SMP Wed Jun 14 08:17:06 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
但 Canonical Livepatch 可以正常工作:
$ canonical-livepatch status --verbose
client-version: "7.21"
machine-id: xxx
machine-token: xxx
architecture: x86_64
cpu-model: Intel(R) Core(TM)2 Quad CPU Q9550 @ 2.83GHz
last-check: 2017-07-04T10:17:04.377940173+03:00
boot-time: 2017-06-27T12:14:24+03:00
uptime: 166h21m9s
status:
- kernel: 4.4.0-81.104-generic
running: true
livepatch:
checkState: checked
patchState: applied
version: "25.1"
fixes: |-
* CVE-2016-0758 LP: #158120 and others
为什么 uname 显示 4.4.0-81,不是 4.4.0-85? 如果 canonical 只能更新相同的内核,是否有任何选项可以在不重新启动的情况下切换内核?
答案1
引用http://blog.dustinkirkland.com/2016/10/canonical-livepatch.html:
Canonical Livepatch 服务旨在解决高危和严重程度的 Linux 内核安全漏洞
正常更新(使用 apt 获得的更新)仍需要重新启动系统才能应用新内核。