dcsimg

Say Goodbye to Reboots with Ksplice

Linux is famous for uptime, but even it has to reboot when a new kernel vulnerability is fixed. Or does it? Now there's Ksplice, technology that applies patches directly into the running kernel. And thanks to their free Uptrack service it's free for users of Ubuntu!

Linux is famous for its stability and for having computers which have been online without being rebooted for years at a time. Indeed, among the geek community the longer your computer has been online the more “respect” you get. It’s called “uptime”, the amount of time your computer has been up for without needing a reboot.

Due to its open source nature, new security holes are found and fixed constantly on Linux distributions. Many of these updates are for user space applications such as web servers, databases, office programs and the wider desktop environment. Distributions will package these fixes and distribute them via the standard package management system, however via this method applications and daemons need to be restarted in order to load the new safe program.

When it comes to the Linux kernel itself, the usual way to achieve this is to reboot the computer. Naturally, this also means that all of the applications will be closed and daemons stopped, before being restarted after a successful reboot. Uptime is especially important for servers, as they need to be online and accessible as much as possible.

So what’s the problem? Well in order to provide maximum uptime, many users and administrators will not restart their systems in order to load the new kernel because of the inconvenience of having to stop the system. It’s a trade-off that can be dangerous because the system is still vulnerable! Just six days after a particular vulnerability in the kernel was discovered, many servers had been compromised including one in use by the Debian GNU/Linux project.

It’s simply just not feasible to reboot a machine every time a kernel vulnerability is discovered. There has to be a better way.

Enter Ksplice, a solution to the problem. Ksplice is a suite of tools which can apply patches directly into a running kernel resulting in an instantly patched system without a single interruption. No need to reboot the system or restart any services! If Debian had been running Ksplice they could have patched that vulnerable system live, not long after the vulnerability was found and fixed, without a single moment of downtime. The beauty of this method is that any number of patches can be applied. If there was a vulnerability found every hour, Ksplice could patch the kernel every hour also, all without skipping a beat. Left to the old ways, the server would need to be rebooted every hour or left vulnerable and rebooted later!

Work on Ksplice is currently focusing on the Linux kernel, but the technology could be taken and applied to user space applications also. The project has just announced the availability of a free service called Uptrack, for users of the latest Ubuntu offering, Jaunty Jackalope 9.04. That’s right, you can take advantage of this great project right on your own machine. But would users really want such a product?

The Ksplice team has done a great job at integrating their Uptrack service with an easy to use graphical interface. Installation is simple, just download the package from their website and open it with the GDebi installer (the default option). Users must agree to a terms of service, which includes a reference to the GPLv2 – the free software license the software is released under. Upon completion of the installation, the Uptrack manager will be run automatically. It looks similar to the system update-manager and is very easy to use. The application connects to the online service to determine what updates are available for the running kernel. The list is then presented and the user can install them at the click of a button. It all works very well and was very fast. Each time you log onto the system, the Ksplice updater will start with an icon present in the system tray and automatically check for updates in the background, prompting you when new ones are available.

Ksplice Uptrack Manager
Ksplice Uptrack Manager

Kernel updates under Ubuntu currently involve a delayed release system. Individual fixes are not released and installed separately, but rather are grouped together in a whole new kernel release. The issue with this is that the system will be vulnerable from the time the security flaw exists, until the new kernel is released through the update system. Not only this, but once you have downloaded and installed the new kernel update, you still need to reboot your computer for the fixes to take effect. If you’re busy, this would further increase the amount of time your system is vulnerable.

Using Ksplice however, it doesn’t matter whether the new kernel update from Ubuntu is downloaded or not. In fact, doesn’t matter if the computer is rebooted ever again! The system will always be patched with the latest fixes. Ksplice does this by determining what kernel is running and then after talking to the online Uptrack service, it downloads and patches any new fixes directly into the running kernel. These fixes are based on those sitting in Ubuntu’s Git source tree, waiting to be rolled into the next kernel update.

If a new kernel from Ubuntu is downloaded and installed via the system’s update service, then Ksplice will detect this after a reboot and then install any new fixes for that kernel too. It’s a simple as that. No matter which way you want to work, Ksplice will ensure that your kernel is always secure and up-to-date.

Upon a reboot the Ksplice boot time service starts up (just after Apparmor) and applies all of the patches for the kernel before your computer continues to boot any further. On an Intel Core2 machine this delayed the boot process by about eight seconds for nine patches, but considering the amount of time saved for future updates (and reboots) it’s a small price to pay! All future updates for the kernel will be applied in realtime via the graphical interface, naturally without a reboot.

The implementation so far appears to work very well, but only for the current kernel version that’s running. While it is possible to have a completely rebootless update system because Ksplice will always individually patch what Ubuntu releases as a whole new kernel update, the current updating system in Ubuntu makes it appear as though updates are required. In fact, installing a new kernel in Ubuntu prompts the user to tell them they must reboot. With Ksplice that’s actually no longer required. Perhaps this is an area that the Ksplice team could work on more closely with Canonical? Either way, the first step is to get as many people using the system as possible! Nevertheless this technology is nothing to be sneezed at. What it does, it does very well indeed and the team are to be congratulated on such an amazing project and implementation. It’s truly first class!

It might be great on servers, but why would a desktop user care? Many users switch their computer off at night anyway, so updates which come in during the day requiring a reboot won’t be a hassle. The biggest advantage comes from servers where uptime is important, but it does have a purpose for desktops too. Firstly, by using Ksplice you don’t have to reboot straight away when you get a new kernel update – you can take your time. Secondly, you are protected with all updates for the time between official kernel updates from Ubuntu.

Certainly most desktop users will probably feel that their system is secure enough and not feel the need for such a service. After all, most desktops rarely face the Internet directly like a server might. Even so, the more layers of security and protection one can have on their system the better. Finally, the Ksplice team really has done a first class job at implementing the technology. It’s just so easy for end users to install and use. So if you’re on Ubuntu Jaunty, why not give it a try? It’s a free service which helps to keep your system all that much more secure, without getting in the way of your work.

The technology used in Ksplice is very exciting. It makes a lot of sense and one has to wonder why it’s only being “discovered” now. One day in the future when Ksplice becomes the norm, we’ll look back and wonder what we ever used to do before rebootless updates came on the scene.

Comments on "Say Goodbye to Reboots with Ksplice"

clusterman

Any word on other distro\’s taking advantaged of Ksplice?

Reply
csmart

Hey clusterman,

I don\’t know whether any distributions have taken it up as yet. The Ubuntu service from Ksplice is the first that I know of. But stay tuned for a follow up article which might help provide more answers to that question.. :-)

-c

Reply
handydan918

Too bad they won\’t do the same for another distro.

I\’d rather reboot once or twice a year than be stuck with Ubu…

Reply
thequickbrownfox

Would it be fair to say that this guy got his idea and title for this article from the latest issue of Linux Journal?

Reply
golding

Hiya Chris,

Anything happening for Gentoo with this? It looks like it\’s in binary only, are they going to release it in source balls? How will it work with portage?

Regards .. Robert (Adelaide)

Reply
jswanhart

What happens when a syscall is patched while a thread is executing that syscall? There isn\’t a critical section around every system call so how can it guarantee that it won\’t crash the kernel by modifying memory in place while another thread reads it?

Reply
csmart

handydan918, I didn\’t say that they wouldn\’t I said stay tuned to find out ;-)

thequickbrownfox, no, not fair to say. Ksplice announced their Uptrack service for Ubuntu recently so there are bound to be a few articles about it cropping up. And after visiting their site to check I have to say that my title is nothing like theirs.

golding, I haven\’t heard anything about Gentoo on this, but it would be interesting. They should be able to apply it like any other distro, but the harder thing for them would be the fact that people compile their own kernels. It would only work on an official static kernel, I think.

jswanhart, I\’m not sure but I can find out for you. I the mean time, have you read the paper from their website?

-c

Reply

Im thankful for the blog.Thanks Again. Really Cool.

Reply

Im obliged for the blog article.Really looking forward to read more. Keep writing.

Reply

Please let me know if you’re looking for a article author for your weblog. You have some really great articles and I feel I would be a good asset. If you ever want to take some of the load off, I’d absolutely love to write some material for your blog in exchange for a link back to mine. Please blast me an email if interested. Regards!

Reply

Howdy just wanted to give you a quick heads up and let you know a few of the pictures aren’t loading correctly. I’m not sure why but I think its a linking issue. I’ve tried it in two different internet browsers and both show the same outcome.

Reply

Thank you for every other fantastic post. The place else may anyone get that kind of information in such a perfect way of writing? I’ve a presentation next week, and I’m at the search for such information.

Reply

Thanks for sharing superb informations. Your site is very cool. I’m impressed by the details that you have on this web site. It reveals how nicely you understand this subject. Bookmarked this web page, will come back for more articles. You, my pal, ROCK! I found just the information I already searched everywhere and just couldn’t come across. What an ideal web-site.

Reply

You got a very excellent website, Glad I discovered it through yahoo.

Reply

Hey there. I found your web site via Google even as searching for a related topic, your web site came up. It appears to be great. I have bookmarked it in my google bookmarks to come back then.

Reply

Your style is really unique in comparison to other people I ave read stuff from. I appreciate you for posting when you have the opportunity, Guess I will just bookmark this page.

Reply

Fantastic afternoon Sunday.Thought perhaps DJ Pineapple had brought in all his family and friends.Number of really great dance among them.Great fun to watch them.

Reply

Good info. Lucky me I reach on your website by accident, I bookmarked it.

Reply

Here are a few of the web pages we recommend for our visitors.

Reply

Disponemos de unidades móviles con toda la equipación necesaria y nuestros técnicos cuentan con toda la tecnología necesaria (GSM, SMS, GPRS y GPS) para llegar a su domicilio en el menor tiempo posible.

Reply

Thanks again for the blog article. Awesome.

Reply

Here are a few of the sites we recommend for our visitors.

Reply

8vdkKn Wow, awesome weblog structure! How lengthy have you ever been running a blog for? you made running a blog look easy. The overall glance of your site is magnificent, let alone the content material!

Reply

Hey there. I found your web site by way of Google whilst searching for a similar subject, your website got here up. It seems to be good. I have bookmarked it in my google bookmarks to visit then.

Reply

Somebody essentially help to make seriously posts I would state. This is the very first time I frequented your website page and thus far? I surprised with the research you made to make this particular publish extraordinary. Magnificent job!

Reply

You are a very bright person!

Reply

The time to read or pay a visit to the subject material or web-sites we’ve linked to below.

Reply

Great – I should certainly pronounce, impressed with your site. I had no trouble navigating through all tabs as well as related info ended up being truly simple to do to access. I recently found what I hoped for before you know it at all. Reasonably unusual. Is likely to appreciate it for those who add forums or anything, web site theme . a tones way for your customer to communicate. Nice task.

Reply

Check below, are some completely unrelated internet sites to ours, nonetheless, they may be most trustworthy sources that we use.

Reply

I was wondering if you ever thought of changing the structure of your
site? Its very well written; I love what youve got
to say. But maybe you could a little more
in the way of content so people could connect with it
better. Youve got an awful lot of text for only
having one or two pictures. Maybe you could space it out better?

Reply

Check below, are some completely unrelated websites to ours, nevertheless, they may be most trustworthy sources that we use.

Reply

You are a very capable person!

Reply

Awesome post. I am a regular visitor of your web site and appreciate you taking the time to maintain the nice site. I’ll be a regular visitor for a really long time.

Reply

Thanks, I have just been searching for information about this topic for ages and yours is the greatest I’ve discovered so far. However, what about the bottom line? Are you positive concerning the supply?

Reply

Always a major fan of linking to bloggers that I enjoy but do not get a lot of link love from.

Reply

Although web sites we backlink to beneath are considerably not associated to ours, we feel they’re in fact really worth a go through, so have a look.

Reply

Wonderful story, reckoned we could combine a couple of unrelated information, nevertheless really really worth taking a search, whoa did one particular discover about Mid East has got a lot more problerms at the same time.

Reply

Below you will obtain the link to some websites that we think you’ll want to visit.

Reply

The facts talked about within the report are a number of the very best accessible.

Reply

Please go to the sites we stick to, which includes this one particular, as it represents our picks in the web.

Reply

Here is an excellent Blog You may Discover Fascinating that we encourage you to visit.

Reply

Check below, are some completely unrelated web sites to ours, having said that, they’re most trustworthy sources that we use.

Reply

I’ve been surfing online mire thban thrse hours today, yet I never found
any interesting article like yours. It’s pretty worth enough for me.
Personally, if all webmasters and bloggers made good content as you did, the net will be a lot more useful thn ever
before.|
I couldn’t resist commenting. Very well written!|
I’ll right away seize your rss as I can’t to find your e-mail subscription link or newsletter service.
Do you have any? Please allow me understand sso that I may
subscribe. Thanks.|
It is appropriate time to make some plans for the future
and it is time to be happy. I hve read this
ost andd if I could I wish to suggest you somee interesting thinbs or suggestions.
Maybe you could write next articles referring to this article.
I want to read even more things about it!|
It is appropriate tijme to make a few plans foor the longer term and
itt is time to be happy. I’ve learn this submit and if I may just I wish to recommend
you few fascinating things oor advice. Perhaps you ccan write subsequent aryicles regarding this article.I desire to learn even more
issues approximately it!|
I have been surfing on-line greater than 3 hours theese days, butt I never discovered any fascinating article like yours.
It is beautiful value enough forr me. In myy
opinion, if all webmasters and bloggers made just right content as you probably did, tthe net will
be much more helpful than ever before.|
Ahaa, its fastidious dialogue conncerning this piece of writing at
this place at this web site, I have read all that, so at this
time mee lso commenting here.|
I am sure this article has touched alll the internet users, itss really
really fastidious piece of writing on building up
new web site.|
Wow, this article is nice, my younger sister iis analyzing such things, so I am going
to inform her.|
bookmarked!!, I love your web site!|
Way cool! Some extremely valid points! I appreciate you penning this post and
the rest of the site iis vesry good.|
Hi, I do believce tyis is an excellent site.
I stumbledupon it ;) I am going too return once again since I
bookmartked it. Money and freeedom is thhe
greatest way too change, mayy you be rich and continue
to guide other people.|
Woah! I’m really digging the template/theme of this blog.
It’s simple, yet effective. A lot of times it’s difficult to
get that “perfect balance” between user friendliness andd
visual appearance. I must say you’ve done a amazing job with this.

Also, the blog loads super quick for me on Opera.
Excellent Blog!|
These are actually impressive ideas in abouit blogging.
You hafe touched some fastidious things here. Any way keep up wrinting.|
I like what you guys aree up too. This kind of clever work
and reporting! Keeep up the terrific works guyss I’ve
added you guys to our blogroll.|
Hi! Someone in my Facebook group shared this site with us so I came tto check it out.
I’m definitely loving the information. I’m bookmarking and wikl be
tweeting this to my followers! Wonderful blog and superb design and style.|
Everyone lkves what you guys tend to bbe up too. Such clever work and exposure!
Keep up the fantastic works guys I’ve included you guys
to my own blogroll.|
Hi would you mind sharing which blog platform you’re
working with? I’m planning to start my own blog in the near future
but I’m having a difficult time selecting between BlogEngine/Wordpress/B2evolution and Drupal.
The reason I ask is because ykur design and style seems different then most blogs
and I’m looking for something unique. P.S Apologies for being off-topic but I had to ask!|
Hey would you mind letting me know which hosting company you’re utilizing?
I’ve loaded your blog in 3 different wweb browsers and I must say this blog loads a lot faster
then most. Can you redcommend a good internet hosting
provider at a reasonable price? Kudos, I appreciate it!|
I like it when folks get together aand share thoughts.

Great website, continue the good work!|
Thank you for the auspicious writeup. It in fact was a amusement account it.
Look advanced to more added agfreeable from you!
By the way, how could we communicate?|
Hey there just wanted to give you a quick heads up. The words
in your post seem too be running off the screen in Firefox.
I’m not sure if this is a formatting issue or something to do with web browser compatibility but
I thought I’d post to let you know. The design and style look great though!
Hope you get thhe problem fixed soon. Many thanks|
This is a topic which is near to my heart… Thank you!

Where are your contact details though?|
It’s vewry trouble-free to fiond out any matter on net as
compared too textbooks, as I found this paragraph at this web site.|
Does your website have a contact page? I’m having trouble locating it but,
I’d like to send you an e-mail. I’ve got some creative ideas
for yoiur blog you might be interested in hearing.
Either way, great site and I look forward to seeing it develop over
time.|
Hey there! I’ve been following your weeb site for a while now and finally got
the courage to go ahead annd give you a shout ouut from
Atascocita Tx! Just wasnted to say keep up the great work!|
Greettings from Carolina! I’m bored to death aat work so I decided to browse your blog on my
iphone during lunch break. I enjoy the knowledge you provide here and can’t
wait to take a look when I get home. I’m shocked at how fast your blog loaded on my movile ..
I’m not even using WIFI, just 3G .. Anyhow, good blog!|
Its like you read my thoughts! Yoou seem too grasp a lot about this, like you wrote the book in it or something.
I believe that you can do with some p.c. to drive the mssage house a
bit, however other thaqn that, that is fantastic
blog. An excellent read. I’ll definitely be back.|
I visited several web pages but the audio quality
for audio songs current at this web site is truly superb.|
Hello, i read your blog occasionally and i own a similar one annd i was just curious if you
get a lot of spam comments? If so how do you stop it, any plugin or anything you
ccan suggest? I get soo much lately it’s driving me crazy so any help is very
much appreciated.|
Greetings! Very helpful advicfe within this post!
It is thhe little changes that make the biggest changes.
Thanks for sharing!|
I really love your blog.. Great colors & theme. Did you
build this amazing site yourself? Please reply back as I’m trying
to create my very own blog annd would love tto find
out where you got this from or exactly what the theme is named.
Thanks!|
Howdy! This article couldn’tbe written much better! Looking at this article reminds me of my previous roommate!
He constantly kept talking about this. I will forward this article too him.
Pretty sure he’s going to have a great read.
Many thanks for sharing!|
Whoa! This blog looks exactly like my old one!
It’s on a entrely different topic but it has pretty
much the same layout and design. Great choice of colors!|
There is certainly a lot to fijnd out about this issue.

I like all the points you made.|
You made some really good points there.I checked on the net to
find out more abbout the issue and found most individuals will go along with your viewss on this site.|
Hi, I check your blokgs on a regular basis. Your humoristic style is awesome, keep up the good work!|
I just could not depart your website before suggesting that
I really enjoyed the usual info a person supply to your guests?
Is going to be again often in order to inspect new posts|
I want to to thank youu for this fantastic read!! I certainly loved eery litle bit of
it.I have got you bookmarked to check out new thingss you
post…|
What’s up, just wanted too mention, I loved this article.
It was helpful. Keep on posting!|
Hi there,I enjoy reading all of yopur post. I wanted tto
write a little comment to support you.|
I always spent my half an our to read this website’s posts evedry day alonng with a
mug of coffee.|
I for all time emailed this web site post page to all
my friends, since if like to read iit afterward my contacts will too.|
My programmer is trying to convince mee to move
to .net from PHP. I have always disliked thhe idea because of
the costs.But he’s tryiong none the less. I’ve been uusing WordPress on numerous websites
for about a year and am worried about switching to another platform.
I have heard glod things about blogengine.net. Is there a way
I can transfer all my wordpress content into
it? Any kin of hhelp would be really appreciated!|
Hi there! I could have sworn I’ve visited this website before but after browsing through some of the
articles I realiuzed it’s new to me. Anyways, I’m definitely happy I found it and I’ll be book-marking
it and checking back frequently!|
Great article! This iis the kind of info that should be shared around the net.
Disgrace on the seek engines for not positioning this publish
upper! Come on over and seek advice from my web site .

Thank you =)|
Heya i am for the first time here. I found this board and I find It really useful & it helped
me out a lot. I hope to give something back and aid others like
you helped me.|
Hello, I believe your site could possibly be having web browser compatibility issues.
Whenever I take a look at your website in Safari, it looks
fine however when opening in Internet Explorer, it’s got some overlapping
issues. I just wanted to provide you with a quick heads up!
Apart from that, great blog!|
A person essentially help to make severely
articles I’d state. That is the first time I frequeented your website page and soo far?
I surprised with the analysis youu made to create this particular put up
incredible.Magnificent job!|
Heya i am forr the primary time here. I came across this board
and I to find It really helppful & it helped me out much.
I hope to present something back and aid others like yyou
aided me.|
Howdy! I simjply wish to ofger you a big thumbs up for your great ibformation yyou hav gott here on thiis post.
I’ll be coming badk to your blog for more soon.|
I all the ttime used too read article in news
papers but now as I am a user of internet so frm now I am using net for content, thanks to web.|
Your means of explaining everything in this paragraph is really pleasant, all be capable of without difficulty bbe aware of it, Thanks a lot.|
Hi there, I found your site by way off Google while searching for a similar subject, your wweb site got here up, it seems great.
I have bookmarked it in my google bookmarks.
Hello there, simply changed into aware of your weblog via Google,
and found tha it is truly informative. I am going to watch
out for brussels. I’ll appreciate for those who proceed this in future.

Manyy people might be bennefited from your writing.

Cheers!|
I amm curious to find out what blog system you have bee using?
I’m experiencing some small security issues with mmy latest site and
I’d like to find something more safeguarded. Do yoou
have anyy solutions?|
I’m really impressed with your writing skills aand also with
the layyout on your weblog. Is this a paid theme or did you modify it yourself?
Anyway keep upp the nice qualitfy writing, it is
rare to see a nice blog like this one today.|
I am really inspired together with your writing skills as well as with the layout in your weblog.
Is this a paid subject matter or did you mdify itt your self?

Either way keeep up the excellent quality writing, it is rare to look a great weblog
like this one nowadays..|
Hi, Neat post. Theree is a problem together with your website in internet explorer, would chesck this?
IE nonetheless is the marketplace chief and a huge part of other people wipl miss your wonderful writing duue to this problem.|
I am not sure where you’re getting your information, but good
topic. I needs to spend some time learning much more or understanding
more. Thanks for wonderful information I was looking for this information foor my
mission.|
Hi, i think that i ssaw you visited my web site soo i came to “return the favor”.I’m trying to find things to enhance
my site!I suppose its ok to use some of your\

Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>