Livepatching the Kernel in Ubuntu 16.04 LTS

Hello everyone and Happy New Year! I hope 2017 has started great for everyone out there.

So I have been playing around with Canonical’s Livepatch service on my Ubuntu 16.04 servers and I have to say, it is pretty slick. I run two KVM hosts that run various servers and containers so that I can do my job. In fact, this web server runs as a KVM on one of my hosts. Since I can’t typically run kernel updates and reboot when ever I feel like since I have other work loads running on these servers, Canonical Livepatch answers this problem for me.

How it works is pretty simple. When a security patch for the Kernel comes out, this service downloads the patch and installs it in the running kernel on my system WITHOUT HAVING TO REBOOT MY SERVER!!! That is amazing!! I get the security update to patch and make my system secure and I don’t have to schedule a maintenance window and bring down 20+ VM’s and 100+ containers, I can just update the host and BAM! All my containers and my hosts are updated, no reboot, no downtime. I still have to touch all my KVM’s, but that is the way when you run VM’s.

So you want to try this out? It’s pretty simple to setup. First, it only works on Ubuntu 16.04 LTS. This “should” change to be available in 14.04 but as of when I wrote this, it was still not yet available on 14.04.

The Kernel Livepatch is a snap application, making use of snaps on the system. This makes it even easier to install and update. To install on your system, it is as simple as:

sudo snap install canonical-livepatch

This will pull down the snap application and install and start it. Now, you have to enable the service. You need to go to https://auth.livepatch.canonical.com to sign up for the service. Regular Ubuntu users are authorized up to 3 machines to get Livepatches for. If you need more, you can purchase them via support for your systems. Once you are signed up, you will have a token that you use to add your systems.

You then run:

sudo canonical-livepatch enable <TOKEN>

This will setup livepatch. To see it work, simply run

canonical-livepatch status --verbose

and you will get the following output:

client-version: "6"
machine-id: --REMOVED--
machine-token: --REMOVED--
architecture: x86_64
cpu-model: Intel(R) Xeon(R) CPU           E5645  @ 2.40GHz
last-check: 2017-01-11T15:21:36.477627539-08:00
boot-time: 2016-11-28T09:16:56-08:00
uptime: 1062h5m33s
status:
- kernel: 4.4.0-47.68-generic
  running: true
  livepatch:
    checkState: checked
    patchState: applied
    version: "15.1"
    fixes: |-
      * CVE-2016-7425
      * CVE-2016-8655
      * CVE-2016-8658

I have those CVE’s installed, and I didn’t have to reboot my system for them to be implemented.  Now my KVM host is patched, and I had 0 downtime to do it.

There you have it. Let me know in the comments if you have any questions!

 

By wililupy

With over 22 years experience in the IT field, there is not a whole lot Lucas hasn't seen. However, with the trends in technology, he is constantly learning and trying new technologies to keep up with markets and company demands for new technologies to meet their needs. He currently is a Senior Principal Engineer and Dell Technologies specializing in Networking Solutions.

27 comments

  1. Greetings from California! I’m bored to death at work so I decided to browse your website on my iphone during lunch break. I really like the info you present here and can’t wait to take a look when I get home. I’m surprised at how fast your blog loaded on my mobile .. I’m not even using WIFI, just 3G .. Anyhow, good blog!

  2. My coder is trying to convince me to move to .net from PHP. I have always disliked the idea because of the expenses. But he’s tryiong none the less. I’ve been using Movable-type on several websites for about a year and am nervous about switching to another platform. I have heard very good things about blogengine.net. Is there a way I can transfer all my wordpress content into it? Any help would be really appreciated!
    small business ideas
    http://www.dealhint.eu

  3. An intriguing discussion is definitely worth comment. I think that you ought to publish more on this subject, it might not be a taboo subject but generally people do not talk about these subjects. To the next! Many thanks!!

  4. Hi there fantastic website! Does running a blog similar to this require a great deal of work? I’ve no expertise in programming but I had been hoping to start my own blog in the near future. Anyhow, should you have any recommendations or tips for new blog owners please share. I understand this is off topic nevertheless I simply needed to ask. Cheers!

    1. Thank you for the reply.
      The blog pretty much runs itself. I’m using Canonical technologies to manage it. I just used Juju on OpenStack to deploy WordPress in my server farm and it worked out of the box. I may write a blog on how to do that in the near futures.
      Stay posted. 😉

  5. I am extremely impressed with your writing skills and also with the layout on your blog. Is this a paid theme or did you modify it yourself? Anyway keep up the excellent quality writing, it is rare to see a great blog like this one these days.

    1. Thank you,
      The graphics are all my own. I use GImp to do them. I like to do graphics on the side, but am still learning it.
      Thanks for the feedback!

  6. Hey there just wanted to give you a quick heads up. The text in your content seem to be running off the screen in Internet explorer. I’m not sure if this is a formatting issue or something to do with internet browser compatibility but I figured I’d post to let you know. The layout look great though! Hope you get the problem solved soon. Thanks

  7. We absolutely love your blog and find almost all of your post’s to be precisely what I’m looking for. Do you offer guest writers to write content available for you? I wouldn’t mind writing a post or elaborating on most of the subjects you write with regards to here. Again, awesome web log!

    1. Hi thank you,

      I will definitely think about that. I could totally do that, I just need some more time in the day to research this. I have your contact information so I can reach out to you if I decide to go down that route.

      Thanks again!

  8. Have you ever considered about adding a little bit more than just your articles?
    I mean, what you say is fundamental and everything.
    But imagine if you added some great pictures or videos to give your posts more, “pop”!
    Your content is excellent but with pics and clips, this site
    could certainly be one of the most beneficial in its field.
    Awesome blog!

  9. Thank you for sharing superb informations. Your site is very cool. I’m impressed by the details that you have on this website. It reveals how nicely you perceive this subject. Bookmarked this website page, will come back for extra articles. You, my friend, ROCK! I found just the info I already searched everywhere and just couldn’t come across. What a great web site.

  10. Hi I am so grateful I found your blog page, I really found
    you by error, while I was researching on Google for something else, Regardless I am here now
    and would just like to say kudos for a marvelous post and a all round thrilling
    blog (I also love the theme/design), I don’t have time to look over it all at the minute
    but I have book-marked it and also included your
    RSS feeds, so when I have time I will be back to read a great deal more, Please do keep
    up the great work.

  11. You are so interesting! I do not suppose I’ve read through anything like this before.
    So great to find somebody with some unique thoughts on this subject.
    Seriously.. many thanks for starting this up.
    This site is something that is required on the
    internet, someone with a bit of originality!

  12. You can cesrtainly ѕee yоur enthusiasm іn the workk you ԝrite.
    The arena hopes for more passionate writers likе you who are not afrtaid tо mention һow tһey believe.
    At all timеs follow yoսr heart.

  13. Very great post. I simply stumbled upon your blog and
    wanted to mention that I have really enjoyed browsing your weblog posts.
    After all I will be subscribing to your feed and I’m hoping you write once more very soon!

  14. I like the valuable information you provide for your articles.

    I’ll bookmark your blog and test once more right here frequently.
    I am somewhat sure I will be told many new stuff
    proper here! Good luck for the following!

Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.