Livepatching the Kernel in Ubuntu 16.04 LTS

Hello everyone and Happy New Year! I hope 2017 has started great for everyone out there.

So I have been playing around with Canonical’s Livepatch service on my Ubuntu 16.04 servers and I have to say, it is pretty slick. I run two KVM hosts that run various servers and containers so that I can do my job. In fact, this web server runs as a KVM on one of my hosts. Since I can’t typically run kernel updates and reboot when ever I feel like since I have other work loads running on these servers, Canonical Livepatch answers this problem for me.

How it works is pretty simple. When a security patch for the Kernel comes out, this service downloads the patch and installs it in the running kernel on my system WITHOUT HAVING TO REBOOT MY SERVER!!! That is amazing!! I get the security update to patch and make my system secure and I don’t have to schedule a maintenance window and bring down 20+ VM’s and 100+ containers, I can just update the host and BAM! All my containers and my hosts are updated, no reboot, no downtime. I still have to touch all my KVM’s, but that is the way when you run VM’s.

So you want to try this out? It’s pretty simple to setup. First, it only works on Ubuntu 16.04 LTS. This “should” change to be available in 14.04 but as of when I wrote this, it was still not yet available on 14.04.

The Kernel Livepatch is a snap application, making use of snaps on the system. This makes it even easier to install and update. To install on your system, it is as simple as:

sudo snap install canonical-livepatch

This will pull down the snap application and install and start it. Now, you have to enable the service. You need to go to https://auth.livepatch.canonical.com to sign up for the service. Regular Ubuntu users are authorized up to 3 machines to get Livepatches for. If you need more, you can purchase them via support for your systems. Once you are signed up, you will have a token that you use to add your systems.

You then run:

sudo canonical-livepatch enable <TOKEN>

This will setup livepatch. To see it work, simply run

canonical-livepatch status --verbose

and you will get the following output:

client-version: "6"
machine-id: --REMOVED--
machine-token: --REMOVED--
architecture: x86_64
cpu-model: Intel(R) Xeon(R) CPU           E5645  @ 2.40GHz
last-check: 2017-01-11T15:21:36.477627539-08:00
boot-time: 2016-11-28T09:16:56-08:00
uptime: 1062h5m33s
status:
- kernel: 4.4.0-47.68-generic
  running: true
  livepatch:
    checkState: checked
    patchState: applied
    version: "15.1"
    fixes: |-
      * CVE-2016-7425
      * CVE-2016-8655
      * CVE-2016-8658

I have those CVE’s installed, and I didn’t have to reboot my system for them to be implemented.  Now my KVM host is patched, and I had 0 downtime to do it.

There you have it. Let me know in the comments if you have any questions!

 

Comments

27 responses to “Livepatching the Kernel in Ubuntu 16.04 LTS”

  1. business finance websites Avatar

    Wow, marvelous blog layout! How long have you been blogging for? you made blogging look easy. The overall look of your site is wonderful, as well as the content!

    1. wililupy Avatar
      wililupy

      Thank you for the reply!

  2. finance Avatar

    Greetings from California! I’m bored to death at work so I decided to browse your website on my iphone during lunch break. I really like the info you present here and can’t wait to take a look when I get home. I’m surprised at how fast your blog loaded on my mobile .. I’m not even using WIFI, just 3G .. Anyhow, good blog!

  3. Donnakiz Avatar

    I like the helpful information you supply for your articles. I will bookmark your blog and test again right here frequently. I am somewhat certain I’ll be told many new stuff right right here! Good luck for the next!
    online courses http://www.educationhints.eu

  4. ValerieDyday Avatar

    My coder is trying to convince me to move to .net from PHP. I have always disliked the idea because of the expenses. But he’s tryiong none the less. I’ve been using Movable-type on several websites for about a year and am nervous about switching to another platform. I have heard very good things about blogengine.net. Is there a way I can transfer all my wordpress content into it? Any help would be really appreciated!
    small business ideas
    http://www.dealhint.eu

  5. educational sites Avatar

    An intriguing discussion is definitely worth comment. I think that you ought to publish more on this subject, it might not be a taboo subject but generally people do not talk about these subjects. To the next! Many thanks!!

  6. dep of education Avatar

    Hi there fantastic website! Does running a blog similar to this require a great deal of work? I’ve no expertise in programming but I had been hoping to start my own blog in the near future. Anyhow, should you have any recommendations or tips for new blog owners please share. I understand this is off topic nevertheless I simply needed to ask. Cheers!

    1. wililupy Avatar
      wililupy

      Thank you for the reply.
      The blog pretty much runs itself. I’m using Canonical technologies to manage it. I just used Juju on OpenStack to deploy WordPress in my server farm and it worked out of the box. I may write a blog on how to do that in the near futures.
      Stay posted. 😉

  7. higher education degree Avatar

    I am extremely impressed with your writing skills and also with the layout on your blog. Is this a paid theme or did you modify it yourself? Anyway keep up the excellent quality writing, it is rare to see a great blog like this one these days.

    1. wililupy Avatar
      wililupy

      Thank you,
      The graphics are all my own. I use GImp to do them. I like to do graphics on the side, but am still learning it.
      Thanks for the feedback!

  8. education advice Avatar

    Hey there just wanted to give you a quick heads up. The text in your content seem to be running off the screen in Internet explorer. I’m not sure if this is a formatting issue or something to do with internet browser compatibility but I figured I’d post to let you know. The layout look great though! Hope you get the problem solved soon. Thanks

  9. college degrees Avatar

    We absolutely love your blog and find almost all of your post’s to be precisely what I’m looking for. Do you offer guest writers to write content available for you? I wouldn’t mind writing a post or elaborating on most of the subjects you write with regards to here. Again, awesome web log!

    1. wililupy Avatar
      wililupy

      Hi thank you,

      I will definitely think about that. I could totally do that, I just need some more time in the day to research this. I have your contact information so I can reach out to you if I decide to go down that route.

      Thanks again!

  10. Ned Moritz Avatar

    “Great Blogpost! Hello mates, nice post and good arguments commented here, I am in fact_ enjoying by these.”

  11. https://dochoithudam.com/do-choi-tinh-duc-nu Avatar

    Have you ever considered about adding a little bit more than just your articles?
    I mean, what you say is fundamental and everything.
    But imagine if you added some great pictures or videos to give your posts more, “pop”!
    Your content is excellent but with pics and clips, this site
    could certainly be one of the most beneficial in its field.
    Awesome blog!

  12. dani Avatar

    “I really like your writing style, good info, thanks for posting. “Let every man mind his own business.”

  13. PHP Autos Script Avatar

    Thank you for sharing superb informations. Your site is very cool. I’m impressed by the details that you have on this website. It reveals how nicely you perceive this subject. Bookmarked this website page, will come back for extra articles. You, my friend, ROCK! I found just the info I already searched everywhere and just couldn’t come across. What a great web site.

  14. Bhagwat Katha Avatar

    Hello! I merely would choose to make a massive thumbs up for your excellent info you’ve got here on this post. We are returning to your site to get more soon.

  15. borvestinkral Avatar

    Helpful information. Fortunate me I found your site accidentally, and I am surprised why this twist of fate did not happened earlier! I bookmarked it.

  16. viola de arco eagle Avatar

    Hi I am so grateful I found your blog page, I really found
    you by error, while I was researching on Google for something else, Regardless I am here now
    and would just like to say kudos for a marvelous post and a all round thrilling
    blog (I also love the theme/design), I don’t have time to look over it all at the minute
    but I have book-marked it and also included your
    RSS feeds, so when I have time I will be back to read a great deal more, Please do keep
    up the great work.

  17. harga yamaha Avatar

    You are so interesting! I do not suppose I’ve read through anything like this before.
    So great to find somebody with some unique thoughts on this subject.
    Seriously.. many thanks for starting this up.
    This site is something that is required on the
    internet, someone with a bit of originality!

  18. Korona królów odcinek 6 online Avatar

    We are a group of volunteers and starting a new scheme in our
    community. Your website offered us with valuable info to work on. You have done an impressive job and our
    entire community will be thankful to you.

  19. Hair Bloom Review Avatar

    It is not my first time to pay a quick visit this web site, i
    am browsing this website dailly and take nice facts from here all
    the time.

  20. wannajizz Avatar

    Awesome article.

  21. youjizz Avatar

    You can cesrtainly ѕee yоur enthusiasm іn the workk you ԝrite.
    The arena hopes for more passionate writers likе you who are not afrtaid tо mention һow tһey believe.
    At all timеs follow yoսr heart.

  22. SB Garcinia Avatar

    Very great post. I simply stumbled upon your blog and
    wanted to mention that I have really enjoyed browsing your weblog posts.
    After all I will be subscribing to your feed and I’m hoping you write once more very soon!

  23. Callum Avatar

    I like the valuable information you provide for your articles.

    I’ll bookmark your blog and test once more right here frequently.
    I am somewhat sure I will be told many new stuff
    proper here! Good luck for the following!

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.