News for hackers. Stuff that matters.
Re:Antergos Linux Project Ends by subway on Tuesday May 21, 2019 @11:51PM (#19977595)
Not really. It's technically possible with Ksplice, but almost no distro actually supports it.

Beyond the kernel, you have various libs and binaries that will be replaced during upgrades. All can usually/mostly be restarted without a reboot, but just upgrading packages alone won't guarantee all running processes have been updated.

Re:Antergos Linux Project Ends by cyphar on Wednesday May 22, 2019 @01:15AM (#19977991)
The core code behind kSplice/kGraft have been upstream since Linux 4.0 and both Red Hat and SUSE support it (in fact, many security patches are released this way). I believe that some less enterprise-y disros like Fedora and Ubuntu support it too.

The issue isn't whether it's supported, the problem is that live patching is limited in what it can patch (when functions are inlined it can become impossible to patch them and so on). So while a machine with 4 years uptime might be live patched there are some security issues that cannot be patched that way (for instance, the retpoline patches for Meltdown/Spectre require all function pointers to have different calling conventions and that requires a reboot).

Re:Antergos Linux Project Ends by genera1 on Wednesday May 22, 2019 @12:01AM (#19977653)
> but almost no distro actually supports it

Ubuntu supports it officially, so does Fedora. From my experience it works more or less fine on CentOS, so probably RHEL too. For Suse there is kGraft, so basically >90% of install base supports live patching.

Re:Antergos Linux Project Ends by usr1106 on Wednesday May 22, 2019 @03:12AM (#19978620)
> Ubuntu supports it officially

I don't think it's part of the usual Ubuntu distro. I understood you need to register to get it. And it's free (as in beer) only for limited use cases. Don't remember the details.

Re:Antergos Linux Project Ends by zokier on Wednesday May 22, 2019 @12:23PM (#19982784)
> It's technically possible with Ksplice, but almost no distro actually supports it.

SLES, RHEL, and Ubuntu all support live patching

https://www.suse.com/documentation/sles-15/book_sle_admin/da...

https://access.redhat.com/documentation/en-us/red_hat_enterp...

https://www.ubuntu.com/livepatch

Re:Antergos Linux Project Ends by regecks on Wednesday May 22, 2019 @12:02AM (#19977662)
In addition to the solutions in my sibling comment, there is also the commercial (but cheap) KernelCare (https://www.kernelcare.com/), which supports basically every major server OS (https://patches.kernelcare.com/).

I run it on all dedicated servers, as well as managed servers where we can easily pass the cost on.

They're currently releasing livepatches across all the kernel builds to address the Intel MDS stuff (at least the kernel-based mitigations) and it's all very pleasant and hands-off.