Will I receive critical security updates if I lock CentOS yum to a specific repo version?

Question

We run Citrix XenServer as our virtualisation platform. Presently we're right up to date with our XenServer service packs and hotfixes i.e. we're running XenServer 6.2SP1 with the SP1015 update applied on top of that:

Hotfix XS62ESP1015 - For XenServer 6.2.0 Service Pack 1

In our current state of affairs CentOS 6.4 is the highest supported version of CentOS supported by Citrix:

XenServer 6.2.0 Virtual Machine User's Guide (Page 15)

Because Citrix has no official support for later versions of CentOS 6, and so that I don't accidentally yum update my servers to a later (and unsupported) version of CentOS 6, I need to ensure that I configure yum to only use http://vault.centos.org/6.4 to obtain base and update packages.

My concern is that I am now no longer going to receive critical security updates such as this one:

http://seclists.org/oss-sec/2014/q4/1052

When I browse:

http://vault.centos.org/6.4/os/x86_64/Packages and http://vault.centos.org/6.4/updates/x86_64/Packages

I can see that the last kernel update was kernel-2.6.32-358.23.2.el6.x86_64.rpm dated 17-Oct-2013 12:47.

Am I correct in assuming that I will never receive critical security updates (kernel or otherwise) if I lock yum to only use the 6.4 package repository?

Answer 1

Yes, you're correct: locking yourself to a particular CentOS point release will expose you to future security flaws by preventing you from receiving the fixes.

Just as in RHEL, a CentOS point release is not a "version" in the same sense as used by much of the rest of the software world. You will never see a CentOS 6.4.1, for example. All the "4" means here is that it is the fourth roll-up of all the updates made to date.

This means there is very little difference between 6.4 and the state of CentOS 6.3 the day before 6.4 came out, if you had just said yum update. Likewise, if you have a system that has CentOS 6.4 on it including every last update made before CentOS 6.5 came out, then did one last unrestricted manual yum update to bring yourself to CentOS 6.5, there will also be very little difference.

Properly speaking, you are using CentOS version 6, period.

You may only need to tell Yum not to update the kernel. This is how Xen is configured on a CentOS 6 VPS we rent here, which is kept up-to-date. (CentOS 6.6, as of this writing.)

Even that much might not be truly necessary, since Xen support comes built into the Linux kernel these days. The Citrix document you are referencing might simply be out of date, or lagging behind some formal testing process.

By contrast, VMs based on OpenVZ (a Xen competitor) must keep a particular kernel version running because it's been patched to match the host OS's kernel. On a different OpenVZ-based VPS we rent here, I can tell that our hosting provider runs CentOS 5 on the host by the kernel version. (2.6.18, rather than 2.6.32.)