3

I'm on Ubuntu 14.04 and really enjoy the fact that I get automatic kernel security updates. When a kernel security problem is patched, a new package will be shipped with the new version. My machine is configured to scan for new security updates every half hour and automatically install them. I don't have to watch mailing lists or CVEs, and I get the patches. It's a good system.

I was thinking of running grsecurity, but they require you to patch and manually recompile your kernel. This is a bit problematic because I'll likely miss out on kernel security updates provided from Ubuntu's upstream.

Is there a way to automate kernel recompilation, adding patch files to the process?

  • emerge / gentoo hardened – Panther Nov 12 '15 at 4:19
0

Are you sure that you have need from automate kernel recompilation? If you are using the Ubuntu repositories for downloading the security updates, there is no need to compile them. Otherwise this point is missing from your question.

There are a few ways to compile automatically the kernel. For example check this article

I am adding a quote from the page:

# Automated Kernel Recompilation By Avinash Shankar 
# Note: This was done under RH-7.3 so plz verify the paths
# Warning: Please run the Script under Xwindows

#going to kernel sources directory:
echo Entering Kernel Source Directory................
cd /usr/src/linux-2.4/

#Cleaning dep files and objs:
echo Cleaning up Junk files..................
make clean

#Configuring your New Kernel:
echo Entering Graphical kernel config.....................
make xconfig

#Making the dependencies files:
echo Making the dependecies ..................
make dep

#Backing up old module files
echo All your module files and system.map files backed up ................ 
mv /lib/modules/2.4.18-3/modules.dep modules.dep.old
mv /usr/src/linux-2.4/System.map System.map.old

#Make a compressed kernel:
echo Compressing the kernel image ..............................................
make bzImage

#Copy the Image to /boot directory
echo Copying the bzImage to /boot Directory......................................................
cp /usr/src/linux-2.4/arch/i386/boot/bzImage /boot

#Make the modules :
echo Compiling the Modules ...............................
make modules

#Make the Installable modules used by the new kernel
echo Making the modules executable ...................................
make modules_install

#copy the System.map file to /boot
echo Copying System.map file to /boot ....................................
cp /usr/src/linux-2.4/System.map /boot

echo Thats it you are finished ! Cool now edit the lilo.conf or your grub.conf file
echo located in the /boot directory. Copy the kernel entries and replace kernel with
echo the bzImage file and the initrd entry with System.map

-----------------------------------------------------------------------------------------------

Also these days Live Kernel Patching is something which will make your life easier. Unfortunately it is valid only for Ubuntu 16.04

Since the release of the Linux 4.0 kernel about 18 months ago, users have been able to patch and update their kernel packages without rebooting.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.