Restart service after yum update?

Question

Today I updated several of our servers using yum.

4 package(s) needed for security, out of 4 available
Run "sudo yum update" to apply all updates.

Three were openssh updates, one java. Do I need to restart the openssh server after the update?

When I see that Apache is updated, I restart it manually. I do the same for PHP updates, but don't know if that's really necessary.

On Debian, when using apt-get, I see messages that a service is being restarted. Does yum do the same?

Which services do I need to restart manually after an update? Or does yum handle the restart?

Answer 1

After you’ve run yum update to upgrade libraries, there may be services running which are still using the old copies of libraries. Such services might still be vulnerable to security bugs in the old libraries.

It’s relatively easy to discover which processes are affected using lsof to list processes using deleted files:

# lsof | awk '$5 == "DEL" { print }'
auditd     1001  1001 root DEL REG /usr/lib64/libnss_files-2.18.so;53bd9626
libvirtd   1468  1509 root DEL REG /usr/lib64/libnss_files-2.18.so;53bd9626
[lots more output]

If you actually run this command after updating (say) glibc, you’ll get pages and pages of output which is hard to sift through.

However with systemd we can map the process IDs to services and user sessions.

That’s what the following script does:

http://oirase.annexia.org/rwmj.wp.com/needs-restart.pl

Typical output looks like this:

In order to complete the installation of glibc-2.18-11.fc20.x86_64, you should restart the following services:

    - accounts-daemon.service - Accounts Service   
    - console-kit-daemon.service - Console Manager
    - udisks2.service - Disk Manager
    - auditd.service - Security Auditing Service
    - dbus.service - D-Bus System Message Bus
    - rtkit-daemon.service - RealtimeKit Scheduling Policy Service
    - upower.service - Daemon for power management
    - colord.service - Manage, Install and Generate Color Profiles
    - firewalld.service - firewalld - dynamic firewall daemon
    - polkit.service - Authorization Manager
    - rsyslog.service - System Logging Service 
    - NetworkManager.service - Network Manager   
    - libvirtd.service - Virtualization daemon
    - gdm.service - GNOME Display Manager

In order to complete the installation of glibc-2.18-11.fc20.x86_64,
you should tell the following users to log out and log in:

    - session-1.scope - Session 1 of user rjones

Answer 2

You could also install the yum-utils package which contains the needs-restarting binary. After your yum update run, you would issue the command

needs-restarting

which will point you to processes that rely on libraries that have been updated and thus should be restarted, for example:

/root » needs-restarting
458 : /usr/lib/systemd/systemd-journald
1161 : /usr/sbin/named -u named -t /var/named/chroot -c /etc/named.conf -u named -n 2
665 : /usr/sbin/abrtd -d -s
661 : /usr/lib/systemd/systemd-logind
660 : /usr/lib/polkit-1/polkitd --no-debug
493 : /usr/lib/systemd/systemd-udevd
1052 : /usr/local/patchman/patchmand
1943 : /usr/libexec/postfix/master -w
698 : /usr/sbin/nrpe -c /etc/nagios/nrpe.cfg -d
1 : /usr/lib/systemd/systemd --switched-root --system --deserialize 22
717 : /usr/sbin/NetworkManager --no-daemon
1019 : /usr/bin/python -Es /usr/sbin/tuned -l -P
1652 : /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --plugin-dir=/usr/lib64/mysql/plugin --log-error=/var/log/mariadb/mariadb.log --pid-file=/var/run/mariadb/mariadb.pid --socket=/var/lib/mysql/mysql.sock
1010 : /usr/bin/python /usr/bin/salt-minion
678 : /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation
16299 : /sbin/rpcbind -w
638 : /sbin/auditd
675 : /usr/sbin/smartd -n -q never
672 : /usr/sbin/irqbalance --foreground
1021 : php-fpm: master process (/etc/php-fpm.conf)
480 : /usr/sbin/lvmetad -f
1024 : /usr/bin/dockerd
1047 : /usr/sbin/xinetd -stayalive -pidfile /var/run/xinetd.pid
1020 : /usr/sbin/sshd -D
1972 : qmgr -l -t fifo -u
1537 : /usr/bin/python /usr/bin/salt-minion
2026 : /usr/bin/python /usr/bin/salt-minion
1009 : php-fpm: master process (/opt/plesk/php/7.0/etc/php-fpm.conf)
1249 : sw-engine-kv
2028 : tlsmgr -l -t unix -u
682 : /usr/sbin/chronyd

It is also possible to determine if the machine should be rebooted by adding the -r flag (CentOS/RHEL 7+ only!), like so:

/root » needs-restarting -r
Core libraries or services have been updated:
  kernel -> 3.10.0-862.3.2.el7
  linux-firmware  20180220-62.1.git6d51311.el7_5
Reboot is required to ensure that your system benefits from these updates.