0

Can anyone did Kernel live patching using Kgraft in SLES 11 or 12 ? Is there any procedure to be followed ? How can we verify the kernel vulnerability fixes after Kgraft patching ??

Improve this question

1 Answer 1

Reset to default
1

Live patching is available only on SLE12+ Is sold as SLE12 extension so you need valid key and register this to get Live patches.

SUSE offers 60day trial on Live patching purchase page

Live patching is controlled by kgr tool:

# kgr 
Error: no command provided

Usage: /usr/bin/kgr [-h][-v] COMMAND
Query and manipulate kGraft patching status.

Commands:
    status:    display the overall status of kGraft patching
    patches:   display the list of loaded patches
    blocking:  list processes that are preventing kGraft patching
           from finishing
    poke:      move forward with the kGraft patching by sending
           STOP and CONT signal to the pending processes

Options:
    -h     print this help
    -v     more detailed output

Report bugs at https://bugzilla.suse.com/.

and verification of applied patches:

 # kgr -v patches
 kgraft_patch_2_2_1
     active: 1
     RPM: kgraft-patch-3_12_62-60_64_8-default-2-2.1.x86_64
     CVE: CVE-2016-8666 CVE-2016-6480
     bug fixes and enhancements: (none)

For own verification of fixed bug you might try bug reproducer if exists. ( not recommended way , SUSE's QA-Maintenace tests this patches very extensively before release to it customers)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .