主页 / ubuntu / 问题

问题[canonical-livepatch](ubuntu)

Martin Hope
user36196
Asked: 2023-11-19 07:35:15 +0800 CST
  • 4

每次我远程登录我的笔记本电脑时，我都会收到一条消息，告诉我立即重新启动，因为 Livepatch 已经修补了漏洞：

Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-84-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

Expanded Security Maintenance for Applications is enabled.

0 updates can be applied immediately.

*** Livepatch has fixed kernel vulnerabilities. System restart recommended on the closest maintenance window ***

这是我重新启动机器后的情况。

如何防止每次登录时出现此消息？

我已按照此处给出的响应进行操作，以确保所有软件包均已更新：Livepatch Behaviour 并在 中重新启动，但仍会在远程登录时收到消息。

我没有运行最新版本的内核，因为它会导致图形问题：Ubuntu 22.04.3 LTS GUI 不适用于 5.15.0-88-generic

编辑：我每次登录 GUI 时都会收到“Livepatch：刚刚应用更新”的通知。

编辑：我检查了 中的脚本/etc/update-motd.d，并有以下内容：

.@.:/etc/update-motd.d$ sudo /snap/bin/canonical-livepatch  refresh
[sudo] password for .:
checking for patches
nothing to apply
kernel: 5.15.0-84.93-generic
patch state: ✓ all applicable livepatch modules inserted
patch version: 99.1
.@.:/etc/update-motd.d$ sudo /snap/bin/canonical-livepatch status
last check: 8 seconds ago
kernel: 5.15.0-84.93-generic
server check-in: succeeded
kernel state: ✓ kernel series 5.15 is covered by Livepatch
patch state: ✓ all applicable livepatch modules inserted
patch version: 99.1
tier: updates (Free usage; This machine beta tests new patches.)
machine id: 
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
canonical-livepatch
Martin Hope
Magdy Samy
Asked: 2022-05-14 02:04:31 +0800 CST
  • 0

sudo ua enable livepatch 得到以下答案

One moment, checking your subscription first
Stderr: internal error, please report: running "canonical-livepatch" failed: cannot find installed snap "canonical-livepatch" at revision 132: missing file /snap/canonical-livepatch/132/meta/snap.yaml
Stdout: 
Unable to configure Livepatch: Failed running command '/snap/bin/canonical-livepatch config remote-server=https://livepatch.canonical.com' [exit(46)]. Message: internal error, please report: running "canonical-livepatch" failed: cannot find installed snap "canonical-livepatch" at revision 132: missing file /snap/canonical-livepatch/132/meta/snap.yaml

ERROR: Unable to configure Livepatch: Failed running command '/snap/bin/canonical-livepatch config remote-server=https://livepatch.canonical.com' [exit(46)]. Message: internal error, please report: running "canonical-livepatch" failed: cannot find installed snap "canonical-livepatch" at revision 132: missing file /snap/canonical-livepatch/132/meta/snap.yaml
canonical-livepatch
Martin Hope
heynnema
Asked: 2020-06-27 10:53:51 +0800 CST
  • 3

在 20.04 中，我启用了Livepatch. 我已经看了两个星期，还没有看到它做任何事情，所以我决定禁用它。

但是，我仍然看到一个进程canonical-livepatch正在运行，并且我仍然看到一个 snap 应用程序canonical-livepatch。

snap 应用程序是否正在启动该canonical-livepatch过程？

我可以安全地删除快照和进程吗？

20.04 canonical-livepatch
Martin Hope
PonJar
Asked: 2019-06-22 12:41:55 +0800 CST
  • 1

我正在本地家庭网络中为 Seafile 运行 Ubuntu 18.04.2 LTS 服务器。我最近安装了 Livepatch，没有错误并且正在运行

canonical-livepatch status

产生的输出显示最近的“last-check”，“running”为真，“checkState”为已检查，“patchState”为无应用。内核是 4.15.0-52.56-generic。

一切似乎都很好，但是我在日志中遇到错误

while starting HTTP server: accept unix /var/snap/canonical-livepatch/77/livepatchd-priv.sock: use of closed network connection

这有什么好担心的吗？

networking canonical-livepatch
Martin Hope
fschoenm
Asked: 2019-06-20 11:45:52 +0800 CST
  • 2

我有 canonical-livepatch 运行，但它显示下面的错误消息。首先，它尝试使用错误进行更新cannot apply patches: cannot apply update: cannot execute finitModule syscall: required key not available。失败后，它拒绝再次尝试另一个更新。

应用更新可能会出现什么问题？我找不到有关该错误消息的任何信息。

我正在运行 Ubuntu 18.04.2 LTS。

$ journalctl -t canonical-livepatch
[...]
Jun 17 23:11:24 callisto canonical-livepatch[1183]: Client.Check
Jun 17 23:11:24 callisto canonical-livepatch[1183]: Checking with livepatch service.
Jun 17 23:11:24 callisto canonical-livepatch[1183]: updating last-check
Jun 17 23:11:24 callisto canonical-livepatch[1183]: touched last check
Jun 17 23:11:24 callisto canonical-livepatch[1183]: Applying update 52.3 for 4.15.0-51.55-generic
Jun 17 23:11:24 callisto canonical-livepatch[1183]: during refresh: cannot apply patches: cannot apply update: cannot execute finitModule syscall: required key not available
Jun 18 00:11:24 callisto canonical-livepatch[1183]: Client.Check
Jun 18 00:11:24 callisto canonical-livepatch[1183]: Checking with livepatch service.
Jun 18 00:11:24 callisto canonical-livepatch[1183]: updating last-check
Jun 18 00:11:24 callisto canonical-livepatch[1183]: touched last check
Jun 18 00:11:24 callisto canonical-livepatch[1183]: No updates available at this time.
Jun 18 00:11:24 callisto canonical-livepatch[1183]: Module may have caused kernel crash! Not inserting module.
Jun 18 00:11:24 callisto canonical-livepatch[1183]: To override this warning, remove /var/snap/canonical-livepatch/common/locks/livepatch_Ubuntu_4_15_0_51_55_generic_52_52.3
Jun 18 00:11:24 callisto canonical-livepatch[1183]: during refresh: cannot apply patches: lock file "/var/snap/canonical-livepatch/common/locks/livepatch_Ubuntu_4_15_0_51_55_generic_52_52.3" already exists
18.04 canonical-livepatch
Martin Hope
Mohamed Hafez
Asked: 2019-05-20 18:01:09 +0800 CST
  • 2

所以可以说一个 livepatch 进来了，我当前运行的内核被打了补丁，我不重新启动服务器，因为我不再需要了。如果几周/几个月/不管怎样，另一个livepatch进来了，几周后又来了，等等，会发生什么？这种情况在不重新戒色的情况下是否可持续？

我能看到这种情况的唯一方法是，如果每个 livepatch 都将正在运行的内核修补到与您正常apt dist-upgrade获取最新内核并重新启动时完全相同的情况，但我的印象是 livepatching 只能修复高和关键的安全性问题，而其他一切都保持不变。

或者，他们是否只是针对旧基础内核的变体 + 为它们制作的不同数量的先前 livepatch 测试每个 livepatch？如果是这种情况，我猜他们测试的时间会有限制，最终您应该重新启动以确保您的基本内核是针对 livepatch 进行测试的内核？

canonical-livepatch