mrvitej.in

Archive · Linux

Updates, Kernels and Livepatch

Keep a server patched without surprises, and know which kernel you are really running.

1 min read

  • Ubuntu 18.04.4 LTS
  • Linux kernel 5.3 HWE
  • unattended-upgrades

Ubuntu 18.04.4 (February 2020) ships the 4.15 kernel by default, with the HWE (hardware enablement) kernel 5.3 available as an option. Use HWE for newer hardware, and stay on 4.15 for the longest-tested path.

uname -r                                 # running kernel
apt list --installed 2>/dev/null | grep linux-image
sudo apt install --install-recommends linux-generic-hwe-18.04   # opt in to HWE
cat /var/run/reboot-required             # exists when a reboot is pending

Security updates apply automatically through unattended-upgrades, which is enabled by default on Ubuntu Server 18.04; check /etc/apt/apt.conf.d/50unattended-upgrades to see what it includes and whether it may reboot.

A kernel update needs a reboot to take effect. Canonical Livepatch applies critical kernel fixes without one and has a free tier for a small number of machines. Plan reboots in a window, and confirm the services start on boot first.