Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #227992 > unrolled thread

kernel security upgrade - "rebase?"

Back to article view | Back to linux.debian.user

Contents

  kernel security upgrade - "rebase?" Bob Bernstein <poobah@ruptured-duck.com> - 2020-10-20 02:10 +0200
    Re: kernel security upgrade - "rebase?" The Wanderer <wanderer@fastmail.fm> - 2020-10-20 02:30 +0200
      Re: kernel security upgrade - "rebase?" David <bouncingcats@gmail.com> - 2020-10-20 03:20 +0200
      Re: kernel security upgrade - "rebase?" Bob Bernstein <poobah@ruptured-duck.com> - 2020-10-20 03:50 +0200
      Re: kernel security upgrade - "rebase?" Andrei POPESCU <andreimpopescu@gmail.com> - 2020-10-20 11:20 +0200
        Re: kernel security upgrade - "rebase?" Richard Hector <richard@walnut.gen.nz> - 2020-10-20 13:40 +0200
          Re: kernel security upgrade - "rebase?" Andrei POPESCU <andreimpopescu@gmail.com> - 2020-10-20 15:20 +0200
        Re: kernel security upgrade - "rebase?" rhkramer@gmail.com - 2020-10-20 16:50 +0200
          Re: kernel security upgrade - "rebase?" Andrei POPESCU <andreimpopescu@gmail.com> - 2020-10-21 08:50 +0200
            Re: kernel security upgrade - "rebase?" David Wright <deblis@lionunicorn.co.uk> - 2020-10-21 20:10 +0200
              Re: kernel security upgrade - "rebase?" rhkramer@gmail.com - 2020-10-22 01:10 +0200

#227992 — kernel security upgrade - "rebase?"

I am trying to meet the challenge of the security upgrade -- 
[SECURITY] [DSA 4774-1] linux security update -- that 
was issued today.

This is an AMD Buster system:

Linux debian.localdomain 4.19.0-8-amd64 #1 SMP Debian 
4.19.98-1+deb10u1 (2020-04-27) x86_64 GNU/Linux

I have noticed for several weeks that when I run "apt-get 
upgrade" my kernel gets held back:

"The following packages have been kept back:
   linux-image-amd64 thunderbird"

So, again today, running apt-get update and then apt-get upgrade 
does not install the new kernel. Here is the instruction from 
the security bulletin:

"For the stable distribution (buster), these problems have been 
fixed in version 4.19.152-1. The vulnerabilities are fixed by 
rebasing to the new stable upstream version 4.19.152 which 
includes additional bugfixes."

I am completely at a loss to know how to "rebase" to the new 
version. The term "rebase" is a Debian term-of-art I have never 
before encountered. Can someone please point me to a step by 
step "Kernel Rebasing For Dummies" guide?

Thank you.


-- 
  A test of right and wrong must be the means, one would
  think, of ascertaining what is right or wrong, and not a
  consequence of having already ascertained it.

                                   J. S. Mill

[toc] | [next] | [standalone]

#227994

[Multipart message — attachments visible in raw view] — view raw

On 2020-10-19 at 20:01, Bob Bernstein wrote:

> I am trying to meet the challenge of the security upgrade -- 
> [SECURITY] [DSA 4774-1] linux security update -- that 
> was issued today.
> 
> This is an AMD Buster system:
> 
> Linux debian.localdomain 4.19.0-8-amd64 #1 SMP Debian 
> 4.19.98-1+deb10u1 (2020-04-27) x86_64 GNU/Linux
> 
> I have noticed for several weeks that when I run "apt-get 
> upgrade" my kernel gets held back:
> 
> "The following packages have been kept back:
>    linux-image-amd64 thunderbird"
> 
> So, again today, running apt-get update and then apt-get upgrade 
> does not install the new kernel. Here is the instruction from 
> the security bulletin:
> 
> "For the stable distribution (buster), these problems have been 
> fixed in version 4.19.152-1. The vulnerabilities are fixed by 
> rebasing to the new stable upstream version 4.19.152 which 
> includes additional bugfixes."
> 
> I am completely at a loss to know how to "rebase" to the new 
> version. The term "rebase" is a Debian term-of-art I have never 
> before encountered. Can someone please point me to a step by 
> step "Kernel Rebasing For Dummies" guide?

Actually, "rebase" isn't a Debian term at all; it's a git term.

What this announcement means is that the Debian kernel-package
maintainers have rebased the kernel they ship from being derived from an
older kernel version to being derived from this newer one.

If you run 'apt-cache show linux-image-amd64', I suspect that you will
see that the previous (and currently-installed) version depends on a
version-specific package which is currently installed, and the newer
(and not-yet-installed) version depends on a version-specific package
whose name specifies 4.19 (and possibly 4.19.152).


To install that package and let the upgrade go forward, you have a few
options. The simplest, and the one I go with myself, would be to run

$ apt-get dist-upgrade

instead of your existing "apt-get upgrade". This will let apt-get
perform new-package installs and old-package removals as part of the
upgrade process; in this case, because linux-image-amd64 now depends on
a new package, a new-package install is necessary in order for the
upgrade to be carried out. It's very likely that that will resolve your
issue; it will probably also let Thunderbird get upgraded as well.

If you don't want to allow the other package additions or removals that
would be involved in that process, you could also see whether

$ apt-get install linux-image-amd64

will perform the upgrade and install the new package for just that one
case, without touching the others.

You could also take the new package name from the 'apt-cache show
linux-image-amd64' output and specify it explicitly on an 'apt-get
install' command-line, but that has downsides later on (in that the
package will probably remain around even after it's not useful anymore)
and I wouldn't particularly recommend it.

-- 
   The Wanderer

The reasonable man adapts himself to the world; the unreasonable one
persists in trying to adapt the world to himself. Therefore all
progress depends on the unreasonable man.         -- George Bernard Shaw

[toc] | [prev] | [next] | [standalone]

#227995

On Tue, 20 Oct 2020 at 11:22, The Wanderer <wanderer@fastmail.fm> wrote:
> On 2020-10-19 at 20:01, Bob Bernstein wrote:

> > I have noticed for several weeks that when I run "apt-get
> > upgrade" my kernel gets held back:

> If you run 'apt-cache show linux-image-amd64', I suspect that you will
> see that the previous (and currently-installed) version depends on a
> version-specific package which is currently installed, and the newer
> (and not-yet-installed) version depends on a version-specific package
> whose name specifies 4.19 (and possibly 4.19.152).

To add to The Wanderer's great answer, you might find the output
of the below command helps to clarify matters, because it tells about
the status of packages that are currently installed:
  $ apt list --installed --upgradeable 'linux-image*'

Whereas (someone please correct me if I'm wrong)
'apt-cache show' tells what is currently available from your
configured repositories, but does not indicate whether any of those
are currently installed, or not.

[toc] | [prev] | [next] | [standalone]

#227998

On Mon, 19 Oct 2020, The Wanderer wrote:

> Actually, "rebase" isn't a Debian term at all; it's a git 
> term.

Ah, thus explaining why I found said term vaguely unpleasant. 
<g>

> To install that package and let the upgrade go forward, you 
> have a few options. The simplest, and the one I go with 
> myself, would be to run

> $ apt-get dist-upgrade

Houston, we have lift-off.

That worked like a charm. Thank you for taking a sizable chunk 
of anxiety out of my world tonight.

All best,

-- 
  A test of right and wrong must be the means, one would
  think, of ascertaining what is right or wrong, and not a
  consequence of having already ascertained it.

                                   J. S. Mill

[toc] | [prev] | [next] | [standalone]

#228010

[Multipart message — attachments visible in raw view] — view raw

On Lu, 19 oct 20, 20:21:45, The Wanderer wrote:
> 
> To install that package and let the upgrade go forward, you have a few
> options. The simplest, and the one I go with myself, would be to run
> 
> $ apt-get dist-upgrade
 
I disagree, the simplest and arguably slightly safer is

    apt upgrade

Contrary to 'apt-get upgrade', 'apt upgrade' also installs new packages, 
but doesn't allow removals.

On a stable system I've yet to encounter an upgrade that also requires 
removals.

Even on unstable they are rare (I'm upgrading my unstable chroot almost 
daily with 'apt upgrade').

Besides, it's also shorter to type ;)

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#228015

On 20/10/20 10:10 pm, Andrei POPESCU wrote:
> On Lu, 19 oct 20, 20:21:45, The Wanderer wrote:
>> 
>> To install that package and let the upgrade go forward, you have a few
>> options. The simplest, and the one I go with myself, would be to run
>> 
>> $ apt-get dist-upgrade
>  
> I disagree, the simplest and arguably slightly safer is
> 
>     apt upgrade
> 
> Contrary to 'apt-get upgrade', 'apt upgrade' also installs new packages, 
> but doesn't allow removals.
> 
> On a stable system I've yet to encounter an upgrade that also requires 
> removals.
> 
> Even on unstable they are rare (I'm upgrading my unstable chroot almost 
> daily with 'apt upgrade').

Currently, my stable desktop requires enigmail removed to install
upgrade thunderbird :-(

I understand that should be fine, but I'm waiting till I'm in the right
frame of mind to deal with any issues :-)

Richard

[toc] | [prev] | [next] | [standalone]

#228022

[Multipart message — attachments visible in raw view] — view raw

On Mi, 21 oct 20, 00:31:39, Richard Hector wrote:
> On 20/10/20 10:10 pm, Andrei POPESCU wrote:
> > On Lu, 19 oct 20, 20:21:45, The Wanderer wrote:
> >> 
> >> To install that package and let the upgrade go forward, you have a few
> >> options. The simplest, and the one I go with myself, would be to run
> >> 
> >> $ apt-get dist-upgrade
> >  
> > I disagree, the simplest and arguably slightly safer is
> > 
> >     apt upgrade
> > 
> > Contrary to 'apt-get upgrade', 'apt upgrade' also installs new packages, 
> > but doesn't allow removals.
> > 
> > On a stable system I've yet to encounter an upgrade that also requires 
> > removals.
> > 
> > Even on unstable they are rare (I'm upgrading my unstable chroot almost 
> > daily with 'apt upgrade').
> 
> Currently, my stable desktop requires enigmail removed to install
> upgrade thunderbird :-(

I stand corrected.

> I understand that should be fine, but I'm waiting till I'm in the right
> frame of mind to deal with any issues :-)

Which kind of proves my point, as depending on the list of changes one 
might even miss the removal on running dist-upgrade indiscriminately.

My advice is to use the big hammer only if the medium one is 
insufficient: it's easier to hit your fingers by mistake with it and it 
will also hurt much more ;)


Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#228026

On Tuesday, October 20, 2020 05:10:33 AM Andrei POPESCU wrote:
> On Lu, 19 oct 20, 20:21:45, The Wanderer wrote:
> > To install that package and let the upgrade go forward, you have a few
> > options. The simplest, and the one I go with myself, would be to run
> > 
> > $ apt-get dist-upgrade
> 
> I disagree, the simplest and arguably slightly safer is
> 
>     apt upgrade

I agree, for an additional reason -- iiuc, if you are using an older version 
of Debian, dist-upgrade will attempt to upgrade to the current version, which 
could cause problems.

[toc] | [prev] | [next] | [standalone]

#228057

[Multipart message — attachments visible in raw view] — view raw

On Ma, 20 oct 20, 10:44:17, rhkramer@gmail.com wrote:
> On Tuesday, October 20, 2020 05:10:33 AM Andrei POPESCU wrote:
> > On Lu, 19 oct 20, 20:21:45, The Wanderer wrote:
> > > To install that package and let the upgrade go forward, you have a few
> > > options. The simplest, and the one I go with myself, would be to run
> > > 
> > > $ apt-get dist-upgrade
> > 
> > I disagree, the simplest and arguably slightly safer is
> > 
> >     apt upgrade
> 
> I agree, for an additional reason -- iiuc, if you are using an older version 
> of Debian, dist-upgrade will attempt to upgrade to the current version, which 
> could cause problems.

Actually you will just end up with a partially upgraded system, which 
may be worse.

Your best course of action at that point is likely to follow-up with 
dist-upgrade to switch completely to the next release.

This two-step distribution upgrade is actually a documented work around 
for some issues on upgrades to the next release.

https://www.debian.org/releases/buster/amd64/release-notes/ch-upgrading.en.html#minimal-upgrade

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#228078

[Multipart message — attachments visible in raw view] — view raw

On Wed 21 Oct 2020 at 09:40:37 (+0300), Andrei POPESCU wrote:
> On Ma, 20 oct 20, 10:44:17, rhkramer@gmail.com wrote:
> > On Tuesday, October 20, 2020 05:10:33 AM Andrei POPESCU wrote:
> > > On Lu, 19 oct 20, 20:21:45, The Wanderer wrote:
> > > > To install that package and let the upgrade go forward, you have a few
> > > > options. The simplest, and the one I go with myself, would be to run
> > > > 
> > > > $ apt-get dist-upgrade
> > > 
> > > I disagree, the simplest and arguably slightly safer is
> > > 
> > >     apt upgrade
> > 
> > I agree, for an additional reason -- iiuc, if you are using an older version 
> > of Debian, dist-upgrade will attempt to upgrade to the current version, which 
> > could cause problems.

What do you mean by "older" and "current"? There's no reason to
suppose that sources.list has been touched. Perhaps the "dist-"
prefix is confusing¹, and makes you think there's a release
change involved. But one of the virtues of the apt-get command
line is its stability, hence its recommendation for scripting,
so that's unlikely to change.

> Actually you will just end up with a partially upgraded system, which 
> may be worse.
> 
> Your best course of action at that point is likely to follow-up with 
> dist-upgrade to switch completely to the next release.
> 
> This two-step distribution upgrade is actually a documented work around 
> for some issues on upgrades to the next release.
> 
> https://www.debian.org/releases/buster/amd64/release-notes/ch-upgrading.en.html#minimal-upgrade

Are you not just compounding rhkramer's confusion?

The OP reported running a system where they were running "apt-get
update" (implied) and "apt-get upgrade" regularly (over a period
of weeks) but that their kernel wasn't up-to-date as it was being
held back.

That's standard behaviour, because linux kernel versions (as opposed
to Debian kernel versions) include their version number in the package
name, so apt-get won't install the new packages by default.

The next step, suitable for the great majority (including myself) is
to use "apt-get dist-upgrade" to allow the kernel to be upgraded.
(Where the previous kernel has been running satisfactorily for a
sufficient period, this can be followed by "apt-get --purge
autoremove" to remove the previously-old version.) (attached 1)

The OP had a problem with this sequence, in that ThunderBird was
also being held back, and they didn't want that upgraded because
of its interaction with EnigMail. There are several possible ways
of resolving that.

Pinning would work one-time, but would have to be updated every
few years, whenever the TB/EM problem recurs, because AIUI it
pins applies to a specific version.

Adding  --no-remove  to your script, or configuring  APT::Get::Remove
in /etc/apt/ will prevent accidental removal of packages by apt-get.

Using apt instead will work until your fingers type apt-get one time.
("Wired" fingers can be just as much a problem as not noticing/bothering
to read apt-get's warning.)

And The Wanderer pointed out that you can just "apt-get install
linux-image-amd64", another one-time method. (attached 2)

BTW I think "rebase" was an accidental slip of the pen, rather than
anything particularly different about this security upgrade.

¹ From  man aptitude:

 Note
    This command was originally named dist-upgrade for historical reasons, and
    aptitude still recognizes dist-upgrade as a synonym for full-upgrade.

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#228089

On Wednesday, October 21, 2020 02:03:26 PM David Wright wrote:
> On Wed 21 Oct 2020 at 09:40:37 (+0300), Andrei POPESCU wrote:
> > On Ma, 20 oct 20, 10:44:17, rhkramer@gmail.com wrote:
> > > I agree, for an additional reason -- iiuc, if you are using an older
> > > version of Debian, dist-upgrade will attempt to upgrade to the current
> > > version, which could cause problems.
> 
> What do you mean by "older" and "current"? There's no reason to
> suppose that sources.list has been touched. Perhaps the "dist-"
> prefix is confusing¹, and makes you think there's a release
> change involved. But one of the virtues of the apt-get command
> line is its stability, hence its recommendation for scripting,
> so that's unlikely to change.

I was thinking it could do something like (attempting to) migrate a system 
from, for example, Jessie to Buster ...

> Are you not just compounding rhkramer's confusion?

Ahh yes, thanks for straightening me out, I was confused!

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web