Kpatch: Dynamic Linux kernel patching

by patrickaljord • 12 years ago

27 7 12 years ago

chomp• 12 years ago

I was at the Linuxcon talk for this yesterday, here's the slides:

http://events.linuxfoundation.org/sites/events/files/slides/...

It's important to note that it's not exactly production ready, but it can work with really simple CVEs (things that don't require changes to data structures and such).

Because of this, kpatch needs a person to manually review the patch before applying it, so some kernel knowledge is required to make sure that you're making a good patch.

I do think that it'll get better as time goes on. This is a really neat feature and brings an open source competitor to ksplice.

gue5t• 12 years ago

That's http://events.linuxfoundation.org/sites/events/files/slides/... now.

spb• 12 years ago

How is this different from ksplice?

Zancarius• 12 years ago

As pointed out by chomp [1] (above).

[1] https://github.com/dynup/kpatch?hn#license

kapilvt• 12 years ago

in a word. support.

as opposed to oracle overlords, who will eventually stop supporting grandfather'd customers and only support unbreakable linux.

there's kgraft and kpatch (suse and redhat respectively), different capabilities.

background links (kgraft/kspice) http://lwn.net/Articles/584016/ http://lwn.net/Articles/589183/

edit.. oracle also owns patents on ksplice.

sam_bwut• 12 years ago

Wait, how handy will this be for adding backdoors once you have root?

michaelmior• 12 years ago

Patch modules can be signed so assuming you only need signed patches (which seems reasonable) this shouldn't be too much of a concern.

Kpatch: Dynamic Linux kernel patching

Related Stories