Misplaced Pages

Ksplice: Difference between revisions

Article snapshot taken from Wikipedia with creative commons attribution-sharealike license. Give it a read and then ask your questions in the chat. We can research this topic together.
Browse history interactively← Previous editContent deleted Content addedVisualWikitext
Revision as of 07:34, 28 December 2014 editDsimic (talk | contribs)Extended confirmed users, Pending changes reviewers, Rollbackers39,664 editsm top: Redundant punctuation← Previous edit Latest revision as of 13:06, 15 December 2024 edit undoCitation bot (talk | contribs)Bots5,445,342 edits Altered template type. Added newspaper. | Use this bot. Report bugs. | Suggested by Dominic3203 | Category:Free security software programmed in C | #UCB_Category 1/6 
(59 intermediate revisions by 32 users not shown)
Line 1: Line 1:
{{Short description|Live patch extension for the Linux kernel}}
{{use dmy dates|date=November 2014}} {{Use dmy dates|date=June 2021}}
{{infobox software {{infobox software
| logo = ] | logo = Ksplice-logo.png
| screenshot = Ksplice-uptrack-applied.png | screenshot = Ksplice-uptrack-applied.png
| caption = A screenshot of the Ksplice Uptrack with applied updates | caption = A screenshot of the Ksplice Uptrack with applied updates
Line 7: Line 8:
| author = | author =
| developer = Ksplice, Inc. | developer = Ksplice, Inc.
| released = {{Start date|2008|04|23}}<ref>{{cite mailing list|last=Arnold|first=Jeff|title=A system for rebootless kernel security updates|url=http://kerneltrap.org/mailarchive/linux-kernel/2008/4/23/1570474|date=23 April 2008|accessdate=27 July 2013 |mailinglist=]}}</ref> | released = {{Start date|df=yes|2008|04|23}}<ref>{{cite mailing list|last=Arnold|first=Jeff|title=A system for rebootless kernel security updates|url=http://kerneltrap.org/mailarchive/linux-kernel/2008/4/23/1570474|date=23 April 2008|access-date=27 July 2013|mailing-list=]|archive-url=https://web.archive.org/web/20120511105350/http://kerneltrap.org/mailarchive/linux-kernel/2008/4/23/1570474|archive-date=11 May 2012|url-status=dead}}</ref>
| latest release version = 0.9.9.1 | latest release version = 1.0.35
| latest release date = {{release date and age|2011|07|28}} | latest release date =
| latest preview version = | latest preview version =
| latest preview date = <!-- {{Start date and age|YYYY|MM|DD}} --> | latest preview date = <!-- {{Start date and age|YYYY|MM|DD}} -->
Line 20: Line 21:
| status = | status =
| genre = ] | genre = ]
| license = ] version 2<ref name="license">{{cite web | license = ] version&nbsp;2<ref name="license-1">{{cite web
| url = https://www.ksplice.com/terms | url = https://www.ksplice.com/terms
| title = Ksplice Uptrack Subscription Agreement | title = Ksplice Uptrack Subscription Agreement
| date = 28 September 2011 | accessdate = 18 November 2014 | date = 28 September 2011 | access-date = 18 November 2014
| website = ksplice.com | website = ksplice.com
}}</ref><ref name="license-2">{{cite web
}}{{Better source|reason=Per Talk:Ksplice#GPL|date=December 2014}}</ref>
| url = https://oss.oracle.com/ksplice/software/ksplice-0.9.9.1-src.tar.gz
| title = ksplice 0.9.9.1 source code, README file
| date = 2011-07-28 | access-date = 2014-12-31
| website = oss.oracle.com
| quote = This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License, version 2.
}}</ref>
| website = {{URL|http://www.ksplice.com/}} | website = {{URL|http://www.ksplice.com/}}
}} }}


'''Ksplice''' is an open-source<ref name="license" /> extension of the ] that allows security ]es to be applied to a running ] without the need for ]s, avoiding ]s and improving ] (a technique broadly referred to as ]). Ksplice supports only the patches that do not make significant semantic changes to kernel's data structures.<ref>{{cite web '''Ksplice''' is an open-source<ref name="license-1" /><ref name="license-2" /> extension of the ] that allows security ]es to be applied to a running ] without the need for ]s, avoiding ]s and improving ] (a technique broadly referred to as ]). Ksplice supports only the patches that do not make significant semantic changes to kernel's data structures.<ref>{{cite web
| url = http://manpages.ubuntu.com/manpages/trusty/man8/ksplice-create.8.html | url = http://manpages.ubuntu.com/manpages/trusty/man8/ksplice-create.8.html
| title = Ubuntu Manpage: ksplice-create{{snd}} Create a set of kernel modules for a rebootless kernel | title = Ubuntu Manpage: ksplice-create Create a set of kernel modules for a rebootless kernel
| year = 2009 | accessdate = 23 November 2014 | year = 2009 | access-date = 23 November 2014
| website = manpages.ubuntu.com | website = manpages.ubuntu.com
}}</ref> }}</ref>


Ksplice has been implemented for Linux on the ] and ] architectures.<ref>{{cite web
Ksplice has been implemented for Linux on the ] and ] architectures. It was developed by Ksplice, Inc. until 21 July 2011, when ] acquired Ksplice and started offering support for ]. Support for ] was dropped and turned into a free 30-day trial for RHEL customers as an incentive to migrate to Oracle Linux Premier Support.<ref>{{cite web|title=Free 30-day trial of Ksplice Zero-Downtime Updates for Red Hat Enterprise Linux Customers|url=http://www.ksplice.com/rhel-signup|publisher=Ksplice}}</ref><ref name=customerletter>{{cite web|url=http://www.oracle.com/us/corporate/Acquisitions/ksplice/customer-letter-430127.html |title=Customer Letter Oracle and Ksplice |publisher=Oracle |date=7 September 2010|accessdate=22 July 2011}}</ref>
| url = https://docs.oracle.com/en/operating-systems/oracle-linux/ksplice-user/OL-KSPLICE-USER.pdf
| title = Ksplice Users Guide: Available Architectures
| year = 2023 | access-date = 22 March 2023
| website = docs.oracle.com
}}</ref> It was developed by Ksplice, Inc. until 21 July 2011, when ] acquired Ksplice and then offered support for ]. Support for ] was dropped and turned into a free 30-day trial for RHEL customers as an incentive to migrate to Oracle Linux Premier Support.<ref>{{cite web|title=Free 30-day trial of Ksplice Zero-Downtime Updates for Red Hat Enterprise Linux Customers|url=http://www.ksplice.com/rhel-signup|publisher=Ksplice}}</ref><ref name=customerletter>{{cite web|url=http://www.oracle.com/us/corporate/Acquisitions/ksplice/customer-letter-430127.html |title=Customer Letter Oracle and Ksplice |publisher=Oracle |date=7 September 2010|access-date=22 July 2011}}</ref>

Ksplice is today offered on the two kernel flavors distributed with Oracle Linux:

* ]
* ]

{{As of|2015|7}}, Ksplice is available for free on desktop Linux installations, with official support available for Ubuntu ].<ref name="ksplice-desktop">{{cite web |url=http://ksplice.oracle.com/try/desktop |title=Oracle Ksplice Free Desktop Edition |date=16 July 2015 |website=Oracle Ksplice |publisher=Oracle |access-date=16 July 2015 |quote=Oracle Ksplice is offered for free on Fedora and Ubuntu Desktop Editions.}}</ref>


== Design == == Design ==
] ]


Ksplice takes as input a ] and the original kernel source code, and it updates the running kernel in ]. Using Ksplice does not require any preparation before the system is originally ], (the running kernel needs no special prior ], for example). In order to generate an update, Ksplice must determine what code within the kernel has been changed by the source code patch. Ksplice performs this analysis at the ] (ELF) object code layer, rather than at the ] source code layer.<ref name="ksplice-eurosys">{{cite web Ksplice takes as input a ] and the original kernel source code, and it updates the running kernel in ]. Using Ksplice does not require any preparation before the system is originally ], (the running kernel needs no special prior ], for example). In order to generate an update, Ksplice must determine what code within the kernel has been changed by the source code patch. Ksplice performs this analysis at the ] (ELF) object code layer, rather than at the ] source code layer.<ref name="ksplice-eurosys">{{cite web
| url = http://pdos.csail.mit.edu/papers/ksplice:eurosys.pdf | url = http://pdos.csail.mit.edu/papers/ksplice:eurosys.pdf
| title = Ksplice: Automatic Rebootless Kernel Updates | title = Ksplice: Automatic Rebootless Kernel Updates
| accessdate = 18 November 2014 | access-date = 18 November 2014
| author1 = Jeff Arnold | author2 = M. Frans Kaashoek | author1 = Jeff Arnold | author2 = M. Frans Kaashoek
| website = mit.edu | format = PDF | website = mit.edu
}}</ref> }}</ref>


To apply a patch, Ksplice first freezes execution of a computer so it is the only program running. The system verifies that no ] were in the middle of executing functions that will be modified by the patch. Ksplice modifies the beginning of changed functions so that they instead point to new, updated versions of those functions, and modifies data and structures in memory that need to be changed. Finally, Ksplice resumes each processor running where it left off.<ref name="ksplice-eurosys" /> To apply a patch, Ksplice first freezes execution of a computer so it is the only program running. The system verifies that no ] were in the middle of executing functions that will be modified by the patch. Ksplice modifies the beginning of changed functions so that they instead point to new, updated versions of those functions, and modifies data and structures in memory that need to be changed. Finally, Ksplice resumes each processor running where it left off.<ref name="ksplice-eurosys" />


To be fully automatic, Ksplice's design was originally limited to patches that did not introduce ] changes to ], since most Linux kernel security patches do not make these kinds of changes. An evaluation against Linux kernel security patches from May 2005 to May 2008 found that Ksplice was able to apply fixes for all the 64 significant kernel ] discovered in that interval. In 2009, major Linux vendors asked their customers to install a kernel update more than once per month.<ref>{{cite web|url=http://blog.nexcess.net/2010/11/30/nexcess-adopts-ksplice-uptrack-rebootless-technology/|title=Nexcess Adopts Ksplice Uptrack "Rebootless" Technology|publisher=Nexcess |date=30 November 2010 |accessdate=18 February 2011}}</ref> For patches that do introduce semantic changes to data structures, Ksplice requires a programmer to write a short amount of additional code to help apply the patch. This was necessary for about 12% of the updates in that time period.<ref>{{cite web|url=http://www.ksplice.com/cve-evaluation |title=Performance record |publisher=Ksplice |date= |accessdate=4 June 2009}}</ref> To be fully automatic, Ksplice's design was originally limited to patches that did not introduce ] changes to ], since most Linux kernel security patches do not make these kinds of changes. An evaluation against Linux kernel security patches from May 2005 to May 2008 found that Ksplice was able to apply fixes for all the 64 significant kernel ] discovered in that interval. In 2009, major Linux vendors asked their customers to install a kernel update more than once per month.<ref>{{cite news|url=http://blog.nexcess.net/2010/11/30/nexcess-adopts-ksplice-uptrack-rebootless-technology/|title=Nexcess Adopts Ksplice Uptrack "Rebootless" Technology|newspaper=Web Hosting Blog |publisher=Nexcess |date=30 November 2010 |access-date=18 February 2011}}</ref> For patches that do introduce semantic changes to data structures, Ksplice requires a programmer to write a short amount of additional code to help apply the patch. This was necessary for about 12% of the updates in that time period.<ref>{{cite web |url=http://www.ksplice.com/cve-evaluation |title=Performance record |publisher=Ksplice |access-date=4 June 2009 |archive-url=https://web.archive.org/web/20090416194641/http://ksplice.com/cve-evaluation |archive-date=16 April 2009 |url-status=dead }}</ref>


==History== ==History==
{{See also|Linux kernel#Live patching}}
The Ksplice software was created by four MIT students based on Jeff Arnold's master's thesis.<ref>{{cite web|first=Jake|last=Edge|url=http://lwn.net/Articles/340477/|title=Ksplice provides updates without reboots|publisher=]|date=10 June 2009|accessdate=21 July 2011}}</ref> Jeff Arnold later created Ksplice, Inc. with himself as the president of the company. Around May 2009, the company won the ] and the Cyber Security Challenge of ].


The Ksplice software was created by four MIT students based on Jeff Arnold's master's thesis,<ref>{{cite web|first=Jake|last=Edge|url=https://lwn.net/Articles/340477/|title=Ksplice provides updates without reboots|publisher=]|date=10 June 2009|access-date=21 July 2011}}</ref> and they later created Ksplice, Inc. Around May 2009, the company won the ] and the Cyber Security Challenge of ].
Whereas the Ksplice software was provided under an open source license, Ksplice, Inc. provided a service to make it easier to use the software. Ksplice, Inc. provided prebuilt and tested updates for the ], ], ], ] and ] Linux distributions.<ref>{{cite web|url=http://www.ksplice.com/uptrack/ |title=Ksplice Uptrack |publisher=Ksplice |accessdate=19 July 2009}}</ref> The virtualization technologies ] and ] were also supported. Updates for Ubuntu Desktop and Fedora systems were provided free of charge, whereas other platforms were offered on a subscription basis.<ref>{{cite web|url=http://www.ksplice.com/pricing|title=Pricing|publisher=Ksplice, Inc.|accessdate=13 March 2011}}</ref>


Whereas the Ksplice software was provided under an open source license, Ksplice, Inc. provided a service to make it easier to use the software. Ksplice, Inc. provided prebuilt and tested updates for the ], ], ], ] and ] Linux distributions.<ref>{{cite web|url=http://www.ksplice.com/uptrack/ |title=Ksplice Uptrack |publisher=Ksplice |access-date=19 July 2009}}</ref> The virtualization technologies ] and ] were also supported. Updates for Ubuntu Desktop and Fedora systems were provided free of charge, whereas other platforms were offered on a subscription basis.<ref>{{cite web|url=http://www.ksplice.com/pricing|title=Pricing|publisher=Ksplice, Inc.|access-date=13 March 2011}}</ref>
On 21 July 2011, ] announced they acquired Ksplice, Inc. At the time the company was acquired, Ksplice, Inc. claimed to have over 700 companies using the service to protect over 100,000 servers. While the service had been available for multiple Linux distributions, it was stated at the time of acquisition that "Oracle believes it will be the only enterprise Linux provider that can offer zero downtime updates." More explicitly, "Oracle does not plan to support the use of Ksplice technology with Red Hat Enterprise Linux."<ref name=customerletter/> Existing legacy customers continue to be supported by Ksplice, but no new customers are being accepted for other platforms.<ref>{{cite web|title=Supported Kernels|url=http://www.ksplice.com/uptrack/supported-kernels|work=Ksplice website|publisher=Oracle America|accessdate=13 February 2012}}</ref>


On 21 July 2011, ] announced that they acquired Ksplice, Inc. At the time the company was acquired, Ksplice, Inc. claimed to have over 700 companies using the service to protect over 100,000 servers. While the service had been available for multiple Linux distributions, it was stated at the time of acquisition that "Oracle believes it will be the only enterprise Linux provider that can offer zero downtime updates." More explicitly, "Oracle does not plan to support the use of Ksplice technology with Red Hat Enterprise Linux."<ref name=customerletter/> Existing legacy customers continue to be supported by Ksplice, but no new customers are being accepted for other platforms.<ref>{{cite web|title=Supported Kernels|url=http://www.ksplice.com/uptrack/supported-kernels|work=Ksplice website|publisher=Oracle America|access-date=13 February 2012}}</ref>
== See also ==
{{Portal|Computer security|Linux}}


{{As of|2015|7}}, Ksplice is available for free on Ubuntu Desktop.<ref name="ksplice-desktop" /> In January 2016, Ksplice was integrated into Oracle's Unbreakable Enterprise Kernel Release&nbsp;4 for ]&nbsp;6 and 7, which is Oracle's redistribution of ].<ref>{{cite web |title=Oracle Brings Real-Time Kernel Patching to Its Unbreakable Enterprise Kernel Release 4 |url=http://news.softpedia.com/news/oracle-brings-real-time-kernel-patching-to-its-unbreakable-enterprise-kernel-498656.shtml |author=Marius Nestor |website=softpedia.com |date=9 January 2016 |access-date=9 January 2016}}</ref>
* ]{{snd}} a method for loading a whole new kernel from a running system

* ]{{snd}} another Linux kernel live patching technology developed by SUSE
As of March 2023, Ksplice is integrated into:
* ]{{snd}} another Linux kernel live patching technology developed by Red Hat

* Oracle's Unbreakable Enterprise Kernel Releases 5, 6 and 7, distributed with Oracle Linux 7, Oracle Linux 8 and Oracle Linux 9
* Red Hat Compatible Kernel releases distributed with Oracle Linux 7, Oracle Linux 8 and Oracle Linux 9

== See also ==
{{Portal|Linux}}
* ], a method for loading a whole new kernel from a running system
* ], ] and ], other Linux kernel live patching technologies developed by SUSE, Red Hat and CloudLinux, respectively
* ] * ]


Line 72: Line 98:


==External links== ==External links==
{{Commons category multi|Ksplice|Linux kernel live patching}}
{{Commonscat}}


* {{Official website|ksplice.com}}
*
* {{YouTube|id=1m5HJ7h1l7I|title=Demo: Zero Downtime OS Updates with Ksplice}}
*


{{Linux kernel}} {{Linux kernel}}
{{Operating system}} {{Operating system}}


] ]
]
]
] ]
]

Latest revision as of 13:06, 15 December 2024

Live patch extension for the Linux kernel

Ksplice
A screenshot of the Ksplice Uptrack with applied updates
Developer(s)Ksplice, Inc.
Initial release23 April 2008 (2008-04-23)
Stable release1.0.35
Operating systemLinux
TypeKernel extension
LicenseGNU GPL version 2
Websitewww.ksplice.com

Ksplice is an open-source extension of the Linux kernel that allows security patches to be applied to a running kernel without the need for reboots, avoiding downtimes and improving availability (a technique broadly referred to as dynamic software updating). Ksplice supports only the patches that do not make significant semantic changes to kernel's data structures.

Ksplice has been implemented for Linux on the x86-64 and AArch64 architectures. It was developed by Ksplice, Inc. until 21 July 2011, when Oracle acquired Ksplice and then offered support for Oracle Linux. Support for Red Hat Enterprise Linux was dropped and turned into a free 30-day trial for RHEL customers as an incentive to migrate to Oracle Linux Premier Support.

Ksplice is today offered on the two kernel flavors distributed with Oracle Linux:

As of July 2015, Ksplice is available for free on desktop Linux installations, with official support available for Ubuntu Linux distribution.

Design

A high-level overview of the hot patches generation, which is based on changes in the kernel's source code.

Ksplice takes as input a unified diff and the original kernel source code, and it updates the running kernel in memory. Using Ksplice does not require any preparation before the system is originally booted, (the running kernel needs no special prior compiling, for example). In order to generate an update, Ksplice must determine what code within the kernel has been changed by the source code patch. Ksplice performs this analysis at the Executable and Linkable Format (ELF) object code layer, rather than at the C source code layer.

To apply a patch, Ksplice first freezes execution of a computer so it is the only program running. The system verifies that no processors were in the middle of executing functions that will be modified by the patch. Ksplice modifies the beginning of changed functions so that they instead point to new, updated versions of those functions, and modifies data and structures in memory that need to be changed. Finally, Ksplice resumes each processor running where it left off.

To be fully automatic, Ksplice's design was originally limited to patches that did not introduce semantic changes to data structures, since most Linux kernel security patches do not make these kinds of changes. An evaluation against Linux kernel security patches from May 2005 to May 2008 found that Ksplice was able to apply fixes for all the 64 significant kernel vulnerabilities discovered in that interval. In 2009, major Linux vendors asked their customers to install a kernel update more than once per month. For patches that do introduce semantic changes to data structures, Ksplice requires a programmer to write a short amount of additional code to help apply the patch. This was necessary for about 12% of the updates in that time period.

History

See also: Linux kernel § Live patching

The Ksplice software was created by four MIT students based on Jeff Arnold's master's thesis, and they later created Ksplice, Inc. Around May 2009, the company won the MIT $100K Entrepreneurship Competition and the Cyber Security Challenge of Global Security Challenge.

Whereas the Ksplice software was provided under an open source license, Ksplice, Inc. provided a service to make it easier to use the software. Ksplice, Inc. provided prebuilt and tested updates for the Red Hat, CentOS, Debian, Ubuntu and Fedora Linux distributions. The virtualization technologies OpenVZ and Virtuozzo were also supported. Updates for Ubuntu Desktop and Fedora systems were provided free of charge, whereas other platforms were offered on a subscription basis.

On 21 July 2011, Oracle Corporation announced that they acquired Ksplice, Inc. At the time the company was acquired, Ksplice, Inc. claimed to have over 700 companies using the service to protect over 100,000 servers. While the service had been available for multiple Linux distributions, it was stated at the time of acquisition that "Oracle believes it will be the only enterprise Linux provider that can offer zero downtime updates." More explicitly, "Oracle does not plan to support the use of Ksplice technology with Red Hat Enterprise Linux." Existing legacy customers continue to be supported by Ksplice, but no new customers are being accepted for other platforms.

As of July 2015, Ksplice is available for free on Ubuntu Desktop. In January 2016, Ksplice was integrated into Oracle's Unbreakable Enterprise Kernel Release 4 for Oracle Linux 6 and 7, which is Oracle's redistribution of Red Hat Enterprise Linux.

As of March 2023, Ksplice is integrated into:

  • Oracle's Unbreakable Enterprise Kernel Releases 5, 6 and 7, distributed with Oracle Linux 7, Oracle Linux 8 and Oracle Linux 9
  • Red Hat Compatible Kernel releases distributed with Oracle Linux 7, Oracle Linux 8 and Oracle Linux 9

See also

References

  1. Arnold, Jeff (23 April 2008). "A system for rebootless kernel security updates". LKML (Mailing list). Archived from the original on 11 May 2012. Retrieved 27 July 2013.
  2. ^ "Ksplice Uptrack Subscription Agreement". ksplice.com. 28 September 2011. Retrieved 18 November 2014.
  3. ^ "ksplice 0.9.9.1 source code, README file". oss.oracle.com. 28 July 2011. Retrieved 31 December 2014. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License, version 2.
  4. "Ubuntu Manpage: ksplice-create – Create a set of kernel modules for a rebootless kernel". manpages.ubuntu.com. 2009. Retrieved 23 November 2014.
  5. "Ksplice Users Guide: Available Architectures" (PDF). docs.oracle.com. 2023. Retrieved 22 March 2023.
  6. "Free 30-day trial of Ksplice Zero-Downtime Updates for Red Hat Enterprise Linux Customers". Ksplice.
  7. ^ "Customer Letter Oracle and Ksplice". Oracle. 7 September 2010. Retrieved 22 July 2011.
  8. ^ "Oracle Ksplice Free Desktop Edition". Oracle Ksplice. Oracle. 16 July 2015. Retrieved 16 July 2015. Oracle Ksplice is offered for free on Fedora and Ubuntu Desktop Editions.
  9. ^ Jeff Arnold; M. Frans Kaashoek. "Ksplice: Automatic Rebootless Kernel Updates" (PDF). mit.edu. Retrieved 18 November 2014.
  10. "Nexcess Adopts Ksplice Uptrack "Rebootless" Technology". Web Hosting Blog. Nexcess. 30 November 2010. Retrieved 18 February 2011.
  11. "Performance record". Ksplice. Archived from the original on 16 April 2009. Retrieved 4 June 2009.
  12. Edge, Jake (10 June 2009). "Ksplice provides updates without reboots". LWN. Retrieved 21 July 2011.
  13. "Ksplice Uptrack". Ksplice. Retrieved 19 July 2009.
  14. "Pricing". Ksplice, Inc. Retrieved 13 March 2011.
  15. "Supported Kernels". Ksplice website. Oracle America. Retrieved 13 February 2012.
  16. Marius Nestor (9 January 2016). "Oracle Brings Real-Time Kernel Patching to Its Unbreakable Enterprise Kernel Release 4". softpedia.com. Retrieved 9 January 2016.

External links

Linux kernel
Organization
Kernel
Support
Technical
Debugging
Startup
ABIs
APIs
Kernel
System Call
Interface
In-kernel
Userspace
Daemons,
File systems
Wrapper
libraries
Components
Variants
Virtualization
Adoption
Range
of use
Adopters
Operating systems
General
Variants
Kernel
Architectures
Components
Process management
Concepts
Scheduling
algorithms
Memory management,
resource protection
Storage access,
file systems
Supporting concepts
Categories: