13

I want to update glibc according to RedHat: https://rhn.redhat.com/errata/RHSA-2015-0090.html

Is it required restart a server after the glibc upgrade?

23

A restart is not technically required, because only programs which use glibc need to be restarted, and the kernel does not use glibc.

That being said, restarting everything that uses glibc is sufficiently broad that you might as well just reboot.

For example, /sbin/init uses glibc. However restarting it is trivial (run init u as root).

| improve this answer | |
  • 3
    OTOH I seriously doubt that init is vulnerable due to the CVE :) – Erbureth says Reinstate Monica Jan 28 '15 at 14:57
  • 11
    @Erbureth, I agree, but I think "I think this program is vulnerable, I think that program is not" is "a strange game. The only winning move is not to play." – gowenfawr Jan 28 '15 at 16:06
  • sysvinit is safe (no DNS calls, and often but not always statically linked too). systemd appears to have a resolver all of its own. In my experience replacing libraries used by long-running processes can cause instabilities. Reboot, and be happy. – mr.spuratic Jan 28 '15 at 17:20
  • 2
    sysvinit can be restarted. Issue the command init u and it will exec /sbin/init. – Joshua Jan 29 '15 at 0:03
9

If you are happy with manually restarting individual services that are using the vulnerable library, you can run this command and restart the listed processes:

# lsof | awk '/libc-/ {print $1}' | sort -u

You will probably find it will be easier to restart the machine entirely.

| improve this answer | |
  • 9
    lsof | awk '/DEL.*libc/{print $1}' | sort -u to match only on those that link to the now deleted (after the update) libc. – sch Jan 28 '15 at 15:38
  • 2
    Did anyone actually check the output of lsof | grep libc? It matches a ton of libraries including libcurl, libcups, libcairo etc. Grepping for libc- seems to produce the correct results. – Deinumite Jan 28 '15 at 16:28
  • That's a pretty roundabout and inaccurate method. How do I detect running processes using a library package? Anyway, for glibc, the answer is pretty much every process. What would be useful would be to know which processes are left over with the old copy, and this command won't tell you. – Gilles 'SO- stop being evil' Jan 29 '15 at 21:56
7

Yes, so the processes that depend on the old version of glibc start again with the new version of the library. Statically linked programs also need to be recompiled for this reason.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.