13

I want to update glibc according to RedHat: https://rhn.redhat.com/errata/RHSA-2015-0090.html

Is it required restart a server after the glibc upgrade?

Improve this question

3 Answers 3

Reset to default
23

A restart is not technically required, because only programs which use glibc need to be restarted, and the kernel does not use glibc.

That being said, restarting everything that uses glibc is sufficiently broad that you might as well just reboot.

For example, /sbin/init uses glibc. However restarting it is trivial (run init u as root).

Improve this answer
7
  • 3
    OTOH I seriously doubt that init is vulnerable due to the CVE :)
    – Erbureth
    Jan 28, 2015 at 14:57
  • 11
    @Erbureth, I agree, but I think "I think this program is vulnerable, I think that program is not" is "a strange game. The only winning move is not to play."
    – gowenfawr
    Jan 28, 2015 at 16:06
  • sysvinit is safe (no DNS calls, and often but not always statically linked too). systemd appears to have a resolver all of its own. In my experience replacing libraries used by long-running processes can cause instabilities. Reboot, and be happy.
    – mr.spuratic
    Jan 28, 2015 at 17:20
  • 2
    sysvinit can be restarted. Issue the command init u and it will exec /sbin/init.
    – Joshua
    Jan 29, 2015 at 0:03
  • FYI: Restarting init without restarting the system
    – Gilles 'SO- stop being evil'
    Jan 29, 2015 at 21:55
9

If you are happy with manually restarting individual services that are using the vulnerable library, you can run this command and restart the listed processes:

# lsof | awk '/libc-/ {print $1}' | sort -u

You will probably find it will be easier to restart the machine entirely.

Improve this answer
3
  • 9
    lsof | awk '/DEL.*libc/{print $1}' | sort -u to match only on those that link to the now deleted (after the update) libc.
    – sch
    Jan 28, 2015 at 15:38
  • 2
    Did anyone actually check the output of lsof | grep libc? It matches a ton of libraries including libcurl, libcups, libcairo etc. Grepping for libc- seems to produce the correct results.
    – Deinumite
    Jan 28, 2015 at 16:28
  • That's a pretty roundabout and inaccurate method. How do I detect running processes using a library package? Anyway, for glibc, the answer is pretty much every process. What would be useful would be to know which processes are left over with the old copy, and this command won't tell you.
    – Gilles 'SO- stop being evil'
    Jan 29, 2015 at 21:56
7

Yes, so the processes that depend on the old version of glibc start again with the new version of the library. Statically linked programs also need to be recompiled for this reason.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .