Chapter 22. Applying patches with kernel live patching You can use the Red Hat Enterprise Linux kernel live patching solution to patch a running kernel without rebooting or restarting any processes. With this solution, system administrators: Can immediately apply critical security patches to the kernel. Do not have to wait for long-running tasks to complete, for users to log off, or for scheduled downtime. Control the system's uptime more and do not sacrifice security or stability. By using the kernel live patching, you can reduce the number of reboots required for security patches. However, note that you cannot address all critical or important CVEs. For more details about the scope of live patching, see the Red Hat Knowledgebase solution Is live kernel patch (kpatch) supported in Red Hat Enterprise Linux? . Warning Some incompatibilities exist between kernel live patching and other kernel subcomponents. Read the Limitations of kpatch carefully before using kernel live patching. Note For details about the support cadence of kernel live patching updates, see: Kernel Live Patch Support Cadence Update Kernel Live Patch life cycles 22.1. Limitations of kpatch By using the kpatch feature, you can apply simple security and bug fix updates that do not require an immediate system reboot. You must not use the SystemTap or kprobe tool during or after loading a patch. The patch might not take effect until the probes are removed. 22.2. Support for third-party live patching The kpatch utility is the only kernel live patching utility supported by Red Hat with the RPM modules provided by Red Hat repositories. Red Hat does not support live patches provided by a third party. For more information about third-party software support policies, see As a customer how does Red Hat support me when I use third party components? 22.3. Access to kernel live patches A kernel module ( kmod ) implements kernel live patching capability and is provided as an RPM package. All customers have access to kernel live patches, which are delivered through the usual channels. However, customers who do not subscribe to an extended support offering will lose access to new patches for the current minor release once the minor release becomes available. For example, customers with standard subscriptions will only be able to live patch RHEL 8.2 kernel until the RHEL 8.3 kernel is released. The components of kernel live patching are as follows: Kernel patch module The delivery mechanism for kernel live patches. A kernel module built specifically for the kernel being patched. The patch module contains the code of the required fixes for the kernel. Patch modules register with the livepatch kernel subsystem and specify the original functions to replace, along with pointers to the replacement functions. Kernel patch modules are delivered as RPMs. The naming convention is kpatch_<kernel version>_<kpatch version>_<kpatch release> . The "kernel version" part of the name has dots replaced with underscores . The kpatch utility A command-line utility for managing patch modules. The kpatch service A systemd service required by multiuser.target . This target loads the kernel patch module at boot time. The kpatch-dnf package A DNF plugin delivered in the form of an RPM package. This plugin manages automatic subscription to kernel live patches. 22.4. The process of live patching kernels The kpatch kernel patching solution uses the livepatch kernel subsystem to redirect outdated functions to updated ones. Applying a live kernel patch to a system triggers the following processes: The kernel patch module is copied to the /var/lib/kpatch/ directory and registered for re-application to the kernel by systemd on boot. The kpatch module loads into the running kernel and the new functions are registered to the ftrace mechanism with a pointer to the location in memory of the new code. When the kernel accesses the patched function, the ftrace mechanism redirects it, bypassing the original functions and leading the kernel to the patched version of the function. Figure 22.1. How kernel live patching works 22.5. Subscribing the currently installed kernels to the live patching stream A kernel patch module is delivered in an RPM package, specific to the version of the kernel being patched. Each RPM package will be cumulatively updated over time. The following procedure explains how to subscribe to all future cumulative live patching updates for a given kernel. Because live patches are cumulative, you cannot select which individual patches are deployed for a given kernel. Warning Red Hat does not support any third party live patches applied to a Red Hat supported system. Prerequisites You have root permissions. Procedure Optional: Check your kernel version: Search for a live patching package that corresponds to the version of your kernel: Install the live patching package: The command above installs and applies the latest cumulative live patches for that specific kernel only. If the version of a live patching package is 1-1 or higher, the package will contain a patch module. In that case the kernel will be automatically patched during the installation of the live patching package. The kernel patch module is also installed into the /var/lib/kpatch/ directory to be loaded by the systemd system and service manager during the future reboots. Note An empty live patching package will be installed when there are no live patches available for a given kernel. An empty live patching package will have a kpatch_version-kpatch_release of 0-0, for example kpatch-patch-4_18_0-94-0-0.el8.x86_64.rpm . The installation of the empty RPM subscribes the system to all future live patches for the given kernel. Verification Verify that all installed kernels have been patched: The output shows that the kernel patch module has been loaded into the kernel that is now patched with the latest fixes from the kpatch-patch-4_18_0-94-1-1.el8.x86_64.rpm package. Note Entering the kpatch list command does not return an empty live patching package. Use the rpm -qa | grep kpatch command instead. Additional resources kpatch(1) manual page 22.6. Automatically subscribing any future kernel to the live patching stream You can use the kpatch-dnf YUM plugin to subscribe your system to fixes delivered by the kernel patch module, also known as kernel live patches. The plugin enables automatic subscription for any kernel the system currently uses, and also for kernels to-be-installed in the future . Prerequisites You have root permissions. Procedure Optional: Check all installed kernels and the kernel you are currently running: Install the kpatch-dnf plugin: Enable automatic subscription to kernel live patches: This command subscribes all currently installed kernels to receiving kernel live patches. The command also installs and applies the latest cumulative live patches, if any, for all installed kernels. When you update the kernel, live patches are installed automatically during the new kernel installation process. The kernel patch module is also installed into the /var/lib/kpatch/ directory to be loaded by the systemd system and service manager during future reboots. Note An empty live patching package will be installed when there are no live patches available for a given kernel. An empty live patching package will have a kpatch_version-kpatch_release of 0-0, for example kpatch-patch-4_18_0-240-0-0.el8.x86_64.rpm . The installation of the empty RPM subscribes the system to all future live patches for the given kernel. Verification Verify that all installed kernels are patched: The output shows that both the kernel you are running, and the other installed kernel have been patched with fixes from kpatch-patch-4_18_0-240_10_1-0-1.rpm and kpatch-patch-4_18_0-240_15_1-0-1.rpm packages respectively. Note Entering the kpatch list command does not return an empty live patching package. Use the rpm -qa | grep kpatch command instead. Additional resources kpatch(1) and dnf-kpatch(8) manual pages 22.7. Disabling automatic subscription to the live patching stream When you subscribe your system to fixes delivered by the kernel patch module, your subscription is automatic . You can disable this feature, to disable automatic installation of kpatch-patch packages. Prerequisites You have root permissions. Procedure Optional: Check all installed kernels and the kernel you are currently running: Disable automatic subscription to kernel live patches: Verification You can check for the successful outcome: Additional resources kpatch(1) and dnf-kpatch(8) manual pages 22.8. Updating kernel patch modules The kernel patch modules are delivered and applied through RPM packages. The process of updating a cumulative kernel patch module is similar to updating any other RPM package. Prerequisites The system is subscribed to the live patching stream, as described in Subscribing the currently installed kernels to the live patching stream . Procedure Update to a new cumulative version for the current kernel: The command above automatically installs and applies any updates that are available for the currently running kernel. Including any future released cumulative live patches. Alternatively, update all installed kernel patch modules: Note When the system reboots into the same kernel, the kernel is automatically live patched again by the kpatch.service systemd service. Additional resources Configuring basic system settings in RHEL 22.9. Removing the live patching package Disable the Red Hat Enterprise Linux kernel live patching solution by removing the live patching package. Prerequisites Root permissions The live patching package is installed. Procedure Select the live patching package. The example output lists live patching packages that you installed. Remove the live patching package. When a live patching package is removed, the kernel remains patched until the reboot, but the kernel patch module is removed from disk. On future reboot, the corresponding kernel will no longer be patched. Reboot your system. Verify the live patching package is removed: The command displays no output if the package has been successfully removed. Verification Verify the kernel live patching solution is disabled: The example output shows that the kernel is not patched and the live patching solution is not active because there are no patch modules that are currently loaded. Important Currently, Red Hat does not support reverting live patches without rebooting your system. In case of any issues, contact our support team. Additional resources The kpatch(1) manual page Uninstalling software packages in RHEL 22.10. Uninstalling the kernel patch module Prevent the Red Hat Enterprise Linux kernel live patching solution from applying a kernel patch module on subsequent boots. Prerequisites Root permissions A live patching package is installed. A kernel patch module is installed and loaded. Procedure Select a kernel patch module: Uninstall the selected kernel patch module. Note that the uninstalled kernel patch module is still loaded: When the selected module is uninstalled, the kernel remains patched until the reboot, but the kernel patch module is removed from disk. Reboot your system. Verification Verify that the kernel patch module is uninstalled: This example output shows no loaded or installed kernel patch modules, therefore the kernel is not patched and the kernel live patching solution is not active. Additional resources The kpatch(1) manual page 22.11. Disabling kpatch.service Prevent the Red Hat Enterprise Linux kernel live patching solution from applying all kernel patch modules globally on subsequent boots. Prerequisites Root permissions A live patching package is installed. A kernel patch module is installed and loaded. Procedure Verify kpatch.service is enabled. Disable kpatch.service . Note that the applied kernel patch module is still loaded: Reboot your system. Optional: Verify the status of kpatch.service . The example output testifies that kpatch.service is disabled. Thereby, the kernel live patching solution is not active. Verify that the kernel patch module has been unloaded. The example output above shows that a kernel patch module is still installed but the kernel is not patched. Important Currently, Red Hat does not support reverting live patches without rebooting your system. In case of any issues, contact our support team. Additional resources The kpatch(1) manual page. Managing systemd

Commands:
uname -r 4.18.0-94.el8.x86_64
yum search USD(uname -r)
yum install "kpatch-patch = USD(uname -r)"
kpatch list Loaded patch modules: kpatch_4_18_0_94_1_1 [enabled] Installed patch modules: kpatch_4_18_0_94_1_1 (4.18.0-94.el8.x86_64) ...
rpm -qa | grep kpatch kpatch-patch-4_18_0-477_21_1-0-0.el8_8.x86_64 kpatch-dnf-0.9.7_0.4-2.el8.noarch kpatch-0.9.7-2.el8.noarch
yum list installed | grep kernel Updating Subscription Management repositories. Installed Packages kernel-core.x86_64 4.18.0-240.10.1.el8_3 @rhel-8-for-x86_64-baseos-rpms kernel-core.x86_64 4.18.0-240.15.1.el8_3 @rhel-8-for-x86_64-baseos-rpms uname -r 4.18.0-240.10.1.el8_3.x86_64
yum install kpatch-dnf
yum kpatch auto Updating Subscription Management repositories. Last metadata expiration check: 19:10:26 ago on Wed 10 Mar 2021 04:08:06 PM CET. Dependencies resolved. ================================================== Package Architecture ================================================== Installing: kpatch-patch-4_18_0-240_10_1 x86_64 kpatch-patch-4_18_0-240_15_1 x86_64 Transaction Summary =================================================== Install 2 Packages ...
kpatch list Loaded patch modules: kpatch_4_18_0_240_10_1_0_1 [enabled] Installed patch modules: kpatch_4_18_0_240_10_1_0_1 (4.18.0-240.10.1.el8_3.x86_64) kpatch_4_18_0_240_15_1_0_2 (4.18.0-240.15.1.el8_3.x86_64)
rpm -qa | grep kpatch kpatch-patch-4_18_0-477_21_1-0-0.el8_8.x86_64 kpatch-dnf-0.9.7_0.4-2.el8.noarch kpatch-0.9.7-2.el8.noarch
yum list installed | grep kernel Updating Subscription Management repositories. Installed Packages kernel-core.x86_64 4.18.0-240.10.1.el8_3 @rhel-8-for-x86_64-baseos-rpms kernel-core.x86_64 4.18.0-240.15.1.el8_3 @rhel-8-for-x86_64-baseos-rpms uname -r 4.18.0-240.10.1.el8_3.x86_64
yum kpatch manual Updating Subscription Management repositories.
yum kpatch status Updating Subscription Management repositories. Last metadata expiration check: 0:30:41 ago on Tue Jun 14 15:59:26 2022. Kpatch update setting: manual
yum update "kpatch-patch = USD(uname -r)"
yum update "kpatch-patch "
yum list installed | grep kpatch-patch kpatch-patch-4_18_0-94.x86_64 1-1.el8 @@commandline ...
yum remove kpatch-patch-4_18_0-94.x86_64
yum list installed | grep kpatch-patch
kpatch list Loaded patch modules:
kpatch list Loaded patch modules: kpatch_4_18_0_94_1_1 [enabled] Installed patch modules: kpatch_4_18_0_94_1_1 (4.18.0-94.el8.x86_64) ...
kpatch uninstall kpatch_4_18_0_94_1_1 uninstalling kpatch_4_18_0_94_1_1 (4.18.0-94.el8.x86_64)
kpatch list Loaded patch modules: kpatch_4_18_0_94_1_1 [enabled] Installed patch modules: < NO_RESULT >
kpatch list Loaded patch modules: ...
systemctl is-enabled kpatch.service enabled
systemctl disable kpatch.service Removed /etc/systemd/system/multi-user.target.wants/kpatch.service.
kpatch list Loaded patch modules: kpatch_4_18_0_94_1_1 [enabled] Installed patch modules: kpatch_4_18_0_94_1_1 (4.18.0-94.el8.x86_64)
systemctl status kpatch.service ● kpatch.service - "Apply kpatch kernel patches" Loaded: loaded (/usr/lib/systemd/system/kpatch.service; disabled; vendor preset: disabled) Active: inactive (dead)
kpatch list Loaded patch modules: < NO_RESULT > Installed patch modules: kpatch_4_18_0_94_1_1 (4.18.0-94.el8.x86_64)