Server downtime is the scourge of all administrators, sometimes to the extent of bypassing necessary security upgrades, all in the name of keeping machines online. Thanks to an MIT graduate student, Jeffery Brian Arnold, keeping a machine online, and up to date with security patches, may be easier than ever.
Ksplice, as the project is called, is a small executable that allows an administrator the ability to patch security holes in the Linux kernel, without rebooting the system. According to the Ksplice website :
“Ksplice allows system administrators to apply security patches to the Linux kernel without having to reboot. Ksplice takes as input a source code change in unified diff format and the kernel source code to be patched, and it applies the patch to the corresponding running kernel. The running kernel does not need to have been prepared in advance in any way.”
Of course, Ksplice is not a perfect silver bullet, some patches cannot be applied using Ksplice. Specifically, any patch that require “semantic changes to data structures” cannot be applied to the running kernel. A semantic change is a change “that would require existing instances of kernel data structures to be transformed.”
But that doesn’t mean that Ksplice isn’t useful. Jeffery looked at 32 months of kernel security patches and found that 84% of them could be applied using Ksplice. That’s sure to increase the uptime.
I have to wonder, though, what is so important that you need that much uptime. Sure, it’s nice to have the system run all the time, but if you have something that is absolutely mission critical, that must run 24×7, regardless, won’t you have a backup or two? Besides which, you generally want to test patches before applying them to such sensitive systems.
There are, of course, other uses for this technology. As noted on the Ksplice website, you can also use Ksplice to “add debugging code to the kernel or to make any other code changes that do not modify data structure semantics.” Jeffery has posted a paper detailing how the technology works.
Pretty neat technology. I wonder if this will lead to zero downtime kernel updates direct from Linux vendors. As it is now, you’ll need to locate and manually apply kernel patches using this tool.