Updates, Kernels and Livepatch

Unpatched servers are how most breaches start. A good routine applies security updates quickly, restarts what needs restarting, handles kernel updates predictably and always has a way back. This post sets that up for Ubuntu 18.04.

Versions in use on this date. Ubuntu 18.04.4 LTS was released on 6 February 2020. It uses the 4.15 kernel by default; the Hardware Enablement (HWE) stack follows newer kernels (5.3 in 18.04.4) for new hardware. Standard security support for 18.04 runs until April 2023.

Patch flow

flowchart TB
  A[Security advisory or monthly cycle] --> ST[Apply to staging first]
  ST --> T[Smoke tests]
  T --> P[Apply to production in batches]
  P --> K{Kernel or libc updated?}
  K -->|yes| LP[Livepatch covers critical kernel CVEs<br/>until scheduled reboot]
  K -->|yes| RB[Rolling reboot in maintenance window]
  K -->|no| NR[needrestart restarts affected services]
  RB --> V[Verify services and monitoring]
  NR --> V
  V --> RL[Rollback - previous kernel in GRUB or snapshot]

Routine commands

sudo apt update
apt list --upgradable
sudo apt upgrade                     # normal updates, never removes packages
sudo apt full-upgrade                # may add or remove packages (kernel metapackages)
cat /var/run/reboot-required /var/run/reboot-required.pkgs 2>/dev/null
uname -r; dpkg -l 'linux-image-*' | grep ^ii

Test updates on a staging copy first. Take a snapshot of the VM or of the root volume before large changes.

Automatic security updates

sudo apt install unattended-upgrades needrestart
sudo dpkg-reconfigure -plow unattended-upgrades
sudo tee /etc/apt/apt.conf.d/52local <<'EOT'
Unattended-Upgrade::Automatic-Reboot "false";
Unattended-Upgrade::Mail "ops@example.com";
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
EOT
sudo unattended-upgrade --dry-run --debug | tail
grep -E 'Packages that will be upgraded|Allowed origins' /var/log/unattended-upgrades/unattended-upgrades.log | tail

By default only the -security pocket is applied. Keep automatic reboots off for production unless you have redundancy; schedule them instead (Automatic-Reboot-Time "03:30" if a single reboot at night is acceptable).

needrestart lists services still using old libraries after an upgrade (such as OpenSSL), so you restart them without rebooting the machine.

Kernel updates

Installing a new kernel does not change the running one until reboot. Multiple kernels are kept so you can fall back:

uname -r                                  # running now
ls /boot/vmlinuz-*
sudo apt autoremove --purge               # removes old kernels, keeps current and previous

If a new kernel fails to boot, choose Advanced options for Ubuntu in the GRUB menu (hold Shift or Esc at boot; on cloud VMs use the serial console) and select the earlier kernel. To make that the default temporarily, use sudo grub-reboot "Advanced options for Ubuntu>Ubuntu, with Linux 4.15.0-xx-generic" and reboot.

HWE

For new installs on newer hardware use sudo apt install linux-generic-hwe-18.04. Servers on virtual machines normally stay on the default 4.15 kernel for stability unless a feature requires the newer one.

Livepatch

Canonical Livepatch applies critical and high kernel security fixes to the running kernel without a reboot. It is free for personal use on up to three machines and part of Ubuntu Advantage for commercial support.

sudo snap install canonical-livepatch
sudo canonical-livepatch enable <your-token>
canonical-livepatch status --verbose

It buys time, not immunity: it covers selected vulnerabilities, so plan regular reboots anyway (monthly is common). It does not apply to containers’ userspace libraries or to non-kernel packages.

Hold and pin when needed

sudo apt-mark hold linux-image-generic mysql-server     # block upgrades temporarily
sudo apt-mark showhold
sudo apt-mark unhold mysql-server

Holds are for short, documented exceptions, such as waiting for a vendor to certify an application on a new database version. Record who placed the hold and why.

Rollback options

1. Reinstall the previous package version: apt-cache policy pkg, then sudo apt install pkg=<version>.
2. Boot the previous kernel from GRUB.
3. Restore the VM snapshot or backup taken before the change.
4. Re-run configuration management to restore config files that a package replaced (look for .dpkg-new and .dpkg-old files).

Cadence

Security updates: within days (critical: within 24 hours). Full patch cycle: monthly. Review ubuntu-security-announce and your own inventory, and keep an up-to-date list of what runs where, so you know who is affected when a new CVE is published.