Last night a fix for a vulnerability in lab-feed was installed on the server — the service that serves the shop's news feed. The package went from 1.0-1 to 1.1-1, and the service is running. Check that the old program is gone from the server.
sudo lsof +L1 looks for files that processes hold open although they are no longer in their directories.
Check the updated service
See which version of lab-feed is installed, then which deleted files processes are holding.
First, predict
The package is upgraded to 1.1-1. What will sudo lsof +L1 find?
Now start the exercise, run the command and compare your prediction with the output.
The lab-feed 1.1-1 package is installed, but lsof +L1 showed the httpd program file marked (deleted) with 0 in NLINK. What do you know for sure from this?
-
dpkg-query printed
1.1-1: the package is installed, and the program file is in its directory —ls -l /usr/lib/lab-feed/httpd. -
The directory holds a different file under the same name:
ls -li /usr/lib/lab-feed/httpdshows an inode number different from the NODE column of lsof. -
The service is running:
systemctl status lab-feedshowsactive (running). A file a process holds stays on the disk while the process lives.
The httpd process runs the old program file, while the directory holds a new one under the same name.