Linux Labs

Server security / Stage 2 of 10

The update is in, the vulnerability is still alive

Not running Starting usually ~20 s
Leave the lesson

Step 7 of 7 · summary · 2 min

Summary

  • A package upgrade changes the files in the directories, while a process started earlier works with the old ones: (deleted) in /proc/<PID>/exe and maps, 0 in NLINK from sudo lsof +L1.
  • Only a new process loads the new file — systemctl restart; the check is a new Main PID and exe without (deleted).
  • A library is held by every process that uses it: sudo needrestart -b names their services. A new kernel starts working only after a reboot.
  • needrestart does not check data files opened at start — sudo lsof +L1 finds them.
  • At the start of the lesson lab-feed ran the old program: the 1.1-1 package replaced the file in the directory, and the process started before the upgrade held the deleted one.
Ubuntu 24.04
Loading…