此内容没有您所选择的语言版本。
1.5.4. Applying the Changes
After downloading and installing security errata and updates, it is important to halt usage of the older software and begin using the new software. How this is done depends on the type of software that has been updated. The following list itemizes the general categories of software and provides instructions for using the updated versions after a package upgrade.
Note
In general, rebooting the system is the surest way to ensure that the latest version of a software package is used; however, this option is not always required, or available to the system administrator.
- Applications
- User-space applications are any programs that can be initiated by a system user. Typically, such applications are used only when a user, script, or automated task utility launches them and they do not persist for long periods of time.Once such a user-space application is updated, halt any instances of the application on the system and launch the program again to use the updated version.
- Kernel
- The kernel is the core software component for the Red Hat Enterprise Linux operating system. It manages access to memory, the processor, and peripherals as well as schedules all tasks.Because of its central role, the kernel cannot be restarted without also stopping the computer. Therefore, an updated version of the kernel cannot be used until the system is rebooted.
- Shared Libraries
- Shared libraries are units of code, such as
glibc, which are used by a number of applications and services. Applications utilizing a shared library typically load the shared code when the application is initialized, so any applications using the updated library must be halted and relaunched.To determine which running applications link against a particular library, use thelsofcommand:lsof<path>For example, to determine which running applications link against thelibwrap.solibrary, type:~]#
lsof /lib64/libwrap.so*COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 13600 root mem REG 253,0 43256 400501 /lib64/libwrap.so.0.7.6 sshd 13603 juan mem REG 253,0 43256 400501 /lib64/libwrap.so.0.7.6 gnome-set 14898 juan mem REG 253,0 43256 400501 /lib64/libwrap.so.0.7.6 metacity 14925 juan mem REG 253,0 43256 400501 /lib64/libwrap.so.0.7.6 [output truncated]This command returns a list of all the running programs which use TCP wrappers for host access control. Therefore, any program listed must be halted and relaunched if thetcp_wrapperspackage is updated. - SysV Services
- SysV services are persistent server programs launched during the boot process. Examples of SysV services include
sshd,vsftpd, andxinetd.Because these programs usually persist in memory as long as the machine is booted, each updated SysV service must be halted and relaunched after the package is upgraded. This can be done using the Services Configuration Tool or by logging into a root shell prompt and issuing the/sbin/servicecommand:/sbin/service<service-name>restartReplace <service-name> with the name of the service, such assshd. xinetdServices- Services controlled by the
xinetdsuper service only run when a there is an active connection. Examples of services controlled byxinetdinclude Telnet, IMAP, and POP3.Because new instances of these services are launched byxinetdeach time a new request is received, connections that occur after an upgrade are handled by the updated software. However, if there are active connections at the time thexinetdcontrolled service is upgraded, they are serviced by the older version of the software.To kill off older instances of a particularxinetdcontrolled service, upgrade the package for the service then halt all processes currently running. To determine if the process is running, use thepsorpgrepcommand and then use thekillorkillallcommand to halt current instances of the service.For example, if security errataimappackages are released, upgrade the packages, then type the following command as root into a shell prompt:~]#
pgrep -l imap1439 imapd 1788 imapd 1793 imapdThis command returns all active IMAP sessions. Individual sessions can then be terminated by issuing the following command as root:kill<PID>If this fails to terminate the session, use the following command instead:kill-9<PID>In the previous examples, replace <PID> with the process identification number (found in the second column of thepgrep -lcommand) for an IMAP session.To kill all active IMAP sessions, issue the following command:~]#
killall imapd
