kGraft，suse中的实时内核修补

Question

有人能在SLES 11或12中使用Kgraft进行实时修补吗？有什么要遵循的程序吗？如何在移植修复之后验证内核漏洞修复？

Answer 1

Live修补只在SLE12+上可用，作为SLE12扩展出售，因此您需要有效的密钥并注册此键才能获得Live修补程序。

SUSE在现场修补购买页面上提供60天的试用

活修补程序由kgr工具控制：

# kgr 
Error: no command provided

Usage: /usr/bin/kgr [-h][-v] COMMAND
Query and manipulate kGraft patching status.

Commands:
    status:    display the overall status of kGraft patching
    patches:   display the list of loaded patches
    blocking:  list processes that are preventing kGraft patching
           from finishing
    poke:      move forward with the kGraft patching by sending
           STOP and CONT signal to the pending processes

Options:
    -h     print this help
    -v     more detailed output

Report bugs at https://bugzilla.suse.com/.

以及应用补丁的验证：

 # kgr -v patches
 kgraft_patch_2_2_1
     active: 1
     RPM: kgraft-patch-3_12_62-60_64_8-default-2-2.1.x86_64
     CVE: CVE-2016-8666 CVE-2016-6480
     bug fixes and enhancements: (none)

为了自己验证修复错误，如果存在，您可以尝试bug复制器。(不推荐使用这种方法，SUSE的QA-维护在向it客户发布之前非常广泛地测试此修补程序)