|
KernelCare is a live kernel patching service that provides security patches and bugfixes for a range of popular Linux kernels〔(【引用サイトリンク】url=http://thevarguy.com/open-source-application-software-companies/050614/embargo-may-6-1201-am-est-kernelcare-promises-linux-secur )〕 that can be installed without rebooting the server〔(【引用サイトリンク】url=http://www.zdnet.com/article/kernelcare-new-no-reboot-linux-patching-system/ )〕 KernelCare software is released under GPL2. The first beta was introduced in March 2014 and it was commercially launched in May 2014. KernelCare Supports CentOS/RHEL 5.x, 6.x, and 7.x; CloudLinux 5.x and 6.x; Parallels Cloud Server; Virtuozzo; OpenVZ; Debian 6.x and 7.x; and Ubuntu 14.04 LTS〔(【引用サイトリンク】url=http://www.hostingjournalist.com/iaas-hosting/cloudlinux-unveils-kernelcare-for-automatic-updates-of-parallels-virtuozzo-containers-kernel/ )〕 ==How it works== KernelCare agent resides on user’s server. It periodically checks in with KernelCare distribution servers. If there are new patches available for the currently running kernel, KernelCare agent downloads and applies those patches to the running kernel. A KernelCare patch is a piece of code used to substitute vulnerable or buggy code in a kernel. It can be an arbitrary code line modification, or it can be a missing security check, a set of functions, or even modified data structures.〔(【引用サイトリンク】url=http://fullcirclemagazine.org/2014/05/07/kernelcare-new-no-reboot-linux-patching-system/ )〕 The patch is compiled as usual, but the generated code has additional information about all changed code pieces caused by original source code modification and information on to how to apply these code pieces. The resulting code modifications are safely applied to the running kernel. A special KernelCare kernel module applies the patches. It loads the patches into the kernel address space, sets up the relocations (i.e., fixes the references to the original kernel code and data), and safely switches the execution path from the original code to updated code blocks. The code ensures the patch is applied safely so the CPU doesn't execute the original code blocks at the same moment when switch to a new version.〔(【引用サイトリンク】url=http://www.thehostingnews.com/cloudlinux-launches-kuberdock-public-beta.html )〕〔(【引用サイトリンク】url=http://www.pro-linux.de/news/1/21062/kernelcare-verspricht-patches-ohne-neustart.html )〕 抄文引用元・出典: フリー百科事典『 ウィキペディア（Wikipedia）』 ■ウィキペディアで「KernelCare」の詳細全文を読む スポンサード リンク
|