I manage some EC2 instances running Amazon Linux (not sure what version), which need security patches.

A lot of software was patched well, but we have stuck on the kernel upgrade. We are unable to use the latest kernel version as we preferred. What have we done?

  1. Get the latest kernel version from the Amazon repository by executing yum update. The system reports that we have got the newest kernel version as we expected and nothing's to be updated anymore.
  2. After we got the latest kernel version, we restarted EC2 by clicking reboot on the EC2 console. After EC2s was restarted, we have checked the EC2's kernel version with the command uname -r. It reports that we still use the same kernel version, not the latest kernel version as we expect.

What is the point that we have missed? Please help.

  • For clarity, which version do have? – Håkan Lindqvist Jan 5 at 0:48
  • 1
    @HåkanLindqvist We expect to use kernel version "4.14.203-116.332.amzn1.x86_64". Right now, It was ran on "4.14.186-110.268.amzn1.x86_64". – WICHPONG KAO-IAN Jan 5 at 4:18

Kernel live patches are available for Amazon Linux 2 with kernel version 4.14.165-131.185 or later. To check your kernel version, run the following command.

[root@actsupport ~]# yum list kernel If you already have a supported kernel version, skip this step. If you do not have a supported kernel version, run the following commands to update the kernel to the latest version and to reboot the instance.

sudo yum install -y kernel
[root@actsupport ~]#

reboot Install the yum plugin for Kernel Live Patching.

[root@actsupport ~]#    yum install -y yum-plugin-kernel-livepatch

Enable the yum plugin for Kernel Live Patching.

[root@actsupport ~]#    yum kernel-livepatch enable -y

This command also installs the latest version of the kernel live patch RPM from the configured repositories.

To confirm that the yum plugin for kernel live patching has installed successfully, run the following command.

[root@actsupport ~]# rpm -qa | grep kernel-livepatch

When you enable Kernel Live Patching, an empty kernel live patch RPM is automatically applied. If Kernel Live Patching was successfully enabled, this command returns a list that includes the initial empty kernel live patch RPM.

Update and start the kpatch service. This service loads all of the kernel live patches upon initialization or at boot.

[root@actsupport ~]#   yum update kpatch-runtime
[root@actsupport ~]#   systemctl enable kpatch.service

Configure the Amazon Linux 2 Kernel Live Patching repository, which contains the kernel live patches.

[root@actsupport ~]#    amazon-linux-extras enable livepatch
  • Thank you for your suggestion. Is it applicable with Amazon linux "1" ? – WICHPONG KAO-IAN Jan 8 at 6:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.