ksplice

File:Ksplice.svg

Ksplice takes as input a unified diff and the original kernel source code, and it updates the running kernel in memory. Using Ksplice does not require any preparation before the system is originally booted, (the running kernel needs no special prior compiling, for example). In order to generate an update, Ksplice must determine what code within the kernel has been changed by the source code patch. Ksplice performs this analysis at the Executable and Linkable Format (ELF) object code layer, rather than at the C source code layer.{{cite web

| url = http://pdos.csail.mit.edu/papers/ksplice:eurosys.pdf

| title = Ksplice: Automatic Rebootless Kernel Updates

| access-date = 18 November 2014

| author1 = Jeff Arnold | author2 = M. Frans Kaashoek

| website = mit.edu

}}

To apply a patch, Ksplice first freezes execution of a computer so it is the only program running. The system verifies that no processors were in the middle of executing functions that will be modified by the patch. Ksplice modifies the beginning of changed functions so that they instead point to new, updated versions of those functions, and modifies data and structures in memory that need to be changed. Finally, Ksplice resumes each processor running where it left off.

To be fully automatic, Ksplice's design was originally limited to patches that did not introduce semantic changes to data structures, since most Linux kernel security patches do not make these kinds of changes. An evaluation against Linux kernel security patches from May 2005 to May 2008 found that Ksplice was able to apply fixes for all the 64 significant kernel vulnerabilities discovered in that interval. In 2009, major Linux vendors asked their customers to install a kernel update more than once per month.{{cite news|url=http://blog.nexcess.net/2010/11/30/nexcess-adopts-ksplice-uptrack-rebootless-technology/|title=Nexcess Adopts Ksplice Uptrack "Rebootless" Technology|newspaper=Web Hosting Blog |publisher=Nexcess |date=30 November 2010 |access-date=18 February 2011}} For patches that do introduce semantic changes to data structures, Ksplice requires a programmer to write a short amount of additional code to help apply the patch. This was necessary for about 12% of the updates in that time period.{{cite web |url=http://www.ksplice.com/cve-evaluation |title=Performance record |publisher=Ksplice |access-date=4 June 2009 |archive-url=https://web.archive.org/web/20090416194641/http://ksplice.com/cve-evaluation |archive-date=16 April 2009 |url-status=dead }}

{{See also|Linux kernel#Live patching}}

The Ksplice software was created by four MIT students based on Jeff Arnold's master's thesis,{{cite web|first=Jake|last=Edge|url=https://lwn.net/Articles/340477/|title=Ksplice provides updates without reboots|publisher=LWN|date=10 June 2009|access-date=21 July 2011}} and they later created Ksplice, Inc. Around May 2009, the company won the MIT $100K Entrepreneurship Competition and the Cyber Security Challenge of Global Security Challenge.

Whereas the Ksplice software was provided under an open source license, Ksplice, Inc. provided a service to make it easier to use the software. Ksplice, Inc. provided prebuilt and tested updates for the Red Hat, CentOS, Debian, Ubuntu and Fedora Linux distributions.{{cite web|url=http://www.ksplice.com/uptrack/ |title=Ksplice Uptrack |publisher=Ksplice |access-date=19 July 2009}} The virtualization technologies OpenVZ and Virtuozzo were also supported. Updates for Ubuntu Desktop and Fedora systems were provided free of charge, whereas other platforms were offered on a subscription basis.{{cite web|url=http://www.ksplice.com/pricing|title=Pricing|publisher=Ksplice, Inc.|access-date=13 March 2011}}

On 21 July 2011, Oracle Corporation announced that they acquired Ksplice, Inc. At the time the company was acquired, Ksplice, Inc. claimed to have over 700 companies using the service to protect over 100,000 servers. While the service had been available for multiple Linux distributions, it was stated at the time of acquisition that "Oracle believes it will be the only enterprise Linux provider that can offer zero downtime updates." More explicitly, "Oracle does not plan to support the use of Ksplice technology with Red Hat Enterprise Linux." Existing legacy customers continue to be supported by Ksplice, but no new customers are being accepted for other platforms.{{cite web|title=Supported Kernels|url=http://www.ksplice.com/uptrack/supported-kernels|work=Ksplice website|publisher=Oracle America|access-date=13 February 2012}}

{{As of|2015|7}}, Ksplice is available for free on Ubuntu Desktop. In January 2016, Ksplice was integrated into Oracle's Unbreakable Enterprise Kernel Release 4 for Oracle Linux 6 and 7, which is Oracle's redistribution of Red Hat Enterprise Linux.{{cite web |title=Oracle Brings Real-Time Kernel Patching to Its Unbreakable Enterprise Kernel Release 4 |url=http://news.softpedia.com/news/oracle-brings-real-time-kernel-patching-to-its-unbreakable-enterprise-kernel-498656.shtml |author=Marius Nestor |website=softpedia.com |date=9 January 2016 |access-date=9 January 2016}}

As of March 2023, Ksplice is integrated into:

• Oracle's Unbreakable Enterprise Kernel Releases 5, 6 and 7, distributed with Oracle Linux 7, Oracle Linux 8 and Oracle Linux 9
• Red Hat Compatible Kernel releases distributed with Oracle Linux 7, Oracle Linux 8 and Oracle Linux 9

{{Portal|Linux}}

• kexec, a method for loading a whole new kernel from a running system
• kGraft, kpatch and KernelCare, other Linux kernel live patching technologies developed by SUSE, Red Hat and CloudLinux, respectively
• Loadable kernel module

{{Reflist|30em}}

{{Commons category multi|Ksplice|Linux kernel live patching}}

• {{Official website|ksplice.com}}

{{Linux kernel}}

{{Operating system}}

Category:Free security software programmed in C

Category:Linux kernel live patching

Category:Linux-only free software

Category:Oracle software