Atualização manual do kernel: o sistema não inicializa o novo kernel

Question

Em resposta ao Dirty COW, eu instalei o kernel 4.4.0-45 como descrito na resposta a esta questão.

Saída de dpkg -l | grep '4\.4\.0-45'

ii  linux-headers-4.4.0-45                                      4.4.0-45.66                                          all          Header files related to Linux kernel version 4.4.0
ii  linux-headers-4.4.0-45-generic                              4.4.0-45.66                                          amd64        Linux kernel headers for version 4.4.0 on 64 bit x86 SMP
ii  linux-image-4.4.0-45-generic                                4.4.0-45.66                                          amd64        Linux kernel image for version 4.4.0 on 64 bit x86 SMP
ii  linux-image-extra-4.4.0-45-generic                          4.4.0-45.66                                          amd64        Linux kernel extra modules for version 4.4.0 on 64 bit x86 SMP
ii  linux-libc-dev:amd64                                        4.4.0-45.66                                          amd64        Linux Kernel Headers for development

mostra claramente que está instalado e update-grub o detecta

Generating grub configuration file ...
Found linux image: /boot/vmlinuz-4.4.0-45-generic
Found initrd image: /boot/initrd.img-4.4.0-45-generic
Found memtest86+ image: /memtest86+.elf
Found memtest86+ image: /memtest86+.bin
done

mas mesmo depois de reiniciar a máquina pela enésima vez uname -r ainda me dá

4.2.0-38-generic

Eu quero saber qual etapa eu perdi que impede o sistema de inicializar o novo kernel.

    

Answer 1

Você não precisa instalar uma nova versão do kernel para corrigir a vulnerabilidade da suja vaca apenas ativar o serviço Canonical Livepatch no seu Ubuntu

Kernel live patching enables runtime correction of critical security issues in your kernel without rebooting. It’s the best way to ensure that machines are safe at the kernel level, while guaranteeing uptime, especially for container hosts where a single machine may be running thousands of different workloads.

(1) Go to https://ubuntu.com/livepatch and retrieve your livepatch token, for example: d3b07384d213edec49eaa6238ad5ff00

(2) Install the livepatch snap, like this: $ sudo snap install canonical-livepatch

(3) Enable your account with the token from step 1

$ sudo canonical-livepatch enable d3b07384d113edec49eaa6238ad5ff00

That’s it. You’re up and running! You can check your status at any time with:

$ canonical-livepatch status kernel: 4.4.0-38.57-generic fully-patched: true version: "12.2"

Now your kernel will remain securely patched, and you can reboot when it’s convenient for you.

Ou executando o seguinte comando:

sudo apt-get update && sudo apt-get dist-upgrade