Re: RHSA-2005:472-05 (kernel security update) not required for all?

[Ben <bda20 cam ac uk>]

On Thu, 26 May 2005, Stephen Gardner wrote:

>  Interesting. I see a slightly different (and at least consistent with my 
> original theory) picture here. Naturally I'll defer to what Jay Turner 
> mentioned about the RHN Errata cache turn around time. All I know is what 
> I saw in that
>
> - no U4 machines show up in RHN as needing  RHSA-2005:472-05
> - all U4 machines show the 2.4.21-32.0.1.EL package available via up2date

Which strikes me as a RHN Errata cache issue.


> - Machines that have the entire U5 suite except the new kernel package
>  show up as requiring RHSA-2005:472-05 in RHN and (finally)
> - a machine which went from U4->U5 minus the kernel update showed up as
>  requiring RHSA-2005:472-05 within 1 minute in RHN.

These seem fairly self-consistent then, I think.  I'm beginning to get 
confused at the number of permutations.


>  As a quick double confirmation for myself I got a U4 machine and used 
> up2date to just update the redhat-release package. Before the machine did 
> not show up in RHN as requiring RHSA-2005:472-05, afterwards (within 15 
> seconds, I hit refresh on the RHN page just after the up2date install 
> finished) it did. So in my case the status of the RHN RHSA-2005:472-05 
> errata listing was determined by the presence of the U5 redhat-release 
> package. I know that doesn't help here to explain what you're seeing Ben 
> but I wanted to illustrate the linkage I'm seeing

This kind of puts paid to the RHN cache being behind then, surely, given 
that some things (that one) are appearing straight away?  Unless updates 
are modular/per update somehow.

For reference I just ran up2date on what RHN claims is a fully updated 
machine (running 2.4.21-32.EL and a U5 redhat-release) and got this:

Name                                    Version        Rel
----------------------------------------------------------
ImageMagick                             5.5.6          14                i386
ImageMagick-c++                         5.5.6          14                i386
ImageMagick-c++-devel                   5.5.6          14                i386
ImageMagick-devel                       5.5.6          14                i386
ImageMagick-perl                        5.5.6          14                i386
ethereal                                0.10.11        1.EL3.1           i386
ethereal-gnome                          0.10.11        1.EL3.1           i386
kernel                                  2.4.21         32.0.1.EL         i686
kernel-doc                              2.4.21         32.0.1.EL         i386
kernel-smp                              2.4.21         32.0.1.EL         i686
kernel-source                           2.4.21         32.0.1.EL         i386
mozilla-nspr                            1.7.8          1.1.3.1           i386
mozilla-nss                             1.7.8          1.1.3.1           i386

So something is very much out of step for this many to be available but 
not showing on RHN!


>  I concur that a machine with -32 installed should be flagged as needing 
> -32.0.1 regardless of whether the kernel is running or not as up2date is 
> rpmdb driven.

Indeed.


>  Based on what Jay said it sounds like time is a big factor here. When the 
> RHN errata cache catches up all RHEL3 systems will be listed a needing 
> RHSA-2005:472-05.

And hopefully all those listed above!  I know RHN handles a _lot_ of 
machines, but it would be nice if it could keep up a little more (-:


> PS. I don't think it's relevant but my (x86) redhat-release package is 
> redhat-release-3AS-13.5.1. Naturally RHN doesn't use the contents of 
> /etc/redhat-release it uses the package release version.. could be a 
> factor.

redhat-release-3AS-13.5.1
redhat-release-3WS-13.5.1

on machines which aren't listing any current updates available via RHN but 
do via up2date.  So no, neither do I.

Ben
--
Unix Support, MISD, University of Cambridge, England
Plugger of wire, typer of keyboard, imparter of Clue
        Life Is Short.          It's All Good.