Cfrtjryk

I use various Linux Distros, mostly Debian-based, usually all default (I change nothing in the kernel/shell or internal-utilities (utilities that come with the distro). I usually install Apache, MySQL and PHP on these systems and doesn't change there anything either.

I never did a kernel upgrade to any system as I don't recall ever having such a need or getting some local mail requiring that.

I know that configuration-management (CM) tools, like Ansible, use to orchestrate, deploy and maybe also automate basically everything above the OS layer (which includes the kernel, of course) but of curiosity - can one "dive down" with Ansible to the kernel and automate kernel upgrades with it as well?

Please also share if you think it's a best practice in a basically all-default system (a system where the distro itself - its kernel, shell(s) and internal utilities aren't changed at all).

With most modern Linux distros, the kernel is distributed as a package, just like any other piece of software/library. Therefore, with Ansible as the example, you can have a task such as:

- name: Ensure that latest kernel is installed

  apt:

    name: linux-image-amd64

    state: latest

    update_cache: yes

  notify: reboot_server # You would need a corresponding handler that reboots the system

and this will ensure that each time the play is run, the latest kernel package will be installed.

The kernel is however different to most other software packages in that:

• Multiple versions can be installed simultaneously, so you need to manage the removal of older versions. You don't necessarily want to do this automatically because:


• To enable a newly installed kernel, you need to reboot the system, so that needs to be managed, both from a business process POV and also technically. This is not an entirely risk free operation, so dependent on the nature of the system architecture, is often not seen as being an appropriate task to simply automate.

There are methods to activate a newly installed kernel without a reboot, but they are still not really a mainstream approach.

As to whether you should do kernel updates, in general yes. Given the litany of high profile security failures as a result of out of date software (and the high profile failures likely being just the tip of the iceberg), all software should be kept up to date. The recent Meltdown and Spectre vulnerabilities underline that the kernel is not special, and needs to be kept up to date like any other package.

Maintaining an effective patching policy needs serious thought given the trade off between the failures that can occur during the process, versus the failures that can occur if it is not done. Automation can certainly help, but each environment is different so you have to examine your own requirements to assess to what extent it is appropriate in your own case.

Either way, if when you say:

(a system where the distro itself - its kernel, shell(s) and internal
utilities aren't changed at all)

you mean that once installed, you never revisit and patch/update/upgrade those elements, you are significantly increasing the risk of your system being compromised.

Yes, given the OS Kernel is software and not firmware (like a BIOS or Boot Loader), it can be changed from the shell, as well as a CM that would change it through implementing the shell in its particular way (like Ansible's YAML dialect).