Should you eventually reboot after a Livepatch?

Question

so lets say a livepatch comes in and my current running kernel gets patched, and I don't reboot the server because I don't need to any more. What happens if weeks/months/whatever down the line another livepatch comes in, and weeks later another, etc? Is this situation sustainable without rebooting ever?

The only way I could see that being the case is if each livepatch patches the running kernel to be exactly what it would be if you did the normal apt dist-upgrade to get the latest kernel and rebooted, but my impression was that livepatching only fixed high and critical security issues and left everything else untouched.

Or, do they just test each livepatch against a variation of older base kernels + varying numbers of previous livepatches made to them? If this were the case I'd guess there's a limit to how far back they would test, and that eventually you should reboot to make sure your base kernel is one that the livepatch was tested against?

Answer 1

Every once in a while, a high/critical security vulnerability issue arrises for which a livepatch can't be made, and you need to do the normal apt dist-upgrade and reboot.

Looking through the archives of the ubuntu-security-announce mailing list, it looks like livepatches are provided for all kernels going back to the last time you were required to do a normal update + reboot, in once case going back as far as kernels released a year and a half prior!

Its probably a safe bet they'll continue to do so, and in any case at the bottom of any Livepatch Security Announcement (LSN) on the aformentioned mailing list, there will be a list of kernels that can receive the livepatch, so if you are really running a kernel old enough not to be included, you can know to just do the normal update + reboot in that case.

(thanks to deadflowr from this thread for much of this info)!