Patchman can fail to report a required reboot on modern RHEL 8/9 systems.
I encountered this on a RHEL 9 host after patching. The host was running an older kernel than the newest installed kernel and dnf needs-restarting -r correctly reported that a reboot was required, but Patchman reported no reboot requirement.
Example:
$ cat /proc/sys/kernel/osrelease
5.14.0-611.54.1.el9_7.x86_64
$ rpm -q kernel --qf '%{VERSION}-%{RELEASE}.%{ARCH}\n' | sort -V
5.14.0-611.36.1.el9_7.x86_64
5.14.0-611.54.1.el9_7.x86_64
5.14.0-687.44.1.el9_8.x86_64
$ ls -l /boot/vmlinuz
ls: cannot access '/boot/vmlinuz': No such file or directory
dnf needs-restarting -r reports that a reboot is required.
Current behaviour
patchman-client checks /var/run/reboot-required and then compares the running kernel against a /boot/vmlinuz symlink.
On RHEL 8/9, /boot/vmlinuz may not exist as a symlink. In that case the client falls back to:
Protocol 2 converts reboot state to a boolean and only sends true when the value is exactly True. ServerCheck therefore becomes:
This produces a false negative.
Expected behaviour
On RPM/DNF systems, Patchman should reliably detect whether a reboot is required.
A suitable method on current RHEL systems is:
where:
0 = reboot not required
1 = reboot required
If dnf needs-restarting is unavailable or returns an unexpected status, Patchman can fall back to its existing logic.
Suggested approach
Conceptually:
if command -v dnf >/dev/null 2>&1; then
dnf needs-restarting -r >/dev/null 2>&1
rc=$?
if [ "$rc" -eq 1 ]; then
reboot=True
return
elif [ "$rc" -eq 0 ]; then
reboot=False
return
fi
fiIt may also be worth preserving the ServerCheck state in Protocol 2 rather than silently serialising an unknown state as false.
Impact
Patchman can incorrectly show that patched RHEL 8/9 hosts do not require a reboot even when a newer kernel and/or reboot-sensitive core components have been installed.
Patchman can fail to report a required reboot on modern RHEL 8/9 systems.
I encountered this on a RHEL 9 host after patching. The host was running an older kernel than the newest installed kernel and
dnf needs-restarting -rcorrectly reported that a reboot was required, but Patchman reported no reboot requirement.Example:
dnf needs-restarting -rreports that a reboot is required.Current behaviour
patchman-clientchecks/var/run/reboot-requiredand then compares the running kernel against a/boot/vmlinuzsymlink.On RHEL 8/9,
/boot/vmlinuzmay not exist as a symlink. In that case the client falls back to:Protocol 2 converts reboot state to a boolean and only sends
truewhen the value is exactlyTrue.ServerChecktherefore becomes:This produces a false negative.
Expected behaviour
On RPM/DNF systems, Patchman should reliably detect whether a reboot is required.
A suitable method on current RHEL systems is:
where:
If
dnf needs-restartingis unavailable or returns an unexpected status, Patchman can fall back to its existing logic.Suggested approach
Conceptually:
It may also be worth preserving the
ServerCheckstate in Protocol 2 rather than silently serialising an unknown state asfalse.Impact
Patchman can incorrectly show that patched RHEL 8/9 hosts do not require a reboot even when a newer kernel and/or reboot-sensitive core components have been installed.