continuous security updates for the Linux system

continuous security updates for the Linux system

[MOHAMMED HASSAN]

[-- Attachment #1: Type: text/plain, Size: 372 bytes --]

Hi guys,
I want to know more about security updates in yocto.
So generally we update our distros when we get pop-ups about security
updates and it's done. But what if my device is installed at a
remote location? How does security update take place in the case of yocto?
How can we do it?
Any other relevant information is graciously welcomed.


Thanks and Regards,
Hassan

[-- Attachment #2: Type: text/html, Size: 481 bytes --]

Re: [yocto] continuous security updates for the Linux system

[Josef Holzmayr]

[-- Attachment #1: Type: text/plain, Size: 1152 bytes --]

Please see https://wiki.yoctoproject.org/wiki/System_Update

Full disclosure: I work for Mender, which is one of the mentioned OTA
solutions - mender.io

Greetz,
Josef

On Mon, Oct 9, 2023 at 2:56 PM MOHAMMED HASSAN <hassanchattarki@gmail.com>
wrote:

> Hi guys,
> I want to know more about security updates in yocto.
> So generally we update our distros when we get pop-ups about security
> updates and it's done. But what if my device is installed at a
> remote location? How does security update take place in the case of yocto?
> How can we do it?
> Any other relevant information is graciously welcomed.
>
>
> Thanks and Regards,
> Hassan
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> You automatically follow any topics you start or reply to.
> View/Reply Online (#61284):
> https://lists.yoctoproject.org/g/yocto/message/61284
> Mute This Topic: https://lists.yoctoproject.org/mt/101851310/4689568
> Group Owner: yocto+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub [
> jester@theyoctojester.info]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>

[-- Attachment #2: Type: text/html, Size: 2098 bytes --]

Re: continuous security updates for the Linux system

[MOHAMMED HASSAN]

[-- Attachment #1: Type: text/plain, Size: 512 bytes --]

On Mon, Oct 9, 2023 at 06:12 AM, Josef Holzmayr wrote:

> 
> Please see https://wiki.yoctoproject.org/wiki/System_Update
> 
> 

Thanks for your reply. I am aware of the system_updates feature though still yet to implement. Is it possible to update the yocto version (i use dunfell) to the latest one, to update the linux version(mine is 5.4.180) to the latest and to update the tools to the latest using these features. Actually i have no clarity with this so I am asking.

Thanks and regards,
Hassan

[-- Attachment #2: Type: text/html, Size: 669 bytes --]

Re: [yocto] continuous security updates for the Linux system

[adrian.freihofer]

[-- Attachment #1: Type: text/plain, Size: 1435 bytes --]

Hi

Would it be possible to extend the
https://wiki.yoctoproject.org/wiki/System_Update table with compatible
backends? Ideally the license of the backends should also be
transparent. OE/Yocto should not end up with a vendor lock in when it
comes to a standard update mechanism. In the end it's about a solution
with client and server, where a client alone is usually pretty
worthless.

Regards,
Adrian

On Mon, 2023-10-09 at 06:22 -0700, MOHAMMED HASSAN wrote:
> On Mon, Oct 9, 2023 at 06:12 AM, Josef Holzmayr wrote:
> > Please see https://wiki.yoctoproject.org/wiki/System_Update
> >  
> Thanks for your reply. I am aware of the system_updates feature
> though still yet to implement. Is it possible to update the yocto
> version (i use dunfell) to the latest one, to update the linux
> version(mine is 5.4.180) to the latest and to update the tools to the
> latest using these features. Actually i have no clarity with this so
> I am asking.
> 
> Thanks and regards,
> Hassan
> 
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#61286):
> https://lists.yoctoproject.org/g/yocto/message/61286
> Mute This Topic: https://lists.yoctoproject.org/mt/101851310/4454582
> Group Owner: yocto+owner@lists.yoctoproject.org
> Unsubscribe:
> https://lists.yoctoproject.org/g/yocto/unsub [adrian.freihofer@gmail.com
> ]
> -=-=-=-=-=-=-=-=-=-=-=-
> 


[-- Attachment #2: Type: text/html, Size: 2619 bytes --]

Re: [yocto] continuous security updates for the Linux system

[Michael Opdenacker]

Hi Hassan

On 09.10.23 at 15:22, MOHAMMED HASSAN wrote:
> On Mon, Oct 9, 2023 at 06:12 AM, Josef Holzmayr wrote:
>
>     Please see https://wiki.yoctoproject.org/wiki/System_Update
>
> Thanks for your reply. I am aware of the system_updates feature though 
> still yet to implement. Is it possible to update the yocto version (i 
> use dunfell) to the latest one, to update the linux version(mine is 
> 5.4.180) to the latest and to update the tools to the latest using 
> these features. Actually i have no clarity with this so I am asking.


Which version of Yocto are you using? If you have one that is still 
supported (like Kirkstone or Dunfell), I'd recommend to stick to these 
and just rebuild with the latest release update. This way you have the 
latest vulnerability fixes supported by the Yocto Project. Once a new 
image is generated, you can deploy it using one of the tools Josef 
mentioned.

Moving to the latest version of Yocto will represent more work, all the 
more as the latest one should be replaced this month.

As far as the Linux kernel is concerned, I'd rather work with a stable 
LTS kernel (https://kernel.org/category/releases.html), as I guess the 
Yocto Project releases can't match the stable kernels in terms of 
vulnerability fixes and how quickly they are deployed. That's my own 
opinion though.

I hope this helps
Cheers
Michael.

-- 
Michael Opdenacker, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: continuous security updates for the Linux system

[MOHAMMED HASSAN]

[-- Attachment #1: Type: text/plain, Size: 1816 bytes --]

On Mon, Oct 9, 2023 at 07:11 AM, Michael Opdenacker wrote:

> 
> Hi Hassan
> 
> On 09.10.23 at 15:22, MOHAMMED HASSAN wrote:
> 
>> On Mon, Oct 9, 2023 at 06:12 AM, Josef Holzmayr wrote:
>> 
>> Please see https://wiki.yoctoproject.org/wiki/System_Update
>> 
>> Thanks for your reply. I am aware of the system_updates feature though
>> still yet to implement. Is it possible to update the yocto version (i
>> use dunfell) to the latest one, to update the linux version(mine is
>> 5.4.180) to the latest and to update the tools to the latest using
>> these features. Actually i have no clarity with this so I am asking.
> 
> 
> Which version of Yocto are you using? If you have one that is still
> supported (like Kirkstone or Dunfell), I'd recommend to stick to these
> and just rebuild with the latest release update. This way you have the
> latest vulnerability fixes supported by the Yocto Project. Once a new
> image is generated, you can deploy it using one of the tools Josef
> mentioned.
> 
> Moving to the latest version of Yocto will represent more work, all the
> more as the latest one should be replaced this month.
> 
> As far as the Linux kernel is concerned, I'd rather work with a stable
> LTS kernel ( https://kernel.org/category/releases.html ), as I guess the
> Yocto Project releases can't match the stable kernels in terms of
> vulnerability fixes and how quickly they are deployed. That's my own
> opinion though.
> 
> 

Hi Michael,
Thanks for your reply.
I am currently using dunfell 3.1.11 and my kernel release is Linux 5.4.180-amlogic. Going by your suggestion i should rebuild to the latest dunfell update i.e 3.1.28. Moving to kirkstone would take more work.
I will search on how to update my yocto release version and get into it.

Thanks
Hassan

[-- Attachment #2: Type: text/html, Size: 2185 bytes --]