Title: How to trigger services restart after OpenBSD update | |
Author: Solène | |
Date: 25 September 2022 | |
Tags: openbsd security deployment | |
Description: | |
# Introduction | |
Keeping an OpenBSD system up-to-date requires two daily operation: | |
* updating the base system with the command: `/usr/sbin/syspatch` | |
* updating the packages (if any) with the command: `/usr/sbin/pkg_add | |
-u` | |
However, OpenBSD isn't very friendly with regard to what to do after | |
upgrading: modified binaries should be restarted to use the new code, | |
and a new kernel requires an upgrade | |
It's not useful to update if the newer binaries are never used. | |
# Syspatch reboot | |
I wrote a small script to automatically reboot if syspatch deployed a | |
new kernel. Instead of running syspatch from a cron job, you can run a | |
script with this content: | |
``` | |
#!/bin/sh | |
OUT=$(/usr/sbin/syspatch) | |
SUCCESS=$? | |
if [ "$SUCCESS" -eq 0 ] | |
then | |
if echo "$OUT" | grep reboot >/dev/null | |
then | |
reboot | |
fi | |
fi | |
``` | |
It's not much, it runs syspatch and if the output contains "reboot", | |
then a reboot of the system is done. | |
# Binaries restart | |
It's getting more complicated when a running program is updated, | |
whether it's a service with a rc.d script, or a program currently in | |
use. | |
This would be nice to see something to help to restart them | |
appropriately, I currently use the program `checkrestart` in a script | |
like this: | |
``` | |
checkrestart | grep smtpd && rcctl restart smtpd | |
checkrestart | grep httpd && rcctl restart httpd | |
checkrestart | grep dovecot && rcctl restart dovecot | |
checkrestart | grep lua && rcctl restart prosody | |
``` | |
This works well for system services, except when the binary is | |
different from the service name like for prosody, in which case you | |
must know the exact name of the binary. | |
But for long-lived commands like a 24/7 emacs or an IRC client, there | |
isn't any mechanism to handle it. At best, you can email you | |
checkrestart output, or run checkrestart upon SSH login. |