From owner-freebsd-questions@FreeBSD.ORG Tue Jul 13 11:18:56 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D36A516A4CF for ; Tue, 13 Jul 2004 11:18:56 +0000 (GMT) Received: from 9.hellooperator.net (cpc3-cdif2-3-0-cust202.cdif.cable.ntl.com [81.103.32.202]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6F4CB43D4C for ; Tue, 13 Jul 2004 11:18:56 +0000 (GMT) (envelope-from rasputin@hellooperator.net) Received: from rasputin by 9.hellooperator.net with local (Exim 4.34) id 1BkLJH-00032O-8Z; Tue, 13 Jul 2004 12:18:55 +0100 Date: Tue, 13 Jul 2004 12:18:55 +0100 From: Dick Davies To: Mark Message-ID: <20040713111855.GB11963@lb.tenfour> References: <200407131018.I6DAIASL045534@asarian-host.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200407131018.I6DAIASL045534@asarian-host.net> User-Agent: Mutt/1.4.2.1i Sender: Rasputin cc: freebsd-questions@freebsd.org Subject: Re: Is it safe to keep /kernel.old? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Dick Davies List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Jul 2004 11:18:57 -0000 * Mark [0719 11:19]: > Dear people, > > I have been applying patches over time; and when I recompile the kernel (4.9R p4), it keeps the old one around. My question is, though, is it safe to keep /kernel.old? I always keep it around, in case the new kernel has a problem. And that always seemed like a sensible policy to me. But what if one of the patches contains an exploitable bug? I run in securelevel 2, so I am not sure whether users could actually use the old kernel (once in multi-user mode). Still, I wonder if this concern is valid at all. Or whether I should perhaps get rid of the old kernel. What I generally do on all BSds is when I've been using the kernel happily for a week or two, I 'cp /kernel /kernel.ok' - if you let /kernel.old get *too* old, you might find it won't boot on a recent userland.... -- Don't go around saying the world owes you a living. The world owes you nothing. It was here first. -- Mark Twain Rasputin :: Jack of All Trades - Master of Nuns