Reluctant to apply the Kernel security update

I’ve had a security update for the Kernel available for a while now, but I’m reluctant to install it because I still don’t see a matching driver and kernel module for my GPU in the Nvidia repositories.

The version of the kernel that’s available from the updater is 2.6.27.25, but the kernel module is only for version 2.6.27.23.

Obviously running on an unpatched kernel is not a great idea, but I also know that updating the kernel without updating to the appropriate version of a kernel module is also a bad idea. I’ve seen plenty enough people complain about having problems after updating and ending up with missmatches to know I should seek the advice of people that know much more about this stuff than I do before just jumping right in.

So… help?:shame:

Take your time in your deliberations. … When I was less familiar with openSUSE Linux, I’ve gone for many many months at times, before applying a kernel update. Apply it when you are ready, and don’t rush it.

The smart thing to do (which you have done already - so WELL DONE) is not to install the kernel update prematurely without giving it some thought and taking precautions.

The precautions I take are:

  • backup /boot/grub/menu.lst before installing kernel
  • for each case (graphics, webcam, audio, wireless) where I might be using a proprietary driver, I ensure I have a binary of the driver ready to recompile/rebuild (with instructions) or I have an rpm ready that was pre-compiled against the new kernel (or I have a source rpm file that I know how to rebuild to create a new rpm)
  • after installing kernel but before rebooting, I check the updated /boot/grub/menu.lst against my backup of the previous (original) /boot/grub/menu.lst and confirm the changes make sense.
  • do this on a night when I have nothing that I can not cancel planned (I often would wait until the weekend) just in case I mess up
  • have a laptop or other PC handy, (or a liveCD that I can boot to) that can access the web in case I mess up
    *]ensure I have the original installation DVD handy (which is also the emergency recovery DVD)

i do NOT know how/why…but, something about the way my system is set
up the last kernel update automatically did everything…by that i mean:

-openSUSE updater told me that i should reboot soon after finishing

-it downloaded and installed the new kernel

-it downloaded the new kernel source

-it built/compiled a new nVidia driver based on the new kernel

-it set EVERYTHING up and then said it was finished

-as instructed i rebooted, and EVERYTHING WORKED perfectly

why? i have NO idea…but, someone here does!


brassy
CAVEAT: The author of this posting does not warrant the accuracy,
completeness, legality, or usefulness of its content and is not
responsible for consequences resulting from its use.

Stephen Philbin wrote:

> I’ve had a security update for the Kernel available for a while now, but
> I’m reluctant to install it because I still don’t see a matching driver
> and kernel module for my GPU in the Nvidia repositories.

Are you using nvidia repository? If yes and if you get no dependency errors
(always check for any), just go ahead and update. If you get any conflict
or dependency message, stop.

I’ve been with a very old nvidia kernel module (installed from nvidia
repository) since years and updating the kernel with no problem at all.

Hey, this is a “non-guaranteed” advice, use with caution :stuck_out_tongue:

Greetings,


Camaleón

Yes.

Yeah. Your comments are indeed appreciated, but what you say doesn’t really fill me with confidence.

Since installing the Nvidia kernel module and driver, I have updated the kernel once before and that left me with non-matching versions of the kernel and the module. I haven’t had any major problems since that update, but the difference in versions is more minor. I’m guessing it’s more to do with luck, rather than design, that the non-matching versions have not caused any major problems.

I think I’d better find my install disk and maybe find some more info before I do anything else.

if you don’t want to wait so long until the repo adds a matching NV driver for the new kernel, it’s better you install the NV driver manually, which is very easy to do. All you need is the kernel source and build environment like gcc, make, m4, etc

I’ve never used the NV repo in my life and always manually re-install the NV drivers. So far during all those years it’s been painless and very quick :slight_smile:

If it is the graphics that worry you, then the more linux knowledge you have, the less worrisome this will be. Now this won’t help new users, but that is not the point of my input to this thread. Rather I am trying to provide information to give you more confidence.

For nVidia, typically there are 3 graphic drivers that work:

  • vesa - a generic driver - works for nvidia, ati, intel and other graphic hardware. Its the most compatible, but also has the worst performance. It almost always survives a kernel update.
  • nv - the openGL (ie open source) graphic driver - average performance. It almost always survives a kernel update.
  • nvidia - the proprietary graphic driver (typically requires a separate install/build of the proprietary driver). It has the best performance. It is almost always broken by a kernel update and needs a rebuild/reinstall.

In openSUSE the graphic tool for configuring the driver is called ‘sax2’. sax2 will update one’s PC’s /etc/X11/xorg.conf file. Hence before running sax2, I always back up my /etc/X11/xorg.conf file so that I can restore the file if necessary.

Sax2 should be run in run level 3 (ie log in with an ascii prompt). One can boot to an ascii prompt by typing “3” (no quotes) in the grub boot menu.

Some examples of using sax2 with root permissions …

  • first, for the vesa driver:
    sax2 -r -m 0=vesa
  • now for the openGL driver:
    sax2 -r -m 0=nv
  • now for the nvidia driver:
    sax2 -r -m 0=nvidia
    Note one must have already installed the nvidia rpm for one’s new kernel, or built the nvidia driver from a binary against one’s new kernel, before running that sax2 command.

Note that I am assuming only one graphic device on the PC. One can tell what graphic devices are detected by sax2 by typing:
sax2 -p
Note that the command I gave was “zero equals driver”.

There are other options for use of sax2, which one can learn by typing:
man sax2

It’s wise to be cautious. I waited and took a chance, and it’s OK. One thing I did do, is download the latest nVIDIA driver so, in the event that the matching stuff didn’t work, I could fallback to the by-hand trick of “init 3 ; sh NVIDIA…”.

Stephen Philbin wrote:

> Camaleón;2019778 Wrote:
>> Are you using nvidia repository?
> Yes.

O.K.

> Yeah. Your comments are indeed appreciated, but what you say doesn’t
> really fill me with confidence.
>
> Since installing the Nvidia kernel module and driver, I have updated
> the kernel once before and that left me with non-matching versions of
> the kernel and the module. I haven’t had any major problems since that
> update, but the difference in versions is more minor. I’m guessing it’s
> more to do with luck, rather than design, that the non-matching versions
> have not caused any major problems.

Maybe. But if you fall into these problems while using nnidia repo packages,
open a bugzilla and tell developers that YaST should warn people in such
situation.

A dependency error should be displayed to the user, if none, I would
consider that a bug :slight_smile:

> I think I’d better find my install disk and maybe find some more info
> before I do anything else.

No need to do that. You can go with another vga driver as others already
told you. There are many situations that can leave you with no graphical
session at all and you should be capable to handle that :slight_smile:

Greetings,


Camaleón

I know it’s been a while, but I’ve finally got back around to this issue of the graphics driver update. I figured it’d be better in the long-run if I just learn how to build the module for myself so that I don’t have to rely on repositories (and the knowledge may come in handy elsewhere lol! ).

I already have gcc, make and M4 installed (I need them to build MySQL, Apache, PHP, Sendmail etc.), and I always install the kernel sources whenever I make the initial installation of Suse anyway. So I think I have the basic tools to build it with (let me know if I missed anything), but I don’t really know what’s what and how to put it together.

For example, I thought the proprietary binary from Nvidia was the driver and that the module I need to build was just a sort of connector/bridge to allow my kernel communicate with the binary driver. By the sounds of what someone posted earlier, though, I get the impression that the module its self is the driver and is built to contain this binary from Nvidia.

Anyway, I guess my questions now are

  1. Where do I get the latest (stable) binary from Nvidia so that I don’t have to wait around for it to show up in the repo’s?

  2. What are the steps I need to take to build a module out of the binary and kernel sources?

  3. What changes do I need to make after building the module to have the kernel make use of it, and what precautions should I take when doing it (such as backing up /etc/X11/xorg.conf)?

What I typically do is go to the nVidia Linux forum, and look at the “stickie” to see what it notes is the latest version: Current NVIDIA Linux graphics driver releases - nV News Forums
The first post in that thread is constantly updated. One needs to determine which of those proprietary drivers is applicable to one’s graphic card.

Alternatively one can go to the nVidia download page: Unix Drivers Portal Page

Its actually NOT hard. Its easy. There is guidance here: NVIDIA/The hard way - openSUSE
… ie “sax2 -r -m 0=nvidia” (if your card chip is “0” where “0” is a number). That is explained in posts above and in the Links I provided.

I always ensure in YaST > Software > Software management, with “filter” set to “pattern” that I have the “Base Developement” pattern installed. And also ensure for the NEW kernel that I also installed kernel-source and kernel-syms.

To have the updated driver used by openSUSE, after being built, is explained here: NVIDIA/The hard way - openSUSE

I thought I gave that to you already in post#2 above: openSUSE Forums - View Single Post - Reluctant to apply the Kernel security update

Yeah. I was just being cautious and checking if there were any other additional precautions I should be aware of.

Thanks for all the help. It is very much appreciated.lol!

Ok. I did it, but I did hit a problem on the way, so I thought it would be a good idea to post about it here just in case anyone else gets it too.

I followed the steps up until it came to do sax2 -r -m 0=nvidia. It started the sax2 config process and then it failed, telling me to check the log file, and leaving me with only a command-line interface. It took me a few guesses to figure out what the contents of the log file meant and what might be causing the problem. I realized it was probably something to do with the old driver I had installed via the Nvidia repos in Yast. So I just used the command-line version of Yast2 to uninstall the previous packages and then tried sax2 -r -m 0=nvidia again which then worked perfectly.

So I guess the key is to make sure you remove the old packages first instead of just assuming they’d get overwritten (despite each installation process being entirely different).