Bug 214254

Summary:	Freebsd-update does not request a reboot in all cases where it is needed
Product:	Base System	Reporter:	bc979
Component:	bin	Assignee:	freebsd-bugs (Nobody) <bugs>
Status:	New ---
Severity:	Affects Many People	CC:	emaste, grahamperrin
Priority:	---
Version:	11.0-RELEASE
Hardware:	Any
OS:	Any

Description bc979 2016-11-05 23:30:29 UTC

I have several systems that were running 11.0-p1 (RELEASE) and needed to update them to the latest security patches.  Freebsd-update brought down the updates and when they were installed it said nothing about rebooting so I didn't. 

freebsd-version -ku
11.0-RELEASE-p2
11.0-RELEASE-p3

uname -a
FreeBSD sermons 11.0-RELEASE-p1 FreeBSD 11.0-RELEASE-p1 #0 r306420: Thu Sep 29 01:43:23 UTC 2016     root@releng2.nyi.freebsd.org:/usr/obj/usr/src/sys/GENERIC  amd64

Once I rebooted the system, uname showed -p2:

FreeBSD master 11.0-RELEASE-p2 FreeBSD 11.0-RELEASE-p2 #0: Mon Oct 24 06:55:27 UTC 2016     root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC  amd64

Apparently a reboot was required after the freebsd-update install and it should have told me that was the case.

Comment 1 Graham Perrin freebsd_committer

2022-01-01 13:01:00 UTC

(In reply to bc979 from comment #0)

> … were running 11.0-p1 (RELEASE) …

> freebsd-version -ku
> 11.0-RELEASE-p2
> 11.0-RELEASE-p3

Non-official <https://bokut.in/freebsd-patch-level-table/#releng/11.0> shows: 

* reboot required for one of the three patches to reach p2

* no such _requirement_ for the one patch between p2 and p3. 

For the latter, more specifically: 

> … The sshd(8) service has to be restarted after the update.  
> A reboot is recommended but not required. …

– <https://www.freebsd.org/security/advisories/FreeBSD-SA-16:33.openssh.asc>

Comment 2 bc979 2022-01-01 23:26:56 UTC

The reboot recommendation/requirement issue continues on to the latest versions.  The current approach appears to be that a reboot is recommended somewhere in the documentations and then leave it up to the administrator to determine if there is anything running that needs to be restarted.

It would seem to me that it would be better to require the reboot and then show the kinds of processes that would not get updated if a reboot was not performed.

The best approach would be for the system to examine itself and determine which running processes require a reboot and make the recommendation based on that.  I suspect that would be much more difficult to implement though.