From e0ee6504fb0955f3f4145987c089240d5dd01b0a Mon Sep 17 00:00:00 2001 From: Prinson Fernandes Date: Wed, 14 Oct 2026 15:15:27 +0530 Subject: [PATCH 1/4] Add docs for CVE-aware reboot recommendations feature --- ...how-kernel-upgrade-recommendations-work.md | 65 +++++++++ docs/client/explanation/architecture/index.md | 2 + .../architecture/reboot-marker-suppression.md | 60 ++++++++ .../troubleshooting/do-i-need-to-reboot.md | 13 +- .../configure-reboot-notification-policy.md | 66 +++++++++ .../how-to-guides/configuration/index.md | 2 + .../operations/check-client-status.md | 2 +- .../platform/configuration-options.md | 1 + docs/client/reference/platform/index.md | 2 + .../platform/kernel-upgrade-recommendation.md | 128 ++++++++++++++++++ .../deployment/deploy-cve-service-via-snap.md | 4 + 11 files changed, 343 insertions(+), 2 deletions(-) create mode 100644 docs/client/explanation/architecture/how-kernel-upgrade-recommendations-work.md create mode 100644 docs/client/explanation/architecture/reboot-marker-suppression.md create mode 100644 docs/client/how-to-guides/configuration/configure-reboot-notification-policy.md create mode 100644 docs/client/reference/platform/kernel-upgrade-recommendation.md diff --git a/docs/client/explanation/architecture/how-kernel-upgrade-recommendations-work.md b/docs/client/explanation/architecture/how-kernel-upgrade-recommendations-work.md new file mode 100644 index 0000000..9d16c33 --- /dev/null +++ b/docs/client/explanation/architecture/how-kernel-upgrade-recommendations-work.md @@ -0,0 +1,65 @@ +--- +myst: + html_meta: + description: "Understand how the Livepatch Client decides whether a reboot into a newer kernel is urgent, and why it sometimes makes no recommendation." +--- + + +(client-explanation-how-kernel-upgrade-recommendations-work)= + +# How kernel upgrade recommendations work + +When a new kernel is installed, Ubuntu asks for a reboot. This page explains how Livepatch decides whether that reboot is urgent, and why it sometimes makes no recommendation. + +## Why the recommendation exists + +Live kernel patches cover high and critical kernel vulnerabilities. A newer kernel can include many fixes, but if Livepatch already covers those fixes, the machine isn't exposed while it waits for the next maintenance window. Lower-priority fixes are only available by rebooting into the new kernel. + +The kernel upgrade recommendation helps you tell these situations apart. It answers a single question: does the kernel that will boot next fix CVEs that this machine isn't already protected from? + +## Where the information comes from + +When the Livepatch Server is enabled with the CVE service, it knows which CVEs each Ubuntu kernel version fixes. + +On every check-in, the client tells the server: + +* The kernel that's running. +* The kernel that will boot after a reboot. +* The CVEs fixed by the live patches that are currently applied. + +The server replies with the CVEs that the next boot kernel fixes and that the running kernel doesn't. + +## How the client recommends reboots + +The client takes the CVEs that the next boot kernel adds and removes the ones that the applied live patches already cover. For example: + +* The next boot kernel fixes 5 CVEs that the running kernel doesn't. +* The applied live patches already cover 3 of them. +* The 2 that remain aren't covered, so the client recommends a reboot. + +If the applied Livepatch covers all the CVEs fixed by the next boot kernel, the Livepatch Client removes the pending reboot notice, and the reboot can wait for a maintenance window. + +## The newest kernel hint + +If Canonical has published an even newer kernel in the same series and flavour as the next boot kernel, the client mentions it, together with the CVEs it fixes. This is informational. It never changes the recommendation or whether a reboot notice is removed. + +## Why the client sometimes stays quiet + +The client only makes a recommendation when it has complete evidence. If anything is uncertain, it makes no recommendation rather than guessing, and it keeps any pending reboot notice. This happens in the following cases: + +* The Livepatch Server doesn't provide kernel upgrade information. +* The kernel that will boot next can't be determined with confidence. +* The kernel is a custom or unsigned kernel that doesn't match an installed Ubuntu kernel package. + +For the full list, see the [kernel upgrade recommendation reference](/client/reference/platform/kernel-upgrade-recommendation.md). + +## Requirements + +* Livepatch Client v11.1.0 or later. +* For on-prem deployments, Livepatch Server v2.7.0 and CVE service v1.1.0 or later, with CVE lookup and CVE sync enabled. See [how to deploy the CVE service via snap](/server/how-to-guides/deployment/deploy-cve-service-via-snap.md). + +## See also + +* [How reboot notices are removed after a kernel update](/client/explanation/architecture/reboot-marker-suppression.md) +* [Kernel upgrade recommendation reference](/client/reference/platform/kernel-upgrade-recommendation.md) +* [Configure the reboot notification policy](/client/how-to-guides/configuration/configure-reboot-notification-policy.md) diff --git a/docs/client/explanation/architecture/index.md b/docs/client/explanation/architecture/index.md index 460d4b4..93d2b75 100644 --- a/docs/client/explanation/architecture/index.md +++ b/docs/client/explanation/architecture/index.md @@ -20,4 +20,6 @@ Updates not provided by Livepatch When to expect new updates Content caching +Kernel upgrade recommendations +Reboot notice removal ``` diff --git a/docs/client/explanation/architecture/reboot-marker-suppression.md b/docs/client/explanation/architecture/reboot-marker-suppression.md new file mode 100644 index 0000000..32f6f50 --- /dev/null +++ b/docs/client/explanation/architecture/reboot-marker-suppression.md @@ -0,0 +1,60 @@ +--- +myst: + html_meta: + description: "Understand when the Livepatch Client removes the pending reboot notice after a kernel update, and when it keeps it." +--- + + +(client-explanation-how-reboot-notices-are-removed)= + +# How reboot notices are removed after a kernel update + +With the `livepatch-aware` reboot notification policy, the Livepatch Client can remove the system's pending reboot notice after a kernel install when Livepatch already covers the CVEs fixed by the next boot kernel. This page explains when that happens and when it doesn't. + +To configure the policy, see [how to configure the reboot notification policy](/client/how-to-guides/configuration/configure-reboot-notification-policy.md). + +## What Livepatch does + +After a kernel install, the system shows a pending reboot notice. With the `livepatch-aware` policy, the client checks whether that reboot is needed urgently. After `apt` finishes installing a kernel, a post-invoke hook created by the Livepatch Client refreshes client information and checks the [kernel upgrade recommendation](/client/explanation/architecture/how-kernel-upgrade-recommendations-work.md). It removes the pending reboot notice only when the result proves that Livepatch covers the CVEs fixed by the next boot kernel. The reboot can then wait for a maintenance window, and the Livepatch message shows that the system is protected. + +This only applies to the `livepatch-aware` policy. + +## When the notice stays + +The client keeps the reboot notice in the following cases: + +* Packages other than the kernel also need the restart. +* The refresh or the coverage check fails or times out. +* The evidence is incomplete. See [when there is no recommendation](/client/reference/platform/kernel-upgrade-recommendation.md) for the cases. +* The policy is `livepatch-agnostic`. + +## Effects on other tools + +Removing the reboot notice, i.e. the `/var/run/reboot-required` file, also removes it for other tools that read it. For example: + +* `unattended-upgrades` with `Automatic-Reboot` enabled doesn't restart the machine, because it only reboots when a notice is pending. +* `update-notifier` and the message of the day no longer show the system's "System restart required" message. +* Monitoring and fleet management tools that check for the reboot notice no longer report the machine as needing a reboot. + +If you don't want Livepatch to change the system's reboot notice, set the policy to `livepatch-agnostic`. See [how to disable Livepatch-aware reboot notifications](/client/how-to-guides/configuration/configure-reboot-notification-policy.md#disable-livepatch-aware-reboot-notifications). + +## Limits + +* Only kernels installed or upgraded with `apt` are evaluated. A kernel installed with `dpkg -i` isn't evaluated until the next `apt` run. +* If you change the GRUB default or the boot entry later, the notice isn't evaluated again until the next scheduled or manual refresh. The message of the day never shows a recommendation that's out of date. +* On s390x, the client never removes the notice, because the architecture doesn't use GRUB. + +## Outcomes at a glance + +| Situation after a kernel install | Reboot notice | Livepatch message | +| --- | --- | --- | +| Livepatch covers the next boot kernel's CVEs | Removed | Protected | +| Livepatch doesn't cover all of the next boot kernel's CVEs | Kept | Reboot required | +| Other packages also need the restart | Kept | None, the system's own notice is shown | +| The client can't prove coverage | Kept | None, the system's own notice is shown | + +## See also + +* [How kernel upgrade recommendations work](/client/explanation/architecture/how-kernel-upgrade-recommendations-work.md) +* [Kernel upgrade recommendation reference](/client/reference/platform/kernel-upgrade-recommendation.md) +* [Configure the reboot notification policy](/client/how-to-guides/configuration/configure-reboot-notification-policy.md) diff --git a/docs/client/explanation/troubleshooting/do-i-need-to-reboot.md b/docs/client/explanation/troubleshooting/do-i-need-to-reboot.md index 8192038..d1bf5d9 100644 --- a/docs/client/explanation/troubleshooting/do-i-need-to-reboot.md +++ b/docs/client/explanation/troubleshooting/do-i-need-to-reboot.md @@ -22,4 +22,15 @@ Enabling the Livepatch service does not turn on automatic installation of securi - Subscribe to the [security announcement mailing list](https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce) - Follow all advised security updates and reboot at your earliest convenience when any software component requires it -Kernel SRU updates also include non-security bug fixes and lower-priority security fixes that may be important to your specific circumstances. These fixes are only available by rebooting into an updated kernel. \ No newline at end of file +Kernel SRU updates also include non-security bug fixes and lower-priority security fixes that may be important to your specific circumstances. These fixes are only available by rebooting into an updated kernel. + +## Livepatch reboot recommendation + +When Livepatch is running, the client also checks whether the kernel that will boot next fixes CVEs that your applied live patches don't cover. If it does, the message of the day recommends a reboot. If Livepatch already covers them, the message tells you that the reboot can wait for a maintenance window. With the default policy, the client can also remove the pending reboot notice after a kernel update. + +To learn more, see: + +- [How kernel upgrade recommendations work](/client/explanation/architecture/how-kernel-upgrade-recommendations-work.md) +- [How reboot notices are removed after a kernel update](/client/explanation/architecture/reboot-marker-suppression.md) +- [Kernel upgrade recommendation reference](/client/reference/platform/kernel-upgrade-recommendation.md) +- [How to configure the reboot notification policy](/client/how-to-guides/configuration/configure-reboot-notification-policy.md) diff --git a/docs/client/how-to-guides/configuration/configure-reboot-notification-policy.md b/docs/client/how-to-guides/configuration/configure-reboot-notification-policy.md new file mode 100644 index 0000000..d7fad35 --- /dev/null +++ b/docs/client/how-to-guides/configuration/configure-reboot-notification-policy.md @@ -0,0 +1,66 @@ +--- +myst: + html_meta: + description: "How to configure the reboot notification policy of the Livepatch Client, so that reboot notices account for kernel CVEs already covered by Livepatch." +--- + + +(client-how-to-guides-how-to-configure-the-reboot-notification-policy)= + +# How to configure the reboot notification policy + +By default, the Livepatch Client can remove a pending reboot notice after a kernel update when Livepatch already covers the CVEs that the next boot kernel fixes. This guide shows how to check, enable, and disable that behavior. + +## Requirements + +* Livepatch Client v11.1.0 or later. +* For on-prem deployments, Livepatch Server v2.7.0 and CVE service v1.1.0 or later. + +## Check the reboot notification policy + +To check the reboot notification policy, run the following command: + +```bash +sudo canonical-livepatch config reboot-notification-policy --format yaml +reboot-notification-policy: livepatch-aware + +sudo canonical-livepatch config reboot-notification-policy --format json +{"reboot-notification-policy":"livepatch-aware"} +``` + +## Enable Livepatch-aware reboot notifications + +To make reboot notifications aware of the Livepatch state, which is the default, run the following command: + +```bash +sudo canonical-livepatch config reboot-notification-policy=livepatch-aware +``` + +With this policy, the client removes a pending reboot notice only after a refresh confirms that Livepatch covers the CVEs fixed by the next-boot kernel. If the refresh, the coverage check, or either command's timeout fails, the notice stays. + +The snap connects the interfaces that this feature needs (`etc-kernel-postinst-d`, `etc-apt-conf-d`, and `boot-grub`) automatically. If the client does not remove notices as expected, check that all three interfaces are connected: + +```bash +snap connections canonical-livepatch +``` + +To connect a missing interface, run: + +```bash +sudo snap connect canonical-livepatch: +``` + +## Disable Livepatch-aware reboot notifications + +When the client removes a reboot notice, tools that read it, such as `unattended-upgrades` and `update-notifier`, are affected. If you don't want the client to remove reboot notices, make reboot notifications independent of the Livepatch state by running the following command: + +```bash +sudo canonical-livepatch config reboot-notification-policy=livepatch-agnostic +``` + +With this policy, the client never removes a pending reboot notice. + +## Next steps + +* To learn how the client decides to remove a reboot notice, see [how reboot notices are removed after a kernel update](/client/explanation/architecture/reboot-marker-suppression.md). +* For all client settings, see the [configuration options](/client/reference/platform/configuration-options.md). diff --git a/docs/client/how-to-guides/configuration/index.md b/docs/client/how-to-guides/configuration/index.md index f4d787a..f3db5df 100644 --- a/docs/client/how-to-guides/configuration/index.md +++ b/docs/client/how-to-guides/configuration/index.md @@ -17,6 +17,7 @@ Configure the client, proxies, cloud-init, and patch cut-off behaviour. * [Configure a proxy](/client/how-to-guides/configuration/configure-proxy.md) * [Enable and configure the Livepatch Client with cloud-init](/client/how-to-guides/configuration/enable-and-configure-the-livepatch-client-with-cloud-init.md) * [Use a patch cut-off date](/client/how-to-guides/configuration/use-patch-cut-off-date.md) +* [Configure the reboot notification policy](/client/how-to-guides/configuration/configure-reboot-notification-policy.md) ```{toctree} :titlesonly: @@ -27,4 +28,5 @@ Configure Livepatch Client Configure proxy Enable and configure the Livepatch Client with cloud init Use patch cut off date +Configure reboot notification policy ``` diff --git a/docs/client/how-to-guides/operations/check-client-status.md b/docs/client/how-to-guides/operations/check-client-status.md index c4c4f1e..9a2117f 100644 --- a/docs/client/how-to-guides/operations/check-client-status.md +++ b/docs/client/how-to-guides/operations/check-client-status.md @@ -129,7 +129,7 @@ The `canonical-livepatch status` command accepts flags that change the output fo * `--summary` shows a concise summary (similar to default output). -* `--verbose` shows extended details such as client version, architecture, boot time, and applied CVEs. +* `--verbose` shows extended details such as client version, architecture, boot time, applied CVEs, applied CVEs fixed in the kernels installed in the system, and CVEs fixed by the next boot kernel that are not yet fixed in the running kernel. * `--show-secrets` shows sensitive machine tokens (requires sudo). diff --git a/docs/client/reference/platform/configuration-options.md b/docs/client/reference/platform/configuration-options.md index dafabd3..7ced963 100644 --- a/docs/client/reference/platform/configuration-options.md +++ b/docs/client/reference/platform/configuration-options.md @@ -21,6 +21,7 @@ The following configuration options are available for the Livepatch Client. See | `check-interval` | integer | Interval in minutes between patch checks. Minimum `60`. Set to `0` to disable automatic checks. | `60` | | `log-level` | string | Log verbosity. One of `debug`, `info`, `notice`, `warning`, `error`. | `warning` | | `tls-patch-download` | boolean | Require TLS for all patch downloads. | `false` | +| `reboot-notification-policy` | string | Controls whether the client removes a pending reboot notice after a kernel update. `livepatch-aware` removes it when Livepatch covers the next boot kernel's CVEs. `livepatch-agnostic` never removes it. See [how to configure the reboot notification policy](/client/how-to-guides/configuration/configure-reboot-notification-policy.md). | `livepatch-aware` | | `cutoff-date` 1 | string | RFC 3339 date in the past. Patches released after this date are not installed. | Empty | | `patch-delay` 1 | string | Duration to wait before a newly released patch is applied. Allowed units: `s`, `m`, `h`, `d`, `w`. | `0` | diff --git a/docs/client/reference/platform/index.md b/docs/client/reference/platform/index.md index 998dcee..d155233 100644 --- a/docs/client/reference/platform/index.md +++ b/docs/client/reference/platform/index.md @@ -15,6 +15,7 @@ Supported kernels, architectures, and configuration options for the Livepatch Cl - [Supported kernels](/client/reference/platform/supported-kernels.md) — Kernel versions, flavours, and Ubuntu releases covered by the Livepatch Client. - [Supported architectures](/client/reference/platform/which-are-the-supported-architectures.md) — CPU architectures for which live kernel patches are available. - [Configuration options](/client/reference/platform/configuration-options.md) — All available configuration settings for the Livepatch Client. +- [Kernel upgrade recommendation](/client/reference/platform/kernel-upgrade-recommendation.md) — Results, messages, and status output for the kernel upgrade recommendation. ```{toctree} :titlesonly: @@ -24,4 +25,5 @@ Supported kernels, architectures, and configuration options for the Livepatch Cl Supported kernels Supported architectures Configuration options +Kernel upgrade recommendation ``` \ No newline at end of file diff --git a/docs/client/reference/platform/kernel-upgrade-recommendation.md b/docs/client/reference/platform/kernel-upgrade-recommendation.md new file mode 100644 index 0000000..982e946 --- /dev/null +++ b/docs/client/reference/platform/kernel-upgrade-recommendation.md @@ -0,0 +1,128 @@ +--- +myst: + html_meta: + description: "Reference for the Livepatch kernel upgrade recommendation, including its results, messages, message of the day rules, and status output fields." +--- + + +(client-reference-kernel-upgrade-recommendation)= + +# Kernel upgrade recommendation + +The Livepatch Client produces a kernel upgrade recommendation. It appears in the message of the day (MOTD) and helps the client decide whether to remove a pending reboot notice. This page describes the possible results, the messages, and the related `status` output. + +For the reasoning behind the recommendation, see [how kernel upgrade recommendations work](/client/explanation/architecture/how-kernel-upgrade-recommendations-work.md). + +## Requirements + +* Livepatch Client v11.1.0 or later. +* For on-prem deployments, Livepatch Server v2.7.0 and CVE service v1.1.0 or later. + +## Recommendation results + +The recommendation is the exit status of `canonical-livepatch kernel-upgrade-required`, the command that the Livepatch MOTD script and reboot notice handling use internally. + +| Exit status | Meaning | +| --- | --- | +| `0` | A reboot is recommended because of an unpatchable or uncovered vulnerability, an expired Livepatch SRU window, or the end of kernel series support. | +| `1` | Livepatch covers the CVEs that matter for the running kernel. The reboot can wait for a maintenance window. | +| `2` | The client doesn't have enough information to make a recommendation. | +| `3` | An error prevented the client from determining a result. | + +### When there is no recommendation + +The client returns exit status `2` instead of guessing in the following cases: + +* The Livepatch Server is older than v2.7.0 and doesn't send kernel upgrade information. +* The next boot kernel can't be determined with confidence. For example, a one-time boot entry or a custom or saved GRUB default is set, or the GRUB configuration can't be read. +* The kernel is a custom kernel, or an unsigned kernel, that doesn't match an installed `linux-image-*` package. +* The machine doesn't use GRUB, as on s390x. +* No recommendation applies, for example when the running kernel is already the newest installed kernel. + +## Messages + +### Reboot recommended + +When a reboot is recommended and Livepatch is applied, the message names the next boot kernel and counts the CVEs it fixes that neither the running kernel nor the applied live patches fix. The counts are grouped by severity: + +```text +*** Kernel upgrade and reboot required. + +Canonical Livepatch has applied live patches for 3 CVEs in the running kernel. + +Rebooting will load kernel 6.8.0-50-generic, which has patches for +5 CVEs not fixed in the running kernel or by the applied livepatch: + 1 critical + 4 high = 5 CVEs + +Consider rebooting. *** +``` + +When Canonical has published an even newer kernel in the same series and flavour as the next boot kernel, the message adds a paragraph about the CVEs fixed in that latest kernel: + +```text +Canonical has published kernel 6.8.0-52-generic, which has patches for +19 CVEs not fixed in the running kernel or by the applied livepatch: + 2 critical + 5 high + 12 medium = 19 CVEs + +Consider upgrading to the latest available kernel, and rebooting. *** +``` + +The information about the newest kernel is only informational. It never changes the recommendation result or the reboot notice. + +### Protected + +When Livepatch covers the running kernel, the message lists up to three of the CVEs fixed by the applied live patches: + +```text +*** Canonical Livepatch has protected this system against CVE-2024-1, CVE-2024-2 and CVE-2024-3 (and 2 more). Upgrade to the latest secure kernel before 2025-06-01 *** +``` + +The date is the end of the kernel's SRU security coverage. If the date isn't available, the message ends with `Upgrade to the latest secure kernel at a suitable time` instead. + +## Message of the day + +The MOTD shows the recommendation as follows: + +| Result | When the message is shown | +| --- | --- | +| Exit status `0` | Always, whichever reboot notification policy is set. | +| Exit status `1` or `2` | When the result includes a message, no system reboot notice is pending, and the [reboot notification policy](/client/how-to-guides/configuration/configure-reboot-notification-policy.md) is `livepatch-aware`. | +| Exit status `3`, or a timeout | Never. | + +When a system reboot notice is pending, the system's own "System restart required" message is shown instead of the Livepatch protected message, so that the two messages don't contradict each other. + +## Status output + +The `kernel-upgrade` block in the `status` output shows the evidence behind the recommendation. It's available with `--format json` and `--format yaml`: + +```yaml +kernel-upgrade: + status: upgrade-available + running-kernel: linux-image-6.8.0-40-generic + next-boot-kernel: linux-image-6.8.0-50-generic + fixed-by-next-boot-kernel-version-summary: + critical: 1 + high: 4 + medium: 30 + latest-kernel: linux-image-6.8.0-52-generic + fixed-by-latest-kernel-version-summary: + critical: 2 + high: 5 + medium: 40 +``` + +| Field | Description | +| --- | --- | +| `status` | `upgrade-available` when the next boot kernel fixes CVEs that the running kernel doesn't, `not-available` when it fixes none, or `same-kernel` when the running and next boot kernels are the same. | +| `running-kernel` | The kernel package that's currently running. | +| `next-boot-kernel` | The kernel package that will boot after a reboot. | +| `fixed-by-next-boot-kernel-version-summary` | The number of CVEs fixed by the next boot kernel and not by the running kernel, per severity. | +| `latest-kernel` | A newer kernel in the same series and flavour as the next boot kernel. Shown only when it exists. | +| `fixed-by-latest-kernel-version-summary` | The number of CVEs fixed by the latest kernel and not by the running kernel, per severity. Shown only with `latest-kernel`. | + +Severities with no CVEs are omitted. With `--verbose`, the full `fixed-by-next-boot-kernel-version` and `fixed-by-latest-kernel-version` CVE lists are shown too. The default `yaml` or `json` output doesn't show these fields. + +## See also + +* [How reboot notices are removed after a kernel update](/client/explanation/architecture/reboot-marker-suppression.md) +* [Check the Livepatch Client status](/client/how-to-guides/operations/check-client-status.md) diff --git a/docs/server/how-to-guides/deployment/deploy-cve-service-via-snap.md b/docs/server/how-to-guides/deployment/deploy-cve-service-via-snap.md index a1d1d9c..d8a1be8 100644 --- a/docs/server/how-to-guides/deployment/deploy-cve-service-via-snap.md +++ b/docs/server/how-to-guides/deployment/deploy-cve-service-via-snap.md @@ -88,8 +88,12 @@ sudo snap set canonical-livepatch-server lp.cve-sync.proxy.no-proxy="" By default, the refresh interval is one hour and the proxy is disabled. +Both `lp.cve-lookup.enabled` and `lp.cve-sync.enabled` must be enabled for client machines to receive CVE information, including the kernel upgrade information. + When the Livepatch Server receives fixed CVE data from the CVE service, it also receives a digest computed by the CVE service. Upon requesting CVE data, the server provides the CVE service with the digest. If the digest has not changed on the CVE service, the request is rejected with a "Not Modified" HTTP code, preventing the server from repeatedly downloading the same data. ## Next steps The Livepatch Server snap is now integrated with the CVE service snap, allowing client machines to receive fixed CVE information about their installed patches. + +To learn how clients use this information to recommend reboots, see [how kernel upgrade recommendations work](/client/explanation/architecture/how-kernel-upgrade-recommendations-work.md). From 2ea1637ba95c0548e46276bf61f2045834f856e4 Mon Sep 17 00:00:00 2001 From: Prinson Fernandes Date: Wed, 14 Oct 2026 16:54:56 +0530 Subject: [PATCH 2/4] Add changelog and address PR comments --- CHANGELOG.md | 13 +++++++++++++ docs/.custom_wordlist.txt | 1 + .../platform/kernel-upgrade-recommendation.md | 2 +- 3 files changed, 15 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bb11f7a..ad33f65 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Added + +- Added a how-to guide for configuring the reboot notification policy of the Livepatch Client. +- Added a reference page for the kernel upgrade recommendation, covering its results, messages, message of the day rules, and status output. +- Added an explanation of how kernel upgrade recommendations work. +- Added an explanation of how the Livepatch Client removes the pending reboot notice after a kernel update, and the effect on other tools. + +### Changed + +- Documented the `reboot-notification-policy` option in the Livepatch Client configuration options. +- Added a "Livepatch reboot recommendation" section to the "When to reboot" explanation. +- Noted in the CVE service deployment guide that both `lp.cve-lookup.enabled` and `lp.cve-sync.enabled` are required for clients to receive kernel upgrade information, and linked to the new explanation. + ## [1.0.0] - 2026-06-18 ### Added diff --git a/docs/.custom_wordlist.txt b/docs/.custom_wordlist.txt index 7d4197c..6e72853 100644 --- a/docs/.custom_wordlist.txt +++ b/docs/.custom_wordlist.txt @@ -167,3 +167,4 @@ xml yaml YouTube yq +Severities diff --git a/docs/client/reference/platform/kernel-upgrade-recommendation.md b/docs/client/reference/platform/kernel-upgrade-recommendation.md index 982e946..5d9c0a8 100644 --- a/docs/client/reference/platform/kernel-upgrade-recommendation.md +++ b/docs/client/reference/platform/kernel-upgrade-recommendation.md @@ -71,7 +71,7 @@ The information about the newest kernel is only informational. It never changes ### Protected -When Livepatch covers the running kernel, the message lists up to three of the CVEs fixed by the applied live patches: +When the recommendation says the reboot can wait because the applied Livepatches cover the CVEs fixed by the next boot kernel, the message lists up to three of the CVEs fixed by the applied live patches: ```text *** Canonical Livepatch has protected this system against CVE-2024-1, CVE-2024-2 and CVE-2024-3 (and 2 more). Upgrade to the latest secure kernel before 2025-06-01 *** From 7793925008ee0c6366c23bdea3ef4f474c93de4a Mon Sep 17 00:00:00 2001 From: Prinson Fernandes Date: Wed, 14 Oct 2026 16:57:35 +0530 Subject: [PATCH 3/4] Fix spellcheck --- docs/.custom_wordlist.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/.custom_wordlist.txt b/docs/.custom_wordlist.txt index 6e72853..c758f7e 100644 --- a/docs/.custom_wordlist.txt +++ b/docs/.custom_wordlist.txt @@ -168,3 +168,4 @@ yaml YouTube yq Severities +Livepatches \ No newline at end of file From f978f83dac427070fb440aef9df72e1b53c6a831 Mon Sep 17 00:00:00 2001 From: Prinson Fernandes Date: Fri, 16 Oct 2026 14:17:13 +0530 Subject: [PATCH 4/4] Minor doc update --- docs/client/reference/platform/kernel-upgrade-recommendation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/client/reference/platform/kernel-upgrade-recommendation.md b/docs/client/reference/platform/kernel-upgrade-recommendation.md index 5d9c0a8..e909095 100644 --- a/docs/client/reference/platform/kernel-upgrade-recommendation.md +++ b/docs/client/reference/platform/kernel-upgrade-recommendation.md @@ -25,7 +25,7 @@ The recommendation is the exit status of `canonical-livepatch kernel-upgrade-req | Exit status | Meaning | | --- | --- | | `0` | A reboot is recommended because of an unpatchable or uncovered vulnerability, an expired Livepatch SRU window, or the end of kernel series support. | -| `1` | Livepatch covers the CVEs that matter for the running kernel. The reboot can wait for a maintenance window. | +| `1` | The applied live patches cover all the CVEs that the next boot kernel fixes and the running kernel doesn't. The reboot can wait for a maintenance window. | | `2` | The client doesn't have enough information to make a recommendation. | | `3` | An error prevented the client from determining a result. |