Linux Kernel Update Reboot Policy

Objective

To ensure that all ECE managed Linux systems remain secure, stable, and compliant by applying critical kernel patches in a timely manner. Kernel updates often contain vital security fixes that are only activated after a system reboot. This policy establishes a clear and predictable schedule for these necessary reboots.

Policy Details

Weeks 1-4: User-Managed Reboot Window

A 4-week countdown is initiated the moment a system automatically installs new security and kernel updates from Canonical or Red Hat.
System administrators and users will be notified of a pending reboot requirement through two primary methods:

A notification will be displayed upon SSH login, indicating that a reboot is required and showing the deadline.
A native desktop notification will alert users in a graphical session of an upcoming reboot and deadline.

During this 4-week period, system owners are strongly encouraged to reboot the system at their convenience. This allows for scheduling during planned maintenance windows to minimize disruption to services.

End of Week 4: Automated Forced Reboot

If the system has not been rebooted by the end of the 4-week window, it will be flagged for a mandatory reboot.
The system will be automatically rebooted during the next available standard maintenance
window @ 7:45 AM Central Time that occurs after the deadline has passed.

User & Administrator Responsibilities

Monitor Notifications: Actively check for reboot announcements advertised during terminal (ssh) and graphical desktop session (gui) logons.
Schedule Maintenance: Proactively schedule reboots within the 4-week grace period to avoid a forced reboot.
Verify System Status: After rebooting, verify that all necessary services have returned to an operational state.