HOL-6340 Provide a Zero Downtime Update for Your Cloud Infrastructure
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Oracle® Linux Administrator's Solutions Guide for Release 6
Oracle® Linux Administrator's Solutions Guide for Release 6 E37355-64 August 2017 Oracle Legal Notices Copyright © 2012, 2017, Oracle and/or its affiliates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable: U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. -
Adaptive Android Kernel Live Patching
Adaptive Android Kernel Live Patching Yue Chen Yulong Zhang Zhi Wang Liangzhao Xia Florida State University Baidu X-Lab Florida State University Baidu X-Lab Chenfu Bao Tao Wei Baidu X-Lab Baidu X-Lab Abstract apps contain sensitive personal data, such as bank ac- counts, mobile payments, private messages, and social Android kernel vulnerabilities pose a serious threat to network data. Even TrustZone, widely used as the se- user security and privacy. They allow attackers to take cure keystore and digital rights management in Android, full control over victim devices, install malicious and un- is under serious threat since the compromised kernel en- wanted apps, and maintain persistent control. Unfortu- ables the attacker to inject malicious payloads into Trust- nately, most Android devices are never timely updated Zone [42, 43]. Therefore, Android kernel vulnerabilities to protect their users from kernel exploits. Recent An- pose a serious threat to user privacy and security. droid malware even has built-in kernel exploits to take Tremendous efforts have been put into finding (and ex- advantage of this large window of vulnerability. An ef- ploiting) Android kernel vulnerabilities by both white- fective solution to this problem must be adaptable to lots hat and black-hat researchers, as evidenced by the sig- of (out-of-date) devices, quickly deployable, and secure nificant increase of kernel vulnerabilities disclosed in from misuse. However, the fragmented Android ecosys- Android Security Bulletin [3] in recent years. In ad- tem makes this a complex and challenging task. dition, many kernel vulnerabilities/exploits are publicly To address that, we systematically studied 1;139 An- available but never reported to Google or the vendors, droid kernels and all the recent critical Android ker- let alone patched (e.g., exploits in Android rooting nel vulnerabilities. -
Consolidation Using Oracle's SPARC Virtualization Technologies
&RQVROLGDWLRQ8VLQJ2UDFOH¶V63$5& Virtualization Technologies ORACLE TECHNICAL WHITE PAPER | OCTOBER 2015 Table of Contents Introduction 3 Designing a Consolidated Infrastructure 6 Seven Areas of Consideration for Consolidation 6 Security Isolation 6 Resource Isolation 6 Workload Efficiency 7 Availability 7 Serviceability 7 Flexibility 8 Agility 8 Requirements-Based Consolidation 9 Oracle Virtualization Technologies 9 Physical Domains (PDoms) 9 Oracle VM Server for SPARC 10 Control, I/O, Service, Guest, and Guest Root Domain Roles 11 Guest Domains Model 11 Redundant Guest Domains Model 12 SR-IOV or Direct I/O Domains Model 13 Redundant SR-IOV Domains Model 14 Guest Root Domains Model 15 Oracle Solaris Zones 16 Native Branded Zones 17 1 | ENTER TITLE OF DOCUMENT HERE Kernel Zones 18 Non-Native Branded Zones 19 Combining Virtualization Technologies 20 Redundant Guest Domains and Oracle Solaris Zones 22 Guest Root Domains and Oracle Solaris Zones 23 Root Domains and SR-IOV Domains 24 Hybrid Combination of All Oracle Virtualization Technologies 26 Summary of Characteristics for Combined Virtualization Technologies 27 Conclusion 28 About Oracle Elite Engineering Exchange 28 2 | CONSOLIDATION USING ORACLE¶¶663$5&9,578$/,=$7ION TECHNOLOGIES Introduction This paper provides a high-level overYLHZRI2UDFOH¶VYLUWXDOL]DWLRQWHFKQRORJLHVDQGit introduces a methodology for evaluating their features so that they can be matched against workload requirements by observing the following seven characteristics: » Security isolation » Resource isolation » Efficiency » Availability » Serviceability » Flexibility » Agility This methodology could also be used to evaluate other Oracle virtualization technologies, as well as other combinations of Oracle virtualization technologies not covered in this paper, such as pluggable databases in Oracle Database 12c or application consolidation within Oracle WebLogic Server. -
Virtualization Strategy with Oracle VM and Oracle Linux
Virtualization Strategy with Oracle VM and Oracle Linux Bjorn Naessens Join the buzz: • Wifi pass: BANQ • Twitter – #oracleopenxperience – @oopenxperience 2 About me • Certifications – OVM 2.x/3.x Implementation Specialist – Oracle Linux 5.x Certified Administrator • Twitter – @BjornNaessens • Blog – http://bjornnaessens.wordpress.com 3 Agenda • Oracle’s Virtualization Strategy • Oracle VM 3.x • Oracle Linux • Oracle Enterprise Manager 12c • Xsigo Data Center Fabric • Q&A 4 Virtualization Strategy Oracle VM 3.x Oracle Linux Oracle’s Virtualization Strategy OEM12c Xsigo Q&A 5 Virtualization Strategy Oracle VM 3.x Oracle Linux OEM12c Xsigo Q&A Oracle’s Server to Desktop Portfolio 6 Benefits of Virtualization • Virtualization offers cost savings benefits – Server consolidation Virtualization Strategy – Lower energy, facility and labor costs Oracle VM 3.x – Lower Licensing Cost Oracle Linux OEM12c Xsigo Q&A • Virtualization offers additional benefits – Standardization – Isolate Applications – Optimize Resources 7 Oracle’s Virtualization Strategy “Virtualization that makes software easier to deploy, easier to manage, and easier to support. Not Virtualization for Virtualization’s sake.” Virtualization Strategy Oracle VM 3.x Oracle Linux OEM12c Xsigo Q&A 8 Virtualization Strategy Oracle VM 3.x Oracle Linux Oracle VM 3.x for x86 OEM12c Xsigo Q&A 9 Positioning • for both Oracle and non-Oracle applications • The only x86 server virtualization software supported Virtualization Strategy and certified for all Oracle software Oracle VM 3.x Oracle Linux • Almost no hypervisor overhead OEM12c Xsigo • Used in Oracle’s Engineered Systems Q&A (ODA, exadata, exalogic and exalytics) • Can be used to limit your license cost of Oracle Products 10 Positioning Continued • Oracle is in the “Challengers” quadrant. -
Protecting Your Linux Systems with Oracle Ksplice
Staying Ahead of Cyberthreats: Protecting Your Linux Systems with Oracle Ksplice The Advantages Of Zero-Downtime Patching April 23, 2020 Copyright © 2020, Oracle and/or its affiliates Public TABLE OF CONTENTS Introduction 2 Why Patching Matters 2 About Oracle Ksplice 3 Other Benefits 3 Conclusion 4 Learn More 4 1 WHITE PAPER | Staying Ahead of Cyberthreats: Protecting Your Linux Systems Copyright © 2020, Oracle and/or its affiliates |Public INTRODUCTION IT systems require regular patching for security, performance, and compliance reasons. For Linux operating system (OS) kernel updates, which include “Availability requirements important new security enhancements and bug fixes, releases happen about 1 are on the rise for once per month. These updates help keep systems current with the latest organizations undergoing innovations. However, manually patching systems has many inherent digital transformations. challenges and difficulties which tends to delay their timely application. For this Downtimes are costly, reason, zero-downtime patching solutions for Linux, like Oracle Ksplice, are with unplanned becoming essential tools. In this paper, Oracle Ksplice’s capabilities and many infrastructure downtimes advantages are explained. costing $100,000 per hour on an average. With Why Patching Matters the possibility of every organization being a Inadequate patch management can leave loopholes in the IT infrastructure leading to target for cyberattacks various security and performance issues. Ideally, patches should be applied shortly after and attackers moving very release to ensure the latest system protections. Patching typically requires downtime quickly to exploit system which, depending on operations, can require weeks or months of advanced planning. vulnerabilities, IDC Most Linux patching also traditionally happens at the disk level for file systems, which has recommends several disadvantages. -
Kshot: Live Kernel Patching with SMM and SGX
KShot: Live Kernel Patching with SMM and SGX Lei Zhou∗y, Fengwei Zhang∗, Jinghui Liaoz, Zhengyu Ning∗, Jidong Xiaox Kevin Leach{, Westley Weimer{ and Guojun Wangk ∗Department of Computer Science and Engineering, Southern University of Science and Technology, Shenzhen, China, zhoul2019,zhangfw,ningzy2019 @sustech.edu.cn f g ySchool of Computer Science and Engineering, Central South University, Changsha, China zDepartment of Computer Science, Wayne State University, Detroit, USA, [email protected] xDepartment of Computer Science, Boise State University, Boise, USA, [email protected] Department of Computer Science and Engineering, University of Michigan, Ann Arbor, USA, kjleach,weimerw @umich.edu { f g kSchool of Computer Science and Cyber Engineering, Guangzhou University, Guangzhou, China, [email protected] Abstract—Live kernel patching is an increasingly common kernel vulnerabilities also merit patching. Organizations often trend in operating system distributions, enabling dynamic up- use rolling upgrades [3], [6], in which patches are designed dates to include new features or to fix vulnerabilities without to affect small subsystems that minimize unplanned whole- having to reboot the system. Patching the kernel at runtime lowers downtime and reduces the loss of useful state from running system downtime, to update and patch whole server systems. applications. However, existing kernel live patching techniques However, rolling upgrades do not altogether obviate the need (1) rely on specific support from the target operating system, to restart software or reboot systems; instead, dynamic hot and (2) admit patch failures resulting from kernel faults. We patching (live patching) approaches [7]–[9] aim to apply present KSHOT, a kernel live patching mechanism based on patches to running software without having to restart it. -
Porting Linux Embedded Linux Conference (Europe)
Porting Linux Embedded Linux Conference (Europe) Porting Linux About Jon Masters ● Been playing with Linux for 14 years (and the kernel for 13 of those), since the age of 13. ● Built embedded NMR scientific instruments, worked with Montavista UK, now at Red Hat. ● Author of the LKML Summary Podcast and the kernel column in Linux User & Developer. ● Co-author of Building Embedded Linux Systems (second edition) – O'Reilly (2008) ● My car still has an empeg :) Porting Linux Overview ● Why port Linux anyway? ● Background pre-requisities ● Early board work ● Bootloader bringup ● Initial kernel bringup ● Debugging ● Working with Upstream ● Trends Porting Linux Why port Linux anyway? ● Linux is very portable ● Supports 23 architectures in the upstream “mainline” kernel tree of Linus Torvalds. ● Kernel is mostly written in C, with some assembly (most architectures only need a dozen such files) ● Split between high-level generic functions and low- level functions to abstract architectural differences. Porting Linux Why port Linux anyway? ● Linux is competitive ● The number of Linux kernel developers contributing to the official kernel has tripled since 2005. ● Feature growth continues with an average of 10K new lines of source code added every day. ● In the hour you spend here 5.45 patches will on average be added to the upstream Linux kernel. ● Source: Linux Foundation analysis Porting Linux Why port Linux anyway? ● Linux is cost effective. ● A large amount of code to build upon. ● Large (growing) community of developers. ● I think we all know the rest. Porting Linux Background pre-requisities ● Hardware ● Development board or simulator – Optional debugger, some kind of UART – Boards range in value from $200-$crazy – Implement the same architecture and platform as the final design but maybe with a number of hacks. -
Oracle VM Server Virtualization
1 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle. 2 Copyright © 2012,2011, Oracle and/or its affiliates. All rights Insert Information Protection Policy Classification from Slide 8 Allreserved. rights reserved. ORACLE PRODUCT LOGO Übersicht und Aktuelles zu Virtualisierungstechnologien im Oracle-Portfolio Franz Haberhauer LOGO 3 CopyrightChief © 2012, Oracle Technologist and/or its affiliates. Hardware Presales Northern Europe All rights reserved. Virtualisierung • Abstraktionsschicht zwischen Ressource und Nutzer – zwischen OS und HW: Hypervisor-basierte virtuelle Maschinen – zwischen Anwendung und OS: Ausführungsumgebungen – Effizienz • Ressourcen transparent aufteilen oder zusammenfassen – Isolation der Nutzer gemeinsamer Ressourcen – Ressourcemanagement • Provisionierung und Management – Flexibilität durch Entkopplung von Abhängigkeiten 4 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Wozu virtualisieren? Konsolidierung Flexibilität Effizienz - primär CPU -Provisionierung - Scaleout im Management - RAM? Netzwerk? - Golden Images - OS-Instanzen - Image Archiv -
Oracle VM Server for X86 Virtualization and Management
ORACLE DATA SHEET Oracle VM Server for x86 Virtualization and Management Oracle VM Server for x86 is a zero license cost server virtualization and management solution that makes enterprise applications easier to deploy, manage, and support. Backed worldwide by affordable enterprise-quality support for both Oracle and non-Oracle environments, Oracle VM reduces operations and support costs while increasing IT efficiency and agility. Engineered for Open Cloud Infrastructure ORACLE’S SERVER VIRTUALIZATION AND MANAGEMENT SOLUTION You are facing increased operating costs and inefficient resource utilization, and have an eye toward cloud computing. Your virtualization solution has to increase datacenter flexibility, meet KEY FEATURES AND BENEFITS your price/performance needs, and make applications easier to deploy, manage, and support. • Complete server virtualization and management solution with zero license Oracle VM delivers: cost • High performance and scalability: Low-overhead architecture with the Xen® hypervisor • Modern, low overhead architecture provides scalable performance under increasing workloads. Supports up to 384 physical based on the Xen hypervisor for leading price/performance CPUs and 6TB memory with each guest VM supporting up to 256 virtual CPUs and 2,000,000MB memory to accommodate the most demanding enterprise and cloud • Speeds application deployment with applications. Oracle VM Templates and virtual appliances • Broad guest operating system support: Oracle Linux, Oracle Solaris, Red Hat Enterprise Linux, SUSE Linux Enterprise Server, CentOS, Microsoft Windows. • Full Oracle VM Manager command-line interface (CLI) and Web Services API • Modern Dom0 kernel: Oracle Unbreakable Enterprise Kernel (UEK) Release 4 offers high (WS-API) allow greater automation and performance and streamlined partner certifications. interoperability • Dom0 UEK update on live systems: Oracle Ksplice updates the Dom0 UEK with all of the • Advanced virtualization features important security patches with no server reboot required. -
Oracle Linux System Administration I
Oracle Linux System Administration I Dieser Kurs im Web Die Schulung hilft Ihnen, eine Reihe von Fähigkeiten zu entwickeln, einschließlich der Installation, der Verwendung des Unbreakable Enterprise Kernel, der Alle tagesaktuellen Informationen Konfiguration von Linux-Diensten, der Vorbereitung des Systems für die Oracle- und Möglichkeiten zur Bestellung finden Sie unter dem folgenden Link: Datenbank, der Überwachung und der Fehlerbehebung. www.experteach.de/go/026S Nach diesem Kurs verfügen Sie über das Wissen und die Fähigkeiten, typische Vormerkung Probleme von Administratoren zu lösen, und verstehen das Kernel- Sie können auf unserer Website einen Platz Entwicklungsmodell und die Linux-Distributionen. Machen Sie sich damit vertraut, kostenlos und unverbindlich für 7 Tage reservieren. wie Oracle Linux Ihnen die neuesten Linux-Innovationen bietet, die extreme Dies geht auch telefonisch unter 06074 4868-0. Leistung, erweiterte Skalierbarkeit und Zuverlässigkeit für Garantierte Kurstermine Unternehmensanwendungen und -systeme ermöglichen. Für Ihre Planungssicherheit bieten wir stets eine große Auswahl garantierter Kurstermine an. Kursinhalt • Course Introduction Ihr Kurs maßgeschneidert • Introduction to Oracle Linux Diesen Kurs können wir für Ihr Projekt exakt an • Installing Oracle Linux 7 Ihre Anforderungen anpassen. • Oracle Linux 7 Boot Process • System Configuration • Package Management • Ksplice • Automate Tasks • Kernel Module Configuration • User and Group Administration • Partitions, File Systems, and Swap • Implementing the XFS File System • Implementing the Btrfs File System • Storage Administration • Network Configuration • File Sharing • OpenSSH Service • Security Administration • Oracle on Oracle • System Monitoring E-Book Sie erhalten die englischsprachigen Original-Unterlagen in Form eines Oracle University eKits. Zielgruppe • System Administrator • Linux Administrator • Entwickler Voraussetzungen • Arten von Benutzerkonten & Arbeiten mit Dateien und Verzeichnissen unter Unix • Textbearbeitung mit vi & Unix-Prozesskontrolle Training Preise zzgl. -
Oracle® VM Manager User's Guide for Release 3.3
Oracle® VM Manager User's Guide for Release 3.3 E50250-09 July 2017 Oracle Legal Notices Copyright © 2011, 2017 Oracle and/or its affiliates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable: U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. -
Oracle Ksplice for Oracle Linux
Oracle Ksplice for Oracle Linux Oracle Corporation Oracle Corporation Oracle Ksplice Oracle Ksplice is an exciting new addition to the Oracle Linux Premier Support subscription. The Oracle Ksplice technology allows customers to update their systems with new kernel security errata (CVEs) without the need to reboot the system. This allows customers to remain current with their OS vulnerability patches while at the same time minimizing downtime. Oracle Ksplice actually actively applies these updates to the running kernel image, not just an on-disk change that would only take effect after a subsequent reboot. As a general rule, the Linux kernel receives security updates approximately once a month. For any general purpose Operating System on the market today, applying these updates requires the system administrator to schedule downtime and reboot the server into the new OS kernel with the security updates. As system setups become more and more complex with multi-system interdependencies, the ability to schedule reboots is becoming more and more difficult and costly. Oracle Ksplice is available as part of the Oracle Linux Premier and Premier Limited support subscriptions. It is also part of the Oracle Premier Support for Systems and Operating Systems subscriptions offering. Oracle Linux Basic, Basic Limited and Network Support subscribers can contact their sales representatives to discuss potential upgrade of their subscription to a Premier Support plan. Another requirement for the Oracle Ksplice updates, is the use of the Oracle Unbreakable Enterprise Kernel(UEK). The lowest Linux kernel version at time of writing is 2.6.32-100.28.9. This kernel (and newer) can be installed on both Oracle Linux(OL) 5 and 6 distribution versions.