Security Advisory - release version, user or kernel patch level?

[Steve O'Hara-Smith]

On Thu, 06 Apr 2017 08:35:01 +0000
zhaghzhagh at openmailbox.org wrote:

> Good morning
> 
> Every now and then I get confused by the version number of security 
> patches.
> 
> For example:
> 
> https://www.freebsd.org/security/advisories/FreeBSD-SA-17:02.openssl.asc:
> 
> ...
> Corrected:      2017-01-26 19:14:14 UTC (stable/11, 11.0-STABLE)
>                  2017-02-23 07:11:48 UTC (releng/11.0, 11.0-RELEASE-p8)
>                  2017-01-27 07:45:06 UTC (stable/10, 10.3-STABLE)
>                  2017-02-23 07:12:18 UTC (releng/10.3, 10.3-RELEASE-p17)
> ...
> 
> [user at domain ~]$ uname -a
> FreeBSD domain.tld 10.3-RELEASE-p11 FreeBSD 10.3-RELEASE-p11 #0: Mon Oct 
> 24 18:47:18 UTC 2016     
> root at amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC  i386
> 
> Guesses:
> 
> 1. 'uname' - 'p11' = kernel patch level (?)

	Correct.

> 2. '10.3-RELEASE-p17' - 'p17' = user patch level (?)

	Correct - user patch level can be ahead of kernel patch level when
there are updates that don't affect the kernel.

> What if there is a security patch that affects only kernel?

	I don't think that's happened (at the very least it will affect src
as well). I would expect both patch levels to bump if it did happen.

> Is it safe in all times to use 'freebsd-version -u' to decide whether my 
> host needs to be updated, upon a security notification is issued? (Don't 
> want to run 'freebsd-update' unnecessarily.)

	Yes it is - or just run freebsd-update fetch periodically, if it
fetches anything then there are patches for your system then you can check
the advisory to see how urgent installation is.

-- 
Steve O'Hara-Smith <steve at sohara.org>