Netskope Publisher runs on Ubuntu Linux. To keep the underlying OS kernel secure and up to date, Publisher relies on Ubuntu’s native unattended-upgrades mechanism for automated kernel patching.
This article explains how kernel updates work, when they take effect, and the recommended configuration for a fully automated patching experience.
Mechanism: unattended-upgrades
Publisher uses Ubuntu’s unattended-upgrades package (for updates) to automatically download and install security updates, including kernel packages.
How It Works
• The unattended-upgrades service runs daily.
• It checks Ubuntu’s official security repository for available updates and installs them automatically.
• Kernel packages are included, but new kernel versions are not published daily. They are released by Ubuntu on an as-needed basis (typically a few times per month).
• Once a new kernel package is installed, it does not take effect until the Publisher is rebooted.
Key takeaway: unattended-upgrades ensures patches are downloaded and installed promptly, but a reboot is required to activate a new kernel.
Reboot: When Does the New Kernel Take Effect?
A pending kernel update is applied upon the next Publisher reboot. There are two ways this happens: via Publisher Auto-Update and Manual/Scheduled Reboot.
Via Publisher Auto-Update (Recommended)
When Publisher Auto-Update is enabled:
• Netskope releases new Publisher versions approximately monthly.
• During the auto-update process, if the system detects a pending reboot (like a kernel update waiting to be applied), the reboot occurs automatically as part of the update.
• This means enabling auto-update effectively ensures kernel updates are applied monthly without manual intervention.
Manual/Scheduled Reboot
If auto-update is not enabled, or if you require kernel updates to be applied more frequently:
• Schedule a reboot at least once a month.
• Verify whether a reboot is pending via the Publisher wizard UI or by running:
ls /var/run/reboot-required
Recommended Configuration
For a fully automated, hands-off patching experience, enable both settings:
| Setting | Recommendation |
|---|---|
| Enable Kernel Updates | On |
| Publisher Auto-Update | Enabled (monthly or more frequent) |
With both enabled:
1. unattended-upgrades downloads kernel patches as they become available.
2. Publisher auto-update triggers monthly, reboots the system, and the latest kernel takes effect.
If auto-update is disabled, you must schedule manual reboots to apply pending kernel updates.
Platform Support
Kernel update capability varies by Publisher image type and version:
| Publisher Type | Kernel Updates | Notes |
|---|---|---|
| AMI | Available by default | No action required |
| VHD / VHDX | Available by default | No action required |
| OVA (fresh install, R111+) | Available by default | No action required |
| OVA (deployed before R111) | Requires enablement | See Enable Kernel Updates on Older OVA Publishers |
How to Verify
To confirm kernel update capability, SSH into the Publisher and run:
apt list --installed | grep linux-image-generic
If linux-image-generic is present, kernel updates are functional.
Frequently Asked Questions
Q: Are kernel updates applied automatically?
A: The kernel package is downloaded and installed automatically by unattended-upgrades. However, the new kernel only takes effect after a reboot. If auto-upgrade is enabled, the reboot happens automatically during the next Publisher upgrade cycle.
Q: How often do kernel updates occur?
A: unattended-upgrades checks daily. Kernel packages are released by Ubuntu as needed (typically a few times per month). The kernel becomes active upon the next reboot.
Q: Does the Publisher reboot automatically after a kernel update?
A: Not immediately. The reboot happens when:
• Publisher auto-upgrade runs (recommended), or
• An administrator manually reboots the Publisher.
Q: Is there a difference between OVA and non-OVA Publishers?
A: For AMI, VHD, and VHDX, kernel updates work out of the box. For OVA Publishers deployed before R111, a one-time enablement process is required (disk expansion + package installation). Refer to this article: Enable Kernel Updates on Older OVA Publishers.
Q: What about CVEs that affect the host OS?
A: Publisher runs on Ubuntu, which may be affected by OS-level CVEs in kernel or system packages. Enabling kernel updates and unattended-upgrades ensures these CVE patches are applied automatically as Ubuntu publishes fixes. Combined with auto-upgrade (which triggers a reboot), this provides timely remediation without manual intervention.
For customers who perform host OS vulnerability scanning, keeping both Enable Kernel Updates and Auto-Upgrade enabled is the recommended approach to maintain a patched baseline.