Rocky Linux Introduces New Security Repository with Urgent Fixes
Introduction
The Rocky Linux team has introduced a new Security Repository feature that enables users to access expedited security fixes for critical vulnerabilities.
Background
The decision to implement this feature was prompted by two recent vulnerabilities, CopyFail and Dirty Frag, which were subject to public proof-of-concept exploits before upstream patches became widely available.
According to the Rocky Linux team, “In these situations, Rocky Linux administrators lacked a supported path to a patched package, leading to the development of the Security Repository.”
How it Works
- The Security Repository is designed for specific scenarios where a significant vulnerability is publicly disclosed, exploit code is circulating, and upstream fixes have not yet been released.
- Packages within the Security Repository are versioned to be superseded by the next upstream release once a fix is made available.
- If Red Hat releases a patch, the upstream package will replace the Rocky version.
- The repository does not issue traditional errata records, and updates do not appear in `dnf update –security` output.
Future Developments
In cases where Rocky releases a patch and upstream declines to address the underlying issue, the next upstream kernel release will replace the Rocky-patched version, requiring users to version-lock their kernel to retain the fix.
Conclusion
The introduction of the Security Repository demonstrates Rocky Linux’s commitment to providing timely and effective solutions to address emerging threats.
About Author
English