Applying security patches without reinstalling the whole system

[takeda]

So FreeBSD used to provide what to update specific parts of the system from source in their security advisories/erratas.

Then quite a while ago (it's been several years) stopped doing that.

I'm wondering:

• what was the reason? Was it because people used freebsd-upgrade
• is there a way for me to figure that out?

For example: https://www.freebsd.org/security/advisories/FreeBSD-EN-26:18.tzdata.asc
Is it enough to just run:

cd /usr/src/share/zoneinfo
make install

?

Is there some simple way to figure that out?

 

[Phishfry]

I have no idea about your system because of lack of detail.
This still works for me.
freebsd-update fetch install
Depending on patches maybe reboot then check.
freebsd-version -kru

 

[richardtoohey2]

The OP wants to apply patches and build from source, but is saying the simple instructions on how to do so no longer seem to be provided.

Like you, I use freebsd-update and I do not know the answers to the patching-when-building-from-source questions.

 

[takeda]

Yeah exactly I guess I'm now the minority that still builds the system from the source.

 

[richardtoohey2]

The instructions are still there, but are rather "broad" - build everything in this case (from the tzdata.asc patch above):

3) To update your system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch https://security.FreeBSD.org/patches/EN-26:18/tzdata-2026c.patch
# fetch https://security.FreeBSD.org/patches/EN-26:18/tzdata-2026c.patch.asc
# gpg --verify tzdata-2026c.patch.asc

b) Apply the patch.  Execute the following commands as root:

# cd /usr/src
# patch -E -p0 < /path/to/patch

c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.

Restart all the affected applications and daemons, or reboot the system.

So you are hoping for narrower instructions in subsection (c), rather than build & install the world?

 

[richardtoohey2]

Going back to 2019, the tzdata instructions were build world level:

https://www.freebsd.org/security/advisories/FreeBSD-EN-19:18.tzdata.asc

Even further back, another random sample tzdata patch - build world:

https://www.freebsd.org/security/advisories/FreeBSD-EN-14:10.tzdata.asc

Not mixing it up with OpenBSD?

 

[takeda]

I guess it was a "little bit" longer than I remembered, I think the switch was around 2012:

https://www.freebsd.org/security/advisories/FreeBSD-SA-12:03.bind.asc

b) Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch
# cd /usr/src/lib/bind/
# make obj && make depend && make && make install
# cd /usr/src/usr.sbin/named
# make obj && make depend && make && make install