Applying security patches without reinstalling the whole system

takeda · Thursday at 1:44 AM

So FreeBSD used to provide what to update specific parts of the system from source in their security advisories/erratas.

Then quite a while ago (it's been several years) stopped doing that.

I'm wondering:

what was the reason? Was it because people used freebsd-upgrade
is there a way for me to figure that out?

For example: https://www.freebsd.org/security/advisories/FreeBSD-EN-26:18.tzdata.asc
Is it enough to just run:

 cd /usr/src/share/zoneinfo

make install

?

Is there some simple way to figure that out?

Phishfry · Thursday at 2:18 AM

I have no idea about your system because of lack of detail.
This still works for me.
freebsd-update fetch install
Depending on patches maybe reboot then check.
freebsd-version -kru

richardtoohey2 · Thursday at 2:30 AM

The OP wants to apply patches and build from source, but is saying the simple instructions on how to do so no longer seem to be provided.

Like you, I use freebsd-update and I do not know the answers to the patching-when-building-from-source questions.

takeda · Thursday at 2:34 AM

Yeah exactly I guess I'm now the minority that still builds the system from the source.

richardtoohey2 · Thursday at 2:46 AM

The instructions are still there, but are rather "broad" - build everything in this case (from the tzdata.asc patch above):

Code:

3) To update your system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch https://security.FreeBSD.org/patches/EN-26:18/tzdata-2026c.patch
# fetch https://security.FreeBSD.org/patches/EN-26:18/tzdata-2026c.patch.asc
# gpg --verify tzdata-2026c.patch.asc

b) Apply the patch.  Execute the following commands as root:

# cd /usr/src
# patch -E -p0 < /path/to/patch

c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.

Restart all the affected applications and daemons, or reboot the system.

So you are hoping for narrower instructions in subsection (c), rather than build & install the world?

richardtoohey2 · Thursday at 2:53 AM

Going back to 2019, the tzdata instructions were build world level:

https://www.freebsd.org/security/advisories/FreeBSD-EN-19:18.tzdata.asc

Even further back, another random sample tzdata patch - build world:

https://www.freebsd.org/security/advisories/FreeBSD-EN-14:10.tzdata.asc

Not mixing it up with OpenBSD?

takeda · Thursday at 3:57 AM

I guess it was a "little bit" longer than I remembered, I think the switch was around 2012:

https://www.freebsd.org/security/advisories/FreeBSD-SA-12:03.bind.asc

Code:

b) Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch
# cd /usr/src/lib/bind/
# make obj && make depend && make && make install
# cd /usr/src/usr.sbin/named
# make obj && make depend && make && make install

cracauer@ · Friday at 5:56 AM

From the advisory:

IV. Workaround

The system administrator can install an updated version of the IANA Time Zone
Database from the misc/zoneinfo port and run tzsetup(8).

takeda · Friday at 6:30 AM

Good point, I missed it, but I was wondering of something generic, for example this doesn't have a workaround:

https://www.freebsd.org/security/advisories/FreeBSD-SA-26:33.unbound.asc

Initially I didn't mind to do installworld, once in a while, but recently there were tons of security advisories, AFAIR there were two batches a week or two apart.

cracauer@ · Friday at 6:55 AM

You can always solve this with a `make installworld` as long as the kernel is not affected.

takeda · 2026-08-02T08:42:57+0100

Yes that's true, but to do it properly I should reboot to single user, then run etcupdate. On top of that the inodes of files that not supposed to change change so it also impacts backup.

cracauer@ · 2026-08-02T13:59:50+0100

takeda said:
Yes that's true, but to do it properly I should reboot to single user, then run etcupdate. On top of that the inodes of files that not supposed to change change so it also impacts backup.

I never run etcupdate. Every now and then I add missing UIDs and GIDs.

Emrion · 2026-08-02T14:30:41+0100

The main reason is: don't compile if you can update on an other way.

There is freebsd-update, but it's not working for STABLE or CURRENT versions.
If you are on RELEASE versions, it's just a waste of time, unless you have a personal patch somewhere in the system.

And now, even if you are on STABLE or CURRENT versions, pkgbase does updates without compiling.

So, are you sure you're still needing compiling or is it just a habit?

takeda · 2026-08-03T00:46:31+0100

cracauer@ said:
I never run etcupdate. Every now and then I add missing UIDs and GIDs.

But the /usr/src/UPDATING says:

[4] Note: This step is non-optional. Failure to do this step
can result in a significant reduction in the functionality of the
system. Attempting to do it by hand is not recommended and those
that pursue this avenue should read this file carefully, as well
as the archives of freebsd-current and freebsd-hackers mailing lists
for potential gotchas. See etcupdate(8) for more information.

Yeah, I know with security patches it's unlikely to change, but there is a chance and the footnote must have been added because people weren't running it.
In any case this is just one step, the others still apply.

Emrion said:
So, are you sure you're still needing compiling or is it just a habit?

I do have some minor changes, but main reason is that I enable optimizations for my CPU.

Anyway I know I could use freebsd-upgrade and that's why I mentioned it in the initial post, I'm just wondering if there's an easy way to just run subset installation, but I'm guessing it's not unless you intimately know how how the Makefiles are designed.

cracauer@ · 2026-08-03T07:06:06+0100

Ah schnickschnack. One of my -current system has /etc files reaching back to 2004.