landscape doesn't enforce installation of linux-image-generic, linux-image-virtual, or equivalent

[Paul Gear]

I found a machine today which was registered in landscape and receiving updates, but which did not have a kernel metapackage installed, and thus did not receive updated kernel packages.

Landscape should enforce the use of a suitable linux-image-* to ensure that dependencies on the most recent kernels are included.

Please let me know what logs and other diagnostics you would like gathered for supporting information.

[Adam Collard (adam-collard)]

Landscape is not opinionated on how you manage your machines - a broad sweep of installing a linux-image-* package on all machines is likely to upset some users..

 If you wish to ensure certain packages are installed across a set of machines, you should use package profiles[0].

[0] https://landscape.canonical.com/static/doc/user-guide/ch07.html#definepp

[Paul Gear (paulgear)]

Given that this leaves Landscape clients vulnerable to kernel USNs, shouldn't it at least be worthy of a warning that the machine in question is not receiving appropriate kernel updates?

[Adam Collard (adam-collard)]

On Tue, 21 Feb 2017 at 23:45 Paul Gear <email address hidden> wrote:

> Given that this leaves Landscape clients vulnerable to kernel USNs,
> shouldn't it at least be worthy of a warning that the machine in
> question is not receiving appropriate kernel updates?
>

Well by that logic, every piece of software should check if the kernel is
vulnerable :)

Package profiles are how one does this in Landscape. You will receive an
alert in Landscape for any machines that are not compliant with the package
profile.