kfiresmith / patch_facts Goto Github PK

EOLs shouldn't be hard coded into the script, or at least not their state but rather their drop-dead date.

We should also account for both ESM on Ubuntu and ELS/EUS on RHEL and CloudLinux-ELS for CentOS.

In rare cases, this script captures bad data due to APT repos being broken.

We should ensure we are capturing a valid number when we write out all_updates and security_updates values.

Example:

        "all_updates": "E: Error: BrokenCount > 0",
        "date_collected": "2021-06-29T11:59+0000",
        "eol": "true",
        "errata_support": "true",
        "needs_reboot": "false",
        "os_updates_broken": "true",
        "security_updates": "E: Error: BrokenCount > 0"

We should use OS tools to determine if a system needs to be rebooted for applied security patches to be active.

Red Hat 6+ variants have /usr/bin/needs-restarting as part of yum-utils. This can be run as a normal user and has the -r flag to simply return 0 if we don't need to restart and 1 if we do need to restart.

For Debian variants, the presence of /var/run/reboot-required is enough.