Risk(s) in updating libc6

[Rashkae]

Gary Chambers wrote:
> All,
> 
> I have recently migrated a production server from Solaris to Ubuntu
> 10.04 Server LTS and have recently been informed that some packages
> dealing with libc6 need to be upgraded.  My configuration is a normal
> installation with the exception of manually compiled versions of
> Postfix (2.7.1) and Dovecot (1.2.11).  Given the following details of
> my system's current state, can anyone offer insight into whether or
> not upgrading the libc6 packages will break anything?  Thank you very
> much in advance.
> 
> $ lsb_release -a
> No LSB modules are available.
> Distributor ID:	Ubuntu
> Description:	Ubuntu 10.04 LTS
> Release:	10.04
> Codename:	lucid
> 
> $ uname -a
> Linux port 2.6.32-21-server #32-Ubuntu SMP Fri Apr 16 09:17:34 UTC
> 2010 x86_64 GNU/Linux
> 
> $ sudo apt-get upgrade
> Reading package lists... Done
> Building dependency tree
> Reading state information... Done
> The following packages have been kept back:
>   linux-headers-server linux-image-server linux-server
> The following packages will be upgraded:
>   libc-bin libc-dev-bin libc6 libc6-dev libpam-modules libpam-runtime
> libpam0g libpam0g-dev libpng12-0
> 9 upgraded, 0 newly installed, 0 to remove and 3 not upgraded.
> 
> -- Gary Chambers
> 
> /* Nothing fancy and nothing Microsoft! */
> 


Probably not.  I know this is not a definitive answer, but logically, 
security fixes and what not in a released version of Ubuntu should be as 
minor as possible.. (otherwise, Ubuntu itself would have to update every 
package that relies on libc, ie: all of them.) To that end, fixes are 
often backported to the version of the package that is installed with 
the release.  The only caveat I would keep in mind, in the days of yore, 
it was considered a good idea to restart systems after a libc 
upgrade/update.  Otherwise, processes that are running might behave 
erratically when the library changes.  I don't know if re-boot is still 
considered mandatory for a libc update, but unless you have confirmation 
otherwise, you might want to save the update for a period of scheduled 
maintenance window on a production system.

(for that matter, you should always have a backup copy of the last known 
working configuration of your system in case something like an update 
does break something important to you.)