[PATCH kernel-helper] kernel hooks: flag pending reboot after installing a new kernel

[PATCH kernel-helper] kernel hooks: flag pending reboot after installing a new kernel

[Jonas Theisen]

Ship a postinst.d hook that writes /run/reboot-required and records
the kernel package in /run/reboot-required.pkgs, similar to
the hooks shipped by unattended-upgrades on Debian and
update-notifier on Ubuntu. Tools like needrestart or monitoring checks
can then notice that the newly installed kernel is not running yet,
without requiring one of those packages to be installed.

Skip this when configuring the currently running kernel, as no reboot
is needed then.

Came up in https://forum.proxmox.com/threads/156352/

Signed-off-by: Jonas Theisen <j.theisen@proxmox.com>
---
 src/proxmox-boot/Makefile                |  2 ++
 src/proxmox-boot/proxmox-reboot-required | 19 +++++++++++++++++++
 2 files changed, 21 insertions(+)
 create mode 100755 src/proxmox-boot/proxmox-reboot-required

diff --git a/src/proxmox-boot/Makefile b/src/proxmox-boot/Makefile
index 044a024..d9e1c3d 100644
--- a/src/proxmox-boot/Makefile
+++ b/src/proxmox-boot/Makefile
@@ -1,4 +1,5 @@
 KERNEL_HOOKSCRIPTS = proxmox-auto-removal zz-proxmox-boot
+KERNEL_POSTINST_HOOKSCRIPTS = proxmox-reboot-required
 INITRAMFS_HOOKSCRIPTS = proxmox-boot-sync
 SHARE_FILES = functions
 GRUB_CFG_SNIPPET = 000_proxmox_boot_header
@@ -17,6 +18,7 @@ all:
 install:
 	install -d $(POSTINSTHOOKDIR)
 	install -m 0755 $(KERNEL_HOOKSCRIPTS) $(POSTINSTHOOKDIR)
+	install -m 0755 $(KERNEL_POSTINST_HOOKSCRIPTS) $(POSTINSTHOOKDIR)
 	install -d $(POSTRMHOOKDIR)
 	install -m 0755 $(KERNEL_HOOKSCRIPTS) $(POSTRMHOOKDIR)
 	install -d $(POSTINITRAMFSHOOKDIR)
diff --git a/src/proxmox-boot/proxmox-reboot-required b/src/proxmox-boot/proxmox-reboot-required
new file mode 100755
index 0000000..ccb01cd
--- /dev/null
+++ b/src/proxmox-boot/proxmox-reboot-required
@@ -0,0 +1,19 @@
+#! /bin/sh
+set -e
+
+# Flag that a reboot is needed to boot the newly installed kernel, following the convention used by
+# update-notifier and unattended-upgrades, so that tools like needrestart or monitoring checks
+# notice it. Reconfiguring the currently running kernel does not require a reboot.
+
+version="$1"
+
+[ -n "$version" ] || exit 0
+[ "$version" != "$(uname -r)" ] || exit 0
+[ -d /run ] || exit 0
+
+pkg="${DPKG_MAINTSCRIPT_PACKAGE:-proxmox-kernel-$version}"
+
+echo "*** System restart required ***" > /run/reboot-required
+if ! grep -qxF "$pkg" /run/reboot-required.pkgs 2>/dev/null; then
+	echo "$pkg" >> /run/reboot-required.pkgs
+fi
-- 
2.47.3

Re: [PATCH kernel-helper] kernel hooks: flag pending reboot after installing a new kernel

[Thomas Lamprecht]

Am 13.10.26 um 13:47 schrieb Jonas Theisen:
> Ship a postinst.d hook that writes /run/reboot-required and records
> the kernel package in /run/reboot-required.pkgs, similar to
> the hooks shipped by unattended-upgrades on Debian and
> update-notifier on Ubuntu. Tools like needrestart or monitoring checks
> can then notice that the newly installed kernel is not running yet,
> without requiring one of those packages to be installed.

Any reference to those docs/code/... that describe these file (paths)
would be appreciated here.

> 
> Skip this when configuring the currently running kernel, as no reboot
> is needed then.
> 
> Came up in https://forum.proxmox.com/threads/156352/
> 
> Signed-off-by: Jonas Theisen <j.theisen@proxmox.com>
> ---
>  src/proxmox-boot/Makefile                |  2 ++
>  src/proxmox-boot/proxmox-reboot-required | 19 +++++++++++++++++++
>  2 files changed, 21 insertions(+)
>  create mode 100755 src/proxmox-boot/proxmox-reboot-required
> 
> diff --git a/src/proxmox-boot/Makefile b/src/proxmox-boot/Makefile
> index 044a024..d9e1c3d 100644
> --- a/src/proxmox-boot/Makefile
> +++ b/src/proxmox-boot/Makefile
> @@ -1,4 +1,5 @@
>  KERNEL_HOOKSCRIPTS = proxmox-auto-removal zz-proxmox-boot
> +KERNEL_POSTINST_HOOKSCRIPTS = proxmox-reboot-required
>  INITRAMFS_HOOKSCRIPTS = proxmox-boot-sync
>  SHARE_FILES = functions
>  GRUB_CFG_SNIPPET = 000_proxmox_boot_header
> @@ -17,6 +18,7 @@ all:
>  install:
>  	install -d $(POSTINSTHOOKDIR)
>  	install -m 0755 $(KERNEL_HOOKSCRIPTS) $(POSTINSTHOOKDIR)
> +	install -m 0755 $(KERNEL_POSTINST_HOOKSCRIPTS) $(POSTINSTHOOKDIR)
>  	install -d $(POSTRMHOOKDIR)
>  	install -m 0755 $(KERNEL_HOOKSCRIPTS) $(POSTRMHOOKDIR)
>  	install -d $(POSTINITRAMFSHOOKDIR)
> diff --git a/src/proxmox-boot/proxmox-reboot-required b/src/proxmox-boot/proxmox-reboot-required
> new file mode 100755
> index 0000000..ccb01cd
> --- /dev/null
> +++ b/src/proxmox-boot/proxmox-reboot-required
> @@ -0,0 +1,19 @@
> +#! /bin/sh
> +set -e
> +
> +# Flag that a reboot is needed to boot the newly installed kernel, following the convention used by
> +# update-notifier and unattended-upgrades, so that tools like needrestart or monitoring checks
> +# notice it. Reconfiguring the currently running kernel does not require a reboot.
> +
> +version="$1"
> +
> +[ -n "$version" ] || exit 0
> +[ "$version" != "$(uname -r)" ] || exit 0
> +[ -d /run ] || exit 0
> +
> +pkg="${DPKG_MAINTSCRIPT_PACKAGE:-proxmox-kernel-$version}"
> +
> +echo "*** System restart required ***" > /run/reboot-required

That's always truncating any existing reboot-required file though?
Or doesn't that matter because it will be either not there or contain
exactly this string? In any case, needs either fixing or mentioning
that its fine in the commit message and maybe even a short 

Let's also use printf over echo, avoids various edge cases and makes
trailing newline and parameter handling more explicit.

> +if ! grep -qxF "$pkg" /run/reboot-required.pkgs 2>/dev/null; then
> +	echo "$pkg" >> /run/reboot-required.pkgs

same here w.r.t. using printf.

> +fi

Re: [PATCH kernel-helper] kernel hooks: flag pending reboot after installing a new kernel

[Jonas Theisen]

On 10/14/26 10:35, Thomas Lamprecht wrote:
> Am 13.10.26 um 13:47 schrieb Jonas Theisen:
>> Ship a postinst.d hook that writes /run/reboot-required and records
>> the kernel package in /run/reboot-required.pkgs, similar to
>> the hooks shipped by unattended-upgrades on Debian and
>> update-notifier on Ubuntu. Tools like needrestart or monitoring checks
>> can then notice that the newly installed kernel is not running yet,
>> without requiring one of those packages to be installed.
> Any reference to those docs/code/... that describe these file (paths)
> would be appreciated here.

 From https://github.com/mvo5/unattended-upgrades

unattended-upgrade:

105 REBOOT_REQUIRED_FILE = "/var/run/reboot-required"
[...]
867 def reboot_required():
868     # type: () -> bool
869     return os.path.isfile(REBOOT_REQUIRED_FILE)

kernel/postinst.d/unattended-upgrades:

  8 if [ -d /var/run ]; then
  9     touch /var/run/reboot-required
10     if ! grep -q "^$DPKG_MAINTSCRIPT_PACKAGE$" 
/var/run/reboot-required.pkgs 2> /dev/null ; then
11         echo "$DPKG_MAINTSCRIPT_PACKAGE" >> /var/run/reboot-required.pkgs
12     fi
13 fi

 From https://github.com/liske/needrestart

data/update-motd-reboot-required

  5 if [ -f /var/run/reboot-required ]; then
  6         cat /var/run/reboot-required
  7 fi

Since `/var/run` is just a symlink to `/run` i figured we should use
the current specification.

Should i also include these refs in the commit message?

*snip*

>> +++ b/src/proxmox-boot/proxmox-reboot-required
>> @@ -0,0 +1,19 @@
>> +#! /bin/sh
>> +set -e
>> +
>> +# Flag that a reboot is needed to boot the newly installed kernel, following the convention used by
>> +# update-notifier and unattended-upgrades, so that tools like needrestart or monitoring checks
>> +# notice it. Reconfiguring the currently running kernel does not require a reboot.
>> +
>> +version="$1"
>> +
>> +[ -n "$version" ] || exit 0
>> +[ "$version" != "$(uname -r)" ] || exit 0
>> +[ -d /run ] || exit 0
>> +
>> +pkg="${DPKG_MAINTSCRIPT_PACKAGE:-proxmox-kernel-$version}"
>> +
>> +echo "*** System restart required ***" > /run/reboot-required
> That's always truncating any existing reboot-required file though?
> Or doesn't that matter because it will be either not there or contain
> exactly this string? In any case, needs either fixing or mentioning
> that its fine in the commit message and maybe even a short

According to my understanding of this files usage it is just checked
for existence and printed in the motd. The content seems to be irrelevant.

> Let's also use printf over echo, avoids various edge cases and makes
> trailing newline and parameter handling more explicit.
>
>> +if ! grep -qxF "$pkg" /run/reboot-required.pkgs 2>/dev/null; then
>> +	echo "$pkg" >> /run/reboot-required.pkgs
> same here w.r.t. using printf.

Ack! Will fix that on both occurrences. Thanks!

Re: [PATCH kernel-helper] kernel hooks: flag pending reboot after installing a new kernel

[Thomas Lamprecht]

Am 14.10.26 um 11:37 schrieb Jonas Theisen:
> On 10/14/26 10:35, Thomas Lamprecht wrote:
>> Am 13.10.26 um 13:47 schrieb Jonas Theisen:
>>> Ship a postinst.d hook that writes /run/reboot-required and records
>>> the kernel package in /run/reboot-required.pkgs, similar to
>>> the hooks shipped by unattended-upgrades on Debian and
>>> update-notifier on Ubuntu. Tools like needrestart or monitoring checks
>>> can then notice that the newly installed kernel is not running yet,
>>> without requiring one of those packages to be installed.
>> Any reference to those docs/code/... that describe these file (paths)
>> would be appreciated here.
> 
> From https://github.com/mvo5/unattended-upgrades
> 
> unattended-upgrade:
> 
> 105 REBOOT_REQUIRED_FILE = "/var/run/reboot-required"
> [...]
> 867 def reboot_required():
> 868     # type: () -> bool
> 869     return os.path.isfile(REBOOT_REQUIRED_FILE)
> 
> kernel/postinst.d/unattended-upgrades:
> 
>  8 if [ -d /var/run ]; then
>  9     touch /var/run/reboot-required
> 10     if ! grep -q "^$DPKG_MAINTSCRIPT_PACKAGE$" /var/run/reboot-required.pkgs 2> /dev/null ; then
> 11         echo "$DPKG_MAINTSCRIPT_PACKAGE" >> /var/run/reboot-required.pkgs
> 12     fi
> 13 fi
> 
> From https://github.com/liske/needrestart
> 
> data/update-motd-reboot-required
> 
>  5 if [ -f /var/run/reboot-required ]; then
>  6         cat /var/run/reboot-required
>  7 fi
> 
> Since `/var/run` is just a symlink to `/run` i figured we should use
> the current specification.
> 
> Should i also include these refs in the commit message?

Yes, please, at least in some basic prose form describing how
this is checked/used with [X] reference to the repo/file/docs/...


>>> +echo "*** System restart required ***" > /run/reboot-required
>>
>> That's always truncating any existing reboot-required file though?
>> Or doesn't that matter because it will be either not there or contain
>> exactly this string? In any case, needs either fixing or mentioning
>> that its fine in the commit message and maybe even a short
> 
> According to my understanding of this files usage it is just checked
> for existence and printed in the motd. The content seems to be irrelevant.

Ack, then it's at least not that problematic, but potentially still not
nice to blindly override it? Did you check how others - e.g. debian or
ubuntu handles this for kernel updates? As just adding a lot of
complexity with not much gain is not really worth it either, but maybe
others came up with a sensible solution here already.

Re: [PATCH kernel-helper] kernel hooks: flag pending reboot after installing a new kernel

[Jonas Theisen]

On 10/14/26 11:52, Thomas Lamprecht wrote:
> Am 14.10.26 um 11:37 schrieb Jonas Theisen:
>> <snip>
>>
>> Should i also include these refs in the commit message?
> Yes, please, at least in some basic prose form describing how
> this is checked/used with [X] reference to the repo/file/docs/...
>
Ack!
>>>> +echo "*** System restart required ***" > /run/reboot-required
>>> That's always truncating any existing reboot-required file though?
>>> Or doesn't that matter because it will be either not there or contain
>>> exactly this string? In any case, needs either fixing or mentioning
>>> that its fine in the commit message and maybe even a short
>> According to my understanding of this files usage it is just checked
>> for existence and printed in the motd. The content seems to be irrelevant.
> Ack, then it's at least not that problematic, but potentially still not
> nice to blindly override it? Did you check how others - e.g. debian or
> ubuntu handles this for kernel updates? As just adding a lot of
> complexity with not much gain is not really worth it either, but maybe
> others came up with a sensible solution here already.

Ubuntu's update-notifier uses the same truncation:

data/notify-reboot-required:

26 echo "*** $(eval_gettext "System restart required") ***" > 
/var/run/reboot-required
27 echo "$DPKG_MAINTSCRIPT_PACKAGE" >> /var/run/reboot-required.pkgs

Debian does not have an equivalent natively but the package
reboot-notifier works the same way and also truncates the 
reboot-required file.

Re: [PATCH kernel-helper] kernel hooks: flag pending reboot after installing a new kernel

[Jonas Theisen]

Superseded by: 
https://lore.proxmox.com/pve-devel/20261014104153.133304-1-j.theisen@proxmox.com/T/#u