OpenBSD Tutorial: Using syspatch to manage system patches

Keeping an OpenBSD system up to date is super simple thanks to the syspatch command. Keep in mind I'm not talking about upgrading your system from one version number to the next, as that's a whole other thing. Patches are simply fixes for bugs or vulnerabilities of any kind that have been caught since the specific version number of your system was officially released. (The command was introduced for OpenBSD 6.1, so it won't work for 6.0 or earlier.)

Syspatch allows five different operations for managing your patches. Let's dive in with text from an actual terminal session courtesy of the script command (in this case, script > syspatch.txt).

Script started on Sat May 12 10:57:14 2018

$ su
Password: _
# syspatch -l

Syspatch with the -l option lists all patches that are already installed on your system. In this example, no patches have been installed yet.

# syspatch -c
001_perl
002_libtls
003_arp
004_gif
005_httpd
006_ipseclen
007_libcrypto

Syspatch with the -c option will display all available patches, excluding those already installed on your system. (A list of all currently available patches - as well as explanations for each of them - can be found at https://www.openbsd.org/errata.html. Be sure to click on the appropriate version number.) The next step is to simply issue a vanilla syspatch (i.e. with no options), which will install all of the patches listed by syspatch -c.

# syspatch
Installing patch 001_perl
Installing patch 002_libtls
Installing patch 003_arp
Installing patch 004_gif
Installing patch 005_httpd
Installing patch 006_ipseclen
Installing patch 007_libcrypto
Relinking to create unique kernel... done.
# exit
$ exit

Script done on Sat May 12 11:00:38 2018

Not represented in the above session are the -R and -r options, which revert all installed patches or only the most recently installed patch, respectively. Also, notice how once the patches have all been installed, OpenBSD then relinks all libraries randomly to create a unique kernel, which makes it that much harder for would-be hackers looking to break into your system.