Install needrestart (detect stale libraries after upgrades)
needrestart scans running processes for shared libraries that were deleted or replaced on disk but are still mapped in memory, then restarts the affected services and tells you when the kernel or microcode requires a reboot. It closes the window every upgrade opens: a patched libssl on disk while every daemon keeps executing the vulnerable copy it loaded at boot. No standard mandates it: Pavois carries it as a Debian defence-in-depth practice, and it is the one that most directly converts patch installed into patch effective.
Checked against what is installed or registered, packages present/absent, account databases.
What Pavois checks
Pavois asserts that needrestart is present in the dpkg inventory. This is an inventory-state control: it proves the tool is installed, not that its APT hook (/etc/apt/apt.conf.d/99needrestart) still fires, and above all not that anything gets restarted. The behaviour depends on $nrconf{restart} in /etc/needrestart/needrestart.conf: in the default interactive mode ('i') it merely asks, so a host that answers "no" every time keeps running stale libraries and still passes this rule.
describe package('needrestart') do
it { should be_installed }
endHow to verify it is applied
Run dpkg -l needrestart and confirm the state column reads ii:
ii needrestart 3.6-4 all check which daemons need to be restarted after library upgrades
Then ask it what is stale: needrestart -b prints machine-readable output. A clean host lists no service and reports a kernel version equal to the running one:
NEEDRESTART-VER: 3.6
NEEDRESTART-KCUR: 6.1.0-23-amd64
NEEDRESTART-KEXP: 6.1.0-23-amd64
NEEDRESTART-KSTA: 1
A NEEDRESTART-SVC: <unit> line means that unit still maps a replaced library; NEEDRESTART-KSTA: 3 means the running kernel is obsolete and a reboot is required.
Inspect & investigate
needrestart has no log file of its own. When triggered by the APT hook it writes its report inline in the apt output (the familiar "Restarting services..." / "Pending kernel upgrade" block), which persists only in /var/log/apt/term.log. The restarts it performs are traceable, but in the systemd journal, as ordinary unit restarts (journalctl -u <unit>). If you want continuous evidence that no host is running stale code, schedule needrestart -b and feed its NEEDRESTART-SVC / NEEDRESTART-KSTA lines to your monitoring: that is the only durable trace.
Remediation
The Pavois harden plan installs the needrestart package with the system package manager (package resource, action install). It does not touch needrestart.conf, so the distribution default applies (interactive on Debian, list-only on Ubuntu's non-interactive runs). Choosing $nrconf{restart} = 'a' to restart services automatically is a service-availability decision, and Pavois deliberately leaves it to you.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | needrestart |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without needrestart, a host can run patched-on-disk but vulnerable-in-memory libraries for months, until someone happens to reboot: your patch report says fixed, the process memory says exploitable. The side effects are the price. It restarts services during an upgrade: that is a brief interruption, dropped connections, and on a database, a hypervisor or a queue broker it is not free, so schedule upgrades accordingly. In interactive mode it prompts, which can hang an automated apt run in CI or under unattended-upgrades (set $nrconf{restart} to 'a' or 'l', or drive apt with NEEDRESTART_MODE=a). And needrestart is itself code that runs as root at upgrade time: the local privilege-escalation flaws found in 2024 (CVE-2024-48990 and siblings, fixed in 3.8) are the reminder that it must be kept patched like anything else.