I am writing a BASH script that automatically configures, builds and installs the most recent kernel image. The generated kernel should include the grsecurity patchset. It would use the previous configuration from /proc/config.gz, which I created manually when compiling the first custom kernel on the machine.Is it safe to fully automatize the process? It would look like this:Check the most recent kernel that grsecurity is available forDownload the grsecurity patchset and the matching kernel source treePatch the kernelCopy the previous kernel configuration file into the kernel source directoryRun make olddefconfig to configure the kernel based on the previous configurationCompile the kernel with fakeroot make deb-pkgInstall the resulting packages and change bootloader prioritySend me a mail indicating that a reboot is requiredThe main question: is it likely that a kernel compiled with olddefconfig will contain errors that prevent the system from booting if the previous configuration is working correctly? It is very important because it is a remote server accessed via SSH and a manual rescue would take a lot of effort.
Automatized kernel upgrade
linux;debian;kernel;compiling;grsecurity
If you can't afford failure, test. Even if you can afford failure, testing is good. If at all possible, run the build in a dedicated test environment. In many cases a virtual guest makes for an adequate test system. When you cab reboot into your updated kernel and any subsequent tests complete successfully too, only then copy and deploy the new package to your remote system. Now to your main question: will your plan and make olddefconfig contain errors that will result in a boot failure? Only an idiot would believe any system to be completely foolproof. When you want to run the most recent kernel, as you stated, you will be bleeding edge and have all the advantages and risks associated with that. Reducing risk is selecting a long term release where a feature set is frozen, and only bug/security fixes will be introduced. Regardless: any reboot runs a small risk of failing. On a side note: I have spent too many hours in the past in data centers repairing issues/misconfigurations in servers that I recommend everyone to always add a suitable remote management option (e.g. HP ILO, Dell's DRAC, Oracle's ILOM etc. or a KVM over IP gateway) to your remote servers, that allows you to fix most issues the comfort of your desk. 