apt Upgrade 显示有关英特尔微码更新的警告。有什么我需要做的吗？

Question

当我sudo apt upgrade在 Kubuntu 23.10 中运行时，我得到以下输出：

\n

user1@user1-Desktop1:~$ sudo apt upgrade \nReading package lists... Done\nBuilding dependency tree \nReading state information... Done\nCalculating upgrade... Done\n#\n# Canonical released microcode updates for both Intel (CVE-2022-40982) and AMD\n# (CVE-2023-20593). \xe2\x80\x98Unattended upgrades\xe2\x80\x99 provide security updates by default.\n# Ensure it remains enabled to always get all updates as they become available.\n#\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n

\n

我是否需要按照警告中的说明启用无人值守升级？如何做到这一点以及为什么我需要做任何事情？

\n

我正在使用 Kubuntu，并从 23.04 升级。使用 GUI 工具更新至 23.10（正如此处所述）。我的系统安装大约一个月了。我从未更改过任何内容/etc/apt，一切都是默认的。这是我的/etc/apt/sources.list：

\n

# deb cdrom:[Kubuntu 23.04 _Lunar Lobster_ - Release amd64 (20230414.1)]/ lunar main multiverse restricted universe\n\n# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to\n# newer versions of the distribution.\ndeb http://de.archive.ubuntu.com/ubuntu/ mantic main restricted\n# deb-src http://de.archive.ubuntu.com/ubuntu/ lunar main restricted\n\n## Major bug fix updates produced after the final release of the\n## distribution.\ndeb http://de.archive.ubuntu.com/ubuntu/ mantic-updates main restricted\n# deb-src http://de.archive.ubuntu.com/ubuntu/ lunar-updates main restricted\n\n## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu\n## team. Also, please note that software in universe WILL NOT receive any\n## review or updates from the Ubuntu security team.\ndeb http://de.archive.ubuntu.com/ubuntu/ mantic universe\n# deb-src http://de.archive.ubuntu.com/ubuntu/ lunar universe\ndeb http://de.archive.ubuntu.com/ubuntu/ mantic-updates universe\n# deb-src http://de.archive.ubuntu.com/ubuntu/ lunar-updates universe\n\n## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu \n## team, and may not be under a free licence. Please satisfy yourself as to \n## your rights to use the software. Also, please note that software in \n## multiverse WILL NOT receive any review or updates from the Ubuntu\n## security team.\ndeb http://de.archive.ubuntu.com/ubuntu/ mantic multiverse\n# deb-src http://de.archive.ubuntu.com/ubuntu/ lunar multiverse\ndeb http://de.archive.ubuntu.com/ubuntu/ mantic-updates multiverse\n# deb-src http://de.archive.ubuntu.com/ubuntu/ lunar-updates multiverse\n\n## N.B. software from this repository may not have been tested as\n## extensively as that contained in the main release, although it includes\n## newer versions of some applications which may provide useful features.\n## Also, please note that software in backports WILL NOT receive any review\n## or updates from the Ubuntu security team.\ndeb http://de.archive.ubuntu.com/ubuntu/ mantic-backports main restricted universe multiverse\n# deb-src http://de.archive.ubuntu.com/ubuntu/ lunar-backports main restricted universe multiverse\n\ndeb http://security.ubuntu.com/ubuntu mantic-security main restricted\n# deb-src http://security.ubuntu.com/ubuntu lunar-security main restricted\ndeb http://security.ubuntu.com/ubuntu mantic-security universe\n# deb-src http://security.ubuntu.com/ubuntu lunar-security universe\ndeb http://security.ubuntu.com/ubuntu mantic-security multiverse\n# deb-src http://security.ubuntu.com/ubuntu lunar-security multiverse\n\n# This system was installed using small removable media\n# (e.g. netinst, live or single CD). The matching "deb cdrom"\n# entries were disabled at the end of the installation process.\n# For information about how to configure apt package sources,\n# see the sources.list(5) manual.\n

\n

Answer 1

您最新的终端输出表明 intel-microcode 已经是最新版本，并且启用了无人值守升级。没有错误消息，因此您的 Ubuntu 是最新的且受到保护。一切都很好，所以您无需执行任何操作。您的主要问题\xe2\x80\x98Unattended upgrades\xe2\x80\x99 provide security updates by default. Ensure it remains enabled不是错误消息，它只是提醒您在 Ubuntu 中保持启用安全更新。

\n

您收到的消息是 Ubuntu 提醒您启用无人值守升级功能。无人值守升级会自动下载并安装系统的安全更新，无需用户进行任何手动干预。默认情况下，在所有当前支持的 Ubuntu 版本中启用无人值守升级。最好保持此功能处于启用状态，以确保您的 Ubuntu 始终是最新且安全的。

\n

以下命令将检查 Ubuntu 当前是否启用了无人值守升级：

\n

sudo apt-config dump | grep -E \'APT::Periodic::Update-Package-Lists|APT::Periodic::Unattended-Upgrade\'\n

\n

该命令的输出应该是：

\n

APT::Periodic::Update-Package-Lists "1";\nAPT::Periodic::Unattended-Upgrade "1";\n

\n

两行末尾的“1”表示启用无人值守升级，否则如果任一值设置为“0”，则禁用无人值守升级。

\n

要启用无人值守升级，请运行以下命令：

\n

sudo apt install unattended-upgrades\n

\n

要检查是否安装了无人值守升级包，请运行以下命令：

\n

apt policy unattended-upgrades\n

\n

Ubuntu 中的英特尔微代码更新提高了 Ubuntu 的安全性、性能和稳定性。一旦 Intel 微码更新可用，最好立即在 Ubuntu 中安装它们。还可以通过运行以下命令在 Ubuntu 中手动安装 Intel 微码更新包：

\n

sudo apt install intel-microcode\n

\n

intel-microcode 软件包通过无人值守升级自动安装和更新。要验证情况是否如此，您可以检查无人值守升级配置文件：

\n

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades\n

\n

查找接近 50unattused-upgrades 结尾处以 开头的行Unattended-Upgrade::Package-Blacklist。如果 intel-microcode 软件包未在此行之后列出，则它符合无人值守升级的条件。

\n

你的sources.list 文件中有一些来自Ubuntu 23.04 月球的剩余行，这些行都被注释掉了，所以没有什么可担心的。其余未注释掉的行均适用于 Ubuntu 23.10 mantic，因为它们应该如此。

\n