Given the many issues caused by new HWE kernels like 6.17 or 7.0, and since my hardware doesn't require a new kernel, I'd like to know if it's possible to configure Zorin 18 so that no HWE kernels will get installed at all in the future and the 6.8 GA kernel is always set as the default boot kernel.
I don’t want to specify a particular kernel in the savedefaut line of /etc/default/grub - which would have to be changed with every kernel update - but rather, I simply want the system to always boot from the latest 6.8 kernel version and have no other kernels on the system besides the 6.8 kernel.
How to do that? Is it possible to lock HWE kernels in general - including future HWE kernels as well?
I'd like to inquire about this, as it could be an option for users who are running very old hardware (older than 10 years old) on Zorin 18 and are having nothing but problems with new kernels.
Why do you think this step is necessary, first? It is not. You can safely boot from the preferred kernel, no changing things after updates needed, by keeping the savedefault dynamic.
To answer your question more directly, sadly, no. Not easily and not with a great deal of effort.
On any package management system, upgrades are offered from the remote side. You can specify a block for a specific package, but you cannot generically block a range of variations of that package.
And this logically follows: Specificity is essential for secure package management - removing specificity breaks the operation.
Default booting to the safe working and stable kernel - while clearing out installed clutter of later kernels with your normal housecleaning routines is the most effective and safest way.
You can set the default to saved and add GRUB_SAVEDEFAULT=true without specifying a kernel version that you would feel the need to change that version of every time you change the kernel.
That is dynamic.
Wow, I didn't know
GRUB_SAVEDEFAULT=true
had that effect. I thought you had to reconfigure it after every kernel update. That's really handy.
So, after an kernel update, it automatically boots with the new 6.8 kernel version? Or do you mean, you just have to select the new kernel after an update and then it will be kept until you change it. So you have to go into Advanced options for Zorin after a kernel update and select the latest 6.8 kernel there?
To me, it sounds it is more complicated than on Zorin 17 where you don't need that because no higher kernel versions than 6.8 are installed/available.
Yes. The way it actually works is, your saved default is dynamically set when you update-grub while booted into that kernel.
So, if you are booted into 6.8, then the system updates to 7.0, then 7.0 will be installed, listed in the grub menu but you will automatically still boot into the saved default of 6.8. If you then get another upgrade that installs 7.2, 7.3, you will still boot into the 6.8.
You can change this, if you decide that hte 7.1 kernel is too cute and cuddly to ignore, by selecting it from Grub Menu, booting into it, then running update-grub.
It is a good idea to keep a backup kernel - but clean out the rest. I use Ubuntu Cleaner as it is simple and effective, others like BleachBit or Stacer - But I Do Recommend clearing out unused kernels that accumulate since they can be space hogs.
I mean, when there are kernel updates within the kernel 6.8 line. Does the system automatically switch to the next higher kernel 6.8 version after an update and boot from the latest 6.8 kernel?
It will boot into the same 6.8 kernel that you selected as default.
Remember specificity - The actual version is not 6.8, it is linux-image-6.8.0-31-generic (for example).
If you get an update that installs linux-image-6.8.0-32-generic, that is an entirely different version number.
That's what I meant with that you have to care about the kernels after each kernel update.
Otherwise, you'll receive the updates, but by default, the system will continue to boot with the old kernel that you had set as "saved" in grub.
So you'll probably have to open the Advanced Options after every kernel update and select the latest 6.8 kernel.
This comment leads me to think I misunderstood your question.
The purpose of what I set up above is to retain a stable and function kernel that will fully boot, regardless of updates.
Your comment above implies that you do want updated kernels to boot, instead of the previous.
When you install kernel 6.8 on Zorin 18, you’ll also receive updates for that kernel - that is, newer versions of the 6.8 kernel. At the same time, you’ll receive updates for (so far) the 6.17 kernel or 7.0 kernel. With the “saved 6.8 kernel” setting, I want to prevent the computer from booting from kernel 6.17 or 7.0, while still always using the latest version of the 6.8 kernel, since this generally doesn’t cause major problems.
If you are using the linux-image-6.8.0-31 kernel, for example, and you get Two Packages in the updater:
One installs updates like security patches for that 6.8.0-31 kernel
One installs the 6.17.0-53 kernel.
You will boot into the 6.8.0-31 kernel - with the security updates applied, without needing to take any extra action on your part.
If the updater installs linux-image-6.8.0-32, that will remain offset, and you will still boot to the 6.8.0-31 kernel, with its patches applied automatically.
I think that in order to achieve what I want, I’ll have to make sure - every time there’s a kernel update that installs a new 6.8 kernel - that the system boots from that kernel.
Maybe I still don’t quite understand how kernels work.
After all, a lot of things are backported to older kernels. So do I even need the latest 6.8 kernel version or not for safety reasons or better functionality?
Do you mean with offset that it is enough for security or functionality reasons to have the latest kernel installed, independent if you boot from the latest kernel or not? The patches are applied anyway?
Well, I just facepalmed. I See what you mean, now.
I had thought you meant other 6.8 kernels in the same 6.8 grouping - which (As I now realize you know) are distinct from each other.
But no - you mean... If a Security patch causes a backported release to your kernel, you must then boot into it - then update-grub - YES, you are correct. In that case, you would need to do that.
I am sorry, I was reading too fast and thinking too slow.
Hm..I was referring to kernel updates like e.g. from 6.8.0-31 to 6.8.0-32. I feel pretty silly asking all these questions. I don't quite get it. Maybe I just need to give it a try and see how things go over time.
Right now, I still feel like I might miss out on important changes with this saved setting in grub if I'm not careful.
Yes, and you have a better grasp than you give yourself credit for - and I missed it in the thread, too.
You are correct.
If you are set to boot say, 6.8.0-31, and 6.8.0-32 is later installed, you will continue to boot on 6.8.0-31.
Which is where I said, these are Entirely Different Version numbers.
But what I missed: 6.8.0-32 would be the Security Patch you were asking about.
My brain defaulted back to "Security patches when installed are automatically applied."
I was too hasty - since kernels will have that revision number -32 in this example, that "entirely different version number" comes back to haunt me.
You would need to boot into that and set it as default.
I am banning myself from cheese cake for the past month as punishment.
So I had understood it correctly after all.
Go ahead and keep eating cheesecake - that's way too harsh a punishment! I'm so glad you help me so much.
I think it would be very helpful if the tutorial for "How to set an older kernel as default" also mentioned what to do for future kernel updates if the setting is kept for longer time to avoid that users don't get security updates.
Is your intent to stay on GA (General Availability) as a priority?
Or the 6.8 kernel specifically (including its Security patches) as a priority?
Installing as you posted, this will install the -136 version which is able to move to the updates until 2029, but those updates will include the fact it moves to 6.8.0-137 and ...-138...
If your goal is to get those automatically, but avoid HWE, remove --purge the HWE command will cause that to happen. BUT, you would also end up on the 6.17 or later GA kernels.
I don't know what GA is, I just read about that one kernel 6.8 already has reached its end of life and another not and thought it is named GA.
I'd like to have that one which is supported until 2029.
My priority is to get 6.8 kernel specifically (including its Security patches).