How needrestart Automatically Restarts Daemons on Debian

On a patched Debian operating system, updating packages updates files on the disk, but running processes continue to execute the old code mapped in memory until they are restarted. The needrestart utility solves this security gap by scanning running processes immediately after package manager operations, determining which background daemons rely on obsolete libraries, and triggering their restart based on predefined operational modes. This automated process ensures that security patches take effect system-wide without requiring a full system reboot.

How needrestart Detects Outdated Services

Whenever apt or dpkg finishes applying patches, needrestart is triggered via a post-invoke hook located at /etc/apt/apt.conf.d/99needrestart.

Once invoked, the tool inspects the /proc filesystem:

  1. It examines the process memory mappings (/proc/[pid]/maps) for all active processes.
  2. It looks for mapped files—such as shared libraries (.so files) or executables—marked with (deleted), which occurs when package managers replace existing binaries on disk with updated versions.
  3. It associates the affected processes with their corresponding management units, typically systemd services or init scripts.

In addition to daemon checks, needrestart inspects the processor microcode status and checks if an upgraded Linux kernel requires a full operating system reboot.

Configuring Automatic Daemon Restarts

By default on modern Debian installations, needrestart may run in an interactive mode that displays a dialog box asking the administrator which services to restart. To make daemon restarts completely automated, the configuration must be set to automatic mode.

This setting is controlled in /etc/needrestart/needrestart.conf via the $nrconf{restart} directive:

  • Automatic ('a'): Automatically restarts all outdated services without user intervention.
  • Interactive ('i'): Prompts the user with a list of affected services.
  • List-only ('l'): Identifies and logs outdated services without restarting them.

To set full automation, update the configuration file:

$nrconf{restart} = 'a';

When set to automatic, needrestart issues standard service management commands—such as systemctl restart <service>—for each identified unit as soon as the package installation phase completes.

Handling Exclusions and Sensitive Services

Not all services should be restarted automatically, particularly stateful applications like database servers or display managers that could disconnect active sessions. needrestart manages this through regex-based blacklists inside /etc/needrestart/needrestart.conf.

Administrators can prevent specific daemons from restarting automatically by adding them to the $nrconf{override_rc} array:

# Prevent database and display managers from auto-restarting
$nrconf{override_rc} = {
    qr(^mysql) => 0,
    qr(^postgresql) => 0,
    qr(^gdm3) => 0,
};

When an excluded daemon's libraries are patched, needrestart ignores the process or notifies the administrator, leaving the restart to be scheduled during an appropriate maintenance window.