#2557·vuls

checkrestart in debian 13 trixie misreports deleted files causing the vuls function to fail

Author: MrFlibble007Created May 18, 2026Updated Jun 24, 2026
Labelsbug

What did you do? (required. The issue will be closed when not provided.)

Upgraded endpoints from debian 12 to debian 13

What did you expect to happen?

With Fast Root Scan or Deep scan reboot check should not fail

What happened instead?

Failures on multiple machines due to checkrestart output

Example

Warning for 2fauth-01: [Failed to scan need-restarting processes:
    github.com/future-architect/vuls/scanner.(*debian).postScan
        github.com/future-architect/vuls/scanner/debian.go:259

Failed to LANGUAGE=en_US.UTF-8 checkrestart. status: 1, stdout: 31 non-ignored program(s) or unit(s) need restarting (see checkrestart(8)) The following systemd units started programmes that are using deleted files:
apache2.service:
Program /usr/sbin/apache2 (PID: 1007, CMDLINE: '/usr/sbin/apache2 -k start')
Program /usr/sbin/apache2 (PID: 1189, CMDLINE: '/usr/sbin/apache2 -k start')
Program /usr/sbin/apache2 (PID: 1190, CMDLINE: '/usr/sbin/apache2 -k start')
Program /usr/sbin/apache2 (PID: 1191, CMDLINE: '/usr/sbin/apache2 -k start')
Program /usr/sbin/apache2 (PID: 1194, CMDLINE: '/usr/sbin/apache2 -k start')
Program /usr/sbin/apache2 (PID: 1195, CMDLINE: '/usr/sbin/apache2 -k start')
Program /usr/sbin/apache2 (PID: 6261, CMDLINE: '/usr/sbin/apache2 -k start')
auditd.service:
Program /usr/sbin/auditd (PID: 732)
chrony.service:
Program /usr/sbin/chronyd (PID: 884, CMDLINE: '/usr/sbin/chronyd -4 -F 1')
Program /usr/sbin/chronyd (PID: 886, CMDLINE: '/usr/sbin/chronyd -4 -F 1')
cron.service:
Program /usr/sbin/cron (PID: 923, CMDLINE: '/usr/sbin/cron -f')
dbus.service:
Program /usr/bin/dbus-daemon (PID: 755, CMDLINE: '/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only')
exim4.service:
Program /usr/sbin/exim4 (PID: 1187, CMDLINE: '/usr/sbin/exim4 -bdf -q30m')

(snipped)

Steps to reproduce the behaviour

I've not quite figured out at what point checkrestart is filled with these, running systemctl try-restart for the services involved temporarily clears the issue.

Configuration (MUST fill this out):

docker based vuls - latest

Comment

I believe the root cause is this bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1083094 however its marked as minor and this is a legacy package.

Can we please switch from checkrestart to needrestart?