Install security updates

In Red Hat Enterprise Linux, you can install a specific security advisory and all available security updates. You can also configure the system to download and install security updates automatically.

Install all available security updates
Copy link

Install all available Red Hat security updates by using the DNF utility. This helps patch all known vulnerabilities and quickly brings the system into full compliance.

Before you begin
Copy link

  • A Red Hat subscription is attached to the host.

Procedure
Copy link

  1. Install security updates by using the DNF utility: 
    # dnf update --security

    Without the --security parameter, dnf update installs all updates, including bug fixes and enhancements.

  2. Confirm and start the installation by pressing y: 
    …
Transaction Summary
===========================================
Upgrade  … Packages

Total download size: … M
Is this ok [y/d/N]: y
  3. Optional: List processes that require a manual restart of the system after installing the updated packages: 
    # dnf needs-restarting
     
    1107 : /usr/sbin/rsyslogd -n
1199 : -bash

    The previous command lists only processes that require a restart, and not services. That is, you cannot restart processes listed by using the systemctl command. For example, the bash process shown in the output terminates when the user who owns it logs out.

Results
Copy link

  • Verify that no remaining security updates are available: 
    # dnf updateinfo list updates security

    If the command returns no output, all available security updates are installed.

Install a security update provided by a specific advisory
Copy link

Install a security update associated with a specific advisory ID by using the DNF utility. This enables targeted patching of critical vulnerabilities without updating all packages.

Before you begin
Copy link

About this task
Copy link

In certain situations, you should install only specific updates. For example, if a specific service can be updated without scheduling downtime, you can install security updates for that service only and install the remaining updates later.

Procedure
Copy link

  1. Install a specific advisory, for example: 
    # dnf update --advisory=RHSA-2019:0997
  2. Alternatively, update to apply a specific advisory with a minimal version change by using the dnf upgrade-minimal command, for example: 
    # dnf upgrade-minimal --advisory=RHSA-2019:0997
  3. Confirm and start the installation by pressing y: 
    …
Transaction Summary
===========================================
Upgrade  … Packages

Total download size: … M
Is this ok [y/d/N]: y
  4. Optional: List the processes that require a manual restart of the system after installing the updated packages: 
    # dnf needs-restarting
     
    1107 : /usr/sbin/rsyslogd -n
1199 : -bash

    The previous command lists only processes that require a restart, and not services. That is, you cannot restart processes listed by using the systemctl command. For example, the bash process shown in the output terminates when the user who owns it logs out.

Results
Copy link

  • Verify that the advisory is now listed as installed: 
    # dnf updateinfo list security --installed

    The output includes the advisory ID that you installed.

Install security updates automatically
Copy link

Configure the dnf-automatic tool to download and install security updates automatically. Automating this task helps ensure that your systems remain protected against newly discovered threats without manual intervention.

Before you begin
Copy link

  • A Red Hat subscription is attached to the host.
  • The dnf-automatic package is installed.

About this task
Copy link

See the dnf-automatic(8) man page on your system for more information.

Procedure
Copy link

  1. In the /etc/dnf/automatic.conf file, in the [commands] section, make sure the upgrade_type option is set to either default or security: 
    [commands]
#  What kind of upgrade to perform:
# default                            = all available upgrades
# security                           = only the security upgrades
upgrade_type = security
  2. Enable and start the systemd timer unit: 
    # systemctl enable --now dnf-automatic-install.timer

Results
Copy link

  1. Verify that the timer is enabled: 
    # systemctl status dnf-automatic-install.timer