Chapter 2. Installing security updates

Procedure

1. Install security updates using dnf utility:

   # dnf update --security

   Without the --security parameter, dnf update installs all updates, including bug fixes and enhancements.

2. Confirm and start the installation by pressing y:

   …
   Transaction Summary
   ===========================================
   Upgrade  … Packages
   
   Total download size: … M
   Is this ok [y/d/N]: y

3. Optional: List processes that require a manual restart of the system after installing the updated packages:

   # dnf needs-restarting
   1107 : /usr/sbin/rsyslogd -n
   1199 : -bash

   The previous command lists only processes that require a restart, and not services. That is, you cannot restart processes listed using the systemctl utility. For example, the bash process in the output is terminated when the user that owns this process logs out.

Procedure

1. Install a specific advisory, for example:

   # dnf update --advisory=RHSA-2019:0997

2. Alternatively, update to apply a specific advisory with a minimal version change by using the dnf upgrade-minimal command, for example:

   # dnf upgrade-minimal --advisory=RHSA-2019:0997

3. Confirm and start the installation by pressing y:

   …
   Transaction Summary
   ===========================================
   Upgrade  … Packages
   
   Total download size: … M
   Is this ok [y/d/N]: y

4. Optional: List the processes that require a manual restart of the system after installing the updated packages:

   # dnf needs-restarting
   1107 : /usr/sbin/rsyslogd -n
   1199 : -bash

   The previous command lists only processes that require a restart, and not services. This means that you cannot restart all processes listed by using the systemctl utility. For example, the bash process in the output is terminated when the user that owns this process logs out.

Procedure

1. In the /etc/dnf/automatic.conf file, in the [commands] section, make sure the upgrade_type option is set to either default or security:

   [commands]
   #  What kind of upgrade to perform:
   # default                            = all available upgrades
   # security                           = only the security upgrades
   upgrade_type = security

2. Enable and start the systemd timer unit:

   # systemctl enable --now dnf-automatic-install.timer

Verification

1. Verify that the timer is enabled:

   # systemctl status dnf-automatic-install.timer