Chapter 2. Installing security updates

Procedure

1. Install security updates using yum utility:

   # yum update --security

   Copy to Clipboard Toggle word wrap

   Without the --security parameter, yum update installs all updates, including bug fixes and enhancements.

2. Confirm and start the installation by pressing y:

   …
   Transaction Summary
   ===========================================
   Upgrade  … Packages
   
   Total download size: … M
   Is this ok [y/d/N]: y

   Copy to Clipboard Toggle word wrap

3. Optional: List processes that require a manual restart of the system after installing the updated packages:

   # yum needs-restarting
   1107 : /usr/sbin/rsyslogd -n
   1199 : -bash

   Copy to Clipboard Toggle word wrap

   The previous command lists only processes that require a restart, and not services. That is, you cannot restart processes listed using the systemctl utility. For example, the bash process in the output is terminated when the user that owns this process logs out.

Procedure

1. Install a specific advisory, for example:

   # yum update --advisory=RHSA-2019:0997

   Copy to Clipboard Toggle word wrap

2. Alternatively, update to apply a specific advisory with a minimal version change by using the yum upgrade-minimal command, for example:

   # yum upgrade-minimal --advisory=RHSA-2019:0997

   Copy to Clipboard Toggle word wrap

3. Confirm and start the installation by pressing y:

   …
   Transaction Summary
   ===========================================
   Upgrade  … Packages
   
   Total download size: … M
   Is this ok [y/d/N]: y

   Copy to Clipboard Toggle word wrap

4. Optional: List the processes that require a manual restart of the system after installing the updated packages:

   # yum needs-restarting
   1107 : /usr/sbin/rsyslogd -n
   1199 : -bash

   Copy to Clipboard Toggle word wrap

   The previous command lists only processes that require a restart, and not services. This means that you cannot restart all processes listed by using the systemctl utility. For example, the bash process in the output is terminated when the user that owns this process logs out.

Procedure

1. In the /etc/dnf/automatic.conf file, in the [commands] section, make sure the upgrade_type option is set to either default or security:

   [commands]
   #  What kind of upgrade to perform:
   # default                            = all available upgrades
   # security                           = only the security upgrades
   upgrade_type = security

   Copy to Clipboard Toggle word wrap

2. Enable and start the systemd timer unit:

   # systemctl enable --now dnf-automatic-install.timer

   Copy to Clipboard Toggle word wrap

Verification

1. Verify that the timer is enabled:

   # systemctl status dnf-automatic-install.timer

   Copy to Clipboard Toggle word wrap