Chapter 2. Installing security updates

Procedure

1. Install security updates using dnf utility:

   Copy to Clipboard Toggle word wrap

   # dnf update --security

   Without the --security parameter, dnf update installs all updates, including bug fixes and enhancements.

2. Confirm and start the installation by pressing y:

   Copy to Clipboard Toggle word wrap

   …
   Transaction Summary
   ===========================================
   Upgrade  … Packages
   
   Total download size: … M
   Is this ok [y/d/N]: y

3. Optional: List processes that require a manual restart of the system after installing the updated packages:

   Copy to Clipboard Toggle word wrap

   # dnf needs-restarting
   1107 : /usr/sbin/rsyslogd -n
   1199 : -bash

   The previous command lists only processes that require a restart, and not services. That is, you cannot restart processes listed using the systemctl utility. For example, the bash process in the output is terminated when the user that owns this process logs out.

Procedure

1. Install a specific advisory, for example:

   Copy to Clipboard Toggle word wrap

   # dnf update --advisory=RHSA-2019:0997

2. Alternatively, update to apply a specific advisory with a minimal version change by using the dnf upgrade-minimal command, for example:

   Copy to Clipboard Toggle word wrap

   # dnf upgrade-minimal --advisory=RHSA-2019:0997

3. Confirm and start the installation by pressing y:

   Copy to Clipboard Toggle word wrap

   …
   Transaction Summary
   ===========================================
   Upgrade  … Packages
   
   Total download size: … M
   Is this ok [y/d/N]: y

4. Optional: List the processes that require a manual restart of the system after installing the updated packages:

   Copy to Clipboard Toggle word wrap

   # dnf needs-restarting
   1107 : /usr/sbin/rsyslogd -n
   1199 : -bash

   The previous command lists only processes that require a restart, and not services. This means that you cannot restart all processes listed by using the systemctl utility. For example, the bash process in the output is terminated when the user that owns this process logs out.

Procedure

1. In the /etc/dnf/automatic.conf file, in the [commands] section, make sure the upgrade_type option is set to either default or security:

   Copy to Clipboard Toggle word wrap

   [commands]
   #  What kind of upgrade to perform:
   # default                            = all available upgrades
   # security                           = only the security upgrades
   upgrade_type = security

2. Enable and start the systemd timer unit:

   Copy to Clipboard Toggle word wrap

   # systemctl enable --now dnf-automatic-install.timer

Verification

1. Verify that the timer is enabled:

   Copy to Clipboard Toggle word wrap

   # systemctl status dnf-automatic-install.timer