Este conteúdo não está disponível no idioma selecionado.
Chapter 2. Installing security updates
In RHEL, you can install a specific security advisory and all available security updates. You can also configure the system to download and install security updates automatically.
2.1. Installing all available security updates
To keep the security of your system up to date, you can install all currently available security updates using the dnf
utility.
Prerequisites
- A Red Hat subscription is attached to the host.
Procedure
Install security updates using
dnf
utility:dnf update --security
# dnf update --security
Copy to Clipboard Copied! Without the
--security
parameter,dnf update
installs all updates, including bug fixes and enhancements.Confirm and start the installation by pressing y:
… Transaction Summary =========================================== Upgrade … Packages Total download size: … M Is this ok [y/d/N]: y
… Transaction Summary =========================================== Upgrade … Packages Total download size: … M Is this ok [y/d/N]: y
Copy to Clipboard Copied! Optional: List processes that require a manual restart of the system after installing the updated packages:
dnf needs-restarting
# dnf needs-restarting 1107 : /usr/sbin/rsyslogd -n 1199 : -bash
Copy to Clipboard Copied! The previous command lists only processes that require a restart, and not services. That is, you cannot restart processes listed using the
systemctl
utility. For example, thebash
process in the output is terminated when the user that owns this process logs out.
2.2. Installing a security update provided by a specific advisory
In certain situations, you might want to install only specific updates. For example, if a specific service can be updated without scheduling a downtime, you can install security updates for only this service, and install the remaining security updates later.
Prerequisites
- A Red Hat subscription is attached to the host.
You know the ID of the security advisory that you want to update.
For more information, see the Identifying the security advisory updates section.
Procedure
Install a specific advisory, for example:
dnf update --advisory=RHSA-2019:0997
# dnf update --advisory=RHSA-2019:0997
Copy to Clipboard Copied! Alternatively, update to apply a specific advisory with a minimal version change by using the
dnf upgrade-minimal
command, for example:dnf upgrade-minimal --advisory=RHSA-2019:0997
# dnf upgrade-minimal --advisory=RHSA-2019:0997
Copy to Clipboard Copied! Confirm and start the installation by pressing
y
:… Transaction Summary =========================================== Upgrade … Packages Total download size: … M Is this ok [y/d/N]: y
… Transaction Summary =========================================== Upgrade … Packages Total download size: … M Is this ok [y/d/N]: y
Copy to Clipboard Copied! Optional: List the processes that require a manual restart of the system after installing the updated packages:
dnf needs-restarting
# dnf needs-restarting 1107 : /usr/sbin/rsyslogd -n 1199 : -bash
Copy to Clipboard Copied! The previous command lists only processes that require a restart, and not services. This means that you cannot restart all processes listed by using the
systemctl
utility. For example, thebash
process in the output is terminated when the user that owns this process logs out.
2.3. Installing security updates automatically
You can configure your system so that it automatically downloads and installs all security updates.
Prerequisites
- A Red Hat subscription is attached to the host.
-
The
dnf-automatic
package is installed.
Procedure
In the
/etc/dnf/automatic.conf
file, in the[commands]
section, make sure theupgrade_type
option is set to eitherdefault
orsecurity
:[commands] # What kind of upgrade to perform: # default = all available upgrades # security = only the security upgrades upgrade_type = security
[commands] # What kind of upgrade to perform: # default = all available upgrades # security = only the security upgrades upgrade_type = security
Copy to Clipboard Copied! Enable and start the
systemd
timer unit:systemctl enable --now dnf-automatic-install.timer
# systemctl enable --now dnf-automatic-install.timer
Copy to Clipboard Copied!
Verification
Verify that the timer is enabled:
systemctl status dnf-automatic-install.timer
# systemctl status dnf-automatic-install.timer
Copy to Clipboard Copied!