Chapter 2. Installing security updates

Procedure

1. Install security updates using dnf utility:

   # dnf update --security

   Copy to Clipboard

   Without the --security parameter, dnf update installs all updates, including bug fixes and enhancements.

2. Confirm and start the installation by pressing y:

   …
   Transaction Summary
   ===========================================
   Upgrade  … Packages
   
   Total download size: … M
   Is this ok [y/d/N]: y

   Copy to Clipboard

3. Optional: List processes that require a manual restart of the system after installing the updated packages:

   # dnf needs-restarting
   1107 : /usr/sbin/rsyslogd -n
   1199 : -bash

   Copy to Clipboard

   The previous command lists only processes that require a restart, and not services. That is, you cannot restart processes listed using the systemctl utility. For example, the bash process in the output is terminated when the user that owns this process logs out.

Procedure

1. Install a specific advisory, for example:

   # dnf update --advisory=RHSA-2019:0997

   Copy to Clipboard

2. Alternatively, update to apply a specific advisory with a minimal version change by using the dnf upgrade-minimal command, for example:

   # dnf upgrade-minimal --advisory=RHSA-2019:0997

   Copy to Clipboard

3. Confirm and start the installation by pressing y:

   …
   Transaction Summary
   ===========================================
   Upgrade  … Packages
   
   Total download size: … M
   Is this ok [y/d/N]: y

   Copy to Clipboard

4. Optional: List the processes that require a manual restart of the system after installing the updated packages:

   # dnf needs-restarting
   1107 : /usr/sbin/rsyslogd -n
   1199 : -bash

   Copy to Clipboard

   The previous command lists only processes that require a restart, and not services. This means that you cannot restart all processes listed by using the systemctl utility. For example, the bash process in the output is terminated when the user that owns this process logs out.

Procedure

1. In the /etc/dnf/automatic.conf file, in the [commands] section, make sure the upgrade_type option is set to either default or security:

   [commands]
   #  What kind of upgrade to perform:
   # default                            = all available upgrades
   # security                           = only the security upgrades
   upgrade_type = security

   Copy to Clipboard

2. Enable and start the systemd timer unit:

   # systemctl enable --now dnf-automatic-install.timer

   Copy to Clipboard

Verification

1. Verify that the timer is enabled:

   # systemctl status dnf-automatic-install.timer

   Copy to Clipboard