Chapter 2. Installing security updates

Procedure

1. Install security updates using dnf utility:

   # dnf update --security

   Note

   The --security parameter is important. Without it, dnf update installs all updates, including bug fixes and enhancements.

2. Confirm and start the installation by pressing y:

   ...
   Transaction Summary
   ===========================================
   Upgrade  ... Packages
   
   Total download size: ... M
   Is this ok [y/d/N]: y

3. Optional: list processes that require a manual restart of the system after installing the updated packages:

   # dnf needs-restarting
   1107 : /usr/sbin/rsyslogd -n
   1199 : -bash

   Note

   This command lists only processes that require a restart, and not services. That is, you cannot restart processes listed using the systemctl utility. For example, the bash process in the output is terminated when the user that owns this process logs out.

Procedure

1. Install a specific advisory:

   # dnf update --advisory=<Update_ID>

   Replace <Update_ID> with the ID of the security advisory that you want to update. For example:

   # dnf update --advisory=RHSA-2019:0997

   Important

   You can update to apply a specific advisory with a minimal version change by using the dnf upgrade-minimal --advisory=<Update_ID> command.

2. Confirm and start the installation by pressing y:

   ...
   Transaction Summary
   ===========================================
   Upgrade  ... Packages
   
   Total download size: ... M
   Is this ok [y/d/N]: y

3. Optional: List the processes that require a manual restart of the system after installing the updated packages:

   # dnf needs-restarting
   1107 : /usr/sbin/rsyslogd -n
   1199 : -bash

   Note

   This command lists only processes that require a restart, and not services. This means that you cannot restart all processes listed by using the systemctl utility. For example, the bash process in the output is terminated when the user that owns this process logs out.

Procedure

1. In the /etc/dnf/automatic.conf file, under the [commands] section, make sure the upgrade_type option is set to either default or security:

   [commands]
   #  What kind of upgrade to perform:
   # default                            = all available upgrades
   # security                           = only the security upgrades
   upgrade_type = security

2. Enable and start the systemd timer unit:

   # systemctl enable --now dnf-automatic-install.timer

Verification

1. Verify that the timer is enabled:

   # systemctl status dnf-automatic-install.timer