Disable automatic updates for ALL users

rmet0815 · #1 26th January 2012, 09:58 AM

Fedora does automatically update the system once you log into the graphic environment - which we occasionally use from some (reporting) tools. Now I know that you can disable the automatic updates on a per users basis with "Other -> Software Settings" (or gpk-prefs on the commandline). But we want to disable this for ALL users, so that either it is a) disabled at all or b) it defaults to "all off" (never check, update nothing) so that a user has to actively enable it.

Is this possible? Is there a config file for this?

Any help would be greatly appreciated.

ps: it was suggested to use "/etc/yum/pluginconf.d/refresh-packagekit.conf", but according to the rpm it only udpates status, not blocking the update.

cnzhangquan · #2 31st May 2012, 03:22 AM

i don't like it auto update.

i will do it myself when i need

RayMikkelson · #3 5th March 2013, 11:38 PM

I'm running F17. Does anyone know how to disable automatic updates for a given box (for all users)?

I'm running many Fedora desktops in a corporate environment and need control of when updates occur on my network. Kernel updates occasionally break our tools and we want control over when updates happen.

sidebrnz · #4 6th March 2013, 03:16 AM

Uninstall the software updater. Then, you can use yum to update when and if you need it.

dobbi · #5 6th March 2013, 04:57 AM

Assuming you are using PackageKit have you tried setting the preferences?

Code:

su -
/usr/bin/gpk-prefs

---------- Post added at 05:48 AM ---------- Previous post was at 05:13 AM ----------

https://access.redhat.com/knowledge/...ackageKit.html

Oops, on a global scale, I believe PolicyKit was meant to do just that, PackageKit will ask SeLinux if it can run first, so you probably has to change that policy.

https://access.redhat.com/knowledge/...face-0011.html
https://fedoraproject.org/wiki/SELinux
https://docs.fedoraproject.org/en-US...l/SELinux_FAQ/
http://magazine.redhat.com/2007/08/2...policy-module/
http://wiki.centos.org/HowTos/SELinux

Unfortunately this is just my guess, I don't really know how to do what you want, I know I would start looking at that and trying to set the preferrences of the user first to see if it blocks everybody.

However I took a brief look at the system-config-selinux that comes with policycoreutils-gui and seems easier than trying to change the policies directly.

---------- Post added at 05:57 AM ---------- Previous post was at 05:48 AM ----------

http://sayamindu.randomink.org/soc/d...ent_guide.html

Using GConf for Gnome also may be possible to lockdown certain features.

And there is this PDF that the guy who posted said from page 10 forward explains how to lockdown a system.

http://www.centos.org/docs/4/pdf/rhd-dg-en.pdf

Source:
http://serverfault.com/questions/292...ccess-in-linux

RayMikkelson · #6 6th March 2013, 05:32 PM

Thanks for the replies.

What package are you referring to as the "software updater?". I tried removing PackageKit itself, but then yum wants to remove an additional 20 packages, some of which I want to keep, such as gdm, gnome-shell, etc. I've seen other threads that imply you cannot remove PackageKit when using the later Fedora releases.

Running gpk-prefs, while it might work, I would need to run it for all users on my network (>100 folks), so that's not an attractive solution. Besides, not everyone runs gnome (I have KDE & LXDE users as well).

Right now, I'm considering removing gnome-packagekit (for the gnome users) and apper (for the KDE users) and ?? for LXDE...

However, I've seen packagekitd running on a newly installed box when no one has logged into it yet (other than ssh'ing in (no GUI)). So, I'm guessing that there are other triggers that start packagekitd besides a when a user is logged in via a GUI (gnome, KDE, etc.). Unfortunately, I've not figured out what those other triggers might be...

sidebrnz · #7 6th March 2013, 06:47 PM

It is, I'll grant, hard to remove PackageKit (or preupgrade) if you're running Gnome. I migrated to Xfce just before Gnome 3 came out and, once I'd switched to lightdm I had no trouble whatsoever removing them. YMMV, of course, and probably does.

As far as finding out what starts packagekitd, try this:

systemctl status packagekitd.service

and, if it doesn't report "no file or directory," it's probably started at boot. BTW, you don't need root for that command, although if you want to change a setting you will.

cazo · #8 7th March 2013, 01:46 AM

I believe you can do this with an override file. The idea is to create a file called, for example, /usr/share/glib-2.0/schemas/org.gnome.settings-daemon.plugins.updates.gschema.override containing:

Code:

[org.gnome.settings-daemon.plugins.updates]
active=false

Then, execute

Code:

glib-compile-schemas /usr/share/glib-2.0/schemas

This should prevent any later updates from undoing it.

Fedora 17 installs two override files (for the login screen background & the desktop background). By comparing these to the regular schema .xml files, it should make more sense.

Of course, you can also do it the "easy" way of modifying the file /usr/share/glib-2.0/schemas//org.gnome.settings-daemon.plugins.updates.gschema.xml (which is part of the gnome-settings-daemon package).

Update: This is how the kickstart file /usr/share/spin-kickstarts/fedora-live-desktop.ks does it for the LiveCD.

dobbi · #9 7th March 2013, 02:42 AM

Quote:

Originally Posted by RayMikkelson

Thanks for the replies.

What package are you referring to as the "software updater?". I tried removing PackageKit itself, but then yum wants to remove an additional 20 packages, some of which I want to keep, such as gdm, gnome-shell, etc. I've seen other threads that imply you cannot remove PackageKit when using the later Fedora releases.

Running gpk-prefs, while it might work, I would need to run it for all users on my network (>100 folks), so that's not an attractive solution. Besides, not everyone runs gnome (I have KDE & LXDE users as well).

Right now, I'm considering removing gnome-packagekit (for the gnome users) and apper (for the KDE users) and ?? for LXDE...

However, I've seen packagekitd running on a newly installed box when no one has logged into it yet (other than ssh'ing in (no GUI)). So, I'm guessing that there are other triggers that start packagekitd besides a when a user is logged in via a GUI (gnome, KDE, etc.). Unfortunately, I've not figured out what those other triggers might be...

Since you are talking multiple desktop manager you need to find the one thing that all of them have.

Probably is SELinux and FreeIPA, you can craft a policy to limit user access to it so only root will be able to update those systems and distribute that policy to every client.

https://docs.fedoraproject.org/en-US...x-mapping.html

There is also TOMOYO.
https://en.wikipedia.org/wiki/TOMOYO_Linux (which seems easier, but don't take my word for it)

---------- Post added at 03:42 AM ---------- Previous post was at 03:26 AM ----------

It may also be possible to use the firewall to block access as another layer.

You can even use this cool open source network simulator to play around while trying to figure it out. Ok I will stop now.
http://www.gns3.net/

RayMikkelson · #10 11th March 2013, 09:06 PM

Thanks to everyone for their responses.

What I've decided to do is to:

Quote:

yum -y remove gnome-packagekit apper

I'm hoping that the yum command that runs at boot is triggered by gdm being started up on the console, and removing gnome-packagekit will take care of that scenario.

Most of the suggestions are gnome-centric, and I have users using other window managers, so they don't take care of the entire problem. For simplicity, I'm not running SELinux, so the PolicyKit/SELinux ideas won't work for my situation. Can't uninstall PackageKit.

I'll let you know if that does the trick...