How to install only security updates in Fedora using the DNF?

[Lucky Luke]

I ran below command and received "Operation aborted" massage:

#dnf updateinfo list updates security | dnf upgrade

In OpenSUSE by using the YaST can detect and install different types of updates easily, It also has the perfect advantage of DELTARPM.

On Fedora I tried Yumex but it using Yum as backend and it don't provide a way for installing different types of updates, and Yumex-dnf is not yet too stable and is not available in Fedora and RPMFUSION repositories.

Please tell me ways to do it.

[PabloTwo]

It can be done ( I just now figured out how ) but it's slightly convoluted, and it can be done with a one line command. For me this works using "sudo" in the command as I have sudo setup to not ask for any password.

For starters, I ran this command:

[paul@fettel ~]$ sudo dnf updateinfo list sec
Last metadata expiration check performed 1:32:25 ago on Sat Aug  8 14:31:57 2015.
[paul@fettel ~]$

And because my system was already fully up to date, it returned nothing. But I already knew there was a new kernel version in the updates-testing repo (kernels are always considered security updates) so I enabled that repo in the command to see what it would return:

[paul@fettel ~]$ sudo dnf --enablerepo=updates-testing updateinfo list sec
Fedora 22 - x86_64 - Test Updates                                                                      448 kB/s | 3.1 MB     00:07    
Last metadata expiration check performed 0:00:03 ago on Sat Aug  8 16:05:26 2015.
FEDORA-2015-12908 security kernel-4.1.4-200.fc22.x86_64
FEDORA-2015-12908 security kernel-core-4.1.4-200.fc22.x86_64
FEDORA-2015-12908 security kernel-headers-4.1.4-200.fc22.x86_64
FEDORA-2015-12908 security kernel-modules-4.1.4-200.fc22.x86_64
FEDORA-2015-12908 security kernel-modules-extra-4.1.4-200.fc22.x86_64
FEDORA-2015-12908 security kernel-tools-4.1.4-200.fc22.x86_64
FEDORA-2015-12908 security kernel-tools-libs-4.1.4-200.fc22.x86_64
FEDORA-2015-12921 security pcre-8.37-3.fc22.x86_64
FEDORA-2015-12921 security pcre-devel-8.37-3.fc22.x86_64
FEDORA-2015-12574 security rubygems-2.4.8-100.fc22.noarch
FEDORA-2015-13001 security webkitgtk4-2.8.5-1.fc22.x86_64
FEDORA-2015-12435 security xfsprogs-3.2.2-2.fc22.x86_64
[paul@fettel ~]$

OK, and a few other security related packages besides the kernel packages. But dnf can't work with a messy list like the output above. So, we need to get rid of the chatter before the package list. The "-q" option can do that. Then we need to parse the output so only the third field (the actual package names) in the list is displayed. Awk can do that. And we capture the final output as a variable, and send that to dnf. Like so:

[paul@fettel ~]$ security_updates=$( sudo dnf -q --enablerepo=updates-testing updateinfo list sec | awk '{print $3}' ); sudo dnf --enablerepo=updates-testing upgrade $security_updates
Last metadata expiration check performed 0:15:49 ago on Sat Aug  8 16:05:26 2015.
Dependencies resolved.
=======================================================================================================================================
 Package                               Arch                    Version                          Repository                        Size
=======================================================================================================================================
Installing:
 kernel                                x86_64                  4.1.4-200.fc22                   updates-testing                   67 k
 kernel-core                           x86_64                  4.1.4-200.fc22                   updates-testing                   19 M
 kernel-modules                        x86_64                  4.1.4-200.fc22                   updates-testing                   18 M
 kernel-modules-extra                  x86_64                  4.1.4-200.fc22                   updates-testing                  2.2 M
Upgrading:
 kernel-headers                        x86_64                  4.1.4-200.fc22                   updates-testing                  1.0 M
 kernel-tools                          x86_64                  4.1.4-200.fc22                   updates-testing                  154 k
 kernel-tools-libs                     x86_64                  4.1.4-200.fc22                   updates-testing                   74 k
 pcre                                  x86_64                  8.37-3.fc22                      updates-testing                  486 k
 pcre-devel                            x86_64                  8.37-3.fc22                      updates-testing                  538 k
 rubygems                              noarch                  2.4.8-100.fc22                   updates-testing                  269 k
 webkitgtk4                            x86_64                  2.8.5-1.fc22                     updates-testing                   20 M
 xfsprogs                              x86_64                  3.2.2-2.fc22                     updates-testing                  873 k
Removing:
 kernel                                x86_64                  4.1.2-200.fc22                   @System                            0  
 kernel-core                           x86_64                  4.1.2-200.fc22                   @System                           42 M
 kernel-modules                        x86_64                  4.1.2-200.fc22                   @System                           17 M
 kernel-modules-extra                  x86_64                  4.1.2-200.fc22                   @System                          2.1 M

Transaction Summary
=======================================================================================================================================
Install  4 Packages
Upgrade  8 Packages
Remove   4 Packages

Total download size: 63 M
Is this ok [y/N]: n
Operation aborted.
[paul@fettel ~]$

For your purposes, you will want to leave out the "--enablerepo=updates-testing" parts from the command, and you can leave out the "sudo" parts and run this command directly as the root user. I was running it as a regular user for testing.

[PabloTwo]

You could refine this a bit further by setting the command into a bash script file. In the script file you could then test for an "empty string" (no content in the variable) and if it's empty then exit so you don't then try to get dnf to upgrade no packages. Something like:

#!/bin/bash
# Check for and install security updates if available

security_updates=$( dnf -q updateinfo list sec | awk '{print $3}' )
if [ -n "$security_updates" ]; then
   exit
fi
dnf upgrade $security_updates

[Lucky Luke]

Thank you so much.

What to do for filtering the updates list? For example if we don't want to install <Firefox> update. Can I use "grep [-v|--invert-match]" ?

[PabloTwo]

For any packages, security or otherwise, that you don't want to update, just create a line:

exclude=

in your /etc/dnf/dnf.conf file. Globs OK and use space to separate entries. Say, if you didn't want any kernel or firefox updates:

exclude=kernel* firefox

[mrlee]

Method below was fully satisfying for me.
Create file with name "dnfupdate-security" then paste python lines below or
execute cmd:

sudo touch /usr/bin/dnfupdate-security && sudo chmod +x /usr/bin/dnfupdate-security
sudo gedit /usr/bin/dnfupdate-security

#!/usr/bin/python
"""
DESCRIPTION: Check for security updates and insert all the packages into "dnf update" as argument.
"""
import os

updateList = ''; x = ''

for x in os.popen("dnf -q updateinfo list sec | awk '{print $3}'"):
	x = x.strip()
	updateList = updateList+' '+x

if x != '':
	os.system('dnf update '+updateList)
else:
	print 'No security updates available at this time!'

Then execute:

sudo dnfupdate-security

[srakitnican]

How does this differ from PabloTwo method?

As I see is using the same method to check for security updates and to pass it to dnf.

[mrlee]

Sorry but in my case the method below produces no positive result. I tried booth methods just to clear my doubts but the method below is not returning any updates although 1 existed. My proposed method does list it and works properly. Please try the pablo method to clear my doubts? I copied and paste it as is but still no result?!


#!/bin/bash
# Check for and install security updates if available

security_updates=$( dnf -q updateinfo list sec | awk '{print $3}' )
if [ -n "$security_updates" ]; then
exit
fi
dnf upgrade $security_updates

[srakitnican]

Yes, there is a bug in if check, it is basically inverted of what is supposed to do.

[ -z STRING ] True of the length if "STRING" is zero.
[ -n STRING ] or [ STRING ] True if the length of "STRING" is non-zero.

Simply this should work:

#!/bin/bash
# Check for and install security updates if available

security_updates=$( dnf -q updateinfo list sec | awk '{print $3}' )
if [ "$security_updates" ]; then
  dnf upgrade $security_updates
fi

Don't have any update to confirm ATM.