Chapter 2. Installing security updates In RHEL, you can install a specific security advisory and all available security updates. You can also configure the system to download and install security updates automatically. 2.1. Installing all available security updates To keep the security of your system up to date, you can install all currently available security updates using the dnf utility. Prerequisites A Red Hat subscription is attached to the host. Procedure Install security updates using dnf utility: Without the --security parameter, dnf update installs all updates, including bug fixes and enhancements. Confirm and start the installation by pressing y : Optional: List processes that require a manual restart of the system after installing the updated packages: The command lists only processes that require a restart, and not services. That is, you cannot restart processes listed using the systemctl utility. For example, the bash process in the output is terminated when the user that owns this process logs out. 2.2. Installing a security update provided by a specific advisory In certain situations, you might want to install only specific updates. For example, if a specific service can be updated without scheduling a downtime, you can install security updates for only this service, and install the remaining security updates later. Prerequisites A Red Hat subscription is attached to the host. You know the ID of the security advisory that you want to update. For more information, see the Identifying the security advisory updates section. Procedure Install a specific advisory, for example: Alternatively, update to apply a specific advisory with a minimal version change by using the dnf upgrade-minimal command, for example: Confirm and start the installation by pressing y : Optional: List the processes that require a manual restart of the system after installing the updated packages: The command lists only processes that require a restart, and not services. This means that you cannot restart all processes listed by using the systemctl utility. For example, the bash process in the output is terminated when the user that owns this process logs out. 2.3. Installing security updates automatically You can configure your system so that it automatically downloads and installs all security updates. Prerequisites A Red Hat subscription is attached to the host. The dnf-automatic package is installed. Procedure In the /etc/dnf/automatic.conf file, in the [commands] section, make sure the upgrade_type option is set to either default or security : Enable and start the systemd timer unit: Verification Verify that the timer is enabled: Additional resources dnf-automatic(8) man page on your system

Commands:
dnf update --security
... Transaction Summary =========================================== Upgrade ... Packages Total download size: ... M Is this ok [y/d/N]: y
dnf needs-restarting 1107 : /usr/sbin/rsyslogd -n 1199 : -bash
dnf update --advisory=RHSA-2019:0997
dnf upgrade-minimal --advisory=RHSA-2019:0997
... Transaction Summary =========================================== Upgrade ... Packages Total download size: ... M Is this ok [y/d/N]: y
dnf needs-restarting 1107 : /usr/sbin/rsyslogd -n 1199 : -bash
What kind of upgrade to perform: default = all available upgrades security = only the security upgrades upgrade_type = security
systemctl enable --now dnf-automatic-install.timer
systemctl status dnf-automatic-install.timer