Marking packages as non-removable / non-installable

Question

My machine resides in a corporate domain and have CFEngine installed, for automated configuration and maintenance purposes. Configuration is pulled automatically into few thousand computers from one place, and my machine is just one of those.

I'm root and can change the system in the way I want, but don't want to touch CFEngine files at all.

Problem:

Adobe recently released a new Flash version (11.2) that fixes some security issues, but I have version 11.0r1. After new version release Chrome won't automatically execute Flash plugin, and shows the message every time I visit the page with a flash content:

Adobe Flash Player was blocked because it is out of date.

Along with message there are two buttons, Run this time and Update plug-in.... Both buttons works as expected, and update works as well. But after some short period of time new Flash plugin is automatically removed from the machine and old Flash package is installed back, because of CFEngine, where old Flash package is marked as mandatory.

Question:

Is it possible to tell apt that some particular packages are non-removable, or non-installable, so CFEngine will fail installing old Flash package while will succeed with others?

Or any other ways of permanently updating Flash?

Answer 1

You can "hold" a package in Ubuntu.

Holding a package basically means you're telling the package manager to keep the current version no matter what. This is useful if more recent version of a currently working program breaks after an update.

You can do it via Synaptic or on the command-line via apt/dpkg. The command-line version to hold a package is:

echo package_name hold | dpkg --set-selections

Ubuntu Community Documentation has a more complete guide explaining how to pin or hold packages.

---

Answer above is ripped from here. Following solved the problem:

echo adobe-flashplugin hold | dpkg --set-selections