sudo apt-get upgrade installs all updates, not just security updates. I know that I can use Update Manager to select only important security updates, but is there a way to do this from the command line?
The package unattended-upgrades provides functionality to install security updates automatically.
You could use this, but instead of configuring the automatic part you could call it manually. For this case, the following should do it:
This assumes that the package is installed by default, which it probably is. If not, just do:
replace /etc/apt/preferences with the following:
now a simple apt-get upgrade will upgrade all security updates only.
Why (and how) this works: The preferences file will pin all packages from ubuntu distribution to priority 50, which will make them less desirable than already installed packages. Files originating from security repository are given the default (500) priority so they are considered for installation. This means that only packages that are considered more desirable than currently installed ones are security updates. More information about pinning in the apt_preferences manpage.
You can temporarily promote a certain distribution for updates with the --target-release option that works with apt-get and aptitude (at least) which will allow you pin certain releases so that they are eligible for upgrade.
If you wish to use this for scripts only and not make it default for the system, you can place the rules in to some other location and use this instead:
This will make apt look for the preferences file from a non-default location.
The preferences file given as an example doesn't apply to third party repositories, if you wish to pin those too you can use
A Few Tips On How To Manage Updates
This applies both to Debian and Ubuntu, but more specific instructions for Ubuntu follow.
• Show security updates only:
• Show all upgradeable packages
• Install security updates only
• Check what services need to be restarted after package upgrades. Figure out what packages you are going to upgrade beforehand and schedule your restarts/reboots. The problem here is that unless you restart a service it still may be using an older version of a library (most common reason) that's been loaded into memory before you installed new package which fixes a security vulnerability or whatever.
However, keep in mind that checkrestart may list processes that shouldn't necessarily be restarted. For example, PostgreSQL service may be keeping in its memory reference to an already deleted xlog file, which isn't a valid reason to restart the service.
Therefore, another, more reliable, way to check this using standard utils is the following little bash script that I shamelessly stole from https://locallost.net/?p=233
It checks if running processes on a system are still using deleted libraries by virtue of keeping copies of those in active memory.
Sometimes Ubuntu shows security updates as if they're coming from $release-updates repository. This is so, I'm told, because Ubuntu developers push security updates to $release-updates repository as well to expedite their availability.
If that's the case, you could do the following to deal with security updates only:
Although its pretty ugly, you could disable all the repositories apart from the security repository and then do:
I haven't tested it, but in theory it would only find updates in the security repo and apply them...
I can't find an option in either apt-get or aptitude, however someone had the same question on SuperUser. The only response is:
No reply as to whether that worked however.