yum update --security installs only security updates. I think it's an extension from the yum-security plugin.

Is there an equivalent dnf command? (dnf replaced yum in Fedora 22)


4 Answers 4


You can use dnf-automatic with three settings:

apply_updates = yes
download_updates = yes
upgrade_type = security

(Default configuration file is /etc/dnf/automatic.conf)

or using:

dnf updateinfo list security

to get all available updates, then update them manually.


Based on http://forums.fedoraforum.org/showthread.php?t=305905


SECURITY_UPDATES_LIST=$( dnf --refresh -q updateinfo list sec | awk '{print $3}' )
SECURITY_UPDATES_NUM=`echo "$SECURITY_UPDATES_LIST" | sed '/^$/d' | wc -l`

if [ "$SECURITY_UPDATES_NUM" -eq 0 ]; then

  • --refresh force repo sync
  • -y install automatically
  • SECURITY_UPDATES_NUM refined/fixed counting method, works for 0/1/infinity
  • 1
    The same as one-liner in bash (-y and --refresh can be added): up=$(sudo dnf -q updateinfo list sec | awk '{print $3}'); [[ $up ]] && sudo dnf upgrade $up
    – marcin
    Apr 5, 2016 at 16:51
  • As a one-liner alias alias security-update="pkgs=\$(sudo dnf --refresh -q updateinfo list sec | awk '{print \$3}'); [[ \$pkgs ]] && sudo dnf upgrade -y \$pkgs" Jul 12, 2019 at 3:32

You can put the dnf updateinfo list updates security in a for loop on the cli or bash script. I still highly recommend to review the security updates but you can always allow to throw in the -y command to dnf update

this is what works for me depending on some needs:

for i in $(dnf updateinfo list updates security | grep -Ei ^fedora | cut -d' ' -f3) ; do dnf update $i; done

Or a bit shorter with awk ( be aware this doesn't work with --refresh )

for i in $(dnf updateinfo list updates security | awk 'NR>1 {print $3}') ; do dnf update $i; done

for a dnf --refresh

for i in $(dnf updateinfo list updates security| dnf updateinfo list updates security| awk 'NR>1 {print $3}') ; do dnf update $i; done

The before proposed methods didn't satisfy in my case. You can try this one and it's perhaps more perfect. Create file with name "dnfupdate-security" then paste python lines below or execute cmd:

cmd1: sudo touch /usr/bin/dnfupdate-security && sudo chmod +x /usr/bin/dnfupdate-security

cmd2: sudo gedit /usr/bin/dnfupdate-security

Next paste the python code into file 'dnfupdate-security', save it

Execution cmd: sudo dnfupdate-security

DESCRIPTION: Check for security updates and insert all the packages into "dnf update" as argument.
import os

updateList = ''; x = ''

for x in os.popen("dnf -q updateinfo list sec | awk '{print $3}'"):
    x = x.strip()
    updateList = updateList+' '+x

if x != '':
    os.system('dnf update '+updateList)
    print 'No security updates available at this time!'
  • 1
    "more perfect" ? Mar 29, 2016 at 13:47
  • This more perfect solution gives an IndentationError (because import os is in not at the beginning of the line (even if you remove the 3 leading spaces from each line). And even if I correct your inconsistent indentation, I get a SyntaxError.
    – Anthon
    Mar 29, 2016 at 14:10
  • Dissing old answers is not something you should do. Some people may think the same thing about your code, i.e. it sucks.
    – MelBurslan
    Mar 29, 2016 at 14:11
  • All critique's accepted positively. I done few edits. I tested all and it should work on fedora/redhat based systems... I didn't mean to say method before didn't work but in my case sucks?! :) Mar 29, 2016 at 15:03
  • so you put shell commands from Tomot's answer into python scripts changing dnf upgrade -y to dnf update. Any other substantial differences?
    – marcin
    Mar 29, 2016 at 15:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.