How to run a command after apt-get upgrade

Question

Recently I came across the nice checkrestart tool, that checks if running processes use an outdated version of a recently updated library and would need a restart to load them with the updated lib. At the moment I have to call checkrestart by hand every time I have used apt-get upgrade or aptitude upgrade.

Is there a way to invoke such a command automatically after apt-get or aptitude have upgraded some packages? Bonus points if the solution also works with unattended-upgrades.

Answer 1

After some more searching it turned out what I already suspected: apt itself provides a set of hooks to invoke commands at certain events, which is used by a lot of tools but seems to be barely documented.

Calling a tool like checkrestart after a package upgrade is fairly simple. One hast just to put the following code line either into /etc/apt/apt.conf or one of the existing files or a new file in /etc/apt/apt.conf.d/:

DPkg::Post-Invoke-Success { '/usr/sbin/checkrestart';};

This will call checkrestart every time that dpkg was called by apt (and of course any other tool that relies on apt, such as aptitude) and finished successfully.

Answer 2

There are a couple of ways to do this.

Using a Script

A quick and dirty solution would be to write a script called apt-get or aptitude and make it call the actual program as such:

#!/bin/bash
# filename: apt-get

# '$@' is all of the arguments passed to the script
/usr/bin/apt-get-bin "$@"
# or /usr/bin/aptitude-bin "$@"

if [[ $1 == *upgrade* ]] ; then
    checkrestart
fi

Make the script executable: chmod +x apt-get. You may also want to make the script owned by root: chown root apt-get; chgrp root apt-get. Be careful not to set the setuid bit on your script, because if an attacker gains write privileges to it, they could quickly and easily modify it to give them a root shell.

This method would of course require you to move the actual binary to another location and move your shell script to some location in your path. The proper place to put user scripts is /usr/local/bin. In this situation though, you should put your script in the location the actual binary was in before you moved it in order to keep things organized.

Replacing the binary with a script in this manner is fairly intrusive and affects all users on the machine. As an alternative, you could call your script something like apt-get-cr and just remember to call that script instead of apt-get. You could also write a shell function.

Using a Shell Function

Using a shell function allows you to keep the command name apt-get without having to move around binaries.

apt-get() {
    # 'command' makes sure this function doesn't call itself.
    # You could also use a direct path the binary as shown above.
    command apt-get "$@"

    if [[ $1 == *upgrade* ]] ; then
        checkrestart
    fi
}

Put this function somewhere in your shell configuration (~/.bashrc, ~/.zshrc, etc.)

This method is generally a lot less intrusive than the script method. Also, it doesn't require moving around the binaries, which is generally something only the root user can do.

On the downside, the shell function method isn't always very portable between shells and doesn't inherently mesh well with graphical interfaces such as launcher bars in the way the script method does (you can almost always treat a script like an executable binary.)