Stopping kernel updates on Ubuntu
Suppose that you run production machines, where you don't want to have to reboot things without a bunch of advance planning (or a serious emergency). One of the things you want to do on such a system is block kernel updates. On dpkg-based systems, this is called holding a package.
(One way to do it, the one I use, is '
echo pkgname hold | dpkg
dpkg --get-selections | fgrep hold' can then
be used to list held packages.)
In order to block all Ubuntu kernel updates, you have to remember that Ubuntu does two sorts of kernel updates:
- entirely new kernel packages (with the new kernel version in their
As new packages these aren't seen as upgrades to anything already installed on your system, so Ubuntu updates the kernel meta-packages to require the new kernel packages. Holding the meta-packages blocks any chance that these new kernel packages will get pulled in by a routine update.
In theory '
apt-get -u upgrade' won't install new packages, even dependencies of upgrades of existing packages (you have to use
dist-upgradeinstead). In practice I'm not sure that I trust that to happen all of the time; holding the meta-packages is harmless and makes sure.
(Ubuntu appears to update only the meta-packages from time to time, but since the meta-package contains basically nothing, not updating it seems harmless.)
- 'minor' point releases of existing kernel
As point releases of an already installed package, these are update candidates on their own (without a meta-package update to go with them), so you have to hold all of the existing kernel packages to block them. This means that you have to remember to apply a hold to any new kernel package that gets installed as a result of updating the meta-packages.
(If you don't care about older kernel packages, you can either leave them un-held or just remove them.)
The way we explicitly upgrade held packages is to use '
...'. There is probably a better command line way, but this one
works for us.
(Please do not suggest
aptitude. Aptitude's command line interface
makes me want to strangle people; it is about five times too clever.)