.\" yum security plugin .TH "yum-security" "8" "12 April 2007" "James Antill" "" .SH "NAME" yum security plugin .SH "SYNOPSIS" \fByum\fP [options] [command] [package ...] .SH "DESCRIPTION" .PP This plugin extends \fByum\fP to allow lists and updates to be limited using security relevant criteria .PP added yum \fIcommand\fPs are: .br .I \fR yum update-minimal .PP This works like the update command, but if you have the the package foo-1 installed and have foo-2 and foo-3 available with updateinfo.xml then update-minimal will update you to foo-3. .br .I \fR yum updateinfo info .br .I \fR yum updateinfo list .br .I \fR yum updateinfo summary .PP all of the last three take these \fIsub-command\fPs: .br .I \fR yum updateinfo * all .br .I \fR yum updateinfo * available .br .I \fR yum updateinfo * installed .br .I \fR yum updateinfo * updates .PP and then: .br .I \fR * [advisory...] .br .I \fR * .br .I \fR * bugzillas .br .I \fR * cves .br .I \fR * enhancement .br .I \fR * security .br .I \fR * new-packages .br .br .PP .IP "\fBall\fP" Is used to display information about both install and available advisories. .PP .IP "\fBavailable\fP" Is used to display information about just available advisories. This is the default. .PP .IP "\fBinstalled\fP" Is used to display information about just install advisories. .PP .IP "\fBupdates\fP" This is mostly the same as "available" but it only shows advisory information for packages that can be updated to. .PP .IP "\fB [advisory...]\fP" Is used to display information about one or more advisories. .PP .IP "\fB [package...]\fP" Is used to display information about one or more packages. .PP .IP "\fBlist\fP" Is used to list all of the relevant errata notice information, from the updateinfo.xml data in yum. This includes bugzillas, CVEs, security updates and new. .PP .IP "\fBinfo\fP" Is used to show all the errata notice information, from the updateinfo.xml data in yum. This includes bugzillas, CVEs, security updates and new. .PP .IP "\fBlist\fP" Is used to list all of the relevant errata notice information, from the updateinfo.xml data in yum. This includes bugzillas, CVEs, security updates and new. .IP .IP "\fBbugzillas / bzs\fP" Is the subset of the updateinfo information, pertaining to the bugzillas. .IP .IP "\fBcves\fP" Is the subset of the updateinfo information, pertaining to the CVEs. .IP .IP "\fBsecurity / sec\fP" Is the subset of the updateinfo information, pertaining to security. .IP "\fBbugfix\fP" Is the subset of the updateinfo information, pertaining to bugfixes. .IP "\fBenhancement\fP" Is the subset of the updateinfo information, pertaining to enhancements. .IP "\fBrecommended\fP" Is the subset of the updateinfo information, pertaining to recommended updates. .IP "\fBnew-packages\fP" Is the subset of the updateinfo information, pertaining to new packages. These are packages which weren't available at the initial release of your distribution. .IP .PP .SH "GENERAL OPTIONS" There are four options added to yum that are available in the "list updates", "info updates", "check-update" and "update" commands. They are: .PP .IP "\fB\--advisory\fP" This option includes packages coresponding to the advisory ID, Eg. FEDORA-2201-123. .IP "\fB\--bz\fP" This option includes packages that say they fix a Bugzilla ID, Eg. 123. .IP "\fB\--cve\fP" This option includes packages that say they fix a CVE - Common Vulnerabilities and Exposures ID (http://cve.mitre.org/about/), Eg. CVE-2201-0123. .IP "\fB\--bugfixes\fP" This option includes packages that say they fix a bugfix issue. .IP "\fB\--security\fP" This option includes packages that say they fix a security issue. .PP .PP .SH "EXAMPLES" .PP To list all updates that are security relevant, and get a reutrn code on whether there are security updates use: .IP yum --security check-update .PP To upgrade packages that have security errata (upgrades to the latest available package) use: .IP yum --security update .PP To upgrade packages that have security errata (upgrades to the last security errata package) use: .IP yum --security update-minimal .PP To get a list of all BZs that are fixed for packages you have installed use: .IP yum updateinfo list bugzillas .PP To get a list of all security advisoryies, including the ones you have already installed use: .IP yum updateinfo list all security .PP To get the information on advisory FEDORA-2707-4567 use: .IP yum updateinfo info FEDORA-2707-4567 .PP To update packages to the latest version which contain fixes for Bugzillas 123, 456 and 789; and all security updates use: .IP yum --bz 123 --bz 456 --bz 789 --security update .PP To update to the packages which just update Bugzillas 123, 456 and 789; and all security updates use: .IP yum --bz 123 --bz 456 --bz 789 --security update-minimal .PP To get an info list of the latest packages which contain fixes for Bugzilla 123; CVEs CVE-2207-0123 and CVE-2207-3210; and Fedora advisories FEDORA-2707-4567 and FEDORA-2707-7654 use: .IP yum --bz 123 --cve CVE-2207-0123 --cve CVE-2207-3210 --advisory FEDORA-2707-4567 --advisory FEDORA-2707-7654 info updates .PP To get a list of packages which are "new". .IP yum updateinfo list new .PP To get a summary of advisories you haven't installed yet use: .IP yum updateinfo summary .SH "SEE ALSO" .nf .I yum (8) .I yum.conf (5) .fi .SH "AUTHORS" .nf James Antill . .fi .SH "BUGS" The update-minimal command ignores the --obsoletes flag. The update-minimal command can only directly affect things atm., so if you update pkgA minimally but that requires an update to pkgB then pkgB will be updated to the newest version by the depsolver. Also the above will happen even if you've also minimally updated pkgB, if either the direct (minimal) update for pkgB happens after or if the minimal update for pkgB doesn't satisy the requirements of pkgA. The main "problem" is that if the data is not correct the plugin cannot work correctly. For instance "--bz 123" will not fix BZ 123 if a package is updated to fix that BZ without referencing that it does so in the updateinfo.xml.