How do I configure the package manager to disable or enable kernel updates on a Linux ECS instance?-阿里云帮助中心

Configure YUM, APT, or DNF to prevent or allow automatic kernel updates on a Linux ECS instance.

Background

Kernel updates may cause issues such as incompatible hardware drivers, invalid SELinux modules, and instance startup failures. Evaluate the update content and necessity before proceeding.

Prerequisites

Complete compatibility tests and create snapshots for the instance to ensure data security.

Disable or enable kernel updates

To prevent automatic kernel updates, configure the package manager for your Linux distribution.

Alibaba Cloud Linux and CentOS

Use Workbench to connect to the Linux ECS instance over SSH.
View the current kernel version:
```
sudo uname -r
```
Sample output showing kernel version 5.10.134-16.al8.x86_64:
```
5.10.134-16.al8.x86_64
```

View installed kernel packages:

sudo rpm -qa | grep kernel

Sample output showing the installed package kernel-5.10.134-16.al8.x86_64:

kernel-devel-5.10.134-18.al8.x86_64
kernel-core-5.10.134-16.al8.x86_64
kernel-modules-5.10.134-16.al8.x86_64
kernel-modules-extra-5.10.134-16.al8.x86_64
kernel-modules-internal-5.10.134-16.al8.x86_64
kernel-tools-libs-5.10.134-16.al8.x86_64
kernel-tools-5.10.134-16.al8.x86_64
kernel-5.10.134-16.al8.x86_64
kernel-devel-5.10.134-16.al8.x86_64
kernel-headers-5.10.134-16.al8.x86_64

Open the YUM configuration file:
```
sudo vi /etc/yum.conf
```
Press I to enter Insert mode and add the following line:
```
exclude = kernel*
```
Note
- This line blocks all kernel updates, including security patches. The instance may miss critical kernel security updates, which can lead to security risks.
- To re-enable kernel updates, delete or comment out the line added in Step 5.
Press Esc, enter :wq, and press Enter to save and close the file.

(Optional) Verify that kernel updates are blocked:

sudo yum update --assumeno | grep kernel

If kernel updates are blocked, the output ends with:

kernel-core                             x86_64  5.10.134-18.al8              alinux3-plus      32 M
 kernel-modules                          x86_64  5.10.134-18.al8              alinux3-plus      23 M
 kernel-modules-extra                    x86_64  5.10.134-18.al8              alinux3-plus     1.5 M
 kernel-modules-internal                 x86_64  5.10.134-18.al8              alinux3-plus     1.0 M
 kernel-headers                          x86_64  5.10.134-18.al8              alinux3-plus     2.3 M
 kernel-tools                            x86_64  5.10.134-18.al8              alinux3-plus     1.1 M
 kernel-tools-libs                       x86_64  5.10.134-18.al8              alinux3-plus     947 k
Operation aborted.

Ubuntu and Debian

Use Workbench to connect to the Linux ECS instance over SSH
View the current kernel version:
```
sudo uname -r
```
Sample output showing kernel version 5.4.0-204-generic:
```
5.4.0-204-generic
```

View installed kernel packages:

sudo dpkg -l | grep linux-image

Sample output showing the installed package linux-image-5.4.0-204-generic:

ii  linux-image-5.4.0-204-generic         5.4.0-204.224                     amd64        Signed kernel image generic
ii  linux-image-5.4.0-42-generic          5.4.0-42.46                       amd64        Signed kernel image generic
ii  linux-image-generic                   5.4.0.204.200                     amd64        Generic Linux kernel image

Lock the kernel package:
```
sudo apt-mark hold linux-image-*
```
Note
- This line blocks all kernel updates, including security patches. The instance may miss critical kernel security updates, which can lead to security risks.
- To re-enable kernel updates:
  
  sudo apt-mark unhold linux-image-*
(Optional) View locked kernel packages:
```
sudo apt-mark showhold
```

Fedora

Use Workbench to connect to the Linux ECS instance over SSH
View the current kernel version:
```
sudo uname -r
```
Sample output showing kernel version 6.10.10-200.fc40.x86_64:
```
6.10.10-200.fc40.x86_64
```

View installed kernel packages:

sudo rpm -qa | grep kernel

Sample output showing the installed package kernel-6.10.10-200.fc40.x86_64:

kernel-modules-core-6.8.5-301.fc40.x86_64
kernel-core-6.8.5-301.fc40.x86_64
kernel-modules-6.8.5-301.fc40.x86_64
libreport-plugin-kerneloops-2.17.15-1.fc40.x86_64
kernel-6.8.5-301.fc40.x86_64
kernel-devel-6.8.5-301.fc40.x86_64
kernel-headers-6.10.3-200.fc40.x86_64
abrt-addon-kerneloops-2.17.6-1.fc40.x86_64
kernel-modules-core-6.10.10-200.fc40.x86_64
kernel-core-6.10.10-200.fc40.x86_64
kernel-modules-6.10.10-200.fc40.x86_64
kernel-devel-6.10.10-200.fc40.x86_64
kernel-6.10.10-200.fc40.x86_64
kernel-tools-libs-6.8.5-301.fc40.x86_64
kernel-tools-6.8.5-301.fc40.x86_64

Open the DNF configuration file:
```
sudo vi /etc/dnf/dnf.conf
```
Press I to enter Insert mode and add the following line:
```
exclude = kernel*
```
Note
- This line blocks all kernel updates, including security patches. The instance may miss critical kernel security updates, which can lead to security risks.
- To re-enable kernel updates, delete or comment out the line added in Step 5.
Press Esc, enter :wq, and press Enter to save and close the file.
(Optional) Verify that kernel updates are blocked:
```
sudo dnf update --assumeno | grep kernel
```
If kernel updates are blocked, the output shows:
```
Operation aborted.
```

Important

These methods are for reference only. If your instance requires a specific kernel version, develop a plan based on your business scenario to prevent issues from kernel updates.

Troubleshooting

Problem description: When updating the kernel on an Alibaba Cloud Linux or CentOS instance, the No package marked for Update error appears.
Cause: The /etc/yum.conf file may contain a kernel exclusion rule that blocks updates.
Solution:
- Use Workbench to connect to the Linux instance over SSH.
- Open the YUM configuration file:
```
sudo vi /etc/yum.conf
```
- Press I to enter Insert mode. Delete or comment out the exclude = kernel* line.
```
# To comment out the configuration, add a number sign (#) in front of the line that includes the configuration. 
exclude = kernel*
```
- Press Esc, enter :wq, and press Enter to save and close the file.

References

To manually upgrade the kernel, see Upgrade the operating system kernel of a Linux ECS instance.