I was googling about yum and reading some articles when I stumbled on bunch of articles about disabling yum from update kernel packages. Now I'm wondering why I should do that. When I update system I update all packages. Even if kernel update will mess up something you can always boot with older one (Centos has ability to maintain few kernels). In the end if you have bad day update of any package can mess things up, but keeping system up to date is one of basics rules of security.

Am I wrong ? Why I should prevent yum from kernel update?


The primary reason is when your system is using additional kernel modules not included in the distribution, for instance to support specific hardware. You might be dependent on a third party vendor providing the update for that.

The historic reason may be because unless explicitly configured otherwise an upgrade replaces the old version of a package and that may be problematic if that happens to running kernel. (Although the defaults for yum are to install new kernels and not upgrade them, making that a non-issue)

  • reasonable argument – B14D3 Nov 5 '14 at 12:00

I don't see any good reason for don't update the kernel, because yum has:

installonly_limit = 3

This setting is by default, that would says, if i update my current kernel and something bad broke my server during the system update, i can come back to the previous kernel.


If you use Fedora, the kernel will update very often, after that it will add a new item in the GRUB2 menu at startup screen, I always keep previous one and current one, when the new kernel messes up the operating system, I would scroll back to the previous kernel. So I made aliases up/ug to

sudo yum update --exclude=kernel*
sudo yum --exclude=kernel* upgrade

to update/upgrade, if I want to update kernels, I would manually type the right commands to update the kernel packages.

  • 2
    * has special meaning in the shell. Better to quote it like --exclude='kernel*'. – kasperd Nov 5 '14 at 12:29
  • @kasperd there is no problem with or without quote, you me an example if you have. – CodyChan Nov 6 '14 at 0:48
  • Try touch './--exclude=kernel-1.*' and then run the command again. If you are using bash, you can also try shopt -s failglob – kasperd Nov 6 '14 at 17:48
  • @kasperd Why would anyone like to create a file/dir a name prefix of "--"? Normally I would even avoid creating a file/dir like "File Name" but prefer "File_name or "File-name" – CodyChan Nov 7 '14 at 5:28
  • Might be a simple mistake or possibly somebody trying to pull off a privilege escalation. The essence is, the meaning of the command as you typed it not what you want it to do. Why would you want to use a command which means do what I want you to do unless this file exists, in which case I want you to do something else? – kasperd Nov 7 '14 at 8:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.