In the GUI tool you can get a list packages with security updates. Can this be done on the command line in Debian or Ubuntu?
Normally I might use "apt-get upgrade" which would show me what is being upgraded, but I would like to know which ones are security updates.
apt-get upgrade -s | grep -i security
... is what the Nagios check-apt plugin uses to count pending security updates which is similar to what you're looking for.
On ubuntu you should be able to use apt-check, it's the one that populates your motd with the number of security updates available.
Use the unattended-upgrade application.
sudo unattended-upgrade
This lets you install only security updates automatically, but you can call it manually if needed.
You can get a list with this command:
sudo unattended-upgrade --dry-run -d 2> /dev/null | grep 'Checking' | awk '{ print $2 }'
I have a modified version of update-notifier that takes an additional switch: --security-package-names which outputs only the security related package names. I have it as a gist (until I create a merge request in the relevant project in launchpad). Until then it can be run as follows:
Run
curl -s https://gist.githubusercontent.com/ahmadnazir/c2444d6b09fd7bb4963a13bc577d92a3/raw/0231b94a4e46abe0a5959de5f84feda76ad2eb9d/apt-check.py \
| python /dev/stdin --security-package-names \
| column -t -s , \
| sort
Output
This gives an output of the format: package name, installed version, and candidate version:
...
thunderbird 1:38.6.0+build1-0ubuntu0.14.04.1 1:38.8.0+build1-0ubuntu0.14.04.1
thunderbird-gnome-support 1:38.6.0+build1-0ubuntu0.14.04.1 1:38.8.0+build1-0ubuntu0.14.04.1
thunderbird-locale-en 1:38.6.0+build1-0ubuntu0.14.04.1 1:38.8.0+build1-0ubuntu0.14.04.1
thunderbird-locale-en-us 1:38.6.0+build1-0ubuntu0.14.04.1 1:38.8.0+build1-0ubuntu0.14.04.1
...
Based on Fabrizio Regini's answer above.
For 12.04 / Precise:
sudo unattended-upgrade --dry-run -d 2>&1 /dev/null | grep 'Checking' | grep security | awk '{ print $2 }'
For 14.04 /Trusty:
sudo unattended-upgrade --dry-run -d | grep 'Checking' | grep security | awk '{ print $2 }'
And a variant clobbered together after reading the other responses - I believe this to cater to the false positive issue, and be reasonably lightweight.
sudo unattended-upgrade --dry-run -d 2>/dev/null | awk '/Checking/ && /archive:..*-security. / {print $2}'
I believe that Answering the question the OP asks is how to see the List of packages, and not how to install only security packages. Building on the answer of @topdog You should use:
/usr/lib/update-notifier/apt-check -p
Where the -p flag stands for packages
These two commands will spit out the list. Pipe to wc -l to see how many are behind. ;-)
grep security /etc/apt/sources.list > /tmp/security.list
sudo apt-get upgrade -oDir::Etc::Sourcelist=/tmp/security.list -s
Still valid for older distros or if you have update repos off, but security on:
sudo apt-get upgrade -s| grep ^Inst |grep Security
I think @smin 's answer is basically a good approach, but a bit loose with the regex, as noted by @Shnatsel.
How about this:
apt-get upgrade -q --dry-run \
| perl -ne 'm/^Inst (\S+) \S+ \(([^\)]+) Debian-Security:8/ && print "$1-$2\n"'
This lists the package names along with the versions you want to install. You can take -$2 out of the print statement if you don't want the versions there.
[This could probably be made just a little lighter-weight by using awk instead of perl]
I solved modifying the apt-check script on my Ubuntu system. It takes care only about security updates, displaying also package names if -p flag it has been provided.
You can find the gist here: https://gist.github.com/thesp0nge/94f9d336a081a3fefba6ca61d787a28b
