Objective
To provide a workaround for Linux patch policies on RHEL, CentOS, and Fedora systems where excluded packages are updated due to unresolved dependency chains, using a custom Automox Worklet.
Overview
When using an Automox Patch All Except policy on Linux endpoints, excluded package names are passed directly to the underlying package manager (yum or dnf). However, if an included package requires an updated version of an excluded package as a dependency, the package manager may override the policy exclusion to satisfy the dependency requirement.
Example Scenario:
If a policy excludes httpd, but php is scheduled for an update that requires a newer version of httpd, running yum update will force httpd to update to satisfy the php dependency chain.
To prevent this, administrators can deploy a custom Worklet using explicit --exclude (-x) flags alongside --skip-broken to enforce strict package and dependency exclusion rules.
Command-Line Syntax Examples
Depending on your environment's requirements, adjust the yum or dnf syntax in your remediation script:
| Use Case | Execution Command | Description |
| Exclude Single Package & Dependencies | yum -x 'httpd*' update --skip-broken -y | Excludes all packages starting with httpd and skips packages with broken dependencies. |
| Exclude Multiple Specific Packages | yum -x php,httpd update --skip-broken -y | Excludes php and httpd simultaneously. |
| Exclude Multiple Wildcard Patterns | yum -x 'php*' -x 'kernel*' update --skip-broken -y | Uses multiple wildcard pattern exclusions for both PHP and Kernel updates. |
ℹ️ RHEL 8/9 & Modern Enterprise Linux Note: On modern distributions (RHEL 8+, Fedora, Rocky Linux, AlmaLinux),
dnfreplacesyum. The syntax and flags (-xand--skip-broken) remain identical.
Worklet Configuration
Replace standard CentOS/RHEL Patch All Except policies with this custom Worklet structure to enforce strict dependency handling.
1.Create a New Linux Worklet:
- In the Automox console, navigate to Policies > Create Policy.
- Select Worklet and set the OS target to Linux.
- Enter a clear name (e.g., RHEL/CentOS - Patch Updates with Strict HTTPD/PHP Exclusions).
2.Configure Evaluation Code:
To ensure system updates run consistently on your defined schedule, force the Evaluation script to return exit code 1 (Non-Compliant):
Bash
#!/bin/bash
# Force remediation execution during scheduled policy cycle
exit 1
3.Configure Remediation Code:
Add your custom package update script using the appropriate exclusion pattern:
Bash
#!/bin/bash
# Update system packages while excluding specific patterns and broken dependency chains
if command -v dnf &> /dev/null; then
dnf -x 'httpd*' -x 'php*' update --skip-broken -y
else
yum -x 'httpd*' -x 'php*' update --skip-broken -y
fi
4.Assign Device Groups & Set Schedule:
- Assign the Worklet to your target RHEL/CentOS Device Group(s).
- Configure the execution schedule to match your regular maintenance window.
- Click Save Policy.