CloudOps Orchestration Service:How Patch Manager works

Linux

Patch Manager supports multiple Linux distributions. Each uses a different package manager to scan and install patches.

Patch baselines on YUM and DNF

CentOS, Alibaba Cloud Linux, Red Hat Enterprise Linux, and Anolis OS use YUM or DNF to manage packages. Both support update notifications stored in a updateinfo.xml file in the software repository. Each update notification contains a set of packages that fix specific issues. These packages are treated as security packages. If you do not select Include Non-security Updates when creating a patch baseline, only packages listed in update notifications are eligible.

Fields in updateinfo.xml:

Patch Manager filters update notifications in updateinfo.xml based on patch baseline rules. For example, the CentOS public baseline specifies:

'PatchFilterGroup': [
    {
        'Values': [
            '*'
        ],
        'Key': 'Product'
    },
    {
        'Values': [
            'Security',
            'Bugfix'
        ],
        'Key':'Classification'
    },
    {
        'Values': [
            'Critical',
            'Important'
        ],
        'Key': 'Severity'
    }
]

This rule matches Security or Bugfix updates at Critical or Important severity. Equivalent yum command:

yum check-update --security --bugfix --secseverity=Critical,Important

Equivalent dnf commands:

dnf  check-update --security --bugfix --secseverity=Critical
dnf  check-update --security --bugfix --secseverity=Important

If a custom baseline rule does not specify patch types or severity levels, the equivalent commands are:

yum check-update --security
dnf check-update --security

After filtering, Patch Manager runs the yum(update api) or dnf update command to install patches, then restarts the instance. If Allow Restart is set to No, the instance is not restarted.

Note: If kernel live patching is enabled on Alibaba Cloud Linux 2 and only kernel live patches are installed, Patch Manager skips the restart. Kernel Live Patching overview.

Patch baselines on APT

On Debian and Ubuntu, patch baselines select patches based on the Priority and Section fields of DEB packages.

Patch Manager scans and installs patches as follows:

1. Runs apt update to refresh the package list.

2. Matches upgradable packages against the patch baseline. If Include Non-security Updates is not selected, only packages in the security repository are eligible. Security repository names by OS:

Debian Server 8: debian-security jessie
Debian Server 9: debian-security stretch
Debian Server 10: debian-security buster
Debian Server 11: debian-security bullseye
Debian Server 12: debian-security bookworm
Ubuntu Server 16.04 LTS: xenial-security
Ubuntu Server 18.04 LTS: bionic-security
Ubuntu Server 20.04 LTS: focal-security
Ubuntu Server 22.04 LTS: jammy-security

The Debian/Ubuntu public baseline matches packages with Required or Important priority:

'PatchFilterGroup': [
    {
        'Values': [
            '*'
        ],
        'Key': 'Product'
    },
    {
        'Values': [
            'Required',
            'Important'
        ],
        'Key': 'Severity'
}

This rule is equivalent to:

1. Run apt list --upgradable to list all upgradable packages.

2. Run apt list -a package-name to list all versions, sorted latest to earliest.

3. Run apt show package-name=={Version} to check the priority and whether it meets the baseline rule.

4. Verify the matching version is in the security repository.

Patch Manager runs the apt update api command to install matched patches, then restarts the instance. If Allow Restart is set to No, the instance is not restarted.

Patch baselines on Zypper

On SLES and openSUSE, Zypper manages system patches. Run zypper list-patches to list applicable patches. Patch attributes:

Zypper patch baselines filter by Category and Severity. Example:

"PatchFilterGroup": [
    {
        "Values": [
            "*"
        ],
        "Key": "Product"
    },
    {
        "Values": [
            "security",
            "recommended"
        ],
        "Key": "Classification"
    },
    {
        "Values": [
            "Critical",
            "Important",
            "Moderate"
        ],
        "Key": "Severity"
    }
],

This rule matches security and recommended patches at Critical, Important, or Moderate severity.

Windows

Note: Patch Manager supports only Windows Server 2012 R2, Server 2016, Server 2019, Server 2022, and Server 2025.