Exclude Package Updates Yum DNF Command

The yum and dnf commands let you exclude specific packages from being updated, installed, or removed by adding the --exclude option or by configuring exclude directives in the repository or main configuration files. You can use this to block a single package, multiple packages, or a group of packages using wildcards, and the setting applies to both command-line invocations and persistent configuration.

How to Use the Exclude Option

The --exclude option works with both yum and dnf. On most modern Fedora and RHEL-based systems, yum is a symlink to dnf, so the syntax is identical.

Exclude a single package: sudo dnf --exclude=kernel update
Exclude multiple packages: sudo dnf --exclude=kernel --exclude=firefox update
Use wildcards: sudo dnf --exclude='kernel*' update
Exclude during install: sudo dnf --exclude=unwanted install package

The option applies to the current command only. To make it permanent, add the exclude directive to the configuration file as described below.

Persistent Exclusion via Configuration Files

To exclude packages from all future operations, edit the main configuration file /etc/dnf/dnf.conf (or /etc/yum.conf on older systems) and add a line under the [main] section:

exclude=kernel* firefox

This excludes any package matching kernel* and the exact package firefox. You can also add exclusions per repository by editing the repository file (e.g., /etc/yum.repos.d/epel.repo) and adding an exclude= line under the repository’s [epel] section.

To verify the current exclusions, run dnf config-manager --dump or check the configuration files. The --exclude option on the command line overrides the configuration file for that single run.

Common Use Cases

Excluding packages is useful in several scenarios:

Kernel updates: On production servers, you may want to delay kernel updates until you test them. Exclude kernel* to prevent automatic updates.
Specific software versions: If an application requires a specific version of a library, you can exclude that library to avoid breaking the application.
Large downloads: Temporarily exclude a large package to speed up the update process.
Testing: When you want to update everything except a particular package to isolate issues.

Remember that excluding a package means it will not receive security or bug fixes, so it should be a deliberate decision.

Common Mistakes and Misconceptions

One common mistake is using the wrong syntax for wildcards. The pattern kernel* matches any package whose name starts with kernel, but it does not match kernel-devel if you use kernel*? Actually, it does match because the asterisk is a glob. However, if you want to match exactly kernel and its subpackages, you need to list them explicitly or use a broader pattern.

Another mistake is forgetting that the --exclude option does not apply to dnf remove or dnf install unless you specify it. The exclusion only affects the operation you run it with.

Some users think that excluding a package also excludes its dependencies. That is not true: only the named packages are excluded. Dependencies may still be updated, which could cause conflicts. To exclude a package and its dependencies, you need to list them all or use a different approach like version locking.

Alternatives: Version Locking and Held Packages

If you need to keep a package at a specific version, the dnf versionlock plugin is a more robust alternative. It locks the package to the installed version and prevents any change unless you explicitly unlock it.

Install the plugin: sudo dnf install python3-dnf-plugin-versionlock
Lock a package: sudo dnf versionlock add firefox
List locked packages: sudo dnf versionlock list
Remove a lock: sudo dnf versionlock delete firefox

Version locking is more precise than excluding because it prevents both updates and downgrades, and it works with dependency resolution.

Frequently Asked Questions

How do I exclude multiple packages with dnf?

You can use multiple --exclude options, each with one package or pattern, or you can separate them with commas inside a single option: sudo dnf --exclude=kernel,firefox update. The comma-separated form is also valid in the configuration file.

Does –exclude work with yum on CentOS 7?

Yes, yum supports the same --exclude option. On CentOS 7, you can use sudo yum --exclude=kernel update. The configuration file is /etc/yum.conf.

Can I exclude a package from only one repository?

Yes, edit the repository file (e.g., /etc/yum.repos.d/epel.repo) and add exclude=package under the specific repository section. This exclusion applies only to that repository.

Why is my excluded package still being updated?

Check if the package is a dependency of another package that is being updated. Excluding a package does not exclude its dependencies. Also verify that the exclusion pattern is correct and that you are using the right configuration file. Run dnf check-update to see what would be updated and confirm the exclusion is applied.

What is the difference between –exclude and –obsoletes?

--exclude prevents specific packages from being installed or updated. --obsoletes controls whether packages that are marked as obsolete are replaced. They are unrelated; you can use both together if needed.

Can I exclude a package permanently without editing config files?

No, the --exclude option is per-command. To make it permanent, you must add the exclude directive to a configuration file. Alternatively, you can use versionlock for a more permanent solution.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →