Overview

The Linux OS Upgrade Restriction Policy controls how far managed Linux devices can upgrade. Use it to keep devices on a tested OS release, allow only security updates, or hold back specific packages, such as graphics drivers, that could break your users' work.

You can set:

how far devices can upgrade: major releases, minor updates, security updates only, or nothing
which update channel devices follow
packages to hold back from upgrades
whether users see OS upgrade notifications

The Swif agent applies the policy on each device.

This policy restricts upgrades. It doesn't install them. To install updates on a schedule, use the Linux Software Update Policy. Use the two together: this policy sets the limits, and the Software Update Policy installs updates within them.

Requirements

Requirement	Details
Platform	Linux
Supported distributions	[Add the supported distributions.]
Device ownership	Company-owned and BYOD
Swif agent	Installed and running

Settings reference

Setting	What it does	Default
Upgrade Level	How far the device can upgrade. See below.	Not set
Update Channel	The update channel the device follows. See below.	Not set
Package Holds	Package names or patterns to hold back from upgrades, such as `nvidia-*`	Empty
Suppress Notification	When on, the device doesn't show OS upgrade notifications	Off

Settings you leave unset aren't managed.

Upgrade Level

Level	What's allowed
`major`	All upgrades, including moving to a new major OS release, such as Ubuntu 22.04 to 24.04
`minor`	Updates within the current OS release, but not a new major release
`security`	Security updates only
`frozen`	No OS upgrades

Update Channel

Channel	Use for
`conservative`	[Add what this channel means.]
`standard`	[Add what this channel means.]
`leading`	[Add what this channel means.]

Package Holds

Packages that match an entry stay at their current version, even when other packages are upgraded. Use * to match many packages at once. For example, nvidia-* holds every package whose name starts with nvidia-.

Common uses:

Graphics drivers, such as nvidia-*, which can stop working after an upgrade
Kernel packages, when a custom driver or module depends on a specific kernel
Business-critical tools that you've tested on a specific version

Held packages don't get security fixes either, so review your holds regularly.

Suppress Notification

When on, users don't see the operating system's prompts to upgrade. This avoids confusion when an upgrade is available, but restricted by the policy.

Before you start

Decide how far devices should upgrade, based on what you've tested.
List packages that must stay on a specific version, such as drivers.
Check that your Linux Software Update Policy matches. Updates it installs are limited by this policy.
Choose a pilot group of devices.

Create the policy

In Swif, go to Device Management > Policies, then select Create new policy > Configure a Policy.
Select Linux OS Upgrade Restriction Policy.
Enter a clear name, such as Linux – Security Updates Only.
Set Upgrade Level and Update Channel.
Add any packages to Package Holds.
Choose whether to turn on Suppress Notification.
Save the policy, and assign it to your Linux devices.

Example configurations

Example 1: Stay on the current release

Setting	Value
Upgrade Level	`minor`
Suppress Notification	On

Devices get updates within their current OS release, but don't move to a new major release. Users don't see prompts to upgrade.

Example 2: Security updates only

Setting	Value
Upgrade Level	`security`
Update Channel	`conservative`

Devices get security fixes only. Use this for stable, tested environments.

Example 3: Keep graphics drivers on a tested version

Setting	Value
Upgrade Level	`minor`
Package Holds	`nvidia-*`

Devices get updates within their current release, while NVIDIA driver packages stay on their current version.

Example 4: Freeze devices completely

Setting	Value
Upgrade Level	`frozen`
Suppress Notification	On

No OS upgrades are installed. Use this only for short periods, such as during a critical project, since devices also miss security updates.

Verify the policy

In Swif, open the device, and confirm that the policy shows as applied.
On the device, check that held packages are held. [Add the command for each distribution.]
If Suppress Notification is on, check that the device doesn't show OS upgrade prompts.

Troubleshooting

A device upgraded beyond its Upgrade Level

Check that the policy shows as applied on the device.
Check whether a user or another tool upgraded the device manually.

A held package still upgraded

Check that the package name matches an entry in Package Holds, including any * pattern.

Devices aren't getting security updates

Check that Upgrade Level isn't frozen.
Check whether the packages are in Package Holds. Held packages don't get any updates.
Check that the Linux Software Update Policy is installing updates.

Users still see upgrade notifications

Check that Suppress Notification is on, and the policy shows as applied.

Linux OS Upgrade Restriction Policy