Skip to content
RevoDocs

macOS and Linux updates

What Revo installs on Macs and Linux machines, the limits on each, and what owner approval on Apple silicon means.

Updated

On this page

Patching on macOS and Linux uses the same policies, approvals, maintenance windows, rings and deployments as Windows. This page covers what's different.

Linux

  • Sources: the device's configured repositories, through APT (Debian, Ubuntu), DNF (Red Hat family) or zypper (SUSE). Revo never adds or changes a repository.
  • Approval: the policy's Linux packages setting auto-approves security updates only, or all package updates, after a number of days. Anything else waits in Patching → Updates.
  • How it installs: the transaction is simulated first, with fixed guards against removing packages, then run in a short-lived systemd unit (revo-patch-…) with its own time limit. On APT a package-list refresh runs once before installing.
  • Restarts use the policy's restart setting, with the warning shown to signed-in users.
  • Backports: Debian and Ubuntu fix vulnerabilities without changing the upstream version. Vulnerability matching uses the distribution's own data, so a package can show as possibly affected until the fixed package is installed. See Vulnerability management.

macOS

  • What installs: the items softwareupdate lists: security responses, Safari and macOS point releases.
  • Never installed: new major macOS versions. Leave those to the Mac's user or your MDM. App Store and Homebrew apps aren't updated either.
  • Approval: macOS updates follow the policy's OS rules: security updates by its security setting, others by its other updates setting.
  • Licence agreements: Apple's installer needs licences accepted, so the policy's Accept licence agreements must be on. Without it, macOS devices are skipped with that reason.

Apple silicon and owner approval

On Apple silicon, Apple lets only a volume owner (a user who can unlock the disk) or an MDM server approve macOS system updates. The agent never asks for or stores a password, so such an update is reported as needs a signed-in owner or MDM instead of being installed.

To get it installed:

  • have the Mac's user install it in System Settings → General → Software Update; or
  • push it from your MDM.

Other items (Safari, security responses that don't need owner approval) still install normally.

Opting out on the device

The device's local administrator can switch patching or restarts off in config.toml. See Local controls.