lowsystemverified ✓rollback-safe
Configure DNF to remove obsolete packages after updates
dnf-clean-requirements · RHEL ≥ 8 · 1 impl
Description
The DNF package manager must be configured to remove all software components after updated versions have been installed. The clean_requirements_on_remove option must be set to True in dnf.conf.
Rationale
Failing to remove outdated packages can leave old, potentially vulnerable software on the system. Configuring DNF to clean dependencies on removal reduces software bloat and removes obsolete packages that could be exploited.
Check → Remediate
Checkconfig_value
- path:
- /etc/dnf/dnf.conf
- key:
- clean_requirements_on_remove
- expected:
- True
Remediateconfig_set
- path:
- /etc/dnf/dnf.conf
- key:
- clean_requirements_on_remove
- value:
- True
- separator:
- =
Framework references
STIG
V-230281V-280942 / RHEL-10-200000V-257824 / RHEL-09-214035
NIST 800-53
CM-6SI-2
Live verification
rhel10:checkrhel8:checkrhel9:check
#dnf#package#updates#cleanup#stig