Automating Kernel Updates on Arch Linux with Pacman Hooks

The problem: keeping the kernel current without manual checks

Arch Linux follows a rolling‑release model, so new kernel packages appear frequently. Forgetting to run pacman -Syu or missing a kernel upgrade can leave the system running an older, potentially less secure kernel. Manually watching for updates adds friction, especially on headless servers where you prefer a hands‑off approach.

Thesis: a simple Pacman hook can detect kernel upgrades and optionally reboot, giving you a reliable, low‑maintenance way to stay current.

How Pacman hooks work

Pacman reads files with the .hook extension from /etc/pacman.d/hooks before and after each transaction. A hook consists of a [Trigger] section that defines when it runs and an [Action] section that specifies the command to execute. Placeholders like %i (installed version) and %o (upgraded version) let the hook inspect which packages changed.

Designing a kernel‑update hook

We want the hook to fire only when the linux package (the default kernel) is upgraded. After the transaction, a small script checks whether the installed version differs from the previous one and, if so, either logs a notice or initiates a reboot.

# /etc/pacman.d/hooks/kernel-reboot.hook
[Trigger]
Operation = Upgrade
Type = Package
Target = linux

[Action]
When = PostTransaction
Exec = /usr/local/bin/kernel-reboot.sh

The script must be owned by root, executable, and placed in /usr/local/bin (or any directory in $PATH). A minimal, safe version for testing looks like this:

#!/usr/bin/env bash
# /usr/local/bin/kernel-reboot.sh
# Log the event; replace the echo with systemctl reboot for real use
logger -t kernel-reboot "Kernel upgrade detected; would reboot now."
# Uncomment the line below to enable automatic reboot
# systemctl reboot

Worked example: enabling the hook

1. Create the hook file (requires root):

   sudo tee /etc/pacman.d/hooks/kernel-reboot.hook > /dev/null <<'EOF'
   [Trigger]
   Operation = Upgrade
   Type = Package
   Target = linux
   
   [Action]
   When = PostTransaction
   Exec = /usr/local/bin/kernel-reboot.sh
   EOF
   

2. Set permissions:

   sudo chmod 644 /etc/pacman.d/hooks/kernel-reboot.hook
   sudo chown root:root /etc/pacman.d/hooks/kernel-reboot.hook
   

3. Install the script:

   sudo tee /usr/local/bin/kernel-reboot.sh > /dev/null <<'EOF'
   #!/usr/bin/env bash
   logger -t kernel-reboot "Kernel upgrade detected; would reboot now."
   # systemctl reboot  # enable when ready
   EOF
   

   sudo chmod +x /usr/local/bin/kernel-reboot.sh
   sudo chown root:root /usr/local/bin/kernel-reboot.sh
   

4. Test the hook without affecting the running kernel:

   sudo pacman -Sy linux  # forces a reinstall of the current kernel version
   

   After the command finishes, check the journal for the log entry:

   journalctl -b -t kernel-reboot
   

   You should see a line similar to "Kernel upgrade detected; would reboot now."
5. Enable real reboot (optional): edit the script, uncomment the systemctl reboot line, save, and repeat the test. The system will reboot after the kernel package is successfully upgraded.

Trade‑offs and limitations

• Automatic reboots can interrupt work. If you run long‑running tasks, consider adding a delay (sleep 300) or a guard that checks for active users (who) before issuing systemctl reboot.
• Hook failures abort the transaction. A syntax error in the script or a missing executable will cause Pacman to roll back the upgrade, leaving the system on the old kernel. Always verify the script with shellcheck or a dry run before enabling it.
• Custom kernels need adjustment. If you use linux-lts, linux-zen, or a locally built kernel, change the Target line accordingly or add multiple Target entries.
• Security. The hook runs as root; ensure the script is not writable by unprivileged users and that its contents are trusted.

Actionable closing

By placing a small hook in /etc/pacman.d/hooks and a simple script in /usr/local/bin, you can automate kernel upgrades on Arch Linux with minimal overhead. Start with the logging‑only version to confirm the hook fires correctly, then enable the reboot line when you are comfortable with the automation. Periodically verify the hook’s permissions and script integrity to maintain a stable, up‑to‑date system.