Linux Mint Update Manager: Automatic Security Updates and Kernel Rollback Configuration

The Problem and the Takeaway

Linux Mint's Update Manager (mintupdate) can automatically install security patches while preserving the ability to boot a previous kernel if an update breaks drivers or introduces regressions. The key is configuring /etc/apt/apt.conf.d/20auto-upgrades for unattended security updates and ensuring Timeshift snapshots plus GRUB's kernel submenu are functional before you need them.

How Automatic Security Updates Work

Mint ships with unattended-upgrades pre-installed. The file /etc/apt/apt.conf.d/20auto-upgrades controls the timer. A typical default looks like this:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::AutocleanInterval "7";

This runs apt update daily, applies upgrades marked as security (origin "Linux Mint" or "Ubuntu" with label "security"), and cleans the cache weekly. The actual security-origin matching lives in /etc/apt/apt.conf.d/50unattended-upgrades; Mint's default already includes the Mint and Ubuntu security pockets.

Worked Example: Enable and Verify Automatic Security Updates

1. Edit the timer (requires root):
   

   sudo nano /etc/apt/apt.conf.d/20auto-upgrades

   Ensure the three lines above are present and uncommented.
2. Confirm security origins in 50unattended-upgrades:
   

   grep -A 10 'Unattended-Upgrade::Allowed-Origins' /etc/apt/apt.conf.d/50unattended-upgrades

   You should see entries for "Linux Mint:${distro_codename}" and "Ubuntu:${distro_codename}-security".
3. Run a dry-run to see what would be installed:
   

   sudo unattended-upgrades --dry-run --debug

   Output lists packages tagged security; no changes are made.
4. Check execution logs after the next daily run:
   

   grep -i "unattended-upgrade" /var/log/apt/history.log

   Each automated run writes a transaction block with date, packages, and version changes.

Kernel Rollback: What Actually Happens

When apt installs a new kernel metapackage (e.g., linux-image-generic), the previous kernel package remains installed. GRUB's configuration (/boot/grub/grub.cfg) builds a submenu titled "Advanced options for Linux Mint" containing every installed kernel. If the new kernel panics or breaks a proprietary driver (NVIDIA, Broadcom, etc.), you reboot, select the submenu, and choose the prior kernel entry.

Timeshift adds a filesystem-level safety net. By default Mint schedules daily root snapshots (excluding /home). Before a major update you can create an on-demand snapshot:

sudo timeshift --create --comments "pre-kernel-upgrade" --tags D

Restoring from the GRUB menu (if Timeshift's GRUB integration is enabled) or from a live USB rolls back the entire root filesystem, not just the kernel.

Verification Steps Before You Rely on Rollback

• GRUB submenu present: grep -c 'submenu' /boot/grub/grub.cfg should return ≥ 1. If zero, run sudo update-grub.
• At least two kernels installed: dpkg --list 'linux-image-[0-9]*' | grep ^ii must show two or more ii lines.
• Timeshift snapshots exist: sudo timeshift --list shows snapshot IDs, dates, and tags. Verify the most recent is recent enough.
• Proprietary driver status: dkms status lists kernel modules built for each installed kernel. If a module is missing for the newest kernel, the driver will fail after reboot.

Common Mistakes and Limits

Holding Packages with apt-mark

Running sudo apt-mark hold linux-image-generic stops kernel upgrades entirely. This defeats automatic security updates for the kernel and leaves known CVEs unpatched. Check holds with apt-mark showhold; remove with sudo apt-mark unhold <package>.

Third-Party PPAs and Dependency Conflicts

PPAs (e.g., graphics-drivers, winehq) can pull newer libraries that conflict with Mint's security pockets. Unattended upgrades will skip packages that would break dependencies, leaving the security update unapplied. Monitor /var/log/unattended-upgrades/unattended-upgrades.log for "held back" messages.

Automatic Updates and Proprietary Drivers

NVIDIA drivers installed via driver-manager are DKMS modules. A kernel security update triggers a DKMS rebuild on next boot. If the rebuild fails (common with very new kernels and older driver branches), the system boots to a black screen. Mitigation: keep the previous kernel until you confirm the new one works, or pin the kernel metapackage to a known-good version while allowing userspace security updates.

Timeshift Snapshot Space

Default configuration stores snapshots on the root partition. A 256 GB SSD with 150 GB used can run out of space after a few daily snapshots plus a major update. Check with df -h / and adjust /etc/timeshift/default.json ("backup_level" and "count" settings) or move the snapshot directory to a separate disk.

Practical Checklist After Any Kernel Update

1. Reboot once and verify desktop loads (drivers, Wi-Fi, audio).
2. Run dkms status — confirm all modules show "installed" for the running kernel.
3. If anything fails, reboot into GRUB → Advanced options → previous kernel.
4. Optionally create a Timeshift snapshot of the working state: sudo timeshift --create --comments "post-kernel-verified" --tags D.

When to Disable Automatic Security Updates

Disable only on systems where an unattended reboot would violate uptime requirements (e.g., a headless server running a database with no HA failover). Edit 20auto-upgrades and set APT::Periodic::Unattended-Upgrade "0";. You must then manually run sudo apt update && sudo apt list --upgradable and apply security patches during a maintenance window.