We should allow the Jenkins master node to control when to install system updates on each slave, so to make sure that updates are installed periodically and automatically but not when a build job is running. The idea is to create an "update script" which is allowed to be invoked via sudo by the jenkins user, so to not give it root permissions but still allow it to perform this operation. Make sure the script is not writable by its user. |