APT: Prevent <other-device> kernels from being installed

[Dantes]

To prevent APT from installing <other-device> kernels that will render an installation useless I did the following:

 

To see which kernel is running:

$ uname -r
6.11.2-current-rockchip-rk3588

 

To see which kernels are installed:

$ dpkg --get-selections 'linux-image*'
inux-image-current-rockchip-rk3588        install
linux-image-edge-rockchip-rk3588        install

 

Its clear to see that I need "rockchip-rk3588" kernels and not the other 1000+  so wonderfully provides.

 

Now that I know which kernel is used and which are not, I will allow and block what I need:

$ sudo nano /etc/apt/preferences.d/kernel

 

The first entry allows the installation of any rockchip-rk3588 kernels that my device can use.

The second entry blocks the installation of any other kernel.

Package: linux-image-*-rockchip-rk3588
Pin: release *
Pin-Priority: 1000

Package: linux-image-*
Pin: release *
Pin-Priority: -1

 

To check if the policy is recognized run this command:

$ apt-cache policy
...
     linux-image-6.9.7+bpo-rt-arm64 -> 6.9.7-1~bpo12+1 with priority -1
     linux-image-6.1.0-11-cloud-arm64 -> 6.1.38-4 with priority -1
>    linux-image-edge-rockchip-rk3588 -> 24.11.0-trunk.249 with priority 1000
>    linux-image-edge-rockchip-rk3588 -> 24.11.0-trunk.238 with priority 1000
     linux-image-6.1.0-11-rt-arm64 -> 6.1.38-4 with priority -1
     linux-image-6.1.0-22-rt-arm64 -> 6.1.94-1 with priority -1
     linux-image-6.1.0-11-arm64 -> 6.1.38-4 with priority -1
     linux-image-6.10.6+bpo-arm64-dbg -> 6.10.6-1~bpo12+1 with priority -1
$

You can clearly see that all  kernels are disabled with priority -1 except those for the rockchip-rk3588

 

To test this simulate the installation:

$ sudo apt install --simulate linux-image-6.9.7+bpo-rt-arm64
[sudo] password for test: 
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Package linux-image-6.9.7+bpo-rt-arm64 is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source
However the following packages replace it:
  linux-image-6.9.7+bpo-rt-arm64-unsigned

E: Package 'linux-image-6.9.7+bpo-rt-arm64' has no installation candidate
$

 

Success

Edited October 10 by Dantes
forgot to add --simulate to test case