Patch management involves applying patches and software updates to a system. Patch management might also involve removing unwanted or faulty patches. Removing patches is also called backing out patches.
This chapter provides step-by-step instructions on how to manage patches by using the patchadd command. For additional information, see the patchadd(1M) man page.
The following is a list of the information that is in this chapter:
A patch is an accumulation of fixes for a known or potential problem within the Oracle Solaris OS or other supported software. A patch can also provide a new feature or an enhancement to a particular software release. A patch consists of files and directories that replace or update existing files and directories. Most patches are delivered as a set of sparse packages. For details about packages, see Chapter 20, Managing Software (Overview).
A software update is a change that you apply to software that corrects an existing problem or introduces a feature. To update is also the process of applying software updates to a system.
You can manage patches on your Oracle Solaris system by using the patchadd command.
A signed patch is one that has a digital signature applied to it. A patch that has its digital signature verified has not been modified since the signature was applied. The digital signature of a signed patch is verified after the patch is downloaded to your system.
Patches for Oracle Solaris, starting with the 2.6 release, are available as signed patches and as unsigned patches. Unsigned patches do not have a digital signature.
The process of adding and removing signed patches by using the patchadd command includes obtaining and applying a trusted certificate by using the keytool utility. Procedures that associated with using the keytool utility in this Oracle Solaris release are not described in detail in this chapter. For complete instructions on using the keytool utility to import and export trusted certificates, go to http://download.oracle.com/docs/cd/E17476_01/javase/1.4.2/docs/tooldocs/solaris/keytool.html.
For information about applying patches to your system by using the patchadd command, see Managing Patches by Using the patchadd Command (Task Map).
For additional overview information about signed patches, see Signed Packages, Patches, and Software Updates.
You can obtain patches from the http://sunsolve.sun.com Website. To access patches from the SunSolve Patch Portal Website, your system must be connected to the Internet and be capable of running a web browser, such as the Mozilla web browser.
You can access individual patches or a set of patches from a patch cluster, or refer to patch reports.
Each patch is associated with a README file that has information about the patch.
Patches are identified by unique patch IDs. A patch ID is an alphanumeric string that is a patch base code and a number that represents the patch revision number joined with a hyphen. For example, patch 118833-10 is the patch ID for the SunOS 5.10 kernel update patch, 10th revision.
This section describes how to manage Oracle Solaris patches with the patch tools that are available.
The patch tools do the following:
Determine the Oracle Solaris version number of the managing host and the target host
Update the patch package's pkginfo file with this information:
Patches that have been obsoleted by the patch being applied
Other patches that are required by this patch
Patches that are incompatible with this patch
While you apply patches, the patchadd command logs information in the /var/sadm/patch/patch-id /log file.
Improvements have been made to the patchadd -M command. When you use this command to apply patches to your system, you are no longer required to specify patch IDs in numeric order. If you use the patchadd -M command without specifying a patch ID, all patches in the directory are installed on the system. For more information about these changes, see the patchadd(1M) man page.
The patchadd command cannot apply a patch or software update under the following conditions:
The package is not fully installed on the system.
The patch package's architecture differs from the system's architecture.
The patch package's version does not match the installed package's version.
A patch with the same base code and a higher revision number has already been applied.
A patch that obsoletes this patch has already been applied.
The patch is incompatible with a patch that has already been applied to the system. Each patch that has been applied keeps this information in its pkginfo file.
The patch being applied depends on another patch that has not yet been applied.
Use the following information to identify tasks for managing patches. Each task points to additional tasks.
Task |
Description |
For Instructions |
---|---|---|
Determine whether to apply signed or unsigned patches. |
Determine whether applying signed or unsigned patches is best for your environment. |
Determining Whether to Apply Signed or Unsigned Patches to Your System |
Apply a patch to your system. |
Use the patchadd command on Solaris 2.6, Solaris 7, Solaris 8, Solaris 9, or Oracle Solaris 10 systems to apply unsigned patches. |
The key factor when determining whether to apply signed or unsigned patches to your system is whether you trust the source of patches.
If you trust the source of patches, for example, a patch CD from a known distributor or an HTTPS connection to a trusted Website, you can use unsigned patches. However, if you do not trust the source, use signed patches.
If you are unsure about whether to trust the source of patches, use signed patches.
To apply signed patches to your system by using the patchadd command, you must add Oracle's Root CA certificate, at the very least, to verify the signature of your signed patch. You can import this certificate from the Java keystore to the package keystore.
For instructions on importing and exporting trusted certificates, go to http://download.oracle.com/docs/cd/E17476_01/javase/1.4.2/docs/tooldocs/solaris/keytool.html.
The following terms are used throughout the patch management chapters.
To install a patch on a system.
To remove a patch from a system.
Data that is created when a patch is applied to enable the system to return to its previous state if the patch is removed (backed out).
Directory in which backout data is stored. By default, this is the save directory of each package that was installed by the patch.
See patch dependency.
An electronic signature that can be used to ensure that a document has not been modified since the signature was applied.
To copy one or more patches from a source of patches, such as the Sun patch server, to the system where the patches are to be applied.
Directory in which patches are stored when they are downloaded from the patch source. This is also the directory from which patches are applied. The default location is /var/sadm/spool.
A repository of certificates and keys that is queried when you attempt to apply a signed patch.
Nonstandard patches cannot be installed using the patchadd command. Nonstandard patches, those that are typically used to deliver firmware or software application fixes that are not delivered in package format, must be installed by using the instructions that are specified in the patch README file.
To sort a set of patches in an order suitable for applying patches.
The form in which software products are delivered for installation on a system. The package contains a collection of files and directories in a defined format.
An update to software that corrects an existing problem or that introduces a feature.
A method of checking a system to determine which patches are appropriate for the system.
An instance where a patch depends on the existence of another patch on a system. A patch that depends on one or more patches can only be applied to a system when those other patches have already been applied.
A unique alphanumeric string, with the patch base code first, a hyphen, and a number that represents the patch revision number.
A rare situation where two patches cannot be on the same system. Each patch in the relationship is incompatible with the other. If you want to apply a patch that is incompatible with a patch already on the system, you must first remove the patch that is already on the system. Then, you can apply the new patch.
A file that contains a list of patches, one patch ID per line. Such a list can be used to perform patch operations. The list can be generated based on the analysis of a system or on user input.
Each line in a patch list has two columns. The first column is the patch ID, and the second column is a synopsis of that patch.
An instance where a patch replaces another patch, even if it has not already been applied to a system. A patch that obsoletes one or more patches replaces those patches entirely and does not require that the obsolete patches be applied before the replacement patch is applied.
A source of patches that can be used by your systems to perform patch analyses and from which to obtain the appropriate patches.
A patch that is signed with a valid digital signature. A signed patch offers greater security than an unsigned patch. The digital signature of the patch can be verified before the patch is applied to your system. A valid digital signature ensures that the signed patch has not been modified since the signature was applied. Signed patches are stored in Java Archive (JAR) format files.
A change to software that you apply that corrects an existing problem or that introduces a feature.
Patches with properties that indicate they must be installed in single-user mode. Also, patches that require you to restart the system after the patch has been applied are referred to as having special handling requirements.
Standard patches are those that adhere to the Oracle Solaris patch specification and are installable by using the patchadd command. Note that nonstandard patches cannot be installed by using the patchadd command
The patch portal Website that provides access to patches, patch information, and patch clusters. See http://sunsolve.sun.com for more information.
A patch that is not signed with a digital signature.
A system that is used to connect your system to the Internet. Your system cannot connect directly to the Internet, but must use the web proxy to establish the connection.
Task |
Description |
For Instructions |
---|---|---|
2. (Optional) Specify a web proxy. |
If your system is behind a firewall with a web proxy, you must specify the web proxy to obtain patches from the patch server. | |
3. Download and apply a patch. |
You can download and apply a patch to your system by using the patchadd command. | |
4. (Optional) Display information about patches that have been applied to your system. |
If you want information about the patches that have already been applied to your system, use the patchadd, showrev, or pkgparam command. | |
5. (Optional) Remove a patch from your system. |
If necessary, remove a patch from your system by using the patchrm command. |
If your system is behind a firewall with a web proxy, you must specify the web proxy to use patchadd to apply a patch.
Become superuser or assume an equivalent role.
Use one of the following methods to specify a web proxy:
Specify the web proxy by using the http_proxy, HTTPPROXY, or HTTPPROXYPORT environment variable.
For example:
# setenv http_proxy http://mycache.domain:8080 |
Or, specify one of the following:
# setenv HTTPPROXY mycache.domain # setenv HTTPPROXYPORT 8080 |
Specify the web proxy on the patchadd command line.
For example:
# patchadd -x mycache.domain:8080 \ -M http://www.sun.com/solaris/patches/latest 101223-02 102323-02 |
On systems that are running an Oracle Solaris release that is not zones aware, using the patchadd command, or any command that accepts the -R option to specify an alternate root path for a global zone that has non-global zones installed, does not work.
You can use of the -R option to add and remove software packages and patches, if the alternate boot environment has configured non-global zones, but no installed non-global zones.
To avoid a potential problem, restrict the use of the -R option for the creation of an alternate root path.
If you are running Oracle Solaris 10, you can alternately choose one of the following methods:
Upgrade any systems that are not running at least the Solaris 10 1/06 OS.
If you are running the Oracle Solaris 10 initial 3/05 release, you can install the following patch to enable the use of commands that accept the -R option for creation of an alternate root path.
For SPARC based systems – Install at least revision 19 of patch 119254.
For x86 based systems – Install at least revision 19 patch 119255.
Boot an alternate root, for example the Oracle Solaris OS, as the active OS. You can then install and uninstall packages and patches without using the -R option.
For more information, see the patchadd(1M), patchrm(1M), pkgadd(1M), and pkgrm(1M) man pages.
Use this procedure to download an unsigned Solaris patch and then apply it to your system.
If you want to apply signed patches, you must first set up the package keystore. For more information, go to http://download.oracle.com/docs/cd/E17476_01/javase/1.4.2/docs/tooldocs/solaris/keytool.html.
Gain access to the system in one of the following ways:
Start a web browser and go to the SunSolve Online Patch Portal at http://sunsolve.Sun.COM.
Determine whether to download a specific patch or a patch cluster, then do one of the following:
Type the patch number (patch-id) in the Find Patch search field, then click Find Patch.
Entering patch-id downloads the latest patch revision.
If this patch is freely available, the patch README appears. If this patch is not freely available, an ACCESS DENIED message appears.
Note that patch numbers for SPARC based and x86 based systems are different. The patch IDs are listed in the patch README. Ensure that you apply the patch that matches your system architecture.
Select the Recommended Patch Cluster that matches the Oracle Solaris release that is running on the system that you want to patch.
Download the patch by following these instructions:
To download a copy of the signed patch, click the Download Signed Patch (n bytes) button.
To download an unsigned patch, click the Download Patch ( n bytes) button.
When the patch or patches are successfully downloaded, close the web browser.
Change to the directory that contains the downloaded patch.
Become superuser or assume an equivalent role.
(Unsigned patch) If you downloaded an unsigned patch, unzip the patch.
# unzip patch-id |
Apply the signed or unsigned patch.
For example:
# patchadd /tmp/111879-01 |
If you downloaded a signed patch, apply it.
For example:
# patchadd /tmp/111879-01.jar |
If you downloaded an unsigned patch, apply it.
For example:
# patchadd /tmp/111879-01 |
Verify that the patch has been successfully applied.
For example:
# patchadd -p | grep 111879 Patch: 111879-01 Obsoletes: Requires: Incompatibles: Packages: SUNWwsr |
Before applying patches, you might want to know more about patches that have been previously applied.
The following commands provide useful information about patches that are already applied to a system.
patchadd -p or showrev -p
Shows all patches that have been applied to the system.
pkgparam pkgid PATCHLIST
Shows all patches that have been applied to the package identified by pkgid, for example, SUNWadmap.
patchadd -S Oracle-Solaris-OS -p
Shows all the /usr patches that have been applied to an OS server.
Use one of the following patchadd command lines to display information about patches that have been applied to your system.
To obtain information about all patches that have been applied to your system, type:
$ patchadd -p |
To verify whether a particular patch has been applied to your system, type, for example:
$ patchadd -p | grep 111879 |