System Administration Guide: Basic Administration

Chapter 23 Managing Patches by Using the patchadd Command (Tasks)

Patch management involves applying patches and software updates to a system. Patch management might also involve removing unwanted or faulty patches. Removing patches is also called backing out patches.

This chapter provides step-by-step instructions on how to manage patches by using the patchadd command. For additional information, see the patchadd(1M) man page.

The following is a list of the information that is in this chapter:

Types of Patches

A patch is an accumulation of fixes for a known or potential problem within the Oracle Solaris OS or other supported software. A patch can also provide a new feature or an enhancement to a particular software release. A patch consists of files and directories that replace or update existing files and directories. Most patches are delivered as a set of sparse packages. For details about packages, see Chapter 20, Managing Software (Overview).

A software update is a change that you apply to software that corrects an existing problem or introduces a feature. To update is also the process of applying software updates to a system.

You can manage patches on your Oracle Solaris system by using the patchadd command.

Signed and Unsigned Patches

A signed patch is one that has a digital signature applied to it. A patch that has its digital signature verified has not been modified since the signature was applied. The digital signature of a signed patch is verified after the patch is downloaded to your system.

Patches for Oracle Solaris, starting with the 2.6 release, are available as signed patches and as unsigned patches. Unsigned patches do not have a digital signature.


Note –

The process of adding and removing signed patches by using the patchadd command includes obtaining and applying a trusted certificate by using the keytool utility. Procedures that associated with using the keytool utility in this Oracle Solaris release are not described in detail in this chapter. For complete instructions on using the keytool utility to import and export trusted certificates, go to http://download.oracle.com/docs/cd/E17476_01/javase/1.4.2/docs/tooldocs/solaris/keytool.html.


For information about applying patches to your system by using the patchadd command, see Managing Patches by Using the patchadd Command (Task Map).

For additional overview information about signed patches, see Signed Packages, Patches, and Software Updates.

Accessing Oracle Solaris Patches

You can obtain patches from the http://sunsolve.sun.com Website. To access patches from the SunSolve Patch Portal Website, your system must be connected to the Internet and be capable of running a web browser, such as the Mozilla web browser.

You can access individual patches or a set of patches from a patch cluster, or refer to patch reports.

Each patch is associated with a README file that has information about the patch.

Patch Numbering

Patches are identified by unique patch IDs. A patch ID is an alphanumeric string that is a patch base code and a number that represents the patch revision number joined with a hyphen. For example, patch 118833-10 is the patch ID for the SunOS 5.10 kernel update patch, 10th revision.

Managing Oracle Solaris Patches

This section describes how to manage Oracle Solaris patches with the patch tools that are available.

The patch tools do the following:

While you apply patches, the patchadd command logs information in the /var/sadm/patch/patch-id /log file.


Note –

Improvements have been made to the patchadd -M command. When you use this command to apply patches to your system, you are no longer required to specify patch IDs in numeric order. If you use the patchadd -M command without specifying a patch ID, all patches in the directory are installed on the system. For more information about these changes, see the patchadd(1M) man page.


The patchadd command cannot apply a patch or software update under the following conditions:

Managing Patches in the Oracle Solaris Operating System

Use the following information to identify tasks for managing patches. Each task points to additional tasks.

Task 

Description 

For Instructions 

Determine whether to apply signed or unsigned patches. 

Determine whether applying signed or unsigned patches is best for your environment. 

Determining Whether to Apply Signed or Unsigned Patches to Your System

Apply a patch to your system. 

Use the patchadd command on Solaris 2.6, Solaris 7, Solaris 8, Solaris 9, or Oracle Solaris 10 systems to apply unsigned patches.

Managing Patches by Using the patchadd Command (Task Map)

Determining Whether to Apply Signed or Unsigned Patches to Your System

The key factor when determining whether to apply signed or unsigned patches to your system is whether you trust the source of patches.

If you trust the source of patches, for example, a patch CD from a known distributor or an HTTPS connection to a trusted Website, you can use unsigned patches. However, if you do not trust the source, use signed patches.

If you are unsure about whether to trust the source of patches, use signed patches.

Importing and Exporting Trusted Certificates to Your Package Keystore

To apply signed patches to your system by using the patchadd command, you must add Oracle's Root CA certificate, at the very least, to verify the signature of your signed patch. You can import this certificate from the Java keystore to the package keystore.

For instructions on importing and exporting trusted certificates, go to http://download.oracle.com/docs/cd/E17476_01/javase/1.4.2/docs/tooldocs/solaris/keytool.html.

Patch Management Terms and Definitions

The following terms are used throughout the patch management chapters.

apply

To install a patch on a system.

back out

To remove a patch from a system.

backout data

Data that is created when a patch is applied to enable the system to return to its previous state if the patch is removed (backed out).

backout directory

Directory in which backout data is stored. By default, this is the save directory of each package that was installed by the patch.

dependency

See patch dependency.

digital signature

An electronic signature that can be used to ensure that a document has not been modified since the signature was applied.

download

To copy one or more patches from a source of patches, such as the Sun patch server, to the system where the patches are to be applied.

download directory

Directory in which patches are stored when they are downloaded from the patch source. This is also the directory from which patches are applied. The default location is /var/sadm/spool.

keystore

A repository of certificates and keys that is queried when you attempt to apply a signed patch.

nonstandard patch

Nonstandard patches cannot be installed using the patchadd command. Nonstandard patches, those that are typically used to deliver firmware or software application fixes that are not delivered in package format, must be installed by using the instructions that are specified in the patch README file.

order

To sort a set of patches in an order suitable for applying patches.

package

The form in which software products are delivered for installation on a system. The package contains a collection of files and directories in a defined format.

patch

An update to software that corrects an existing problem or that introduces a feature.

patch analysis

A method of checking a system to determine which patches are appropriate for the system.

patch dependency

An instance where a patch depends on the existence of another patch on a system. A patch that depends on one or more patches can only be applied to a system when those other patches have already been applied.

patch ID

A unique alphanumeric string, with the patch base code first, a hyphen, and a number that represents the patch revision number.

patch incompatibility

A rare situation where two patches cannot be on the same system. Each patch in the relationship is incompatible with the other. If you want to apply a patch that is incompatible with a patch already on the system, you must first remove the patch that is already on the system. Then, you can apply the new patch.

patch list

A file that contains a list of patches, one patch ID per line. Such a list can be used to perform patch operations. The list can be generated based on the analysis of a system or on user input.

Each line in a patch list has two columns. The first column is the patch ID, and the second column is a synopsis of that patch.

patch obsolescence

An instance where a patch replaces another patch, even if it has not already been applied to a system. A patch that obsoletes one or more patches replaces those patches entirely and does not require that the obsolete patches be applied before the replacement patch is applied.

patch server

A source of patches that can be used by your systems to perform patch analyses and from which to obtain the appropriate patches.

signed patch

A patch that is signed with a valid digital signature. A signed patch offers greater security than an unsigned patch. The digital signature of the patch can be verified before the patch is applied to your system. A valid digital signature ensures that the signed patch has not been modified since the signature was applied. Signed patches are stored in Java Archive (JAR) format files.

software update

A change to software that you apply that corrects an existing problem or that introduces a feature.

special handling

Patches with properties that indicate they must be installed in single-user mode. Also, patches that require you to restart the system after the patch has been applied are referred to as having special handling requirements.

standard patch

Standard patches are those that adhere to the Oracle Solaris patch specification and are installable by using the patchadd command. Note that nonstandard patches cannot be installed by using the patchadd command

SunSolve Online

The patch portal Website that provides access to patches, patch information, and patch clusters. See http://sunsolve.sun.com for more information.

unsigned patch

A patch that is not signed with a digital signature.

web proxy

A system that is used to connect your system to the Internet. Your system cannot connect directly to the Internet, but must use the web proxy to establish the connection.

Managing Patches by Using the patchadd Command (Task Map)

Task 

Description 

For Instructions 

2. (Optional) Specify a web proxy. 

If your system is behind a firewall with a web proxy, you must specify the web proxy to obtain patches from the patch server. 

How to Specify a Web Proxy

3. Download and apply a patch. 

You can download and apply a patch to your system by using the patchadd command.

How to Download and Apply a Patch

4. (Optional) Display information about patches that have been applied to your system. 

If you want information about the patches that have already been applied to your system, use the patchadd, showrev, or pkgparam command.

How to Display Information About Patches

5. (Optional) Remove a patch from your system. 

If necessary, remove a patch from your system by using the patchrm command.

How to Remove a Patch by Using the patchrm Command

ProcedureHow to Specify a Web Proxy

If your system is behind a firewall with a web proxy, you must specify the web proxy to use patchadd to apply a patch.

  1. Become superuser or assume an equivalent role.

  2. Use one of the following methods to specify a web proxy:

    • Specify the web proxy by using the http_proxy, HTTPPROXY, or HTTPPROXYPORT environment variable.

      For example:


      # setenv http_proxy http://mycache.domain:8080
      

      Or, specify one of the following:


      # setenv HTTPPROXY mycache.domain
      # setenv HTTPPROXYPORT 8080
      
    • Specify the web proxy on the patchadd command line.

      For example:


      # patchadd -x mycache.domain:8080 \
      -M http://www.sun.com/solaris/patches/latest 101223-02 102323-02
      

Restrictions on Using patchadd -R to Create an Alternate root Path

On systems that are running an Oracle Solaris release that is not zones aware, using the patchadd command, or any command that accepts the -R option to specify an alternate root path for a global zone that has non-global zones installed, does not work.

You can use of the -R option to add and remove software packages and patches, if the alternate boot environment has configured non-global zones, but no installed non-global zones.

To avoid a potential problem, restrict the use of the -R option for the creation of an alternate root path.

If you are running Oracle Solaris 10, you can alternately choose one of the following methods:

For more information, see the patchadd(1M), patchrm(1M), pkgadd(1M), and pkgrm(1M) man pages.

ProcedureHow to Download and Apply a Patch

Use this procedure to download an unsigned Solaris patch and then apply it to your system.

If you want to apply signed patches, you must first set up the package keystore. For more information, go to http://download.oracle.com/docs/cd/E17476_01/javase/1.4.2/docs/tooldocs/solaris/keytool.html.

  1. Gain access to the system in one of the following ways:

    • Log in to the system where you want to apply the patch.

    • Download the patch and use the ftp command to copy the patch to the target system.

  2. Start a web browser and go to the SunSolve Online Patch Portal at http://sunsolve.Sun.COM.

  3. Determine whether to download a specific patch or a patch cluster, then do one of the following:

    • Type the patch number (patch-id) in the Find Patch search field, then click Find Patch.

      Entering patch-id downloads the latest patch revision.

      If this patch is freely available, the patch README appears. If this patch is not freely available, an ACCESS DENIED message appears.

      Note that patch numbers for SPARC based and x86 based systems are different. The patch IDs are listed in the patch README. Ensure that you apply the patch that matches your system architecture.

    • Select the Recommended Patch Cluster that matches the Oracle Solaris release that is running on the system that you want to patch.

  4. Download the patch by following these instructions:

    • To download a copy of the signed patch, click the Download Signed Patch (n bytes) button.

    • To download an unsigned patch, click the Download Patch ( n bytes) button.

    When the patch or patches are successfully downloaded, close the web browser.

  5. Change to the directory that contains the downloaded patch.

  6. Become superuser or assume an equivalent role.

  7. (Unsigned patch) If you downloaded an unsigned patch, unzip the patch.


    # unzip patch-id
    
  8. Apply the signed or unsigned patch.

    For example:


    # patchadd /tmp/111879-01
    
    • If you downloaded a signed patch, apply it.

      For example:


      # patchadd /tmp/111879-01.jar
      
    • If you downloaded an unsigned patch, apply it.

      For example:


      # patchadd /tmp/111879-01
      
  9. Verify that the patch has been successfully applied.

    For example:


    # patchadd -p | grep 111879
    Patch: 111879-01 Obsoletes:  Requires:  Incompatibles:  Packages: SUNWwsr

ProcedureHow to Display Information About Patches

Before applying patches, you might want to know more about patches that have been previously applied.

The following commands provide useful information about patches that are already applied to a system.

  1. Use one of the following patchadd command lines to display information about patches that have been applied to your system.

    • To obtain information about all patches that have been applied to your system, type:


      $ patchadd -p
      
    • To verify whether a particular patch has been applied to your system, type, for example:


      $ patchadd -p | grep 111879
      

ProcedureHow to Remove a Patch by Using the patchrm Command

  1. Become superuser.

  2. Remove the patch.


    # patchrm 111879-01
    Checking installed patches...
    
    Backing out patch 111879-01...
    
    Patch 111879-01 has been backed out.
  3. Verify that the patch was removed.


    # patchadd -p | grep 111879
    #