Upgrading a Solaris Trusted Extensions System That is Configured with Labeled Zones

Solaris systems that are configured with Solaris Trusted Extensions use non-global zones. Upgrading these systems is the same as upgrading a Solaris system that uses zones, and has the same issues.

• ZFS Zones– Solaris systems with ZFS zones cannot currently be upgraded. For Solaris Trusted Extensions systems with ZFS zones, the alternative is to recreate the zones. To recreate the zones, perform these steps:

  1. First, back up all the data using the tar -T command.

  2. Then delete the zones.

  3. Upgrade the system and reconfigure all the zones.

  4. After all the zones are configured, restore all the data.

• NFSv4 domain– After upgrade, when you bring up each labeled zone, you will be prompted for the NFSv4 domain. To avoid this prompt, before upgrade add the correct NFSMAPID_DOMAIN value in the /etc/default/nfs file in each labeled zone. For more information, see CR 5110062.

• Live Upgrade– Two bugs affect Live Upgrade of Solaris systems with zones:

  • lucreate and lumake Commands Fail on Non-Global Zones (6659451)

  • Incorrect Permissions on /tmp in Non-Global Zones After Solaris Live Upgrade (6619278)

  These bugs will also affect the Live Upgrade of systems that are configured with Solaris Trusted Extensions. The workarounds are also the same.

• Name Service– If your system was configured at install time to use a name service that is different from the name service being used during upgrade, then the global zone may use the correct name service after boot.

  For example, if you specified NIS as the name service to use during system install, but the system was later converted to be an LDAP client, the luactivate boot can revert to using NIS as the name service for the global zone. This is due to CR 6569407.

  The workaround is to adjust the name_service.xml symbolic link in the /var/svc/profile directory to point to the correct xml file corresponding to the name service currently in use. For example, if NIS was specified as the name service during install, then name_service.xml will be a symbolic link to ns_nis.xml. If the system was subsequently converted to being an LDAP client, and LDAP was the name service in use during Live Upgrade, then run the following command:

  # ln -fs ns_ldap.xml name_service.xml

  This should be done before starting Live Upgrade or before running the lucreate command. However, if you did not run this command before lucreate, then perform the following steps after running the luactivate command:

  1. lumount the new boot environment:

     # lumount <BE_name>

  2. Change to the /var/svc/profile directory of the boot environment:

     # cd /.alt.<BE_name>/var/svc/profile

  3. Link the name_service.xml link as appropriate. For example:

     # ln -fs ns_ldap.xml name_sevice.xml

  4. luumount the boot environment:

     # luumount <BE_name>

  ---

  Note –

  If the system is booted without performing the steps mentioned above, you will need to manually start the appropriate name service-related SMF client services.

  ---