Chapter 5 Managing Solaris Patches by Using the Sun Patch Manager Command-Line Interface (Tasks)

This chapter describes how to use the Patch Manager command-line interface to manage patches on your Solaris 9 systems.

The following task-related information is in this chapter:

• Managing Solaris Patches by Using the Sun Patch Manager Command-Line Interface (Task Map)

• Accessing the Sun Patch Manager Command-Line Interface

• Configuring Your Patch Management Environment by Using the Command-Line Interface (Task Map)

• Managing Patches by Using the Command-Line Interface (Task Map)

• Tuning Your Patch Management Environment by Using the Command-Line Interface (Task Map)

Managing Solaris Patches by Using the Sun Patch Manager Command-Line Interface (Task Map)

The following table identifies the tasks that you might perform when you use the Sun Patch Manager command-line interface.

Accessing the Sun Patch Manager Command-Line Interface

Do not run simultaneous Patch Manager operations on your system because it might become unstable. Do not interrupt a patch operation once it has started. If a patch operation is running, you must wait for that operation to complete before starting another operation.

This behavior pertains to operations initiated by both the smpatch command and by the browser interface.

You can run either the local mode or remote mode smpatch command as a user with the appropriate authorizations, such as superuser, or by assuming a role that includes the appropriate profiles.

A user must have the solaris.admin.patchmgr.* authorization to run the smpatch command.

The System Administrator profile includes the appropriate profiles. To create the role and assign the role to a user, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

The pprosetup and pprosvc commands are included with Sun Patch Manager 2.0 for transition purposes. It is best not to use these commands and to use the smpatch command instead.

For more information about smpatch command-line options, see the smpatch(1M) man page.

How to Access the Sun Patch Manager Command-Line Interface (Command Line)

By default, the smpatch command runs in local mode.

1. Decide whether to manage patches on the local system or on a remote system.

   • If you want to manage patches on the local system only, go to Step 2.

   • If you want to manage patches on a remote system, go to Step 4.

     The Solaris WBEM services must be running on the remote system.

2. Log in to a system as a user with appropriate authorizations or assume a role with the appropriate authorizations.

   Note that you must be an appropriately authorized user to assume an appropriate role. See Configuring RBAC (Task Map) in System Administration Guide: Security Services.

3. Run the smpatch command you want.

   For example:

   $ smpatch analyze

4. Log in to a system as a user who is appropriately authorized or is permitted to assume a role that is appropriately authorized.

5. Run the smpatch command with the -n option to specify the name of the system on which to operate.

   For example:

   $ smpatch analyze -n system-name

   To perform the operation with an assumed role, type:

   $ smpatch analyze -r role-name -n system-name

Example 5–1 Accessing the Sun Patch Manager Command-Line Interface

The following examples use the smpatch get command, which lists the configuration settings for your patch management environment.

This example shows how to run the smpatch command on the local system.

# smpatch get

This example shows how an authorized user can run the smpatch command on the remote system called jupiter.

# smpatch get -n jupiter

This example shows how you can run the smpatch command on the remote system called jupiter as the role patcher.

# smpatch get -r patcher -n jupiter

What to Do Next

You can use the smpatch command to configure the patch management environment for your system and manage patches. See the following:

• Configuring Your Patch Management Environment by Using the Command-Line Interface (Task Map)

• Managing Patches by Using the Command-Line Interface (Task Map)

• Tuning Your Patch Management Environment by Using the Command-Line Interface (Task Map)

Configuring Your Patch Management Environment by Using the Command-Line Interface (Task Map)

Use the smpatch command to perform the configuration tasks in this section. For the list of configuration parameters you can set, see Setting Patch Manager Configuration Parameters and the smpatch(1M) man page.

If you want to use the browser interface to configure your patch management environment, see Configuring Your Patch Management Environment by Using the Browser Interface (Task Map).

By default, the patch management environment is configured to obtain patches directly from the Sun patch server. Therefore, you must customize your environment if your system does one or more of the following:

• Connects to the Internet by means of a web proxy

• Requires a user name and password to obtain patches

• Obtains patches from a patch source other than the Sun patch server

The following table identifies the tasks that you might perform when you configure the patch management environment for your system.

The following procedures and examples show how to run the local mode smpatch command, which is run by default. To run the remote mode version, use any of the authentication options (except for -L) or the remote options. See the smpatch(1M) man page.

How to Specify Your Web Proxy (Command Line)

If your system connects to the Internet through a web proxy, you must provide information about the web proxy to Patch Manager.

1. Obtain the host name and the port of the web proxy from your network administrator.

2. Become an appropriately authorized user or assume a role that includes the Software Installation profile or the solaris.admin.patchmgr.* authorization.

   The System Administrator profile includes the appropriate profiles. To create the role and assign the role to a user, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

3. Specify the web proxy.

   # smpatch set patchpro.proxy.host=web-proxy-server \ patchpro.proxy.port=port

4. (Optional) If the web proxy requires authentication, supply the user name and password.

   Obtain this information from your network administrator.

   1. Specify the user name to be used for authentication.

      # smpatch set patchpro.proxy.user=web-proxy-user

   2. Specify the proxy user's password by having smpatch prompt you for the password.

      # smpatch set patchpro.proxy.passwd Web Proxy User Password: web-proxy-password

      Setting the password in this way ensures that the password you type does not appear as clear text in the following:

      • Standard output

      • Output of the ps command

      • Your shell history file

How to Specify a User Name and Password With Which to Obtain Patches (Command Line)

If you needed a user name and password to obtain patches from the Sun patch server, you must specify them for Patch Manager.

If you do not have an account on SunSolve, register for one at http://sunsolve.sun.com.

As of June 2005, a user name and password are not required to obtain patches from the Sun patch server.

1. Become an appropriately authorized user or assume a role that includes the Software Installation profile or the solaris.admin.patchmgr.* authorization.

   The System Administrator profile includes the appropriate profiles. To create the role and assign the role to a user, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

2. Specify your user name.

   # smpatch set patchpro.sun.user=user-name

3. Specify the password for your user by having smpatch prompt you for the password.

   # smpatch set patchpro.sun.passwd Sun User Password: password

   Setting the password in this way ensures that the password you type does not appear as clear text in the following:

   • Standard output

   • Output of the ps command

   • Your shell history file

How to Specify the Source of Patches (Command Line)

Your system can obtain patches from the following sources:

• Sun patch server

• Local patch server on your intranet

• Local patch collection

By default, your system obtains patches from the Sun patch server.

The local patch server is an optional Sun Patch Manager 2.0 feature that you can obtain at no charge if you are a contract customer in the SunSpectrum program.

For information about becoming a contract customer or obtaining the local patch server distribution, go to http://sunsolve.sun.com and click Patch Portal.

If you want your system to obtain patches from a local patch server, you must first configure one. See Configuring Your Local Patch Server (Task Map).

1. Become an appropriately authorized user or assume a role that includes the Software Installation profile or the solaris.admin.patchmgr.* authorization.

   The System Administrator profile includes the appropriate profiles. To create the role and assign the role to a user, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

2. Specify the URL of the patch source.

   • For the Sun patch server, type:

     # smpatch unset patchpro.patch.source

   • For a local patch server, use this URL format:

     # smpatch set patchpro.patch.source=http://server-name:3816/solaris/

   • For a collection of patches in a directory, use this URL format:

     # smpatch set patchpro.patch.source=file:/directory-name

     Note that directory-name can be a local file system or a remotely mounted file system.

   See Example 5–2 for examples of using the file:/ URL format.

Example 5–2 Specifying the Source of Patches

The following example shows how to configure a system to obtain patches from the /export/patches directory on the local system.

# smpatch set patchpro.patch.source=file:/export/patches

The following example shows how to configure a system to obtain patches from the /export/patches directory on the remote system called jupiter.

# smpatch set patchpro.patch.source=file:/net/jupiter/export/patches

The following example shows how to configure a system to obtain patches from a CD mounted from the first CD-ROM drive of the local system.

# smpatch set patchpro.patch.source=file:/cdrom/cdrom0

What to Do Next

After you specify a patch source, your client system is ready to manage patches. See Managing Patches by Using the Command-Line Interface (Task Map).

Managing Patches by Using the Command-Line Interface (Task Map)

Use the smpatch command to perform most of the common patch management tasks described in the following table. See the smpatch(1M) man page.

The following procedures and examples show how to run the local mode smpatch command, which is run by default. To run the remote mode version, use any of the authentication options (except for -L) or the remote options. See the smpatch(1M) man page.

How to Analyze Your System to Obtain the List of Patches to Apply (Command Line)

You can perform an analysis of your system to determine the list of appropriate patches. This list is in an order that can be used to apply patches. You can also supply a list of one or more patches as input to restrict the analysis to just those patches. In addition to performing the analysis, you can save the patch list for modification or for use at a later time.

The system analysis writes the list of patches to standard output, so you can save the contents of the patch list to a file by redirecting standard output to a file.

Each line in a patch list has two columns. The first column is the patch ID, and the second column is a synopsis of that patch.

If you supply a list of one or more patches to the smpatch analyze command, the list of patches is augmented with any patches that are required as dependencies.

1. Become an appropriately authorized user or assume a role that includes the Software Installation profile or the solaris.admin.patchmgr.* authorization.

   The System Administrator profile includes the appropriate profiles. To create the role and assign the role to a user, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

2. Perform a patch analysis of your system and optionally save the list of patches in a file.

   • To create a list of all the appropriate patches for your system, type:

     # smpatch analyze

   • To create a list of particular patches for your system based on a patch list, type:

     # smpatch analyze -x idlist=patch-list-file

   • To create a list of particular patches for your system, type:

     # smpatch analyze -i patch-id...

Example 5–3 Analyzing Your System to Obtain the List of Patches to Apply

The following example shows how to analyze a system to create a list of all appropriate patches. The list is written to the /tmp/patch.all file.

# smpatch analyze > /tmp/patch.all

The following example shows how to create a list of patches, plist, modify it, and resolve the patch dependencies. The list is written to the /tmp/patch.plist file.

# smpatch analyze > plist
# vi plist
.
.
.
# smpatch analyze -x idlist=plist > /tmp/patch.plist

The following example shows how to resolve patch dependencies for patch 112785-28 and write the resulting patch list to a file called /tmp/patch.out. Patch 112785-28 depends on patch 113096-03. After running the smpatch analyze command, the patch.out file contains this ordered list: 113096-03 and 112785-28.

# smpatch analyze -i 112785-28 > /tmp/patch.out

How to Update Your System With Patches (Command Line)

An update of a system performs the entire patch management process in one step. First, the analysis determines the appropriate patches for your system. Next, those patches are downloaded to your system. Finally, the patches are applied to your system.

All standard patches are applied by an update. You can configure your system to apply some nonstandard patches by changing the default policy for applying patches. To change the policy for your system, see How to Change the Policy for Applying Patches (Command Line).

1. Become an appropriately authorized user or assume a role that includes the Software Installation profile or the solaris.admin.patchmgr.* authorization.

   The System Administrator profile includes the appropriate profiles. To create the role and assign the role to a user, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

2. Update the system with patches in one of the following ways:

   • To update your system with all appropriate patches, type:

     # smpatch update

   • To update your system with all patches listed in a file, first create a patch list (see How to Analyze Your System to Obtain the List of Patches to Apply (Command Line)), then type:

     # smpatch update -x idlist=patch-list-file

   • To update your system with particular patches, type:

     # smpatch update -i patch-id -i patch-id ...

   If you specify particular patches by using the -i or -x idlist= options, the list is augmented with patches on which they depend before the update occurs.

   ---

   Note –

   Any patches that cannot be applied to the system are listed in a patch list file called disallowed_patch_list, which is located in the download directory. You can use this file as input to the smpatch add command.

   For example, you might bring your system to single-user mode and apply the patches listed in the disallowed_patch_list file by typing the following:

   # init S # smpatch add -x idlist=/var/sadm/spool/disallowed_patch_list

   See How to Apply Patches to Your System (Command Line) for more information.

   ---

Example 5–4 Updating Your System With Patches

The following example shows how to update a system with patch 112622-12 and 112771-17.

# smpatch update -i 112622-12 -i 112771-17

The following example shows how to update a system by using a list of patches, named plist, as input. It then shows how to create a patch list and modify it to contain only the patches that you want to apply to your system. Then, you use the smpatch update command to apply the patches and update the system.

1. Create a list of patches by performing an analysis.

2. Edit the patch list to include only the patches that you want to apply.

3. Run the smpatch update command to apply the patches.

   For example:

   # smpatch analyze > plist . . . # vi plist . . . # smpatch update -x idlist=plist . . .

How to Apply Patches to Your System (Command Line)

You can use the smpatch add command to apply one or more downloaded patches to your system.

You can use the local mode version of the smpatch command to apply one or more downloaded patches while your system is in single-user mode or in multiuser mode.

The smpatch add command ignores the policy for applying patches and does not resolve dependencies when applying patches.

1. Become an appropriately authorized user or assume a role that includes the Software Installation profile or the solaris.admin.patchmgr.* authorization.

   The System Administrator profile includes the appropriate profiles. To create the role and assign the role to a user, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

2. Apply the downloaded patches to your system.

   • To apply all patches listed in a file, type:

     # smpatch add -x idlist=patch-list-file

   • To apply particular patches, type:

     # smpatch add -i patch-id -i patch-id ...

   • To apply particular patches that have the singleuser property, you must first bring the system to single-user mode. Type:

     # init S # smpatch add -i patch-id -i patch-id ...

   • To apply the list of patches that could not be applied by the smpatch update command, you must first bring the system to single-user mode. Type:

     # init S # smpatch add -x idlist=/var/sadm/spool/disallowed_patch_list

Example 5–5 Applying Patches to Your System

• The following example shows how to apply the patches listed in the file plist while the system is in single-user mode.

  INIT: SINGLE USER MODE Type control-d to proceed with normal startup, (or give root password for system maintenance): root-password single-user privilege assigned to /dev/console. Entering System Maintenance Mode Jan 7 13:17:44 su: 'su root' succeeded for root on /dev/console Sun Microsystems Inc SunOS 5.9 Generic May 2002 # smpatch add -x idlist=plist

• The following example shows how to apply patch 112662-12 while the system is in single-user mode.

  INIT: SINGLE USER MODE Type control-d to proceed with normal startup, (or give root password for system maintenance): root-password single-user privilege assigned to /dev/console. Entering System Maintenance Mode Jan 7 13:17:44 su: 'su root' succeeded for root on /dev/console Sun Microsystems Inc SunOS 5.9 Generic May 2002 # smpatch add -i 112662-12

How to Apply a Nonstandard Patch (Command Line)

You cannot use smpatch to apply nonstandard patches that have the interactive property set. To apply the patch, review the information in the Special Installation Instructions section of the patch's README file.

1. Become superuser.

2. In the download directory, find the nonstandard patch that you want to apply.

   # cd /var/sadm/spool; ls

3. To access the patch README file, do one of the following:

   • View the patch README file from the Sun patch server at http://sunsolve.sun.com.

   • To extract the patch README file from the JAR archive, do the following:

     1. Identify the name of the README file, for example:

        # /usr/j2se/bin/jar tvf 107058-01.jar | grep README 1440 Sat Apr 06 08:50:08 MST 2002 107058-01/README.107058-01

     2. Extract the README file.

        # /usr/j2se/bin/jar xvf 107058-01.jar 107058-01/README.107058-01 extracted: 107058-01/README.107058-01

     3. View the README file.

        # more 107058-01/README.107058-01

4. Follow the instructions in the Special Installation Instructions section of the README file to apply the patch.

How to Resolve a List of Patches (Command Line)

Sometimes a patch depends on another patch, that is, the first patch cannot be applied to the system until the other patch is applied. The first patch is said to have a dependency on the second patch.

If you specify a list of patches to apply, you can resolve the list for patch dependencies. The resulting list might include additional patches that you must apply before applying the patches you specified.

1. Become an appropriately authorized user or assume a role that includes the Software Installation profile or the solaris.admin.patchmgr.* authorization.

   The System Administrator profile includes the appropriate profiles. To create the role and assign the role to a user, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

2. Resolve the list of patches.

   • Resolve a list of patches specified one at a time on the command line.

     # smpatch analyze -i patch-id -i patch-id ...

   • Resolve a list of patches specified in a file.

     # smpatch analyze -x idlist=patch-list-file

Example 5–6 Resolving a List of Patches

The following example shows how to resolve patch dependencies for patch 112785-28 and write the resulting patch list to a file called /tmp/patch.out. Patch 112785-28 depends on patch 113096-03. After running the smpatch analyze command, the patch.out file contains this ordered list: 113096-03 and 112785-28.

# smpatch analyze -i 112785-28 > /tmp/patch.out

The following example shows how to take a modified list of patches, plist, and resolve the patch dependencies. The list is written to the /tmp/patch.plist file.

# smpatch analyze -x idlist=plist > /tmp/patch.plist

How to Use luupgrade to Apply a List of Patches to an Inactive Boot Environment (Command Line)

A patch list that is created by the smpatch command can be used by luupgrade to apply patches to an inactive boot environment. You can also use the luupgrade command to remove patches from an inactive boot environment based on showrev information. See the luupgrade(1M) and showrev(1M) man pages.

This procedure assumes that you have created a second boot environment that is a duplicate of the active boot environment. See the lumake(1M) man page for information about creating boot environments.

1. Become an appropriately authorized user or assume a role that includes the Software Installation profile or the solaris.admin.patchmgr.* authorization.

   The System Administrator profile includes the appropriate profiles. To create the role and assign the role to a user, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

2. Perform a patch analysis on the active boot environment to obtain the list of appropriate patches to apply to the inactive boot environment, and remove the synopsis for each patch entry.

   # smpatch analyze | sed 's/ .*//' > patch-list-file

   The modified file will be a list of patches, one patch ID per line.

3. Download the patches from a patch list to your system.

   # smpatch download -x idlist=patch-list-file

4. Apply patches from a patch list to the inactive boot environment.

   # luupgrade -t -n BE-name -s dir-name `cat patch-list-file`

   You must specify the name of the inactive boot environment to update, BE-name, and the directory where the patches are stored, dir-name.

5. (Optional) To remove a patch from the inactive boot environment, use the following command:

   # luupgrade -T -n BE-name patch-id

   You must specify the name of the inactive boot environment to update, BE-name, and the patch to be removed, patch-id.

Example 5–7 Using luupgrade to Apply a List of Patches to an Inactive Boot Environment

• The following example shows how to use Patch Manager and Solaris Live Upgrade commands to apply a list of patches to an inactive boot environment. For this example, a duplicate boot environment, be2, of the active boot environment has been created.

  First, use the smpatch analyze and sed commands to analyze the active boot environment and create a patch list, plist, that includes one patch ID per line. The sed command removes the synopsis from each patch entry. Use the smpatch download command to download the patches in the list. Then, use the luupgrade command to apply the list of patches to the inactive boot environment of the system. The inactive boot environment is called be2, and the directory where the patches reside is /var/sadm/spool on the active boot environment.

  # smpatch analyze | sed 's/ .*//' > plist . . . # smpatch download -x idlist=plist . . . # luupgrade -t -n be2 -s /var/sadm/spool `cat plist` . . .

• The following example shows how to use Patch Manager and the Solaris Live Upgrade commands to remove a patch from an inactive boot environment. For this example, a duplicate boot environment, be2, of the active boot environment has been created.

  Use the luupgrade command to remove patch 107058-01 from the inactive boot environment of the system, be2.

  # luupgrade -T -n be2 107058-01 . . .

How to Remove Patches From Your System (Command Line)

You can remove only one patch at a time.

If you want to remove more than one patch, use the browser interface. See How to Remove Patches From Your System (Web Browser).

If your system has more than one boot environment, you can use the luupgrade command to remove a list of patches from an inactive boot environment. See How to Use luupgrade to Apply a List of Patches to an Inactive Boot Environment (Command Line).

Do not remove the Sun Patch Manager 2.0 WBEM patch (117680-01 for x86 and 117679-01 for SPARC) from a system, or Patch Manager will not work properly.

1. Identify the patch that you want to remove.

2. Become an appropriately authorized user or assume a role that includes the Software Installation profile or the solaris.admin.patchmgr.* authorization.

   The System Administrator profile includes the appropriate profiles. To create the role and assign the role to a user, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

3. Remove the patch from your system.

   # smpatch remove -i patch-id

How to View Patch Manager Log Entries (Command Line)

Patch Manager writes to the system log file /var/adm/messages.

1. Choose which method to use to see information about a failed installation of a patch.

   • /var/adm/messages – Identifies problems that are found when applying a patch to a system by using Patch Manager.

   • Solaris WBEM log – To view this log from the command line, use the smlog view command. See the smlog(1M) man page.

2. View log entries from the appropriate log file.

Tuning Your Patch Management Environment by Using the Command-Line Interface (Task Map)

The following table identifies the optional tasks that you might perform when you tune the patch management environment for your system.

Use the smpatch command to tune your patch management environment. For the list of configuration parameters you can set, see Setting Patch Manager Configuration Parameters and the smpatch(1M) man page.

If you want to use the browser interface to tune your patch management environment, see Tuning Your Patch Management Environment by Using the Browser Interface (Task Map).

The following procedures and examples show how to run the local mode smpatch command, which is run by default. To run the remote mode version, use any of the authentication options (except for -L) or the remote options. See the smpatch(1M) man page.

How to View the Configuration Settings for Your Patch Management Environment (Command Line)

You can check the configuration settings of your patch management environment to help diagnose problems or to understand your system's patch-related settings.

The configuration settings output shows an entry for all configuration parameters. Each entry appears on a line by itself.

When you list all settings, each entry includes three fields: the parameter name, the value you have assigned, and its default value. The fields are separated by one or more tab characters.

The following values have special meaning:

• - means that no value is set

• "" means that the value is the null string

• \- means that the value is -

• \"" means that the value is "" (two double quotes)

In addition to these special values, these special characters might appear in the output:

• \t for a tab

• \n for a newline

• \\ for a backslash

1. Become an appropriately authorized user or assume a role that includes the Software Installation profile or the solaris.admin.patchmgr.* authorization.

   The System Administrator profile includes the appropriate profiles. To create the role and assign the role to a user, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

2. List the configuration settings for your patch management environment.

   • To list all settings, type:

     # smpatch get

   • To list the values for one or more parameters, type:

     # smpatch get parameter-name...

Example 5–8 Viewing Configuration Settings for Your Patch Management Environment

The following example shows how to list all the configuration settings for your patch management environment.

# smpatch get
patchpro.backout.directory  -      ""
patchpro.download.directory -      /var/sadm/spool
patchpro.install.types      -      rebootafter:reconfigafter:standard
patchpro.patch.source       -      https://updateserver.sun.com/solaris/
patchpro.patchset           -      patchdb
patchpro.proxy.host         -      ""
patchpro.proxy.passwd       ****   ****
patchpro.proxy.port         -      8080
patchpro.proxy.user         -      ""
patchpro.sun.passwd         ****   ****
patchpro.sun.user           -      ""

The following example shows how to list the configuration settings for the patchpro.download.directory and patchpro.patchset parameters.

# smpatch get patchpro.download.directory patchpro.patchset
/var/sadm/spool
patchdb

How to Change the Policy for Applying Patches (Command Line)

If you want to configure your system to apply some nonstandard patches during an update operation, you must change the policy for applying patches.

By default, only patches that are associated with the standard, rebootafter, or reconfigafter properties can be applied by an update operation.

If you change your policy from the default, Sun makes no guarantees that the patches apply correctly to your system or that your system will function properly.

For more information about the policy for applying patches, see Customizing the Policy for Applying Patches.

1. Determine the types of nonstandard patch properties that you want to apply during an update.

2. Become an appropriately authorized user or assume a role that includes the Software Installation profile or the solaris.admin.patchmgr.* authorization.

   The System Administrator profile includes the appropriate profiles. To create the role and assign the role to a user, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

3. Specify the new policy.

   # smpatch set patchpro.install.types=patch-property

   patch-property is a list of patch properties each separated by a colon (:). For the list of valid patch properties, see Customizing the Policy for Applying Patches.

Example 5–9 Changing the Policy for Applying Patches

This example shows how to set the policy for a system. The new policy also includes patches that require that the system be rebooted immediately for the patch to take effect.

# smpatch set \
patchpro.install.types=standard:rebootafter:reconfigafter:rebootimmediate

How to Change the Patch Set (Command Line)

You can choose to analyze your system based on different sets of Sun patches, such as the Recommended Patch Cluster. By default, you use the patch set All Available Patches.

As of June 2005, the only patch sets available from Sun are All Available Patches and Recommended Patch Cluster.

1. Become an appropriately authorized user or assume a role that includes the Software Installation profile or the solaris.admin.patchmgr.* authorization.

   The System Administrator profile includes the appropriate profiles. To create the role and assign the role to a user, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

2. Specify the patch set to use.

   • To base your analysis on all patches, type:

     # smpatch set patchpro.patchset=patchdb

   • To base your analysis on recommended patches, type:

     # smpatch set patchpro.patchset=recommended

   • To base your analysis on another patch set, type:

     # smpatch set patchpro.patchset=patch-set

How to Change Directory Locations (Command Line)

Patch Manager is configured to use these default locations for storing patch-related data:

• Download directory – Directory in which patches are stored when they are downloaded from the patch source. This is also the directory from which patches are applied. Patches remain in this directory until they are successfully applied. The default location is /var/sadm/spool.

• Backout data directory – Directory in which data that enables a patch to be backed out is stored. By default, backout data is stored in the default locations used by patchadd. This is the save directory of each package that was modified by the patch. For example, if a patch modifies the SUNWcsr package, the backout data for that package is stored in the /var/sadm/pkg/SUNWcsr/save directory.

If you run out of available disk space in the default locations, specify different locations for these directories.

If you specify a different directory, you must manually create that directory before performing any patch operations.

1. Determine the new locations for the directories.

2. Become an appropriately authorized user or assume a role that includes the Software Installation profile or the solaris.admin.patchmgr.* authorization.

   The System Administrator profile includes the appropriate profiles. To create the role and assign the role to a user, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

3. Specify a new directory, dir-name, for any of the patch-related directories.

   • To specify a different download directory, type:

     # smpatch set patchpro.download.directory=dir-name

     For example, dir-name is /export/patches.

   • To specify a different backout directory, type:

     # smpatch set patchpro.backout.directory=dir-name

     For example, dir-name is /export/patches/backout.

How to Reset Configuration Parameters to the Default Values (Command Line)

You must reset parameter values explicitly. You cannot use the smpatch command to reset all parameter values at once.

1. Become an appropriately authorized user or assume a role that includes the Software Installation profile or the solaris.admin.patchmgr.* authorization.

   The System Administrator profile includes the appropriate profiles. To create the role and assign the role to a user, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

2. Reset a configuration parameter for your patch management environment to its default value.

   # smpatch unset parameter-name...

Example 5–10 Resetting Configuration Parameters to the Default Values

The following example shows how to configure a system to obtain patches from the Sun patch server instead of from a different patch source.

# smpatch unset patchpro.patch.source

The following example shows how to reset the patch download directory and the backout directory locations to the default values.

# smpatch unset patchpro.download.directory patchpro.backout.directory