Applying Security-Only Online Patches to Oracle AI Database

Use Oracle Fleet Patching and Provisioning (Oracle FPP) to apply only online patches identified by OPatch metadata as containing security fixes to an Oracle AI Database working copy.

Specify -security YES with rhpctl apply patch -online to select security patches from an online patch location or a Monthly Recommended Patch (MRP). For an MRP containing both security and non-security patches, Oracle FPP selects only eligible online patches marked as containing security fixes.

The -security option controls patch selection. Specify NO, or omit the option, to apply eligible online patches without filtering for security fixes. The default is NO. This value does not exclude security patches.

Prerequisites for Security-Only Online Patching

Before you begin, ensure that the Oracle AI Database home is configured as a working copy and that the database instances to which you want to apply the online patches are running. Review the patch readme for prerequisites.

Security-only online patching has the following additional requirements:

OPatch version 12.2.0.1.52 or later is required. Oracle FPP validates the OPatch version before retrieving the patch type and security-fix metadata.
The one-off patches must contain the contains_security_fix metadata property. For an MRP, this requirement applies to its constituent one-off patches.

The following metadata identifies a patch as containing a security fix:

<contains_security_fix>true</contains_security_fix>

If this metadata is absent, Oracle FPP cannot identify the patch for security-only selection. Use this functionality only with patches or MRPs whose constituent one-off patches provide the required metadata.

Applying Security-Only Online Patches

Note:

The -security option requires -online and cannot be used with -patchid, whether you specify YES or NO.

Extract the patch or MRP to a directory that is available on each applicable target node.
For an MRP, use the directory that contains the MRP patch directories.
Evaluate the security-only online patching operation.
```
rhpctl apply patch -workingcopy workingcopy_name -patchloc patch_location_on_target -online -security YES -dbname unique_db_name -eval
```
Specify the working copy using -workingcopy and the absolute path to the unzipped patch directory on the target using -patchloc. Specify the unique name of the database (DB_UNIQUE_NAME without DB_DOMAIN) using -dbname.

If you omit -dbname, Oracle FPP evaluates the eligible databases configured on the working copy.

Review the evaluation results and resolve any reported errors before proceeding.
Apply the security patches by running the command without -eval.
```
rhpctl apply patch -workingcopy workingcopy_name -patchloc patch_location_on_target -online -security YES -dbname unique_db_name
```
Oracle FPP applies only eligible online patches whose contains_security_fix property is true.
Review the operation results and perform the verification steps described in the patch readme.

If No Matching Security Patches Are Found

If you specify -security YES and no online patches marked as containing security fixes are found, Oracle FPP reports an error similar to the following:

No online patches marked as containing security fixes were found in patch location "<patch_location>".

Specify a patch location containing eligible online patches with the required metadata. Alternatively, run the operation without -security YES if you intend to apply eligible online patches without filtering for security fixes.

Rolling Back Security Patches

Use the rhpctl rollback patch command to roll back security patches by specifying their patch IDs.

For security patches applied from an MRP, specify the individual patch IDs that you want to roll back. Review the patch readme for rollback requirements.

rhpctl rollback patch -patchid patch_ids -workingcopy workingcopy_name -online -dbname unique_db_name

Specify a comma-separated list of patch IDs using -patchid. Review the rollback results and perform the verification steps described in the patch readme.

Note:

The -security option is available only for rhpctl apply patch. It is not available for rhpctl rollback patch.