КатегорииLinksUnix Tutorial
Personal Development Ruslan Valiev Solaris Performance Team Damien Farnham Fintan Ryan Nicky Veitch Niall Mullen Sean McGrath DTrace Bryan Cantrill Brendan Gregg ZFS Tim Foster General Ben Rockwood Learning Solaris 10 Privacy policy |
Wednesday, September 27. 2006
Did you know: root shell in Solaris 10 Posted by Gleb Reys
in Solaris at
13:07Comments (7) Trackbacks (0) Did you know: root shell in Solaris 10
As you know, traditionally with older Solaris versions you had to leave /sbin/sh as the default root shell. In Solaris 8 and 9, you're supposed to do this because all the libraries for dynamic linking are in /usr/lib, which could well be on a separate /usr filesystem. This filesystem may not be accessible during the maintenance boot, and therefore it is regarded as a very bad practice to change the root shell.
To make sure the superuser is always going to be able to log in, you have a /sbin/sh assigned to root, and it's a statically built binary, so it doesn't need any of the external libraries: bash-2.03$ file /sbin/sh /sbin/sh: ELF 32-bit MSB executable SPARC Version 1, statically linked, stripped bash-2.03$ ldd /sbin/sh ldd: /sbin/sh: file is not a dynamic executable or shared object But did you know, that Solaris 10 has greatly improved this situation for you, and there are two major improvements? Here they are: 1) Now standard libraries are in /lib, and therefore they're always accessible during your maintenance boots. As a result of this, your /sbin/sh shell is now a regular executable using dynamic libraries: bash-3.00$ file /sbin/sh /sbin/sh: ELF 32-bit MSB executable SPARC Version 1, dynamically linked, stripped bash-3.00$ ldd /sbin/sh libgen.so.1 => /lib/libgen.so.1 libsecdb.so.1 => /lib/libsecdb.so.1 libc.so.1 => /lib/libc.so.1 libnsl.so.1 => /lib/libnsl.so.1 libcmd.so.1 => /lib/libcmd.so.1 libmp.so.2 => /lib/libmp.so.2 libmd5.so.1 => /lib/libmd5.so.1 libscf.so.1 => /lib/libscf.so.1 libdoor.so.1 => /lib/libdoor.so.1 libuutil.so.1 => /lib/libuutil.so.1 libm.so.2 => /lib/libm.so.2 /platform/SUNW,Ultra-5_10/lib/libc_psr.so.1 /platform/SUNW,Ultra-5_10/lib/libmd5_psr.so.1 2) Solaris 10 has a built-in protection against non-executable root shells. So, if you change it to any other shell and it for some reason cannot be started for you, you will automatically get a standard /sbin/sh instead. The same kind of protection exists for sudo command as well. These improvements make sure that there is nothing to stop you now from setting your root shell to anything you like. Monday, September 25. 2006
Solaris patches installation error codes Posted by Gleb Reys
in Solaris at
20:23Comments (2) Trackbacks (0) Solaris patches installation error codes
The last few days I've been busy patching our Solaris boxes, and that's why I had to dig this old trusty table up. It shows all the patches installation error codes which usually appear in a form of:
Installation of 'patch_number' failed. Return code N. I think the most common errors are 2 and 8, but I've seen some others too: 0 No error
1 Usage error 2 Attempt to apply a patch that's already been applied 3 Effective UID is not root 4 Attempt to save original files failed 5 pkgadd failed 6 Patch is obsoleted 7 Invalid package directory 8 Attempting to patch a package that is not installed 9 Cannot access /usr/sbin/pkgadd (client problem) 10 Package validation errors 11 Error adding patch to root template 12 Patch script terminated due to signal 13 Symbolic link included in patch 14 NOT USED 15 The prepatch script had a return code other than 0. 16 The postpatch script had a return code other than 0. 17 Mismatch of the -d option between a previous patch install and the current one. 18 Not enough space in the file systems that are targets of the patch. 19 $SOFTINFO/INST_RELEASE file not found 20 A direct instance patch was required but not found 21 The required patches have not been installed on the manager 22 A progressive instance patch was required but not found 23 A restricted patch is already applied to the package 24 An incompatible patch is applied 25 A required patch is not applied 26 The user specified backout data can't be found 27 The relative directory supplied can't be found 28 A pkginfo file is corrupt or missing 29 Bad patch ID format 30 Dryrun failure(s) 31 Path given for -C option is invalid 32 Must be running Solaris 2.6 or greater 33 Bad formatted patch file or patch file not found Thursday, September 21. 2006
Be careful with Jumpstart miniroot Posted by Gleb Reys
in Solaris at
16:38Comments (7) Trackbacks (0) Be careful with Jumpstart miniroot
Last few days I'm working on debugging the Solaris 10 Jumpstart install for some old desktops (Ultra 10, Ultra 60).
Among few well-known problems, I've noticed such an anomaly: the whole Jumpstart session happens just fine, all the packages are installed, but at the very end I see the errors and the installation fails: SUNWspnego.......................done. 1.30 Mbytes remaining. SUNWsra..........................done. 1.18 Mbytes remaining. SUNWsrh..........................done. 1.00 Mbytes remaining. Completed software installation Solaris 10 software installation succeeded Customizing system files - Mount points table (/etc/vfstab) - Unselected disk mount points (/var/sadm/system/data/vfstab.unselected) - Network host addresses (/etc/hosts) ERROR: Could not open file (/etc/hosts) ERROR: Could not set up the remote host file (/etc/hosts) ERROR: System installation failed After a quick research, I've found out that such errors happen when you have a Solaris network image miniroot corrupted. And after a short while more, I've learned how exactly I got my miniroot image corrupted in the first place: I had my netinstall image in the /export/vol1/jumpstart/images directory, which I had previously shared out using share -o rw,anon=0 /export/vol1/jumpstart/images when I was transferring the netinstall image from a desktop with CD-ROM to the Jumpstart server. Shortly after the copying, I got distracted and therefore had completely forgotten to unshare the resource. As the result of this, the add_install_client had tried to share the miniroot but didn't touch it as the whole netinstall image was already shared out with read/write access. And this is how such a setup corrupts your miniroot: the very first client you Jumpstart, is trying to update some of its files - like /etc/vfstab and /etc/hosts, but they're in miniroot. With read/write access, they get corrupted right there. But what happens usually is that your client moves on to another location for these files, as it can't update the read-only miniroot ones. It normally ends up updaiting /a/etc/vfstab and /a/etc/hosts, I think. As the result of this error, you're left with some directories of your miniroot having regular files instead of symlinks. For example: this is the original and fully working /export/vol1/sol10/Solaris_10/Tools/Boot/etc/inet directory: drwxr-xr-x 4 root sys 1024 Jan 23 2005 . drwxr-xr-x 40 root sys 4096 Jan 23 2005 .. -r--r--r-- 1 root sys 22 Jan 21 2005 datemsk.ndpd lrwxrwxrwx 1 root other 29 Aug 15 16:31 hosts -> ../../tmp/root/etc/inet/hosts drwxr-xr-x 4 root sys 96 Jan 23 2005 ike -r--r--r-- 1 root sys 1101 Jan 23 2005 inetd.conf -r--r--r-- 1 root sys 545 Jan 23 2005 ipaddrsel.conf lrwxrwxrwx 1 root other 31 Aug 15 16:31 ipnodes -> ../../tmp/root/etc/inet/ipnodes -r--r--r-- 1 root sys 914 Jan 23 2005 ipsecalgs -r--r--r-- 1 root sys 2380 Jan 21 2005 ipsecinit.sample lrwxrwxrwx 1 root other 32 Aug 15 16:31 netmasks -> ../../tmp/root/etc/inet/netmasks -r--r--r-- 1 root sys 372 Jan 23 2005 networks -r--r--r-- 1 root sys 1901 Jan 23 2005 protocols drwx------ 3 root sys 96 Jan 23 2005 secret -r--r--r-- 1 root sys 3869 Jan 23 2005 services -r--r--r-- 1 root sys 520 Jan 23 2005 sock2path -r--r--r-- 1 root sys 3312 Jan 21 2005 wanboot.conf.sample ... and this is the same one, only corrupted by the first installed client: drwxr-xr-x 4 root sys 512 Sep 3 16:48 . drwxr-xr-x 40 root sys 3072 Sep 3 16:19 .. -r--r--r-- 1 root sys 22 Jan 21 2005 datemsk.ndpd -r--r--r-- 1 root sys 99 Sep 3 16:48 hosts drwxr-xr-x 4 root sys 512 Sep 3 14:23 ike -r--r--r-- 1 root sys 1101 Jan 23 2005 inetd.conf -r--r--r-- 1 root sys 545 Jan 23 2005 ipaddrsel.conf -r--r--r-- 1 root sys 91 Sep 3 16:48 ipnodes -r--r--r-- 1 root sys 914 Jan 23 2005 ipsecalgs -r--r--r-- 1 root sys 2380 Jan 21 2005 ipsecinit.sample -r--r--r-- 1 root sys 384 Sep 3 16:48 netmasks -r--r--r-- 1 root sys 372 Jan 23 2005 networks -r--r--r-- 1 root sys 1901 Jan 23 2005 protocols -rw-r--r-- 1 root root 523 Sep 3 16:04 routing.conf drwx------ 3 root sys 512 Sep 3 14:23 secret -r--r--r-- 1 root sys 3869 Jan 23 2005 services -r--r--r-- 1 root sys 520 Jan 23 2005 sock2path -r--r--r-- 1 root sys 3312 Jan 21 2005 wanboot.conf.sample LESSON OF TODAY: be careful and always check that your netinstall image has its miniroot shared out in read-only! |





