Installing a Patch
Sun customers can access security patches and other recommended patches via the World Wide Web or anonymous FTP. You can download patches from the SunSolve website, which (as of this writing) is at http://sunsolve.sun.com. Sun customers who have purchased a service contract can access an extended set of patches and a complete database of patch information. (This information is also available via the World Wide Web or FTP, and it is regularly distributed on CD-ROM.)
You can obtain individual patches or groups of patches called a patch cluster. Detailed information about how to install and remove a patch is provided in the README file included with each patch, which contains specific information about the patch.
Patches come in three different formats. Solaris 10 patches come in ZIP format, such as 104945-02.zip. For Solaris 10 patches, use the unzip command to extract the patch files, as follows:
Other times, a patch may come in as a jar file indicated by a .jar suffix in the name, for example 120292-01.jar. To extract the jar file, type
jar xvf 120292-01.jar
For Solaris 2.6 and earlier operating environments, patches might come in compressed TAR format, such as 104945-02.tar.Z. Use the zcat command to decompress this type of patch file and the tar command to create the patch directories, as follows:
/usr/bin/zcat 104945-02.tar.Z | tar xvf -
Other Solaris patches might come as GZIP compressed TAR files, such as 102945-02.tar.gz. To extract a GZIP compressed TAR file, use the gzcat command to decompress and create the patch directories, as follows:
/usr/bin/gzcat 104945-02.tar.gz | tar xvf -
patchadd [ -d ] [ -u ] [ -B backout_dir]
The patchadd command is described in Table 2.6.
Installing a Patch
The following examples describe how to add patches to your system. A word of caution is in order before you install patches, however. It has been my personal experienceMurphy's Law, you might saythat things can go wrong. Because you're modifying the operating system with a patch, I highly recommend that you back up your file systems before loading patches. Although it can be a time-consuming and seemingly unnecessary task, I once encountered a power failure during a patch installation that completely corrupted my system. Another time, the patch installation script was defective, and the patch did not load properly. Without a backup, I would have had to reinstall the entire operating system.
patchadd -M /var/spool/patch patchlist
patchadd -R /export/root/client1 -p
When a patch is installed, files that are replaced are moved into the /var/sadm/pkgs>/<pkgname>/save directory. Files in this directory are used if you ever need to back out of a patch. These files are used to restore the system to the prepatch installation state. Backing out a patch returns files and directories stored in the /var directory to their original locations and removes the versions installed by the patch. If you remove files in this directory, you will not be able to backout a patch.
showrev -p gets its information from /var/sadm/pkg/<pkgname>/save as well, specifically from the pkginfo file in each pkg directory. This directory contains old information about the package as it existed prior to a patch install and contains backups of critical files for the package.
The file that you see in this directory will be different depending on the package, but the save information for the patch IDs that have been installed should always exist and will look something like this:
1s -1 /var/sadm/pkg/SUNWcsu/save <cr> total 8 drwxr-xr-x 2 root other 512 Oct 10 15:25 112233-02 drwxr-xr-x 2 root other 512 Oct 10 15:20 112963-01 drwxr-xr-x 2 root other 512 Oct 10 15:27 112964-02 drwxr-xr-x 2 root other 512 Oct 10 15:08 112998-02
Looking into each directory, we see a file named undo.Z as follows:
1s 112233-02 <cr> undo.Z
If a file doesn't exist here, the patch was installed with the -d option. You did not save the backout information and the patch cannot be backed out. This file will not always be in .Z format. Sometimes it will be just a regular uncompressed file.
A patch cluster contains a selected set of patches, conveniently wrapped for one-step installation. Typically, they will be named "10_recommended". Clusters consist of operating system patches (including security fixes) deemed to be of universal interest. To install a patch cluster, follow these steps:
Removing a Patch
Sometimes a patch does not work as planned and needs to be removed from the system. The utility used to remove, or "back out of," a patch is the patchrm command, described in Table 2.7. Its syntax is as follows:
patchrm [ -f ] [ -B backout_dir]
The following example removes a patch from a standalone system:
The patchrm command removes a Solaris 10 patch package and restores previously saved filesrestoring the file system to its state before a patch was appliedunless any of the following four conditions exist:
Historical information about all installed patches that are able to be uninstalled using patchrm is stored in the /var/sadm/patch directory.