When upgrading or patching Solaris Global or Local (non-global) Zone file permissions must be set to 755 for Veritas Solaris p5p files
Article ID: 100053941
Updated On:
Description
Error Message
In this example, when attempting to update Solaris Local Zone named "zone3", it fails with the following errors:
# zlogin zone3 pkg update VRTSvxfs
Startup: Refreshing catalog 'Veritas' ... Done
Planning: Solver setup ... Done
Planning: Running solver ... Done
Planning: Consolidating action changes ... Done
Planning: Evaluating mediators ... Done
Planning: Planning completed in 2.88 seconds
No updates available for this image. (zone:zone3)
WARNING: Errors were encountered when attempting to retrieve package
catalog information. Packages added to the affected publisher repositories since
the last retrieval may not be available.Errors were encountered when attempting to contact repository for publisher 'Veritas'.Unable to contact valid package repository: http://localhost:1008/Veritas/ef5fb0b408403cec0b44365fe4fa516ea291307d/
Encountered the following error(s):
http protocol error: Unknown error code: 403 reason: Forbidden
URL: 'http://localhost:1008/Veritas/ef5fb0b408403cec0b44365fe4fa516ea291307d'
Cause
As the Veritas "VRTSvxfs.p5p" file is set with file permissions "700", (rwx for root only), the patch install fails.
Example of incorrect file permissions set:
# ls -al /742-1400/patches/VRTSvxfs.p5p
-rwx------ 1 root root 18677760 Jun 24 13:08 /742-1400/patches/VRTSvxfs.p5p
In the Solaris Local (non-global) Zone, the system repository always shows as "syspub".
# zlogin zone3 "pkg publisher"
PUBLISHER TYPE STATUS P LOCATION
Veritas (syspub) origin online F
solaris (disabled, syspub)
The following "for loop" can be used to verify the publisher details for all "running" Solaris Local (non-global) Zones:
# for zone in `zoneadm list -s | egrep -v '^global|^NAME' | awk '{print $1}'`; do echo $zone; zlogin $zone "pkg publisher" ; done
The additional -F option can be used to display the additional URL and proxy values for system-repository locations:
# zlogin zone3 "pkg publisher -F tsv"
PUBLISHER STICKY SYSPUB ENABLED TYPE STATUS URI PROXY
Veritas true true true origin online http://localhost:1008/Veritas/ef5fb0b408403cec0b44365fe4fa516ea291307d/ -
solaris true true false
NOTES:
===================
The file:// repository in the Global Zone has been assigned a http://location in the Solaris Local (non-global) Zone.
The http location defined in the Solaris Local (non-global) Zone is used to communicate with the system repository in the Global Zone.
\The system repository cannot be reconfigured from within a Solaris Local (non-global) Zone.
If a publisher is added or reconfigured in the Global Zone, those changes are seen immediately by Solaris Local (non-global) Zones.
If a publisher is unset in the Global Zone, that publisher is also unset in Solaris Local (non-global) Zone
Resolution
1.] Correct the file permissions for Veritas VxFS patch located in "/742-1400/patches"
# chmod 755 /742-1400/patches/VRTSvxfs.p5p
# ls -al /742-1400/patches/VRTSvxfs.p5p
-rwxr-xr-x 1 root root 18677760 Jun 24 13:08 /742-1400/patches/VRTSvxfs.p5p
2.] Connect to the Solaris Local (non-global) Zone then disable and enable the "zones-proxy-client:default" service:
# zlogin zone3
[Connected to zone 'zone3' pts/2]
Last login: Fri Jul 1 15:16:34 2022 on pts/2
root@zone3:~# svcs svc:/application/pkg/zones-proxy-client:default
STATE STIME FMRI
online 13:56:47 svc:/application/pkg/zones-proxy-client:default
root@zone3:~# svcadm disable svc:/application/pkg/zones-proxy-client:default
root@zone3:~# svcadm enable svc:/application/pkg/zones-proxy-client:default
root@zone3:~# svcs svc:/application/pkg/zones-proxy-client:default
STATE STIME FMRI
online 14:00:01 svc:/application/pkg/zones-proxy-client:default
root@zone3:~# exit
logout
[Connection to zone 'zone3' pts/2 closed]
3.] Disable and Enable the "system-repository:default" service in the Global Zone:
# svcs svc:/application/pkg/system-repository:default
STATE STIME FMRI
maintenance 13:56:47 svc:/application/pkg/system-repository:default
# svcadm disable svc:/application/pkg/system-repository:default
# svcadm enable svc:/application/pkg/system-repository:default
# svcs svc:/application/pkg/system-repository:default
STATE STIME FMRI
online 14:01:35 svc:/application/pkg/system-repository:default
4.] Reconnect to the Solaris Local (non-global) Zone:
# zlogin zone3
[Connected to zone 'zone3' pts/2]
root@zone3:~# pkg publisher
PUBLISHER TYPE STATUS P LOCATION
Veritas (syspub) origin online F
solaris (disabled, syspub)
5.] Attempt the "pkg update" operation in the Solaris Local (non-global) Zone:
root@zone3:~# pkg update --accept VRTSvxfs
------------------------------------------------------------
Package: pkg://Veritas/VRTSvxfs@7.4.2.2600:20220624T063610Z
License: VRTSvxfs.copyright
Copyright (c) 2022 Veritas Technologies LLC. All rights reserved. Veritas and the Veritas Logo are trademarks or registered trademarks of Veritas Technologies LLC or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.
The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR 12.212 and subject to restricted rights as defined in FAR Section 52.227-19 "Commercial Computer Software - Restricted Rights" and DFARS 227.7202, et seq. "Commercial Computer Software and Commercial Computer Software Documentation," as applicable, and any successor regulations, whether delivered by Veritas as on premises or hosted services. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement.
Packages to update: 1
Create boot environment: No
Create backup boot environment: Yes
DOWNLOAD PKGS FILES XFER (MB) SPEED
Completed 1/1 85/85 11.1/11.1 19.9M/s
PHASE ITEMS
Updating modified actions 90/90
Updating package state database Done
Updating package cache 1/1
Updating image state Done
Creating fast lookup database Done
Updating package cache 2/2
6.] Unset the Veritas publisher in the Global Zone.
# pkg publisher
PUBLISHER TYPE STATUS P LOCATION
solaris (disabled) origin online F https://pkg.oracle.com/solaris/support/
Veritas origin online F file:///742-1400/patches/VRTSvxfs.p5p/
# pkg unset-publisher Veritas
Updating package cache 1/1
# pkg publisher
PUBLISHER TYPE STATUS P LOCATION
solaris (disabled) origin online F https://pkg.oracle.com/solaris/support/
Process complete.
Issue/Introduction
Otherwise, the pkg install or pkg update operations will fail within the Solaris Global & Local (non-global) Zones.
The Veritas publisher is defined, referencing the file location "/742-1400/patches/VRTSvxfs.p5p":
# pkg set-publisher -p /742-1400/patches/VRTSvxfs.p5p Veritas
pkg set-publisher:
Added publisher(s): Veritas# pkg publisher
PUBLISHER TYPE STATUS P LOCATION
solaris (disabled) origin online F https://pkg.oracle.com/solaris/support/
Veritas origin online F file:///742-1400/patches/VRTSvxfs.p5p/