White Paper

ManualsBrandsHP ManualsSoftwareHP Dynamic Root Disk (DRD)

DRD-Safe Concepts for HP-UX 11i v2 and Later

1 Introduction...................................................................................................................................... 2

1.1 Abstract .................................................................................................................................... 2

1.2 Purpose of Document.................................................................................................................. 3

1.3 Audience .................................................................................................................................. 3

1.4 Release Information.................................................................................................................... 3

1.5 Terms and Definitions ................................................................................................................. 3

2 What must be DRD-Safe?................................................................................................................... 6

3 DRD-Safe Problem Areas ................................................................................................................... 7

3.1 Process Communications............................................................................................................. 7

3.2 Unterminated Process ................................................................................................................. 9

3.4 Firmware Patches and Other Unsafe Packages ............................................................................ 10

4 Making Control Scripts and Commands DRD-Safe .............................................................................. 11

4.1 Control Scripts Stopping, Starting or Restarting Processes/Daemons .............................................. 11

4.2 Commands that Communicate with Other Processes..................................................................... 12

4.4 Unsafe Logic in an Unconfigure Script ........................................................................................ 13

4.3 Logic to Support NFS Diskless may not be DRD-safe ..................................................................... 16

5 Making Control Script Invocations of swremove DRD-Safe ................................................................... 17

5.1 How to Make Packages DRD-Safe for swremove.......................................................................... 17

6 DRD-Safe Packaging Changes.......................................................................................................... 19

6.1 The is_drd_safe Attribute........................................................................................................... 19

7 Making Special Installation Instructions DRD-Safe ............................................................................... 21

Appendix A ...................................................................................................................................... 22

A.1 HP-UX 11i v2 control_utils......................................................................................................... 22

A.2 HP-UX 11i v2 Commands ......................................................................................................... 23

Summary of content (25 pages)

PAGE 1
DRD-Safe Concepts for HP-UX 11i v2 and Later 1 Introduction...................................................................................................................................... 2 1.1 Abstract .................................................................................................................................... 2 1.2 Purpose of Document.................................................................................................................. 3 1.3 Audience ..............
PAGE 2
1 Introduction 1.1 Abstract System administrators often want to upgrade software and apply patches to their HP-UX systems in as short a maintenance window as possible. In addition, they also need a quick and reliable way to return to the pre-updated system in the event that the modifications do not work as expected. The Dynamic Root Disk (DRD) utilities create and manage the inactive copy of the HP-UX operating system (or inactive system image).
PAGE 3
• • swinstall and swremove. Using chroot prevents modification of files on the booted system image. Such use of chroot is sometimes known as a chroot jail. SW_SESSION_IS_DRD – drd runcmd sets the environment variable SW_SESSION_IS_DRD to 1 when it is executed. Packaging control scripts can use this variable to check for the presence of a runcmd environment. Packaging – Restrictions on software packages are needed to ensure that the booted system image is not modified.
PAGE 4
critical file systems DRD DRD-safe The subset of file systems in a system image that will be cloned during a drd clone operation. Currently, the critical file systems are those in the LVM volume group or VxVM disk group containing the root (“/”) file system. Dynamic Root Disk. The collection of utilities that manages creation, modification, and booting of system images. Refers to software packages for HP-UX, as well as to HP-UX commands.
PAGE 5
system activities All of the running processes that correspond to programs on a booted system. This includes the running kernel, all network processes, all daemons, and all other processes—both system and user. System activities frequently access in-memory copies of data. Thus, any change to in-memory data may affect system activities. system environment The combination of the system image and the system activities that comprise a running installation of HP-UX.
PAGE 6
2 What must be DRD-Safe? System administrators execute the drd runcmd command to install, remove, modify, and verify software on the inactive system image. The following entities must be DRD-Safe: • • • • The software deployment commands: o swinstall o swremove o swmodify o swlist o swverify (without -F and -x fix=true options The control scripts for the software being installed, removed, or verified. Note that the configure script is not in this list.
PAGE 7
3 DRD-Safe Problem Areas Before discussing the details of how to create DRD-safe scripts and how to identify DRD-unsafe commands in current scripts, we will take a look at the activities that are not DRD-safe and thus must not take place in a DRD session. After we have described what types of activities are DRD-unsafe, we will then move on to describing how to create control scripts and packages that avoid these activities and are DRD-safe. 3.
PAGE 8
Example 3.1.2 – Illegal Request: A command executed within the runcmd environment communicates with a daemon started outside of the runcmd environment. For example, assume a daemon is started before the runcmd environment. When the daemon was started, it read information from a configuration file on the booted system image. When a process starts in the runcmd environment and asks for data from the daemon, the data returned is for the booted system image and not for the inactive system image.
PAGE 9
information may not be invalid. Additionally, after the user exits the runcmd environment, the process becomes an unterminated process. (See 3.2 Unterminated Process for more details.) 3.2 Unterminated Process A process that is started in the runcmd environment and remains active after drd runcmd completes is not DRD-safe because it is using data from the inactive system image, but is now running in the booted system image.
PAGE 10
In addition, the persistent process will have an open file reference to the program it is running, causing an unmount of the inactive system image to fail. 3.4 Firmware Patches and Other Unsafe Packages A firmware patch affects both the inactive system image and the booted system image, and as a result, it is not considered DRD-safe. All firmware patches should exclude themselves from being installed or removed from within a runcmd environment.
PAGE 11
4 Making Control Scripts and Commands DRD-Safe This chapter describes the type of logic a packager or developer should look for to determine if a given control script or command is DRD-safe. For each of the following descriptions (sections), a set of examples and suggestions on how to make the control script or commands DRD-safe are provided. Note: Control scripts and commands are executing in a runcmd environment if the SW_SESSION_IS_DRD environment variable is set to 1. 4.
PAGE 12
• • if [[ $SW_SESSION_IS_UPDATE -ne 1 && $SW_SESSION_IS_DRD -ne 1 ]] then vxdctl stop >/dev/null 2>&1 fi kill_named_procs wlmcomd SIGTERM > /dev/null 2>&1 4.2 Commands that Communicate with Other Processes Look for commands that communicate with other process—for example, communications through sockets, RPC calls, or named pipes. Unsafe Examples: • vxdg bootdg The vxdg command attempts to contact the vxconfigd daemon, which was started on the booted system.
PAGE 13
Safe Examples: • lvlnboot –v The lvlnboot command uses files on the inactive image. • cat /etc/fstab | grep -e vxfs -e hfs | grep " / " | \ grep "/dev/vx/dsk" | awk '{FS="/"; print $5}' The preceding command can be used to determine if the system is installed on a VxVM disk group. The command looks for a file system mounted at “/”, checks for a prefix indicating VxVM, then uses awk to parse out the group name. 4.
PAGE 14
However, the directories on the inactive system image must be removed from tftp access the next time the image it booted. To accomplish this, the unconfigure script takes the following steps when running in a DRD session: 1. Create an rc script in sbin/init.d and an S900* symlink to the script 2. Include the setup_tftp call in the script 3. Include code in the script to remove itself as well as the S900 link before exiting The actual code used by the Ignite unconfigure script is shown in text box below.
PAGE 15
# # Remove the Ignite entries # if [[ $SW_SESSION_IS_DRD -ne 1 ]]; then for dir in $INST_DIR $VAR_DIR do setup_tftp -d $dir done # # # # # # Issue a message that the Ignite directories have been removed from tftp access, but that the tftp service itself is still enabled. This was changed for JAGad47307. echo "\ NOTE: tftp access to $INST_DIR and $VAR_DIR has been removed from /etc/inetd.conf. The tftp service is still enabled. To disable tftp service, run SAM.
PAGE 16
An additional step is needed to address the following scenario: A system administrator may use DRD to remove a product or fileset from the inactive system image and then use DRD to install (the same or a different version of) the product or fileset to the inactive system image. Both operations may be done without an intervening reboot. In the case described above, an install control script must remove the rc script and the S900 symlink that were deployed by the remove script.
PAGE 17
5 Making Control Script Invocations of swremove DRD-Safe This chapter describes how to safely invoke swremove in a control script. This assumes that swremove has been determined to be the best way to remove the desired files and update the IPD. Invoking swremove in a control script is often done in new software to obsolete old software. 5.1 How to Make Packages DRD-Safe for swremove If either of the following is true, the invocation of swremove in your control script is already DRDsafe: 1.
PAGE 18
Solution 3: The invocation of swremove can be moved to the configure script. Cautions: • This only works when there are no files in the swremoved software that are replaced by new software. If any of the files are overwritten by new software, new files would get removed during execution of the configure scripts. • If the product being removed has startup scripts, these also get executed on the reboot. Timing of the remove versus the startup is uncertain.
PAGE 19
6 DRD-Safe Packaging Changes 6.1 The is_drd_safe Attribute The is_drd_safe fileset attribute is introduced in HP-UX 11i v2. Attribute: fileset.is_drd_safe • Status: For HP-created HP-UX software—optional for HP-UX 11i v2, required for 11i v3 • Description: Indicates that the fileset can be managed (installed, removed, verified and unconfigured) in a runcmd environment without affecting the running system environment; defaults to false (except for HP-UX 11i v2 patches as explained in the table below).
PAGE 20
is_drd_safe Attribute Policy Release Package Policy Type 11i v2 Patches Attribute does not need to be set for 11i v2 patches. 11i v2 Products 11i v3 All packages (and later) Though all new HP-UX 11i v2 patches (that is, patches created after November 1, 2004) must be DRD-safe, they are not required to set the is_drd_safe attribute. All existing patches have been checked and all but a small subset have been verified to be safe. The small subset of unsafe patches will be handled internally.
PAGE 21
7 Making Special Installation Instructions DRD-Safe When installing patches during a DRD session, the user MUST not stop/kill or restart processes, and should only make kernel tunable changes using drd runcmd kctune.
PAGE 22
Appendix A A.1 HP-UX 11i v2 control_utils The table below describes the SD control_utils, whether they are DRD-safe or not, and any special information related to DRD that might be of interest to packagers.
PAGE 23
script changes for proper functioning during a drd runcmd execution. msg79 newconfig_cp newconfig_msgs newconfig_prep patch_newconfig_cp patch_newconfig_rollback patch_newconfig_rollcheck patch_newconfig_rollsave patch_newconfig_save query_systemfile Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes r_mkdir strip_off_fr Yes Yes mod_pathfile mod_systemfile msg ------------The kc* commands called by query_systemfile are aware of running during a drd runcmd execution --- A.
PAGE 24
efi_ls Yes grep ioscan Yes Varies kill Yes* lifcp Yes* lifls Yes* ln ls lvlnboot mkboot Yes Yes Yes Yes* mkdir mknod mount Yes Yes Yes mv nettlconf ps Yes Yes Yes* contains this command needs closer examination to determine if the other logic is DRD-safe. The efi_ls command itself is DRD-safe, however this command is often used in conjunction with other logic that is not DRD-safe.
PAGE 25
pwd rm rmdir sed swlist, swmodify & swverify swremove Yes Yes Yes Yes Yes Varies tail umount Yes Yes uname Varies this command often precedes logic that modifies the process table. Because modifications to the process table are usually not safe, the presence of ps in a control script is a good indicator that the script needs closer examination to determine if the surrounding logic is safe. -----It is safe to swremove software that has is_drd_safe attribute set.