GetApplyPatch(8)

NAME
GetApplyPatch - retreive and apply a vendor patch

SYNOPSIS
GetApplyPatch [ -b ][ -s site ][ -u user ][ -d dir ][ patchno .. ]

DESCRIPTION
Sun Microsystems supports an anonymous ftp site where recommended patches are found. It is a fundamental security principle that systems which have vendor patches installed will be more secure than those that do not. In the life of any released operating system there will be many patches.

GetApplyPatch is a simple tool to assist in patch management on Solaris systems. It will retrieve and install vendor patches under user control. Patches can be listed on the command line or on standard input -- that makes the tool suitable for a pipeline as in:

    [1:05pm wally] CheckPatches | GetApplyPatch

In "batch" mode (ie. when run from cron(8)) patches are applied blindly with no human intervention. In interactive mode you have several opportunities to consider the patch:

    [3:32pm xsv] CheckPatches | GetApplyPatch
    ***************** Recommended Patch *****************
    105403-03   SunOS 5.6: ypbind/ypserv patch
    Get/Examine? [y/n] y
    Fetching ftp://sunsolve.sun.com/pub/patches/105403-03.tar.Z ...
    Patch 105403-03 retrieved from sunsolve.sun.com; README says:
    Patch-ID# 105403-03
    Keywords: security ypbind ypbind.pid diskless clients lookup rpcbind
    Synopsis: SunOS 5.6: ypbind/ypserv patch
    Date: Apr/14/00
     ...etc.
    Apply 105403-03? [y/n] n
    Cleanup 105403-03? [y/n] y
     ..etc.

One should, of course, be very careful to read the README documentation that comes with each patch. Some patches advise that you bring the system into single user mode, others advise that you reboot the system after applying the patch. In interactive mode you have the opportunity to defer the patch if you so decide after reading the patch documentation.

If you need to back out of a patch that you have installed you will need use the vendor provided script:

    /var/sadm/patch/nnnnnn-mm/backoutpatch

Every vendor patch will have this procedure to restore the system to it's pre-patched state.

OPTIONS
Sites with a local mirror, or sites that must use an ftp proxy will require these options:

-b  forces "batch" mode. No questions are asked and patches are applied with minimal fuss. This is the same behaviour as when run from cron(8) or as an at(1) job.

-s site
    specifies an alternative ftp site -- the default is "sunsolve.sun.com". This is useful if you have a local mirror of sunsolve or if you need to connect through an ftp proxy.

-u user
    specifies an alternative login id for the anonymous ftp site -- the default is "ftp". This is useful if you have an ftp proxy you connect through -- eg. "anonymous@proxy" might be required to get through a proxy.

-d directory
    specifies the directory at the ftp site where you expect to find vendor patches -- the default is "/pub/patches". This is useful if you have a local mirror but a different directory structure.

EXAMPLES
GetApplyPatch is designed to be used interactively in a pipeline with CheckPatches as in:

    [1:05pm wally] CheckPatches | GetApplyPatch

You can also use it to selectively apply patches as in:

    [1:05pm wally] GetApplyPatch 105403-03 105552-03 108333-02

On many systems (certainly not backroom mission critical servers) you probably can get away with a cron job that applies all outstanding patches from a cron job.

BUGS/BEWARE
GetApplyPatch cannot get a patch if it isn't there. There have been times when the Solaris patch report refers to patches that cannot be found at their patch depot. The vendor has also transitioned from traditional compressed tar files to zip files. Most recently on Solaris 7.

GetApplyPatch can only retrieve patches available by anonymous ftp. Sometimes Sun will have other patches hidden away in other support areas with different access requirements.

GetApplyPatch assumes the vendor patches are found at a well known site in a well known location with well known file extensions. When that changes this tool will fail.

FILES
CheckPatches works in a directory /tmp/GetApplyPatch.nnnn.

When vendor patches are applied you'll discover directories with patch number names in /var/sadm/patch. As noted earler, that's where you'll find a back out procedure as may be required (seldom if ever) to restore things to a pre-patched state. You probably ought to purge the patch directory periodically.

Patches, when applied, update the package database at /var/sadm/install/contents.

SEE ALSO
CheckPatches(8), ftp(1), patchadd(1M), pkginfo(1M), and Sun Microsystems support site at http://sunsolve.Sun.COM.

AUTHOR
Reg Quinton, University of Waterloo, Information Systems and Technology. 1999/07/09 - 2001/01/19.