Solaris 8 branded zone and privileges

Hello,
I've just installed a Solaris 8 Branded zone to migrate an old server. The migration worked like a charm, and everything seems ok excepted one thing. The zone must run a Lotus Domino server, so the process needs to bind ports 80, 443 and 389, but it can't.
I've found things about the limitpriv directive for the zone configuration, and the net_privaddr privilege to allow a process to bind ports under 1024.
So now, if I run the process in the non global zone as root, it can bind, but if it is launched as the user notes, it can't.
If I use the ppriv command to see what are the privileges of the process, I see :
1945:   /opt/lotus/notes/latest/sunspa/server
flags = <none>
        E: file_link_any,proc_exec,proc_fork,proc_info,proc_session
        I: file_link_any,proc_exec,proc_fork,proc_info,proc_session
        P: file_link_any,proc_exec,proc_fork,proc_info,proc_session
        L: contract_event,contract_observer,file_chown,file_chown_self,file_dac_execute,file_dac_read,file_dac_search,
        file_dac_write,file_link_any,file_owner,file_setid,ipc_dac_read,ipc_dac_write,ipc_owner,net_bindmlp,net_icmpaccess,
        net_mac_aware,net_privaddr,net_rawaccess,proc_audit,proc_chroot,proc_exec,proc_fork,proc_info,proc_lock_memory,
        proc_owner,proc_session,proc_setid,proc_taskid,sys_acct,sys_admin,sys_audit,sys_mount,sys_nfs,sys_resourceSo, the net_privaddr appears in the limit, but it is not enabled. How can I make it enabled for that process?
Thanks

Thanks for the link, good explanations about privileges but they seem unusable in Solaris 8 branded zone. It suggests to create a role with the privileges my process needs, using the "rolemod -K" command, but this option does not exist for the rolemod command in my Solaris 8 zone, it just supports "classic" RBAC.
Maybe the solution would be to create the good profile for the user running the process, but I'm a little bit lost with RBAC and I can't find an existing profile corresponding to what I want.
Actually, the limitpriv for my zone is "default,net_rawaccess,net_privaddr,file_dac_read" and that's all. I added net_privaddr and file_dac_read because I saw that a "ppriv -D" on the Lotus server complained about the lack of these privileges, but in fact they are already included in default privileges.

Similar Messages

[Solved] Arch Linux in a Solaris branded Zone

Hello,
After having read this article at the Genunix WiKi, I 'd very much like to install Arch Linux (http://204.152.191.100/wiki/index.php/I … anded_zone) in a Solaris branded Zone. However, the Arch Linux file to download is about two years old now, so I 'd like to roll one with a bit more recent kernel.
I just wonder what might be the procedure to do so.
a) Is it just unpacking the ISO inside the zone and let it enroll whilst booting?, or
b) is it advisable to install the old package and upgrade from there?
I am quite curious to learn how this works.
TIA, Algey
Last edited by algernonz (2011-11-28 18:42:31)

Hi,
it does indeed sound like an interesting little project. You should, however, revert to your procedure (a) and use one of the recent ISO images the Arch team has updated this year.
Using that old tar will give you numerous headaches when trying to upgrade. Doing a simple upgrade from that old file will most probably break the system, thats why they took the effort to provide the new ones.
Good luck.

Unclear on branded solaris 9 zones and ipfilter

I just managed to install my first solaris 9 zone on a solaris 10 system (v490). It has gone fairly well so far but I
am definitely "unclear on the concept" with respect to ipfilter and the zone. This is a shared ip zone.
On solaris 9 we use ipfilter 3.4.32.
I used a flar from one of these systems to install the zone. On boot, I see that our ipfboot file in /etc/rc2.d fails with
modload failures etc
You must be superuser to load a module
open device: No such file or directory
open device: No such file or directory
constructing minimal name resolution rules...
open device: No such file or directory
open device: No such file or directory
open device: No such file or directory
open device: No such file or directory
/etc/rc2.d/S65ipfboot: load of /etc/opt/ipf/ipf.conf into alternate set failed
Not switching config due to load error.
/dev/ipf: open: No such file or directory
This makes sense but as I said what do I do instead. I found this in the solaris container system admin manual
"Solaris IP Filter can be enabled in non-global zones by turning on loopback filtering as described in Chapter 26, Solaris IP Filter (Tasks), in System Administration Guide: IP Services. "
Yes, but that doesn't help me much since the IP Filter tasks simply tell me to do this in ipf.conf in the global zone.
set intercept_loopback true;
Isn't there more to it than this? A real example some place would be most helpful. And how can I make sure it is working?
Not a real ipf guru :-(

First thing to check is if your zone can access the global zone (try pinging). If this isn't the case you probably need to setup a routing entry allowing the non-global zone some access.
For example, say the global is 10.0.0.1 and the non-global 192.168.0.1 on eri0 you'd use something like:
route add 10.0.0.1 192.168.0.1 -iface
This tells your non-global zone that it can reach the global zone through the eri0 interface. Ofcourse you can also expand this to networks and such.
Another very important factor to keep in mind when dealing with internet is trying to access it from the non-global zone (as a test). Your ipnat.conf entry should be enough, my guess for to the reason for not routing the data is a non-static arp entry of your internet gateway. Now, this is a mere guess but if you have a default route in your routing table setup for Internet access (netstat -rn) make sure that the host to which the default route is pointing also has a static arp entry (man arp). If this is indeed the case you may also need to setup a routing entry as mentioned above to allow your zone access to this remote gateway.
After that things should work as usual. Hope this helps.

Solaris Branded Zones, Unable to reboot/Halt

Hi People,
Hoping someone can help. Im running Solaris 10 on a Sun Workstation Ultra 45. I have two disks. One disk has the default install of solaris 10 all updated to the latest patches.The second disk is mounted as /zones and holds each of the zones on ZFS. I have then downloaded and installed successfully Solaris 8 and Solaris 9 and Solaris 10 zones. So I have 3 zones.
The problem I am facing is I can boot up all 3 zones fine and they work great, however when I halt or reboot either Solaris 8 or solaris 9, they never come back up. I try and zlogin to them and telnet and ssh and they are totally unresponsive and quite literally dont boot. I have tried to pkill -9 -z zonename ; umount /zonesfilesystem; zpool clear and even rebooted the Global zone. Still will not come up. The only way they will boot after being shutdown is if i shutdown the global zones and turn the server off and back on.
Solaris 10 Zone boots up and down fine with no isses. I have tried this on both UFS and ZFS thinking it might be a file lock issue. Still unable to reboot or halt a zone and bring it back up.
Any help please :)
Thanks in advance.

When they are unable to come back up, what does 'zoneadm list -cv' say? If the state of the zone is "down" or "shutting_down", you can probably benefit from the fix for:
7038404 outstanding zone references should not cause zone_destroy(2) to hang
This is available in 147440-05 (sparc) / 147441-05 (x86) or later.

Solaris 11 - zones and repos

Hi,
We're customers with support and pointed our servers to access the SRU repo as per http://www.oracle.com/technetwork/articles/servers-storage-admin/o11-018-howto-update-s11-1572261.html
Now we want to get started with zones for which Oracle recommends having a local IPS repo. All the docs seem to point to the public release repo as source for this local IPS repo.
How does this work together then with the SRU? Syncing the SRU seems to result in HTTP 401 unauthorized errors.

The way zones work with IPS is that they will communicate through the global zone. This means that whatever IPS publishers have been configured in the global zone, they get exposed within each of the non-global zones though what we call a 'system proxy'. You can compare this by typing 'pkg publisher' in both the global zone and any non-global zones.
I'm not sure what problems you're experiencing, but if you have configured the support repository in the global zone, you should be able to provision (and install other software) within a non-global zone. Also, once one zone has been provisioned on the system, all the package data is cached in the global zone so that additional zone installs (rather than clones) are much faster.
We use the release repository in many examples simply because it also allows administrators to evaluate the OS even if they don't have a current support contract through Oracle, but the same will work for those who do have a support contract and wish to the use the Oracle Solaris support repository.
In terms of creating a local IPS repository, it depends on how your environment looks and how many systems you are needing to update. If this number is relatively low, you may consider just updating that system directly from the Oracle hosted repositories. However, if that number is large, you may be better off creating a local repository. This not only provides faster access for local clients, but also provides another level of change control - you can control how often you sync with the master Oracle repository. To synchronize the Oracle SRU repository, don't forget that you will need to use the key and cert options to pkgrecv to ensure that you have the appropriate credentials to access that repository.
Good luck!

Jumbo Frames within Solaris 10 zones and multiple interfaces...

We have Jumbo Frames working in the Global Zone, and have the MaxFrameSize=3,3,3 etc...
We also have our AGGR's built correctly and defined aggr1:1 and aggr1:2
the problem is on boot-up, if all the name files (hostname.aggr1 and hostname.aggr1:1) are defined in the /etc directory, then you can't start the zones....?
and if you place the files in the /export/zones/<machinename>/root/etc/ directory, than the interfaces do not start-up automatically..... ?
So If I want all the interfaces in the global zone to be seen by the other zones, and for the interfaces to come live when the zones are booted.... where do the hostname.interface files live....???

Darren:
I understand where you're coming from from a technical perspective. But there is a way you could work around it.
For argument's sake, zones a+b with e1000g0 - e1000g3
From an implementation perspective, what's to stop you from:
e1000g0 / e1000g1 shared between all
e1000g2 plumbed at global, only assigned to zone a.
e1000g3 plumbed at global, only assigned to zone b.
You can certainly have an empty interface file (i.e. cp /dev/null /etc/hostname.e1000g2 ; cp /dev/null /etc/hostname.e1000g3). The interface will plumb but have no IP information configured.
This doesn't give truly exclusive interfaces to either zone, but it operates effectively as though it were.
Warning: I haven't actually tested this, but I see no reason that it wouldn't work.

Solaris 10 Zones and networking..

My machine has only one NIC card (rtls0) and also only one public ipv4 IP. I am at the moment unable to get more than one public IP. I've also created a few zones on the machine which I have assigned an internal IP. Now, I can connect (say SSH for example) internally to these zones just fine using their internal IP from the global zone. However, obviously the outside world would not be able to do so. So I decided to simply use the built in firewall/nat tech in Solaris in order to port forward certain ports to internal zones. (Like say set up port 2223 on the global level to forward ssh to one of my created zones' ssh) I looked up and down everywhere with the ipf and ipv4 port forwarding down to enabling it via routeadm and also setting the value of /dev/tcp ip_forwarding to 1. Then when I add the following rule to ipnat:
rdr rtls0 PUBLIC_IP/32 port 2223 -> 192.168.1.2 port 22 tcp
It still has zero effect on the forwarding. It fails to forward, and nothing I've done works. I'm on my last leg here with this issue. Am I doing something wrong with ipfilter or is there a better way to go about doing this with Solaris Zones? (I mean surely there must be an easier way to create self contained zones with applications that still run services without having to resort to assigning it its own IP, no?) Any help is appreciated, thanks.

First thing to check is if your zone can access the global zone (try pinging). If this isn't the case you probably need to setup a routing entry allowing the non-global zone some access.
For example, say the global is 10.0.0.1 and the non-global 192.168.0.1 on eri0 you'd use something like:
route add 10.0.0.1 192.168.0.1 -iface
This tells your non-global zone that it can reach the global zone through the eri0 interface. Ofcourse you can also expand this to networks and such.
Another very important factor to keep in mind when dealing with internet is trying to access it from the non-global zone (as a test). Your ipnat.conf entry should be enough, my guess for to the reason for not routing the data is a non-static arp entry of your internet gateway. Now, this is a mere guess but if you have a default route in your routing table setup for Internet access (netstat -rn) make sure that the host to which the default route is pointing also has a static arp entry (man arp). If this is indeed the case you may also need to setup a routing entry as mentioned above to allow your zone access to this remote gateway.
After that things should work as usual. Hope this helps.

How do I get from Branded Zones to "real" Solaris 10 Zones?

My head is beginning to spin! I am beginning to think I have been led down a blind alley.
We have vast numbers of old Solaris 8 systems that we want to consolidate on new hardware in Solaris 10 Zones. We have been bombarded with advice that the way to go is to move it first to Branded Zones, as a stepping stone, and then migrate/upgrade it from there to Solaris 10. So we have started on our journey.
We now have our first bunch of Solaris 8 containers happily installed and running. And yes, it was relatively easy and painless, and the tool support was good. But now what? What are the steps and tools that will make the second step, from Solaris 8 to Solaris 10?
Everything out there hints that it is supposed to be easy. But every time I try and spec out the steps for our teams to follow I come unstuck. Does Live Upgrade feature in this anywhere? (And if so, at what point does my zone lose its Brand identity?) Is there some way to use archives? (And if so, how do I only include the bits I need to move?) Is there something magic under the covers of the Zone administration commands? (And if so, what pulls in my Solaris 8 stuff?) Is there at least some tool somewhere that will capture the configuration I need and build me a new one?
If the answer is that I just define the new Zone by hand and re-install all my applications from scratch, then can somebody explain just what I have achieved so far, and in what way it can be construed as a "stepping stone"?

Correct. But we have now invested in the time taken to learn about Branded Zones, do the migrations, teach the support teams how to manage them... Plus we are paying the subscription for the Branded Zone software. And we still have pure Solaris 8 applications staring end-of-support in the face. We could have made the same investment to re-install the applications in a real Solaris 10 Zone and make them work "properly". All the publicity tells me I've made my migration to Solaris 10 much easier, but I still can't see how I'm any nearer my end point.Here's where your losing it. There is no real distinction between what you call a normal Solaris 10 zone and a Solaris Branded 8 zone. They could have called it something else and you would still insist that somehow one is normal and one is not. There are a variety of Branded Zones. There's a Solaris 8, Solaris 9, and Linux Branded Zones. They differ from what you call "normal" zones in that you basically are adding an OS to the Base OS and are not just copying files from the Base OS. That's the only difference. In all other respects they are the same. The only differentiators is for a Branded Zone you are adding the files from some other OS, even if it's just an earlier version of Solaris.
How do you migrate from a Solaris 8 zone to a Solaris 10 zone. The same way that you moved from the Solaris 8 physical box to the Solaris 8 branded zone. The steps should be the same. Implicite_Order pretty much said the same thing.
You seem to have a hang up on the words "normal zone." Yea I know, you've spent time and money and educated everyone and now your looking for the payoff. As I already stated and has been echoed by I_O, contact the vendor to see if they have Solaris 10 support, if they do, create a zone on a dev box, do some testing, and then create the zone on the real box, do the install, migrate the data. Just as you already did from the Solaris 8 box. If they don't have a Solaris 10 specific version you can still setup a test box, create a "normal" zone, install the app and some test data, make sure it works, and then create the "normal" zone, install the app, migrate the data, and relax.
alan

Is it possible to patch Global Zone and only specific Non-Global Zones?

Hi Champs,
Is it possible to patch Global Zone and only specific Non-Global Zones? Idea is to patch DEV-zones only on the system & test applications and then patch only the STG-zones on same server!
Not sure if it is possible but just throwing a question...
Cheers,
Nitin

M10vir wrote:
Yes, if you have branded (non-sparse) zone!Branded zones and sparse zones don't have the relation that you imply. In Solaris 10, native zones can be sparse or whole-root (non-sparse, as you say). Zones that are not native zones are branded zones. Branded zones on Solaris 10 include Solaris Legacy Containers, previously known as Solaris 8 Containers and Solaris 9 Containers. That add-on product allows you to run Solaris 8 and Solaris 9 application environments under a thin layer of virtualization provided by the brands framework. solaris8 and solaris9 branded zones can be patched independently of each other and of the global zone.
Solaris 11 has no "native zones" - all zones use the brands framework. The "solaris" brand does no emulation and in that respect is very similar to native zones on Solaris 10. Solaris 11 also provides Solaris 10 Zones via the solaris10 brand. This allows zones or the global zone from a Solaris 10 system to be transferred to a Solaris 11 system and run as solaris10 zones. When running on Solaris 11, solaris10 zones can each be patched independently from each other and the Solaris 11 global zone. Technically, Solaris 11 doesn't have patches - it just has newer versions of packages to which the system is updated.

Trouble w/installing Solaris 10 branded zone on solaris 11.

Having issues creating a policy that works installing solaris 10 u10 branded nfs zone on sol11 in opscenter 12c u1. Maybe i'm just overlooking something basic or it isn't supported in opscenter. I'm able to create the policy but seem to get a very non-informative error message when deploying it.
Error Message:
"The DeploymentPlan execution job failed because the DeploymentProvider ZoneDeploymentProvider for Step Create Solaris Zones failed to generate tasks for the job: Cannot prepare zone tasks: java.lang.NullPointerException. Contact My Oracle Support if the problem persists. (10445)"
Here is the OpsCenter Profile:
Name Prefix:      hous
Starting Number:      1
Zone Description:      solaris 10 update 10
ZoneType:
Branded Zone
Branded Zone Image:
s10-update10-flar
Automatic Recovery:
Yes
Priority of Recovery:      0
CPU Shares:      1
CPU Cap:      0
Physical Memory Cap:      0
Locked Memory Cap:      0
Virtual Memory Cap:      0
Language:      en_US.ISO8859-15
Time Zone:      US/Central
Terminal Type:      xterm
NFSv4 Domain Name:      dynamic
Automatically boot zone when the global zone is booted:
Yes
Automatically boot zone after creation:
Yes
Storage for the metadata Library:      NAS, zone-prod1

Problem found. To jumpstart last two HP Blades we used the copies of AI templates. When we did it from scratch and re-installed the Solaris 11.0 we have no more errors.

Solaris 10-Branded Zone

Hi,
I am trying to establish whether the following configuration is officially supported (and documented):
"Non-Global zone running a release of Solaris 10 which is older than the release of Solaris 10 running in the Global Zone".
I'm familiar with the idea of Branded Zones to support Solaris 8, 9 & some Linux kernels, and have seen some forum posts where people have created Solaris 10-branded zones, but haven't really seen anything that puts the official seal of approval on that configuration. Also I'm familiar with LDOMs and appreciate that I could get to where I want to be that way too.
Any help welcome.
Thanks,
Paul.

This will be supported in Solaris 10 Upate 9 to a degree, using p2v. Below is a reply I had to a request I'd put in. You might also want to read this
http://blogs.sun.com/jerrysblog/entry/zones_p2v
Hi Sean,
I got information that p2v project is being backported for S10u9
This means, that you will be able to install a native zone from a flar.
I don't have detailed information at the moment, how this will work in terms of
patching in combination with Global Zone and other sibling NGZ's.
+According to Jerry Jelinek, Solaris10-branded zones will not being backported to Solaris 10,+
Got this info yesterday evening from Jerry.
I'll provide some more info about the p2v project for native zones in coming Solaris 10_U9,
once I got more details.
So, I'd suggest to check, whether the mentioned p2v project with flar on native zones might fit your requirements.
Thanks,
Alfred
Edited by: ftoomsh on Sep 2, 2010 3:02 AM

Add zfs volume to Solaris 8 branded zone

Hi,
I need to add a zfs volume to a Solaris 8 branded zone.
Basically ive created the zvol and added the following to the zone configuration.
# zonecfg -z test
zonecfg:test> add device
zonecfg:test:device> set match=/dev/zvol/dsk/sol8/vol
zonecfg:test:device> end
When I boot the zone it comes up ok but I am unable to see the device, nothing in format, /dev/dsk etc etc
Ive also tried to setmatch to the raw device as well to no avail.
Basically I have numerous zvols to add and dont really want a load of mount points from the global zone then lofs back to the local zone
Any ideas please??
Thanks...

Thanks but that's why I created zfs volumes and newfs'ed them to create UFS and presented those to the zone.
In the end I just create a script in /etc/rc2.d and mounted the filesystems in there.

Creating a Solaris 8 branded zone

I am in the process of configuring a Solaris 8 branded zone using the SUNWsolaris8 package and the instructions in the Solaris8 Container Guide. Solaris 10 08/07 is installed in the global zone. I have the following kernel patches installed as required: 127111-08 and 128548-08. I get the following error after configuring the zone when I try to verify the zone:
-bash-3.00# zonecfg -z gfxc-qazone
gfxc-qazone: No such zone configured
Use 'create' to begin configuring a new zone.
zonecfg:gfxc-qazone> create -t SUNWsolaris8
zonecfg:gfxc-qazone> set autoboot=true
zonecfg:gfxc-qazone> set zonepath=/export/zones/gfxc-qazone
zonecfg:gfxc-qazone> add attr
zonecfg:gfxc-qazone:attr> set name=machine
zonecfg:gfxc-qazone:attr> set type=string
zonecfg:gfxc-qazone:attr> set value=sun4u
zonecfg:gfxc-qazone:attr> end
zonecfg:gfxc-qazone> verify
gfxc-qazone: unknown brand.
gfxc-qazone: Invalid document
I cannot find any other information anywhere on this error. I am hoping those that have successfully installed a Solaris 8 branded zone can help me out. Thanks.

I have installed the SUNWs8brand packages before I started the configuration and I also installed the patch. I am not sure what you mean if the package installed in the correct order. I cannot find what I am missing. The original installation for the global zone was using the SUNCreq with other packages added during the installation. I realized after the O/S installation that I needed the zone packages as well as the live upgrade packages. After installing those packages I installed the SUNWs8brand packages. Let me know if there is something else that I am missing. I am thinking of re-installing the O/S with the End User software group.

Build Solaris 8 branded zone with ufs /var etc

We have an ancient application which runs on Solaris 8 which we would like to move to a Branded zone. The issue we have is that the application does a fstyp (but within the binary) on any file system that its is writing to and barfs if it doesn't recognise the type. Unfortunately we are limited to basically ufs and vxfs.
The problem is that I need to have /var configured as a UFS filesystem during the zone build ......
Now I know all of the methods that can be used to mount a filesystem within a branded zone:
1) Add FS within zonecfg ... fstype doesn't return UFS
2) LOFS : Doesn't return UFS
3) Mounting a file system after zone boot .... Great for non-system filesystems but not for /var
4) "add device" ... might work BUT I need to build /var during zone configuration .,.....
Any ideas?
Edited by: user13012897 on Dec 8, 2010 5:41 AM

It's not straightforward, but I'd consider writing an interposer library that gets loaded via LD_PRELOAD and gives a different answer than fstyp() would normally give.
http://www.itworld.com/UIR000929interposers

Solaris 8 branded zone not booting after server reboot hangs at ready state

Hi,
For ipchange/hostname change we rebooted the physical server...once rebooting the Solaris brand 8 zone stucks at ready state.
I have run the truss with zoneadm in the log process sleep and wait
Will post the log soon..any help to troubleshoot the issue
Both global zone and Ng zone having same hostid..
dmesg::
Apr 30 13:08:50 xyz zoneadmd[992]: [ID 702911 daemon.error] [zone 'abc'] WARNING: console /devices//pseudo/zconsnex@1/zcons@0 found, but it could not be removed.: I/O error
bash-3.00# ps -ef|grep -i abc
root 1441 1429 0 13:10:56 ? 0:00 /bin/ksh -p /usr/lib/brand/solaris8/s8_boot abc /abc
root 1429 1 0 13:10:55 ? 0:00 zoneadmd -z abc
root 1427 1397 0 13:10:54 pts/3 0:00 zoneadm -z abc boot -f -s
root 1542 1441 0 13:10:56 ? 0:00 /bin/ksh -p /usr/lib/brand/solaris8/s8_boot abc /abc
zoneadm list -cv
2 abc ready /abc solaris8 shared
Thanks
Edited by: muvvas on Apr 30, 2012 2:25 PM

moved the solaris 8 branded zone to other server.their its working fine.sorry for late reply.

Solaris 8 branded zone and privileges

Similar Messages

Maybe you are looking for