5.10 Kernel Patch 120011-14 breaks JASS enable-bart.fin script

A recent kernel patch, 120011-14, delivers a number of the updates that were also delivered in Solaris 10 8/07. If you are applying this patch (it is part of the latest recommended patch bundle) in a JASS/SST driven jumpstart installation of an earlier Solaris 10 release such as 11/06 then you will get an error like this when the enable-bart.fin script is run:

==============================================================================
secure.driver: Finish script: enable-bart.fin
==============================================================================

Enabling the function: Basic Auditing and Reporting Tool (BART)

[NOTE] Copying /a/var/opt/SUNWjass/BART/rules from /tmp/install_config/Files/var/opt/SUNWjass/BART/rules.
[NOTE] Setting path /a/var/opt/SUNWjass/BART/rules permissions to 444.
[NOTE] Setting path /a/var/opt/SUNWjass/BART/rules owner to 0.
[NOTE] Setting path /a/var/opt/SUNWjass/BART/rules group to 0.
Running bart create -r /a/var/opt/SUNWjass/BART/rules.
ld.so.1: bart: fatal: libmd.so.1: open failed: No such file or directory
DEBUG: matched ignored error message
[ERR ] BART create failed; return code 1. Manifest file
/a/var/opt/SUNWjass/BART/manifests/20071002094411.failed.txt.

[NOTE] Removing saved file, /a/var/opt/SUNWjass/BART/rules.JASS.20071002095649

The cause of the problem lies in how BART is executed in a mini-root environment. The BART executable does not exist in the Solaris 10 mini-root so JASS runs it from the system being installed i.e. /a/usr/bin/bart. The newly patched /a/usr/bin/bart is now linked against the new /lib/libmd.so.1 library delivered by this patch, which is also not present in the mini-root of older Solaris 10 releases (though it is in 8/07).

The fix is simple enough:

Index: Finish/enable-bart.fin
===================================================================
--- Finish/enable-bart.fin      (revision 666)
+++ Finish/enable-bart.fin      (working copy)
@@ -44,6 +44,8 @@
      # file is deleted after Solaris is first booted.
      #
      logMessage 'Running bart create -r ${JASS_ROOT_DIR}${RULES}.'
+      LD_LIBRARY_PATH=${JASS_ROOT_DIR}/lib
+      export LD_LIBRARY_PATH
      ${BART} create -R "${JASS_ROOT_DIR}" -r "${JASS_ROOT_DIR}${RULES}" \
         | egrep -v '^/var/|^/etc/rc2.d/S82mkdtab' \
         > "${CONTROL_MANIFEST_FILE}"

IPMP with IPv6 test addresses

Quite a while back Dave Miner discussed how IP Multipathing can be done on the cheap in Solaris 10 by not using IPv4 test addresses at all and relying on the physical link state or alternatively using IPv6 link local addresses as test addresses. My first attempts at configuring the latter failed and not getting any response to my comment in his blog, I left it for more pressing work.

Recently I got back to this and managed to get it working.

Firstly you need to have /etc/inet/hosts and/or /etc/inet/ipnodes set up correctly with your IP address and hostname. In this example our host is called myhost with two interfaces bge0 and bge1.

/etc/inet/hosts:
192.168.1.1 myhost

Then configure your interfaces.

/etc/hostname.bge0:
myhost group production failover up

/etc/hostname.bge1:
up

/etc/hostname6.bge0:
group production -failover up

/etc/hostname6.bge1:
group production -failover up

You need to reboot for these configuration changes to take effect or you can pass the contents of the /etc/hostname* files as arguments to ifconfig.

Update: You need to ensure that both the host and the switch are set to autonegotiate for this to work.

Update 2007.09.20: According to this Sun document you do not need to mark an IPv6 test address as deprecated to prevent applications from using the test address. I've updated the configurations above to reflect this.

Solaris 10 8/07 is available

Also known as Solaris 10 Update 4. The list of what's new is here. Some highlights are:

• Python updated to 2.4.4 with 64 bit support and it now lives in /usr/bin. The 8/07 what's new docs don't mention this but it is mentioned in the HW 7/07 what's new.
  
• Gnu Zebra replaced with the Quagga routing suite.
• IP Instances: LAN and VLAN Separation for Non-Global Zones
• DTrace can now be used in Non-Global zones.

A few things will need a little further investigation:

• Sun Service Tags
• Coherent Console

You can download it now from Sun.

iPhoto Keyword Utilities and iPhoto '08 incompatibility

A warning to iPhoto Keyword Utilities users: you will not be able to import/export keywords to your images if you upgrade to iPhoto '08. The main reason for this is that Keyword Assistant does not work with '08 and the author, Ken Ferry, has stated that he no longer plans to maintain it.

I am talking with Ken to see if he can provide me with source code to the portion of Keyword Assistant that my utilities use. In the mean time I'll be looking at other ways to achieve the same result without Ken's software.

Splunk 3.0 is out!

Splunk 3.0 is out the door! I've tested my Splunk SMF manifest and it continues to work with the new release.