I'm happy to sponsor the following case for Dave Powell. This case
moves core file configuration from a private configuration file to
the SMF repository. The changes are proposed for a minor release.
-dp
------ ------ ------ ------ ------ ------ ------ ------ ------ ------
coreadm Configuration Refinements
David Powell <David.Powell at sun.com>
8/26/2008
Summary:
We propose moving coreadm's configuration from the private
configuration file /etc/coreadm.conf to the Service Configuration
Facility repository. This will require three user-visible
modifications to the coreadm command:
1. Use of the coreadm command to change system settings will
require the solaris.smf.manage.coreadm and
solaris.smf.value.coreadm authorizations instead of the
sys_admin privilege. These authorizations will be provided to
coreadm by the "Maintenance and Repair" execution profile.
2. Use of the -u option (loads kernel settings from the
configuration file) will no longer be committed, and may be
removed in a future release.
3. The existence and function of the /etc/coreadm.conf
configuration file will no longer be committed.
Additionally, we propose delivering a /var/cores directory so
administrators and layered software have a known available location
for storing core files.
These changes are proposed for delivery into a minor release.
Justification:
Storing coreadm's configuration in the SCF repository:
simplifies access to its configuration,
lets coreadm take advantage of future projects that enhance SCF
configuration management, and
permits finer-grained assignment of coreadm administration
responsibilities.
Additional information on 'coreadm -u':
A web search showed that there is widespread misunderstanding of
'coreadm -u' outside of Sun. 'coreadm -u' is used at boot to take
the contents of the coreadm.conf file and apply them to the
kernel. Most, if not all, non-Sun references found said either:
- It is needed to apply changes to the kernel after changing
configuration using other coreadm invocations.
This is incorrect: changes made using other coreadm invocations
are applied the kernel immediately. coreadm -u is no-op in this
case.
- It is needed to store changes made to the kernel so that they are
applied on next-boot.
This is also incorrect: changes made using other coreadm
invocations are stored persistently. coreadm -u is also a no-op
in this case.
For compatibility and to support upgrade, coreadm -u's behavior
will continue to read in coreadm.conf, if it exists, and apply the
configuration to the kernel. On upgrade coreadm.conf will be moved
aside, so the no-op behavior unknowingly assumed in the above cases
will also be preserved.
Additional information on authorizations and privileges:
coreadm documentation currently states that users with the
sys_admin privilege are able to use it to change system core file
settings. This doesn't completely work today. Users with only
that additional privilege are unable to make modifications to the
/etc/coreadm.conf configuration file, so coreadm invocations only
partially succeed.
The new authorizations are sufficient for performing all
operations. The aforementioned execution profile correctly
encapsulates these authorizations.
Documentation changes:
--- filesystem.5 Tue Aug 19 16:00:09 2008
+++ filesystem.5.new Tue Aug 19 16:14:21 2008
@@ -788,6 +788,11 @@
Basic Security Module (BSM) audit files.
+ /var/cores
+
+ Default depository for core files.
+
+
/var/crash
Default depository for kernel crash dumps.
--- coreadm.1m Tue Aug 19 16:00:06 2008
+++ coreadm.1m.new Tue Aug 19 16:14:11 2008
@@ -15,22 +15,19 @@
coreadm [-p pattern] [-P content] [pid]...
- coreadm -u
-
-
DESCRIPTION
coreadm specifies the name and location of core files produced by
abnormally-terminating processes. See core(4).
- Only users who have the sys_admin privilege can execute the first
- form of the SYNOPSIS. This form configures system-wide core file
- options, including a global core file name pattern and a core
- file name pattern for the init(1M) process. All settings are
- saved in coreadm's configuration file /etc/coreadm.conf to set at
- boot. See init(1M).
+ Only users and roles that belong to the "Maintenance and Repair"
+ RBAC profile can execute the first form of the SYNOPSIS. This form
+ configures system-wide core file options, including a global core
+ file name pattern and a core file name pattern for the init(1M)
+ process. All settings are saved persistently and will be applied
+ at boot.
Nonprivileged users can execute the second form of the SYNOPSIS.
@@ -39,13 +36,6 @@
file.
- Only users who have the sys_admin privilege can execute the third
- form of the SYNOPSIS. This form updates all system-wide core file
- options, based on the contents of /etc/coreadm.conf. Normally,
- this option is used on reboot when starting
- svc:/system/coreadm:default.
-
-
A core file name pattern is a normal file system path name with
embedded variables, specified with a leading % character. The
variables are expanded from values that are effective when a core
@@ -220,8 +210,9 @@
-e option for descriptions of possible options.
Multiple -e and -d options can be specified on
- the command line. Only users with the sys_admin
- privilege can use this option.
+ the command line. Only users and roles belonging
+ to the "Maintenance and Repair" RBAC profile can
+ use this option.
-e option... Enable the specified core file option. Specify
@@ -248,9 +239,10 @@
per-process core pattern.
Multiple -e and -d options can be
- specified on the command line.
- Only users with the sys_admin
- privilege can use this option.
+ specified on the command line.
+ Only users and roles belonging to
+ the "Maintenance and Repair" RBAC
+ profile can use this option.
@@ -259,8 +251,8 @@
any of the special % variables that are described
in the DESCRIPTION.
- Only users with the sys_admin privilege can use
- this option.
+ Only users and roles belonging to the "Maintenance
+ and Repair" RBAC profile can use this option.
-G content Set the global core file content to content. You
@@ -267,8 +259,8 @@
must specify content by using the tokens that are
described in the DESCRIPTION.
- Only users with the sys_admin privilege can use
- this option.
+ Only users and roles belonging to the "Maintenance
+ and Repair" RBAC profile can use this option.
-i pattern Set the default per-process core file name to
@@ -280,8 +272,8 @@
(using the -p option) are unaffected. This
default persists across reboot.
- Only users with the sys_admin or proc_owner
- privilege can use this option.
+ Only users and roles belonging to the "Maintenance
+ and Repair" RBAC profile can use this option.
-I content Set the default per-process core file content to
@@ -293,8 +285,8 @@
(using the -P option) are unaffected. This
default persists across reboot.
- Only users with the sys_admin or proc_owner
- privileges can use this option.
+ Only users and roles belonging to the "Maintenance
+ and Repair" RBAC profile can use this option.
-p pattern Set the per-process core file name pattern to
@@ -339,20 +331,8 @@
coreadm).
- -u Update system-wide core file options from the
- contents of the configuration file
- /etc/coreadm.conf. If the configuration file is
- missing or contains invalid values, default
- values are substituted. Following the update, the
- configuration file is resynchronized with the
- system core file configuration.
- Only users with the sys_admin privilege can use
- this option.
-
-
-
OPERANDS
The following operands are supported:
@@ -411,11 +391,13 @@
FILES
- /etc/coreadm.conf
+ /var/cores
+ Directory provided for global core file storage.
+
EXIT STATUS
The following exit values are returned:
@@ -447,7 +429,8 @@
SEE ALSO
gcore(1), svcs(1), init(1M), svcadm(1M), exec(2), fork(2),
- setuid(2), time(2), syslog(3C), core(4), attributes(5), smf(5)
+ setuid(2), time(2), syslog(3C), core(4), attributes(5), smf(5),
+ prof_attr(4), user_attr(4), pfexec(1)
------ ------ ------ ------ ------ ------ ------ ------ ------ ------
--
Daniel Price - Solaris Kernel Engineering - dp at eng.sun.com - blogs.sun.com/dp
