Postgres15 Security Update for VIOS 4.1.0.50

Content

Supported Environments

• This fix procedure is only supported on 4.1.0.50

• For systems running VIOS 3.1 or earlier levels of VIOS 4.1, it is recommended to upgrade to VIOS 4.1.1.30. Once the upgrade is complete, follow the steps below to update PostgreSQL to the latest supported version.

Note:

• These procedures require stopping the vio_daemon while the updates are done.  Queries from the HMC or other management consoles may fail during this time.

• When upgrading to later VIOS levels at a later point in time, including 4.1.1.x or 4.1.2.x, any installed ifixe(s) must be removed before starting the upgrade process. This is a prerequisite for the upgrade to continue. Once the system has been upgraded, follow the instructions below to update the PostgreSQL.

Fix Installation

• Download the fix files from the above provided link.
• (For VIOS SSP Only) Follow the steps below for each node in the cluster, one at a time.  Before starting, verify all nodes in the cluster are at ON_LEVEL:
  $ cluster –status –verbose | grep –e “Node Upgrade Status” 
      Node Upgrade Status:  4.1.1.20 ON_LEVEL 
      Node Upgrade Status:  4.1.1.20 ON_LEVEL 
• (For VIOS SSP Only) Stop cluster services on the node
  $ clstartstop -stop -n <cluster_name> -m <node_name> 
• Stop the vio_daemon 
  $ stopsrc -s vio_daemon 
  0513-044 The viod Subsystem was requested to stop. 
• Make sure the vio_daemon is in “inoperative” state, before applying the fileset. Wait for the process to be inoperative. 
  $ lssrc -s vio_daemon  
  Subsystem Group PID Status vio_daemon inoperative 

• Apply the new iFixs
  $ oem_setup_env
  $ emgr -e /path/to/vdb15_1of2.epkg.Z
  $ emgr -e /path/to/vdb15_2of2.epkg.Z
  $ exit

  NOTE: Please note that these iFixes contain around 668 files in total and installing them would take around 10-15 minutes for each iFix.

• The installation summary will show the latest fileset version as below 
  All package locks processed successfully.
  +---------------------------------------------------------------+
  Operation Summary
  +---------------------------------------------------------------+
  Log file is /var/adm/ras/emgr.log
  EPKG NUMBER      LABEL               OPERATION              RESULT
  ===========      ==============     ================= 
  1                vdb15_1of2          INSTALL                SUCCESS
  Return Status = SUCCESS
   

  All package locks processed successfully.
  +---------------------------------------------------------------+
  Operation Summary
  +---------------------------------------------------------------+
  Log file is /var/adm/ras/emgr.log
  EPKG NUMBER      LABEL               OPERATION              RESULT
  ===========      ==============     =================     
  1                vdb15_2of2          INSTALL                SUCCESS
  Return Status = SUCCESS

• Start the vio_daemon 
  $ startsrc -s vio_daemon -a "-d 4" 
• Repopulate the change management database  by signaling the vio_chgmgt daemon.
  $ oem_setup_env 
  > ps -ef | grep vio_chgmgt”
  > kill -1 <process_id of vio_chgmgt> 
• (For VIOS SSP Only) Start cluster services
  $ clstartstop -start -n <cluster_name> -m <node_name> 

Removal of Postgres 13

• Note: This update requires stopping the vio_daemon while the update is done.  As a result, queries from the HMC or other management consoles may fail during this time.

• (For VIOS SSP Only) Follow the steps below for each node in the cluster, one at a time.  Before starting, verify all nodes in the cluster are at ON_LEVEL:
  $ cluster –status –verbose | grep –e “Node Upgrade Status” 
      Node Upgrade Status:  4.1.1.20 ON_LEVEL 
      Node Upgrade Status:  4.1.1.20 ON_LEVEL 

• Verify the VIOS is running Postgres15 before attempting to remove Postgres13
  $ ps -ef | grep postgres15
   vpgadmin 11338218        1  0 16:14:31      -  0:00 /usr/ios/db/postgres15/bin/postgres -D /home/ios/CM/DB

• (For VIOS SSP Only) Stop cluster services on the node
  $ clstartstop -stop -n <cluster_name> -m <node_name>

• Stop the vio_daemon 
  $ stopsrc -s vio_daemon 
  0513-044 The viod Subsystem was requested to stop. 

• Make sure the vio_daemon is in “inoperative” state, before applying the fileset. Wait for the process to be inoperative. 
  $ lssrc -s vio_daemon 
  Subsystem Group PID Status vio_daemon inoperative 

• Remove the Postgres13 by calling the below script
  $ oem_setup_env
  # ./pg13_cleanup.sh
  SAVEDIR=/ios.database.bk/
  Clearing ODM entries ...
  Clearing access file entries ...
  Clearing inventory file entries ...
  Successfully updated the Kernel Authorization Table.
  Successfully updated the Kernel Role Table.
  Successfully updated the Kernel Command Table.
  Successfully updated the Kernel Device Table.
  Successfully updated the Kernel Object Domain Table.
  Successfully updated the Kernel Domains Table.
  Successfully updated the Kernel RBAC log level.
  $ exit

• Start the vio_daemon 
  $ startsrc -s vio_daemon -a "-d 4" 

• (For VIOS SSP Only) Start cluster services
  $ clstartstop -start -n <cluster_name> -m <node_name>