Give a role some more privileges in Solaris 11.

in the process of building a deployment mechanism, I need a role to make some changes to some files in the a normal user's directory.  I am running into permission issues, understandably.

I can't move or rename the file, that seems to "unlink"(remove) the orginal file.

rm ice.list  -> no good

ppriv -eD rm 

rm[12820]: missing privilege "file_dac_write" (euid = 1002, syscall = 76) for "/export/home/d_usr/ice.list" needed at zfs_delete_final_check+0x40

rm: ice.list not removed: Permission denied

syscall is 76, which is unlinkat

grep 76 /etc/name_to_sysnum

truss -t unlinkat rm ice.list

york_qa_02-ice $ truss -t unlinkat rm ice.list

unlink("ice.list")                              Err#13 EACCES [file_dac_write]

rm: ice.list not removed: Permission denied

york_qa_02-ice $

add this privilege to the user

as root: usermod -K defaultpriv=basic,file_dac_write ice

now I am able to remove files that not owned by "ice"

here are more details on what "ice" role's privilege is like

york_qa_02-ice $ ppriv $$

21189:  -sh

flags = <none>

        E: basic,file_dac_write

        I: basic,file_dac_write

        P: basic,file_dac_write

        L: all

york_qa_02-ice $ ppriv -vl file_dac_write

file_dac_write

        Allows a process to write a file or directory whose permission

        bits or ACL do not allow the process write permission.

        In order to write files owned by uid 0 in the absence of an

        effective uid of 0 ALL privileges are required.

how to expand LUN and replace a smaller LUN with it?

there is an article on how to mirror the rpool, that is how I am going to replace this smaller LUN.  I sized all my rpool way to small(64G), a lot of growing pain, or fun, depending on how you look at it.

here is that article.

I wanted to use another 64G LUN on a testing server to try out the procedure, but 64G is bit too small, so I needed to grow it, so I need to expand the LUN.

To grow the LUN is easy in the SAN, but back in the OS, the "format" recognized the change in that LUN, and told me to use "expand" under partition to grow it, so I followed those instruction, only it didn't work for me, I can't label it.

I went through this before.  I need to erase the label and make the new size come to light.

format -e, I tried to relabel the disk from SMI to EFI, then from EFI to SMI, that worked for me before, but not this time, for some reason.

so I got out of format and did a "zpool create test new_disk", zpool create will make a EFI labeled disks automatically, I read it somewhere and used it often to make sure disks are good.

after that I destroyed the test zpool, then went back to format -e, and label it SMI, and it worked this time.

then I added the disk to the testing server, ldm add-vdisk

I forgot to expand the LUN in the test server, I just followed the link above and resilvered the new disk, then detached the disk.  that's when I realized that the zpool still has the old size.

zpool set autoexpand = on rpool

which expanded the disk to the new size.

Clone RPOOL in LDOM.

the disks are LUNS from zfssa, 7420, this is on a T5-4 server.

if every boot disk is carved out of the pool under primary domain, that's different and there are a few articles on google about it.  All the disks are from SAN and only thing the primary domain does it to make a mpgroup with other service domain.

Goal: clone a rpool from one guest domain and use it on a different domain.

I never felt comfortable about the post below, it just wasn't clean and didn't work all the time, not the feeling I can bank on when it come to clone LUNs.
after giving it more thoughts, I thought of the appliance itself, the 7420, it is very capable and can be snapshot/clone on its own, like how I would snapshot/clone for the local disks, I just need to take a step back and do the same thing in the appliance.

1. click the "Edit" button of the LUN I want to clone in the appliance, to the snapshot tab and make a snapshot
2. after the snapshot is made, it will give an option to clone that snapshot, which will generate another LUN with the same size of the original LUN.
3. so now I have this cloned LUN, then I create another new LUN for data, and present both of them to one of the T5 servers.
4. on T5, create a domain
5. make mpgroup for both disks(LUNs) for the primary domain and the service domain.
5. also add the image disk to this domain
6. make vnets to this domain
7. bind the domain, set the auto-boot?=false
    ldm set-variable auto-boot?=false domain_name
8. start the domain, and go to ok promopt
9. boot off the image disk
10. go to shell
11. we need to address the issue that devices for this domain is not matching what the rpool(cloned) has. without those steps 9-12, we will run into this error(Doc ID 1587707.1)
     so we do a zpool import and see what disk is the rpool on
12. zdb -l the disk_path, e.g zdb -l /dev/rdsk/c0d2s0 (from step 11), what you see is that the string after "path:" is not the disk you see from step 11. that's the issue.
13. zpool import -f rpool, force import the rpool to address this issue, then try step 12 again, this time, the path has the right disk.
14. remote /etc/zfs/zpool/cache!
15. quit and stop the domain, and start the domain
16. now we are at the prompt with a few warnings, error, etc, first thing I do, ipadm delete-addr xxxx, make sure the IP is wiped clean, 
17. re-establish the network stack
18. remove the old entries in /etc/host
19. reboot
20. make sure svcs -xv is clean

----- 11/2013 ----
1. make a snapshot on the source domain.
    zfs snapshot rpool@rpool.snap1

2. send the snapshot to a NFS share, gzip it (or not).
    zfs send -Rv rpool@rpool.snap1 |gzip > /nfs_mnt/rpool.snap1    

3. create a new LUN, let's call it domain_x

4. present this LUN to the target server, this is our cxtxdx disk.

5.the rpool2 and existing rpool both have a BE called "solaris", we need to take care of that.

   beadm list, now there should be just one "solaris"

   beadm create solaris@s_snap1

   beadm create -e solaris@s_snap1 solaris_orig

   beadm activate solaris_orig

   reboot

   beadm rename solaris solaris_bk

6. make sure it has right label:
    # format -L vtoc -d cxtxdx

7. create another rpool, rpool2.  the system is running, there is already a rpool, this is the rpool I want to replace.
  # zfs create rpool2 cxtxdx

8. if the snapshot is not gzipped, then
   zfs receive -Fv rpool2 < snapshot_here
  if it is gziped, then
   gzcat snapshot_here.gz |zfs receive -Fv rpool2

9. set bootfs
    zfs set bootfs=rpool2/ROOT/solaris rpool2 

10. recreate dump/swap space if needed
    zfs create -V 4g rpool2/dump
    zfs create -V 4g rpool2/swap

11. beadm, shows one BE called "solaris".

12. mount "solaris", beadm mount solaris /mnt

13. install boot block
    installboot -F zfs /tmp/mnt/usr/platform/`uname -i`/lib/fs/zfs/bootblk /dev/rdsk/cxtxdx

14. beadm unmount solaris

15. reboot

16. what I see after reboot, is that I have two BE "solaris" and "solaris_bk" have "R" flag under beadm list.  most importantly, it is still boot to the old rpool, I guess I might be need to modify the boot disk through eeprom, but I thought bootfs would take care that, no?

17. ldm stop target_domain

18. remove the original rpool disk

19. boot again, from ok prompt, choose the right boot device.

20. first reboot gives me a lot of warnings, but they all went away after 2nd reboot.



reference:
http://docs.oracle.com/cd/E23824_01/html/821-1448/recover-4.html#scrolltoc