Solaris 9 System Administrator Exam phần 6 potx

Special Disk Operations 251 When the operating system crashes, the crash dump is written to an area of a hard disk identified as the dump device. The crash dump is written in a com- pressed manner to save disk space. The dump device is a raw device (not a file system) and is typically not accessible by system users. Once the crash dump is finished, the system is rebooted. As part of the system boot, the savecore(1M) command is executed. If a crash dump exists in the dump device, the savecore command copies it to an iden- tified user-accessible area of the system so that it can be examined. The crash dump is written as a pair of files with the names unix.X and vmcore.X, where X is a dump sequence number. If a minimum free threshold is specified, the savecore command will estimate the amount of free space that will be avail- able in the savecore directory after saving the crash dump. If the amount of free space will be below the threshold, the crash dump is not saved. The user-accessible area along with other crash dump-related information is configured by the dumpadm(1M) command. This information is stored in the /etc/dumpadm.conf file. The dumpadm Command The dumpadm command (in /usr/sbin) is used to configure the system crash dump operation. By default, the dump device is the swap partition and the savecore directory is /var/crash/system where system is the hostname of the system. The dumpadm command without command-line arguments dis- plays the current crash dump configuration. The dumpadm command-line arguments are described in Table 11.4. The following code shows the dumpadm command, which lists the current crash dump configuration. # dumpadm Dump content: kernel pages Dump device: /dev/dsk/c0t3d0s1 (swap) Savecore directory: /var/crash/solaris9 Savecore enabled: yes # Table 11.4 dumpadm Command-Line Arguments Argument Purpose -c type Sets the type of memory pages to save: kernel for kernel memory pages only, curproc for kernel memory pages and the memory pages of the current process, or all for all memory pages. -d dump-device Sets the dump device to the specified block device (/dev/dsk/c#t#d#s) or swap using the swap keyword. (continued) 11 8699 ch11 11/19/02 10:06 AM Page 251 Chapter 11 252 Table 11.4 dumpadm Command-Line Arguments (continued) Argument Purpose -m threshold Sets the minimum amount of free space that must be available in the savecore directory after a crash dump is saved. The threshold is specified as a number followed by k (Kbytes), m (Mbytes), or % (percentage). This specified threshold is stored in the minfree file in the savecore directory. -n Disables the savecore procedure. That is, does not save the crash dump. -r root Specifies an alternative root for the savecore directory. If not specified, the system root (/) is assumed. -i savecore-directory Sets the savecore directory to savecore-directory. -u Updates the configuration based on the /etc/dumpadm.conf file. -y Enables the savecore procedure. Note that if swap is being used as the dump device, the crash dump must be saved during system reboot (by enabling the savecore procedure) or immediately after the system boots. Otherwise, the crash dump will be overwritten when swap is used. The following example shows the dumpadm command changing the dump device: # dumpadm -d /dev/dsk/c0t3d0s7 Dump content: kernel pages Dump device: /dev/dsk/c0t3d0s7 (dedicated) Savecore directory: /var/crash/solaris9 Savecore enabled: yes The savecore Command The savecore command (if enabled) runs during system boot to copy a crash dump from the dump device to the savecore directory. It is executed by the /etc/init.d/savecore script. The crash dump is written as a pair of files with the names unix.X and vmcore.X, where X is the next number in sequence based on the other crash dump files in the savecore directory. The savecore command examines the minfree file in the savecore directo- ry (if present) and will not save the crash dump if doing so will cause the amount of savecore directory free space to drop below the minimum thresh- old. Table 11.5 lists the command-line arguments of the savecore command. 11 8699 ch11 11/19/02 10:06 AM Page 252 Special Disk Operations 253 Table 11.5 The savecore Command-Line Arguments Argument Purpose -d Disregards dump header valid flag. This forces savecore to save the crash dump even if the dump header valid flag indicates the crash dump has already been saved. directory Saves crash dump in specified directory instead of the default or the dumpadm-configured savecore directory. -f dump-device Attempts to save crash dump from specified dump-device instead of the default or the dumpadm-configured dump device. -L Saves crash dump of live (active) system. Used to take a snapshot of the executing operating system. -v Displays verbose error messages. In the event that savecore cannot save a crash dump because of the minimum free space threshold (or because savecore procedure was disabled), the savecore com- mand can be executed after the system reboots to save the crash dump. If this manual procedure is used due to the free space threshold, be certain to specify an alternative save directory. Summary Swap space is used to increase the apparent size of memory by using disk space. A swap partition is created when the system is installed. If more swap space is needed, swap files can be created and added into the system config- uration. Core files are copies of memory being used by programs that malfunction. These are used to debug software. Core file management involves enabling/disabling core files globally or on a per-process basis along with selecting a directory and naming conventions for core files. Crash dumps are the core files for the operating system. When the system boots, the crash dump can be saved in a user-accessible area so that it can be analyzed. 11 8699 ch11 11/19/02 10:06 AM Page 253 Chapter 11 254 Exam Prep Practice Questions Question 1 Match the coreadm command-line arguments with their uses. ❑ A. -p 1. Sets global core filename pattern ❑ B. -g 2. Enables core file configuration ❑ C. -e 3. Disables core file configuration ❑ D. -d 4. Sets per-process core filename pattern Answers: A matches 4; B matches 1; C matches 2; and D matches 3. Note that the single character of the command-line argument matches the key- word: e for enable, d for disable, g for global, and p for per-process. Question 2 What is the swap command-line argument that will add a swap file to the sys- tem swap space? ❍ A. -a ❍ B. -d ❍ C. -l ❍ D. -s Answer A is correct. -d deletes a swap file from the system swap space; there- fore, answer B is incorrect. -l lists the swap space partition and any swap files; therefore, answer C is incorrect. -s lists statistics about swap space use; therefore, answer D is incorrect. Question 3 Enter the name of the coreadm configuration file. The correct answer is /etc/coreadm.conf 11 8699 ch11 11/19/02 10:06 AM Page 254 Special Disk Operations 255 Question 4 What does the command savecore /var/save do? ❍ A. Copies the crash dump from /var/save to the default savecore directo- ry. ❍ B. Copies the crash dump from /var/save to the dumpadm-specified savecore directory. ❍ C. Copies the crash dump from the dump device to the /var/save directo- ry. ❍ D. Copies the crash dump from the savecore directory to the /var/save directory. Answer C is correct. The savecore command-line argument is used to spec- ify an alternative directory from saving a crash dump instead of using the default or dumpadm-specified directory. Therefore, answers A and B are incor- rect. The savecore command copies the crash dump from the dump device, not the savecore device. Therefore answer D is incorrect. Question 5 Which of the following is the correct syntax for the mkfile command? ❍ A. mkfile -s 32m /swapfile ❍ B. mkfile 32 M swapfile ❍ C. mkfile 32m /swapfile ❍ D. mkfile 32m -f /swapfile Answer C is correct. The mkfile does not use command-line arguments such as -s or -f. Therefore answers A and D are incorrect. The size scale (m or M) should not be separated from the size; therefore, answer B is incorrect. Question 6 Which of the following conditions might require additional swap space? [Select all that apply.] ❑ A. Physical memory is added. ❑ B. The /tmp file system is being heavily used. ❑ C. The load on the system increases. ❑ D. Several memory-intensive applications are added to the system. 11 8699 ch11 11/19/02 10:06 AM Page 255 Chapter 11 256 A, B, C, and D are correct. All of the answers may require additional swap space. Question 7 What is the dumpadm command-line argument that will display the crash dump configuration? ❍ A. -d ❍ B. none (no argument) ❍ C. -v ❍ D. -s Answer B is correct. Using the dumpadm command without any command- line arguments will display the current crash dump configuration. The -d is specified to specify a dump device; therefore, answer A is incorrect. -v does not exist; therefore answer C is not valid. -s is used to specify a savecore directory; therefore, answer D is incorrect. Question 8 Enter the name of the dumpadm configuration file. The correct answer is /etc/dumpadm.conf Question 9 What is the expanded value of the %p core filename pattern variable? ❍ A. program name ❍ B. PID ❍ C. process start time ❍ D. username Answer B is correct. 11 8699 ch11 11/19/02 10:06 AM Page 256 Special Disk Operations 257 Question 10 Which of the following are valid core file options (coreadm -e options)? [Select all that apply.] ❑ A. global ❑ B. process ❑ C. setuid ❑ D. log Answers A, B, and D are correct. The coreadm -e options are global, process, global-setid, proc-setid, and log. Answer C (setuid) is not a valid option. 11 8699 ch11 11/19/02 10:06 AM Page 257 Chapter 11 258 Need to Know More? Mulligan, John P., Solaris 8 Essential Reference, New Riders, Indianapolis, IN, 2001. Sorbell, Mark G., A Practical Guide to Solaris, Addison-Wesley, Reading, MA, 1999. Sun Microsystems, System Administration Guide: Basic Administration. Available in printed form, on the Web at docs.sun.com, and from the online documentation provided with the Solaris 9 operating system. Sun Microsystems, System Reference Manual, Section 1—User Commands. Available in printed form, on the Web at docs.sun.com, and from the online documentation provided with the Solaris 9 operating system. Sun Microsystems, System Reference Manual, Section 1M—System Administration Commands. Available in printed form, on the Web at docs.sun.com, and from the online documentation provided with the Solaris 9 operating system. 11 8699 ch11 11/19/02 10:07 AM Page 258 Advanced Access Control Terms You Need to Understand ✓ Access Control Lists (ACLs) ✓ Role Based Access Control (RBAC) ✓ Roles ✓ Profiles ✓ Authorizations ✓ Privileged operations Concepts You Need to Master ✓ Setting ACLs for files and directories ✓ Displaying ACLs ✓ Creating and assigning roles ✓ Displaying RBAC assignments 12 12 8699 ch12 11/19/02 10:05 AM Page 259 Chapter 12 260 Introduction The first half of this chapter covers setting and displaying Access Control Lists (ACLs). The second portion describes the purpose of Role-Based Access Control (RBAC), covers details on the configuration files used to implement the RBAC, and includes a summary of the commands that can be used to manage the RBAC. Access Control Lists Solaris 9 extends the standard Unix file permissions by adding an Access Control List (ACL) capability. ACLs provide the capability to add permis- sions for specific users and groups, along with a default permission (mask). In addition to supporting the standard read/write/execute permissions for the standard file user account (owner), ACLs can be used to set read/write/exe- cute permissions for additional user accounts. Likewise, ACLs support read/write/execute permissions for the standard file group account and allow read/write/execution permissions for additional group accounts. ACLs also support read/write/execution for the standard permissions (everyone else). ACLs also include a mask capability that controls the maximum allowed permissions given to user and group accounts other than the standard file user account and the standard file group account. For example, root owns a file and sets its ACL mask to read/execute. Later, root adds read/write/execute permission to the file ACL for the guest user account. Because of the mask, the write permission is overridden, and the effective permissions for the guest account are read/execute. The ACL for a directory includes default entries that determine the permis- sions assigned to files and subdirectories created under the directory. Default permissions can be defined for the standard Unix user, group, and other along with a default mask and default permissions for specific users or groups. Two commands are used to manage ACLs: ➤ The setfacl command is used to set ACLs ➤ The getfacl command is used to display ACLs Use of the setfacl command to add, modify, and delete ACLs on files and directories is a stated test objective. 12 8699 ch12 11/19/02 10:05 AM Page 260 [...]... Help 10:05 AM solaris. device.*, solaris. admin.serialmgr.* N/A Profiles 11/ 19/ 02 solaris. jobs.* solaris. snmp.read, solaris. project.read, solaris. admin.patchmgr.read, solaris. network.hosts.read Auths 12 8 69 9 ch12 Page 2 69 Advanced 2 69 Access Control Description Maintains and repairs a system Backs up files and file systems Restores files and file systems from... solaris. admin.usermgr.read, solaris. admin.logsvc.read, solaris. admin.fsmgr.read, solaris. admin.serialmgr.read, solaris. admin.diskmgr.read, solaris. admin.procmgr.user, solaris. compsys.read, solaris. admin.printer.read, solaris. jobs.user, solaris. admin.prodreg.read, solaris. admin.dcmgr.read, All N/A (continued) RtDefault.html RtAuditReview.html RtAuditCtrl.html RtAll.html Help 10:05 AM solaris. audit.read N/A N/A Profiles 11/ 19/ 02... Device Management Device Security DHCP Management File System Management File System Security FTP Management Mail Management Table 12.3 Default RBAC Profiles (continued) N/A N/A solaris. admin.fsmgr.*, solaris. admin.diskmgr.*, solaris. admin.volmgr.* solaris. admin.fsmgr.*, solaris. admin.diskmgr.*, solaris. admin.volmgr.* solaris. dhcpmgr.* solaris. device.*, solaris. admin.serialmgr.* N/A N/A N/A N/A N/A N/A... Profiles 11/ 19/ 02 solaris. audit.config, solaris. jobs.admin, solaris. admin.logsvc.purge, solaris. admin.logsvc.read N/A Auths 12 8 69 9 ch12 Page 268 268 Chapter 12 Description Manages at and cron jobs Controls Access to Removable Media Manages devices and Volume Manager Manages the DHCP service Manages, mounts, and shares file systems Manages file system security... AuthRoleAssign.html solaris. role.delegate Assigns owned roles AuthRoleDelegate.html solaris. role.write Manages roles AuthRoleWrite.html solaris. snmp SNMP Management AuthSnmpHeader.html solaris. snmp.read Gets SNMP information AuthSnmpRead.html solaris. snmp.write Sets SNMP information AuthSnmpWrite.html solaris. system Machine administration SysHeader.html solaris. system. date Sets date and time SysDate.html solaris. system. shutdown... RtObAccessMngmnt.html RtNetSecure.html Help 10:05 AM solaris. *, solaris. grant N/A N/A N/A Profiles 11/ 19/ 02 N/A solaris. network.* Auths 12 8 69 9 ch12 Page 271 Advanced 271 Access Control Description Adds application software to the system Performs most non-security administrative tasks Name Software Installation System Administrator Table 12.3 Default RBAC Profiles... (continued) 12 8 69 9 ch12 11/ 19/ 02 10:05 AM Page 2 76 2 76 Chapter 12 Table 12.5 Default RBAC Authorizations (continued) Name Description Help solaris. admin.printer.modify Updates printer information AuthPrinterModify.html solaris. admin.printer.read Views printer information AuthPrinterRead.html solaris. admin.procmgr Process Manager AuthProcmgrHeader.html solaris. admin.procmgr.admin... cron and at administration JobsGrant.html solaris. jobs.user Manages owned jobs AuthJobsUser.html solaris. login Login Control LoginHeader.html solaris. login.enable Enables logins LoginEnable.html solaris. login.remote Enables remote login LoginRemote.html solaris. mail Mail MailHeader.html solaris. mail.mailq Mail queue MailQueue.html (continued) 12 8 69 9 ch12 11/ 19/ 02 10:05 AM Page 278 278 Chapter 12 ... Object Access Management Operator Primary Administrator Printer Management Process Management Project Management Rights Delegation Table 12.3 Default RBAC Profiles (continued) solaris. role.delegate, solaris. profmgr.delegate, solaris. grant solaris. project.read, solaris. project.write solaris. admin.procmgr.* solaris. admin.printer.read, solaris. admin.printer.modify, solaris. admin.printer.delete N/A N/A N/A... the system SysShutdown.html 12 8 69 9 ch12 11/ 19/ 02 10:05 AM Page 2 79 Advanced 2 79 Access Control Note that all of these authorizations are for the Solaris operating system If new authorizations are added for other software, they should be identified using the reverse order Internet domain name of the organization that creates the authorization For example, . 12 268 (continued) 12 8 69 9 ch12 11/ 19/ 02 10:05 AM Page 268 Advanced Access Control 2 69 Table 12.3 Default RBAC Profiles (continued) Name Description Auths Profiles Help solaris. snmp.read, solaris. project.read,. used. ❑ C. The load on the system increases. ❑ D. Several memory-intensive applications are added to the system. 11 8 69 9 ch11 11/ 19/ 02 10: 06 AM Page 255 Chapter 11 2 56 A, B, C, and D are correct trail:auths =solaris. audit.read; help=AuditReview.html Printer Management:::Control Access to Printer: help=PrinterMgmt.html 12 8 69 9 ch12 11/ 19/ 02 10:05 AM Page 266 Advanced Access Control 267 The