Im Folgenden soll nun der Update auf AIX 7200-05-08-2420 durchgeführt werden. Wir starten auch hier wieder mit installierten Ifixes:

# emgr -l

ID  STATE LABEL      INSTALL TIME      UPDATED BY ABSTRACT
=== ===== ========== ================= ========== ======================================
1    S    81112ma    02/01/25 08:46:29            ifix for openssh Jan CVEs            
2    S    IJ50424s7a 02/01/25 13:09:14            IJ50424 for AIX 7.2 TL5 SP5 to SP7   
3    S    IJ52366s7a 02/01/25 13:09:33            IJ52366 POTENTIAL SECURITY ISSUE     
…
#

Ein Update sollte nicht erfolgreich sein, da nur der installierte Ifix IJ50424s7a, beim Update auf die genannte AIX Version, automatisch entfernt werden kann:

# install_all_updates -Y -d /mnt/aix720508lpp
…
+-----------------------------------------------------------------------------+
                   BUILDDATE Verification ...
+-----------------------------------------------------------------------------+
Verifying build dates...done

The updates being installed do not contain all the APARs to allow
all existing interim fixes to be automatically removed.  Please ensure
the interim fixes are enabled for automatic removal and obtain the
updates that contain the APARs for the following interim fixes,
or remove the interim fixes, as described below.
81112ma
IJ52366s7a

EFIX MANAGER LOCKS
------------------

  * * * ATTENTION * * *

  The following selected filesets are locked by EFIX manager:

  openssh.base.server
  openssh.base.client
  bos.net.tcp.sendmail
  bos.net.tcp.client_core

  installp has halted this operation because one or more files in the
  filesets listed above are registered as having an EFIX. You must remove
  these EFIXES before performing operations on the given fileset.

  To get a listing of all locked filesets and the locking EFIX label,
  execute the following command:

  # /usr/sbin/emgr -P

  To remove the given EFIX, execute the following command:

  # /usr/sbin/emgr -r -L <EFIX label>

  For more information on EFIX management please see the emgr man page
  and documentation.

install_all_updates: Checking for recommended maintenance level 7200-05.
install_all_updates: Executing /usr/bin/oslevel -rf, Result = 7200-05
install_all_updates: Verification completed.
install_all_updates: Log file is /var/adm/ras/install_all_updates.log
install_all_updates: Result = FAILURE
# 

Der Update schlägt fehl (Result = FAILURE). Grund sind gesperrte Filesets, da die zugehörigen installierten Ifixes nicht automatisch deinstalliert werden konnten (81112ma und IJ52366s7a).

Wir deinstallieren die beiden Ifixes, da diese nicht automatisch beim Update entfernt werden:

# emgr -r -L 81112ma
…
EFIX NUMBER       LABEL               OPERATION              RESULT           
===========       ==============      =================      ==============   
1                 81112ma             REMOVE                 SUCCESS          

Return Status = SUCCESS
# 
# emgr -r -L IJ52366s7a
…
EFIX NUMBER       LABEL               OPERATION              RESULT           
===========       ==============      =================      ==============   
1                 IJ52366s7a          REMOVE                 SUCCESS          

ATTENTION: system reboot is required. Please see the "Reboot Processing"
sections in the output above or in the /var/adm/ras/emgr.log file.

Return Status = SUCCESS
# 

Der automatisch entfernbare Ifix IJ50424s7a bleibt installiert.

Wir wiederholen den Update:

# install_all_updates -Y -d /mnt/aix720508lpp
…
+-----------------------------------------------------------------------------+
                   BUILDDATE Verification ...
+-----------------------------------------------------------------------------+
Verifying build dates...done

The updates being installed contain the following interim fix labels,
which will be removed prior to installing the updates:
IJ50424s7a

NOTE: Rejecting an update that contains an interim fix will not
re-install the interim fix on the system.

FILESET STATISTICS
------------------
  112  Selected to be installed, of which:
      112  Passed pre-installation verification
  ----
  112  Total to be installed

installp:  bosboot verification starting...
installp:  bosboot verification completed.
+-----------------------------------------------------------------------------+
                         Installing Software...
+-----------------------------------------------------------------------------+
Removing interim fixes...

The emgr command successfully removed interim fix IJ50424s7a.

installp: APPLYING software for:
        security.acf 7.2.5.203

…
install_all_updates: Checking for recommended maintenance level 7200-05.
install_all_updates: Executing /usr/bin/oslevel -rf, Result = 7200-05
install_all_updates: Verification completed.
install_all_updates: Log file is /var/adm/ras/install_all_updates.log
install_all_updates: Result = SUCCESS
# 

Der Update war erfolgreich, der installierte Ifix IJ50424s7a wurde wie erwartet automatisch entfernt. Der offizielle Ifix für den APAR IJ50424 ist installiert:

# instfix -ik IJ50424
    All filesets for IJ50424 were found.
# 

Es fehlt nun aber der Fix für APAR IJ52366, da ja der zugehörige Ifix manuell deinstalliert wurde und der Update den offiziellen Fix für diesen APAR nicht enthält.