Implementation Guide › Installing and Customizing a UNIX Endpoint › Solaris 10 Zones Implementation › Starting and Stopping CA Access Control in a Zone

Starting and Stopping CA Access Control in a Zone

Starting and stopping CA Access Control in Solaris 10 zones is generally done in the same way you would normally start and stop CA Access Control on any Solaris computer.

The following exceptions apply to starting CA Access Control in zones:

• You can load the CA Access Control kernel module (SEOS_load) from the global zone only.
• You must load the CA Access Control kernel module in the global zone before you can start CA Access Control in any non-global zone.

  Once the CA Access Control kernel module is loaded in the global zone, you can then start and stop CA Access Control in any non-global zone and in any order.

The following exceptions apply to stopping CA Access Control in zones:

• You cannot unload the CA Access Control kernel module when one or more zones has maintenance mode enabled.
• You can stop CA Access Control in all zones in any order by issuing the secons -s command in each zone.
• You can stop CA Access Control in all zones at the same time by adding all zones to a GHOST record and then issuing the secons -s ghost_name command from the global zone.

  This is useful, for example, when you want to upgrade CA Access Control across all zones.

• You should stop the last zone with the secons -sk to disable event interception and prepare the CA Access Control kernel module for unloading.
• You can unload the CA Access Control kernel module (SEOS_load -u) from the global zone only.

  Note: The SEOS_load -u command ensures that CA Access Control is not running on any non-global zone before unloading it.