1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Copyright (c) 2013, Joyent Inc. All rights reserved.
  25  * Copyright (c) 2015 by Delphix. All rights reserved.
  26  */
  27 
  28 /*
  29  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  30  */
  31 
  32 /*
  33  * This module contains functions used to bring up and tear down the
  34  * Virtual Platform: [un]mounting file-systems, [un]plumbing network
  35  * interfaces, [un]configuring devices, establishing resource controls,
  36  * and creating/destroying the zone in the kernel.  These actions, on
  37  * the way up, ready the zone; on the way down, they halt the zone.
  38  * See the much longer block comment at the beginning of zoneadmd.c
  39  * for a bigger picture of how the whole program functions.
  40  *
  41  * This module also has primary responsibility for the layout of "scratch
  42  * zones."  These are mounted, but inactive, zones that are used during
  43  * operating system upgrade and potentially other administrative action.  The
  44  * scratch zone environment is similar to the miniroot environment.  The zone's
  45  * actual root is mounted read-write on /a, and the standard paths (/usr,
  46  * /sbin, /lib) all lead to read-only copies of the running system's binaries.
  47  * This allows the administrative tools to manipulate the zone using "-R /a"
  48  * without relying on any binaries in the zone itself.
  49  *
  50  * If the scratch zone is on an alternate root (Live Upgrade [LU] boot
  51  * environment), then we must resolve the lofs mounts used there to uncover
  52  * writable (unshared) resources.  Shared resources, though, are always
  53  * read-only.  In addition, if the "same" zone with a different root path is
  54  * currently running, then "/b" inside the zone points to the running zone's
  55  * root.  This allows LU to synchronize configuration files during the upgrade
  56  * process.
  57  *
  58  * To construct this environment, this module creates a tmpfs mount on
  59  * $ZONEPATH/lu.  Inside this scratch area, the miniroot-like environment as
  60  * described above is constructed on the fly.  The zone is then created using
  61  * $ZONEPATH/lu as the root.
  62  *
  63  * Note that scratch zones are inactive.  The zone's bits are not running and
  64  * likely cannot be run correctly until upgrade is done.  Init is not running
  65  * there, nor is SMF.  Because of this, the "mounted" state of a scratch zone
  66  * is not a part of the usual halt/ready/boot state machine.
  67  */
  68 
  69 #include <sys/param.h>
  70 #include <sys/mount.h>
  71 #include <sys/mntent.h>
  72 #include <sys/socket.h>
  73 #include <sys/utsname.h>
  74 #include <sys/types.h>
  75 #include <sys/stat.h>
  76 #include <sys/sockio.h>
  77 #include <sys/stropts.h>
  78 #include <sys/conf.h>
  79 #include <sys/systeminfo.h>
  80 
  81 #include <libdlpi.h>
  82 #include <libdllink.h>
  83 #include <libdlvlan.h>
  84 
  85 #include <inet/tcp.h>
  86 #include <arpa/inet.h>
  87 #include <netinet/in.h>
  88 #include <net/route.h>
  89 
  90 #include <stdio.h>
  91 #include <errno.h>
  92 #include <fcntl.h>
  93 #include <unistd.h>
  94 #include <rctl.h>
  95 #include <stdlib.h>
  96 #include <string.h>
  97 #include <strings.h>
  98 #include <wait.h>
  99 #include <limits.h>
 100 #include <libgen.h>
 101 #include <libzfs.h>
 102 #include <libdevinfo.h>
 103 #include <zone.h>
 104 #include <assert.h>
 105 #include <libcontract.h>
 106 #include <libcontract_priv.h>
 107 #include <uuid/uuid.h>
 108 
 109 #include <sys/mntio.h>
 110 #include <sys/mnttab.h>
 111 #include <sys/fs/autofs.h>        /* for _autofssys() */
 112 #include <sys/fs/lofs_info.h>
 113 #include <sys/fs/zfs.h>
 114 
 115 #include <pool.h>
 116 #include <sys/pool.h>
 117 #include <sys/priocntl.h>
 118 
 119 #include <libbrand.h>
 120 #include <sys/brand.h>
 121 #include <libzonecfg.h>
 122 #include <synch.h>
 123 
 124 #include "zoneadmd.h"
 125 #include <tsol/label.h>
 126 #include <libtsnet.h>
 127 #include <sys/priv.h>
 128 #include <libinetutil.h>
 129 
 130 #define V4_ADDR_LEN     32
 131 #define V6_ADDR_LEN     128
 132 
 133 #define RESOURCE_DEFAULT_OPTS \
 134         MNTOPT_RO "," MNTOPT_LOFS_NOSUB "," MNTOPT_NODEVICES
 135 
 136 #define DFSTYPES        "/etc/dfs/fstypes"
 137 #define MAXTNZLEN       2048
 138 
 139 #define ALT_MOUNT(mount_cmd)    ((mount_cmd) != Z_MNT_BOOT)
 140 
 141 /* a reasonable estimate for the number of lwps per process */
 142 #define LWPS_PER_PROCESS        10
 143 
 144 /* for routing socket */
 145 static int rts_seqno = 0;
 146 
 147 /* mangled zone name when mounting in an alternate root environment */
 148 static char kernzone[ZONENAME_MAX];
 149 
 150 /* array of cached mount entries for resolve_lofs */
 151 static struct mnttab *resolve_lofs_mnts, *resolve_lofs_mnt_max;
 152 
 153 /* for Trusted Extensions */
 154 static tsol_zcent_t *get_zone_label(zlog_t *, priv_set_t *);
 155 static int tsol_mounts(zlog_t *, char *, char *);
 156 static void tsol_unmounts(zlog_t *, char *);
 157 
 158 static m_label_t *zlabel = NULL;
 159 static m_label_t *zid_label = NULL;
 160 static priv_set_t *zprivs = NULL;
 161 
 162 static const char *DFLT_FS_ALLOWED = "hsfs,smbfs,nfs,nfs3,nfs4,nfsdyn";
 163 
 164 /* from libsocket, not in any header file */
 165 extern int getnetmaskbyaddr(struct in_addr, struct in_addr *);
 166 
 167 /* from zoneadmd */
 168 extern char query_hook[];
 169 
 170 /*
 171  * For each "net" resource configured in zonecfg, we track a zone_addr_list_t
 172  * node in a linked list that is sorted by linkid.  The list is constructed as
 173  * the xml configuration file is parsed, and the information
 174  * contained in each node is added to the kernel before the zone is
 175  * booted, to be retrieved and applied from within the exclusive-IP NGZ
 176  * on boot.
 177  */
 178 typedef struct zone_addr_list {
 179         struct zone_addr_list *za_next;
 180         datalink_id_t za_linkid;        /* datalink_id_t of interface */
 181         struct zone_nwiftab za_nwiftab; /* address, defrouter properties */
 182 } zone_addr_list_t;
 183 
 184 /*
 185  * An optimization for build_mnttable: reallocate (and potentially copy the
 186  * data) only once every N times through the loop.
 187  */
 188 #define MNTTAB_HUNK     32
 189 
 190 /* some handy macros */
 191 #define SIN(s)  ((struct sockaddr_in *)s)
 192 #define SIN6(s) ((struct sockaddr_in6 *)s)
 193 
 194 /*
 195  * Private autofs system call
 196  */
 197 extern int _autofssys(int, void *);
 198 
 199 static int
 200 autofs_cleanup(zoneid_t zoneid)
 201 {
 202         /*
 203          * Ask autofs to unmount all trigger nodes in the given zone.
 204          */
 205         return (_autofssys(AUTOFS_UNMOUNTALL, (void *)zoneid));
 206 }
 207 
 208 static void
 209 free_mnttable(struct mnttab *mnt_array, uint_t nelem)
 210 {
 211         uint_t i;
 212 
 213         if (mnt_array == NULL)
 214                 return;
 215         for (i = 0; i < nelem; i++) {
 216                 free(mnt_array[i].mnt_mountp);
 217                 free(mnt_array[i].mnt_fstype);
 218                 free(mnt_array[i].mnt_special);
 219                 free(mnt_array[i].mnt_mntopts);
 220                 assert(mnt_array[i].mnt_time == NULL);
 221         }
 222         free(mnt_array);
 223 }
 224 
 225 /*
 226  * Build the mount table for the zone rooted at "zroot", storing the resulting
 227  * array of struct mnttabs in "mnt_arrayp" and the number of elements in the
 228  * array in "nelemp".
 229  */
 230 static int
 231 build_mnttable(zlog_t *zlogp, const char *zroot, size_t zrootlen, FILE *mnttab,
 232     struct mnttab **mnt_arrayp, uint_t *nelemp)
 233 {
 234         struct mnttab mnt;
 235         struct mnttab *mnts;
 236         struct mnttab *mnp;
 237         uint_t nmnt;
 238 
 239         rewind(mnttab);
 240         resetmnttab(mnttab);
 241         nmnt = 0;
 242         mnts = NULL;
 243         while (getmntent(mnttab, &mnt) == 0) {
 244                 struct mnttab *tmp_array;
 245 
 246                 if (strncmp(mnt.mnt_mountp, zroot, zrootlen) != 0)
 247                         continue;
 248                 if (nmnt % MNTTAB_HUNK == 0) {
 249                         tmp_array = realloc(mnts,
 250                             (nmnt + MNTTAB_HUNK) * sizeof (*mnts));
 251                         if (tmp_array == NULL) {
 252                                 free_mnttable(mnts, nmnt);
 253                                 return (-1);
 254                         }
 255                         mnts = tmp_array;
 256                 }
 257                 mnp = &mnts[nmnt++];
 258 
 259                 /*
 260                  * Zero out any fields we're not using.
 261                  */
 262                 (void) memset(mnp, 0, sizeof (*mnp));
 263 
 264                 if (mnt.mnt_special != NULL)
 265                         mnp->mnt_special = strdup(mnt.mnt_special);
 266                 if (mnt.mnt_mntopts != NULL)
 267                         mnp->mnt_mntopts = strdup(mnt.mnt_mntopts);
 268                 mnp->mnt_mountp = strdup(mnt.mnt_mountp);
 269                 mnp->mnt_fstype = strdup(mnt.mnt_fstype);
 270                 if ((mnt.mnt_special != NULL && mnp->mnt_special == NULL) ||
 271                     (mnt.mnt_mntopts != NULL && mnp->mnt_mntopts == NULL) ||
 272                     mnp->mnt_mountp == NULL || mnp->mnt_fstype == NULL) {
 273                         zerror(zlogp, B_TRUE, "memory allocation failed");
 274                         free_mnttable(mnts, nmnt);
 275                         return (-1);
 276                 }
 277         }
 278         *mnt_arrayp = mnts;
 279         *nelemp = nmnt;
 280         return (0);
 281 }
 282 
 283 /*
 284  * This is an optimization.  The resolve_lofs function is used quite frequently
 285  * to manipulate file paths, and on a machine with a large number of zones,
 286  * there will be a huge number of mounted file systems.  Thus, we trigger a
 287  * reread of the list of mount points
 288  */
 289 static void
 290 lofs_discard_mnttab(void)
 291 {
 292         free_mnttable(resolve_lofs_mnts,
 293             resolve_lofs_mnt_max - resolve_lofs_mnts);
 294         resolve_lofs_mnts = resolve_lofs_mnt_max = NULL;
 295 }
 296 
 297 static int
 298 lofs_read_mnttab(zlog_t *zlogp)
 299 {
 300         FILE *mnttab;
 301         uint_t nmnts;
 302 
 303         if ((mnttab = fopen(MNTTAB, "r")) == NULL)
 304                 return (-1);
 305         if (build_mnttable(zlogp, "", 0, mnttab, &resolve_lofs_mnts,
 306             &nmnts) == -1) {
 307                 (void) fclose(mnttab);
 308                 return (-1);
 309         }
 310         (void) fclose(mnttab);
 311         resolve_lofs_mnt_max = resolve_lofs_mnts + nmnts;
 312         return (0);
 313 }
 314 
 315 /*
 316  * This function loops over potential loopback mounts and symlinks in a given
 317  * path and resolves them all down to an absolute path.
 318  */
 319 void
 320 resolve_lofs(zlog_t *zlogp, char *path, size_t pathlen)
 321 {
 322         int len, arlen;
 323         const char *altroot;
 324         char tmppath[MAXPATHLEN];
 325         boolean_t outside_altroot;
 326 
 327         if ((len = resolvepath(path, tmppath, sizeof (tmppath))) == -1)
 328                 return;
 329         tmppath[len] = '\0';
 330         (void) strlcpy(path, tmppath, sizeof (tmppath));
 331 
 332         /* This happens once per zoneadmd operation. */
 333         if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
 334                 return;
 335 
 336         altroot = zonecfg_get_root();
 337         arlen = strlen(altroot);
 338         outside_altroot = B_FALSE;
 339         for (;;) {
 340                 struct mnttab *mnp;
 341 
 342                 /* Search in reverse order to find longest match */
 343                 for (mnp = resolve_lofs_mnt_max - 1; mnp >= resolve_lofs_mnts;
 344                     mnp--) {
 345                         if (mnp->mnt_fstype == NULL ||
 346                             mnp->mnt_mountp == NULL ||
 347                             mnp->mnt_special == NULL)
 348                                 continue;
 349                         len = strlen(mnp->mnt_mountp);
 350                         if (strncmp(mnp->mnt_mountp, path, len) == 0 &&
 351                             (path[len] == '/' || path[len] == '\0'))
 352                                 break;
 353                 }
 354                 if (mnp < resolve_lofs_mnts)
 355                         break;
 356                 /* If it's not a lofs then we're done */
 357                 if (strcmp(mnp->mnt_fstype, MNTTYPE_LOFS) != 0)
 358                         break;
 359                 if (outside_altroot) {
 360                         char *cp;
 361                         int olen = sizeof (MNTOPT_RO) - 1;
 362 
 363                         /*
 364                          * If we run into a read-only mount outside of the
 365                          * alternate root environment, then the user doesn't
 366                          * want this path to be made read-write.
 367                          */
 368                         if (mnp->mnt_mntopts != NULL &&
 369                             (cp = strstr(mnp->mnt_mntopts, MNTOPT_RO)) !=
 370                             NULL &&
 371                             (cp == mnp->mnt_mntopts || cp[-1] == ',') &&
 372                             (cp[olen] == '\0' || cp[olen] == ',')) {
 373                                 break;
 374                         }
 375                 } else if (arlen > 0 &&
 376                     (strncmp(mnp->mnt_special, altroot, arlen) != 0 ||
 377                     (mnp->mnt_special[arlen] != '\0' &&
 378                     mnp->mnt_special[arlen] != '/'))) {
 379                         outside_altroot = B_TRUE;
 380                 }
 381                 /* use temporary buffer because new path might be longer */
 382                 (void) snprintf(tmppath, sizeof (tmppath), "%s%s",
 383                     mnp->mnt_special, path + len);
 384                 if ((len = resolvepath(tmppath, path, pathlen)) == -1)
 385                         break;
 386                 path[len] = '\0';
 387         }
 388 }
 389 
 390 /*
 391  * For a regular mount, check if a replacement lofs mount is needed because the
 392  * referenced device is already mounted somewhere.
 393  */
 394 static int
 395 check_lofs_needed(zlog_t *zlogp, struct zone_fstab *fsptr)
 396 {
 397         struct mnttab *mnp;
 398         zone_fsopt_t *optptr, *onext;
 399 
 400         /* This happens once per zoneadmd operation. */
 401         if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
 402                 return (-1);
 403 
 404         /*
 405          * If this special node isn't already in use, then it's ours alone;
 406          * no need to worry about conflicting mounts.
 407          */
 408         for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max;
 409             mnp++) {
 410                 if (strcmp(mnp->mnt_special, fsptr->zone_fs_special) == 0)
 411                         break;
 412         }
 413         if (mnp >= resolve_lofs_mnt_max)
 414                 return (0);
 415 
 416         /*
 417          * Convert this duplicate mount into a lofs mount.
 418          */
 419         (void) strlcpy(fsptr->zone_fs_special, mnp->mnt_mountp,
 420             sizeof (fsptr->zone_fs_special));
 421         (void) strlcpy(fsptr->zone_fs_type, MNTTYPE_LOFS,
 422             sizeof (fsptr->zone_fs_type));
 423         fsptr->zone_fs_raw[0] = '\0';
 424 
 425         /*
 426          * Discard all but one of the original options and set that to our
 427          * default set of options used for resources.
 428          */
 429         optptr = fsptr->zone_fs_options;
 430         if (optptr == NULL) {
 431                 optptr = malloc(sizeof (*optptr));
 432                 if (optptr == NULL) {
 433                         zerror(zlogp, B_TRUE, "cannot mount %s",
 434                             fsptr->zone_fs_dir);
 435                         return (-1);
 436                 }
 437         } else {
 438                 while ((onext = optptr->zone_fsopt_next) != NULL) {
 439                         optptr->zone_fsopt_next = onext->zone_fsopt_next;
 440                         free(onext);
 441                 }
 442         }
 443         (void) strcpy(optptr->zone_fsopt_opt, RESOURCE_DEFAULT_OPTS);
 444         optptr->zone_fsopt_next = NULL;
 445         fsptr->zone_fs_options = optptr;
 446         return (0);
 447 }
 448 
 449 int
 450 make_one_dir(zlog_t *zlogp, const char *prefix, const char *subdir, mode_t mode,
 451     uid_t userid, gid_t groupid)
 452 {
 453         char path[MAXPATHLEN];
 454         struct stat st;
 455 
 456         if (snprintf(path, sizeof (path), "%s%s", prefix, subdir) >
 457             sizeof (path)) {
 458                 zerror(zlogp, B_FALSE, "pathname %s%s is too long", prefix,
 459                     subdir);
 460                 return (-1);
 461         }
 462 
 463         if (lstat(path, &st) == 0) {
 464                 /*
 465                  * We don't check the file mode since presumably the zone
 466                  * administrator may have had good reason to change the mode,
 467                  * and we don't need to second guess him.
 468                  */
 469                 if (!S_ISDIR(st.st_mode)) {
 470                         if (S_ISREG(st.st_mode)) {
 471                                 /*
 472                                  * Allow readonly mounts of /etc/ files; this
 473                                  * is needed most by Trusted Extensions.
 474                                  */
 475                                 if (strncmp(subdir, "/etc/",
 476                                     strlen("/etc/")) != 0) {
 477                                         zerror(zlogp, B_FALSE,
 478                                             "%s is not in /etc", path);
 479                                         return (-1);
 480                                 }
 481                         } else {
 482                                 zerror(zlogp, B_FALSE,
 483                                     "%s is not a directory", path);
 484                                 return (-1);
 485                         }
 486                 }
 487                 return (0);
 488         }
 489 
 490         if (mkdirp(path, mode) != 0) {
 491                 if (errno == EROFS)
 492                         zerror(zlogp, B_FALSE, "Could not mkdir %s.\nIt is on "
 493                             "a read-only file system in this local zone.\nMake "
 494                             "sure %s exists in the global zone.", path, subdir);
 495                 else
 496                         zerror(zlogp, B_TRUE, "mkdirp of %s failed", path);
 497                 return (-1);
 498         }
 499 
 500         (void) chown(path, userid, groupid);
 501         return (0);
 502 }
 503 
 504 static void
 505 free_remote_fstypes(char **types)
 506 {
 507         uint_t i;
 508 
 509         if (types == NULL)
 510                 return;
 511         for (i = 0; types[i] != NULL; i++)
 512                 free(types[i]);
 513         free(types);
 514 }
 515 
 516 static char **
 517 get_remote_fstypes(zlog_t *zlogp)
 518 {
 519         char **types = NULL;
 520         FILE *fp;
 521         char buf[MAXPATHLEN];
 522         char fstype[MAXPATHLEN];
 523         uint_t lines = 0;
 524         uint_t i;
 525 
 526         if ((fp = fopen(DFSTYPES, "r")) == NULL) {
 527                 zerror(zlogp, B_TRUE, "failed to open %s", DFSTYPES);
 528                 return (NULL);
 529         }
 530         /*
 531          * Count the number of lines
 532          */
 533         while (fgets(buf, sizeof (buf), fp) != NULL)
 534                 lines++;
 535         if (lines == 0) /* didn't read anything; empty file */
 536                 goto out;
 537         rewind(fp);
 538         /*
 539          * Allocate enough space for a NULL-terminated array.
 540          */
 541         types = calloc(lines + 1, sizeof (char *));
 542         if (types == NULL) {
 543                 zerror(zlogp, B_TRUE, "memory allocation failed");
 544                 goto out;
 545         }
 546         i = 0;
 547         while (fgets(buf, sizeof (buf), fp) != NULL) {
 548                 /* LINTED - fstype is big enough to hold buf */
 549                 if (sscanf(buf, "%s", fstype) == 0) {
 550                         zerror(zlogp, B_FALSE, "unable to parse %s", DFSTYPES);
 551                         free_remote_fstypes(types);
 552                         types = NULL;
 553                         goto out;
 554                 }
 555                 types[i] = strdup(fstype);
 556                 if (types[i] == NULL) {
 557                         zerror(zlogp, B_TRUE, "memory allocation failed");
 558                         free_remote_fstypes(types);
 559                         types = NULL;
 560                         goto out;
 561                 }
 562                 i++;
 563         }
 564 out:
 565         (void) fclose(fp);
 566         return (types);
 567 }
 568 
 569 static boolean_t
 570 is_remote_fstype(const char *fstype, char *const *remote_fstypes)
 571 {
 572         uint_t i;
 573 
 574         if (remote_fstypes == NULL)
 575                 return (B_FALSE);
 576         for (i = 0; remote_fstypes[i] != NULL; i++) {
 577                 if (strcmp(remote_fstypes[i], fstype) == 0)
 578                         return (B_TRUE);
 579         }
 580         return (B_FALSE);
 581 }
 582 
 583 /*
 584  * This converts a zone root path (normally of the form .../root) to a Live
 585  * Upgrade scratch zone root (of the form .../lu).
 586  */
 587 static void
 588 root_to_lu(zlog_t *zlogp, char *zroot, size_t zrootlen, boolean_t isresolved)
 589 {
 590         if (!isresolved && zonecfg_in_alt_root())
 591                 resolve_lofs(zlogp, zroot, zrootlen);
 592         (void) strcpy(strrchr(zroot, '/') + 1, "lu");
 593 }
 594 
 595 /*
 596  * The general strategy for unmounting filesystems is as follows:
 597  *
 598  * - Remote filesystems may be dead, and attempting to contact them as
 599  * part of a regular unmount may hang forever; we want to always try to
 600  * forcibly unmount such filesystems and only fall back to regular
 601  * unmounts if the filesystem doesn't support forced unmounts.
 602  *
 603  * - We don't want to unnecessarily corrupt metadata on local
 604  * filesystems (ie UFS), so we want to start off with graceful unmounts,
 605  * and only escalate to doing forced unmounts if we get stuck.
 606  *
 607  * We start off walking backwards through the mount table.  This doesn't
 608  * give us strict ordering but ensures that we try to unmount submounts
 609  * first.  We thus limit the number of failed umount2(2) calls.
 610  *
 611  * The mechanism for determining if we're stuck is to count the number
 612  * of failed unmounts each iteration through the mount table.  This
 613  * gives us an upper bound on the number of filesystems which remain
 614  * mounted (autofs trigger nodes are dealt with separately).  If at the
 615  * end of one unmount+autofs_cleanup cycle we still have the same number
 616  * of mounts that we started out with, we're stuck and try a forced
 617  * unmount.  If that fails (filesystem doesn't support forced unmounts)
 618  * then we bail and are unable to teardown the zone.  If it succeeds,
 619  * we're no longer stuck so we continue with our policy of trying
 620  * graceful mounts first.
 621  *
 622  * Zone must be down (ie, no processes or threads active).
 623  */
 624 static int
 625 unmount_filesystems(zlog_t *zlogp, zoneid_t zoneid, boolean_t unmount_cmd)
 626 {
 627         int error = 0;
 628         FILE *mnttab;
 629         struct mnttab *mnts;
 630         uint_t nmnt;
 631         char zroot[MAXPATHLEN + 1];
 632         size_t zrootlen;
 633         uint_t oldcount = UINT_MAX;
 634         boolean_t stuck = B_FALSE;
 635         char **remote_fstypes = NULL;
 636 
 637         if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
 638                 zerror(zlogp, B_FALSE, "unable to determine zone root");
 639                 return (-1);
 640         }
 641         if (unmount_cmd)
 642                 root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
 643 
 644         (void) strcat(zroot, "/");
 645         zrootlen = strlen(zroot);
 646 
 647         /*
 648          * For Trusted Extensions unmount each higher level zone's mount
 649          * of our zone's /export/home
 650          */
 651         if (!unmount_cmd)
 652                 tsol_unmounts(zlogp, zone_name);
 653 
 654         if ((mnttab = fopen(MNTTAB, "r")) == NULL) {
 655                 zerror(zlogp, B_TRUE, "failed to open %s", MNTTAB);
 656                 return (-1);
 657         }
 658         /*
 659          * Use our hacky mntfs ioctl so we see everything, even mounts with
 660          * MS_NOMNTTAB.
 661          */
 662         if (ioctl(fileno(mnttab), MNTIOC_SHOWHIDDEN, NULL) < 0) {
 663                 zerror(zlogp, B_TRUE, "unable to configure %s", MNTTAB);
 664                 error++;
 665                 goto out;
 666         }
 667 
 668         /*
 669          * Build the list of remote fstypes so we know which ones we
 670          * should forcibly unmount.
 671          */
 672         remote_fstypes = get_remote_fstypes(zlogp);
 673         for (; /* ever */; ) {
 674                 uint_t newcount = 0;
 675                 boolean_t unmounted;
 676                 struct mnttab *mnp;
 677                 char *path;
 678                 uint_t i;
 679 
 680                 mnts = NULL;
 681                 nmnt = 0;
 682                 /*
 683                  * MNTTAB gives us a way to walk through mounted
 684                  * filesystems; we need to be able to walk them in
 685                  * reverse order, so we build a list of all mounted
 686                  * filesystems.
 687                  */
 688                 if (build_mnttable(zlogp, zroot, zrootlen, mnttab, &mnts,
 689                     &nmnt) != 0) {
 690                         error++;
 691                         goto out;
 692                 }
 693                 for (i = 0; i < nmnt; i++) {
 694                         mnp = &mnts[nmnt - i - 1]; /* access in reverse order */
 695                         path = mnp->mnt_mountp;
 696                         unmounted = B_FALSE;
 697                         /*
 698                          * Try forced unmount first for remote filesystems.
 699                          *
 700                          * Not all remote filesystems support forced unmounts,
 701                          * so if this fails (ENOTSUP) we'll continue on
 702                          * and try a regular unmount.
 703                          */
 704                         if (is_remote_fstype(mnp->mnt_fstype, remote_fstypes)) {
 705                                 if (umount2(path, MS_FORCE) == 0)
 706                                         unmounted = B_TRUE;
 707                         }
 708                         /*
 709                          * Try forced unmount if we're stuck.
 710                          */
 711                         if (stuck) {
 712                                 if (umount2(path, MS_FORCE) == 0) {
 713                                         unmounted = B_TRUE;
 714                                         stuck = B_FALSE;
 715                                 } else {
 716                                         /*
 717                                          * The first failure indicates a
 718                                          * mount we won't be able to get
 719                                          * rid of automatically, so we
 720                                          * bail.
 721                                          */
 722                                         error++;
 723                                         zerror(zlogp, B_FALSE,
 724                                             "unable to unmount '%s'", path);
 725                                         free_mnttable(mnts, nmnt);
 726                                         goto out;
 727                                 }
 728                         }
 729                         /*
 730                          * Try regular unmounts for everything else.
 731                          */
 732                         if (!unmounted && umount2(path, 0) != 0)
 733                                 newcount++;
 734                 }
 735                 free_mnttable(mnts, nmnt);
 736 
 737                 if (newcount == 0)
 738                         break;
 739                 if (newcount >= oldcount) {
 740                         /*
 741                          * Last round didn't unmount anything; we're stuck and
 742                          * should start trying forced unmounts.
 743                          */
 744                         stuck = B_TRUE;
 745                 }
 746                 oldcount = newcount;
 747 
 748                 /*
 749                  * Autofs doesn't let you unmount its trigger nodes from
 750                  * userland so we have to tell the kernel to cleanup for us.
 751                  */
 752                 if (autofs_cleanup(zoneid) != 0) {
 753                         zerror(zlogp, B_TRUE, "unable to remove autofs nodes");
 754                         error++;
 755                         goto out;
 756                 }
 757         }
 758 
 759 out:
 760         free_remote_fstypes(remote_fstypes);
 761         (void) fclose(mnttab);
 762         return (error ? -1 : 0);
 763 }
 764 
 765 static int
 766 fs_compare(const void *m1, const void *m2)
 767 {
 768         struct zone_fstab *i = (struct zone_fstab *)m1;
 769         struct zone_fstab *j = (struct zone_fstab *)m2;
 770 
 771         return (strcmp(i->zone_fs_dir, j->zone_fs_dir));
 772 }
 773 
 774 /*
 775  * Fork and exec (and wait for) the mentioned binary with the provided
 776  * arguments.  Returns (-1) if something went wrong with fork(2) or exec(2),
 777  * returns the exit status otherwise.
 778  *
 779  * If we were unable to exec the provided pathname (for whatever
 780  * reason), we return the special token ZEXIT_EXEC.  The current value
 781  * of ZEXIT_EXEC doesn't conflict with legitimate exit codes of the
 782  * consumers of this function; any future consumers must make sure this
 783  * remains the case.
 784  */
 785 static int
 786 forkexec(zlog_t *zlogp, const char *path, char *const argv[])
 787 {
 788         pid_t child_pid;
 789         int child_status = 0;
 790 
 791         /*
 792          * Do not let another thread localize a message while we are forking.
 793          */
 794         (void) mutex_lock(&msglock);
 795         child_pid = fork();
 796         (void) mutex_unlock(&msglock);
 797         if (child_pid == -1) {
 798                 zerror(zlogp, B_TRUE, "could not fork for %s", argv[0]);
 799                 return (-1);
 800         } else if (child_pid == 0) {
 801                 closefrom(0);
 802                 /* redirect stdin, stdout & stderr to /dev/null */
 803                 (void) open("/dev/null", O_RDONLY);     /* stdin */
 804                 (void) open("/dev/null", O_WRONLY);     /* stdout */
 805                 (void) open("/dev/null", O_WRONLY);     /* stderr */
 806                 (void) execv(path, argv);
 807                 /*
 808                  * Since we are in the child, there is no point calling zerror()
 809                  * since there is nobody waiting to consume it.  So exit with a
 810                  * special code that the parent will recognize and call zerror()
 811                  * accordingly.
 812                  */
 813 
 814                 _exit(ZEXIT_EXEC);
 815         } else {
 816                 (void) waitpid(child_pid, &child_status, 0);
 817         }
 818 
 819         if (WIFSIGNALED(child_status)) {
 820                 zerror(zlogp, B_FALSE, "%s unexpectedly terminated due to "
 821                     "signal %d", path, WTERMSIG(child_status));
 822                 return (-1);
 823         }
 824         assert(WIFEXITED(child_status));
 825         if (WEXITSTATUS(child_status) == ZEXIT_EXEC) {
 826                 zerror(zlogp, B_FALSE, "failed to exec %s", path);
 827                 return (-1);
 828         }
 829         return (WEXITSTATUS(child_status));
 830 }
 831 
 832 static int
 833 isregfile(const char *path)
 834 {
 835         struct stat64 st;
 836 
 837         if (stat64(path, &st) == -1)
 838                 return (-1);
 839 
 840         return (S_ISREG(st.st_mode));
 841 }
 842 
 843 static int
 844 dofsck(zlog_t *zlogp, const char *fstype, const char *rawdev)
 845 {
 846         char cmdbuf[MAXPATHLEN];
 847         char *argv[5];
 848         int status;
 849 
 850         /*
 851          * We could alternatively have called /usr/sbin/fsck -F <fstype>, but
 852          * that would cost us an extra fork/exec without buying us anything.
 853          */
 854         if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/fsck", fstype)
 855             >= sizeof (cmdbuf)) {
 856                 zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
 857                 return (-1);
 858         }
 859 
 860         /*
 861          * If it doesn't exist, that's OK: we verified this previously
 862          * in zoneadm.
 863          */
 864         if (isregfile(cmdbuf) == -1)
 865                 return (0);
 866 
 867         argv[0] = "fsck";
 868         argv[1] = "-o";
 869         argv[2] = "p";
 870         argv[3] = (char *)rawdev;
 871         argv[4] = NULL;
 872 
 873         status = forkexec(zlogp, cmdbuf, argv);
 874         if (status == 0 || status == -1)
 875                 return (status);
 876         zerror(zlogp, B_FALSE, "fsck of '%s' failed with exit status %d; "
 877             "run fsck manually", rawdev, status);
 878         return (-1);
 879 }
 880 
 881 static int
 882 domount(zlog_t *zlogp, const char *fstype, const char *opts,
 883     const char *special, const char *directory)
 884 {
 885         char cmdbuf[MAXPATHLEN];
 886         char *argv[6];
 887         int status;
 888 
 889         /*
 890          * We could alternatively have called /usr/sbin/mount -F <fstype>, but
 891          * that would cost us an extra fork/exec without buying us anything.
 892          */
 893         if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/mount", fstype)
 894             >= sizeof (cmdbuf)) {
 895                 zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
 896                 return (-1);
 897         }
 898         argv[0] = "mount";
 899         if (opts[0] == '\0') {
 900                 argv[1] = (char *)special;
 901                 argv[2] = (char *)directory;
 902                 argv[3] = NULL;
 903         } else {
 904                 argv[1] = "-o";
 905                 argv[2] = (char *)opts;
 906                 argv[3] = (char *)special;
 907                 argv[4] = (char *)directory;
 908                 argv[5] = NULL;
 909         }
 910 
 911         status = forkexec(zlogp, cmdbuf, argv);
 912         if (status == 0 || status == -1)
 913                 return (status);
 914         if (opts[0] == '\0')
 915                 zerror(zlogp, B_FALSE, "\"%s %s %s\" "
 916                     "failed with exit code %d",
 917                     cmdbuf, special, directory, status);
 918         else
 919                 zerror(zlogp, B_FALSE, "\"%s -o %s %s %s\" "
 920                     "failed with exit code %d",
 921                     cmdbuf, opts, special, directory, status);
 922         return (-1);
 923 }
 924 
 925 /*
 926  * Check if a given mount point path exists.
 927  * If it does, make sure it doesn't contain any symlinks.
 928  * Note that if "leaf" is false we're checking an intermediate
 929  * component of the mount point path, so it must be a directory.
 930  * If "leaf" is true, then we're checking the entire mount point
 931  * path, so the mount point itself can be anything aside from a
 932  * symbolic link.
 933  *
 934  * If the path is invalid then a negative value is returned.  If the
 935  * path exists and is a valid mount point path then 0 is returned.
 936  * If the path doesn't exist return a positive value.
 937  */
 938 static int
 939 valid_mount_point(zlog_t *zlogp, const char *path, const boolean_t leaf)
 940 {
 941         struct stat statbuf;
 942         char respath[MAXPATHLEN];
 943         int res;
 944 
 945         if (lstat(path, &statbuf) != 0) {
 946                 if (errno == ENOENT)
 947                         return (1);
 948                 zerror(zlogp, B_TRUE, "can't stat %s", path);
 949                 return (-1);
 950         }
 951         if (S_ISLNK(statbuf.st_mode)) {
 952                 zerror(zlogp, B_FALSE, "%s is a symlink", path);
 953                 return (-1);
 954         }
 955         if (!leaf && !S_ISDIR(statbuf.st_mode)) {
 956                 zerror(zlogp, B_FALSE, "%s is not a directory", path);
 957                 return (-1);
 958         }
 959         if ((res = resolvepath(path, respath, sizeof (respath))) == -1) {
 960                 zerror(zlogp, B_TRUE, "unable to resolve path %s", path);
 961                 return (-1);
 962         }
 963         respath[res] = '\0';
 964         if (strcmp(path, respath) != 0) {
 965                 /*
 966                  * We don't like ".."s, "."s, or "//"s throwing us off
 967                  */
 968                 zerror(zlogp, B_FALSE, "%s is not a canonical path", path);
 969                 return (-1);
 970         }
 971         return (0);
 972 }
 973 
 974 /*
 975  * Validate a mount point path.  A valid mount point path is an
 976  * absolute path that either doesn't exist, or, if it does exists it
 977  * must be an absolute canonical path that doesn't have any symbolic
 978  * links in it.  The target of a mount point path can be any filesystem
 979  * object.  (Different filesystems can support different mount points,
 980  * for example "lofs" and "mntfs" both support files and directories
 981  * while "ufs" just supports directories.)
 982  *
 983  * If the path is invalid then a negative value is returned.  If the
 984  * path exists and is a valid mount point path then 0 is returned.
 985  * If the path doesn't exist return a positive value.
 986  */
 987 int
 988 valid_mount_path(zlog_t *zlogp, const char *rootpath, const char *spec,
 989     const char *dir, const char *fstype)
 990 {
 991         char abspath[MAXPATHLEN], *slashp, *slashp_next;
 992         int rv;
 993 
 994         /*
 995          * Sanity check the target mount point path.
 996          * It must be a non-null string that starts with a '/'.
 997          */
 998         if (dir[0] != '/') {
 999                 /* Something went wrong. */
1000                 zerror(zlogp, B_FALSE, "invalid mount directory, "
1001                     "type: \"%s\", special: \"%s\", dir: \"%s\"",
1002                     fstype, spec, dir);
1003                 return (-1);
1004         }
1005 
1006         /*
1007          * Join rootpath and dir.  Make sure abspath ends with '/', this
1008          * is added to all paths (even non-directory paths) to allow us
1009          * to detect the end of paths below.  If the path already ends
1010          * in a '/', then that's ok too (although we'll fail the
1011          * cannonical path check in valid_mount_point()).
1012          */
1013         if (snprintf(abspath, sizeof (abspath),
1014             "%s%s/", rootpath, dir) >= sizeof (abspath)) {
1015                 zerror(zlogp, B_FALSE, "pathname %s%s is too long",
1016                     rootpath, dir);
1017                 return (-1);
1018         }
1019 
1020         /*
1021          * Starting with rootpath, verify the mount path one component
1022          * at a time.  Continue until we've evaluated all of abspath.
1023          */
1024         slashp = &abspath[strlen(rootpath)];
1025         assert(*slashp == '/');
1026         do {
1027                 slashp_next = strchr(slashp + 1, '/');
1028                 *slashp = '\0';
1029                 if (slashp_next != NULL) {
1030                         /* This is an intermediary mount path component. */
1031                         rv = valid_mount_point(zlogp, abspath, B_FALSE);
1032                 } else {
1033                         /* This is the last component of the mount path. */
1034                         rv = valid_mount_point(zlogp, abspath, B_TRUE);
1035                 }
1036                 if (rv < 0)
1037                         return (rv);
1038                 *slashp = '/';
1039         } while ((slashp = slashp_next) != NULL);
1040         return (rv);
1041 }
1042 
1043 static int
1044 mount_one_dev_device_cb(void *arg, const char *match, const char *name)
1045 {
1046         di_prof_t prof = arg;
1047 
1048         if (name == NULL)
1049                 return (di_prof_add_dev(prof, match));
1050         return (di_prof_add_map(prof, match, name));
1051 }
1052 
1053 static int
1054 mount_one_dev_symlink_cb(void *arg, const char *source, const char *target)
1055 {
1056         di_prof_t prof = arg;
1057 
1058         return (di_prof_add_symlink(prof, source, target));
1059 }
1060 
1061 int
1062 vplat_get_iptype(zlog_t *zlogp, zone_iptype_t *iptypep)
1063 {
1064         zone_dochandle_t handle;
1065 
1066         if ((handle = zonecfg_init_handle()) == NULL) {
1067                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
1068                 return (-1);
1069         }
1070         if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
1071                 zerror(zlogp, B_FALSE, "invalid configuration");
1072                 zonecfg_fini_handle(handle);
1073                 return (-1);
1074         }
1075         if (zonecfg_get_iptype(handle, iptypep) != Z_OK) {
1076                 zerror(zlogp, B_FALSE, "invalid ip-type configuration");
1077                 zonecfg_fini_handle(handle);
1078                 return (-1);
1079         }
1080         zonecfg_fini_handle(handle);
1081         return (0);
1082 }
1083 
1084 /*
1085  * Apply the standard lists of devices/symlinks/mappings and the user-specified
1086  * list of devices (via zonecfg) to the /dev filesystem.  The filesystem will
1087  * use these as a profile/filter to determine what exists in /dev.
1088  */
1089 static int
1090 mount_one_dev(zlog_t *zlogp, char *devpath, zone_mnt_t mount_cmd)
1091 {
1092         char                    brand[MAXNAMELEN];
1093         zone_dochandle_t        handle = NULL;
1094         brand_handle_t          bh = NULL;
1095         struct zone_devtab      ztab;
1096         di_prof_t               prof = NULL;
1097         int                     err;
1098         int                     retval = -1;
1099         zone_iptype_t           iptype;
1100         const char              *curr_iptype;
1101 
1102         if (di_prof_init(devpath, &prof)) {
1103                 zerror(zlogp, B_TRUE, "failed to initialize profile");
1104                 goto cleanup;
1105         }
1106 
1107         /*
1108          * Get a handle to the brand info for this zone.
1109          * If we are mounting the zone, then we must always use the default
1110          * brand device mounts.
1111          */
1112         if (ALT_MOUNT(mount_cmd)) {
1113                 (void) strlcpy(brand, default_brand, sizeof (brand));
1114         } else {
1115                 (void) strlcpy(brand, brand_name, sizeof (brand));
1116         }
1117 
1118         if ((bh = brand_open(brand)) == NULL) {
1119                 zerror(zlogp, B_FALSE, "unable to determine zone brand");
1120                 goto cleanup;
1121         }
1122 
1123         if (vplat_get_iptype(zlogp, &iptype) < 0) {
1124                 zerror(zlogp, B_TRUE, "unable to determine ip-type");
1125                 goto cleanup;
1126         }
1127         switch (iptype) {
1128         case ZS_SHARED:
1129                 curr_iptype = "shared";
1130                 break;
1131         case ZS_EXCLUSIVE:
1132                 curr_iptype = "exclusive";
1133                 break;
1134         }
1135 
1136         if (brand_platform_iter_devices(bh, zone_name,
1137             mount_one_dev_device_cb, prof, curr_iptype) != 0) {
1138                 zerror(zlogp, B_TRUE, "failed to add standard device");
1139                 goto cleanup;
1140         }
1141 
1142         if (brand_platform_iter_link(bh,
1143             mount_one_dev_symlink_cb, prof) != 0) {
1144                 zerror(zlogp, B_TRUE, "failed to add standard symlink");
1145                 goto cleanup;
1146         }
1147 
1148         /* Add user-specified devices and directories */
1149         if ((handle = zonecfg_init_handle()) == NULL) {
1150                 zerror(zlogp, B_FALSE, "can't initialize zone handle");
1151                 goto cleanup;
1152         }
1153         if (err = zonecfg_get_handle(zone_name, handle)) {
1154                 zerror(zlogp, B_FALSE, "can't get handle for zone "
1155                     "%s: %s", zone_name, zonecfg_strerror(err));
1156                 goto cleanup;
1157         }
1158         if (err = zonecfg_setdevent(handle)) {
1159                 zerror(zlogp, B_FALSE, "%s: %s", zone_name,
1160                     zonecfg_strerror(err));
1161                 goto cleanup;
1162         }
1163         while (zonecfg_getdevent(handle, &ztab) == Z_OK) {
1164                 if (di_prof_add_dev(prof, ztab.zone_dev_match)) {
1165                         zerror(zlogp, B_TRUE, "failed to add "
1166                             "user-specified device");
1167                         goto cleanup;
1168                 }
1169         }
1170         (void) zonecfg_enddevent(handle);
1171 
1172         /* Send profile to kernel */
1173         if (di_prof_commit(prof)) {
1174                 zerror(zlogp, B_TRUE, "failed to commit profile");
1175                 goto cleanup;
1176         }
1177 
1178         retval = 0;
1179 
1180 cleanup:
1181         if (bh != NULL)
1182                 brand_close(bh);
1183         if (handle != NULL)
1184                 zonecfg_fini_handle(handle);
1185         if (prof)
1186                 di_prof_fini(prof);
1187         return (retval);
1188 }
1189 
1190 static int
1191 mount_one(zlog_t *zlogp, struct zone_fstab *fsptr, const char *rootpath,
1192     zone_mnt_t mount_cmd)
1193 {
1194         char path[MAXPATHLEN];
1195         char optstr[MAX_MNTOPT_STR];
1196         zone_fsopt_t *optptr;
1197         int rv;
1198 
1199         if ((rv = valid_mount_path(zlogp, rootpath, fsptr->zone_fs_special,
1200             fsptr->zone_fs_dir, fsptr->zone_fs_type)) < 0) {
1201                 zerror(zlogp, B_FALSE, "%s%s is not a valid mount point",
1202                     rootpath, fsptr->zone_fs_dir);
1203                 return (-1);
1204         } else if (rv > 0) {
1205                 /* The mount point path doesn't exist, create it now. */
1206                 if (make_one_dir(zlogp, rootpath, fsptr->zone_fs_dir,
1207                     DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
1208                     DEFAULT_DIR_GROUP) != 0) {
1209                         zerror(zlogp, B_FALSE, "failed to create mount point");
1210                         return (-1);
1211                 }
1212 
1213                 /*
1214                  * Now this might seem weird, but we need to invoke
1215                  * valid_mount_path() again.  Why?  Because it checks
1216                  * to make sure that the mount point path is canonical,
1217                  * which it can only do if the path exists, so now that
1218                  * we've created the path we have to verify it again.
1219                  */
1220                 if ((rv = valid_mount_path(zlogp, rootpath,
1221                     fsptr->zone_fs_special, fsptr->zone_fs_dir,
1222                     fsptr->zone_fs_type)) < 0) {
1223                         zerror(zlogp, B_FALSE,
1224                             "%s%s is not a valid mount point",
1225                             rootpath, fsptr->zone_fs_dir);
1226                         return (-1);
1227                 }
1228         }
1229 
1230         (void) snprintf(path, sizeof (path), "%s%s", rootpath,
1231             fsptr->zone_fs_dir);
1232 
1233         /*
1234          * In general the strategy here is to do just as much verification as
1235          * necessary to avoid crashing or otherwise doing something bad; if the
1236          * administrator initiated the operation via zoneadm(1m), he'll get
1237          * auto-verification which will let him know what's wrong.  If he
1238          * modifies the zone configuration of a running zone and doesn't attempt
1239          * to verify that it's OK we won't crash but won't bother trying to be
1240          * too helpful either.  zoneadm verify is only a couple keystrokes away.
1241          */
1242         if (!zonecfg_valid_fs_type(fsptr->zone_fs_type)) {
1243                 zerror(zlogp, B_FALSE, "cannot mount %s on %s: "
1244                     "invalid file-system type %s", fsptr->zone_fs_special,
1245                     fsptr->zone_fs_dir, fsptr->zone_fs_type);
1246                 return (-1);
1247         }
1248 
1249         /*
1250          * If we're looking at an alternate root environment, then construct
1251          * read-only loopback mounts as necessary.  Note that any special
1252          * paths for lofs zone mounts in an alternate root must have
1253          * already been pre-pended with any alternate root path by the
1254          * time we get here.
1255          */
1256         if (zonecfg_in_alt_root()) {
1257                 struct stat64 st;
1258 
1259                 if (stat64(fsptr->zone_fs_special, &st) != -1 &&
1260                     S_ISBLK(st.st_mode)) {
1261                         /*
1262                          * If we're going to mount a block device we need
1263                          * to check if that device is already mounted
1264                          * somewhere else, and if so, do a lofs mount
1265                          * of the device instead of a direct mount
1266                          */
1267                         if (check_lofs_needed(zlogp, fsptr) == -1)
1268                                 return (-1);
1269                 } else if (strcmp(fsptr->zone_fs_type, MNTTYPE_LOFS) == 0) {
1270                         /*
1271                          * For lofs mounts, the special node is inside the
1272                          * alternate root.  We need lofs resolution for
1273                          * this case in order to get at the underlying
1274                          * read-write path.
1275                          */
1276                         resolve_lofs(zlogp, fsptr->zone_fs_special,
1277                             sizeof (fsptr->zone_fs_special));
1278                 }
1279         }
1280 
1281         /*
1282          * Run 'fsck -m' if there's a device to fsck.
1283          */
1284         if (fsptr->zone_fs_raw[0] != '\0' &&
1285             dofsck(zlogp, fsptr->zone_fs_type, fsptr->zone_fs_raw) != 0) {
1286                 return (-1);
1287         } else if (isregfile(fsptr->zone_fs_special) == 1 &&
1288             dofsck(zlogp, fsptr->zone_fs_type, fsptr->zone_fs_special) != 0) {
1289                 return (-1);
1290         }
1291 
1292         /*
1293          * Build up mount option string.
1294          */
1295         optstr[0] = '\0';
1296         if (fsptr->zone_fs_options != NULL) {
1297                 (void) strlcpy(optstr, fsptr->zone_fs_options->zone_fsopt_opt,
1298                     sizeof (optstr));
1299                 for (optptr = fsptr->zone_fs_options->zone_fsopt_next;
1300                     optptr != NULL; optptr = optptr->zone_fsopt_next) {
1301                         (void) strlcat(optstr, ",", sizeof (optstr));
1302                         (void) strlcat(optstr, optptr->zone_fsopt_opt,
1303                             sizeof (optstr));
1304                 }
1305         }
1306 
1307         if ((rv = domount(zlogp, fsptr->zone_fs_type, optstr,
1308             fsptr->zone_fs_special, path)) != 0)
1309                 return (rv);
1310 
1311         /*
1312          * The mount succeeded.  If this was not a mount of /dev then
1313          * we're done.
1314          */
1315         if (strcmp(fsptr->zone_fs_type, MNTTYPE_DEV) != 0)
1316                 return (0);
1317 
1318         /*
1319          * We just mounted an instance of a /dev filesystem, so now we
1320          * need to configure it.
1321          */
1322         return (mount_one_dev(zlogp, path, mount_cmd));
1323 }
1324 
1325 static void
1326 free_fs_data(struct zone_fstab *fsarray, uint_t nelem)
1327 {
1328         uint_t i;
1329 
1330         if (fsarray == NULL)
1331                 return;
1332         for (i = 0; i < nelem; i++)
1333                 zonecfg_free_fs_option_list(fsarray[i].zone_fs_options);
1334         free(fsarray);
1335 }
1336 
1337 /*
1338  * This function initiates the creation of a small Solaris Environment for
1339  * scratch zone. The Environment creation process is split up into two
1340  * functions(build_mounted_pre_var() and build_mounted_post_var()). It
1341  * is done this way because:
1342  *      We need to have both /etc and /var in the root of the scratchzone.
1343  *      We loopback mount zone's own /etc and /var into the root of the
1344  *      scratch zone. Unlike /etc, /var can be a seperate filesystem. So we
1345  *      need to delay the mount of /var till the zone's root gets populated.
1346  *      So mounting of localdirs[](/etc and /var) have been moved to the
1347  *      build_mounted_post_var() which gets called only after the zone
1348  *      specific filesystems are mounted.
1349  *
1350  * Note that the scratch zone we set up for updating the zone (Z_MNT_UPDATE)
1351  * does not loopback mount the zone's own /etc and /var into the root of the
1352  * scratch zone.
1353  */
1354 static boolean_t
1355 build_mounted_pre_var(zlog_t *zlogp, char *rootpath,
1356     size_t rootlen, const char *zonepath, char *luroot, size_t lurootlen)
1357 {
1358         char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1359         const char **cpp;
1360         static const char *mkdirs[] = {
1361                 "/system", "/system/contract", "/system/object", "/proc",
1362                 "/dev", "/tmp", "/a", NULL
1363         };
1364         char *altstr;
1365         FILE *fp;
1366         uuid_t uuid;
1367 
1368         resolve_lofs(zlogp, rootpath, rootlen);
1369         (void) snprintf(luroot, lurootlen, "%s/lu", zonepath);
1370         resolve_lofs(zlogp, luroot, lurootlen);
1371         (void) snprintf(tmp, sizeof (tmp), "%s/bin", luroot);
1372         (void) symlink("./usr/bin", tmp);
1373 
1374         /*
1375          * These are mostly special mount points; not handled here.  (See
1376          * zone_mount_early.)
1377          */
1378         for (cpp = mkdirs; *cpp != NULL; cpp++) {
1379                 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1380                 if (mkdir(tmp, 0755) != 0) {
1381                         zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1382                         return (B_FALSE);
1383                 }
1384         }
1385         /*
1386          * This is here to support lucopy.  If there's an instance of this same
1387          * zone on the current running system, then we mount its root up as
1388          * read-only inside the scratch zone.
1389          */
1390         (void) zonecfg_get_uuid(zone_name, uuid);
1391         altstr = strdup(zonecfg_get_root());
1392         if (altstr == NULL) {
1393                 zerror(zlogp, B_TRUE, "memory allocation failed");
1394                 return (B_FALSE);
1395         }
1396         zonecfg_set_root("");
1397         (void) strlcpy(tmp, zone_name, sizeof (tmp));
1398         (void) zonecfg_get_name_by_uuid(uuid, tmp, sizeof (tmp));
1399         if (zone_get_rootpath(tmp, fromdir, sizeof (fromdir)) == Z_OK &&
1400             strcmp(fromdir, rootpath) != 0) {
1401                 (void) snprintf(tmp, sizeof (tmp), "%s/b", luroot);
1402                 if (mkdir(tmp, 0755) != 0) {
1403                         zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1404                         return (B_FALSE);
1405                 }
1406                 if (domount(zlogp, MNTTYPE_LOFS, RESOURCE_DEFAULT_OPTS, fromdir,
1407                     tmp) != 0) {
1408                         zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1409                             fromdir);
1410                         return (B_FALSE);
1411                 }
1412         }
1413         zonecfg_set_root(altstr);
1414         free(altstr);
1415 
1416         if ((fp = zonecfg_open_scratch(luroot, B_TRUE)) == NULL) {
1417                 zerror(zlogp, B_TRUE, "cannot open zone mapfile");
1418                 return (B_FALSE);
1419         }
1420         (void) ftruncate(fileno(fp), 0);
1421         if (zonecfg_add_scratch(fp, zone_name, kernzone, "/") == -1) {
1422                 zerror(zlogp, B_TRUE, "cannot add zone mapfile entry");
1423         }
1424         zonecfg_close_scratch(fp);
1425         (void) snprintf(tmp, sizeof (tmp), "%s/a", luroot);
1426         if (domount(zlogp, MNTTYPE_LOFS, "", rootpath, tmp) != 0)
1427                 return (B_FALSE);
1428         (void) strlcpy(rootpath, tmp, rootlen);
1429         return (B_TRUE);
1430 }
1431 
1432 
1433 static boolean_t
1434 build_mounted_post_var(zlog_t *zlogp, zone_mnt_t mount_cmd, char *rootpath,
1435     const char *luroot)
1436 {
1437         char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1438         const char **cpp;
1439         const char **loopdirs;
1440         const char **tmpdirs;
1441         static const char *localdirs[] = {
1442                 "/etc", "/var", NULL
1443         };
1444         static const char *scr_loopdirs[] = {
1445                 "/etc/lib", "/etc/fs", "/lib", "/sbin", "/platform",
1446                 "/usr", NULL
1447         };
1448         static const char *upd_loopdirs[] = {
1449                 "/etc", "/kernel", "/lib", "/opt", "/platform", "/sbin",
1450                 "/usr", "/var", NULL
1451         };
1452         static const char *scr_tmpdirs[] = {
1453                 "/tmp", "/var/run", NULL
1454         };
1455         static const char *upd_tmpdirs[] = {
1456                 "/tmp", "/var/run", "/var/tmp", NULL
1457         };
1458         struct stat st;
1459 
1460         if (mount_cmd == Z_MNT_SCRATCH) {
1461                 /*
1462                  * These are mounted read-write from the zone undergoing
1463                  * upgrade.  We must be careful not to 'leak' things from the
1464                  * main system into the zone, and this accomplishes that goal.
1465                  */
1466                 for (cpp = localdirs; *cpp != NULL; cpp++) {
1467                         (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot,
1468                             *cpp);
1469                         (void) snprintf(fromdir, sizeof (fromdir), "%s%s",
1470                             rootpath, *cpp);
1471                         if (mkdir(tmp, 0755) != 0) {
1472                                 zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1473                                 return (B_FALSE);
1474                         }
1475                         if (domount(zlogp, MNTTYPE_LOFS, "", fromdir, tmp)
1476                             != 0) {
1477                                 zerror(zlogp, B_TRUE, "cannot mount %s on %s",
1478                                     tmp, *cpp);
1479                                 return (B_FALSE);
1480                         }
1481                 }
1482         }
1483 
1484         if (mount_cmd == Z_MNT_UPDATE)
1485                 loopdirs = upd_loopdirs;
1486         else
1487                 loopdirs = scr_loopdirs;
1488 
1489         /*
1490          * These are things mounted read-only from the running system because
1491          * they contain binaries that must match system.
1492          */
1493         for (cpp = loopdirs; *cpp != NULL; cpp++) {
1494                 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1495                 if (mkdir(tmp, 0755) != 0) {
1496                         if (errno != EEXIST) {
1497                                 zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1498                                 return (B_FALSE);
1499                         }
1500                         if (lstat(tmp, &st) != 0) {
1501                                 zerror(zlogp, B_TRUE, "cannot stat %s", tmp);
1502                                 return (B_FALSE);
1503                         }
1504                         /*
1505                          * Ignore any non-directories encountered.  These are
1506                          * things that have been converted into symlinks
1507                          * (/etc/fs and /etc/lib) and no longer need a lofs
1508                          * fixup.
1509                          */
1510                         if (!S_ISDIR(st.st_mode))
1511                                 continue;
1512                 }
1513                 if (domount(zlogp, MNTTYPE_LOFS, RESOURCE_DEFAULT_OPTS, *cpp,
1514                     tmp) != 0) {
1515                         zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1516                             *cpp);
1517                         return (B_FALSE);
1518                 }
1519         }
1520 
1521         if (mount_cmd == Z_MNT_UPDATE)
1522                 tmpdirs = upd_tmpdirs;
1523         else
1524                 tmpdirs = scr_tmpdirs;
1525 
1526         /*
1527          * These are things with tmpfs mounted inside.
1528          */
1529         for (cpp = tmpdirs; *cpp != NULL; cpp++) {
1530                 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1531                 if (mount_cmd == Z_MNT_SCRATCH && mkdir(tmp, 0755) != 0 &&
1532                     errno != EEXIST) {
1533                         zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1534                         return (B_FALSE);
1535                 }
1536 
1537                 /*
1538                  * We could set the mode for /tmp when we do the mkdir but
1539                  * since that can be modified by the umask we will just set
1540                  * the correct mode for /tmp now.
1541                  */
1542                 if (strcmp(*cpp, "/tmp") == 0 && chmod(tmp, 01777) != 0) {
1543                         zerror(zlogp, B_TRUE, "cannot chmod %s", tmp);
1544                         return (B_FALSE);
1545                 }
1546 
1547                 if (domount(zlogp, MNTTYPE_TMPFS, "", "swap", tmp) != 0) {
1548                         zerror(zlogp, B_TRUE, "cannot mount swap on %s", *cpp);
1549                         return (B_FALSE);
1550                 }
1551         }
1552         return (B_TRUE);
1553 }
1554 
1555 typedef struct plat_gmount_cb_data {
1556         zlog_t                  *pgcd_zlogp;
1557         struct zone_fstab       **pgcd_fs_tab;
1558         int                     *pgcd_num_fs;
1559 } plat_gmount_cb_data_t;
1560 
1561 /*
1562  * plat_gmount_cb() is a callback function invoked by libbrand to iterate
1563  * through all global brand platform mounts.
1564  */
1565 int
1566 plat_gmount_cb(void *data, const char *spec, const char *dir,
1567     const char *fstype, const char *opt)
1568 {
1569         plat_gmount_cb_data_t   *cp = data;
1570         zlog_t                  *zlogp = cp->pgcd_zlogp;
1571         struct zone_fstab       *fs_ptr = *cp->pgcd_fs_tab;
1572         int                     num_fs = *cp->pgcd_num_fs;
1573         struct zone_fstab       *fsp, *tmp_ptr;
1574 
1575         num_fs++;
1576         if ((tmp_ptr = realloc(fs_ptr, num_fs * sizeof (*tmp_ptr))) == NULL) {
1577                 zerror(zlogp, B_TRUE, "memory allocation failed");
1578                 return (-1);
1579         }
1580 
1581         fs_ptr = tmp_ptr;
1582         fsp = &fs_ptr[num_fs - 1];
1583 
1584         /* update the callback struct passed in */
1585         *cp->pgcd_fs_tab = fs_ptr;
1586         *cp->pgcd_num_fs = num_fs;
1587 
1588         fsp->zone_fs_raw[0] = '\0';
1589         (void) strlcpy(fsp->zone_fs_special, spec,
1590             sizeof (fsp->zone_fs_special));
1591         (void) strlcpy(fsp->zone_fs_dir, dir, sizeof (fsp->zone_fs_dir));
1592         (void) strlcpy(fsp->zone_fs_type, fstype, sizeof (fsp->zone_fs_type));
1593         fsp->zone_fs_options = NULL;
1594         if ((opt != NULL) &&
1595             (zonecfg_add_fs_option(fsp, (char *)opt) != Z_OK)) {
1596                 zerror(zlogp, B_FALSE, "error adding property");
1597                 return (-1);
1598         }
1599 
1600         return (0);
1601 }
1602 
1603 static int
1604 mount_filesystems_fsent(zone_dochandle_t handle, zlog_t *zlogp,
1605     struct zone_fstab **fs_tabp, int *num_fsp, zone_mnt_t mount_cmd)
1606 {
1607         struct zone_fstab *tmp_ptr, *fs_ptr, *fsp, fstab;
1608         int num_fs;
1609 
1610         num_fs = *num_fsp;
1611         fs_ptr = *fs_tabp;
1612 
1613         if (zonecfg_setfsent(handle) != Z_OK) {
1614                 zerror(zlogp, B_FALSE, "invalid configuration");
1615                 return (-1);
1616         }
1617         while (zonecfg_getfsent(handle, &fstab) == Z_OK) {
1618                 /*
1619                  * ZFS filesystems will not be accessible under an alternate
1620                  * root, since the pool will not be known.  Ignore them in this
1621                  * case.
1622                  */
1623                 if (ALT_MOUNT(mount_cmd) &&
1624                     strcmp(fstab.zone_fs_type, MNTTYPE_ZFS) == 0)
1625                         continue;
1626 
1627                 num_fs++;
1628                 if ((tmp_ptr = realloc(fs_ptr,
1629                     num_fs * sizeof (*tmp_ptr))) == NULL) {
1630                         zerror(zlogp, B_TRUE, "memory allocation failed");
1631                         (void) zonecfg_endfsent(handle);
1632                         return (-1);
1633                 }
1634                 /* update the pointers passed in */
1635                 *fs_tabp = tmp_ptr;
1636                 *num_fsp = num_fs;
1637 
1638                 fs_ptr = tmp_ptr;
1639                 fsp = &fs_ptr[num_fs - 1];
1640                 (void) strlcpy(fsp->zone_fs_dir,
1641                     fstab.zone_fs_dir, sizeof (fsp->zone_fs_dir));
1642                 (void) strlcpy(fsp->zone_fs_raw, fstab.zone_fs_raw,
1643                     sizeof (fsp->zone_fs_raw));
1644                 (void) strlcpy(fsp->zone_fs_type, fstab.zone_fs_type,
1645                     sizeof (fsp->zone_fs_type));
1646                 fsp->zone_fs_options = fstab.zone_fs_options;
1647 
1648                 /*
1649                  * For all lofs mounts, make sure that the 'special'
1650                  * entry points inside the alternate root.  The
1651                  * source path for a lofs mount in a given zone needs
1652                  * to be relative to the root of the boot environment
1653                  * that contains the zone.  Note that we don't do this
1654                  * for non-lofs mounts since they will have a device
1655                  * as a backing store and device paths must always be
1656                  * specified relative to the current boot environment.
1657                  */
1658                 fsp->zone_fs_special[0] = '\0';
1659                 if (strcmp(fsp->zone_fs_type, MNTTYPE_LOFS) == 0) {
1660                         (void) strlcat(fsp->zone_fs_special, zonecfg_get_root(),
1661                             sizeof (fsp->zone_fs_special));
1662                 }
1663                 (void) strlcat(fsp->zone_fs_special, fstab.zone_fs_special,
1664                     sizeof (fsp->zone_fs_special));
1665         }
1666         (void) zonecfg_endfsent(handle);
1667         return (0);
1668 }
1669 
1670 static int
1671 mount_filesystems(zlog_t *zlogp, zone_mnt_t mount_cmd)
1672 {
1673         char rootpath[MAXPATHLEN];
1674         char zonepath[MAXPATHLEN];
1675         char brand[MAXNAMELEN];
1676         char luroot[MAXPATHLEN];
1677         int i, num_fs = 0;
1678         struct zone_fstab *fs_ptr = NULL;
1679         zone_dochandle_t handle = NULL;
1680         zone_state_t zstate;
1681         brand_handle_t bh;
1682         plat_gmount_cb_data_t cb;
1683 
1684         if (zone_get_state(zone_name, &zstate) != Z_OK ||
1685             (zstate != ZONE_STATE_READY && zstate != ZONE_STATE_MOUNTED)) {
1686                 zerror(zlogp, B_FALSE,
1687                     "zone must be in '%s' or '%s' state to mount file-systems",
1688                     zone_state_str(ZONE_STATE_READY),
1689                     zone_state_str(ZONE_STATE_MOUNTED));
1690                 goto bad;
1691         }
1692 
1693         if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
1694                 zerror(zlogp, B_TRUE, "unable to determine zone path");
1695                 goto bad;
1696         }
1697 
1698         if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
1699                 zerror(zlogp, B_TRUE, "unable to determine zone root");
1700                 goto bad;
1701         }
1702 
1703         if ((handle = zonecfg_init_handle()) == NULL) {
1704                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
1705                 goto bad;
1706         }
1707         if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK ||
1708             zonecfg_setfsent(handle) != Z_OK) {
1709                 zerror(zlogp, B_FALSE, "invalid configuration");
1710                 goto bad;
1711         }
1712 
1713         /*
1714          * If we are mounting the zone, then we must always use the default
1715          * brand global mounts.
1716          */
1717         if (ALT_MOUNT(mount_cmd)) {
1718                 (void) strlcpy(brand, default_brand, sizeof (brand));
1719         } else {
1720                 (void) strlcpy(brand, brand_name, sizeof (brand));
1721         }
1722 
1723         /* Get a handle to the brand info for this zone */
1724         if ((bh = brand_open(brand)) == NULL) {
1725                 zerror(zlogp, B_FALSE, "unable to determine zone brand");
1726                 zonecfg_fini_handle(handle);
1727                 return (-1);
1728         }
1729 
1730         /*
1731          * Get the list of global filesystems to mount from the brand
1732          * configuration.
1733          */
1734         cb.pgcd_zlogp = zlogp;
1735         cb.pgcd_fs_tab = &fs_ptr;
1736         cb.pgcd_num_fs = &num_fs;
1737         if (brand_platform_iter_gmounts(bh, zonepath,
1738             plat_gmount_cb, &cb) != 0) {
1739                 zerror(zlogp, B_FALSE, "unable to mount filesystems");
1740                 brand_close(bh);
1741                 zonecfg_fini_handle(handle);
1742                 return (-1);
1743         }
1744         brand_close(bh);
1745 
1746         /*
1747          * Iterate through the rest of the filesystems. Sort them all,
1748          * then mount them in sorted order. This is to make sure the
1749          * higher level directories (e.g., /usr) get mounted before
1750          * any beneath them (e.g., /usr/local).
1751          */
1752         if (mount_filesystems_fsent(handle, zlogp, &fs_ptr, &num_fs,
1753             mount_cmd) != 0)
1754                 goto bad;
1755 
1756         zonecfg_fini_handle(handle);
1757         handle = NULL;
1758 
1759         /*
1760          * Normally when we mount a zone all the zone filesystems
1761          * get mounted relative to rootpath, which is usually
1762          * <zonepath>/root.  But when mounting a zone for administration
1763          * purposes via the zone "mount" state, build_mounted_pre_var()
1764          * updates rootpath to be <zonepath>/lu/a so we'll mount all
1765          * the zones filesystems there instead.
1766          *
1767          * build_mounted_pre_var() and build_mounted_post_var() will
1768          * also do some extra work to create directories and lofs mount
1769          * a bunch of global zone file system paths into <zonepath>/lu.
1770          *
1771          * This allows us to be able to enter the zone (now rooted at
1772          * <zonepath>/lu) and run the upgrade/patch tools that are in the
1773          * global zone and have them upgrade the to-be-modified zone's
1774          * files mounted on /a.  (Which mirrors the existing standard
1775          * upgrade environment.)
1776          *
1777          * There is of course one catch.  When doing the upgrade
1778          * we need <zoneroot>/lu/dev to be the /dev filesystem
1779          * for the zone and we don't want to have any /dev filesystem
1780          * mounted at <zoneroot>/lu/a/dev.  Since /dev is specified
1781          * as a normal zone filesystem by default we'll try to mount
1782          * it at <zoneroot>/lu/a/dev, so we have to detect this
1783          * case and instead mount it at <zoneroot>/lu/dev.
1784          *
1785          * All this work is done in three phases:
1786          *   1) Create and populate lu directory (build_mounted_pre_var()).
1787          *   2) Mount the required filesystems as per the zone configuration.
1788          *   3) Set up the rest of the scratch zone environment
1789          *      (build_mounted_post_var()).
1790          */
1791         if (ALT_MOUNT(mount_cmd) && !build_mounted_pre_var(zlogp,
1792             rootpath, sizeof (rootpath), zonepath, luroot, sizeof (luroot)))
1793                 goto bad;
1794 
1795         qsort(fs_ptr, num_fs, sizeof (*fs_ptr), fs_compare);
1796 
1797         for (i = 0; i < num_fs; i++) {
1798                 if (ALT_MOUNT(mount_cmd) &&
1799                     strcmp(fs_ptr[i].zone_fs_dir, "/dev") == 0) {
1800                         size_t slen = strlen(rootpath) - 2;
1801 
1802                         /*
1803                          * By default we'll try to mount /dev as /a/dev
1804                          * but /dev is special and always goes at the top
1805                          * so strip the trailing '/a' from the rootpath.
1806                          */
1807                         assert(strcmp(&rootpath[slen], "/a") == 0);
1808                         rootpath[slen] = '\0';
1809                         if (mount_one(zlogp, &fs_ptr[i], rootpath, mount_cmd)
1810                             != 0)
1811                                 goto bad;
1812                         rootpath[slen] = '/';
1813                         continue;
1814                 }
1815                 if (mount_one(zlogp, &fs_ptr[i], rootpath, mount_cmd) != 0)
1816                         goto bad;
1817         }
1818         if (ALT_MOUNT(mount_cmd) &&
1819             !build_mounted_post_var(zlogp, mount_cmd, rootpath, luroot))
1820                 goto bad;
1821 
1822         /*
1823          * For Trusted Extensions cross-mount each lower level /export/home
1824          */
1825         if (mount_cmd == Z_MNT_BOOT &&
1826             tsol_mounts(zlogp, zone_name, rootpath) != 0)
1827                 goto bad;
1828 
1829         free_fs_data(fs_ptr, num_fs);
1830 
1831         /*
1832          * Everything looks fine.
1833          */
1834         return (0);
1835 
1836 bad:
1837         if (handle != NULL)
1838                 zonecfg_fini_handle(handle);
1839         free_fs_data(fs_ptr, num_fs);
1840         return (-1);
1841 }
1842 
1843 /* caller makes sure neither parameter is NULL */
1844 static int
1845 addr2netmask(char *prefixstr, int maxprefixlen, uchar_t *maskstr)
1846 {
1847         int prefixlen;
1848 
1849         prefixlen = atoi(prefixstr);
1850         if (prefixlen < 0 || prefixlen > maxprefixlen)
1851                 return (1);
1852         while (prefixlen > 0) {
1853                 if (prefixlen >= 8) {
1854                         *maskstr++ = 0xFF;
1855                         prefixlen -= 8;
1856                         continue;
1857                 }
1858                 *maskstr |= 1 << (8 - prefixlen);
1859                 prefixlen--;
1860         }
1861         return (0);
1862 }
1863 
1864 /*
1865  * Tear down all interfaces belonging to the given zone.  This should
1866  * be called with the zone in a state other than "running", so that
1867  * interfaces can't be assigned to the zone after this returns.
1868  *
1869  * If anything goes wrong, log an error message and return an error.
1870  */
1871 static int
1872 unconfigure_shared_network_interfaces(zlog_t *zlogp, zoneid_t zone_id)
1873 {
1874         struct lifnum lifn;
1875         struct lifconf lifc;
1876         struct lifreq *lifrp, lifrl;
1877         int64_t lifc_flags = LIFC_NOXMIT | LIFC_ALLZONES;
1878         int num_ifs, s, i, ret_code = 0;
1879         uint_t bufsize;
1880         char *buf = NULL;
1881 
1882         if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
1883                 zerror(zlogp, B_TRUE, "could not get socket");
1884                 ret_code = -1;
1885                 goto bad;
1886         }
1887         lifn.lifn_family = AF_UNSPEC;
1888         lifn.lifn_flags = (int)lifc_flags;
1889         if (ioctl(s, SIOCGLIFNUM, (char *)&lifn) < 0) {
1890                 zerror(zlogp, B_TRUE,
1891                     "could not determine number of network interfaces");
1892                 ret_code = -1;
1893                 goto bad;
1894         }
1895         num_ifs = lifn.lifn_count;
1896         bufsize = num_ifs * sizeof (struct lifreq);
1897         if ((buf = malloc(bufsize)) == NULL) {
1898                 zerror(zlogp, B_TRUE, "memory allocation failed");
1899                 ret_code = -1;
1900                 goto bad;
1901         }
1902         lifc.lifc_family = AF_UNSPEC;
1903         lifc.lifc_flags = (int)lifc_flags;
1904         lifc.lifc_len = bufsize;
1905         lifc.lifc_buf = buf;
1906         if (ioctl(s, SIOCGLIFCONF, (char *)&lifc) < 0) {
1907                 zerror(zlogp, B_TRUE, "could not get configured network "
1908                     "interfaces");
1909                 ret_code = -1;
1910                 goto bad;
1911         }
1912         lifrp = lifc.lifc_req;
1913         for (i = lifc.lifc_len / sizeof (struct lifreq); i > 0; i--, lifrp++) {
1914                 (void) close(s);
1915                 if ((s = socket(lifrp->lifr_addr.ss_family, SOCK_DGRAM, 0)) <
1916                     0) {
1917                         zerror(zlogp, B_TRUE, "%s: could not get socket",
1918                             lifrl.lifr_name);
1919                         ret_code = -1;
1920                         continue;
1921                 }
1922                 (void) memset(&lifrl, 0, sizeof (lifrl));
1923                 (void) strncpy(lifrl.lifr_name, lifrp->lifr_name,
1924                     sizeof (lifrl.lifr_name));
1925                 if (ioctl(s, SIOCGLIFZONE, (caddr_t)&lifrl) < 0) {
1926                         if (errno == ENXIO)
1927                                 /*
1928                                  * Interface may have been removed by admin or
1929                                  * another zone halting.
1930                                  */
1931                                 continue;
1932                         zerror(zlogp, B_TRUE,
1933                             "%s: could not determine the zone to which this "
1934                             "network interface is bound", lifrl.lifr_name);
1935                         ret_code = -1;
1936                         continue;
1937                 }
1938                 if (lifrl.lifr_zoneid == zone_id) {
1939                         if (ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifrl) < 0) {
1940                                 zerror(zlogp, B_TRUE,
1941                                     "%s: could not remove network interface",
1942                                     lifrl.lifr_name);
1943                                 ret_code = -1;
1944                                 continue;
1945                         }
1946                 }
1947         }
1948 bad:
1949         if (s > 0)
1950                 (void) close(s);
1951         if (buf)
1952                 free(buf);
1953         return (ret_code);
1954 }
1955 
1956 static union    sockunion {
1957         struct  sockaddr sa;
1958         struct  sockaddr_in sin;
1959         struct  sockaddr_dl sdl;
1960         struct  sockaddr_in6 sin6;
1961 } so_dst, so_ifp;
1962 
1963 static struct {
1964         struct  rt_msghdr hdr;
1965         char    space[512];
1966 } rtmsg;
1967 
1968 static int
1969 salen(struct sockaddr *sa)
1970 {
1971         switch (sa->sa_family) {
1972         case AF_INET:
1973                 return (sizeof (struct sockaddr_in));
1974         case AF_LINK:
1975                 return (sizeof (struct sockaddr_dl));
1976         case AF_INET6:
1977                 return (sizeof (struct sockaddr_in6));
1978         default:
1979                 return (sizeof (struct sockaddr));
1980         }
1981 }
1982 
1983 #define ROUNDUP_LONG(a) \
1984         ((a) > 0 ? (1 + (((a) - 1) | (sizeof (long) - 1))) : sizeof (long))
1985 
1986 /*
1987  * Look up which zone is using a given IP address.  The address in question
1988  * is expected to have been stuffed into the structure to which lifr points
1989  * via a previous SIOCGLIFADDR ioctl().
1990  *
1991  * This is done using black router socket magic.
1992  *
1993  * Return the name of the zone on success or NULL on failure.
1994  *
1995  * This is a lot of code for a simple task; a new ioctl request to take care
1996  * of this might be a useful RFE.
1997  */
1998 
1999 static char *
2000 who_is_using(zlog_t *zlogp, struct lifreq *lifr)
2001 {
2002         static char answer[ZONENAME_MAX];
2003         pid_t pid;
2004         int s, rlen, l, i;
2005         char *cp = rtmsg.space;
2006         struct sockaddr_dl *ifp = NULL;
2007         struct sockaddr *sa;
2008         char save_if_name[LIFNAMSIZ];
2009 
2010         answer[0] = '\0';
2011 
2012         pid = getpid();
2013         if ((s = socket(PF_ROUTE, SOCK_RAW, 0)) < 0) {
2014                 zerror(zlogp, B_TRUE, "could not get routing socket");
2015                 return (NULL);
2016         }
2017 
2018         if (lifr->lifr_addr.ss_family == AF_INET) {
2019                 struct sockaddr_in *sin4;
2020 
2021                 so_dst.sa.sa_family = AF_INET;
2022                 sin4 = (struct sockaddr_in *)&lifr->lifr_addr;
2023                 so_dst.sin.sin_addr = sin4->sin_addr;
2024         } else {
2025                 struct sockaddr_in6 *sin6;
2026 
2027                 so_dst.sa.sa_family = AF_INET6;
2028                 sin6 = (struct sockaddr_in6 *)&lifr->lifr_addr;
2029                 so_dst.sin6.sin6_addr = sin6->sin6_addr;
2030         }
2031 
2032         so_ifp.sa.sa_family = AF_LINK;
2033 
2034         (void) memset(&rtmsg, 0, sizeof (rtmsg));
2035         rtmsg.hdr.rtm_type = RTM_GET;
2036         rtmsg.hdr.rtm_flags = RTF_UP | RTF_HOST;
2037         rtmsg.hdr.rtm_version = RTM_VERSION;
2038         rtmsg.hdr.rtm_seq = ++rts_seqno;
2039         rtmsg.hdr.rtm_addrs = RTA_IFP | RTA_DST;
2040 
2041         l = ROUNDUP_LONG(salen(&so_dst.sa));
2042         (void) memmove(cp, &(so_dst), l);
2043         cp += l;
2044         l = ROUNDUP_LONG(salen(&so_ifp.sa));
2045         (void) memmove(cp, &(so_ifp), l);
2046         cp += l;
2047 
2048         rtmsg.hdr.rtm_msglen = l = cp - (char *)&rtmsg;
2049 
2050         if ((rlen = write(s, &rtmsg, l)) < 0) {
2051                 zerror(zlogp, B_TRUE, "writing to routing socket");
2052                 return (NULL);
2053         } else if (rlen < (int)rtmsg.hdr.rtm_msglen) {
2054                 zerror(zlogp, B_TRUE,
2055                     "write to routing socket got only %d for len\n", rlen);
2056                 return (NULL);
2057         }
2058         do {
2059                 l = read(s, &rtmsg, sizeof (rtmsg));
2060         } while (l > 0 && (rtmsg.hdr.rtm_seq != rts_seqno ||
2061             rtmsg.hdr.rtm_pid != pid));
2062         if (l < 0) {
2063                 zerror(zlogp, B_TRUE, "reading from routing socket");
2064                 return (NULL);
2065         }
2066 
2067         if (rtmsg.hdr.rtm_version != RTM_VERSION) {
2068                 zerror(zlogp, B_FALSE,
2069                     "routing message version %d not understood",
2070                     rtmsg.hdr.rtm_version);
2071                 return (NULL);
2072         }
2073         if (rtmsg.hdr.rtm_msglen != (ushort_t)l) {
2074                 zerror(zlogp, B_FALSE, "message length mismatch, "
2075                     "expected %d bytes, returned %d bytes",
2076                     rtmsg.hdr.rtm_msglen, l);
2077                 return (NULL);
2078         }
2079         if (rtmsg.hdr.rtm_errno != 0)  {
2080                 errno = rtmsg.hdr.rtm_errno;
2081                 zerror(zlogp, B_TRUE, "RTM_GET routing socket message");
2082                 return (NULL);
2083         }
2084         if ((rtmsg.hdr.rtm_addrs & RTA_IFP) == 0) {
2085                 zerror(zlogp, B_FALSE, "network interface not found");
2086                 return (NULL);
2087         }
2088         cp = ((char *)(&rtmsg.hdr + 1));
2089         for (i = 1; i != 0; i <<= 1) {
2090                 /* LINTED E_BAD_PTR_CAST_ALIGN */
2091                 sa = (struct sockaddr *)cp;
2092                 if (i != RTA_IFP) {
2093                         if ((i & rtmsg.hdr.rtm_addrs) != 0)
2094                                 cp += ROUNDUP_LONG(salen(sa));
2095                         continue;
2096                 }
2097                 if (sa->sa_family == AF_LINK &&
2098                     ((struct sockaddr_dl *)sa)->sdl_nlen != 0)
2099                         ifp = (struct sockaddr_dl *)sa;
2100                 break;
2101         }
2102         if (ifp == NULL) {
2103                 zerror(zlogp, B_FALSE, "network interface could not be "
2104                     "determined");
2105                 return (NULL);
2106         }
2107 
2108         /*
2109          * We need to set the I/F name to what we got above, then do the
2110          * appropriate ioctl to get its zone name.  But lifr->lifr_name is
2111          * used by the calling function to do a REMOVEIF, so if we leave the
2112          * "good" zone's I/F name in place, *that* I/F will be removed instead
2113          * of the bad one.  So we save the old (bad) I/F name before over-
2114          * writing it and doing the ioctl, then restore it after the ioctl.
2115          */
2116         (void) strlcpy(save_if_name, lifr->lifr_name, sizeof (save_if_name));
2117         (void) strncpy(lifr->lifr_name, ifp->sdl_data, ifp->sdl_nlen);
2118         lifr->lifr_name[ifp->sdl_nlen] = '\0';
2119         i = ioctl(s, SIOCGLIFZONE, lifr);
2120         (void) strlcpy(lifr->lifr_name, save_if_name, sizeof (save_if_name));
2121         if (i < 0) {
2122                 zerror(zlogp, B_TRUE,
2123                     "%s: could not determine the zone network interface "
2124                     "belongs to", lifr->lifr_name);
2125                 return (NULL);
2126         }
2127         if (getzonenamebyid(lifr->lifr_zoneid, answer, sizeof (answer)) < 0)
2128                 (void) snprintf(answer, sizeof (answer), "%d",
2129                     lifr->lifr_zoneid);
2130 
2131         if (strlen(answer) > 0)
2132                 return (answer);
2133         return (NULL);
2134 }
2135 
2136 /*
2137  * Configures a single interface: a new virtual interface is added, based on
2138  * the physical interface nwiftabptr->zone_nwif_physical, with the address
2139  * specified in nwiftabptr->zone_nwif_address, for zone zone_id.  Note that
2140  * the "address" can be an IPv6 address (with a /prefixlength required), an
2141  * IPv4 address (with a /prefixlength optional), or a name; for the latter,
2142  * an IPv4 name-to-address resolution will be attempted.
2143  *
2144  * If anything goes wrong, we log an detailed error message, attempt to tear
2145  * down whatever we set up and return an error.
2146  */
2147 static int
2148 configure_one_interface(zlog_t *zlogp, zoneid_t zone_id,
2149     struct zone_nwiftab *nwiftabptr)
2150 {
2151         struct lifreq lifr;
2152         struct sockaddr_in netmask4;
2153         struct sockaddr_in6 netmask6;
2154         struct sockaddr_storage laddr;
2155         struct in_addr in4;
2156         sa_family_t af;
2157         char *slashp = strchr(nwiftabptr->zone_nwif_address, '/');
2158         int s;
2159         boolean_t got_netmask = B_FALSE;
2160         boolean_t is_loopback = B_FALSE;
2161         char addrstr4[INET_ADDRSTRLEN];
2162         int res;
2163 
2164         res = zonecfg_valid_net_address(nwiftabptr->zone_nwif_address, &lifr);
2165         if (res != Z_OK) {
2166                 zerror(zlogp, B_FALSE, "%s: %s", zonecfg_strerror(res),
2167                     nwiftabptr->zone_nwif_address);
2168                 return (-1);
2169         }
2170         af = lifr.lifr_addr.ss_family;
2171         if (af == AF_INET)
2172                 in4 = ((struct sockaddr_in *)(&lifr.lifr_addr))->sin_addr;
2173         if ((s = socket(af, SOCK_DGRAM, 0)) < 0) {
2174                 zerror(zlogp, B_TRUE, "could not get socket");
2175                 return (-1);
2176         }
2177 
2178         /*
2179          * This is a similar kind of "hack" like in addif() to get around
2180          * the problem of SIOCLIFADDIF.  The problem is that this ioctl
2181          * does not include the netmask when adding a logical interface.
2182          * To get around this problem, we first add the logical interface
2183          * with a 0 address.  After that, we set the netmask if provided.
2184          * Finally we set the interface address.
2185          */
2186         laddr = lifr.lifr_addr;
2187         (void) strlcpy(lifr.lifr_name, nwiftabptr->zone_nwif_physical,
2188             sizeof (lifr.lifr_name));
2189         (void) memset(&lifr.lifr_addr, 0, sizeof (lifr.lifr_addr));
2190 
2191         if (ioctl(s, SIOCLIFADDIF, (caddr_t)&lifr) < 0) {
2192                 /*
2193                  * Here, we know that the interface can't be brought up.
2194                  * A similar warning message was already printed out to
2195                  * the console by zoneadm(1M) so instead we log the
2196                  * message to syslog and continue.
2197                  */
2198                 zerror(&logsys, B_TRUE, "WARNING: skipping network interface "
2199                     "'%s' which may not be present/plumbed in the "
2200                     "global zone.", lifr.lifr_name);
2201                 (void) close(s);
2202                 return (Z_OK);
2203         }
2204 
2205         /* Preserve literal IPv4 address for later potential printing. */
2206         if (af == AF_INET)
2207                 (void) inet_ntop(AF_INET, &in4, addrstr4, INET_ADDRSTRLEN);
2208 
2209         lifr.lifr_zoneid = zone_id;
2210         if (ioctl(s, SIOCSLIFZONE, (caddr_t)&lifr) < 0) {
2211                 zerror(zlogp, B_TRUE, "%s: could not place network interface "
2212                     "into zone", lifr.lifr_name);
2213                 goto bad;
2214         }
2215 
2216         /*
2217          * Loopback interface will use the default netmask assigned, if no
2218          * netmask is found.
2219          */
2220         if (strcmp(nwiftabptr->zone_nwif_physical, "lo0") == 0) {
2221                 is_loopback = B_TRUE;
2222         }
2223         if (af == AF_INET) {
2224                 /*
2225                  * The IPv4 netmask can be determined either
2226                  * directly if a prefix length was supplied with
2227                  * the address or via the netmasks database.  Not
2228                  * being able to determine it is a common failure,
2229                  * but it often is not fatal to operation of the
2230                  * interface.  In that case, a warning will be
2231                  * printed after the rest of the interface's
2232                  * parameters have been configured.
2233                  */
2234                 (void) memset(&netmask4, 0, sizeof (netmask4));
2235                 if (slashp != NULL) {
2236                         if (addr2netmask(slashp + 1, V4_ADDR_LEN,
2237                             (uchar_t *)&netmask4.sin_addr) != 0) {
2238                                 *slashp = '/';
2239                                 zerror(zlogp, B_FALSE,
2240                                     "%s: invalid prefix length in %s",
2241                                     lifr.lifr_name,
2242                                     nwiftabptr->zone_nwif_address);
2243                                 goto bad;
2244                         }
2245                         got_netmask = B_TRUE;
2246                 } else if (getnetmaskbyaddr(in4,
2247                     &netmask4.sin_addr) == 0) {
2248                         got_netmask = B_TRUE;
2249                 }
2250                 if (got_netmask) {
2251                         netmask4.sin_family = af;
2252                         (void) memcpy(&lifr.lifr_addr, &netmask4,
2253                             sizeof (netmask4));
2254                 }
2255         } else {
2256                 (void) memset(&netmask6, 0, sizeof (netmask6));
2257                 if (addr2netmask(slashp + 1, V6_ADDR_LEN,
2258                     (uchar_t *)&netmask6.sin6_addr) != 0) {
2259                         *slashp = '/';
2260                         zerror(zlogp, B_FALSE,
2261                             "%s: invalid prefix length in %s",
2262                             lifr.lifr_name,
2263                             nwiftabptr->zone_nwif_address);
2264                         goto bad;
2265                 }
2266                 got_netmask = B_TRUE;
2267                 netmask6.sin6_family = af;
2268                 (void) memcpy(&lifr.lifr_addr, &netmask6,
2269                     sizeof (netmask6));
2270         }
2271         if (got_netmask &&
2272             ioctl(s, SIOCSLIFNETMASK, (caddr_t)&lifr) < 0) {
2273                 zerror(zlogp, B_TRUE, "%s: could not set netmask",
2274                     lifr.lifr_name);
2275                 goto bad;
2276         }
2277 
2278         /* Set the interface address */
2279         lifr.lifr_addr = laddr;
2280         if (ioctl(s, SIOCSLIFADDR, (caddr_t)&lifr) < 0) {
2281                 zerror(zlogp, B_TRUE,
2282                     "%s: could not set IP address to %s",
2283                     lifr.lifr_name, nwiftabptr->zone_nwif_address);
2284                 goto bad;
2285         }
2286 
2287         if (ioctl(s, SIOCGLIFFLAGS, (caddr_t)&lifr) < 0) {
2288                 zerror(zlogp, B_TRUE, "%s: could not get flags",
2289                     lifr.lifr_name);
2290                 goto bad;
2291         }
2292         lifr.lifr_flags |= IFF_UP;
2293         if (ioctl(s, SIOCSLIFFLAGS, (caddr_t)&lifr) < 0) {
2294                 int save_errno = errno;
2295                 char *zone_using;
2296 
2297                 /*
2298                  * If we failed with something other than EADDRNOTAVAIL,
2299                  * then skip to the end.  Otherwise, look up our address,
2300                  * then call a function to determine which zone is already
2301                  * using that address.
2302                  */
2303                 if (errno != EADDRNOTAVAIL) {
2304                         zerror(zlogp, B_TRUE,
2305                             "%s: could not bring network interface up",
2306                             lifr.lifr_name);
2307                         goto bad;
2308                 }
2309                 if (ioctl(s, SIOCGLIFADDR, (caddr_t)&lifr) < 0) {
2310                         zerror(zlogp, B_TRUE, "%s: could not get address",
2311                             lifr.lifr_name);
2312                         goto bad;
2313                 }
2314                 zone_using = who_is_using(zlogp, &lifr);
2315                 errno = save_errno;
2316                 if (zone_using == NULL)
2317                         zerror(zlogp, B_TRUE,
2318                             "%s: could not bring network interface up",
2319                             lifr.lifr_name);
2320                 else
2321                         zerror(zlogp, B_TRUE, "%s: could not bring network "
2322                             "interface up: address in use by zone '%s'",
2323                             lifr.lifr_name, zone_using);
2324                 goto bad;
2325         }
2326 
2327         if (!got_netmask && !is_loopback) {
2328                 /*
2329                  * A common, but often non-fatal problem, is that the system
2330                  * cannot find the netmask for an interface address. This is
2331                  * often caused by it being only in /etc/inet/netmasks, but
2332                  * /etc/nsswitch.conf says to use NIS or NIS+ and it's not
2333                  * in that. This doesn't show up at boot because the netmask
2334                  * is obtained from /etc/inet/netmasks when no network
2335                  * interfaces are up, but isn't consulted when NIS/NIS+ is
2336                  * available. We warn the user here that something like this
2337                  * has happened and we're just running with a default and
2338                  * possible incorrect netmask.
2339                  */
2340                 char buffer[INET6_ADDRSTRLEN];
2341                 void  *addr;
2342                 const char *nomatch = "no matching subnet found in netmasks(4)";
2343 
2344                 if (af == AF_INET)
2345                         addr = &((struct sockaddr_in *)
2346                             (&lifr.lifr_addr))->sin_addr;
2347                 else
2348                         addr = &((struct sockaddr_in6 *)
2349                             (&lifr.lifr_addr))->sin6_addr;
2350 
2351                 /*
2352                  * Find out what netmask the interface is going to be using.
2353                  * If we just brought up an IPMP data address on an underlying
2354                  * interface above, the address will have already migrated, so
2355                  * the SIOCGLIFNETMASK won't be able to find it (but we need
2356                  * to bring the address up to get the actual netmask).  Just
2357                  * omit printing the actual netmask in this corner-case.
2358                  */
2359                 if (ioctl(s, SIOCGLIFNETMASK, (caddr_t)&lifr) < 0 ||
2360                     inet_ntop(af, addr, buffer, sizeof (buffer)) == NULL) {
2361                         zerror(zlogp, B_FALSE, "WARNING: %s; using default.",
2362                             nomatch);
2363                 } else {
2364                         zerror(zlogp, B_FALSE,
2365                             "WARNING: %s: %s: %s; using default of %s.",
2366                             lifr.lifr_name, nomatch, addrstr4, buffer);
2367                 }
2368         }
2369 
2370         /*
2371          * If a default router was specified for this interface
2372          * set the route now. Ignore if already set.
2373          */
2374         if (strlen(nwiftabptr->zone_nwif_defrouter) > 0) {
2375                 int status;
2376                 char *argv[7];
2377 
2378                 argv[0] = "route";
2379                 argv[1] = "add";
2380                 argv[2] = "-ifp";
2381                 argv[3] = nwiftabptr->zone_nwif_physical;
2382                 argv[4] = "default";
2383                 argv[5] = nwiftabptr->zone_nwif_defrouter;
2384                 argv[6] = NULL;
2385 
2386                 status = forkexec(zlogp, "/usr/sbin/route", argv);
2387                 if (status != 0 && status != EEXIST)
2388                         zerror(zlogp, B_FALSE, "Unable to set route for "
2389                             "interface %s to %s\n",
2390                             nwiftabptr->zone_nwif_physical,
2391                             nwiftabptr->zone_nwif_defrouter);
2392         }
2393 
2394         (void) close(s);
2395         return (Z_OK);
2396 bad:
2397         (void) ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifr);
2398         (void) close(s);
2399         return (-1);
2400 }
2401 
2402 /*
2403  * Sets up network interfaces based on information from the zone configuration.
2404  * IPv4 and IPv6 loopback interfaces are set up "for free", modeling the global
2405  * system.
2406  *
2407  * If anything goes wrong, we log a general error message, attempt to tear down
2408  * whatever we set up, and return an error.
2409  */
2410 static int
2411 configure_shared_network_interfaces(zlog_t *zlogp)
2412 {
2413         zone_dochandle_t handle;
2414         struct zone_nwiftab nwiftab, loopback_iftab;
2415         zoneid_t zoneid;
2416 
2417         if ((zoneid = getzoneidbyname(zone_name)) == ZONE_ID_UNDEFINED) {
2418                 zerror(zlogp, B_TRUE, "unable to get zoneid");
2419                 return (-1);
2420         }
2421 
2422         if ((handle = zonecfg_init_handle()) == NULL) {
2423                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
2424                 return (-1);
2425         }
2426         if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2427                 zerror(zlogp, B_FALSE, "invalid configuration");
2428                 zonecfg_fini_handle(handle);
2429                 return (-1);
2430         }
2431         if (zonecfg_setnwifent(handle) == Z_OK) {
2432                 for (;;) {
2433                         if (zonecfg_getnwifent(handle, &nwiftab) != Z_OK)
2434                                 break;
2435                         if (configure_one_interface(zlogp, zoneid, &nwiftab) !=
2436                             Z_OK) {
2437                                 (void) zonecfg_endnwifent(handle);
2438                                 zonecfg_fini_handle(handle);
2439                                 return (-1);
2440                         }
2441                 }
2442                 (void) zonecfg_endnwifent(handle);
2443         }
2444         zonecfg_fini_handle(handle);
2445         if (is_system_labeled()) {
2446                 /*
2447                  * Labeled zones share the loopback interface
2448                  * so it is not plumbed for shared stack instances.
2449                  */
2450                 return (0);
2451         }
2452         (void) strlcpy(loopback_iftab.zone_nwif_physical, "lo0",
2453             sizeof (loopback_iftab.zone_nwif_physical));
2454         (void) strlcpy(loopback_iftab.zone_nwif_address, "127.0.0.1",
2455             sizeof (loopback_iftab.zone_nwif_address));
2456         loopback_iftab.zone_nwif_defrouter[0] = '\0';
2457         if (configure_one_interface(zlogp, zoneid, &loopback_iftab) != Z_OK)
2458                 return (-1);
2459 
2460         /* Always plumb up the IPv6 loopback interface. */
2461         (void) strlcpy(loopback_iftab.zone_nwif_address, "::1/128",
2462             sizeof (loopback_iftab.zone_nwif_address));
2463         if (configure_one_interface(zlogp, zoneid, &loopback_iftab) != Z_OK)
2464                 return (-1);
2465         return (0);
2466 }
2467 
2468 static void
2469 zdlerror(zlog_t *zlogp, dladm_status_t err, const char *dlname, const char *str)
2470 {
2471         char errmsg[DLADM_STRSIZE];
2472 
2473         (void) dladm_status2str(err, errmsg);
2474         zerror(zlogp, B_FALSE, "%s '%s': %s", str, dlname, errmsg);
2475 }
2476 
2477 static int
2478 add_datalink(zlog_t *zlogp, char *zone_name, datalink_id_t linkid, char *dlname)
2479 {
2480         dladm_status_t err;
2481         boolean_t cpuset, poolset;
2482         char *poolp;
2483 
2484         /* First check if it's in use by global zone. */
2485         if (zonecfg_ifname_exists(AF_INET, dlname) ||
2486             zonecfg_ifname_exists(AF_INET6, dlname)) {
2487                 zerror(zlogp, B_FALSE, "WARNING: skipping network interface "
2488                     "'%s' which is used in the global zone", dlname);
2489                 return (-1);
2490         }
2491 
2492         /* Set zoneid of this link. */
2493         err = dladm_set_linkprop(dld_handle, linkid, "zone", &zone_name, 1,
2494             DLADM_OPT_ACTIVE);
2495         if (err != DLADM_STATUS_OK) {
2496                 zdlerror(zlogp, err, dlname,
2497                     "WARNING: unable to add network interface");
2498                 return (-1);
2499         }
2500 
2501         /*
2502          * Set the pool of this link if the zone has a pool and
2503          * neither the cpus nor the pool datalink property is
2504          * already set.
2505          */
2506         err = dladm_linkprop_is_set(dld_handle, linkid, DLADM_PROP_VAL_CURRENT,
2507             "cpus", &cpuset);
2508         if (err != DLADM_STATUS_OK) {
2509                 zdlerror(zlogp, err, dlname,
2510                     "WARNING: unable to check if cpus link property is set");
2511         }
2512         err = dladm_linkprop_is_set(dld_handle, linkid, DLADM_PROP_VAL_CURRENT,
2513             "pool", &poolset);
2514         if (err != DLADM_STATUS_OK) {
2515                 zdlerror(zlogp, err, dlname,
2516                     "WARNING: unable to check if pool link property is set");
2517         }
2518 
2519         if ((strlen(pool_name) != 0) && !cpuset && !poolset) {
2520                 poolp = pool_name;
2521                 err = dladm_set_linkprop(dld_handle, linkid, "pool",
2522                     &poolp, 1, DLADM_OPT_ACTIVE);
2523                 if (err != DLADM_STATUS_OK) {
2524                         zerror(zlogp, B_FALSE, "WARNING: unable to set "
2525                             "pool %s to datalink %s", pool_name, dlname);
2526                         bzero(pool_name, sizeof (pool_name));
2527                 }
2528         } else {
2529                 bzero(pool_name, sizeof (pool_name));
2530         }
2531         return (0);
2532 }
2533 
2534 static boolean_t
2535 sockaddr_to_str(sa_family_t af, const struct sockaddr *sockaddr,
2536     char *straddr, size_t len)
2537 {
2538         struct sockaddr_in *sin;
2539         struct sockaddr_in6 *sin6;
2540         const char *str = NULL;
2541 
2542         if (af == AF_INET) {
2543                 /* LINTED E_BAD_PTR_CAST_ALIGN */
2544                 sin = SIN(sockaddr);
2545                 str = inet_ntop(AF_INET, (void *)&sin->sin_addr, straddr, len);
2546         } else if (af == AF_INET6) {
2547                 /* LINTED E_BAD_PTR_CAST_ALIGN */
2548                 sin6 = SIN6(sockaddr);
2549                 str = inet_ntop(AF_INET6, (void *)&sin6->sin6_addr, straddr,
2550                     len);
2551         }
2552 
2553         return (str != NULL);
2554 }
2555 
2556 static int
2557 ipv4_prefixlen(struct sockaddr_in *sin)
2558 {
2559         struct sockaddr_in *m;
2560         struct sockaddr_storage mask;
2561 
2562         m = SIN(&mask);
2563         m->sin_family = AF_INET;
2564         if (getnetmaskbyaddr(sin->sin_addr, &m->sin_addr) == 0) {
2565                 return (mask2plen((struct sockaddr *)&mask));
2566         } else if (IN_CLASSA(htonl(sin->sin_addr.s_addr))) {
2567                 return (8);
2568         } else if (IN_CLASSB(ntohl(sin->sin_addr.s_addr))) {
2569                 return (16);
2570         } else if (IN_CLASSC(ntohl(sin->sin_addr.s_addr))) {
2571                 return (24);
2572         }
2573         return (0);
2574 }
2575 
2576 static int
2577 zone_setattr_network(int type, zoneid_t zoneid, datalink_id_t linkid,
2578     void *buf, size_t bufsize)
2579 {
2580         zone_net_data_t *zndata;
2581         size_t znsize;
2582         int err;
2583 
2584         znsize = sizeof (*zndata) + bufsize;
2585         zndata = calloc(1, znsize);
2586         if (zndata == NULL)
2587                 return (ENOMEM);
2588         zndata->zn_type = type;
2589         zndata->zn_len = bufsize;
2590         zndata->zn_linkid = linkid;
2591         bcopy(buf, zndata->zn_val, zndata->zn_len);
2592         err = zone_setattr(zoneid, ZONE_ATTR_NETWORK, zndata, znsize);
2593         free(zndata);
2594         return (err);
2595 }
2596 
2597 static int
2598 add_net_for_linkid(zlog_t *zlogp, zoneid_t zoneid, zone_addr_list_t *start)
2599 {
2600         struct lifreq lifr;
2601         char **astr, *address;
2602         dladm_status_t dlstatus;
2603         char *ip_nospoof = "ip-nospoof";
2604         int nnet, naddr, err = 0, j;
2605         size_t zlen, cpleft;
2606         zone_addr_list_t *ptr, *end;
2607         char  tmp[INET6_ADDRSTRLEN], *maskstr;
2608         char *zaddr, *cp;
2609         struct in6_addr *routes = NULL;
2610         boolean_t is_set;
2611         datalink_id_t linkid;
2612 
2613         assert(start != NULL);
2614         naddr = 0; /* number of addresses */
2615         nnet = 0; /* number of net resources */
2616         linkid = start->za_linkid;
2617         for (ptr = start; ptr != NULL && ptr->za_linkid == linkid;
2618             ptr = ptr->za_next) {
2619                 nnet++;
2620         }
2621         end = ptr;
2622         zlen = nnet * (INET6_ADDRSTRLEN + 1);
2623         astr = calloc(1, nnet * sizeof (uintptr_t));
2624         zaddr = calloc(1, zlen);
2625         if (astr == NULL || zaddr == NULL) {
2626                 err = ENOMEM;
2627                 goto done;
2628         }
2629         cp = zaddr;
2630         cpleft = zlen;
2631         j = 0;
2632         for (ptr = start; ptr != end; ptr = ptr->za_next) {
2633                 address = ptr->za_nwiftab.zone_nwif_allowed_address;
2634                 if (address[0] == '\0')
2635                         continue;
2636                 (void) snprintf(tmp, sizeof (tmp), "%s", address);
2637                 /*
2638                  * Validate the data. zonecfg_valid_net_address() clobbers
2639                  * the /<mask> in the address string.
2640                  */
2641                 if (zonecfg_valid_net_address(address, &lifr) != Z_OK) {
2642                         zerror(zlogp, B_FALSE, "invalid address [%s]\n",
2643                             address);
2644                         err = EINVAL;
2645                         goto done;
2646                 }
2647                 /*
2648                  * convert any hostnames to numeric address strings.
2649                  */
2650                 if (!sockaddr_to_str(lifr.lifr_addr.ss_family,
2651                     (const struct sockaddr *)&lifr.lifr_addr, cp, cpleft)) {
2652                         err = EINVAL;
2653                         goto done;
2654                 }
2655                 /*
2656                  * make a copy of the numeric string for the data needed
2657                  * by the "allowed-ips" datalink property.
2658                  */
2659                 astr[j] = strdup(cp);
2660                 if (astr[j] == NULL) {
2661                         err = ENOMEM;
2662                         goto done;
2663                 }
2664                 j++;
2665                 /*
2666                  * compute the default netmask from the address, if necessary
2667                  */
2668                 if ((maskstr = strchr(tmp, '/')) == NULL) {
2669                         int prefixlen;
2670 
2671                         if (lifr.lifr_addr.ss_family == AF_INET) {
2672                                 prefixlen = ipv4_prefixlen(
2673                                     SIN(&lifr.lifr_addr));
2674                         } else {
2675                                 struct sockaddr_in6 *sin6;
2676 
2677                                 sin6 = SIN6(&lifr.lifr_addr);
2678                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2679                                         prefixlen = 10;
2680                                 else
2681                                         prefixlen = 64;
2682                         }
2683                         (void) snprintf(tmp, sizeof (tmp), "%d", prefixlen);
2684                         maskstr = tmp;
2685                 } else {
2686                         maskstr++;
2687                 }
2688                 /* append the "/<netmask>" */
2689                 (void) strlcat(cp, "/", cpleft);
2690                 (void) strlcat(cp, maskstr, cpleft);
2691                 (void) strlcat(cp, ",", cpleft);
2692                 cp += strnlen(cp, zlen);
2693                 cpleft = &zaddr[INET6_ADDRSTRLEN] - cp;
2694         }
2695         naddr = j; /* the actual number of addresses in the net resource */
2696         assert(naddr <= nnet);
2697 
2698         /*
2699          * zonecfg has already verified that the defrouter property can only
2700          * be set if there is at least one address defined for the net resource.
2701          * If j is 0, there are no addresses defined, and therefore no routers
2702          * to configure, and we are done at that point.
2703          */
2704         if (j == 0)
2705                 goto done;
2706 
2707         /* over-write last ',' with '\0' */
2708         zaddr[strnlen(zaddr, zlen) + 1] = '\0';
2709 
2710         /*
2711          * First make sure L3 protection is not already set on the link.
2712          */
2713         dlstatus = dladm_linkprop_is_set(dld_handle, linkid, DLADM_OPT_ACTIVE,
2714             "protection", &is_set);
2715         if (dlstatus != DLADM_STATUS_OK) {
2716                 err = EINVAL;
2717                 zerror(zlogp, B_FALSE, "unable to check if protection is set");
2718                 goto done;
2719         }
2720         if (is_set) {
2721                 err = EINVAL;
2722                 zerror(zlogp, B_FALSE, "Protection is already set");
2723                 goto done;
2724         }
2725         dlstatus = dladm_linkprop_is_set(dld_handle, linkid, DLADM_OPT_ACTIVE,
2726             "allowed-ips", &is_set);
2727         if (dlstatus != DLADM_STATUS_OK) {
2728                 err = EINVAL;
2729                 zerror(zlogp, B_FALSE, "unable to check if allowed-ips is set");
2730                 goto done;
2731         }
2732         if (is_set) {
2733                 zerror(zlogp, B_FALSE, "allowed-ips is already set");
2734                 err = EINVAL;
2735                 goto done;
2736         }
2737 
2738         /*
2739          * Enable ip-nospoof for the link, and add address to the allowed-ips
2740          * list.
2741          */
2742         dlstatus = dladm_set_linkprop(dld_handle, linkid, "protection",
2743             &ip_nospoof, 1, DLADM_OPT_ACTIVE);
2744         if (dlstatus != DLADM_STATUS_OK) {
2745                 zerror(zlogp, B_FALSE, "could not set protection\n");
2746                 err = EINVAL;
2747                 goto done;
2748         }
2749         dlstatus = dladm_set_linkprop(dld_handle, linkid, "allowed-ips",
2750             astr, naddr, DLADM_OPT_ACTIVE);
2751         if (dlstatus != DLADM_STATUS_OK) {
2752                 zerror(zlogp, B_FALSE, "could not set allowed-ips\n");
2753                 err = EINVAL;
2754                 goto done;
2755         }
2756 
2757         /* now set the address in the data-store */
2758         err = zone_setattr_network(ZONE_NETWORK_ADDRESS, zoneid, linkid,
2759             zaddr, strnlen(zaddr, zlen) + 1);
2760         if (err != 0)
2761                 goto done;
2762 
2763         /*
2764          * add the defaultrouters
2765          */
2766         routes = calloc(1, nnet * sizeof (*routes));
2767         j = 0;
2768         for (ptr = start; ptr != end; ptr = ptr->za_next) {
2769                 address = ptr->za_nwiftab.zone_nwif_defrouter;
2770                 if (address[0] == '\0')
2771                         continue;
2772                 if (strchr(address, '/') == NULL && strchr(address, ':') != 0) {
2773                         /*
2774                          * zonecfg_valid_net_address() expects numeric IPv6
2775                          * addresses to have a CIDR format netmask.
2776                          */
2777                         (void) snprintf(tmp, sizeof (tmp), "/%d", V6_ADDR_LEN);
2778                         (void) strlcat(address, tmp, INET6_ADDRSTRLEN);
2779                 }
2780                 if (zonecfg_valid_net_address(address, &lifr) != Z_OK) {
2781                         zerror(zlogp, B_FALSE,
2782                             "invalid router [%s]\n", address);
2783                         err = EINVAL;
2784                         goto done;
2785                 }
2786                 if (lifr.lifr_addr.ss_family == AF_INET6) {
2787                         routes[j] = SIN6(&lifr.lifr_addr)->sin6_addr;
2788                 } else {
2789                         IN6_INADDR_TO_V4MAPPED(&SIN(&lifr.lifr_addr)->sin_addr,
2790                             &routes[j]);
2791                 }
2792                 j++;
2793         }
2794         assert(j <= nnet);
2795         if (j > 0) {
2796                 err = zone_setattr_network(ZONE_NETWORK_DEFROUTER, zoneid,
2797                     linkid, routes, j * sizeof (*routes));
2798         }
2799 done:
2800         free(routes);
2801         for (j = 0; j < naddr; j++)
2802                 free(astr[j]);
2803         free(astr);
2804         free(zaddr);
2805         return (err);
2806 
2807 }
2808 
2809 static int
2810 add_net(zlog_t *zlogp, zoneid_t zoneid, zone_addr_list_t *zalist)
2811 {
2812         zone_addr_list_t *ptr;
2813         datalink_id_t linkid;
2814         int err;
2815 
2816         if (zalist == NULL)
2817                 return (0);
2818 
2819         linkid = zalist->za_linkid;
2820 
2821         err = add_net_for_linkid(zlogp, zoneid, zalist);
2822         if (err != 0)
2823                 return (err);
2824 
2825         for (ptr = zalist; ptr != NULL; ptr = ptr->za_next) {
2826                 if (ptr->za_linkid == linkid)
2827                         continue;
2828                 linkid = ptr->za_linkid;
2829                 err = add_net_for_linkid(zlogp, zoneid, ptr);
2830                 if (err != 0)
2831                         return (err);
2832         }
2833         return (0);
2834 }
2835 
2836 /*
2837  * Add "new" to the list of network interfaces to be configured  by
2838  * add_net on zone boot in "old". The list of interfaces in "old" is
2839  * sorted by datalink_id_t, with interfaces sorted FIFO for a given
2840  * datalink_id_t.
2841  *
2842  * Returns the merged list of IP interfaces containing "old" and "new"
2843  */
2844 static zone_addr_list_t *
2845 add_ip_interface(zone_addr_list_t *old, zone_addr_list_t *new)
2846 {
2847         zone_addr_list_t *ptr, *next;
2848         datalink_id_t linkid = new->za_linkid;
2849 
2850         assert(old != new);
2851 
2852         if (old == NULL)
2853                 return (new);
2854         for (ptr = old; ptr != NULL; ptr = ptr->za_next) {
2855                 if (ptr->za_linkid == linkid)
2856                         break;
2857         }
2858         if (ptr == NULL) {
2859                 /* linkid does not already exist, add to the beginning */
2860                 new->za_next = old;
2861                 return (new);
2862         }
2863         /*
2864          * adding to the middle of the list; ptr points at the first
2865          * occurrence of linkid. Find the last occurrence.
2866          */
2867         while ((next = ptr->za_next) != NULL) {
2868                 if (next->za_linkid != linkid)
2869                         break;
2870                 ptr = next;
2871         }
2872         /* insert new after ptr */
2873         new->za_next = next;
2874         ptr->za_next = new;
2875         return (old);
2876 }
2877 
2878 void
2879 free_ip_interface(zone_addr_list_t *zalist)
2880 {
2881         zone_addr_list_t *ptr, *new;
2882 
2883         for (ptr = zalist; ptr != NULL; ) {
2884                 new = ptr;
2885                 ptr = ptr->za_next;
2886                 free(new);
2887         }
2888 }
2889 
2890 /*
2891  * Add the kernel access control information for the interface names.
2892  * If anything goes wrong, we log a general error message, attempt to tear down
2893  * whatever we set up, and return an error.
2894  */
2895 static int
2896 configure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
2897 {
2898         zone_dochandle_t handle;
2899         struct zone_nwiftab nwiftab;
2900         char rootpath[MAXPATHLEN];
2901         char path[MAXPATHLEN];
2902         datalink_id_t linkid;
2903         di_prof_t prof = NULL;
2904         boolean_t added = B_FALSE;
2905         zone_addr_list_t *zalist = NULL, *new;
2906 
2907         if ((handle = zonecfg_init_handle()) == NULL) {
2908                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
2909                 return (-1);
2910         }
2911         if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2912                 zerror(zlogp, B_FALSE, "invalid configuration");
2913                 zonecfg_fini_handle(handle);
2914                 return (-1);
2915         }
2916 
2917         if (zonecfg_setnwifent(handle) != Z_OK) {
2918                 zonecfg_fini_handle(handle);
2919                 return (0);
2920         }
2921 
2922         for (;;) {
2923                 if (zonecfg_getnwifent(handle, &nwiftab) != Z_OK)
2924                         break;
2925 
2926                 if (prof == NULL) {
2927                         if (zone_get_devroot(zone_name, rootpath,
2928                             sizeof (rootpath)) != Z_OK) {
2929                                 (void) zonecfg_endnwifent(handle);
2930                                 zonecfg_fini_handle(handle);
2931                                 zerror(zlogp, B_TRUE,
2932                                     "unable to determine dev root");
2933                                 return (-1);
2934                         }
2935                         (void) snprintf(path, sizeof (path), "%s%s", rootpath,
2936                             "/dev");
2937                         if (di_prof_init(path, &prof) != 0) {
2938                                 (void) zonecfg_endnwifent(handle);
2939                                 zonecfg_fini_handle(handle);
2940                                 zerror(zlogp, B_TRUE,
2941                                     "failed to initialize profile");
2942                                 return (-1);
2943                         }
2944                 }
2945 
2946                 /*
2947                  * Create the /dev entry for backward compatibility.
2948                  * Only create the /dev entry if it's not in use.
2949                  * Note that the zone still boots when the assigned
2950                  * interface is inaccessible, used by others, etc.
2951                  * Also, when vanity naming is used, some interface do
2952                  * do not have corresponding /dev node names (for example,
2953                  * vanity named aggregations).  The /dev entry is not
2954                  * created in that case.  The /dev/net entry is always
2955                  * accessible.
2956                  */
2957                 if (dladm_name2info(dld_handle, nwiftab.zone_nwif_physical,
2958                     &linkid, NULL, NULL, NULL) == DLADM_STATUS_OK &&
2959                     add_datalink(zlogp, zone_name, linkid,
2960                     nwiftab.zone_nwif_physical) == 0) {
2961                         added = B_TRUE;
2962                 } else {
2963                         (void) zonecfg_endnwifent(handle);
2964                         zonecfg_fini_handle(handle);
2965                         zerror(zlogp, B_TRUE, "failed to add network device");
2966                         return (-1);
2967                 }
2968                 /* set up the new IP interface, and add them all later */
2969                 new = malloc(sizeof (*new));
2970                 if (new == NULL) {
2971                         zerror(zlogp, B_TRUE, "no memory for %s",
2972                             nwiftab.zone_nwif_physical);
2973                         zonecfg_fini_handle(handle);
2974                         free_ip_interface(zalist);
2975                 }
2976                 bzero(new, sizeof (*new));
2977                 new->za_nwiftab = nwiftab;
2978                 new->za_linkid = linkid;
2979                 zalist = add_ip_interface(zalist, new);
2980         }
2981         if (zalist != NULL) {
2982                 if ((errno = add_net(zlogp, zoneid, zalist)) != 0) {
2983                         (void) zonecfg_endnwifent(handle);
2984                         zonecfg_fini_handle(handle);
2985                         zerror(zlogp, B_TRUE, "failed to add address");
2986                         free_ip_interface(zalist);
2987                         return (-1);
2988                 }
2989                 free_ip_interface(zalist);
2990         }
2991         (void) zonecfg_endnwifent(handle);
2992         zonecfg_fini_handle(handle);
2993 
2994         if (prof != NULL && added) {
2995                 if (di_prof_commit(prof) != 0) {
2996                         zerror(zlogp, B_TRUE, "failed to commit profile");
2997                         return (-1);
2998                 }
2999         }
3000         if (prof != NULL)
3001                 di_prof_fini(prof);
3002 
3003         return (0);
3004 }
3005 
3006 static int
3007 remove_datalink_pool(zlog_t *zlogp, zoneid_t zoneid)
3008 {
3009         ushort_t flags;
3010         zone_iptype_t iptype;
3011         int i, dlnum = 0;
3012         datalink_id_t *dllink, *dllinks = NULL;
3013         dladm_status_t err;
3014 
3015         if (strlen(pool_name) == 0)
3016                 return (0);
3017 
3018         if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
3019             sizeof (flags)) < 0) {
3020                 if (vplat_get_iptype(zlogp, &iptype) < 0) {
3021                         zerror(zlogp, B_FALSE, "unable to determine ip-type");
3022                         return (-1);
3023                 }
3024         } else {
3025                 if (flags & ZF_NET_EXCL)
3026                         iptype = ZS_EXCLUSIVE;
3027                 else
3028                         iptype = ZS_SHARED;
3029         }
3030 
3031         if (iptype == ZS_EXCLUSIVE) {
3032                 /*
3033                  * Get the datalink count and for each datalink,
3034                  * attempt to clear the pool property and clear
3035                  * the pool_name.
3036                  */
3037                 if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
3038                         zerror(zlogp, B_TRUE, "unable to count network "
3039                             "interfaces");
3040                         return (-1);
3041                 }
3042 
3043                 if (dlnum == 0)
3044                         return (0);
3045 
3046                 if ((dllinks = malloc(dlnum * sizeof (datalink_id_t)))
3047                     == NULL) {
3048                         zerror(zlogp, B_TRUE, "memory allocation failed");
3049                         return (-1);
3050                 }
3051                 if (zone_list_datalink(zoneid, &dlnum, dllinks) != 0) {
3052                         zerror(zlogp, B_TRUE, "unable to list network "
3053                             "interfaces");
3054                         return (-1);
3055                 }
3056 
3057                 bzero(pool_name, sizeof (pool_name));
3058                 for (i = 0, dllink = dllinks; i < dlnum; i++, dllink++) {
3059                         err = dladm_set_linkprop(dld_handle, *dllink, "pool",
3060                             NULL, 0, DLADM_OPT_ACTIVE);
3061                         if (err != DLADM_STATUS_OK) {
3062                                 zerror(zlogp, B_TRUE,
3063                                     "WARNING: unable to clear pool");
3064                         }
3065                 }
3066                 free(dllinks);
3067         }
3068         return (0);
3069 }
3070 
3071 static int
3072 remove_datalink_protect(zlog_t *zlogp, zoneid_t zoneid)
3073 {
3074         ushort_t flags;
3075         zone_iptype_t iptype;
3076         int i, dlnum = 0;
3077         dladm_status_t dlstatus;
3078         datalink_id_t *dllink, *dllinks = NULL;
3079 
3080         if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
3081             sizeof (flags)) < 0) {
3082                 if (vplat_get_iptype(zlogp, &iptype) < 0) {
3083                         zerror(zlogp, B_FALSE, "unable to determine ip-type");
3084                         return (-1);
3085                 }
3086         } else {
3087                 if (flags & ZF_NET_EXCL)
3088                         iptype = ZS_EXCLUSIVE;
3089                 else
3090                         iptype = ZS_SHARED;
3091         }
3092 
3093         if (iptype != ZS_EXCLUSIVE)
3094                 return (0);
3095 
3096         /*
3097          * Get the datalink count and for each datalink,
3098          * attempt to clear the pool property and clear
3099          * the pool_name.
3100          */
3101         if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
3102                 zerror(zlogp, B_TRUE, "unable to count network interfaces");
3103                 return (-1);
3104         }
3105 
3106         if (dlnum == 0)
3107                 return (0);
3108 
3109         if ((dllinks = malloc(dlnum * sizeof (datalink_id_t))) == NULL) {
3110                 zerror(zlogp, B_TRUE, "memory allocation failed");
3111                 return (-1);
3112         }
3113         if (zone_list_datalink(zoneid, &dlnum, dllinks) != 0) {
3114                 zerror(zlogp, B_TRUE, "unable to list network interfaces");
3115                 free(dllinks);
3116                 return (-1);
3117         }
3118 
3119         for (i = 0, dllink = dllinks; i < dlnum; i++, dllink++) {
3120                 char dlerr[DLADM_STRSIZE];
3121 
3122                 dlstatus = dladm_set_linkprop(dld_handle, *dllink,
3123                     "protection", NULL, 0, DLADM_OPT_ACTIVE);
3124                 if (dlstatus == DLADM_STATUS_NOTFOUND) {
3125                         /* datalink does not belong to the GZ */
3126                         continue;
3127                 }
3128                 if (dlstatus != DLADM_STATUS_OK) {
3129                         zerror(zlogp, B_FALSE,
3130                             dladm_status2str(dlstatus, dlerr));
3131                         free(dllinks);
3132                         return (-1);
3133                 }
3134                 dlstatus = dladm_set_linkprop(dld_handle, *dllink,
3135                     "allowed-ips", NULL, 0, DLADM_OPT_ACTIVE);
3136                 if (dlstatus != DLADM_STATUS_OK) {
3137                         zerror(zlogp, B_FALSE,
3138                             dladm_status2str(dlstatus, dlerr));
3139                         free(dllinks);
3140                         return (-1);
3141                 }
3142         }
3143         free(dllinks);
3144         return (0);
3145 }
3146 
3147 static int
3148 unconfigure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
3149 {
3150         int dlnum = 0;
3151 
3152         /*
3153          * The kernel shutdown callback for the dls module should have removed
3154          * all datalinks from this zone.  If any remain, then there's a
3155          * problem.
3156          */
3157         if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
3158                 zerror(zlogp, B_TRUE, "unable to list network interfaces");
3159                 return (-1);
3160         }
3161         if (dlnum != 0) {
3162                 zerror(zlogp, B_FALSE,
3163                     "datalinks remain in zone after shutdown");
3164                 return (-1);
3165         }
3166         return (0);
3167 }
3168 
3169 static int
3170 tcp_abort_conn(zlog_t *zlogp, zoneid_t zoneid,
3171     const struct sockaddr_storage *local, const struct sockaddr_storage *remote)
3172 {
3173         int fd;
3174         struct strioctl ioc;
3175         tcp_ioc_abort_conn_t conn;
3176         int error;
3177 
3178         conn.ac_local = *local;
3179         conn.ac_remote = *remote;
3180         conn.ac_start = TCPS_SYN_SENT;
3181         conn.ac_end = TCPS_TIME_WAIT;
3182         conn.ac_zoneid = zoneid;
3183 
3184         ioc.ic_cmd = TCP_IOC_ABORT_CONN;
3185         ioc.ic_timout = -1; /* infinite timeout */
3186         ioc.ic_len = sizeof (conn);
3187         ioc.ic_dp = (char *)&conn;
3188 
3189         if ((fd = open("/dev/tcp", O_RDONLY)) < 0) {
3190                 zerror(zlogp, B_TRUE, "unable to open %s", "/dev/tcp");
3191                 return (-1);
3192         }
3193 
3194         error = ioctl(fd, I_STR, &ioc);
3195         (void) close(fd);
3196         if (error == 0 || errno == ENOENT)      /* ENOENT is not an error */
3197                 return (0);
3198         return (-1);
3199 }
3200 
3201 static int
3202 tcp_abort_connections(zlog_t *zlogp, zoneid_t zoneid)
3203 {
3204         struct sockaddr_storage l, r;
3205         struct sockaddr_in *local, *remote;
3206         struct sockaddr_in6 *local6, *remote6;
3207         int error;
3208 
3209         /*
3210          * Abort IPv4 connections.
3211          */
3212         bzero(&l, sizeof (*local));
3213         local = (struct sockaddr_in *)&l;
3214         local->sin_family = AF_INET;
3215         local->sin_addr.s_addr = INADDR_ANY;
3216         local->sin_port = 0;
3217 
3218         bzero(&r, sizeof (*remote));
3219         remote = (struct sockaddr_in *)&r;
3220         remote->sin_family = AF_INET;
3221         remote->sin_addr.s_addr = INADDR_ANY;
3222         remote->sin_port = 0;
3223 
3224         if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
3225                 return (error);
3226 
3227         /*
3228          * Abort IPv6 connections.
3229          */
3230         bzero(&l, sizeof (*local6));
3231         local6 = (struct sockaddr_in6 *)&l;
3232         local6->sin6_family = AF_INET6;
3233         local6->sin6_port = 0;
3234         local6->sin6_addr = in6addr_any;
3235 
3236         bzero(&r, sizeof (*remote6));
3237         remote6 = (struct sockaddr_in6 *)&r;
3238         remote6->sin6_family = AF_INET6;
3239         remote6->sin6_port = 0;
3240         remote6->sin6_addr = in6addr_any;
3241 
3242         if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
3243                 return (error);
3244         return (0);
3245 }
3246 
3247 static int
3248 get_privset(zlog_t *zlogp, priv_set_t *privs, zone_mnt_t mount_cmd)
3249 {
3250         int error = -1;
3251         zone_dochandle_t handle;
3252         char *privname = NULL;
3253 
3254         if ((handle = zonecfg_init_handle()) == NULL) {
3255                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
3256                 return (-1);
3257         }
3258         if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
3259                 zerror(zlogp, B_FALSE, "invalid configuration");
3260                 zonecfg_fini_handle(handle);
3261                 return (-1);
3262         }
3263 
3264         if (ALT_MOUNT(mount_cmd)) {
3265                 zone_iptype_t   iptype;
3266                 const char      *curr_iptype;
3267 
3268                 if (zonecfg_get_iptype(handle, &iptype) != Z_OK) {
3269                         zerror(zlogp, B_TRUE, "unable to determine ip-type");
3270                         zonecfg_fini_handle(handle);
3271                         return (-1);
3272                 }
3273 
3274                 switch (iptype) {
3275                 case ZS_SHARED:
3276                         curr_iptype = "shared";
3277                         break;
3278                 case ZS_EXCLUSIVE:
3279                         curr_iptype = "exclusive";
3280                         break;
3281                 }
3282 
3283                 if (zonecfg_default_privset(privs, curr_iptype) == Z_OK) {
3284                         zonecfg_fini_handle(handle);
3285                         return (0);
3286                 }
3287                 zerror(zlogp, B_FALSE,
3288                     "failed to determine the zone's default privilege set");
3289                 zonecfg_fini_handle(handle);
3290                 return (-1);
3291         }
3292 
3293         switch (zonecfg_get_privset(handle, privs, &privname)) {
3294         case Z_OK:
3295                 error = 0;
3296                 break;
3297         case Z_PRIV_PROHIBITED:
3298                 zerror(zlogp, B_FALSE, "privilege \"%s\" is not permitted "
3299                     "within the zone's privilege set", privname);
3300                 break;
3301         case Z_PRIV_REQUIRED:
3302                 zerror(zlogp, B_FALSE, "required privilege \"%s\" is missing "
3303                     "from the zone's privilege set", privname);
3304                 break;
3305         case Z_PRIV_UNKNOWN:
3306                 zerror(zlogp, B_FALSE, "unknown privilege \"%s\" specified "
3307                     "in the zone's privilege set", privname);
3308                 break;
3309         default:
3310                 zerror(zlogp, B_FALSE, "failed to determine the zone's "
3311                     "privilege set");
3312                 break;
3313         }
3314 
3315         free(privname);
3316         zonecfg_fini_handle(handle);
3317         return (error);
3318 }
3319 
3320 static int
3321 get_rctls(zlog_t *zlogp, char **bufp, size_t *bufsizep)
3322 {
3323         nvlist_t *nvl = NULL;
3324         char *nvl_packed = NULL;
3325         size_t nvl_size = 0;
3326         nvlist_t **nvlv = NULL;
3327         int rctlcount = 0;
3328         int error = -1;
3329         zone_dochandle_t handle;
3330         struct zone_rctltab rctltab;
3331         rctlblk_t *rctlblk = NULL;
3332         uint64_t maxlwps;
3333         uint64_t maxprocs;
3334 
3335         *bufp = NULL;
3336         *bufsizep = 0;
3337 
3338         if ((handle = zonecfg_init_handle()) == NULL) {
3339                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
3340                 return (-1);
3341         }
3342         if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
3343                 zerror(zlogp, B_FALSE, "invalid configuration");
3344                 zonecfg_fini_handle(handle);
3345                 return (-1);
3346         }
3347 
3348         rctltab.zone_rctl_valptr = NULL;
3349         if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0) {
3350                 zerror(zlogp, B_TRUE, "%s failed", "nvlist_alloc");
3351                 goto out;
3352         }
3353 
3354         /*
3355          * Allow the administrator to control both the maximum number of
3356          * process table slots and the maximum number of lwps with just the
3357          * max-processes property.  If only the max-processes property is set,
3358          * we add a max-lwps property with a limit derived from max-processes.
3359          */
3360         if (zonecfg_get_aliased_rctl(handle, ALIAS_MAXPROCS, &maxprocs)
3361             == Z_OK &&
3362             zonecfg_get_aliased_rctl(handle, ALIAS_MAXLWPS, &maxlwps)
3363             == Z_NO_ENTRY) {
3364                 if (zonecfg_set_aliased_rctl(handle, ALIAS_MAXLWPS,
3365                     maxprocs * LWPS_PER_PROCESS) != Z_OK) {
3366                         zerror(zlogp, B_FALSE, "unable to set max-lwps alias");
3367                         goto out;
3368                 }
3369         }
3370 
3371         if (zonecfg_setrctlent(handle) != Z_OK) {
3372                 zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setrctlent");
3373                 goto out;
3374         }
3375 
3376         if ((rctlblk = malloc(rctlblk_size())) == NULL) {
3377                 zerror(zlogp, B_TRUE, "memory allocation failed");
3378                 goto out;
3379         }
3380         while (zonecfg_getrctlent(handle, &rctltab) == Z_OK) {
3381                 struct zone_rctlvaltab *rctlval;
3382                 uint_t i, count;
3383                 const char *name = rctltab.zone_rctl_name;
3384 
3385                 /* zoneadm should have already warned about unknown rctls. */
3386                 if (!zonecfg_is_rctl(name)) {
3387                         zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3388                         rctltab.zone_rctl_valptr = NULL;
3389                         continue;
3390                 }
3391                 count = 0;
3392                 for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
3393                     rctlval = rctlval->zone_rctlval_next) {
3394                         count++;
3395                 }
3396                 if (count == 0) {       /* ignore */
3397                         continue;       /* Nothing to free */
3398                 }
3399                 if ((nvlv = malloc(sizeof (*nvlv) * count)) == NULL)
3400                         goto out;
3401                 i = 0;
3402                 for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
3403                     rctlval = rctlval->zone_rctlval_next, i++) {
3404                         if (nvlist_alloc(&nvlv[i], NV_UNIQUE_NAME, 0) != 0) {
3405                                 zerror(zlogp, B_TRUE, "%s failed",
3406                                     "nvlist_alloc");
3407                                 goto out;
3408                         }
3409                         if (zonecfg_construct_rctlblk(rctlval, rctlblk)
3410                             != Z_OK) {
3411                                 zerror(zlogp, B_FALSE, "invalid rctl value: "
3412                                     "(priv=%s,limit=%s,action=%s)",
3413                                     rctlval->zone_rctlval_priv,
3414                                     rctlval->zone_rctlval_limit,
3415                                     rctlval->zone_rctlval_action);
3416                                 goto out;
3417                         }
3418                         if (!zonecfg_valid_rctl(name, rctlblk)) {
3419                                 zerror(zlogp, B_FALSE,
3420                                     "(priv=%s,limit=%s,action=%s) is not a "
3421                                     "valid value for rctl '%s'",
3422                                     rctlval->zone_rctlval_priv,
3423                                     rctlval->zone_rctlval_limit,
3424                                     rctlval->zone_rctlval_action,
3425                                     name);
3426                                 goto out;
3427                         }
3428                         if (nvlist_add_uint64(nvlv[i], "privilege",
3429                             rctlblk_get_privilege(rctlblk)) != 0) {
3430                                 zerror(zlogp, B_FALSE, "%s failed",
3431                                     "nvlist_add_uint64");
3432                                 goto out;
3433                         }
3434                         if (nvlist_add_uint64(nvlv[i], "limit",
3435                             rctlblk_get_value(rctlblk)) != 0) {
3436                                 zerror(zlogp, B_FALSE, "%s failed",
3437                                     "nvlist_add_uint64");
3438                                 goto out;
3439                         }
3440                         if (nvlist_add_uint64(nvlv[i], "action",
3441                             (uint_t)rctlblk_get_local_action(rctlblk, NULL))
3442                             != 0) {
3443                                 zerror(zlogp, B_FALSE, "%s failed",
3444                                     "nvlist_add_uint64");
3445                                 goto out;
3446                         }
3447                 }
3448                 zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3449                 rctltab.zone_rctl_valptr = NULL;
3450                 if (nvlist_add_nvlist_array(nvl, (char *)name, nvlv, count)
3451                     != 0) {
3452                         zerror(zlogp, B_FALSE, "%s failed",
3453                             "nvlist_add_nvlist_array");
3454                         goto out;
3455                 }
3456                 for (i = 0; i < count; i++)
3457                         nvlist_free(nvlv[i]);
3458                 free(nvlv);
3459                 nvlv = NULL;
3460                 rctlcount++;
3461         }
3462         (void) zonecfg_endrctlent(handle);
3463 
3464         if (rctlcount == 0) {
3465                 error = 0;
3466                 goto out;
3467         }
3468         if (nvlist_pack(nvl, &nvl_packed, &nvl_size, NV_ENCODE_NATIVE, 0)
3469             != 0) {
3470                 zerror(zlogp, B_FALSE, "%s failed", "nvlist_pack");
3471                 goto out;
3472         }
3473 
3474         error = 0;
3475         *bufp = nvl_packed;
3476         *bufsizep = nvl_size;
3477 
3478 out:
3479         free(rctlblk);
3480         zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3481         if (error && nvl_packed != NULL)
3482                 free(nvl_packed);
3483         nvlist_free(nvl);
3484         if (nvlv != NULL)
3485                 free(nvlv);
3486         if (handle != NULL)
3487                 zonecfg_fini_handle(handle);
3488         return (error);
3489 }
3490 
3491 static int
3492 get_implicit_datasets(zlog_t *zlogp, char **retstr)
3493 {
3494         char cmdbuf[2 * MAXPATHLEN];
3495 
3496         if (query_hook[0] == '\0')
3497                 return (0);
3498 
3499         if (snprintf(cmdbuf, sizeof (cmdbuf), "%s datasets", query_hook)
3500             > sizeof (cmdbuf))
3501                 return (-1);
3502 
3503         if (do_subproc(zlogp, cmdbuf, retstr) != 0)
3504                 return (-1);
3505 
3506         return (0);
3507 }
3508 
3509 static int
3510 get_datasets(zlog_t *zlogp, char **bufp, size_t *bufsizep)
3511 {
3512         zone_dochandle_t handle;
3513         struct zone_dstab dstab;
3514         size_t total, offset, len;
3515         int error = -1;
3516         char *str = NULL;
3517         char *implicit_datasets = NULL;
3518         int implicit_len = 0;
3519 
3520         *bufp = NULL;
3521         *bufsizep = 0;
3522 
3523         if ((handle = zonecfg_init_handle()) == NULL) {
3524                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
3525                 return (-1);
3526         }
3527         if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
3528                 zerror(zlogp, B_FALSE, "invalid configuration");
3529                 zonecfg_fini_handle(handle);
3530                 return (-1);
3531         }
3532 
3533         if (get_implicit_datasets(zlogp, &implicit_datasets) != 0) {
3534                 zerror(zlogp, B_FALSE, "getting implicit datasets failed");
3535                 goto out;
3536         }
3537 
3538         if (zonecfg_setdsent(handle) != Z_OK) {
3539                 zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
3540                 goto out;
3541         }
3542 
3543         total = 0;
3544         while (zonecfg_getdsent(handle, &dstab) == Z_OK)
3545                 total += strlen(dstab.zone_dataset_name) + 1;
3546         (void) zonecfg_enddsent(handle);
3547 
3548         if (implicit_datasets != NULL)
3549                 implicit_len = strlen(implicit_datasets);
3550         if (implicit_len > 0)
3551                 total += implicit_len + 1;
3552 
3553         if (total == 0) {
3554                 error = 0;
3555                 goto out;
3556         }
3557 
3558         if ((str = malloc(total)) == NULL) {
3559                 zerror(zlogp, B_TRUE, "memory allocation failed");
3560                 goto out;
3561         }
3562 
3563         if (zonecfg_setdsent(handle) != Z_OK) {
3564                 zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
3565                 goto out;
3566         }
3567         offset = 0;
3568         while (zonecfg_getdsent(handle, &dstab) == Z_OK) {
3569                 len = strlen(dstab.zone_dataset_name);
3570                 (void) strlcpy(str + offset, dstab.zone_dataset_name,
3571                     total - offset);
3572                 offset += len;
3573                 if (offset < total - 1)
3574                         str[offset++] = ',';
3575         }
3576         (void) zonecfg_enddsent(handle);
3577 
3578         if (implicit_len > 0)
3579                 (void) strlcpy(str + offset, implicit_datasets, total - offset);
3580 
3581         error = 0;
3582         *bufp = str;
3583         *bufsizep = total;
3584 
3585 out:
3586         if (error != 0 && str != NULL)
3587                 free(str);
3588         if (handle != NULL)
3589                 zonecfg_fini_handle(handle);
3590         if (implicit_datasets != NULL)
3591                 free(implicit_datasets);
3592 
3593         return (error);
3594 }
3595 
3596 static int
3597 validate_datasets(zlog_t *zlogp)
3598 {
3599         zone_dochandle_t handle;
3600         struct zone_dstab dstab;
3601         zfs_handle_t *zhp;
3602         libzfs_handle_t *hdl;
3603 
3604         if ((handle = zonecfg_init_handle()) == NULL) {
3605                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
3606                 return (-1);
3607         }
3608         if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
3609                 zerror(zlogp, B_FALSE, "invalid configuration");
3610                 zonecfg_fini_handle(handle);
3611                 return (-1);
3612         }
3613 
3614         if (zonecfg_setdsent(handle) != Z_OK) {
3615                 zerror(zlogp, B_FALSE, "invalid configuration");
3616                 zonecfg_fini_handle(handle);
3617                 return (-1);
3618         }
3619 
3620         if ((hdl = libzfs_init()) == NULL) {
3621                 zerror(zlogp, B_FALSE, "opening ZFS library");
3622                 zonecfg_fini_handle(handle);
3623                 return (-1);
3624         }
3625 
3626         while (zonecfg_getdsent(handle, &dstab) == Z_OK) {
3627 
3628                 if ((zhp = zfs_open(hdl, dstab.zone_dataset_name,
3629                     ZFS_TYPE_FILESYSTEM)) == NULL) {
3630                         zerror(zlogp, B_FALSE, "cannot open ZFS dataset '%s'",
3631                             dstab.zone_dataset_name);
3632                         zonecfg_fini_handle(handle);
3633                         libzfs_fini(hdl);
3634                         return (-1);
3635                 }
3636 
3637                 /*
3638                  * Automatically set the 'zoned' property.  We check the value
3639                  * first because we'll get EPERM if it is already set.
3640                  */
3641                 if (!zfs_prop_get_int(zhp, ZFS_PROP_ZONED) &&
3642                     zfs_prop_set(zhp, zfs_prop_to_name(ZFS_PROP_ZONED),
3643                     "on") != 0) {
3644                         zerror(zlogp, B_FALSE, "cannot set 'zoned' "
3645                             "property for ZFS dataset '%s'\n",
3646                             dstab.zone_dataset_name);
3647                         zonecfg_fini_handle(handle);
3648                         zfs_close(zhp);
3649                         libzfs_fini(hdl);
3650                         return (-1);
3651                 }
3652 
3653                 zfs_close(zhp);
3654         }
3655         (void) zonecfg_enddsent(handle);
3656 
3657         zonecfg_fini_handle(handle);
3658         libzfs_fini(hdl);
3659 
3660         return (0);
3661 }
3662 
3663 /*
3664  * Return true if the path is its own zfs file system.  We determine this
3665  * by stat-ing the path to see if it is zfs and stat-ing the parent to see
3666  * if it is a different fs.
3667  */
3668 boolean_t
3669 is_zonepath_zfs(char *zonepath)
3670 {
3671         int res;
3672         char *path;
3673         char *parent;
3674         struct statvfs64 buf1, buf2;
3675 
3676         if (statvfs64(zonepath, &buf1) != 0)
3677                 return (B_FALSE);
3678 
3679         if (strcmp(buf1.f_basetype, "zfs") != 0)
3680                 return (B_FALSE);
3681 
3682         if ((path = strdup(zonepath)) == NULL)
3683                 return (B_FALSE);
3684 
3685         parent = dirname(path);
3686         res = statvfs64(parent, &buf2);
3687         free(path);
3688 
3689         if (res != 0)
3690                 return (B_FALSE);
3691 
3692         if (buf1.f_fsid == buf2.f_fsid)
3693                 return (B_FALSE);
3694 
3695         return (B_TRUE);
3696 }
3697 
3698 /*
3699  * Verify the MAC label in the root dataset for the zone.
3700  * If the label exists, it must match the label configured for the zone.
3701  * Otherwise if there's no label on the dataset, create one here.
3702  */
3703 
3704 static int
3705 validate_rootds_label(zlog_t *zlogp, char *rootpath, m_label_t *zone_sl)
3706 {
3707         int             error = -1;
3708         zfs_handle_t    *zhp;
3709         libzfs_handle_t *hdl;
3710         m_label_t       ds_sl;
3711         char            zonepath[MAXPATHLEN];
3712         char            ds_hexsl[MAXNAMELEN];
3713 
3714         if (!is_system_labeled())
3715                 return (0);
3716 
3717         if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
3718                 zerror(zlogp, B_TRUE, "unable to determine zone path");
3719                 return (-1);
3720         }
3721 
3722         if (!is_zonepath_zfs(zonepath))
3723                 return (0);
3724 
3725         if ((hdl = libzfs_init()) == NULL) {
3726                 zerror(zlogp, B_FALSE, "opening ZFS library");
3727                 return (-1);
3728         }
3729 
3730         if ((zhp = zfs_path_to_zhandle(hdl, rootpath,
3731             ZFS_TYPE_FILESYSTEM)) == NULL) {
3732                 zerror(zlogp, B_FALSE, "cannot open ZFS dataset for path '%s'",
3733                     rootpath);
3734                 libzfs_fini(hdl);
3735                 return (-1);
3736         }
3737 
3738         /* Get the mlslabel property if it exists. */
3739         if ((zfs_prop_get(zhp, ZFS_PROP_MLSLABEL, ds_hexsl, MAXNAMELEN,
3740             NULL, NULL, 0, B_TRUE) != 0) ||
3741             (strcmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) == 0)) {
3742                 char            *str2 = NULL;
3743 
3744                 /*
3745                  * No label on the dataset (or default only); create one.
3746                  * (Only do this automatic labeling for the labeled brand.)
3747                  */
3748                 if (strcmp(brand_name, LABELED_BRAND_NAME) != 0) {
3749                         error = 0;
3750                         goto out;
3751                 }
3752 
3753                 error = l_to_str_internal(zone_sl, &str2);
3754                 if (error)
3755                         goto out;
3756                 if (str2 == NULL) {
3757                         error = -1;
3758                         goto out;
3759                 }
3760                 if ((error = zfs_prop_set(zhp,
3761                     zfs_prop_to_name(ZFS_PROP_MLSLABEL), str2)) != 0) {
3762                         zerror(zlogp, B_FALSE, "cannot set 'mlslabel' "
3763                             "property for root dataset at '%s'\n", rootpath);
3764                 }
3765                 free(str2);
3766                 goto out;
3767         }
3768 
3769         /* Convert the retrieved dataset label to binary form. */
3770         error = hexstr_to_label(ds_hexsl, &ds_sl);
3771         if (error) {
3772                 zerror(zlogp, B_FALSE, "invalid 'mlslabel' "
3773                     "property on root dataset at '%s'\n", rootpath);
3774                 goto out;                       /* exit with error */
3775         }
3776 
3777         /*
3778          * Perform a MAC check by comparing the zone label with the
3779          * dataset label.
3780          */
3781         error = (!blequal(zone_sl, &ds_sl));
3782         if (error)
3783                 zerror(zlogp, B_FALSE, "Rootpath dataset has mismatched label");
3784 out:
3785         zfs_close(zhp);
3786         libzfs_fini(hdl);
3787 
3788         return (error);
3789 }
3790 
3791 /*
3792  * Mount lower level home directories into/from current zone
3793  * Share exported directories specified in dfstab for zone
3794  */
3795 static int
3796 tsol_mounts(zlog_t *zlogp, char *zone_name, char *rootpath)
3797 {
3798         zoneid_t *zids = NULL;
3799         priv_set_t *zid_privs;
3800         const priv_impl_info_t *ip = NULL;
3801         uint_t nzents_saved;
3802         uint_t nzents;
3803         int i;
3804         char readonly[] = "ro";
3805         struct zone_fstab lower_fstab;
3806         char *argv[4];
3807 
3808         if (!is_system_labeled())
3809                 return (0);
3810 
3811         if (zid_label == NULL) {
3812                 zid_label = m_label_alloc(MAC_LABEL);
3813                 if (zid_label == NULL)
3814                         return (-1);
3815         }
3816 
3817         /* Make sure our zone has an /export/home dir */
3818         (void) make_one_dir(zlogp, rootpath, "/export/home",
3819             DEFAULT_DIR_MODE, DEFAULT_DIR_USER, DEFAULT_DIR_GROUP);
3820 
3821         lower_fstab.zone_fs_raw[0] = '\0';
3822         (void) strlcpy(lower_fstab.zone_fs_type, MNTTYPE_LOFS,
3823             sizeof (lower_fstab.zone_fs_type));
3824         lower_fstab.zone_fs_options = NULL;
3825         (void) zonecfg_add_fs_option(&lower_fstab, readonly);
3826 
3827         /*
3828          * Get the list of zones from the kernel
3829          */
3830         if (zone_list(NULL, &nzents) != 0) {
3831                 zerror(zlogp, B_TRUE, "unable to list zones");
3832                 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3833                 return (-1);
3834         }
3835 again:
3836         if (nzents == 0) {
3837                 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3838                 return (-1);
3839         }
3840 
3841         zids = malloc(nzents * sizeof (zoneid_t));
3842         if (zids == NULL) {
3843                 zerror(zlogp, B_TRUE, "memory allocation failed");
3844                 return (-1);
3845         }
3846         nzents_saved = nzents;
3847 
3848         if (zone_list(zids, &nzents) != 0) {
3849                 zerror(zlogp, B_TRUE, "unable to list zones");
3850                 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3851                 free(zids);
3852                 return (-1);
3853         }
3854         if (nzents != nzents_saved) {
3855                 /* list changed, try again */
3856                 free(zids);
3857                 goto again;
3858         }
3859 
3860         ip = getprivimplinfo();
3861         if ((zid_privs = priv_allocset()) == NULL) {
3862                 zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
3863                 zonecfg_free_fs_option_list(
3864                     lower_fstab.zone_fs_options);
3865                 free(zids);
3866                 return (-1);
3867         }
3868 
3869         for (i = 0; i < nzents; i++) {
3870                 char zid_name[ZONENAME_MAX];
3871                 zone_state_t zid_state;
3872                 char zid_rpath[MAXPATHLEN];
3873                 struct stat stat_buf;
3874 
3875                 if (zids[i] == GLOBAL_ZONEID)
3876                         continue;
3877 
3878                 if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
3879                         continue;
3880 
3881                 /*
3882                  * Do special setup for the zone we are booting
3883                  */
3884                 if (strcmp(zid_name, zone_name) == 0) {
3885                         struct zone_fstab autofs_fstab;
3886                         char map_path[MAXPATHLEN];
3887                         int fd;
3888 
3889                         /*
3890                          * Create auto_home_<zone> map for this zone
3891                          * in the global zone. The non-global zone entry
3892                          * will be created by automount when the zone
3893                          * is booted.
3894                          */
3895 
3896                         (void) snprintf(autofs_fstab.zone_fs_special,
3897                             MAXPATHLEN, "auto_home_%s", zid_name);
3898 
3899                         (void) snprintf(autofs_fstab.zone_fs_dir, MAXPATHLEN,
3900                             "/zone/%s/home", zid_name);
3901 
3902                         (void) snprintf(map_path, sizeof (map_path),
3903                             "/etc/%s", autofs_fstab.zone_fs_special);
3904                         /*
3905                          * If the map file doesn't exist create a template
3906                          */
3907                         if ((fd = open(map_path, O_RDWR | O_CREAT | O_EXCL,
3908                             S_IRUSR | S_IWUSR | S_IRGRP| S_IROTH)) != -1) {
3909                                 int len;
3910                                 char map_rec[MAXPATHLEN];
3911 
3912                                 len = snprintf(map_rec, sizeof (map_rec),
3913                                     "+%s\n*\t-fstype=lofs\t:%s/export/home/&\n",
3914                                     autofs_fstab.zone_fs_special, rootpath);
3915                                 (void) write(fd, map_rec, len);
3916                                 (void) close(fd);
3917                         }
3918 
3919                         /*
3920                          * Mount auto_home_<zone> in the global zone if absent.
3921                          * If it's already of type autofs, then
3922                          * don't mount it again.
3923                          */
3924                         if ((stat(autofs_fstab.zone_fs_dir, &stat_buf) == -1) ||
3925                             strcmp(stat_buf.st_fstype, MNTTYPE_AUTOFS) != 0) {
3926                                 char optstr[] = "indirect,ignore,nobrowse";
3927 
3928                                 (void) make_one_dir(zlogp, "",
3929                                     autofs_fstab.zone_fs_dir, DEFAULT_DIR_MODE,
3930                                     DEFAULT_DIR_USER, DEFAULT_DIR_GROUP);
3931 
3932                                 /*
3933                                  * Mount will fail if automounter has already
3934                                  * processed the auto_home_<zonename> map
3935                                  */
3936                                 (void) domount(zlogp, MNTTYPE_AUTOFS, optstr,
3937                                     autofs_fstab.zone_fs_special,
3938                                     autofs_fstab.zone_fs_dir);
3939                         }
3940                         continue;
3941                 }
3942 
3943 
3944                 if (zone_get_state(zid_name, &zid_state) != Z_OK ||
3945                     (zid_state != ZONE_STATE_READY &&
3946                     zid_state != ZONE_STATE_RUNNING))
3947                         /* Skip over zones without mounted filesystems */
3948                         continue;
3949 
3950                 if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
3951                     sizeof (m_label_t)) < 0)
3952                         /* Skip over zones with unspecified label */
3953                         continue;
3954 
3955                 if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
3956                     sizeof (zid_rpath)) == -1)
3957                         /* Skip over zones with bad path */
3958                         continue;
3959 
3960                 if (zone_getattr(zids[i], ZONE_ATTR_PRIVSET, zid_privs,
3961                     sizeof (priv_chunk_t) * ip->priv_setsize) == -1)
3962                         /* Skip over zones with bad privs */
3963                         continue;
3964 
3965                 /*
3966                  * Reading down is valid according to our label model
3967                  * but some customers want to disable it because it
3968                  * allows execute down and other possible attacks.
3969                  * Therefore, we restrict this feature to zones that
3970                  * have the NET_MAC_AWARE privilege which is required
3971                  * for NFS read-down semantics.
3972                  */
3973                 if ((bldominates(zlabel, zid_label)) &&
3974                     (priv_ismember(zprivs, PRIV_NET_MAC_AWARE))) {
3975                         /*
3976                          * Our zone dominates this one.
3977                          * Create a lofs mount from lower zone's /export/home
3978                          */
3979                         (void) snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
3980                             "%s/zone/%s/export/home", rootpath, zid_name);
3981 
3982                         /*
3983                          * If the target is already an LOFS mount
3984                          * then don't do it again.
3985                          */
3986                         if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
3987                             strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
3988 
3989                                 if (snprintf(lower_fstab.zone_fs_special,
3990                                     MAXPATHLEN, "%s/export",
3991                                     zid_rpath) > MAXPATHLEN)
3992                                         continue;
3993 
3994                                 /*
3995                                  * Make sure the lower-level home exists
3996                                  */
3997                                 if (make_one_dir(zlogp,
3998                                     lower_fstab.zone_fs_special, "/home",
3999                                     DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
4000                                     DEFAULT_DIR_GROUP) != 0)
4001                                         continue;
4002 
4003                                 (void) strlcat(lower_fstab.zone_fs_special,
4004                                     "/home", MAXPATHLEN);
4005 
4006                                 /*
4007                                  * Mount can fail because the lower-level
4008                                  * zone may have already done a mount up.
4009                                  */
4010                                 (void) mount_one(zlogp, &lower_fstab, "",
4011                                     Z_MNT_BOOT);
4012                         }
4013                 } else if ((bldominates(zid_label, zlabel)) &&
4014                     (priv_ismember(zid_privs, PRIV_NET_MAC_AWARE))) {
4015                         /*
4016                          * This zone dominates our zone.
4017                          * Create a lofs mount from our zone's /export/home
4018                          */
4019                         if (snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
4020                             "%s/zone/%s/export/home", zid_rpath,
4021                             zone_name) > MAXPATHLEN)
4022                                 continue;
4023 
4024                         /*
4025                          * If the target is already an LOFS mount
4026                          * then don't do it again.
4027                          */
4028                         if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
4029                             strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
4030 
4031                                 (void) snprintf(lower_fstab.zone_fs_special,
4032                                     MAXPATHLEN, "%s/export/home", rootpath);
4033 
4034                                 /*
4035                                  * Mount can fail because the higher-level
4036                                  * zone may have already done a mount down.
4037                                  */
4038                                 (void) mount_one(zlogp, &lower_fstab, "",
4039                                     Z_MNT_BOOT);
4040                         }
4041                 }
4042         }
4043         zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
4044         priv_freeset(zid_privs);
4045         free(zids);
4046 
4047         /*
4048          * Now share any exported directories from this zone.
4049          * Each zone can have its own dfstab.
4050          */
4051 
4052         argv[0] = "zoneshare";
4053         argv[1] = "-z";
4054         argv[2] = zone_name;
4055         argv[3] = NULL;
4056 
4057         (void) forkexec(zlogp, "/usr/lib/zones/zoneshare", argv);
4058         /* Don't check for errors since they don't affect the zone */
4059 
4060         return (0);
4061 }
4062 
4063 /*
4064  * Unmount lofs mounts from higher level zones
4065  * Unshare nfs exported directories
4066  */
4067 static void
4068 tsol_unmounts(zlog_t *zlogp, char *zone_name)
4069 {
4070         zoneid_t *zids = NULL;
4071         uint_t nzents_saved;
4072         uint_t nzents;
4073         int i;
4074         char *argv[4];
4075         char path[MAXPATHLEN];
4076 
4077         if (!is_system_labeled())
4078                 return;
4079 
4080         /*
4081          * Get the list of zones from the kernel
4082          */
4083         if (zone_list(NULL, &nzents) != 0) {
4084                 return;
4085         }
4086 
4087         if (zid_label == NULL) {
4088                 zid_label = m_label_alloc(MAC_LABEL);
4089                 if (zid_label == NULL)
4090                         return;
4091         }
4092 
4093 again:
4094         if (nzents == 0)
4095                 return;
4096 
4097         zids = malloc(nzents * sizeof (zoneid_t));
4098         if (zids == NULL) {
4099                 zerror(zlogp, B_TRUE, "memory allocation failed");
4100                 return;
4101         }
4102         nzents_saved = nzents;
4103 
4104         if (zone_list(zids, &nzents) != 0) {
4105                 free(zids);
4106                 return;
4107         }
4108         if (nzents != nzents_saved) {
4109                 /* list changed, try again */
4110                 free(zids);
4111                 goto again;
4112         }
4113 
4114         for (i = 0; i < nzents; i++) {
4115                 char zid_name[ZONENAME_MAX];
4116                 zone_state_t zid_state;
4117                 char zid_rpath[MAXPATHLEN];
4118 
4119                 if (zids[i] == GLOBAL_ZONEID)
4120                         continue;
4121 
4122                 if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
4123                         continue;
4124 
4125                 /*
4126                  * Skip the zone we are halting
4127                  */
4128                 if (strcmp(zid_name, zone_name) == 0)
4129                         continue;
4130 
4131                 if ((zone_getattr(zids[i], ZONE_ATTR_STATUS, &zid_state,
4132                     sizeof (zid_state)) < 0) ||
4133                     (zid_state < ZONE_IS_READY))
4134                         /* Skip over zones without mounted filesystems */
4135                         continue;
4136 
4137                 if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
4138                     sizeof (m_label_t)) < 0)
4139                         /* Skip over zones with unspecified label */
4140                         continue;
4141 
4142                 if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
4143                     sizeof (zid_rpath)) == -1)
4144                         /* Skip over zones with bad path */
4145                         continue;
4146 
4147                 if (zlabel != NULL && bldominates(zid_label, zlabel)) {
4148                         /*
4149                          * This zone dominates our zone.
4150                          * Unmount the lofs mount of our zone's /export/home
4151                          */
4152 
4153                         if (snprintf(path, MAXPATHLEN,
4154                             "%s/zone/%s/export/home", zid_rpath,
4155                             zone_name) > MAXPATHLEN)
4156                                 continue;
4157 
4158                         /* Skip over mount failures */
4159                         (void) umount(path);
4160                 }
4161         }
4162         free(zids);
4163 
4164         /*
4165          * Unmount global zone autofs trigger for this zone
4166          */
4167         (void) snprintf(path, MAXPATHLEN, "/zone/%s/home", zone_name);
4168         /* Skip over mount failures */
4169         (void) umount(path);
4170 
4171         /*
4172          * Next unshare any exported directories from this zone.
4173          */
4174 
4175         argv[0] = "zoneunshare";
4176         argv[1] = "-z";
4177         argv[2] = zone_name;
4178         argv[3] = NULL;
4179 
4180         (void) forkexec(zlogp, "/usr/lib/zones/zoneunshare", argv);
4181         /* Don't check for errors since they don't affect the zone */
4182 
4183         /*
4184          * Finally, deallocate any devices in the zone.
4185          */
4186 
4187         argv[0] = "deallocate";
4188         argv[1] = "-Isz";
4189         argv[2] = zone_name;
4190         argv[3] = NULL;
4191 
4192         (void) forkexec(zlogp, "/usr/sbin/deallocate", argv);
4193         /* Don't check for errors since they don't affect the zone */
4194 }
4195 
4196 /*
4197  * Fetch the Trusted Extensions label and multi-level ports (MLPs) for
4198  * this zone.
4199  */
4200 static tsol_zcent_t *
4201 get_zone_label(zlog_t *zlogp, priv_set_t *privs)
4202 {
4203         FILE *fp;
4204         tsol_zcent_t *zcent = NULL;
4205         char line[MAXTNZLEN];
4206 
4207         if ((fp = fopen(TNZONECFG_PATH, "r")) == NULL) {
4208                 zerror(zlogp, B_TRUE, "%s", TNZONECFG_PATH);
4209                 return (NULL);
4210         }
4211 
4212         while (fgets(line, sizeof (line), fp) != NULL) {
4213                 /*
4214                  * Check for malformed database
4215                  */
4216                 if (strlen(line) == MAXTNZLEN - 1)
4217                         break;
4218                 if ((zcent = tsol_sgetzcent(line, NULL, NULL)) == NULL)
4219                         continue;
4220                 if (strcmp(zcent->zc_name, zone_name) == 0)
4221                         break;
4222                 tsol_freezcent(zcent);
4223                 zcent = NULL;
4224         }
4225         (void) fclose(fp);
4226 
4227         if (zcent == NULL) {
4228                 zerror(zlogp, B_FALSE, "zone requires a label assignment. "
4229                     "See tnzonecfg(4)");
4230         } else {
4231                 if (zlabel == NULL)
4232                         zlabel = m_label_alloc(MAC_LABEL);
4233                 /*
4234                  * Save this zone's privileges for later read-down processing
4235                  */
4236                 if ((zprivs = priv_allocset()) == NULL) {
4237                         zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
4238                         return (NULL);
4239                 } else {
4240                         priv_copyset(privs, zprivs);
4241                 }
4242         }
4243         return (zcent);
4244 }
4245 
4246 /*
4247  * Add the Trusted Extensions multi-level ports for this zone.
4248  */
4249 static void
4250 set_mlps(zlog_t *zlogp, zoneid_t zoneid, tsol_zcent_t *zcent)
4251 {
4252         tsol_mlp_t *mlp;
4253         tsol_mlpent_t tsme;
4254 
4255         if (!is_system_labeled())
4256                 return;
4257 
4258         tsme.tsme_zoneid = zoneid;
4259         tsme.tsme_flags = 0;
4260         for (mlp = zcent->zc_private_mlp; !TSOL_MLP_END(mlp); mlp++) {
4261                 tsme.tsme_mlp = *mlp;
4262                 if (tnmlp(TNDB_LOAD, &tsme) != 0) {
4263                         zerror(zlogp, B_TRUE, "cannot set zone-specific MLP "
4264                             "on %d-%d/%d", mlp->mlp_port,
4265                             mlp->mlp_port_upper, mlp->mlp_ipp);
4266                 }
4267         }
4268 
4269         tsme.tsme_flags = TSOL_MEF_SHARED;
4270         for (mlp = zcent->zc_shared_mlp; !TSOL_MLP_END(mlp); mlp++) {
4271                 tsme.tsme_mlp = *mlp;
4272                 if (tnmlp(TNDB_LOAD, &tsme) != 0) {
4273                         zerror(zlogp, B_TRUE, "cannot set shared MLP "
4274                             "on %d-%d/%d", mlp->mlp_port,
4275                             mlp->mlp_port_upper, mlp->mlp_ipp);
4276                 }
4277         }
4278 }
4279 
4280 static void
4281 remove_mlps(zlog_t *zlogp, zoneid_t zoneid)
4282 {
4283         tsol_mlpent_t tsme;
4284 
4285         if (!is_system_labeled())
4286                 return;
4287 
4288         (void) memset(&tsme, 0, sizeof (tsme));
4289         tsme.tsme_zoneid = zoneid;
4290         if (tnmlp(TNDB_FLUSH, &tsme) != 0)
4291                 zerror(zlogp, B_TRUE, "cannot flush MLPs");
4292 }
4293 
4294 int
4295 prtmount(const struct mnttab *fs, void *x)
4296 {
4297         zerror((zlog_t *)x, B_FALSE, "  %s", fs->mnt_mountp);
4298         return (0);
4299 }
4300 
4301 /*
4302  * Look for zones running on the main system that are using this root (or any
4303  * subdirectory of it).  Return B_TRUE and print an error if a conflicting zone
4304  * is found or if we can't tell.
4305  */
4306 static boolean_t
4307 duplicate_zone_root(zlog_t *zlogp, const char *rootpath)
4308 {
4309         zoneid_t *zids = NULL;
4310         uint_t nzids = 0;
4311         boolean_t retv;
4312         int rlen, zlen;
4313         char zroot[MAXPATHLEN];
4314         char zonename[ZONENAME_MAX];
4315 
4316         for (;;) {
4317                 nzids += 10;
4318                 zids = malloc(nzids * sizeof (*zids));
4319                 if (zids == NULL) {
4320                         zerror(zlogp, B_TRUE, "memory allocation failed");
4321                         return (B_TRUE);
4322                 }
4323                 if (zone_list(zids, &nzids) == 0)
4324                         break;
4325                 free(zids);
4326         }
4327         retv = B_FALSE;
4328         rlen = strlen(rootpath);
4329         while (nzids > 0) {
4330                 /*
4331                  * Ignore errors; they just mean that the zone has disappeared
4332                  * while we were busy.
4333                  */
4334                 if (zone_getattr(zids[--nzids], ZONE_ATTR_ROOT, zroot,
4335                     sizeof (zroot)) == -1)
4336                         continue;
4337                 zlen = strlen(zroot);
4338                 if (zlen > rlen)
4339                         zlen = rlen;
4340                 if (strncmp(rootpath, zroot, zlen) == 0 &&
4341                     (zroot[zlen] == '\0' || zroot[zlen] == '/') &&
4342                     (rootpath[zlen] == '\0' || rootpath[zlen] == '/')) {
4343                         if (getzonenamebyid(zids[nzids], zonename,
4344                             sizeof (zonename)) == -1)
4345                                 (void) snprintf(zonename, sizeof (zonename),
4346                                     "id %d", (int)zids[nzids]);
4347                         zerror(zlogp, B_FALSE,
4348                             "zone root %s already in use by zone %s",
4349                             rootpath, zonename);
4350                         retv = B_TRUE;
4351                         break;
4352                 }
4353         }
4354         free(zids);
4355         return (retv);
4356 }
4357 
4358 /*
4359  * Search for loopback mounts that use this same source node (same device and
4360  * inode).  Return B_TRUE if there is one or if we can't tell.
4361  */
4362 static boolean_t
4363 duplicate_reachable_path(zlog_t *zlogp, const char *rootpath)
4364 {
4365         struct stat64 rst, zst;
4366         struct mnttab *mnp;
4367 
4368         if (stat64(rootpath, &rst) == -1) {
4369                 zerror(zlogp, B_TRUE, "can't stat %s", rootpath);
4370                 return (B_TRUE);
4371         }
4372         if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
4373                 return (B_TRUE);
4374         for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max; mnp++) {
4375                 if (mnp->mnt_fstype == NULL ||
4376                     strcmp(MNTTYPE_LOFS, mnp->mnt_fstype) != 0)
4377                         continue;
4378                 /* We're looking at a loopback mount.  Stat it. */
4379                 if (mnp->mnt_special != NULL &&
4380                     stat64(mnp->mnt_special, &zst) != -1 &&
4381                     rst.st_dev == zst.st_dev && rst.st_ino == zst.st_ino) {
4382                         zerror(zlogp, B_FALSE,
4383                             "zone root %s is reachable through %s",
4384                             rootpath, mnp->mnt_mountp);
4385                         return (B_TRUE);
4386                 }
4387         }
4388         return (B_FALSE);
4389 }
4390 
4391 /*
4392  * Set memory cap and pool info for the zone's resource management
4393  * configuration.
4394  */
4395 static int
4396 setup_zone_rm(zlog_t *zlogp, char *zone_name, zoneid_t zoneid)
4397 {
4398         int res;
4399         uint64_t tmp;
4400         struct zone_mcaptab mcap;
4401         char sched[MAXNAMELEN];
4402         zone_dochandle_t handle = NULL;
4403         char pool_err[128];
4404 
4405         if ((handle = zonecfg_init_handle()) == NULL) {
4406                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
4407                 return (Z_BAD_HANDLE);
4408         }
4409 
4410         if ((res = zonecfg_get_snapshot_handle(zone_name, handle)) != Z_OK) {
4411                 zerror(zlogp, B_FALSE, "invalid configuration");
4412                 zonecfg_fini_handle(handle);
4413                 return (res);
4414         }
4415 
4416         /*
4417          * If a memory cap is configured, set the cap in the kernel using
4418          * zone_setattr() and make sure the rcapd SMF service is enabled.
4419          */
4420         if (zonecfg_getmcapent(handle, &mcap) == Z_OK) {
4421                 uint64_t num;
4422                 char smf_err[128];
4423 
4424                 num = (uint64_t)strtoull(mcap.zone_physmem_cap, NULL, 10);
4425                 if (zone_setattr(zoneid, ZONE_ATTR_PHYS_MCAP, &num, 0) == -1) {
4426                         zerror(zlogp, B_TRUE, "could not set zone memory cap");
4427                         zonecfg_fini_handle(handle);
4428                         return (Z_INVAL);
4429                 }
4430 
4431                 if (zonecfg_enable_rcapd(smf_err, sizeof (smf_err)) != Z_OK) {
4432                         zerror(zlogp, B_FALSE, "enabling system/rcap service "
4433                             "failed: %s", smf_err);
4434                         zonecfg_fini_handle(handle);
4435                         return (Z_INVAL);
4436                 }
4437         }
4438 
4439         /* Get the scheduling class set in the zone configuration. */
4440         if (zonecfg_get_sched_class(handle, sched, sizeof (sched)) == Z_OK &&
4441             strlen(sched) > 0) {
4442                 if (zone_setattr(zoneid, ZONE_ATTR_SCHED_CLASS, sched,
4443                     strlen(sched)) == -1)
4444                         zerror(zlogp, B_TRUE, "WARNING: unable to set the "
4445                             "default scheduling class");
4446 
4447         } else if (zonecfg_get_aliased_rctl(handle, ALIAS_SHARES, &tmp)
4448             == Z_OK) {
4449                 /*
4450                  * If the zone has the zone.cpu-shares rctl set then we want to
4451                  * use the Fair Share Scheduler (FSS) for processes in the
4452                  * zone.  Check what scheduling class the zone would be running
4453                  * in by default so we can print a warning and modify the class
4454                  * if we wouldn't be using FSS.
4455                  */
4456                 char class_name[PC_CLNMSZ];
4457 
4458                 if (zonecfg_get_dflt_sched_class(handle, class_name,
4459                     sizeof (class_name)) != Z_OK) {
4460                         zerror(zlogp, B_FALSE, "WARNING: unable to determine "
4461                             "the zone's scheduling class");
4462 
4463                 } else if (strcmp("FSS", class_name) != 0) {
4464                         zerror(zlogp, B_FALSE, "WARNING: The zone.cpu-shares "
4465                             "rctl is set but\nFSS is not the default "
4466                             "scheduling class for\nthis zone.  FSS will be "
4467                             "used for processes\nin the zone but to get the "
4468                             "full benefit of FSS,\nit should be the default "
4469                             "scheduling class.\nSee dispadmin(1M) for more "
4470                             "details.");
4471 
4472                         if (zone_setattr(zoneid, ZONE_ATTR_SCHED_CLASS, "FSS",
4473                             strlen("FSS")) == -1)
4474                                 zerror(zlogp, B_TRUE, "WARNING: unable to set "
4475                                     "zone scheduling class to FSS");
4476                 }
4477         }
4478 
4479         /*
4480          * The next few blocks of code attempt to set up temporary pools as
4481          * well as persistent pools.  In all cases we call the functions
4482          * unconditionally.  Within each funtion the code will check if the
4483          * zone is actually configured for a temporary pool or persistent pool
4484          * and just return if there is nothing to do.
4485          *
4486          * If we are rebooting we want to attempt to reuse any temporary pool
4487          * that was previously set up.  zonecfg_bind_tmp_pool() will do the
4488          * right thing in all cases (reuse or create) based on the current
4489          * zonecfg.
4490          */
4491         if ((res = zonecfg_bind_tmp_pool(handle, zoneid, pool_err,
4492             sizeof (pool_err))) != Z_OK) {
4493                 if (res == Z_POOL || res == Z_POOL_CREATE || res == Z_POOL_BIND)
4494                         zerror(zlogp, B_FALSE, "%s: %s\ndedicated-cpu setting "
4495                             "cannot be instantiated", zonecfg_strerror(res),
4496                             pool_err);
4497                 else
4498                         zerror(zlogp, B_FALSE, "could not bind zone to "
4499                             "temporary pool: %s", zonecfg_strerror(res));
4500                 zonecfg_fini_handle(handle);
4501                 return (Z_POOL_BIND);
4502         }
4503 
4504         /*
4505          * Check if we need to warn about poold not being enabled.
4506          */
4507         if (zonecfg_warn_poold(handle)) {
4508                 zerror(zlogp, B_FALSE, "WARNING: A range of dedicated-cpus has "
4509                     "been specified\nbut the dynamic pool service is not "
4510                     "enabled.\nThe system will not dynamically adjust the\n"
4511                     "processor allocation within the specified range\n"
4512                     "until svc:/system/pools/dynamic is enabled.\n"
4513                     "See poold(1M).");
4514         }
4515 
4516         /* The following is a warning, not an error. */
4517         if ((res = zonecfg_bind_pool(handle, zoneid, pool_err,
4518             sizeof (pool_err))) != Z_OK) {
4519                 if (res == Z_POOL_BIND)
4520                         zerror(zlogp, B_FALSE, "WARNING: unable to bind to "
4521                             "pool '%s'; using default pool.", pool_err);
4522                 else if (res == Z_POOL)
4523                         zerror(zlogp, B_FALSE, "WARNING: %s: %s",
4524                             zonecfg_strerror(res), pool_err);
4525                 else
4526                         zerror(zlogp, B_FALSE, "WARNING: %s",
4527                             zonecfg_strerror(res));
4528         }
4529 
4530         /* Update saved pool name in case it has changed */
4531         (void) zonecfg_get_poolname(handle, zone_name, pool_name,
4532             sizeof (pool_name));
4533 
4534         zonecfg_fini_handle(handle);
4535         return (Z_OK);
4536 }
4537 
4538 static void
4539 report_prop_err(zlog_t *zlogp, const char *name, const char *value, int res)
4540 {
4541         switch (res) {
4542         case Z_TOO_BIG:
4543                 zerror(zlogp, B_FALSE, "%s property value is too large.", name);
4544                 break;
4545 
4546         case Z_INVALID_PROPERTY:
4547                 zerror(zlogp, B_FALSE, "%s property value \"%s\" is not valid",
4548                     name, value);
4549                 break;
4550 
4551         default:
4552                 zerror(zlogp, B_TRUE, "fetching property %s: %d", name, res);
4553                 break;
4554         }
4555 }
4556 
4557 /*
4558  * Sets the hostid of the new zone based on its configured value.  The zone's
4559  * zone_t structure must already exist in kernel memory.  'zlogp' refers to the
4560  * log used to report errors and warnings and must be non-NULL.  'zone_namep'
4561  * is the name of the new zone and must be non-NULL.  'zoneid' is the numeric
4562  * ID of the new zone.
4563  *
4564  * This function returns zero on success and a nonzero error code on failure.
4565  */
4566 static int
4567 setup_zone_hostid(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4568 {
4569         int res;
4570         char hostidp[HW_HOSTID_LEN];
4571         unsigned int hostid;
4572 
4573         res = zonecfg_get_hostid(handle, hostidp, sizeof (hostidp));
4574 
4575         if (res == Z_BAD_PROPERTY) {
4576                 return (Z_OK);
4577         } else if (res != Z_OK) {
4578                 report_prop_err(zlogp, "hostid", hostidp, res);
4579                 return (res);
4580         }
4581 
4582         hostid = (unsigned int)strtoul(hostidp, NULL, 16);
4583         if ((res = zone_setattr(zoneid, ZONE_ATTR_HOSTID, &hostid,
4584             sizeof (hostid))) != 0) {
4585                 zerror(zlogp, B_TRUE,
4586                     "zone hostid is not valid: %s: %d", hostidp, res);
4587                 return (Z_SYSTEM);
4588         }
4589 
4590         return (res);
4591 }
4592 
4593 static int
4594 setup_zone_fs_allowed(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4595 {
4596         char fsallowed[ZONE_FS_ALLOWED_MAX];
4597         char *fsallowedp = fsallowed;
4598         int len = sizeof (fsallowed);
4599         int res;
4600 
4601         res = zonecfg_get_fs_allowed(handle, fsallowed, len);
4602 
4603         if (res == Z_BAD_PROPERTY) {
4604                 /* No value, set the defaults */
4605                 (void) strlcpy(fsallowed, DFLT_FS_ALLOWED, len);
4606         } else if (res != Z_OK) {
4607                 report_prop_err(zlogp, "fs-allowed", fsallowed, res);
4608                 return (res);
4609         } else if (fsallowed[0] == '-') {
4610                 /* dropping default privs - use remaining list */
4611                 if (fsallowed[1] != ',')
4612                         return (Z_OK);
4613                 fsallowedp += 2;
4614                 len -= 2;
4615         } else {
4616                 /* Has a value, append the defaults */
4617                 if (strlcat(fsallowed, ",", len) >= len ||
4618                     strlcat(fsallowed, DFLT_FS_ALLOWED, len) >= len) {
4619                         report_prop_err(zlogp, "fs-allowed", fsallowed,
4620                             Z_TOO_BIG);
4621                         return (Z_TOO_BIG);
4622                 }
4623         }
4624 
4625         if (zone_setattr(zoneid, ZONE_ATTR_FS_ALLOWED, fsallowedp, len) != 0) {
4626                 zerror(zlogp, B_TRUE,
4627                     "fs-allowed couldn't be set: %s: %d", fsallowedp, res);
4628                 return (Z_SYSTEM);
4629         }
4630 
4631         return (Z_OK);
4632 }
4633 
4634 static int
4635 setup_zone_attrs(zlog_t *zlogp, char *zone_namep, zoneid_t zoneid)
4636 {
4637         zone_dochandle_t handle;
4638         int res = Z_OK;
4639 
4640         if ((handle = zonecfg_init_handle()) == NULL) {
4641                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
4642                 return (Z_BAD_HANDLE);
4643         }
4644         if ((res = zonecfg_get_snapshot_handle(zone_namep, handle)) != Z_OK) {
4645                 zerror(zlogp, B_FALSE, "invalid configuration");
4646                 goto out;
4647         }
4648 
4649         if ((res = setup_zone_hostid(handle, zlogp, zoneid)) != Z_OK)
4650                 goto out;
4651 
4652         if ((res = setup_zone_fs_allowed(handle, zlogp, zoneid)) != Z_OK)
4653                 goto out;
4654 
4655 out:
4656         zonecfg_fini_handle(handle);
4657         return (res);
4658 }
4659 
4660 zoneid_t
4661 vplat_create(zlog_t *zlogp, zone_mnt_t mount_cmd)
4662 {
4663         zoneid_t rval = -1;
4664         priv_set_t *privs;
4665         char rootpath[MAXPATHLEN];
4666         char *rctlbuf = NULL;
4667         size_t rctlbufsz = 0;
4668         char *zfsbuf = NULL;
4669         size_t zfsbufsz = 0;
4670         zoneid_t zoneid = -1;
4671         int xerr;
4672         char *kzone;
4673         FILE *fp = NULL;
4674         tsol_zcent_t *zcent = NULL;
4675         int match = 0;
4676         int doi = 0;
4677         int flags;
4678         zone_iptype_t iptype;
4679 
4680         if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
4681                 zerror(zlogp, B_TRUE, "unable to determine zone root");
4682                 return (-1);
4683         }
4684         if (zonecfg_in_alt_root())
4685                 resolve_lofs(zlogp, rootpath, sizeof (rootpath));
4686 
4687         if (vplat_get_iptype(zlogp, &iptype) < 0) {
4688                 zerror(zlogp, B_TRUE, "unable to determine ip-type");
4689                 return (-1);
4690         }
4691         switch (iptype) {
4692         case ZS_SHARED:
4693                 flags = 0;
4694                 break;
4695         case ZS_EXCLUSIVE:
4696                 flags = ZCF_NET_EXCL;
4697                 break;
4698         }
4699 
4700         if ((privs = priv_allocset()) == NULL) {
4701                 zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
4702                 return (-1);
4703         }
4704         priv_emptyset(privs);
4705         if (get_privset(zlogp, privs, mount_cmd) != 0)
4706                 goto error;
4707 
4708         if (mount_cmd == Z_MNT_BOOT &&
4709             get_rctls(zlogp, &rctlbuf, &rctlbufsz) != 0) {
4710                 zerror(zlogp, B_FALSE, "Unable to get list of rctls");
4711                 goto error;
4712         }
4713 
4714         if (get_datasets(zlogp, &zfsbuf, &zfsbufsz) != 0) {
4715                 zerror(zlogp, B_FALSE, "Unable to get list of ZFS datasets");
4716                 goto error;
4717         }
4718 
4719         if (mount_cmd == Z_MNT_BOOT && is_system_labeled()) {
4720                 zcent = get_zone_label(zlogp, privs);
4721                 if (zcent != NULL) {
4722                         match = zcent->zc_match;
4723                         doi = zcent->zc_doi;
4724                         *zlabel = zcent->zc_label;
4725                 } else {
4726                         goto error;
4727                 }
4728                 if (validate_rootds_label(zlogp, rootpath, zlabel) != 0)
4729                         goto error;
4730         }
4731 
4732         kzone = zone_name;
4733 
4734         /*
4735          * We must do this scan twice.  First, we look for zones running on the
4736          * main system that are using this root (or any subdirectory of it).
4737          * Next, we reduce to the shortest path and search for loopback mounts
4738          * that use this same source node (same device and inode).
4739          */
4740         if (duplicate_zone_root(zlogp, rootpath))
4741                 goto error;
4742         if (duplicate_reachable_path(zlogp, rootpath))
4743                 goto error;
4744 
4745         if (ALT_MOUNT(mount_cmd)) {
4746                 root_to_lu(zlogp, rootpath, sizeof (rootpath), B_TRUE);
4747 
4748                 /*
4749                  * Forge up a special root for this zone.  When a zone is
4750                  * mounted, we can't let the zone have its own root because the
4751                  * tools that will be used in this "scratch zone" need access
4752                  * to both the zone's resources and the running machine's
4753                  * executables.
4754                  *
4755                  * Note that the mkdir here also catches read-only filesystems.
4756                  */
4757                 if (mkdir(rootpath, 0755) != 0 && errno != EEXIST) {
4758                         zerror(zlogp, B_TRUE, "cannot create %s", rootpath);
4759                         goto error;
4760                 }
4761                 if (domount(zlogp, "tmpfs", "", "swap", rootpath) != 0)
4762                         goto error;
4763         }
4764 
4765         if (zonecfg_in_alt_root()) {
4766                 /*
4767                  * If we are mounting up a zone in an alternate root partition,
4768                  * then we have some additional work to do before starting the
4769                  * zone.  First, resolve the root path down so that we're not
4770                  * fooled by duplicates.  Then forge up an internal name for
4771                  * the zone.
4772                  */
4773                 if ((fp = zonecfg_open_scratch("", B_TRUE)) == NULL) {
4774                         zerror(zlogp, B_TRUE, "cannot open mapfile");
4775                         goto error;
4776                 }
4777                 if (zonecfg_lock_scratch(fp) != 0) {
4778                         zerror(zlogp, B_TRUE, "cannot lock mapfile");
4779                         goto error;
4780                 }
4781                 if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
4782                     NULL, 0) == 0) {
4783                         zerror(zlogp, B_FALSE, "scratch zone already running");
4784                         goto error;
4785                 }
4786                 /* This is the preferred name */
4787                 (void) snprintf(kernzone, sizeof (kernzone), "SUNWlu-%s",
4788                     zone_name);
4789                 srandom(getpid());
4790                 while (zonecfg_reverse_scratch(fp, kernzone, NULL, 0, NULL,
4791                     0) == 0) {
4792                         /* This is just an arbitrary name; note "." usage */
4793                         (void) snprintf(kernzone, sizeof (kernzone),
4794                             "SUNWlu.%08lX%08lX", random(), random());
4795                 }
4796                 kzone = kernzone;
4797         }
4798 
4799         xerr = 0;
4800         if ((zoneid = zone_create(kzone, rootpath, privs, rctlbuf,
4801             rctlbufsz, zfsbuf, zfsbufsz, &xerr, match, doi, zlabel,
4802             flags)) == -1) {
4803                 if (xerr == ZE_AREMOUNTS) {
4804                         if (zonecfg_find_mounts(rootpath, NULL, NULL) < 1) {
4805                                 zerror(zlogp, B_FALSE,
4806                                     "An unknown file-system is mounted on "
4807                                     "a subdirectory of %s", rootpath);
4808                         } else {
4809 
4810                                 zerror(zlogp, B_FALSE,
4811                                     "These file-systems are mounted on "
4812                                     "subdirectories of %s:", rootpath);
4813                                 (void) zonecfg_find_mounts(rootpath,
4814                                     prtmount, zlogp);
4815                         }
4816                 } else if (xerr == ZE_CHROOTED) {
4817                         zerror(zlogp, B_FALSE, "%s: "
4818                             "cannot create a zone from a chrooted "
4819                             "environment", "zone_create");
4820                 } else if (xerr == ZE_LABELINUSE) {
4821                         char zonename[ZONENAME_MAX];
4822                         (void) getzonenamebyid(getzoneidbylabel(zlabel),
4823                             zonename, ZONENAME_MAX);
4824                         zerror(zlogp, B_FALSE, "The zone label is already "
4825                             "used by the zone '%s'.", zonename);
4826                 } else {
4827                         zerror(zlogp, B_TRUE, "%s failed", "zone_create");
4828                 }
4829                 goto error;
4830         }
4831 
4832         if (zonecfg_in_alt_root() &&
4833             zonecfg_add_scratch(fp, zone_name, kernzone,
4834             zonecfg_get_root()) == -1) {
4835                 zerror(zlogp, B_TRUE, "cannot add mapfile entry");
4836                 goto error;
4837         }
4838 
4839         /*
4840          * The following actions are not performed when merely mounting a zone
4841          * for administrative use.
4842          */
4843         if (mount_cmd == Z_MNT_BOOT) {
4844                 brand_handle_t bh;
4845                 struct brand_attr attr;
4846                 char modname[MAXPATHLEN];
4847 
4848                 if (setup_zone_attrs(zlogp, zone_name, zoneid) != Z_OK)
4849                         goto error;
4850 
4851                 if ((bh = brand_open(brand_name)) == NULL) {
4852                         zerror(zlogp, B_FALSE,
4853                             "unable to determine brand name");
4854                         goto error;
4855                 }
4856 
4857                 if (!is_system_labeled() &&
4858                     (strcmp(brand_name, LABELED_BRAND_NAME) == 0)) {
4859                         brand_close(bh);
4860                         zerror(zlogp, B_FALSE,
4861                             "cannot boot labeled zone on unlabeled system");
4862                         goto error;
4863                 }
4864 
4865                 /*
4866                  * If this brand requires any kernel support, now is the time to
4867                  * get it loaded and initialized.
4868                  */
4869                 if (brand_get_modname(bh, modname, MAXPATHLEN) < 0) {
4870                         brand_close(bh);
4871                         zerror(zlogp, B_FALSE,
4872                             "unable to determine brand kernel module");
4873                         goto error;
4874                 }
4875                 brand_close(bh);
4876 
4877                 if (strlen(modname) > 0) {
4878                         (void) strlcpy(attr.ba_brandname, brand_name,
4879                             sizeof (attr.ba_brandname));
4880                         (void) strlcpy(attr.ba_modname, modname,
4881                             sizeof (attr.ba_modname));
4882                         if (zone_setattr(zoneid, ZONE_ATTR_BRAND, &attr,
4883                             sizeof (attr) != 0)) {
4884                                 zerror(zlogp, B_TRUE,
4885                                     "could not set zone brand attribute.");
4886                                 goto error;
4887                         }
4888                 }
4889 
4890                 if (setup_zone_rm(zlogp, zone_name, zoneid) != Z_OK)
4891                         goto error;
4892 
4893                 set_mlps(zlogp, zoneid, zcent);
4894         }
4895 
4896         rval = zoneid;
4897         zoneid = -1;
4898 
4899 error:
4900         if (zoneid != -1) {
4901                 (void) zone_shutdown(zoneid);
4902                 (void) zone_destroy(zoneid);
4903         }
4904         if (rctlbuf != NULL)
4905                 free(rctlbuf);
4906         priv_freeset(privs);
4907         if (fp != NULL)
4908                 zonecfg_close_scratch(fp);
4909         lofs_discard_mnttab();
4910         if (zcent != NULL)
4911                 tsol_freezcent(zcent);
4912         return (rval);
4913 }
4914 
4915 /*
4916  * Enter the zone and write a /etc/zones/index file there.  This allows
4917  * libzonecfg (and thus zoneadm) to report the UUID and potentially other zone
4918  * details from inside the zone.
4919  */
4920 static void
4921 write_index_file(zoneid_t zoneid)
4922 {
4923         FILE *zef;
4924         FILE *zet;
4925         struct zoneent *zep;
4926         pid_t child;
4927         int tmpl_fd;
4928         ctid_t ct;
4929         int fd;
4930         char uuidstr[UUID_PRINTABLE_STRING_LENGTH];
4931 
4932         /* Locate the zone entry in the global zone's index file */
4933         if ((zef = setzoneent()) == NULL)
4934                 return;
4935         while ((zep = getzoneent_private(zef)) != NULL) {
4936                 if (strcmp(zep->zone_name, zone_name) == 0)
4937                         break;
4938                 free(zep);
4939         }
4940         endzoneent(zef);
4941         if (zep == NULL)
4942                 return;
4943 
4944         if ((tmpl_fd = init_template()) == -1) {
4945                 free(zep);
4946                 return;
4947         }
4948 
4949         if ((child = fork()) == -1) {
4950                 (void) ct_tmpl_clear(tmpl_fd);
4951                 (void) close(tmpl_fd);
4952                 free(zep);
4953                 return;
4954         }
4955 
4956         /* parent waits for child to finish */
4957         if (child != 0) {
4958                 free(zep);
4959                 if (contract_latest(&ct) == -1)
4960                         ct = -1;
4961                 (void) ct_tmpl_clear(tmpl_fd);
4962                 (void) close(tmpl_fd);
4963                 (void) waitpid(child, NULL, 0);
4964                 (void) contract_abandon_id(ct);
4965                 return;
4966         }
4967 
4968         /* child enters zone and sets up index file */
4969         (void) ct_tmpl_clear(tmpl_fd);
4970         if (zone_enter(zoneid) != -1) {
4971                 (void) mkdir(ZONE_CONFIG_ROOT, ZONE_CONFIG_MODE);
4972                 (void) chown(ZONE_CONFIG_ROOT, ZONE_CONFIG_UID,
4973                     ZONE_CONFIG_GID);
4974                 fd = open(ZONE_INDEX_FILE, O_WRONLY|O_CREAT|O_TRUNC,
4975                     ZONE_INDEX_MODE);
4976                 if (fd != -1 && (zet = fdopen(fd, "w")) != NULL) {
4977                         (void) fchown(fd, ZONE_INDEX_UID, ZONE_INDEX_GID);
4978                         if (uuid_is_null(zep->zone_uuid))
4979                                 uuidstr[0] = '\0';
4980                         else
4981                                 uuid_unparse(zep->zone_uuid, uuidstr);
4982                         (void) fprintf(zet, "%s:%s:/:%s\n", zep->zone_name,
4983                             zone_state_str(zep->zone_state),
4984                             uuidstr);
4985                         (void) fclose(zet);
4986                 }
4987         }
4988         _exit(0);
4989 }
4990 
4991 int
4992 vplat_bringup(zlog_t *zlogp, zone_mnt_t mount_cmd, zoneid_t zoneid)
4993 {
4994         char zonepath[MAXPATHLEN];
4995 
4996         if (mount_cmd == Z_MNT_BOOT && validate_datasets(zlogp) != 0) {
4997                 lofs_discard_mnttab();
4998                 return (-1);
4999         }
5000 
5001         /*
5002          * Before we try to mount filesystems we need to create the
5003          * attribute backing store for /dev
5004          */
5005         if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
5006                 lofs_discard_mnttab();
5007                 return (-1);
5008         }
5009         resolve_lofs(zlogp, zonepath, sizeof (zonepath));
5010 
5011         /* Make /dev directory owned by root, grouped sys */
5012         if (make_one_dir(zlogp, zonepath, "/dev", DEFAULT_DIR_MODE,
5013             0, 3) != 0) {
5014                 lofs_discard_mnttab();
5015                 return (-1);
5016         }
5017 
5018         if (mount_filesystems(zlogp, mount_cmd) != 0) {
5019                 lofs_discard_mnttab();
5020                 return (-1);
5021         }
5022 
5023         if (mount_cmd == Z_MNT_BOOT) {
5024                 zone_iptype_t iptype;
5025 
5026                 if (vplat_get_iptype(zlogp, &iptype) < 0) {
5027                         zerror(zlogp, B_TRUE, "unable to determine ip-type");
5028                         lofs_discard_mnttab();
5029                         return (-1);
5030                 }
5031 
5032                 switch (iptype) {
5033                 case ZS_SHARED:
5034                         /* Always do this to make lo0 get configured */
5035                         if (configure_shared_network_interfaces(zlogp) != 0) {
5036                                 lofs_discard_mnttab();
5037                                 return (-1);
5038                         }
5039                         break;
5040                 case ZS_EXCLUSIVE:
5041                         if (configure_exclusive_network_interfaces(zlogp,
5042                             zoneid) !=
5043                             0) {
5044                                 lofs_discard_mnttab();
5045                                 return (-1);
5046                         }
5047                         break;
5048                 }
5049         }
5050 
5051         write_index_file(zoneid);
5052 
5053         lofs_discard_mnttab();
5054         return (0);
5055 }
5056 
5057 static int
5058 lu_root_teardown(zlog_t *zlogp)
5059 {
5060         char zroot[MAXPATHLEN];
5061 
5062         if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
5063                 zerror(zlogp, B_FALSE, "unable to determine zone root");
5064                 return (-1);
5065         }
5066         root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
5067 
5068         /*
5069          * At this point, the processes are gone, the filesystems (save the
5070          * root) are unmounted, and the zone is on death row.  But there may
5071          * still be creds floating about in the system that reference the
5072          * zone_t, and which pin down zone_rootvp causing this call to fail
5073          * with EBUSY.  Thus, we try for a little while before just giving up.
5074          * (How I wish this were not true, and umount2 just did the right
5075          * thing, or tmpfs supported MS_FORCE This is a gross hack.)
5076          */
5077         if (umount2(zroot, MS_FORCE) != 0) {
5078                 if (errno == ENOTSUP && umount2(zroot, 0) == 0)
5079                         goto unmounted;
5080                 if (errno == EBUSY) {
5081                         int tries = 10;
5082 
5083                         while (--tries >= 0) {
5084                                 (void) sleep(1);
5085                                 if (umount2(zroot, 0) == 0)
5086                                         goto unmounted;
5087                                 if (errno != EBUSY)
5088                                         break;
5089                         }
5090                 }
5091                 zerror(zlogp, B_TRUE, "unable to unmount '%s'", zroot);
5092                 return (-1);
5093         }
5094 unmounted:
5095 
5096         /*
5097          * Only zones in an alternate root environment have scratch zone
5098          * entries.
5099          */
5100         if (zonecfg_in_alt_root()) {
5101                 FILE *fp;
5102                 int retv;
5103 
5104                 if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
5105                         zerror(zlogp, B_TRUE, "cannot open mapfile");
5106                         return (-1);
5107                 }
5108                 retv = -1;
5109                 if (zonecfg_lock_scratch(fp) != 0)
5110                         zerror(zlogp, B_TRUE, "cannot lock mapfile");
5111                 else if (zonecfg_delete_scratch(fp, kernzone) != 0)
5112                         zerror(zlogp, B_TRUE, "cannot delete map entry");
5113                 else
5114                         retv = 0;
5115                 zonecfg_close_scratch(fp);
5116                 return (retv);
5117         } else {
5118                 return (0);
5119         }
5120 }
5121 
5122 int
5123 vplat_teardown(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting)
5124 {
5125         char *kzone;
5126         zoneid_t zoneid;
5127         int res;
5128         char pool_err[128];
5129         char zpath[MAXPATHLEN];
5130         char cmdbuf[MAXPATHLEN];
5131         brand_handle_t bh = NULL;
5132         dladm_status_t status;
5133         char errmsg[DLADM_STRSIZE];
5134         ushort_t flags;
5135 
5136         kzone = zone_name;
5137         if (zonecfg_in_alt_root()) {
5138                 FILE *fp;
5139 
5140                 if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
5141                         zerror(zlogp, B_TRUE, "unable to open map file");
5142                         goto error;
5143                 }
5144                 if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
5145                     kernzone, sizeof (kernzone)) != 0) {
5146                         zerror(zlogp, B_FALSE, "unable to find scratch zone");
5147                         zonecfg_close_scratch(fp);
5148                         goto error;
5149                 }
5150                 zonecfg_close_scratch(fp);
5151                 kzone = kernzone;
5152         }
5153 
5154         if ((zoneid = getzoneidbyname(kzone)) == ZONE_ID_UNDEFINED) {
5155                 if (!bringup_failure_recovery)
5156                         zerror(zlogp, B_TRUE, "unable to get zoneid");
5157                 if (unmount_cmd)
5158                         (void) lu_root_teardown(zlogp);
5159                 goto error;
5160         }
5161 
5162         if (remove_datalink_pool(zlogp, zoneid) != 0) {
5163                 zerror(zlogp, B_FALSE, "unable clear datalink pool property");
5164                 goto error;
5165         }
5166 
5167         if (remove_datalink_protect(zlogp, zoneid) != 0) {
5168                 zerror(zlogp, B_FALSE,
5169                     "unable clear datalink protect property");
5170                 goto error;
5171         }
5172 
5173         /*
5174          * The datalinks assigned to the zone will be removed from the NGZ as
5175          * part of zone_shutdown() so that we need to remove protect/pool etc.
5176          * before zone_shutdown(). Even if the shutdown itself fails, the zone
5177          * will not be able to violate any constraints applied because the
5178          * datalinks are no longer available to the zone.
5179          */
5180         if (zone_shutdown(zoneid) != 0) {
5181                 zerror(zlogp, B_TRUE, "unable to shutdown zone");
5182                 goto error;
5183         }
5184 
5185         /* Get the zonepath of this zone */
5186         if (zone_get_zonepath(zone_name, zpath, sizeof (zpath)) != Z_OK) {
5187                 zerror(zlogp, B_FALSE, "unable to determine zone path");
5188                 goto error;
5189         }
5190 
5191         /* Get a handle to the brand info for this zone */
5192         if ((bh = brand_open(brand_name)) == NULL) {
5193                 zerror(zlogp, B_FALSE, "unable to determine zone brand");
5194                 return (-1);
5195         }
5196         /*
5197          * If there is a brand 'halt' callback, execute it now to give the
5198          * brand a chance to cleanup any custom configuration.
5199          */
5200         (void) strcpy(cmdbuf, EXEC_PREFIX);
5201         if (brand_get_halt(bh, zone_name, zpath, cmdbuf + EXEC_LEN,
5202             sizeof (cmdbuf) - EXEC_LEN) < 0) {
5203                 brand_close(bh);
5204                 zerror(zlogp, B_FALSE, "unable to determine branded zone's "
5205                     "halt callback.");
5206                 goto error;
5207         }
5208         brand_close(bh);
5209 
5210         if ((strlen(cmdbuf) > EXEC_LEN) &&
5211             (do_subproc(zlogp, cmdbuf, NULL) != Z_OK)) {
5212                 zerror(zlogp, B_FALSE, "%s failed", cmdbuf);
5213                 goto error;
5214         }
5215 
5216         if (!unmount_cmd) {
5217                 zone_iptype_t iptype;
5218 
5219                 if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
5220                     sizeof (flags)) < 0) {
5221                         if (vplat_get_iptype(zlogp, &iptype) < 0) {
5222                                 zerror(zlogp, B_TRUE, "unable to determine "
5223                                     "ip-type");
5224                                 goto error;
5225                         }
5226                 } else {
5227                         if (flags & ZF_NET_EXCL)
5228                                 iptype = ZS_EXCLUSIVE;
5229                         else
5230                                 iptype = ZS_SHARED;
5231                 }
5232 
5233                 switch (iptype) {
5234                 case ZS_SHARED:
5235                         if (unconfigure_shared_network_interfaces(zlogp,
5236                             zoneid) != 0) {
5237                                 zerror(zlogp, B_FALSE, "unable to unconfigure "
5238                                     "network interfaces in zone");
5239                                 goto error;
5240                         }
5241                         break;
5242                 case ZS_EXCLUSIVE:
5243                         if (unconfigure_exclusive_network_interfaces(zlogp,
5244                             zoneid) != 0) {
5245                                 zerror(zlogp, B_FALSE, "unable to unconfigure "
5246                                     "network interfaces in zone");
5247                                 goto error;
5248                         }
5249                         status = dladm_zone_halt(dld_handle, zoneid);
5250                         if (status != DLADM_STATUS_OK) {
5251                                 zerror(zlogp, B_FALSE, "unable to notify "
5252                                     "dlmgmtd of zone halt: %s",
5253                                     dladm_status2str(status, errmsg));
5254                         }
5255                         break;
5256                 }
5257         }
5258 
5259         if (!unmount_cmd && tcp_abort_connections(zlogp, zoneid) != 0) {
5260                 zerror(zlogp, B_TRUE, "unable to abort TCP connections");
5261                 goto error;
5262         }
5263 
5264         if (unmount_filesystems(zlogp, zoneid, unmount_cmd) != 0) {
5265                 zerror(zlogp, B_FALSE,
5266                     "unable to unmount file systems in zone");
5267                 goto error;
5268         }
5269 
5270         /*
5271          * If we are rebooting then we normally don't want to destroy an
5272          * existing temporary pool at this point so that we can just reuse it
5273          * when the zone boots back up.  However, it is also possible we were
5274          * running with a temporary pool and the zone configuration has been
5275          * modified to no longer use a temporary pool.  In that case we need
5276          * to destroy the temporary pool now.  This case looks like the case
5277          * where we never had a temporary pool configured but
5278          * zonecfg_destroy_tmp_pool will do the right thing either way.
5279          */
5280         if (!unmount_cmd) {
5281                 boolean_t destroy_tmp_pool = B_TRUE;
5282 
5283                 if (rebooting) {
5284                         struct zone_psettab pset_tab;
5285                         zone_dochandle_t handle;
5286 
5287                         if ((handle = zonecfg_init_handle()) != NULL &&
5288                             zonecfg_get_handle(zone_name, handle) == Z_OK &&
5289                             zonecfg_lookup_pset(handle, &pset_tab) == Z_OK)
5290                                 destroy_tmp_pool = B_FALSE;
5291 
5292                         zonecfg_fini_handle(handle);
5293                 }
5294 
5295                 if (destroy_tmp_pool) {
5296                         if ((res = zonecfg_destroy_tmp_pool(zone_name, pool_err,
5297                             sizeof (pool_err))) != Z_OK) {
5298                                 if (res == Z_POOL)
5299                                         zerror(zlogp, B_FALSE, pool_err);
5300                         }
5301                 }
5302         }
5303 
5304         remove_mlps(zlogp, zoneid);
5305 
5306         if (zone_destroy(zoneid) != 0) {
5307                 zerror(zlogp, B_TRUE, "unable to destroy zone");
5308                 goto error;
5309         }
5310 
5311         /*
5312          * Special teardown for alternate boot environments: remove the tmpfs
5313          * root for the zone and then remove it from the map file.
5314          */
5315         if (unmount_cmd && lu_root_teardown(zlogp) != 0)
5316                 goto error;
5317 
5318         lofs_discard_mnttab();
5319         return (0);
5320 
5321 error:
5322         lofs_discard_mnttab();
5323         return (-1);
5324 }