xref: /illumos-gate/usr/src/cmd/zoneadm/zoneadm.c (revision 2ec67e0462179ec092c00572ee5460c3db3cc066)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 /*
30  * zoneadm is a command interpreter for zone administration.  It is all in
31  * C (i.e., no lex/yacc), and all the argument passing is argc/argv based.
32  * main() calls parse_and_run() which calls cmd_match(), then invokes the
33  * appropriate command's handler function.  The rest of the program is the
34  * handler functions and their helper functions.
35  *
36  * Some of the helper functions are used largely to simplify I18N: reducing
37  * the need for translation notes.  This is particularly true of many of
38  * the zerror() calls: doing e.g. zerror(gettext("%s failed"), "foo") rather
39  * than zerror(gettext("foo failed")) with a translation note indicating
40  * that "foo" need not be translated.
41  */
42 
43 #include <stdio.h>
44 #include <errno.h>
45 #include <unistd.h>
46 #include <signal.h>
47 #include <stdarg.h>
48 #include <ctype.h>
49 #include <stdlib.h>
50 #include <string.h>
51 #include <wait.h>
52 #include <zone.h>
53 #include <priv.h>
54 #include <locale.h>
55 #include <libintl.h>
56 #include <libzonecfg.h>
57 #include <bsm/adt.h>
58 #include <sys/brand.h>
59 #include <sys/param.h>
60 #include <sys/types.h>
61 #include <sys/stat.h>
62 #include <sys/statvfs.h>
63 #include <assert.h>
64 #include <sys/sockio.h>
65 #include <sys/mntent.h>
66 #include <limits.h>
67 #include <dirent.h>
68 #include <uuid/uuid.h>
69 
70 #include <fcntl.h>
71 #include <door.h>
72 #include <macros.h>
73 #include <libgen.h>
74 #include <fnmatch.h>
75 #include <sys/modctl.h>
76 #include <libbrand.h>
77 #include <libscf.h>
78 #include <procfs.h>
79 #include <strings.h>
80 
81 #include <pool.h>
82 #include <sys/pool.h>
83 #include <sys/priocntl.h>
84 #include <sys/fsspriocntl.h>
85 
86 #include "zoneadm.h"
87 
88 #define	MAXARGS	8
89 
90 /* Reflects kernel zone entries */
91 typedef struct zone_entry {
92 	zoneid_t	zid;
93 	char		zname[ZONENAME_MAX];
94 	char		*zstate_str;
95 	zone_state_t	zstate_num;
96 	char		zbrand[MAXNAMELEN];
97 	char		zroot[MAXPATHLEN];
98 	char		zuuid[UUID_PRINTABLE_STRING_LENGTH];
99 	zone_iptype_t	ziptype;
100 } zone_entry_t;
101 
102 static zone_entry_t *zents;
103 static size_t nzents;
104 static boolean_t is_native_zone = B_TRUE;
105 
106 #define	LOOPBACK_IF	"lo0"
107 #define	SOCKET_AF(af)	(((af) == AF_UNSPEC) ? AF_INET : (af))
108 
109 struct net_if {
110 	char	*name;
111 	int	af;
112 };
113 
114 /* 0755 is the default directory mode. */
115 #define	DEFAULT_DIR_MODE \
116 	(S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH)
117 
118 struct cmd {
119 	uint_t	cmd_num;				/* command number */
120 	char	*cmd_name;				/* command name */
121 	char	*short_usage;				/* short form help */
122 	int	(*handler)(int argc, char *argv[]);	/* function to call */
123 
124 };
125 
126 #define	SHELP_HELP	"help"
127 #define	SHELP_BOOT	"boot [-- boot_arguments]"
128 #define	SHELP_HALT	"halt"
129 #define	SHELP_READY	"ready"
130 #define	SHELP_REBOOT	"reboot [-- boot_arguments]"
131 #define	SHELP_LIST	"list [-cipv]"
132 #define	SHELP_VERIFY	"verify"
133 #define	SHELP_INSTALL	"install [-x nodataset] [brand-specific args]"
134 #define	SHELP_UNINSTALL	"uninstall [-F]"
135 #define	SHELP_CLONE	"clone [-m method] [-s <ZFS snapshot>] zonename"
136 #define	SHELP_MOVE	"move zonepath"
137 #define	SHELP_DETACH	"detach [-n]"
138 #define	SHELP_ATTACH	"attach [-F] [-n <path>]"
139 #define	SHELP_MARK	"mark incomplete"
140 
141 #define	EXEC_PREFIX	"exec "
142 #define	EXEC_LEN	(strlen(EXEC_PREFIX))
143 #define	RMCOMMAND	"/usr/bin/rm -rf"
144 
145 static int cleanup_zonepath(char *, boolean_t);
146 
147 extern int ifname_open(char *);
148 
149 static int help_func(int argc, char *argv[]);
150 static int ready_func(int argc, char *argv[]);
151 static int boot_func(int argc, char *argv[]);
152 static int halt_func(int argc, char *argv[]);
153 static int reboot_func(int argc, char *argv[]);
154 static int list_func(int argc, char *argv[]);
155 static int verify_func(int argc, char *argv[]);
156 static int install_func(int argc, char *argv[]);
157 static int uninstall_func(int argc, char *argv[]);
158 static int mount_func(int argc, char *argv[]);
159 static int unmount_func(int argc, char *argv[]);
160 static int clone_func(int argc, char *argv[]);
161 static int move_func(int argc, char *argv[]);
162 static int detach_func(int argc, char *argv[]);
163 static int attach_func(int argc, char *argv[]);
164 static int mark_func(int argc, char *argv[]);
165 static int apply_func(int argc, char *argv[]);
166 static int sanity_check(char *zone, int cmd_num, boolean_t running,
167     boolean_t unsafe_when_running, boolean_t force);
168 static int cmd_match(char *cmd);
169 static int verify_details(int, char *argv[]);
170 static int verify_brand(zone_dochandle_t, int, char *argv[]);
171 static int invoke_brand_handler(int, char *argv[]);
172 
173 static struct cmd cmdtab[] = {
174 	{ CMD_HELP,		"help",		SHELP_HELP,	help_func },
175 	{ CMD_BOOT,		"boot",		SHELP_BOOT,	boot_func },
176 	{ CMD_HALT,		"halt",		SHELP_HALT,	halt_func },
177 	{ CMD_READY,		"ready",	SHELP_READY,	ready_func },
178 	{ CMD_REBOOT,		"reboot",	SHELP_REBOOT,	reboot_func },
179 	{ CMD_LIST,		"list",		SHELP_LIST,	list_func },
180 	{ CMD_VERIFY,		"verify",	SHELP_VERIFY,	verify_func },
181 	{ CMD_INSTALL,		"install",	SHELP_INSTALL,	install_func },
182 	{ CMD_UNINSTALL,	"uninstall",	SHELP_UNINSTALL,
183 	    uninstall_func },
184 	/* mount and unmount are private commands for admin/install */
185 	{ CMD_MOUNT,		"mount",	NULL,		mount_func },
186 	{ CMD_UNMOUNT,		"unmount",	NULL,		unmount_func },
187 	{ CMD_CLONE,		"clone",	SHELP_CLONE,	clone_func },
188 	{ CMD_MOVE,		"move",		SHELP_MOVE,	move_func },
189 	{ CMD_DETACH,		"detach",	SHELP_DETACH,	detach_func },
190 	{ CMD_ATTACH,		"attach",	SHELP_ATTACH,	attach_func },
191 	{ CMD_MARK,		"mark",		SHELP_MARK,	mark_func },
192 	{ CMD_APPLY,		"apply",	NULL,		apply_func }
193 };
194 
195 /* global variables */
196 
197 /* set early in main(), never modified thereafter, used all over the place */
198 static char *execname;
199 static char target_brand[MAXNAMELEN];
200 static char *locale;
201 char *target_zone;
202 static char *target_uuid;
203 
204 /* used in do_subproc() and signal handler */
205 static volatile boolean_t child_killed;
206 static int do_subproc_cnt = 0;
207 
208 /*
209  * Used to indicate whether this zoneadm instance has another zoneadm
210  * instance in its ancestry.
211  */
212 static boolean_t zoneadm_is_nested = B_FALSE;
213 
214 /* used to track nested zone-lock operations */
215 static int zone_lock_cnt = 0;
216 
217 /* used to communicate lock status to children */
218 #define	LOCK_ENV_VAR	"_ZONEADM_LOCK_HELD"
219 static char zoneadm_lock_held[] = LOCK_ENV_VAR"=1";
220 static char zoneadm_lock_not_held[] = LOCK_ENV_VAR"=0";
221 
222 char *
223 cmd_to_str(int cmd_num)
224 {
225 	assert(cmd_num >= CMD_MIN && cmd_num <= CMD_MAX);
226 	return (cmdtab[cmd_num].cmd_name);
227 }
228 
229 /* This is a separate function because of gettext() wrapping. */
230 static char *
231 long_help(int cmd_num)
232 {
233 	assert(cmd_num >= CMD_MIN && cmd_num <= CMD_MAX);
234 	switch (cmd_num) {
235 	case CMD_HELP:
236 		return (gettext("Print usage message."));
237 	case CMD_BOOT:
238 		return (gettext("Activates (boots) specified zone.  See "
239 		    "zoneadm(1m) for valid boot\n\targuments."));
240 	case CMD_HALT:
241 		return (gettext("Halts specified zone, bypassing shutdown "
242 		    "scripts and removing runtime\n\tresources of the zone."));
243 	case CMD_READY:
244 		return (gettext("Prepares a zone for running applications but "
245 		    "does not start any user\n\tprocesses in the zone."));
246 	case CMD_REBOOT:
247 		return (gettext("Restarts the zone (equivalent to a halt / "
248 		    "boot sequence).\n\tFails if the zone is not active.  "
249 		    "See zoneadm(1m) for valid boot\n\targuments."));
250 	case CMD_LIST:
251 		return (gettext("Lists the current zones, or a "
252 		    "specific zone if indicated.  By default,\n\tall "
253 		    "running zones are listed, though this can be "
254 		    "expanded to all\n\tinstalled zones with the -i "
255 		    "option or all configured zones with the\n\t-c "
256 		    "option.  When used with the general -z <zone> and/or -u "
257 		    "<uuid-match>\n\toptions, lists only the specified "
258 		    "matching zone, but lists it\n\tregardless of its state, "
259 		    "and the -i and -c options are disallowed.  The\n\t-v "
260 		    "option can be used to display verbose information: zone "
261 		    "name, id,\n\tcurrent state, root directory and options.  "
262 		    "The -p option can be used\n\tto request machine-parsable "
263 		    "output.  The -v and -p options are mutually\n\texclusive."
264 		    "  If neither -v nor -p is used, just the zone name is "
265 		    "listed."));
266 	case CMD_VERIFY:
267 		return (gettext("Check to make sure the configuration "
268 		    "can safely be instantiated\n\ton the machine: "
269 		    "physical network interfaces exist, etc."));
270 	case CMD_INSTALL:
271 		return (gettext("Install the configuration on to the system.  "
272 		    "The -x nodataset option\n\tcan be used to prevent the "
273 		    "creation of a new ZFS file system for the\n\tzone "
274 		    "(assuming the zonepath is within a ZFS file system).\n\t"
275 		    "All other arguments are passed to the brand installation "
276 		    "function;\n\tsee brand(4) for more information."));
277 	case CMD_UNINSTALL:
278 		return (gettext("Uninstall the configuration from the system.  "
279 		    "The -F flag can be used\n\tto force the action."));
280 	case CMD_CLONE:
281 		return (gettext("Clone the installation of another zone.  "
282 		    "The -m option can be used to\n\tspecify 'copy' which "
283 		    "forces a copy of the source zone.  The -s option\n\t"
284 		    "can be used to specify the name of a ZFS snapshot "
285 		    "that was taken from\n\ta previous clone command.  The "
286 		    "snapshot will be used as the source\n\tinstead of "
287 		    "creating a new ZFS snapshot."));
288 	case CMD_MOVE:
289 		return (gettext("Move the zone to a new zonepath."));
290 	case CMD_DETACH:
291 		return (gettext("Detach the zone from the system. The zone "
292 		    "state is changed to\n\t'configured' (but the files under "
293 		    "the zonepath are untouched).\n\tThe zone can subsequently "
294 		    "be attached, or can be moved to another\n\tsystem and "
295 		    "attached there.  The -n option can be used to specify\n\t"
296 		    "'no-execute' mode.  When -n is used, the information "
297 		    "needed to attach\n\tthe zone is sent to standard output "
298 		    "but the zone is not actually\n\tdetached."));
299 	case CMD_ATTACH:
300 		return (gettext("Attach the zone to the system.  The zone "
301 		    "state must be 'configured'\n\tprior to attach; upon "
302 		    "successful completion, the zone state will be\n\t"
303 		    "'installed'.  The system software on the current "
304 		    "system must be\n\tcompatible with the software on the "
305 		    "zone's original system.\n\tSpecify -F to force the attach "
306 		    "and skip software compatibility tests.\n\tThe -n option "
307 		    "can be used to specify 'no-execute' mode.  When -n is\n\t"
308 		    "used, the information needed to attach the zone is read "
309 		    "from the\n\tspecified path and the configuration is only "
310 		    "validated.  The path can\n\tbe '-' to specify standard "
311 		    "input."));
312 	case CMD_MARK:
313 		return (gettext("Set the state of the zone.  This can be used "
314 		    "to force the zone\n\tstate to 'incomplete' "
315 		    "administratively if some activity has rendered\n\tthe "
316 		    "zone permanently unusable.  The only valid state that "
317 		    "may be\n\tspecified is 'incomplete'."));
318 	default:
319 		return ("");
320 	}
321 	/* NOTREACHED */
322 	return (NULL);
323 }
324 
325 /*
326  * Called with explicit B_TRUE when help is explicitly requested, B_FALSE for
327  * unexpected errors.
328  */
329 
330 static int
331 usage(boolean_t explicit)
332 {
333 	int i;
334 	FILE *fd = explicit ? stdout : stderr;
335 
336 	(void) fprintf(fd, "%s:\t%s help\n", gettext("usage"), execname);
337 	(void) fprintf(fd, "\t%s [-z <zone>] [-u <uuid-match>] list\n",
338 	    execname);
339 	(void) fprintf(fd, "\t%s {-z <zone>|-u <uuid-match>} <%s>\n", execname,
340 	    gettext("subcommand"));
341 	(void) fprintf(fd, "\n%s:\n\n", gettext("Subcommands"));
342 	for (i = CMD_MIN; i <= CMD_MAX; i++) {
343 		if (cmdtab[i].short_usage == NULL)
344 			continue;
345 		(void) fprintf(fd, "%s\n", cmdtab[i].short_usage);
346 		if (explicit)
347 			(void) fprintf(fd, "\t%s\n\n", long_help(i));
348 	}
349 	if (!explicit)
350 		(void) fputs("\n", fd);
351 	return (Z_USAGE);
352 }
353 
354 static void
355 sub_usage(char *short_usage, int cmd_num)
356 {
357 	(void) fprintf(stderr, "%s:\t%s\n", gettext("usage"), short_usage);
358 	(void) fprintf(stderr, "\t%s\n", long_help(cmd_num));
359 }
360 
361 /*
362  * zperror() is like perror(3c) except that this also prints the executable
363  * name at the start of the message, and takes a boolean indicating whether
364  * to call libc'c strerror() or that from libzonecfg.
365  */
366 
367 void
368 zperror(const char *str, boolean_t zonecfg_error)
369 {
370 	(void) fprintf(stderr, "%s: %s: %s\n", execname, str,
371 	    zonecfg_error ? zonecfg_strerror(errno) : strerror(errno));
372 }
373 
374 /*
375  * zperror2() is very similar to zperror() above, except it also prints a
376  * supplied zone name after the executable.
377  *
378  * All current consumers of this function want libzonecfg's strerror() rather
379  * than libc's; if this ever changes, this function can be made more generic
380  * like zperror() above.
381  */
382 
383 void
384 zperror2(const char *zone, const char *str)
385 {
386 	(void) fprintf(stderr, "%s: %s: %s: %s\n", execname, zone, str,
387 	    zonecfg_strerror(errno));
388 }
389 
390 /* PRINTFLIKE1 */
391 void
392 zerror(const char *fmt, ...)
393 {
394 	va_list alist;
395 
396 	va_start(alist, fmt);
397 	(void) fprintf(stderr, "%s: ", execname);
398 	if (target_zone != NULL)
399 		(void) fprintf(stderr, "zone '%s': ", target_zone);
400 	(void) vfprintf(stderr, fmt, alist);
401 	(void) fprintf(stderr, "\n");
402 	va_end(alist);
403 }
404 
405 static void *
406 safe_calloc(size_t nelem, size_t elsize)
407 {
408 	void *r = calloc(nelem, elsize);
409 
410 	if (r == NULL) {
411 		zerror(gettext("failed to allocate %lu bytes: %s"),
412 		    (ulong_t)nelem * elsize, strerror(errno));
413 		exit(Z_ERR);
414 	}
415 	return (r);
416 }
417 
418 static void
419 zone_print(zone_entry_t *zent, boolean_t verbose, boolean_t parsable)
420 {
421 	static boolean_t firsttime = B_TRUE;
422 	char *ip_type_str;
423 
424 	if (zent->ziptype == ZS_EXCLUSIVE)
425 		ip_type_str = "excl";
426 	else
427 		ip_type_str = "shared";
428 
429 	assert(!(verbose && parsable));
430 	if (firsttime && verbose) {
431 		firsttime = B_FALSE;
432 		(void) printf("%*s %-16s %-10s %-30s %-8s %-6s\n",
433 		    ZONEID_WIDTH, "ID", "NAME", "STATUS", "PATH", "BRAND",
434 		    "IP");
435 	}
436 	if (!verbose) {
437 		char *cp, *clim;
438 
439 		if (!parsable) {
440 			(void) printf("%s\n", zent->zname);
441 			return;
442 		}
443 		if (zent->zid == ZONE_ID_UNDEFINED)
444 			(void) printf("-");
445 		else
446 			(void) printf("%lu", zent->zid);
447 		(void) printf(":%s:%s:", zent->zname, zent->zstate_str);
448 		cp = zent->zroot;
449 		while ((clim = strchr(cp, ':')) != NULL) {
450 			(void) printf("%.*s\\:", clim - cp, cp);
451 			cp = clim + 1;
452 		}
453 		(void) printf("%s:%s:%s:%s\n", cp, zent->zuuid, zent->zbrand,
454 		    ip_type_str);
455 		return;
456 	}
457 	if (zent->zstate_str != NULL) {
458 		if (zent->zid == ZONE_ID_UNDEFINED)
459 			(void) printf("%*s", ZONEID_WIDTH, "-");
460 		else
461 			(void) printf("%*lu", ZONEID_WIDTH, zent->zid);
462 		(void) printf(" %-16s %-10s %-30s %-8s %-6s\n", zent->zname,
463 		    zent->zstate_str, zent->zroot, zent->zbrand, ip_type_str);
464 	}
465 }
466 
467 static int
468 lookup_zone_info(const char *zone_name, zoneid_t zid, zone_entry_t *zent)
469 {
470 	char root[MAXPATHLEN], *cp;
471 	int err;
472 	uuid_t uuid;
473 
474 	(void) strlcpy(zent->zname, zone_name, sizeof (zent->zname));
475 	(void) strlcpy(zent->zroot, "???", sizeof (zent->zroot));
476 	(void) strlcpy(zent->zbrand, "???", sizeof (zent->zbrand));
477 	zent->zstate_str = "???";
478 
479 	zent->zid = zid;
480 
481 	if (zonecfg_get_uuid(zone_name, uuid) == Z_OK &&
482 	    !uuid_is_null(uuid))
483 		uuid_unparse(uuid, zent->zuuid);
484 	else
485 		zent->zuuid[0] = '\0';
486 
487 	/*
488 	 * For labeled zones which query the zone path of lower-level
489 	 * zones, the path needs to be adjusted to drop the final
490 	 * "/root" component. This adjusted path is then useful
491 	 * for reading down any exported directories from the
492 	 * lower-level zone.
493 	 */
494 	if (is_system_labeled() && zent->zid != ZONE_ID_UNDEFINED) {
495 		if (zone_getattr(zent->zid, ZONE_ATTR_ROOT, zent->zroot,
496 		    sizeof (zent->zroot)) == -1) {
497 			zperror2(zent->zname,
498 			    gettext("could not get zone path."));
499 			return (Z_ERR);
500 		}
501 		cp = zent->zroot + strlen(zent->zroot) - 5;
502 		if (cp > zent->zroot && strcmp(cp, "/root") == 0)
503 			*cp = 0;
504 	} else {
505 		if ((err = zone_get_zonepath(zent->zname, root,
506 		    sizeof (root))) != Z_OK) {
507 			errno = err;
508 			zperror2(zent->zname,
509 			    gettext("could not get zone path."));
510 			return (Z_ERR);
511 		}
512 		(void) strlcpy(zent->zroot, root, sizeof (zent->zroot));
513 	}
514 
515 	if ((err = zone_get_state(zent->zname, &zent->zstate_num)) != Z_OK) {
516 		errno = err;
517 		zperror2(zent->zname, gettext("could not get state"));
518 		return (Z_ERR);
519 	}
520 	zent->zstate_str = zone_state_str(zent->zstate_num);
521 
522 	/*
523 	 * A zone's brand is only available in the .xml file describing it,
524 	 * which is only visible to the global zone.  This causes
525 	 * zone_get_brand() to fail when called from within a non-global
526 	 * zone.  Fortunately we only do this on labeled systems, where we
527 	 * know all zones are native.
528 	 */
529 	if (getzoneid() != GLOBAL_ZONEID) {
530 		assert(is_system_labeled() != 0);
531 		(void) strlcpy(zent->zbrand, NATIVE_BRAND_NAME,
532 		    sizeof (zent->zbrand));
533 	} else if (zone_get_brand(zent->zname, zent->zbrand,
534 	    sizeof (zent->zbrand)) != Z_OK) {
535 		zperror2(zent->zname, gettext("could not get brand name"));
536 		return (Z_ERR);
537 	}
538 
539 	/*
540 	 * Get ip type of the zone.
541 	 * Note for global zone, ZS_SHARED is set always.
542 	 */
543 	if (zid == GLOBAL_ZONEID) {
544 		zent->ziptype = ZS_SHARED;
545 	} else {
546 
547 		if (zent->zstate_num == ZONE_STATE_RUNNING) {
548 			ushort_t flags;
549 
550 			if (zone_getattr(zid, ZONE_ATTR_FLAGS, &flags,
551 			    sizeof (flags)) < 0) {
552 				zperror2(zent->zname,
553 				    gettext("could not get zone flags"));
554 				return (Z_ERR);
555 			}
556 			if (flags & ZF_NET_EXCL)
557 				zent->ziptype = ZS_EXCLUSIVE;
558 			else
559 				zent->ziptype = ZS_SHARED;
560 		} else {
561 			zone_dochandle_t handle;
562 
563 			if ((handle = zonecfg_init_handle()) == NULL) {
564 				zperror2(zent->zname,
565 				    gettext("could not init handle"));
566 				return (Z_ERR);
567 			}
568 			if ((err = zonecfg_get_handle(zent->zname, handle))
569 			    != Z_OK) {
570 				zperror2(zent->zname,
571 				    gettext("could not get handle"));
572 				zonecfg_fini_handle(handle);
573 				return (Z_ERR);
574 			}
575 
576 			if ((err = zonecfg_get_iptype(handle, &zent->ziptype))
577 			    != Z_OK) {
578 				zperror2(zent->zname,
579 				    gettext("could not get ip-type"));
580 				zonecfg_fini_handle(handle);
581 				return (Z_ERR);
582 			}
583 			zonecfg_fini_handle(handle);
584 		}
585 	}
586 
587 	return (Z_OK);
588 }
589 
590 /*
591  * fetch_zents() calls zone_list(2) to find out how many zones are running
592  * (which is stored in the global nzents), then calls zone_list(2) again
593  * to fetch the list of running zones (stored in the global zents).  This
594  * function may be called multiple times, so if zents is already set, we
595  * return immediately to save work.
596  */
597 
598 static int
599 fetch_zents(void)
600 {
601 	zoneid_t *zids = NULL;
602 	uint_t nzents_saved;
603 	int i, retv;
604 	FILE *fp;
605 	boolean_t inaltroot;
606 	zone_entry_t *zentp;
607 
608 	if (nzents > 0)
609 		return (Z_OK);
610 
611 	if (zone_list(NULL, &nzents) != 0) {
612 		zperror(gettext("failed to get zoneid list"), B_FALSE);
613 		return (Z_ERR);
614 	}
615 
616 again:
617 	if (nzents == 0)
618 		return (Z_OK);
619 
620 	zids = safe_calloc(nzents, sizeof (zoneid_t));
621 	nzents_saved = nzents;
622 
623 	if (zone_list(zids, &nzents) != 0) {
624 		zperror(gettext("failed to get zone list"), B_FALSE);
625 		free(zids);
626 		return (Z_ERR);
627 	}
628 	if (nzents != nzents_saved) {
629 		/* list changed, try again */
630 		free(zids);
631 		goto again;
632 	}
633 
634 	zents = safe_calloc(nzents, sizeof (zone_entry_t));
635 
636 	inaltroot = zonecfg_in_alt_root();
637 	if (inaltroot)
638 		fp = zonecfg_open_scratch("", B_FALSE);
639 	else
640 		fp = NULL;
641 	zentp = zents;
642 	retv = Z_OK;
643 	for (i = 0; i < nzents; i++) {
644 		char name[ZONENAME_MAX];
645 		char altname[ZONENAME_MAX];
646 
647 		if (getzonenamebyid(zids[i], name, sizeof (name)) < 0) {
648 			zperror(gettext("failed to get zone name"), B_FALSE);
649 			retv = Z_ERR;
650 			continue;
651 		}
652 		if (zonecfg_is_scratch(name)) {
653 			/* Ignore scratch zones by default */
654 			if (!inaltroot)
655 				continue;
656 			if (fp == NULL ||
657 			    zonecfg_reverse_scratch(fp, name, altname,
658 			    sizeof (altname), NULL, 0) == -1) {
659 				zerror(gettext("could not resolve scratch "
660 				    "zone %s"), name);
661 				retv = Z_ERR;
662 				continue;
663 			}
664 			(void) strcpy(name, altname);
665 		} else {
666 			/* Ignore non-scratch when in an alternate root */
667 			if (inaltroot && strcmp(name, GLOBAL_ZONENAME) != 0)
668 				continue;
669 		}
670 		if (lookup_zone_info(name, zids[i], zentp) != Z_OK) {
671 			zerror(gettext("failed to get zone data"));
672 			retv = Z_ERR;
673 			continue;
674 		}
675 		zentp++;
676 	}
677 	nzents = zentp - zents;
678 	if (fp != NULL)
679 		zonecfg_close_scratch(fp);
680 
681 	free(zids);
682 	return (retv);
683 }
684 
685 static int
686 zone_print_list(zone_state_t min_state, boolean_t verbose, boolean_t parsable)
687 {
688 	int i;
689 	zone_entry_t zent;
690 	FILE *cookie;
691 	char *name;
692 
693 	/*
694 	 * First get the list of running zones from the kernel and print them.
695 	 * If that is all we need, then return.
696 	 */
697 	if ((i = fetch_zents()) != Z_OK) {
698 		/*
699 		 * No need for error messages; fetch_zents() has already taken
700 		 * care of this.
701 		 */
702 		return (i);
703 	}
704 	for (i = 0; i < nzents; i++)
705 		zone_print(&zents[i], verbose, parsable);
706 	if (min_state >= ZONE_STATE_RUNNING)
707 		return (Z_OK);
708 	/*
709 	 * Next, get the full list of zones from the configuration, skipping
710 	 * any we have already printed.
711 	 */
712 	cookie = setzoneent();
713 	while ((name = getzoneent(cookie)) != NULL) {
714 		for (i = 0; i < nzents; i++) {
715 			if (strcmp(zents[i].zname, name) == 0)
716 				break;
717 		}
718 		if (i < nzents) {
719 			free(name);
720 			continue;
721 		}
722 		if (lookup_zone_info(name, ZONE_ID_UNDEFINED, &zent) != Z_OK) {
723 			free(name);
724 			continue;
725 		}
726 		free(name);
727 		if (zent.zstate_num >= min_state)
728 			zone_print(&zent, verbose, parsable);
729 	}
730 	endzoneent(cookie);
731 	return (Z_OK);
732 }
733 
734 static zone_entry_t *
735 lookup_running_zone(char *str)
736 {
737 	zoneid_t zoneid;
738 	char *cp;
739 	int i;
740 
741 	if (fetch_zents() != Z_OK)
742 		return (NULL);
743 
744 	for (i = 0; i < nzents; i++) {
745 		if (strcmp(str, zents[i].zname) == 0)
746 			return (&zents[i]);
747 	}
748 	errno = 0;
749 	zoneid = strtol(str, &cp, 0);
750 	if (zoneid < MIN_ZONEID || zoneid > MAX_ZONEID ||
751 	    errno != 0 || *cp != '\0')
752 		return (NULL);
753 	for (i = 0; i < nzents; i++) {
754 		if (zoneid == zents[i].zid)
755 			return (&zents[i]);
756 	}
757 	return (NULL);
758 }
759 
760 /*
761  * Check a bit in a mode_t: if on is B_TRUE, that bit should be on; if
762  * B_FALSE, it should be off.  Return B_TRUE if the mode is bad (incorrect).
763  */
764 static boolean_t
765 bad_mode_bit(mode_t mode, mode_t bit, boolean_t on, char *file)
766 {
767 	char *str;
768 
769 	assert(bit == S_IRUSR || bit == S_IWUSR || bit == S_IXUSR ||
770 	    bit == S_IRGRP || bit == S_IWGRP || bit == S_IXGRP ||
771 	    bit == S_IROTH || bit == S_IWOTH || bit == S_IXOTH);
772 	/*
773 	 * TRANSLATION_NOTE
774 	 * The strings below will be used as part of a larger message,
775 	 * either:
776 	 * (file name) must be (owner|group|world) (read|writ|execut)able
777 	 * or
778 	 * (file name) must not be (owner|group|world) (read|writ|execut)able
779 	 */
780 	switch (bit) {
781 	case S_IRUSR:
782 		str = gettext("owner readable");
783 		break;
784 	case S_IWUSR:
785 		str = gettext("owner writable");
786 		break;
787 	case S_IXUSR:
788 		str = gettext("owner executable");
789 		break;
790 	case S_IRGRP:
791 		str = gettext("group readable");
792 		break;
793 	case S_IWGRP:
794 		str = gettext("group writable");
795 		break;
796 	case S_IXGRP:
797 		str = gettext("group executable");
798 		break;
799 	case S_IROTH:
800 		str = gettext("world readable");
801 		break;
802 	case S_IWOTH:
803 		str = gettext("world writable");
804 		break;
805 	case S_IXOTH:
806 		str = gettext("world executable");
807 		break;
808 	}
809 	if ((mode & bit) == (on ? 0 : bit)) {
810 		/*
811 		 * TRANSLATION_NOTE
812 		 * The first parameter below is a file name; the second
813 		 * is one of the "(owner|group|world) (read|writ|execut)able"
814 		 * strings from above.
815 		 */
816 		/*
817 		 * The code below could be simplified but not in a way
818 		 * that would easily translate to non-English locales.
819 		 */
820 		if (on) {
821 			(void) fprintf(stderr, gettext("%s must be %s.\n"),
822 			    file, str);
823 		} else {
824 			(void) fprintf(stderr, gettext("%s must not be %s.\n"),
825 			    file, str);
826 		}
827 		return (B_TRUE);
828 	}
829 	return (B_FALSE);
830 }
831 
832 /*
833  * We want to make sure that no zone has its zone path as a child node
834  * (in the directory sense) of any other.  We do that by comparing this
835  * zone's path to the path of all other (non-global) zones.  The comparison
836  * in each case is simple: add '/' to the end of the path, then do a
837  * strncmp() of the two paths, using the length of the shorter one.
838  */
839 
840 static int
841 crosscheck_zonepaths(char *path)
842 {
843 	char rpath[MAXPATHLEN];		/* resolved path */
844 	char path_copy[MAXPATHLEN];	/* copy of original path */
845 	char rpath_copy[MAXPATHLEN];	/* copy of original rpath */
846 	struct zoneent *ze;
847 	int res, err;
848 	FILE *cookie;
849 
850 	cookie = setzoneent();
851 	while ((ze = getzoneent_private(cookie)) != NULL) {
852 		/* Skip zones which are not installed. */
853 		if (ze->zone_state < ZONE_STATE_INSTALLED) {
854 			free(ze);
855 			continue;
856 		}
857 		/* Skip the global zone and the current target zone. */
858 		if (strcmp(ze->zone_name, GLOBAL_ZONENAME) == 0 ||
859 		    strcmp(ze->zone_name, target_zone) == 0) {
860 			free(ze);
861 			continue;
862 		}
863 		if (strlen(ze->zone_path) == 0) {
864 			/* old index file without path, fall back */
865 			if ((err = zone_get_zonepath(ze->zone_name,
866 			    ze->zone_path, sizeof (ze->zone_path))) != Z_OK) {
867 				errno = err;
868 				zperror2(ze->zone_name,
869 				    gettext("could not get zone path"));
870 				free(ze);
871 				continue;
872 			}
873 		}
874 		(void) snprintf(path_copy, sizeof (path_copy), "%s%s",
875 		    zonecfg_get_root(), ze->zone_path);
876 		res = resolvepath(path_copy, rpath, sizeof (rpath));
877 		if (res == -1) {
878 			if (errno != ENOENT) {
879 				zperror(path_copy, B_FALSE);
880 				free(ze);
881 				return (Z_ERR);
882 			}
883 			(void) printf(gettext("WARNING: zone %s is installed, "
884 			    "but its %s %s does not exist.\n"), ze->zone_name,
885 			    "zonepath", path_copy);
886 			free(ze);
887 			continue;
888 		}
889 		rpath[res] = '\0';
890 		(void) snprintf(path_copy, sizeof (path_copy), "%s/", path);
891 		(void) snprintf(rpath_copy, sizeof (rpath_copy), "%s/", rpath);
892 		if (strncmp(path_copy, rpath_copy,
893 		    min(strlen(path_copy), strlen(rpath_copy))) == 0) {
894 			/*
895 			 * TRANSLATION_NOTE
896 			 * zonepath is a literal that should not be translated.
897 			 */
898 			(void) fprintf(stderr, gettext("%s zonepath (%s) and "
899 			    "%s zonepath (%s) overlap.\n"),
900 			    target_zone, path, ze->zone_name, rpath);
901 			free(ze);
902 			return (Z_ERR);
903 		}
904 		free(ze);
905 	}
906 	endzoneent(cookie);
907 	return (Z_OK);
908 }
909 
910 static int
911 validate_zonepath(char *path, int cmd_num)
912 {
913 	int res;			/* result of last library/system call */
914 	boolean_t err = B_FALSE;	/* have we run into an error? */
915 	struct stat stbuf;
916 	struct statvfs64 vfsbuf;
917 	char rpath[MAXPATHLEN];		/* resolved path */
918 	char ppath[MAXPATHLEN];		/* parent path */
919 	char rppath[MAXPATHLEN];	/* resolved parent path */
920 	char rootpath[MAXPATHLEN];	/* root path */
921 	zone_state_t state;
922 
923 	if (path[0] != '/') {
924 		(void) fprintf(stderr,
925 		    gettext("%s is not an absolute path.\n"), path);
926 		return (Z_ERR);
927 	}
928 	if ((res = resolvepath(path, rpath, sizeof (rpath))) == -1) {
929 		if ((errno != ENOENT) ||
930 		    (cmd_num != CMD_VERIFY && cmd_num != CMD_INSTALL &&
931 		    cmd_num != CMD_CLONE && cmd_num != CMD_MOVE)) {
932 			zperror(path, B_FALSE);
933 			return (Z_ERR);
934 		}
935 		if (cmd_num == CMD_VERIFY) {
936 			/*
937 			 * TRANSLATION_NOTE
938 			 * zoneadm is a literal that should not be translated.
939 			 */
940 			(void) fprintf(stderr, gettext("WARNING: %s does not "
941 			    "exist, so it could not be verified.\nWhen "
942 			    "'zoneadm %s' is run, '%s' will try to create\n%s, "
943 			    "and '%s' will be tried again,\nbut the '%s' may "
944 			    "fail if:\nthe parent directory of %s is group- or "
945 			    "other-writable\nor\n%s overlaps with any other "
946 			    "installed zones.\n"), path,
947 			    cmd_to_str(CMD_INSTALL), cmd_to_str(CMD_INSTALL),
948 			    path, cmd_to_str(CMD_VERIFY),
949 			    cmd_to_str(CMD_VERIFY), path, path);
950 			return (Z_OK);
951 		}
952 		/*
953 		 * The zonepath is supposed to be mode 700 but its
954 		 * parent(s) 755.  So use 755 on the mkdirp() then
955 		 * chmod() the zonepath itself to 700.
956 		 */
957 		if (mkdirp(path, DEFAULT_DIR_MODE) < 0) {
958 			zperror(path, B_FALSE);
959 			return (Z_ERR);
960 		}
961 		/*
962 		 * If the chmod() fails, report the error, but might
963 		 * as well continue the verify procedure.
964 		 */
965 		if (chmod(path, S_IRWXU) != 0)
966 			zperror(path, B_FALSE);
967 		/*
968 		 * Since the mkdir() succeeded, we should not have to
969 		 * worry about a subsequent ENOENT, thus this should
970 		 * only recurse once.
971 		 */
972 		return (validate_zonepath(path, cmd_num));
973 	}
974 	rpath[res] = '\0';
975 	if (strcmp(path, rpath) != 0) {
976 		errno = Z_RESOLVED_PATH;
977 		zperror(path, B_TRUE);
978 		return (Z_ERR);
979 	}
980 	if ((res = stat(rpath, &stbuf)) != 0) {
981 		zperror(rpath, B_FALSE);
982 		return (Z_ERR);
983 	}
984 	if (!S_ISDIR(stbuf.st_mode)) {
985 		(void) fprintf(stderr, gettext("%s is not a directory.\n"),
986 		    rpath);
987 		return (Z_ERR);
988 	}
989 	if (strcmp(stbuf.st_fstype, MNTTYPE_TMPFS) == 0) {
990 		(void) printf(gettext("WARNING: %s is on a temporary "
991 		    "file system.\n"), rpath);
992 	}
993 	if (crosscheck_zonepaths(rpath) != Z_OK)
994 		return (Z_ERR);
995 	/*
996 	 * Try to collect and report as many minor errors as possible
997 	 * before returning, so the user can learn everything that needs
998 	 * to be fixed up front.
999 	 */
1000 	if (stbuf.st_uid != 0) {
1001 		(void) fprintf(stderr, gettext("%s is not owned by root.\n"),
1002 		    rpath);
1003 		err = B_TRUE;
1004 	}
1005 	err |= bad_mode_bit(stbuf.st_mode, S_IRUSR, B_TRUE, rpath);
1006 	err |= bad_mode_bit(stbuf.st_mode, S_IWUSR, B_TRUE, rpath);
1007 	err |= bad_mode_bit(stbuf.st_mode, S_IXUSR, B_TRUE, rpath);
1008 	err |= bad_mode_bit(stbuf.st_mode, S_IRGRP, B_FALSE, rpath);
1009 	err |= bad_mode_bit(stbuf.st_mode, S_IWGRP, B_FALSE, rpath);
1010 	err |= bad_mode_bit(stbuf.st_mode, S_IXGRP, B_FALSE, rpath);
1011 	err |= bad_mode_bit(stbuf.st_mode, S_IROTH, B_FALSE, rpath);
1012 	err |= bad_mode_bit(stbuf.st_mode, S_IWOTH, B_FALSE, rpath);
1013 	err |= bad_mode_bit(stbuf.st_mode, S_IXOTH, B_FALSE, rpath);
1014 
1015 	(void) snprintf(ppath, sizeof (ppath), "%s/..", path);
1016 	if ((res = resolvepath(ppath, rppath, sizeof (rppath))) == -1) {
1017 		zperror(ppath, B_FALSE);
1018 		return (Z_ERR);
1019 	}
1020 	rppath[res] = '\0';
1021 	if ((res = stat(rppath, &stbuf)) != 0) {
1022 		zperror(rppath, B_FALSE);
1023 		return (Z_ERR);
1024 	}
1025 	/* theoretically impossible */
1026 	if (!S_ISDIR(stbuf.st_mode)) {
1027 		(void) fprintf(stderr, gettext("%s is not a directory.\n"),
1028 		    rppath);
1029 		return (Z_ERR);
1030 	}
1031 	if (stbuf.st_uid != 0) {
1032 		(void) fprintf(stderr, gettext("%s is not owned by root.\n"),
1033 		    rppath);
1034 		err = B_TRUE;
1035 	}
1036 	err |= bad_mode_bit(stbuf.st_mode, S_IRUSR, B_TRUE, rppath);
1037 	err |= bad_mode_bit(stbuf.st_mode, S_IWUSR, B_TRUE, rppath);
1038 	err |= bad_mode_bit(stbuf.st_mode, S_IXUSR, B_TRUE, rppath);
1039 	err |= bad_mode_bit(stbuf.st_mode, S_IWGRP, B_FALSE, rppath);
1040 	err |= bad_mode_bit(stbuf.st_mode, S_IWOTH, B_FALSE, rppath);
1041 	if (strcmp(rpath, rppath) == 0) {
1042 		(void) fprintf(stderr, gettext("%s is its own parent.\n"),
1043 		    rppath);
1044 		err = B_TRUE;
1045 	}
1046 
1047 	if (statvfs64(rpath, &vfsbuf) != 0) {
1048 		zperror(rpath, B_FALSE);
1049 		return (Z_ERR);
1050 	}
1051 	if (strcmp(vfsbuf.f_basetype, MNTTYPE_NFS) == 0) {
1052 		/*
1053 		 * TRANSLATION_NOTE
1054 		 * Zonepath and NFS are literals that should not be translated.
1055 		 */
1056 		(void) fprintf(stderr, gettext("Zonepath %s is on an NFS "
1057 		    "mounted file system.\n"
1058 		    "\tA local file system must be used.\n"), rpath);
1059 		return (Z_ERR);
1060 	}
1061 	if (vfsbuf.f_flag & ST_NOSUID) {
1062 		/*
1063 		 * TRANSLATION_NOTE
1064 		 * Zonepath and nosuid are literals that should not be
1065 		 * translated.
1066 		 */
1067 		(void) fprintf(stderr, gettext("Zonepath %s is on a nosuid "
1068 		    "file system.\n"), rpath);
1069 		return (Z_ERR);
1070 	}
1071 
1072 	if ((res = zone_get_state(target_zone, &state)) != Z_OK) {
1073 		errno = res;
1074 		zperror2(target_zone, gettext("could not get state"));
1075 		return (Z_ERR);
1076 	}
1077 	/*
1078 	 * The existence of the root path is only bad in the configured state,
1079 	 * as it is *supposed* to be there at the installed and later states.
1080 	 * However, the root path is expected to be there if the zone is
1081 	 * detached.
1082 	 * State/command mismatches are caught earlier in verify_details().
1083 	 */
1084 	if (state == ZONE_STATE_CONFIGURED && cmd_num != CMD_ATTACH) {
1085 		if (snprintf(rootpath, sizeof (rootpath), "%s/root", rpath) >=
1086 		    sizeof (rootpath)) {
1087 			/*
1088 			 * TRANSLATION_NOTE
1089 			 * Zonepath is a literal that should not be translated.
1090 			 */
1091 			(void) fprintf(stderr,
1092 			    gettext("Zonepath %s is too long.\n"), rpath);
1093 			return (Z_ERR);
1094 		}
1095 		if ((res = stat(rootpath, &stbuf)) == 0) {
1096 			if (zonecfg_detached(rpath))
1097 				(void) fprintf(stderr,
1098 				    gettext("Cannot %s detached "
1099 				    "zone.\nUse attach or remove %s "
1100 				    "directory.\n"), cmd_to_str(cmd_num),
1101 				    rpath);
1102 			else
1103 				(void) fprintf(stderr,
1104 				    gettext("Rootpath %s exists; "
1105 				    "remove or move aside prior to %s.\n"),
1106 				    rootpath, cmd_to_str(cmd_num));
1107 			return (Z_ERR);
1108 		}
1109 	}
1110 
1111 	return (err ? Z_ERR : Z_OK);
1112 }
1113 
1114 /*
1115  * The following two routines implement a simple locking mechanism to
1116  * ensure that only one instance of zoneadm at a time is able to manipulate
1117  * a given zone.  The lock is built on top of an fcntl(2) lock of
1118  * [<altroot>]/var/run/zones/<zonename>.zoneadm.lock.  If a zoneadm instance
1119  * can grab that lock, it is allowed to manipulate the zone.
1120  *
1121  * Since zoneadm may call external applications which in turn invoke
1122  * zoneadm again, we introduce the notion of "lock inheritance".  Any
1123  * instance of zoneadm that has another instance in its ancestry is assumed
1124  * to be acting on behalf of the original zoneadm, and is thus allowed to
1125  * manipulate its zone.
1126  *
1127  * This inheritance is implemented via the _ZONEADM_LOCK_HELD environment
1128  * variable.  When zoneadm is granted a lock on its zone, this environment
1129  * variable is set to 1.  When it releases the lock, the variable is set to
1130  * 0.  Since a child process inherits its parent's environment, checking
1131  * the state of this variable indicates whether or not any ancestor owns
1132  * the lock.
1133  */
1134 static void
1135 release_lock_file(int lockfd)
1136 {
1137 	/*
1138 	 * If we are cleaning up from a failed attempt to lock the zone for
1139 	 * the first time, we might have a zone_lock_cnt of 0.  In that
1140 	 * error case, we don't want to do anything but close the lock
1141 	 * file.
1142 	 */
1143 	assert(zone_lock_cnt >= 0);
1144 	if (zone_lock_cnt > 0) {
1145 		assert(getenv(LOCK_ENV_VAR) != NULL);
1146 		assert(atoi(getenv(LOCK_ENV_VAR)) == 1);
1147 		if (--zone_lock_cnt > 0) {
1148 			assert(lockfd == -1);
1149 			return;
1150 		}
1151 		if (putenv(zoneadm_lock_not_held) != 0) {
1152 			zperror(target_zone, B_TRUE);
1153 			exit(Z_ERR);
1154 		}
1155 	}
1156 	assert(lockfd >= 0);
1157 	(void) close(lockfd);
1158 }
1159 
1160 static int
1161 grab_lock_file(const char *zone_name, int *lockfd)
1162 {
1163 	char pathbuf[PATH_MAX];
1164 	struct flock flock;
1165 
1166 	/*
1167 	 * If we already have the lock, we can skip this expensive song
1168 	 * and dance.
1169 	 */
1170 	if (zone_lock_cnt > 0) {
1171 		zone_lock_cnt++;
1172 		*lockfd = -1;
1173 		return (Z_OK);
1174 	}
1175 	assert(getenv(LOCK_ENV_VAR) != NULL);
1176 	assert(atoi(getenv(LOCK_ENV_VAR)) == 0);
1177 
1178 	if (snprintf(pathbuf, sizeof (pathbuf), "%s%s", zonecfg_get_root(),
1179 	    ZONES_TMPDIR) >= sizeof (pathbuf)) {
1180 		zerror(gettext("alternate root path is too long"));
1181 		return (Z_ERR);
1182 	}
1183 	if (mkdir(pathbuf, S_IRWXU) < 0 && errno != EEXIST) {
1184 		zerror(gettext("could not mkdir %s: %s"), pathbuf,
1185 		    strerror(errno));
1186 		return (Z_ERR);
1187 	}
1188 	(void) chmod(pathbuf, S_IRWXU);
1189 
1190 	/*
1191 	 * One of these lock files is created for each zone (when needed).
1192 	 * The lock files are not cleaned up (except on system reboot),
1193 	 * but since there is only one per zone, there is no resource
1194 	 * starvation issue.
1195 	 */
1196 	if (snprintf(pathbuf, sizeof (pathbuf), "%s%s/%s.zoneadm.lock",
1197 	    zonecfg_get_root(), ZONES_TMPDIR, zone_name) >= sizeof (pathbuf)) {
1198 		zerror(gettext("alternate root path is too long"));
1199 		return (Z_ERR);
1200 	}
1201 	if ((*lockfd = open(pathbuf, O_RDWR|O_CREAT, S_IRUSR|S_IWUSR)) < 0) {
1202 		zerror(gettext("could not open %s: %s"), pathbuf,
1203 		    strerror(errno));
1204 		return (Z_ERR);
1205 	}
1206 	/*
1207 	 * Lock the file to synchronize with other zoneadmds
1208 	 */
1209 	flock.l_type = F_WRLCK;
1210 	flock.l_whence = SEEK_SET;
1211 	flock.l_start = (off_t)0;
1212 	flock.l_len = (off_t)0;
1213 	if ((fcntl(*lockfd, F_SETLKW, &flock) < 0) ||
1214 	    (putenv(zoneadm_lock_held) != 0)) {
1215 		zerror(gettext("unable to lock %s: %s"), pathbuf,
1216 		    strerror(errno));
1217 		release_lock_file(*lockfd);
1218 		return (Z_ERR);
1219 	}
1220 	zone_lock_cnt = 1;
1221 	return (Z_OK);
1222 }
1223 
1224 static boolean_t
1225 get_doorname(const char *zone_name, char *buffer)
1226 {
1227 	return (snprintf(buffer, PATH_MAX, "%s" ZONE_DOOR_PATH,
1228 	    zonecfg_get_root(), zone_name) < PATH_MAX);
1229 }
1230 
1231 /*
1232  * system daemons are not audited.  For the global zone, this occurs
1233  * "naturally" since init is started with the default audit
1234  * characteristics.  Since zoneadmd is a system daemon and it starts
1235  * init for a zone, it is necessary to clear out the audit
1236  * characteristics inherited from whomever started zoneadmd.  This is
1237  * indicated by the audit id, which is set from the ruid parameter of
1238  * adt_set_user(), below.
1239  */
1240 
1241 static void
1242 prepare_audit_context()
1243 {
1244 	adt_session_data_t	*ah;
1245 	char			*failure = gettext("audit failure: %s");
1246 
1247 	if (adt_start_session(&ah, NULL, 0)) {
1248 		zerror(failure, strerror(errno));
1249 		return;
1250 	}
1251 	if (adt_set_user(ah, ADT_NO_AUDIT, ADT_NO_AUDIT,
1252 	    ADT_NO_AUDIT, ADT_NO_AUDIT, NULL, ADT_NEW)) {
1253 		zerror(failure, strerror(errno));
1254 		(void) adt_end_session(ah);
1255 		return;
1256 	}
1257 	if (adt_set_proc(ah))
1258 		zerror(failure, strerror(errno));
1259 
1260 	(void) adt_end_session(ah);
1261 }
1262 
1263 static int
1264 start_zoneadmd(const char *zone_name)
1265 {
1266 	char doorpath[PATH_MAX];
1267 	pid_t child_pid;
1268 	int error = Z_ERR;
1269 	int doorfd, lockfd;
1270 	struct door_info info;
1271 
1272 	if (!get_doorname(zone_name, doorpath))
1273 		return (Z_ERR);
1274 
1275 	if (grab_lock_file(zone_name, &lockfd) != Z_OK)
1276 		return (Z_ERR);
1277 
1278 	/*
1279 	 * Now that we have the lock, re-confirm that the daemon is
1280 	 * *not* up and working fine.  If it is still down, we have a green
1281 	 * light to start it.
1282 	 */
1283 	if ((doorfd = open(doorpath, O_RDONLY)) < 0) {
1284 		if (errno != ENOENT) {
1285 			zperror(doorpath, B_FALSE);
1286 			goto out;
1287 		}
1288 	} else {
1289 		if (door_info(doorfd, &info) == 0 &&
1290 		    ((info.di_attributes & DOOR_REVOKED) == 0)) {
1291 			error = Z_OK;
1292 			(void) close(doorfd);
1293 			goto out;
1294 		}
1295 		(void) close(doorfd);
1296 	}
1297 
1298 	if ((child_pid = fork()) == -1) {
1299 		zperror(gettext("could not fork"), B_FALSE);
1300 		goto out;
1301 	} else if (child_pid == 0) {
1302 		const char *argv[6], **ap;
1303 
1304 		/* child process */
1305 		prepare_audit_context();
1306 
1307 		ap = argv;
1308 		*ap++ = "zoneadmd";
1309 		*ap++ = "-z";
1310 		*ap++ = zone_name;
1311 		if (zonecfg_in_alt_root()) {
1312 			*ap++ = "-R";
1313 			*ap++ = zonecfg_get_root();
1314 		}
1315 		*ap = NULL;
1316 
1317 		(void) execv("/usr/lib/zones/zoneadmd", (char * const *)argv);
1318 		/*
1319 		 * TRANSLATION_NOTE
1320 		 * zoneadmd is a literal that should not be translated.
1321 		 */
1322 		zperror(gettext("could not exec zoneadmd"), B_FALSE);
1323 		_exit(Z_ERR);
1324 	} else {
1325 		/* parent process */
1326 		pid_t retval;
1327 		int pstatus = 0;
1328 
1329 		do {
1330 			retval = waitpid(child_pid, &pstatus, 0);
1331 		} while (retval != child_pid);
1332 		if (WIFSIGNALED(pstatus) || (WIFEXITED(pstatus) &&
1333 		    WEXITSTATUS(pstatus) != 0)) {
1334 			zerror(gettext("could not start %s"), "zoneadmd");
1335 			goto out;
1336 		}
1337 	}
1338 	error = Z_OK;
1339 out:
1340 	release_lock_file(lockfd);
1341 	return (error);
1342 }
1343 
1344 static int
1345 ping_zoneadmd(const char *zone_name)
1346 {
1347 	char doorpath[PATH_MAX];
1348 	int doorfd;
1349 	struct door_info info;
1350 
1351 	if (!get_doorname(zone_name, doorpath))
1352 		return (Z_ERR);
1353 
1354 	if ((doorfd = open(doorpath, O_RDONLY)) < 0) {
1355 		return (Z_ERR);
1356 	}
1357 	if (door_info(doorfd, &info) == 0 &&
1358 	    ((info.di_attributes & DOOR_REVOKED) == 0)) {
1359 		(void) close(doorfd);
1360 		return (Z_OK);
1361 	}
1362 	(void) close(doorfd);
1363 	return (Z_ERR);
1364 }
1365 
1366 static int
1367 call_zoneadmd(const char *zone_name, zone_cmd_arg_t *arg)
1368 {
1369 	char doorpath[PATH_MAX];
1370 	int doorfd, result;
1371 	door_arg_t darg;
1372 
1373 	zoneid_t zoneid;
1374 	uint64_t uniqid = 0;
1375 
1376 	zone_cmd_rval_t *rvalp;
1377 	size_t rlen;
1378 	char *cp, *errbuf;
1379 
1380 	rlen = getpagesize();
1381 	if ((rvalp = malloc(rlen)) == NULL) {
1382 		zerror(gettext("failed to allocate %lu bytes: %s"), rlen,
1383 		    strerror(errno));
1384 		return (-1);
1385 	}
1386 
1387 	if ((zoneid = getzoneidbyname(zone_name)) != ZONE_ID_UNDEFINED) {
1388 		(void) zone_getattr(zoneid, ZONE_ATTR_UNIQID, &uniqid,
1389 		    sizeof (uniqid));
1390 	}
1391 	arg->uniqid = uniqid;
1392 	(void) strlcpy(arg->locale, locale, sizeof (arg->locale));
1393 	if (!get_doorname(zone_name, doorpath)) {
1394 		zerror(gettext("alternate root path is too long"));
1395 		free(rvalp);
1396 		return (-1);
1397 	}
1398 
1399 	/*
1400 	 * Loop trying to start zoneadmd; if something goes seriously
1401 	 * wrong we break out and fail.
1402 	 */
1403 	for (;;) {
1404 		if (start_zoneadmd(zone_name) != Z_OK)
1405 			break;
1406 
1407 		if ((doorfd = open(doorpath, O_RDONLY)) < 0) {
1408 			zperror(gettext("failed to open zone door"), B_FALSE);
1409 			break;
1410 		}
1411 
1412 		darg.data_ptr = (char *)arg;
1413 		darg.data_size = sizeof (*arg);
1414 		darg.desc_ptr = NULL;
1415 		darg.desc_num = 0;
1416 		darg.rbuf = (char *)rvalp;
1417 		darg.rsize = rlen;
1418 		if (door_call(doorfd, &darg) != 0) {
1419 			(void) close(doorfd);
1420 			/*
1421 			 * We'll get EBADF if the door has been revoked.
1422 			 */
1423 			if (errno != EBADF) {
1424 				zperror(gettext("door_call failed"), B_FALSE);
1425 				break;
1426 			}
1427 			continue;	/* take another lap */
1428 		}
1429 		(void) close(doorfd);
1430 
1431 		if (darg.data_size == 0) {
1432 			/* Door server is going away; kick it again. */
1433 			continue;
1434 		}
1435 
1436 		errbuf = rvalp->errbuf;
1437 		while (*errbuf != '\0') {
1438 			/*
1439 			 * Remove any newlines since zerror()
1440 			 * will append one automatically.
1441 			 */
1442 			cp = strchr(errbuf, '\n');
1443 			if (cp != NULL)
1444 				*cp = '\0';
1445 			zerror("%s", errbuf);
1446 			if (cp == NULL)
1447 				break;
1448 			errbuf = cp + 1;
1449 		}
1450 		result = rvalp->rval == 0 ? 0 : -1;
1451 		free(rvalp);
1452 		return (result);
1453 	}
1454 
1455 	free(rvalp);
1456 	return (-1);
1457 }
1458 
1459 static int
1460 invoke_brand_handler(int cmd_num, char *argv[])
1461 {
1462 	zone_dochandle_t handle;
1463 	int err;
1464 
1465 	if ((handle = zonecfg_init_handle()) == NULL) {
1466 		zperror(cmd_to_str(cmd_num), B_TRUE);
1467 		return (Z_ERR);
1468 	}
1469 	if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) {
1470 		errno = err;
1471 		zperror(cmd_to_str(cmd_num), B_TRUE);
1472 		zonecfg_fini_handle(handle);
1473 		return (Z_ERR);
1474 	}
1475 	if (verify_brand(handle, cmd_num, argv) != Z_OK) {
1476 		zonecfg_fini_handle(handle);
1477 		return (Z_ERR);
1478 	}
1479 	zonecfg_fini_handle(handle);
1480 	return (Z_OK);
1481 }
1482 
1483 static int
1484 ready_func(int argc, char *argv[])
1485 {
1486 	zone_cmd_arg_t zarg;
1487 	int arg;
1488 
1489 	if (zonecfg_in_alt_root()) {
1490 		zerror(gettext("cannot ready zone in alternate root"));
1491 		return (Z_ERR);
1492 	}
1493 
1494 	optind = 0;
1495 	if ((arg = getopt(argc, argv, "?")) != EOF) {
1496 		switch (arg) {
1497 		case '?':
1498 			sub_usage(SHELP_READY, CMD_READY);
1499 			return (optopt == '?' ? Z_OK : Z_USAGE);
1500 		default:
1501 			sub_usage(SHELP_READY, CMD_READY);
1502 			return (Z_USAGE);
1503 		}
1504 	}
1505 	if (argc > optind) {
1506 		sub_usage(SHELP_READY, CMD_READY);
1507 		return (Z_USAGE);
1508 	}
1509 	if (sanity_check(target_zone, CMD_READY, B_FALSE, B_FALSE, B_FALSE)
1510 	    != Z_OK)
1511 		return (Z_ERR);
1512 	if (verify_details(CMD_READY, argv) != Z_OK)
1513 		return (Z_ERR);
1514 
1515 	zarg.cmd = Z_READY;
1516 	if (call_zoneadmd(target_zone, &zarg) != 0) {
1517 		zerror(gettext("call to %s failed"), "zoneadmd");
1518 		return (Z_ERR);
1519 	}
1520 	return (Z_OK);
1521 }
1522 
1523 static int
1524 boot_func(int argc, char *argv[])
1525 {
1526 	zone_cmd_arg_t zarg;
1527 	boolean_t force = B_FALSE;
1528 	int arg;
1529 
1530 	if (zonecfg_in_alt_root()) {
1531 		zerror(gettext("cannot boot zone in alternate root"));
1532 		return (Z_ERR);
1533 	}
1534 
1535 	zarg.bootbuf[0] = '\0';
1536 
1537 	/*
1538 	 * The following getopt processes arguments to zone boot; that
1539 	 * is to say, the [here] portion of the argument string:
1540 	 *
1541 	 *	zoneadm -z myzone boot [here] -- -v -m verbose
1542 	 *
1543 	 * Where [here] can either be nothing, -? (in which case we bail
1544 	 * and print usage), -f (a private option to indicate that the
1545 	 * boot operation should be 'forced'), or -s.  Support for -s is
1546 	 * vestigal and obsolete, but is retained because it was a
1547 	 * documented interface and there are known consumers including
1548 	 * admin/install; the proper way to specify boot arguments like -s
1549 	 * is:
1550 	 *
1551 	 *	zoneadm -z myzone boot -- -s -v -m verbose.
1552 	 */
1553 	optind = 0;
1554 	while ((arg = getopt(argc, argv, "?fs")) != EOF) {
1555 		switch (arg) {
1556 		case '?':
1557 			sub_usage(SHELP_BOOT, CMD_BOOT);
1558 			return (optopt == '?' ? Z_OK : Z_USAGE);
1559 		case 's':
1560 			(void) strlcpy(zarg.bootbuf, "-s",
1561 			    sizeof (zarg.bootbuf));
1562 			break;
1563 		case 'f':
1564 			force = B_TRUE;
1565 			break;
1566 		default:
1567 			sub_usage(SHELP_BOOT, CMD_BOOT);
1568 			return (Z_USAGE);
1569 		}
1570 	}
1571 
1572 	for (; optind < argc; optind++) {
1573 		if (strlcat(zarg.bootbuf, argv[optind],
1574 		    sizeof (zarg.bootbuf)) >= sizeof (zarg.bootbuf)) {
1575 			zerror(gettext("Boot argument list too long"));
1576 			return (Z_ERR);
1577 		}
1578 		if (optind < argc - 1)
1579 			if (strlcat(zarg.bootbuf, " ", sizeof (zarg.bootbuf)) >=
1580 			    sizeof (zarg.bootbuf)) {
1581 				zerror(gettext("Boot argument list too long"));
1582 				return (Z_ERR);
1583 			}
1584 	}
1585 	if (sanity_check(target_zone, CMD_BOOT, B_FALSE, B_FALSE, force)
1586 	    != Z_OK)
1587 		return (Z_ERR);
1588 	if (verify_details(CMD_BOOT, argv) != Z_OK)
1589 		return (Z_ERR);
1590 	zarg.cmd = force ? Z_FORCEBOOT : Z_BOOT;
1591 	if (call_zoneadmd(target_zone, &zarg) != 0) {
1592 		zerror(gettext("call to %s failed"), "zoneadmd");
1593 		return (Z_ERR);
1594 	}
1595 
1596 	return (Z_OK);
1597 }
1598 
1599 static void
1600 fake_up_local_zone(zoneid_t zid, zone_entry_t *zeptr)
1601 {
1602 	ssize_t result;
1603 	uuid_t uuid;
1604 	FILE *fp;
1605 	ushort_t flags;
1606 
1607 	(void) memset(zeptr, 0, sizeof (*zeptr));
1608 
1609 	zeptr->zid = zid;
1610 
1611 	/*
1612 	 * Since we're looking up our own (non-global) zone name,
1613 	 * we can be assured that it will succeed.
1614 	 */
1615 	result = getzonenamebyid(zid, zeptr->zname, sizeof (zeptr->zname));
1616 	assert(result >= 0);
1617 	if (zonecfg_is_scratch(zeptr->zname) &&
1618 	    (fp = zonecfg_open_scratch("", B_FALSE)) != NULL) {
1619 		(void) zonecfg_reverse_scratch(fp, zeptr->zname, zeptr->zname,
1620 		    sizeof (zeptr->zname), NULL, 0);
1621 		zonecfg_close_scratch(fp);
1622 	}
1623 
1624 	if (is_system_labeled()) {
1625 		(void) zone_getattr(zid, ZONE_ATTR_ROOT, zeptr->zroot,
1626 		    sizeof (zeptr->zroot));
1627 		(void) strlcpy(zeptr->zbrand, NATIVE_BRAND_NAME,
1628 			    sizeof (zeptr->zbrand));
1629 	} else {
1630 		(void) strlcpy(zeptr->zroot, "/", sizeof (zeptr->zroot));
1631 		(void) zone_getattr(zid, ZONE_ATTR_BRAND, zeptr->zbrand,
1632 		    sizeof (zeptr->zbrand));
1633 	}
1634 
1635 	zeptr->zstate_str = "running";
1636 	if (zonecfg_get_uuid(zeptr->zname, uuid) == Z_OK &&
1637 	    !uuid_is_null(uuid))
1638 		uuid_unparse(uuid, zeptr->zuuid);
1639 
1640 	if (zone_getattr(zid, ZONE_ATTR_FLAGS, &flags, sizeof (flags)) < 0) {
1641 		zperror2(zeptr->zname, gettext("could not get zone flags"));
1642 		exit(Z_ERR);
1643 	}
1644 	if (flags & ZF_NET_EXCL)
1645 		zeptr->ziptype = ZS_EXCLUSIVE;
1646 	else
1647 		zeptr->ziptype = ZS_SHARED;
1648 }
1649 
1650 static int
1651 list_func(int argc, char *argv[])
1652 {
1653 	zone_entry_t *zentp, zent;
1654 	int arg, retv;
1655 	boolean_t output = B_FALSE, verbose = B_FALSE, parsable = B_FALSE;
1656 	zone_state_t min_state = ZONE_STATE_RUNNING;
1657 	zoneid_t zone_id = getzoneid();
1658 
1659 	if (target_zone == NULL) {
1660 		/* all zones: default view to running but allow override */
1661 		optind = 0;
1662 		while ((arg = getopt(argc, argv, "?cipv")) != EOF) {
1663 			switch (arg) {
1664 			case '?':
1665 				sub_usage(SHELP_LIST, CMD_LIST);
1666 				return (optopt == '?' ? Z_OK : Z_USAGE);
1667 				/*
1668 				 * The 'i' and 'c' options are not mutually
1669 				 * exclusive so if 'c' is given, then min_state
1670 				 * is set to 0 (ZONE_STATE_CONFIGURED) which is
1671 				 * the lowest possible state.  If 'i' is given,
1672 				 * then min_state is set to be the lowest state
1673 				 * so far.
1674 				 */
1675 			case 'c':
1676 				min_state = ZONE_STATE_CONFIGURED;
1677 				break;
1678 			case 'i':
1679 				min_state = min(ZONE_STATE_INSTALLED,
1680 				    min_state);
1681 
1682 				break;
1683 			case 'p':
1684 				parsable = B_TRUE;
1685 				break;
1686 			case 'v':
1687 				verbose = B_TRUE;
1688 				break;
1689 			default:
1690 				sub_usage(SHELP_LIST, CMD_LIST);
1691 				return (Z_USAGE);
1692 			}
1693 		}
1694 		if (parsable && verbose) {
1695 			zerror(gettext("%s -p and -v are mutually exclusive."),
1696 			    cmd_to_str(CMD_LIST));
1697 			return (Z_ERR);
1698 		}
1699 		if (zone_id == GLOBAL_ZONEID || is_system_labeled()) {
1700 			retv = zone_print_list(min_state, verbose, parsable);
1701 		} else {
1702 			fake_up_local_zone(zone_id, &zent);
1703 			retv = Z_OK;
1704 			zone_print(&zent, verbose, parsable);
1705 		}
1706 		return (retv);
1707 	}
1708 
1709 	/*
1710 	 * Specific target zone: disallow -i/-c suboptions.
1711 	 */
1712 	optind = 0;
1713 	while ((arg = getopt(argc, argv, "?pv")) != EOF) {
1714 		switch (arg) {
1715 		case '?':
1716 			sub_usage(SHELP_LIST, CMD_LIST);
1717 			return (optopt == '?' ? Z_OK : Z_USAGE);
1718 		case 'p':
1719 			parsable = B_TRUE;
1720 			break;
1721 		case 'v':
1722 			verbose = B_TRUE;
1723 			break;
1724 		default:
1725 			sub_usage(SHELP_LIST, CMD_LIST);
1726 			return (Z_USAGE);
1727 		}
1728 	}
1729 	if (parsable && verbose) {
1730 		zerror(gettext("%s -p and -v are mutually exclusive."),
1731 		    cmd_to_str(CMD_LIST));
1732 		return (Z_ERR);
1733 	}
1734 	if (argc > optind) {
1735 		sub_usage(SHELP_LIST, CMD_LIST);
1736 		return (Z_USAGE);
1737 	}
1738 	if (zone_id != GLOBAL_ZONEID && !is_system_labeled()) {
1739 		fake_up_local_zone(zone_id, &zent);
1740 		/*
1741 		 * main() will issue a Z_NO_ZONE error if it cannot get an
1742 		 * id for target_zone, which in a non-global zone should
1743 		 * happen for any zone name except `zonename`.  Thus we
1744 		 * assert() that here but don't otherwise check.
1745 		 */
1746 		assert(strcmp(zent.zname, target_zone) == 0);
1747 		zone_print(&zent, verbose, parsable);
1748 		output = B_TRUE;
1749 	} else if ((zentp = lookup_running_zone(target_zone)) != NULL) {
1750 		zone_print(zentp, verbose, parsable);
1751 		output = B_TRUE;
1752 	} else if (lookup_zone_info(target_zone, ZONE_ID_UNDEFINED,
1753 	    &zent) == Z_OK) {
1754 		zone_print(&zent, verbose, parsable);
1755 		output = B_TRUE;
1756 	}
1757 
1758 	/*
1759 	 * Invoke brand-specific handler. Note that we do this
1760 	 * only if we're in the global zone, and target_zone is specified
1761 	 * and it is not the global zone.
1762 	 */
1763 	if (zone_id == GLOBAL_ZONEID && target_zone != NULL &&
1764 	    strcmp(target_zone, GLOBAL_ZONENAME) != 0)
1765 		if (invoke_brand_handler(CMD_LIST, argv) != Z_OK)
1766 			return (Z_ERR);
1767 
1768 	return (output ? Z_OK : Z_ERR);
1769 }
1770 
1771 static void
1772 sigterm(int sig)
1773 {
1774 	/*
1775 	 * Ignore SIG{INT,TERM}, so we don't end up in an infinite loop,
1776 	 * then propagate the signal to our process group.
1777 	 */
1778 	assert(sig == SIGINT || sig == SIGTERM);
1779 	(void) sigset(SIGINT, SIG_IGN);
1780 	(void) sigset(SIGTERM, SIG_IGN);
1781 	(void) kill(0, sig);
1782 	child_killed = B_TRUE;
1783 }
1784 
1785 static int
1786 do_subproc(char *cmdbuf)
1787 {
1788 	char inbuf[1024];	/* arbitrary large amount */
1789 	FILE *file;
1790 
1791 	do_subproc_cnt++;
1792 	child_killed = B_FALSE;
1793 	/*
1794 	 * We use popen(3c) to launch child processes for [un]install;
1795 	 * this library call does not return a PID, so we have to kill
1796 	 * the whole process group.  To avoid killing our parent, we
1797 	 * become a process group leader here.  But doing so can wreak
1798 	 * havoc with reading from stdin when launched by a non-job-control
1799 	 * shell, so we close stdin and reopen it as /dev/null first.
1800 	 */
1801 	(void) close(STDIN_FILENO);
1802 	(void) openat(STDIN_FILENO, "/dev/null", O_RDONLY);
1803 	if (!zoneadm_is_nested)
1804 		(void) setpgid(0, 0);
1805 	(void) sigset(SIGINT, sigterm);
1806 	(void) sigset(SIGTERM, sigterm);
1807 	file = popen(cmdbuf, "r");
1808 	for (;;) {
1809 		if (child_killed || fgets(inbuf, sizeof (inbuf), file) == NULL)
1810 			break;
1811 		(void) fputs(inbuf, stdout);
1812 	}
1813 	(void) sigset(SIGINT, SIG_DFL);
1814 	(void) sigset(SIGTERM, SIG_DFL);
1815 	return (pclose(file));
1816 }
1817 
1818 static int
1819 do_subproc_interactive(char *cmdbuf)
1820 {
1821 	void (*saveint)(int);
1822 	void (*saveterm)(int);
1823 	void (*savequit)(int);
1824 	void (*savehup)(int);
1825 	int pid, child, status;
1826 
1827 	/*
1828 	 * do_subproc() links stdin to /dev/null, which would break any
1829 	 * interactive subprocess we try to launch here.  Similarly, we
1830 	 * can't have been launched as a subprocess ourselves.
1831 	 */
1832 	assert(do_subproc_cnt == 0 && !zoneadm_is_nested);
1833 
1834 	if ((child = vfork()) == 0) {
1835 		(void) execl("/bin/sh", "sh", "-c", cmdbuf, (char *)NULL);
1836 	}
1837 
1838 	if (child == -1)
1839 		return (-1);
1840 
1841 	saveint = sigset(SIGINT, SIG_IGN);
1842 	saveterm = sigset(SIGTERM, SIG_IGN);
1843 	savequit = sigset(SIGQUIT, SIG_IGN);
1844 	savehup = sigset(SIGHUP, SIG_IGN);
1845 
1846 	while ((pid = waitpid(child, &status, 0)) != child && pid != -1)
1847 		;
1848 
1849 	(void) sigset(SIGINT, saveint);
1850 	(void) sigset(SIGTERM, saveterm);
1851 	(void) sigset(SIGQUIT, savequit);
1852 	(void) sigset(SIGHUP, savehup);
1853 
1854 	return (pid == -1 ? -1 : status);
1855 }
1856 
1857 static int
1858 subproc_status(const char *cmd, int status, boolean_t verbose_failure)
1859 {
1860 	if (WIFEXITED(status)) {
1861 		int exit_code = WEXITSTATUS(status);
1862 
1863 		if ((verbose_failure) && (exit_code != ZONE_SUBPROC_OK))
1864 			zerror(gettext("'%s' failed with exit code %d."), cmd,
1865 			    exit_code);
1866 
1867 		return (exit_code);
1868 	} else if (WIFSIGNALED(status)) {
1869 		int signal = WTERMSIG(status);
1870 		char sigstr[SIG2STR_MAX];
1871 
1872 		if (sig2str(signal, sigstr) == 0) {
1873 			zerror(gettext("'%s' terminated by signal SIG%s."), cmd,
1874 			    sigstr);
1875 		} else {
1876 			zerror(gettext("'%s' terminated by an unknown signal."),
1877 			    cmd);
1878 		}
1879 	} else {
1880 		zerror(gettext("'%s' failed for unknown reasons."), cmd);
1881 	}
1882 
1883 	/*
1884 	 * Assume a subprocess that died due to a signal or an unknown error
1885 	 * should be considered an exit code of ZONE_SUBPROC_FATAL, as the
1886 	 * user will likely need to do some manual cleanup.
1887 	 */
1888 	return (ZONE_SUBPROC_FATAL);
1889 }
1890 
1891 /*
1892  * Various sanity checks; make sure:
1893  * 1. We're in the global zone.
1894  * 2. The calling user has sufficient privilege.
1895  * 3. The target zone is neither the global zone nor anything starting with
1896  *    "SUNW".
1897  * 4a. If we're looking for a 'not running' (i.e., configured or installed)
1898  *     zone, the name service knows about it.
1899  * 4b. For some operations which expect a zone not to be running, that it is
1900  *     not already running (or ready).
1901  */
1902 static int
1903 sanity_check(char *zone, int cmd_num, boolean_t running,
1904     boolean_t unsafe_when_running, boolean_t force)
1905 {
1906 	zone_entry_t *zent;
1907 	priv_set_t *privset;
1908 	zone_state_t state, min_state;
1909 	char kernzone[ZONENAME_MAX];
1910 	FILE *fp;
1911 
1912 	if (getzoneid() != GLOBAL_ZONEID) {
1913 		switch (cmd_num) {
1914 		case CMD_HALT:
1915 			zerror(gettext("use %s to %s this zone."), "halt(1M)",
1916 			    cmd_to_str(cmd_num));
1917 			break;
1918 		case CMD_REBOOT:
1919 			zerror(gettext("use %s to %s this zone."),
1920 			    "reboot(1M)", cmd_to_str(cmd_num));
1921 			break;
1922 		default:
1923 			zerror(gettext("must be in the global zone to %s a "
1924 			    "zone."), cmd_to_str(cmd_num));
1925 			break;
1926 		}
1927 		return (Z_ERR);
1928 	}
1929 
1930 	if ((privset = priv_allocset()) == NULL) {
1931 		zerror(gettext("%s failed"), "priv_allocset");
1932 		return (Z_ERR);
1933 	}
1934 
1935 	if (getppriv(PRIV_EFFECTIVE, privset) != 0) {
1936 		zerror(gettext("%s failed"), "getppriv");
1937 		priv_freeset(privset);
1938 		return (Z_ERR);
1939 	}
1940 
1941 	if (priv_isfullset(privset) == B_FALSE) {
1942 		zerror(gettext("only a privileged user may %s a zone."),
1943 		    cmd_to_str(cmd_num));
1944 		priv_freeset(privset);
1945 		return (Z_ERR);
1946 	}
1947 	priv_freeset(privset);
1948 
1949 	if (zone == NULL) {
1950 		zerror(gettext("no zone specified"));
1951 		return (Z_ERR);
1952 	}
1953 
1954 	if (strcmp(zone, GLOBAL_ZONENAME) == 0) {
1955 		zerror(gettext("%s operation is invalid for the global zone."),
1956 		    cmd_to_str(cmd_num));
1957 		return (Z_ERR);
1958 	}
1959 
1960 	if (strncmp(zone, "SUNW", 4) == 0) {
1961 		zerror(gettext("%s operation is invalid for zones starting "
1962 		    "with SUNW."), cmd_to_str(cmd_num));
1963 		return (Z_ERR);
1964 	}
1965 
1966 	if (!is_native_zone && cmd_num == CMD_MOUNT) {
1967 		zerror(gettext("%s operation is invalid for branded zones."),
1968 		    cmd_to_str(cmd_num));
1969 			return (Z_ERR);
1970 	}
1971 
1972 	if (!zonecfg_in_alt_root()) {
1973 		zent = lookup_running_zone(zone);
1974 	} else if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
1975 		zent = NULL;
1976 	} else {
1977 		if (zonecfg_find_scratch(fp, zone, zonecfg_get_root(),
1978 		    kernzone, sizeof (kernzone)) == 0)
1979 			zent = lookup_running_zone(kernzone);
1980 		else
1981 			zent = NULL;
1982 		zonecfg_close_scratch(fp);
1983 	}
1984 
1985 	/*
1986 	 * Look up from the kernel for 'running' zones.
1987 	 */
1988 	if (running && !force) {
1989 		if (zent == NULL) {
1990 			zerror(gettext("not running"));
1991 			return (Z_ERR);
1992 		}
1993 	} else {
1994 		int err;
1995 
1996 		if (unsafe_when_running && zent != NULL) {
1997 			/* check whether the zone is ready or running */
1998 			if ((err = zone_get_state(zent->zname,
1999 			    &zent->zstate_num)) != Z_OK) {
2000 				errno = err;
2001 				zperror2(zent->zname,
2002 				    gettext("could not get state"));
2003 				/* can't tell, so hedge */
2004 				zent->zstate_str = "ready/running";
2005 			} else {
2006 				zent->zstate_str =
2007 				    zone_state_str(zent->zstate_num);
2008 			}
2009 			zerror(gettext("%s operation is invalid for %s zones."),
2010 			    cmd_to_str(cmd_num), zent->zstate_str);
2011 			return (Z_ERR);
2012 		}
2013 		if ((err = zone_get_state(zone, &state)) != Z_OK) {
2014 			errno = err;
2015 			zperror2(zone, gettext("could not get state"));
2016 			return (Z_ERR);
2017 		}
2018 		switch (cmd_num) {
2019 		case CMD_UNINSTALL:
2020 			if (state == ZONE_STATE_CONFIGURED) {
2021 				zerror(gettext("is already in state '%s'."),
2022 				    zone_state_str(ZONE_STATE_CONFIGURED));
2023 				return (Z_ERR);
2024 			}
2025 			break;
2026 		case CMD_ATTACH:
2027 		case CMD_CLONE:
2028 		case CMD_INSTALL:
2029 			if (state == ZONE_STATE_INSTALLED) {
2030 				zerror(gettext("is already %s."),
2031 				    zone_state_str(ZONE_STATE_INSTALLED));
2032 				return (Z_ERR);
2033 			} else if (state == ZONE_STATE_INCOMPLETE) {
2034 				zerror(gettext("zone is %s; %s required."),
2035 				    zone_state_str(ZONE_STATE_INCOMPLETE),
2036 				    cmd_to_str(CMD_UNINSTALL));
2037 				return (Z_ERR);
2038 			}
2039 			break;
2040 		case CMD_DETACH:
2041 		case CMD_MOVE:
2042 		case CMD_READY:
2043 		case CMD_BOOT:
2044 		case CMD_MOUNT:
2045 		case CMD_MARK:
2046 			if ((cmd_num == CMD_BOOT || cmd_num == CMD_MOUNT) &&
2047 			    force)
2048 				min_state = ZONE_STATE_INCOMPLETE;
2049 			else
2050 				min_state = ZONE_STATE_INSTALLED;
2051 
2052 			if (force && cmd_num == CMD_BOOT && is_native_zone) {
2053 				zerror(gettext("Only branded zones may be "
2054 				    "force-booted."));
2055 				return (Z_ERR);
2056 			}
2057 
2058 			if (state < min_state) {
2059 				zerror(gettext("must be %s before %s."),
2060 				    zone_state_str(min_state),
2061 				    cmd_to_str(cmd_num));
2062 				return (Z_ERR);
2063 			}
2064 			break;
2065 		case CMD_VERIFY:
2066 			if (state == ZONE_STATE_INCOMPLETE) {
2067 				zerror(gettext("zone is %s; %s required."),
2068 				    zone_state_str(ZONE_STATE_INCOMPLETE),
2069 				    cmd_to_str(CMD_UNINSTALL));
2070 				return (Z_ERR);
2071 			}
2072 			break;
2073 		case CMD_UNMOUNT:
2074 			if (state != ZONE_STATE_MOUNTED) {
2075 				zerror(gettext("must be %s before %s."),
2076 				    zone_state_str(ZONE_STATE_MOUNTED),
2077 				    cmd_to_str(cmd_num));
2078 				return (Z_ERR);
2079 			}
2080 			break;
2081 		}
2082 	}
2083 	return (Z_OK);
2084 }
2085 
2086 static int
2087 halt_func(int argc, char *argv[])
2088 {
2089 	zone_cmd_arg_t zarg;
2090 	int arg;
2091 
2092 	if (zonecfg_in_alt_root()) {
2093 		zerror(gettext("cannot halt zone in alternate root"));
2094 		return (Z_ERR);
2095 	}
2096 
2097 	optind = 0;
2098 	if ((arg = getopt(argc, argv, "?")) != EOF) {
2099 		switch (arg) {
2100 		case '?':
2101 			sub_usage(SHELP_HALT, CMD_HALT);
2102 			return (optopt == '?' ? Z_OK : Z_USAGE);
2103 		default:
2104 			sub_usage(SHELP_HALT, CMD_HALT);
2105 			return (Z_USAGE);
2106 		}
2107 	}
2108 	if (argc > optind) {
2109 		sub_usage(SHELP_HALT, CMD_HALT);
2110 		return (Z_USAGE);
2111 	}
2112 	/*
2113 	 * zoneadmd should be the one to decide whether or not to proceed,
2114 	 * so even though it seems that the fourth parameter below should
2115 	 * perhaps be B_TRUE, it really shouldn't be.
2116 	 */
2117 	if (sanity_check(target_zone, CMD_HALT, B_FALSE, B_FALSE, B_FALSE)
2118 	    != Z_OK)
2119 		return (Z_ERR);
2120 
2121 	/*
2122 	 * Invoke brand-specific handler.
2123 	 */
2124 	if (invoke_brand_handler(CMD_HALT, argv) != Z_OK)
2125 		return (Z_ERR);
2126 
2127 	zarg.cmd = Z_HALT;
2128 	return ((call_zoneadmd(target_zone, &zarg) == 0) ? Z_OK : Z_ERR);
2129 }
2130 
2131 static int
2132 reboot_func(int argc, char *argv[])
2133 {
2134 	zone_cmd_arg_t zarg;
2135 	int arg;
2136 
2137 	if (zonecfg_in_alt_root()) {
2138 		zerror(gettext("cannot reboot zone in alternate root"));
2139 		return (Z_ERR);
2140 	}
2141 
2142 	optind = 0;
2143 	if ((arg = getopt(argc, argv, "?")) != EOF) {
2144 		switch (arg) {
2145 		case '?':
2146 			sub_usage(SHELP_REBOOT, CMD_REBOOT);
2147 			return (optopt == '?' ? Z_OK : Z_USAGE);
2148 		default:
2149 			sub_usage(SHELP_REBOOT, CMD_REBOOT);
2150 			return (Z_USAGE);
2151 		}
2152 	}
2153 
2154 	zarg.bootbuf[0] = '\0';
2155 	for (; optind < argc; optind++) {
2156 		if (strlcat(zarg.bootbuf, argv[optind],
2157 		    sizeof (zarg.bootbuf)) >= sizeof (zarg.bootbuf)) {
2158 			zerror(gettext("Boot argument list too long"));
2159 			return (Z_ERR);
2160 		}
2161 		if (optind < argc - 1)
2162 			if (strlcat(zarg.bootbuf, " ", sizeof (zarg.bootbuf)) >=
2163 			    sizeof (zarg.bootbuf)) {
2164 				zerror(gettext("Boot argument list too long"));
2165 				return (Z_ERR);
2166 			}
2167 	}
2168 
2169 
2170 	/*
2171 	 * zoneadmd should be the one to decide whether or not to proceed,
2172 	 * so even though it seems that the fourth parameter below should
2173 	 * perhaps be B_TRUE, it really shouldn't be.
2174 	 */
2175 	if (sanity_check(target_zone, CMD_REBOOT, B_TRUE, B_FALSE, B_FALSE)
2176 	    != Z_OK)
2177 		return (Z_ERR);
2178 	if (verify_details(CMD_REBOOT, argv) != Z_OK)
2179 		return (Z_ERR);
2180 
2181 	zarg.cmd = Z_REBOOT;
2182 	return ((call_zoneadmd(target_zone, &zarg) == 0) ? Z_OK : Z_ERR);
2183 }
2184 
2185 static int
2186 verify_brand(zone_dochandle_t handle, int cmd_num, char *argv[])
2187 {
2188 	char cmdbuf[MAXPATHLEN];
2189 	int err;
2190 	char zonepath[MAXPATHLEN];
2191 	brand_handle_t bh = NULL;
2192 	int status, i;
2193 
2194 	/*
2195 	 * Fetch the verify command from the brand configuration.
2196 	 * "exec" the command so that the returned status is that of
2197 	 * the command and not the shell.
2198 	 */
2199 	if ((err = zonecfg_get_zonepath(handle, zonepath, sizeof (zonepath))) !=
2200 	    Z_OK) {
2201 		errno = err;
2202 		zperror(cmd_to_str(cmd_num), B_TRUE);
2203 		return (Z_ERR);
2204 	}
2205 	if ((bh = brand_open(target_brand)) == NULL) {
2206 		zerror(gettext("missing or invalid brand"));
2207 		return (Z_ERR);
2208 	}
2209 
2210 	/*
2211 	 * If the brand has its own verification routine, execute it now.
2212 	 * The verification routine validates the intended zoneadm
2213 	 * operation for the specific brand. The zoneadm subcommand and
2214 	 * all its arguments are passed to the routine.
2215 	 */
2216 	(void) strcpy(cmdbuf, EXEC_PREFIX);
2217 	err = brand_get_verify_adm(bh, target_zone, zonepath,
2218 	    cmdbuf + EXEC_LEN, sizeof (cmdbuf) - EXEC_LEN, 0, NULL);
2219 	brand_close(bh);
2220 	if (err != 0)
2221 		return (Z_BRAND_ERROR);
2222 	if (strlen(cmdbuf) <= EXEC_LEN)
2223 		return (Z_OK);
2224 
2225 	if (strlcat(cmdbuf, cmd_to_str(cmd_num),
2226 	    sizeof (cmdbuf)) >= sizeof (cmdbuf))
2227 		return (Z_ERR);
2228 
2229 	/* Build the argv string */
2230 	i = 0;
2231 	while (argv[i] != NULL) {
2232 		if ((strlcat(cmdbuf, " ",
2233 		    sizeof (cmdbuf)) >= sizeof (cmdbuf)) ||
2234 		    (strlcat(cmdbuf, argv[i++],
2235 		    sizeof (cmdbuf)) >= sizeof (cmdbuf)))
2236 			return (Z_ERR);
2237 	}
2238 
2239 	if (zoneadm_is_nested)
2240 		status = do_subproc(cmdbuf);
2241 	else
2242 		status = do_subproc_interactive(cmdbuf);
2243 	err = subproc_status(gettext("brand-specific verification"),
2244 	    status, B_FALSE);
2245 
2246 	return ((err == ZONE_SUBPROC_OK) ? Z_OK : Z_BRAND_ERROR);
2247 }
2248 
2249 static int
2250 verify_rctls(zone_dochandle_t handle)
2251 {
2252 	struct zone_rctltab rctltab;
2253 	size_t rbs = rctlblk_size();
2254 	rctlblk_t *rctlblk;
2255 	int error = Z_INVAL;
2256 
2257 	if ((rctlblk = malloc(rbs)) == NULL) {
2258 		zerror(gettext("failed to allocate %lu bytes: %s"), rbs,
2259 		    strerror(errno));
2260 		return (Z_NOMEM);
2261 	}
2262 
2263 	if (zonecfg_setrctlent(handle) != Z_OK) {
2264 		zerror(gettext("zonecfg_setrctlent failed"));
2265 		free(rctlblk);
2266 		return (error);
2267 	}
2268 
2269 	rctltab.zone_rctl_valptr = NULL;
2270 	while (zonecfg_getrctlent(handle, &rctltab) == Z_OK) {
2271 		struct zone_rctlvaltab *rctlval;
2272 		const char *name = rctltab.zone_rctl_name;
2273 
2274 		if (!zonecfg_is_rctl(name)) {
2275 			zerror(gettext("WARNING: Ignoring unrecognized rctl "
2276 			    "'%s'."),  name);
2277 			zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
2278 			rctltab.zone_rctl_valptr = NULL;
2279 			continue;
2280 		}
2281 
2282 		for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
2283 		    rctlval = rctlval->zone_rctlval_next) {
2284 			if (zonecfg_construct_rctlblk(rctlval, rctlblk)
2285 			    != Z_OK) {
2286 				zerror(gettext("invalid rctl value: "
2287 				    "(priv=%s,limit=%s,action%s)"),
2288 				    rctlval->zone_rctlval_priv,
2289 				    rctlval->zone_rctlval_limit,
2290 				    rctlval->zone_rctlval_action);
2291 				goto out;
2292 			}
2293 			if (!zonecfg_valid_rctl(name, rctlblk)) {
2294 				zerror(gettext("(priv=%s,limit=%s,action=%s) "
2295 				    "is not a valid value for rctl '%s'"),
2296 				    rctlval->zone_rctlval_priv,
2297 				    rctlval->zone_rctlval_limit,
2298 				    rctlval->zone_rctlval_action,
2299 				    name);
2300 				goto out;
2301 			}
2302 		}
2303 		zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
2304 	}
2305 	rctltab.zone_rctl_valptr = NULL;
2306 	error = Z_OK;
2307 out:
2308 	zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
2309 	(void) zonecfg_endrctlent(handle);
2310 	free(rctlblk);
2311 	return (error);
2312 }
2313 
2314 static int
2315 verify_pool(zone_dochandle_t handle)
2316 {
2317 	char poolname[MAXPATHLEN];
2318 	pool_conf_t *poolconf;
2319 	pool_t *pool;
2320 	int status;
2321 	int error;
2322 
2323 	/*
2324 	 * This ends up being very similar to the check done in zoneadmd.
2325 	 */
2326 	error = zonecfg_get_pool(handle, poolname, sizeof (poolname));
2327 	if (error == Z_NO_ENTRY || (error == Z_OK && strlen(poolname) == 0)) {
2328 		/*
2329 		 * No pool specified.
2330 		 */
2331 		return (0);
2332 	}
2333 	if (error != Z_OK) {
2334 		zperror(gettext("Unable to retrieve pool name from "
2335 		    "configuration"), B_TRUE);
2336 		return (error);
2337 	}
2338 	/*
2339 	 * Don't do anything if pools aren't enabled.
2340 	 */
2341 	if (pool_get_status(&status) != PO_SUCCESS || status != POOL_ENABLED) {
2342 		zerror(gettext("WARNING: pools facility not active; "
2343 		    "zone will not be bound to pool '%s'."), poolname);
2344 		return (Z_OK);
2345 	}
2346 	/*
2347 	 * Try to provide a sane error message if the requested pool doesn't
2348 	 * exist.  It isn't clear that pools-related failures should
2349 	 * necessarily translate to a failure to verify the zone configuration,
2350 	 * hence they are not considered errors.
2351 	 */
2352 	if ((poolconf = pool_conf_alloc()) == NULL) {
2353 		zerror(gettext("WARNING: pool_conf_alloc failed; "
2354 		    "using default pool"));
2355 		return (Z_OK);
2356 	}
2357 	if (pool_conf_open(poolconf, pool_dynamic_location(), PO_RDONLY) !=
2358 	    PO_SUCCESS) {
2359 		zerror(gettext("WARNING: pool_conf_open failed; "
2360 		    "using default pool"));
2361 		pool_conf_free(poolconf);
2362 		return (Z_OK);
2363 	}
2364 	pool = pool_get_pool(poolconf, poolname);
2365 	(void) pool_conf_close(poolconf);
2366 	pool_conf_free(poolconf);
2367 	if (pool == NULL) {
2368 		zerror(gettext("WARNING: pool '%s' not found. "
2369 		    "using default pool"), poolname);
2370 	}
2371 
2372 	return (Z_OK);
2373 }
2374 
2375 static int
2376 verify_ipd(zone_dochandle_t handle)
2377 {
2378 	int return_code = Z_OK;
2379 	struct zone_fstab fstab;
2380 	struct stat st;
2381 	char specdir[MAXPATHLEN];
2382 
2383 	if (zonecfg_setipdent(handle) != Z_OK) {
2384 		/*
2385 		 * TRANSLATION_NOTE
2386 		 * inherit-pkg-dirs is a literal that should not be translated.
2387 		 */
2388 		(void) fprintf(stderr, gettext("could not verify "
2389 		    "inherit-pkg-dirs: unable to enumerate mounts\n"));
2390 		return (Z_ERR);
2391 	}
2392 	while (zonecfg_getipdent(handle, &fstab) == Z_OK) {
2393 		/*
2394 		 * Verify fs_dir exists.
2395 		 */
2396 		(void) snprintf(specdir, sizeof (specdir), "%s%s",
2397 		    zonecfg_get_root(), fstab.zone_fs_dir);
2398 		if (stat(specdir, &st) != 0) {
2399 			/*
2400 			 * TRANSLATION_NOTE
2401 			 * inherit-pkg-dir is a literal that should not be
2402 			 * translated.
2403 			 */
2404 			(void) fprintf(stderr, gettext("could not verify "
2405 			    "inherit-pkg-dir %s: %s\n"),
2406 			    fstab.zone_fs_dir, strerror(errno));
2407 			return_code = Z_ERR;
2408 		}
2409 		if (strcmp(st.st_fstype, MNTTYPE_NFS) == 0) {
2410 			/*
2411 			 * TRANSLATION_NOTE
2412 			 * inherit-pkg-dir and NFS are literals that should
2413 			 * not be translated.
2414 			 */
2415 			(void) fprintf(stderr, gettext("cannot verify "
2416 			    "inherit-pkg-dir %s: NFS mounted file system.\n"
2417 			    "\tA local file system must be used.\n"),
2418 			    fstab.zone_fs_dir);
2419 			return_code = Z_ERR;
2420 		}
2421 	}
2422 	(void) zonecfg_endipdent(handle);
2423 
2424 	return (return_code);
2425 }
2426 
2427 /*
2428  * Verify that the special device/file system exists and is valid.
2429  */
2430 static int
2431 verify_fs_special(struct zone_fstab *fstab)
2432 {
2433 	struct stat st;
2434 
2435 	/*
2436 	 * This validation is really intended for standard zone administration.
2437 	 * If we are in a mini-root or some other upgrade situation where
2438 	 * we are using the scratch zone, just by-pass this.
2439 	 */
2440 	if (zonecfg_in_alt_root())
2441 		return (Z_OK);
2442 
2443 	if (strcmp(fstab->zone_fs_type, MNTTYPE_ZFS) == 0)
2444 		return (verify_fs_zfs(fstab));
2445 
2446 	if (stat(fstab->zone_fs_special, &st) != 0) {
2447 		(void) fprintf(stderr, gettext("could not verify fs "
2448 		    "%s: could not access %s: %s\n"), fstab->zone_fs_dir,
2449 		    fstab->zone_fs_special, strerror(errno));
2450 		return (Z_ERR);
2451 	}
2452 
2453 	if (strcmp(st.st_fstype, MNTTYPE_NFS) == 0) {
2454 		/*
2455 		 * TRANSLATION_NOTE
2456 		 * fs and NFS are literals that should
2457 		 * not be translated.
2458 		 */
2459 		(void) fprintf(stderr, gettext("cannot verify "
2460 		    "fs %s: NFS mounted file system.\n"
2461 		    "\tA local file system must be used.\n"),
2462 		    fstab->zone_fs_special);
2463 		return (Z_ERR);
2464 	}
2465 
2466 	return (Z_OK);
2467 }
2468 
2469 static int
2470 verify_filesystems(zone_dochandle_t handle)
2471 {
2472 	int return_code = Z_OK;
2473 	struct zone_fstab fstab;
2474 	char cmdbuf[MAXPATHLEN];
2475 	struct stat st;
2476 
2477 	/*
2478 	 * No need to verify inherit-pkg-dir fs types, as their type is
2479 	 * implicitly lofs, which is known.  Therefore, the types are only
2480 	 * verified for regular file systems below.
2481 	 *
2482 	 * Since the actual mount point is not known until the dependent mounts
2483 	 * are performed, we don't attempt any path validation here: that will
2484 	 * happen later when zoneadmd actually does the mounts.
2485 	 */
2486 	if (zonecfg_setfsent(handle) != Z_OK) {
2487 		(void) fprintf(stderr, gettext("could not verify file systems: "
2488 		    "unable to enumerate mounts\n"));
2489 		return (Z_ERR);
2490 	}
2491 	while (zonecfg_getfsent(handle, &fstab) == Z_OK) {
2492 		if (!zonecfg_valid_fs_type(fstab.zone_fs_type)) {
2493 			(void) fprintf(stderr, gettext("cannot verify fs %s: "
2494 			    "type %s is not allowed.\n"), fstab.zone_fs_dir,
2495 			    fstab.zone_fs_type);
2496 			return_code = Z_ERR;
2497 			goto next_fs;
2498 		}
2499 		/*
2500 		 * Verify /usr/lib/fs/<fstype>/mount exists.
2501 		 */
2502 		if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/mount",
2503 		    fstab.zone_fs_type) > sizeof (cmdbuf)) {
2504 			(void) fprintf(stderr, gettext("cannot verify fs %s: "
2505 			    "type %s is too long.\n"), fstab.zone_fs_dir,
2506 			    fstab.zone_fs_type);
2507 			return_code = Z_ERR;
2508 			goto next_fs;
2509 		}
2510 		if (stat(cmdbuf, &st) != 0) {
2511 			(void) fprintf(stderr, gettext("could not verify fs "
2512 			    "%s: could not access %s: %s\n"), fstab.zone_fs_dir,
2513 			    cmdbuf, strerror(errno));
2514 			return_code = Z_ERR;
2515 			goto next_fs;
2516 		}
2517 		if (!S_ISREG(st.st_mode)) {
2518 			(void) fprintf(stderr, gettext("could not verify fs "
2519 			    "%s: %s is not a regular file\n"),
2520 			    fstab.zone_fs_dir, cmdbuf);
2521 			return_code = Z_ERR;
2522 			goto next_fs;
2523 		}
2524 		/*
2525 		 * Verify /usr/lib/fs/<fstype>/fsck exists iff zone_fs_raw is
2526 		 * set.
2527 		 */
2528 		if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/fsck",
2529 		    fstab.zone_fs_type) > sizeof (cmdbuf)) {
2530 			(void) fprintf(stderr, gettext("cannot verify fs %s: "
2531 			    "type %s is too long.\n"), fstab.zone_fs_dir,
2532 			    fstab.zone_fs_type);
2533 			return_code = Z_ERR;
2534 			goto next_fs;
2535 		}
2536 		if (fstab.zone_fs_raw[0] == '\0' && stat(cmdbuf, &st) == 0) {
2537 			(void) fprintf(stderr, gettext("could not verify fs "
2538 			    "%s: must specify 'raw' device for %s "
2539 			    "file systems\n"),
2540 			    fstab.zone_fs_dir, fstab.zone_fs_type);
2541 			return_code = Z_ERR;
2542 			goto next_fs;
2543 		}
2544 		if (fstab.zone_fs_raw[0] != '\0' &&
2545 		    (stat(cmdbuf, &st) != 0 || !S_ISREG(st.st_mode))) {
2546 			(void) fprintf(stderr, gettext("cannot verify fs %s: "
2547 			    "'raw' device specified but "
2548 			    "no fsck executable exists for %s\n"),
2549 			    fstab.zone_fs_dir, fstab.zone_fs_type);
2550 			return_code = Z_ERR;
2551 			goto next_fs;
2552 		}
2553 
2554 		/* Verify fs_special. */
2555 		if ((return_code = verify_fs_special(&fstab)) != Z_OK)
2556 			goto next_fs;
2557 
2558 		/* Verify fs_raw. */
2559 		if (fstab.zone_fs_raw[0] != '\0' &&
2560 		    stat(fstab.zone_fs_raw, &st) != 0) {
2561 			/*
2562 			 * TRANSLATION_NOTE
2563 			 * fs is a literal that should not be translated.
2564 			 */
2565 			(void) fprintf(stderr, gettext("could not verify fs "
2566 			    "%s: could not access %s: %s\n"), fstab.zone_fs_dir,
2567 			    fstab.zone_fs_raw, strerror(errno));
2568 			return_code = Z_ERR;
2569 			goto next_fs;
2570 		}
2571 next_fs:
2572 		zonecfg_free_fs_option_list(fstab.zone_fs_options);
2573 	}
2574 	(void) zonecfg_endfsent(handle);
2575 
2576 	return (return_code);
2577 }
2578 
2579 static int
2580 verify_limitpriv(zone_dochandle_t handle)
2581 {
2582 	char *privname = NULL;
2583 	int err;
2584 	priv_set_t *privs;
2585 
2586 	if ((privs = priv_allocset()) == NULL) {
2587 		zperror(gettext("failed to allocate privilege set"), B_FALSE);
2588 		return (Z_NOMEM);
2589 	}
2590 	err = zonecfg_get_privset(handle, privs, &privname);
2591 	switch (err) {
2592 	case Z_OK:
2593 		break;
2594 	case Z_PRIV_PROHIBITED:
2595 		(void) fprintf(stderr, gettext("privilege \"%s\" is not "
2596 		    "permitted within the zone's privilege set\n"), privname);
2597 		break;
2598 	case Z_PRIV_REQUIRED:
2599 		(void) fprintf(stderr, gettext("required privilege \"%s\" is "
2600 		    "missing from the zone's privilege set\n"), privname);
2601 		break;
2602 	case Z_PRIV_UNKNOWN:
2603 		(void) fprintf(stderr, gettext("unknown privilege \"%s\" "
2604 		    "specified in the zone's privilege set\n"), privname);
2605 		break;
2606 	default:
2607 		zperror(
2608 		    gettext("failed to determine the zone's privilege set"),
2609 		    B_TRUE);
2610 		break;
2611 	}
2612 	free(privname);
2613 	priv_freeset(privs);
2614 	return (err);
2615 }
2616 
2617 static void
2618 free_local_netifs(int if_cnt, struct net_if **if_list)
2619 {
2620 	int		i;
2621 
2622 	for (i = 0; i < if_cnt; i++) {
2623 		free(if_list[i]->name);
2624 		free(if_list[i]);
2625 	}
2626 	free(if_list);
2627 }
2628 
2629 /*
2630  * Get a list of the network interfaces, along with their address families,
2631  * that are plumbed in the global zone.  See if_tcp(7p) for a description
2632  * of the ioctls used here.
2633  */
2634 static int
2635 get_local_netifs(int *if_cnt, struct net_if ***if_list)
2636 {
2637 	int		s;
2638 	int		i;
2639 	int		res = Z_OK;
2640 	int		space_needed;
2641 	int		cnt = 0;
2642 	struct		lifnum if_num;
2643 	struct		lifconf if_conf;
2644 	struct		lifreq *if_reqp;
2645 	char		*if_buf;
2646 	struct net_if	**local_ifs = NULL;
2647 
2648 	*if_cnt = 0;
2649 	*if_list = NULL;
2650 
2651 	if ((s = socket(SOCKET_AF(AF_INET), SOCK_DGRAM, 0)) < 0)
2652 		return (Z_ERR);
2653 
2654 	/*
2655 	 * Come back here in the unlikely event that the number of interfaces
2656 	 * increases between the time we get the count and the time we do the
2657 	 * SIOCGLIFCONF ioctl.
2658 	 */
2659 retry:
2660 	/* Get the number of interfaces. */
2661 	if_num.lifn_family = AF_UNSPEC;
2662 	if_num.lifn_flags = LIFC_NOXMIT;
2663 	if (ioctl(s, SIOCGLIFNUM, &if_num) < 0) {
2664 		(void) close(s);
2665 		return (Z_ERR);
2666 	}
2667 
2668 	/* Get the interface configuration list. */
2669 	space_needed = if_num.lifn_count * sizeof (struct lifreq);
2670 	if ((if_buf = malloc(space_needed)) == NULL) {
2671 		(void) close(s);
2672 		return (Z_ERR);
2673 	}
2674 	if_conf.lifc_family = AF_UNSPEC;
2675 	if_conf.lifc_flags = LIFC_NOXMIT;
2676 	if_conf.lifc_len = space_needed;
2677 	if_conf.lifc_buf = if_buf;
2678 	if (ioctl(s, SIOCGLIFCONF, &if_conf) < 0) {
2679 		free(if_buf);
2680 		/*
2681 		 * SIOCGLIFCONF returns EINVAL if the buffer we passed in is
2682 		 * too small.  In this case go back and get the new if cnt.
2683 		 */
2684 		if (errno == EINVAL)
2685 			goto retry;
2686 
2687 		(void) close(s);
2688 		return (Z_ERR);
2689 	}
2690 	(void) close(s);
2691 
2692 	/* Get the name and address family for each interface. */
2693 	if_reqp = if_conf.lifc_req;
2694 	for (i = 0; i < (if_conf.lifc_len / sizeof (struct lifreq)); i++) {
2695 		struct net_if	**p;
2696 		struct lifreq	req;
2697 
2698 		if (strcmp(LOOPBACK_IF, if_reqp->lifr_name) == 0) {
2699 			if_reqp++;
2700 			continue;
2701 		}
2702 
2703 		if ((s = socket(SOCKET_AF(if_reqp->lifr_addr.ss_family),
2704 		    SOCK_DGRAM, 0)) == -1) {
2705 			res = Z_ERR;
2706 			break;
2707 		}
2708 
2709 		(void) strncpy(req.lifr_name, if_reqp->lifr_name,
2710 		    sizeof (req.lifr_name));
2711 		if (ioctl(s, SIOCGLIFADDR, &req) < 0) {
2712 			(void) close(s);
2713 			if_reqp++;
2714 			continue;
2715 		}
2716 
2717 		if ((p = (struct net_if **)realloc(local_ifs,
2718 		    sizeof (struct net_if *) * (cnt + 1))) == NULL) {
2719 			res = Z_ERR;
2720 			break;
2721 		}
2722 		local_ifs = p;
2723 
2724 		if ((local_ifs[cnt] = malloc(sizeof (struct net_if))) == NULL) {
2725 			res = Z_ERR;
2726 			break;
2727 		}
2728 
2729 		if ((local_ifs[cnt]->name = strdup(if_reqp->lifr_name))
2730 		    == NULL) {
2731 			free(local_ifs[cnt]);
2732 			res = Z_ERR;
2733 			break;
2734 		}
2735 		local_ifs[cnt]->af = req.lifr_addr.ss_family;
2736 		cnt++;
2737 
2738 		(void) close(s);
2739 		if_reqp++;
2740 	}
2741 
2742 	free(if_buf);
2743 
2744 	if (res != Z_OK) {
2745 		free_local_netifs(cnt, local_ifs);
2746 	} else {
2747 		*if_cnt = cnt;
2748 		*if_list = local_ifs;
2749 	}
2750 
2751 	return (res);
2752 }
2753 
2754 static char *
2755 af2str(int af)
2756 {
2757 	switch (af) {
2758 	case AF_INET:
2759 		return ("IPv4");
2760 	case AF_INET6:
2761 		return ("IPv6");
2762 	default:
2763 		return ("Unknown");
2764 	}
2765 }
2766 
2767 /*
2768  * Cross check the network interface name and address family with the
2769  * interfaces that are set up in the global zone so that we can print the
2770  * appropriate error message.
2771  */
2772 static void
2773 print_net_err(char *phys, char *addr, int af, char *msg)
2774 {
2775 	int		i;
2776 	int		local_if_cnt = 0;
2777 	struct net_if	**local_ifs = NULL;
2778 	boolean_t	found_if = B_FALSE;
2779 	boolean_t	found_af = B_FALSE;
2780 
2781 	if (get_local_netifs(&local_if_cnt, &local_ifs) != Z_OK) {
2782 		(void) fprintf(stderr,
2783 		    gettext("could not verify %s %s=%s %s=%s\n\t%s\n"),
2784 		    "net", "address", addr, "physical", phys, msg);
2785 		return;
2786 	}
2787 
2788 	for (i = 0; i < local_if_cnt; i++) {
2789 		if (strcmp(phys, local_ifs[i]->name) == 0) {
2790 			found_if = B_TRUE;
2791 			if (af == local_ifs[i]->af) {
2792 				found_af = B_TRUE;
2793 				break;
2794 			}
2795 		}
2796 	}
2797 
2798 	free_local_netifs(local_if_cnt, local_ifs);
2799 
2800 	if (!found_if) {
2801 		(void) fprintf(stderr,
2802 		    gettext("could not verify %s %s=%s\n\t"
2803 		    "network interface %s is not plumbed in the global zone\n"),
2804 		    "net", "physical", phys, phys);
2805 		return;
2806 	}
2807 
2808 	/*
2809 	 * Print this error if we were unable to find the address family
2810 	 * for this interface.  If the af variable is not initialized to
2811 	 * to something meaningful by the caller (not AF_UNSPEC) then we
2812 	 * also skip this message since it wouldn't be informative.
2813 	 */
2814 	if (!found_af && af != AF_UNSPEC) {
2815 		(void) fprintf(stderr,
2816 		    gettext("could not verify %s %s=%s %s=%s\n\tthe %s address "
2817 		    "family is not configured on this network interface in "
2818 		    "the\n\tglobal zone\n"),
2819 		    "net", "address", addr, "physical", phys, af2str(af));
2820 		return;
2821 	}
2822 
2823 	(void) fprintf(stderr,
2824 	    gettext("could not verify %s %s=%s %s=%s\n\t%s\n"),
2825 	    "net", "address", addr, "physical", phys, msg);
2826 }
2827 
2828 static int
2829 verify_handle(int cmd_num, zone_dochandle_t handle, char *argv[])
2830 {
2831 	struct zone_nwiftab nwiftab;
2832 	int return_code = Z_OK;
2833 	int err;
2834 	boolean_t in_alt_root;
2835 	zone_iptype_t iptype;
2836 	int fd;
2837 
2838 	in_alt_root = zonecfg_in_alt_root();
2839 	if (in_alt_root)
2840 		goto no_net;
2841 
2842 	if ((err = zonecfg_get_iptype(handle, &iptype)) != Z_OK) {
2843 		errno = err;
2844 		zperror(cmd_to_str(cmd_num), B_TRUE);
2845 		zonecfg_fini_handle(handle);
2846 		return (Z_ERR);
2847 	}
2848 	if ((err = zonecfg_setnwifent(handle)) != Z_OK) {
2849 		errno = err;
2850 		zperror(cmd_to_str(cmd_num), B_TRUE);
2851 		zonecfg_fini_handle(handle);
2852 		return (Z_ERR);
2853 	}
2854 	while (zonecfg_getnwifent(handle, &nwiftab) == Z_OK) {
2855 		struct lifreq lifr;
2856 		sa_family_t af = AF_UNSPEC;
2857 		char dl_owner_zname[ZONENAME_MAX];
2858 		zoneid_t dl_owner_zid;
2859 		zoneid_t target_zid;
2860 		int res;
2861 
2862 		/* skip any loopback interfaces */
2863 		if (strcmp(nwiftab.zone_nwif_physical, "lo0") == 0)
2864 			continue;
2865 		switch (iptype) {
2866 		case ZS_SHARED:
2867 			if ((res = zonecfg_valid_net_address(
2868 			    nwiftab.zone_nwif_address, &lifr)) != Z_OK) {
2869 				print_net_err(nwiftab.zone_nwif_physical,
2870 				    nwiftab.zone_nwif_address, af,
2871 				    zonecfg_strerror(res));
2872 			    return_code = Z_ERR;
2873 			    continue;
2874 			}
2875 			af = lifr.lifr_addr.ss_family;
2876 			if (!zonecfg_ifname_exists(af,
2877 			    nwiftab.zone_nwif_physical)) {
2878 				/*
2879 				 * The interface failed to come up. We continue
2880 				 * on anyway for the sake of consistency: a
2881 				 * zone is not shut down if the interface fails
2882 				 * any time after boot, nor does the global zone
2883 				 * fail to boot if an interface fails.
2884 				 */
2885 				(void) fprintf(stderr,
2886 				    gettext("WARNING: skipping network "
2887 					"interface '%s' which may not be "
2888 					"present/plumbed in the global "
2889 					"zone.\n"),
2890 				    nwiftab.zone_nwif_physical);
2891 			}
2892 			break;
2893 		case ZS_EXCLUSIVE:
2894 			/* Warning if it exists for either IPv4 or IPv6 */
2895 
2896 			if (zonecfg_ifname_exists(AF_INET,
2897 			    nwiftab.zone_nwif_physical) ||
2898 			    zonecfg_ifname_exists(AF_INET6,
2899 			    nwiftab.zone_nwif_physical)) {
2900 				(void) fprintf(stderr,
2901 				    gettext("WARNING: skipping network "
2902 				    "interface '%s' which is used in the "
2903 				    "global zone.\n"),
2904 				    nwiftab.zone_nwif_physical);
2905 				break;
2906 			}
2907 			/*
2908 			 * Verify that the physical interface can
2909 			 * be opened
2910 			 */
2911 			fd = ifname_open(nwiftab.zone_nwif_physical);
2912 			if (fd == -1) {
2913 				(void) fprintf(stderr,
2914 				    gettext("WARNING: skipping network "
2915 				    "interface '%s' which cannot be opened.\n"),
2916 				    nwiftab.zone_nwif_physical);
2917 				break;
2918 			} else {
2919 				(void) close(fd);
2920 			}
2921 			/*
2922 			 * Verify whether the physical interface is already
2923 			 * used by a zone.
2924 			 */
2925 			dl_owner_zid = ALL_ZONES;
2926 			if (zone_check_datalink(&dl_owner_zid,
2927 			    nwiftab.zone_nwif_physical) != 0)
2928 				break;
2929 
2930 			/*
2931 			 * If the zone being verified is
2932 			 * running and owns the interface
2933 			 */
2934 			target_zid = getzoneidbyname(target_zone);
2935 			if (target_zid == dl_owner_zid)
2936 				break;
2937 
2938 			/* Zone id match failed, use name to check */
2939 			if (getzonenamebyid(dl_owner_zid, dl_owner_zname,
2940 			    ZONENAME_MAX) < 0) {
2941 				/* No name, show ID instead */
2942 				(void) snprintf(dl_owner_zname, ZONENAME_MAX,
2943 				    "<%d>", dl_owner_zid);
2944 			} else if (strcmp(dl_owner_zname, target_zone) == 0)
2945 				break;
2946 
2947 			/*
2948 			 * Note here we only report a warning that
2949 			 * the interface is already in use by another
2950 			 * running zone, and the verify process just
2951 			 * goes on, if the interface is still in use
2952 			 * when this zone really boots up, zoneadmd
2953 			 * will find it. If the name of the zone which
2954 			 * owns this interface cannot be determined,
2955 			 * then it is not possible to determine if there
2956 			 * is a conflict so just report it as a warning.
2957 			 */
2958 			(void) fprintf(stderr,
2959 			    gettext("WARNING: skipping network interface "
2960 			    "'%s' which is used by the non-global zone "
2961 			    "'%s'.\n"), nwiftab.zone_nwif_physical,
2962 			    dl_owner_zname);
2963 			break;
2964 		}
2965 	}
2966 	(void) zonecfg_endnwifent(handle);
2967 no_net:
2968 
2969 	/* verify that lofs has not been excluded from the kernel */
2970 	if (!(cmd_num == CMD_DETACH || cmd_num == CMD_ATTACH ||
2971 	    cmd_num == CMD_MOVE || cmd_num == CMD_CLONE) &&
2972 	    modctl(MODLOAD, 1, "fs/lofs", NULL) != 0) {
2973 		if (errno == ENXIO)
2974 			(void) fprintf(stderr, gettext("could not verify "
2975 			    "lofs(7FS): possibly excluded in /etc/system\n"));
2976 		else
2977 			(void) fprintf(stderr, gettext("could not verify "
2978 			    "lofs(7FS): %s\n"), strerror(errno));
2979 		return_code = Z_ERR;
2980 	}
2981 
2982 	if (verify_filesystems(handle) != Z_OK)
2983 		return_code = Z_ERR;
2984 	if (verify_ipd(handle) != Z_OK)
2985 		return_code = Z_ERR;
2986 	if (!in_alt_root && verify_rctls(handle) != Z_OK)
2987 		return_code = Z_ERR;
2988 	if (!in_alt_root && verify_pool(handle) != Z_OK)
2989 		return_code = Z_ERR;
2990 	if (!in_alt_root && verify_brand(handle, cmd_num, argv) != Z_OK)
2991 		return_code = Z_ERR;
2992 	if (!in_alt_root && verify_datasets(handle) != Z_OK)
2993 		return_code = Z_ERR;
2994 
2995 	/*
2996 	 * As the "mount" command is used for patching/upgrading of zones
2997 	 * or other maintenance processes, the zone's privilege set is not
2998 	 * checked in this case.  Instead, the default, safe set of
2999 	 * privileges will be used when this zone is created in the
3000 	 * kernel.
3001 	 */
3002 	if (!in_alt_root && cmd_num != CMD_MOUNT &&
3003 	    verify_limitpriv(handle) != Z_OK)
3004 		return_code = Z_ERR;
3005 
3006 	return (return_code);
3007 }
3008 
3009 static int
3010 verify_details(int cmd_num, char *argv[])
3011 {
3012 	zone_dochandle_t handle;
3013 	char zonepath[MAXPATHLEN], checkpath[MAXPATHLEN];
3014 	int return_code = Z_OK;
3015 	int err;
3016 
3017 	if ((handle = zonecfg_init_handle()) == NULL) {
3018 		zperror(cmd_to_str(cmd_num), B_TRUE);
3019 		return (Z_ERR);
3020 	}
3021 	if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) {
3022 		errno = err;
3023 		zperror(cmd_to_str(cmd_num), B_TRUE);
3024 		zonecfg_fini_handle(handle);
3025 		return (Z_ERR);
3026 	}
3027 	if ((err = zonecfg_get_zonepath(handle, zonepath, sizeof (zonepath))) !=
3028 	    Z_OK) {
3029 		errno = err;
3030 		zperror(cmd_to_str(cmd_num), B_TRUE);
3031 		zonecfg_fini_handle(handle);
3032 		return (Z_ERR);
3033 	}
3034 	/*
3035 	 * zonecfg_get_zonepath() gets its data from the XML repository.
3036 	 * Verify this against the index file, which is checked first by
3037 	 * zone_get_zonepath().  If they don't match, bail out.
3038 	 */
3039 	if ((err = zone_get_zonepath(target_zone, checkpath,
3040 	    sizeof (checkpath))) != Z_OK) {
3041 		errno = err;
3042 		zperror2(target_zone, gettext("could not get zone path"));
3043 		zonecfg_fini_handle(handle);
3044 		return (Z_ERR);
3045 	}
3046 	if (strcmp(zonepath, checkpath) != 0) {
3047 		/*
3048 		 * TRANSLATION_NOTE
3049 		 * XML and zonepath are literals that should not be translated.
3050 		 */
3051 		(void) fprintf(stderr, gettext("The XML repository has "
3052 		    "zonepath '%s',\nbut the index file has zonepath '%s'.\n"
3053 		    "These must match, so fix the incorrect entry.\n"),
3054 		    zonepath, checkpath);
3055 		zonecfg_fini_handle(handle);
3056 		return (Z_ERR);
3057 	}
3058 	if (validate_zonepath(zonepath, cmd_num) != Z_OK) {
3059 		(void) fprintf(stderr, gettext("could not verify zonepath %s "
3060 		    "because of the above errors.\n"), zonepath);
3061 		return_code = Z_ERR;
3062 	}
3063 
3064 	if (verify_handle(cmd_num, handle, argv) != Z_OK)
3065 		return_code = Z_ERR;
3066 
3067 	zonecfg_fini_handle(handle);
3068 	if (return_code == Z_ERR)
3069 		(void) fprintf(stderr,
3070 		    gettext("%s: zone %s failed to verify\n"),
3071 		    execname, target_zone);
3072 	return (return_code);
3073 }
3074 
3075 static int
3076 verify_func(int argc, char *argv[])
3077 {
3078 	int arg;
3079 
3080 	optind = 0;
3081 	if ((arg = getopt(argc, argv, "?")) != EOF) {
3082 		switch (arg) {
3083 		case '?':
3084 			sub_usage(SHELP_VERIFY, CMD_VERIFY);
3085 			return (optopt == '?' ? Z_OK : Z_USAGE);
3086 		default:
3087 			sub_usage(SHELP_VERIFY, CMD_VERIFY);
3088 			return (Z_USAGE);
3089 		}
3090 	}
3091 	if (argc > optind) {
3092 		sub_usage(SHELP_VERIFY, CMD_VERIFY);
3093 		return (Z_USAGE);
3094 	}
3095 	if (sanity_check(target_zone, CMD_VERIFY, B_FALSE, B_FALSE, B_FALSE)
3096 	    != Z_OK)
3097 		return (Z_ERR);
3098 	return (verify_details(CMD_VERIFY, argv));
3099 }
3100 
3101 static int
3102 addopt(char *buf, int opt, char *optarg, size_t bufsize)
3103 {
3104 	char optstring[4];
3105 
3106 	if (opt > 0)
3107 		(void) sprintf(optstring, " -%c", opt);
3108 	else
3109 		(void) strcpy(optstring, " ");
3110 
3111 	if ((strlcat(buf, optstring, bufsize) > bufsize))
3112 		return (Z_ERR);
3113 	if ((optarg != NULL) && (strlcat(buf, optarg, bufsize) > bufsize))
3114 		return (Z_ERR);
3115 	return (Z_OK);
3116 }
3117 
3118 static int
3119 install_func(int argc, char *argv[])
3120 {
3121 	char cmdbuf[MAXPATHLEN];
3122 	int lockfd;
3123 	int arg, err, subproc_err;
3124 	char zonepath[MAXPATHLEN];
3125 	brand_handle_t bh = NULL;
3126 	int status;
3127 	boolean_t nodataset = B_FALSE;
3128 	char opts[128];
3129 
3130 	if (target_zone == NULL) {
3131 		sub_usage(SHELP_INSTALL, CMD_INSTALL);
3132 		return (Z_USAGE);
3133 	}
3134 
3135 	if (zonecfg_in_alt_root()) {
3136 		zerror(gettext("cannot install zone in alternate root"));
3137 		return (Z_ERR);
3138 	}
3139 
3140 	if ((err = zone_get_zonepath(target_zone, zonepath,
3141 	    sizeof (zonepath))) != Z_OK) {
3142 		errno = err;
3143 		zperror2(target_zone, gettext("could not get zone path"));
3144 		return (Z_ERR);
3145 	}
3146 
3147 	/* Fetch the install command from the brand configuration.  */
3148 	if ((bh = brand_open(target_brand)) == NULL) {
3149 		zerror(gettext("missing or invalid brand"));
3150 		return (Z_ERR);
3151 	}
3152 
3153 	(void) strcpy(cmdbuf, EXEC_PREFIX);
3154 	if (brand_get_install(bh, target_zone, zonepath, cmdbuf + EXEC_LEN,
3155 	    sizeof (cmdbuf) - EXEC_LEN, 0, NULL) != 0) {
3156 		zerror("invalid brand configuration: missing install resource");
3157 		brand_close(bh);
3158 		return (Z_ERR);
3159 	}
3160 
3161 	(void) strcpy(opts, "?x:");
3162 	if (!is_native_zone) {
3163 		/*
3164 		 * Fetch the list of recognized command-line options from
3165 		 * the brand configuration file.
3166 		 */
3167 		if (brand_get_installopts(bh, opts + strlen(opts),
3168 		    sizeof (opts) - strlen(opts)) != 0) {
3169 			zerror("invalid brand configuration: missing "
3170 			    "install options resource");
3171 			brand_close(bh);
3172 			return (Z_ERR);
3173 		}
3174 	}
3175 	brand_close(bh);
3176 
3177 	optind = 0;
3178 	while ((arg = getopt(argc, argv, opts)) != EOF) {
3179 		switch (arg) {
3180 		case '?':
3181 			sub_usage(SHELP_INSTALL, CMD_INSTALL);
3182 			return (optopt == '?' ? Z_OK : Z_USAGE);
3183 		case 'x':
3184 			if (strcmp(optarg, "nodataset") != 0) {
3185 				sub_usage(SHELP_INSTALL, CMD_INSTALL);
3186 				return (Z_USAGE);
3187 			}
3188 			nodataset = B_TRUE;
3189 			break;
3190 		default:
3191 			if (is_native_zone) {
3192 				sub_usage(SHELP_INSTALL, CMD_INSTALL);
3193 				return (Z_USAGE);
3194 			}
3195 
3196 			/*
3197 			 * This option isn't for zoneadm, so append it to
3198 			 * the command line passed to the brand-specific
3199 			 * install routine.
3200 			 */
3201 			if (addopt(cmdbuf, optopt, optarg,
3202 			    sizeof (cmdbuf)) != Z_OK) {
3203 				zerror("Install command line too long");
3204 				return (Z_ERR);
3205 			}
3206 			break;
3207 		}
3208 	}
3209 
3210 	if (!is_native_zone) {
3211 		for (; optind < argc; optind++) {
3212 			if (addopt(cmdbuf, 0, argv[optind],
3213 			    sizeof (cmdbuf)) != Z_OK) {
3214 				zerror("Install command line too long");
3215 				return (Z_ERR);
3216 			}
3217 		}
3218 	}
3219 
3220 	if (sanity_check(target_zone, CMD_INSTALL, B_FALSE, B_TRUE, B_FALSE)
3221 	    != Z_OK)
3222 		return (Z_ERR);
3223 	if (verify_details(CMD_INSTALL, argv) != Z_OK)
3224 		return (Z_ERR);
3225 
3226 	if (grab_lock_file(target_zone, &lockfd) != Z_OK) {
3227 		zerror(gettext("another %s may have an operation in progress."),
3228 		    "zoneadm");
3229 		return (Z_ERR);
3230 	}
3231 	err = zone_set_state(target_zone, ZONE_STATE_INCOMPLETE);
3232 	if (err != Z_OK) {
3233 		errno = err;
3234 		zperror2(target_zone, gettext("could not set state"));
3235 		goto done;
3236 	}
3237 
3238 	if (!nodataset)
3239 		create_zfs_zonepath(zonepath);
3240 
3241 	/*
3242 	 * According to the Application Packaging Developer's Guide, a
3243 	 * "checkinstall" script when included in a package is executed as
3244 	 * the user "install", if such a user exists, or by the user
3245 	 * "nobody".  In order to support this dubious behavior, the path
3246 	 * to the zone being constructed is opened up during the life of
3247 	 * the command laying down the zone's root file system.  Once this
3248 	 * has completed, regardless of whether it was successful, the
3249 	 * path to the zone is again restricted.
3250 	 */
3251 	if (chmod(zonepath, DEFAULT_DIR_MODE) != 0) {
3252 		zperror(zonepath, B_FALSE);
3253 		err = Z_ERR;
3254 		goto done;
3255 	}
3256 
3257 	if (is_native_zone)
3258 		status = do_subproc(cmdbuf);
3259 	else
3260 		status = do_subproc_interactive(cmdbuf);
3261 
3262 	if (chmod(zonepath, S_IRWXU) != 0) {
3263 		zperror(zonepath, B_FALSE);
3264 		err = Z_ERR;
3265 		goto done;
3266 	}
3267 	if ((subproc_err =
3268 	    subproc_status(gettext("brand-specific installation"), status,
3269 	    B_FALSE)) != ZONE_SUBPROC_OK) {
3270 		err = Z_ERR;
3271 		goto done;
3272 	}
3273 
3274 	if ((err = zone_set_state(target_zone, ZONE_STATE_INSTALLED)) != Z_OK) {
3275 		errno = err;
3276 		zperror2(target_zone, gettext("could not set state"));
3277 		goto done;
3278 	}
3279 
3280 done:
3281 	/*
3282 	 * If the install script exited with ZONE_SUBPROC_USAGE or
3283 	 * ZONE_SUBPROC_NOTCOMPLETE, try to clean up the zone and leave the
3284 	 * zone in the CONFIGURED state so that another install can be
3285 	 * attempted without requiring an uninstall first.
3286 	 */
3287 	if ((subproc_err == ZONE_SUBPROC_USAGE) ||
3288 	    (subproc_err == ZONE_SUBPROC_NOTCOMPLETE)) {
3289 		if ((err = cleanup_zonepath(zonepath, B_FALSE)) != Z_OK) {
3290 			errno = err;
3291 			zperror2(target_zone,
3292 			    gettext("cleaning up zonepath failed"));
3293 		} else if ((err = zone_set_state(target_zone,
3294 		    ZONE_STATE_CONFIGURED)) != Z_OK) {
3295 			errno = err;
3296 			zperror2(target_zone, gettext("could not set state"));
3297 		}
3298 	}
3299 
3300 	release_lock_file(lockfd);
3301 	return ((err == Z_OK) ? Z_OK : Z_ERR);
3302 }
3303 
3304 /*
3305  * Check that the inherited pkg dirs are the same for the clone and its source.
3306  * The easiest way to do that is check that the list of ipds is the same
3307  * by matching each one against the other.  This algorithm should be fine since
3308  * the list of ipds should not be that long.
3309  */
3310 static int
3311 valid_ipd_clone(zone_dochandle_t s_handle, char *source_zone,
3312 	zone_dochandle_t t_handle, char *target_zone)
3313 {
3314 	int err;
3315 	int res = Z_OK;
3316 	int s_cnt = 0;
3317 	int t_cnt = 0;
3318 	struct zone_fstab s_fstab;
3319 	struct zone_fstab t_fstab;
3320 
3321 	/*
3322 	 * First check the source of the clone against the target.
3323 	 */
3324 	if ((err = zonecfg_setipdent(s_handle)) != Z_OK) {
3325 		errno = err;
3326 		zperror2(source_zone, gettext("could not enumerate "
3327 		    "inherit-pkg-dirs"));
3328 		return (Z_ERR);
3329 	}
3330 
3331 	while (zonecfg_getipdent(s_handle, &s_fstab) == Z_OK) {
3332 		boolean_t match = B_FALSE;
3333 
3334 		s_cnt++;
3335 
3336 		if ((err = zonecfg_setipdent(t_handle)) != Z_OK) {
3337 			errno = err;
3338 			zperror2(target_zone, gettext("could not enumerate "
3339 			    "inherit-pkg-dirs"));
3340 			(void) zonecfg_endipdent(s_handle);
3341 			return (Z_ERR);
3342 		}
3343 
3344 		while (zonecfg_getipdent(t_handle, &t_fstab) == Z_OK) {
3345 			if (strcmp(s_fstab.zone_fs_dir, t_fstab.zone_fs_dir)
3346 			    == 0) {
3347 				match = B_TRUE;
3348 				break;
3349 			}
3350 		}
3351 		(void) zonecfg_endipdent(t_handle);
3352 
3353 		if (!match) {
3354 			(void) fprintf(stderr, gettext("inherit-pkg-dir "
3355 			    "'%s' is not configured in zone %s.\n"),
3356 			    s_fstab.zone_fs_dir, target_zone);
3357 			res = Z_ERR;
3358 		}
3359 	}
3360 
3361 	(void) zonecfg_endipdent(s_handle);
3362 
3363 	/* skip the next check if we already have errors */
3364 	if (res == Z_ERR)
3365 		return (res);
3366 
3367 	/*
3368 	 * Now check the number of ipds in the target so we can verify
3369 	 * that the source is not a subset of the target.
3370 	 */
3371 	if ((err = zonecfg_setipdent(t_handle)) != Z_OK) {
3372 		errno = err;
3373 		zperror2(target_zone, gettext("could not enumerate "
3374 		    "inherit-pkg-dirs"));
3375 		return (Z_ERR);
3376 	}
3377 
3378 	while (zonecfg_getipdent(t_handle, &t_fstab) == Z_OK)
3379 		t_cnt++;
3380 
3381 	(void) zonecfg_endipdent(t_handle);
3382 
3383 	if (t_cnt != s_cnt) {
3384 		(void) fprintf(stderr, gettext("Zone %s is configured "
3385 		    "with inherit-pkg-dirs that are not configured in zone "
3386 		    "%s.\n"), target_zone, source_zone);
3387 		res = Z_ERR;
3388 	}
3389 
3390 	return (res);
3391 }
3392 
3393 static void
3394 warn_dev_match(zone_dochandle_t s_handle, char *source_zone,
3395 	zone_dochandle_t t_handle, char *target_zone)
3396 {
3397 	int err;
3398 	struct zone_devtab s_devtab;
3399 	struct zone_devtab t_devtab;
3400 
3401 	if ((err = zonecfg_setdevent(t_handle)) != Z_OK) {
3402 		errno = err;
3403 		zperror2(target_zone, gettext("could not enumerate devices"));
3404 		return;
3405 	}
3406 
3407 	while (zonecfg_getdevent(t_handle, &t_devtab) == Z_OK) {
3408 		if ((err = zonecfg_setdevent(s_handle)) != Z_OK) {
3409 			errno = err;
3410 			zperror2(source_zone,
3411 			    gettext("could not enumerate devices"));
3412 			(void) zonecfg_enddevent(t_handle);
3413 			return;
3414 		}
3415 
3416 		while (zonecfg_getdevent(s_handle, &s_devtab) == Z_OK) {
3417 			/*
3418 			 * Use fnmatch to catch the case where wildcards
3419 			 * were used in one zone and the other has an
3420 			 * explicit entry (e.g. /dev/dsk/c0t0d0s6 vs.
3421 			 * /dev/\*dsk/c0t0d0s6).
3422 			 */
3423 			if (fnmatch(t_devtab.zone_dev_match,
3424 			    s_devtab.zone_dev_match, FNM_PATHNAME) == 0 ||
3425 			    fnmatch(s_devtab.zone_dev_match,
3426 			    t_devtab.zone_dev_match, FNM_PATHNAME) == 0) {
3427 				(void) fprintf(stderr,
3428 				    gettext("WARNING: device '%s' "
3429 				    "is configured in both zones.\n"),
3430 				    t_devtab.zone_dev_match);
3431 				break;
3432 			}
3433 		}
3434 		(void) zonecfg_enddevent(s_handle);
3435 	}
3436 
3437 	(void) zonecfg_enddevent(t_handle);
3438 }
3439 
3440 /*
3441  * Check if the specified mount option (opt) is contained within the
3442  * options string.
3443  */
3444 static boolean_t
3445 opt_match(char *opt, char *options)
3446 {
3447 	char *p;
3448 	char *lastp;
3449 
3450 	if ((p = strtok_r(options, ",", &lastp)) != NULL) {
3451 		if (strcmp(p, opt) == 0)
3452 			return (B_TRUE);
3453 		while ((p = strtok_r(NULL, ",", &lastp)) != NULL) {
3454 			if (strcmp(p, opt) == 0)
3455 				return (B_TRUE);
3456 		}
3457 	}
3458 
3459 	return (B_FALSE);
3460 }
3461 
3462 #define	RW_LOFS	"WARNING: read-write lofs file system on '%s' is configured " \
3463 	"in both zones.\n"
3464 
3465 static void
3466 print_fs_warnings(struct zone_fstab *s_fstab, struct zone_fstab *t_fstab)
3467 {
3468 	/*
3469 	 * It is ok to have shared lofs mounted fs but we want to warn if
3470 	 * either is rw since this will effect the other zone.
3471 	 */
3472 	if (strcmp(t_fstab->zone_fs_type, "lofs") == 0) {
3473 		zone_fsopt_t *optp;
3474 
3475 		/* The default is rw so no options means rw */
3476 		if (t_fstab->zone_fs_options == NULL ||
3477 		    s_fstab->zone_fs_options == NULL) {
3478 			(void) fprintf(stderr, gettext(RW_LOFS),
3479 			    t_fstab->zone_fs_special);
3480 			return;
3481 		}
3482 
3483 		for (optp = s_fstab->zone_fs_options; optp != NULL;
3484 		    optp = optp->zone_fsopt_next) {
3485 			if (opt_match("rw", optp->zone_fsopt_opt)) {
3486 				(void) fprintf(stderr, gettext(RW_LOFS),
3487 				    s_fstab->zone_fs_special);
3488 				return;
3489 			}
3490 		}
3491 
3492 		for (optp = t_fstab->zone_fs_options; optp != NULL;
3493 		    optp = optp->zone_fsopt_next) {
3494 			if (opt_match("rw", optp->zone_fsopt_opt)) {
3495 				(void) fprintf(stderr, gettext(RW_LOFS),
3496 				    t_fstab->zone_fs_special);
3497 				return;
3498 			}
3499 		}
3500 
3501 		return;
3502 	}
3503 
3504 	/*
3505 	 * TRANSLATION_NOTE
3506 	 * The first variable is the file system type and the second is
3507 	 * the file system special device.  For example,
3508 	 * WARNING: ufs file system on '/dev/dsk/c0t0d0s0' ...
3509 	 */
3510 	(void) fprintf(stderr, gettext("WARNING: %s file system on '%s' "
3511 	    "is configured in both zones.\n"), t_fstab->zone_fs_type,
3512 	    t_fstab->zone_fs_special);
3513 }
3514 
3515 static void
3516 warn_fs_match(zone_dochandle_t s_handle, char *source_zone,
3517 	zone_dochandle_t t_handle, char *target_zone)
3518 {
3519 	int err;
3520 	struct zone_fstab s_fstab;
3521 	struct zone_fstab t_fstab;
3522 
3523 	if ((err = zonecfg_setfsent(t_handle)) != Z_OK) {
3524 		errno = err;
3525 		zperror2(target_zone,
3526 		    gettext("could not enumerate file systems"));
3527 		return;
3528 	}
3529 
3530 	while (zonecfg_getfsent(t_handle, &t_fstab) == Z_OK) {
3531 		if ((err = zonecfg_setfsent(s_handle)) != Z_OK) {
3532 			errno = err;
3533 			zperror2(source_zone,
3534 			    gettext("could not enumerate file systems"));
3535 			(void) zonecfg_endfsent(t_handle);
3536 			return;
3537 		}
3538 
3539 		while (zonecfg_getfsent(s_handle, &s_fstab) == Z_OK) {
3540 			if (strcmp(t_fstab.zone_fs_special,
3541 			    s_fstab.zone_fs_special) == 0) {
3542 				print_fs_warnings(&s_fstab, &t_fstab);
3543 				break;
3544 			}
3545 		}
3546 		(void) zonecfg_endfsent(s_handle);
3547 	}
3548 
3549 	(void) zonecfg_endfsent(t_handle);
3550 }
3551 
3552 /*
3553  * We don't catch the case where you used the same IP address but
3554  * it is not an exact string match.  For example, 192.9.0.128 vs. 192.09.0.128.
3555  * However, we're not going to worry about that but we will check for
3556  * a possible netmask on one of the addresses (e.g. 10.0.0.1 and 10.0.0.1/24)
3557  * and handle that case as a match.
3558  */
3559 static void
3560 warn_ip_match(zone_dochandle_t s_handle, char *source_zone,
3561 	zone_dochandle_t t_handle, char *target_zone)
3562 {
3563 	int err;
3564 	struct zone_nwiftab s_nwiftab;
3565 	struct zone_nwiftab t_nwiftab;
3566 
3567 	if ((err = zonecfg_setnwifent(t_handle)) != Z_OK) {
3568 		errno = err;
3569 		zperror2(target_zone,
3570 		    gettext("could not enumerate network interfaces"));
3571 		return;
3572 	}
3573 
3574 	while (zonecfg_getnwifent(t_handle, &t_nwiftab) == Z_OK) {
3575 		char *p;
3576 
3577 		/* remove an (optional) netmask from the address */
3578 		if ((p = strchr(t_nwiftab.zone_nwif_address, '/')) != NULL)
3579 			*p = '\0';
3580 
3581 		if ((err = zonecfg_setnwifent(s_handle)) != Z_OK) {
3582 			errno = err;
3583 			zperror2(source_zone,
3584 			    gettext("could not enumerate network interfaces"));
3585 			(void) zonecfg_endnwifent(t_handle);
3586 			return;
3587 		}
3588 
3589 		while (zonecfg_getnwifent(s_handle, &s_nwiftab) == Z_OK) {
3590 			/* remove an (optional) netmask from the address */
3591 			if ((p = strchr(s_nwiftab.zone_nwif_address, '/'))
3592 			    != NULL)
3593 				*p = '\0';
3594 
3595 			/* For exclusive-IP zones, address is not specified. */
3596 			if (strlen(s_nwiftab.zone_nwif_address) == 0)
3597 				continue;
3598 
3599 			if (strcmp(t_nwiftab.zone_nwif_address,
3600 			    s_nwiftab.zone_nwif_address) == 0) {
3601 				(void) fprintf(stderr,
3602 				    gettext("WARNING: network address '%s' "
3603 				    "is configured in both zones.\n"),
3604 				    t_nwiftab.zone_nwif_address);
3605 				break;
3606 			}
3607 		}
3608 		(void) zonecfg_endnwifent(s_handle);
3609 	}
3610 
3611 	(void) zonecfg_endnwifent(t_handle);
3612 }
3613 
3614 static void
3615 warn_dataset_match(zone_dochandle_t s_handle, char *source,
3616 	zone_dochandle_t t_handle, char *target)
3617 {
3618 	int err;
3619 	struct zone_dstab s_dstab;
3620 	struct zone_dstab t_dstab;
3621 
3622 	if ((err = zonecfg_setdsent(t_handle)) != Z_OK) {
3623 		errno = err;
3624 		zperror2(target, gettext("could not enumerate datasets"));
3625 		return;
3626 	}
3627 
3628 	while (zonecfg_getdsent(t_handle, &t_dstab) == Z_OK) {
3629 		if ((err = zonecfg_setdsent(s_handle)) != Z_OK) {
3630 			errno = err;
3631 			zperror2(source,
3632 			    gettext("could not enumerate datasets"));
3633 			(void) zonecfg_enddsent(t_handle);
3634 			return;
3635 		}
3636 
3637 		while (zonecfg_getdsent(s_handle, &s_dstab) == Z_OK) {
3638 			if (strcmp(t_dstab.zone_dataset_name,
3639 			    s_dstab.zone_dataset_name) == 0) {
3640 				target_zone = source;
3641 				zerror(gettext("WARNING: dataset '%s' "
3642 				    "is configured in both zones.\n"),
3643 				    t_dstab.zone_dataset_name);
3644 				break;
3645 			}
3646 		}
3647 		(void) zonecfg_enddsent(s_handle);
3648 	}
3649 
3650 	(void) zonecfg_enddsent(t_handle);
3651 }
3652 
3653 /*
3654  * Check that the clone and its source have the same brand type.
3655  */
3656 static int
3657 valid_brand_clone(char *source_zone, char *target_zone)
3658 {
3659 	brand_handle_t bh;
3660 	char source_brand[MAXNAMELEN];
3661 
3662 	if ((zone_get_brand(source_zone, source_brand,
3663 	    sizeof (source_brand))) != Z_OK) {
3664 		(void) fprintf(stderr, "%s: zone '%s': %s\n",
3665 		    execname, source_zone, gettext("missing or invalid brand"));
3666 		return (Z_ERR);
3667 	}
3668 
3669 	if (strcmp(source_brand, target_brand) != NULL) {
3670 		(void) fprintf(stderr,
3671 		    gettext("%s: Zones '%s' and '%s' have different brand "
3672 		    "types.\n"), execname, source_zone, target_zone);
3673 		return (Z_ERR);
3674 	}
3675 
3676 	if ((bh = brand_open(target_brand)) == NULL) {
3677 		zerror(gettext("missing or invalid brand"));
3678 		return (Z_ERR);
3679 	}
3680 	brand_close(bh);
3681 	return (Z_OK);
3682 }
3683 
3684 static int
3685 validate_clone(char *source_zone, char *target_zone)
3686 {
3687 	int err = Z_OK;
3688 	zone_dochandle_t s_handle;
3689 	zone_dochandle_t t_handle;
3690 
3691 	if ((t_handle = zonecfg_init_handle()) == NULL) {
3692 		zperror(cmd_to_str(CMD_CLONE), B_TRUE);
3693 		return (Z_ERR);
3694 	}
3695 	if ((err = zonecfg_get_handle(target_zone, t_handle)) != Z_OK) {
3696 		errno = err;
3697 		zperror(cmd_to_str(CMD_CLONE), B_TRUE);
3698 		zonecfg_fini_handle(t_handle);
3699 		return (Z_ERR);
3700 	}
3701 
3702 	if ((s_handle = zonecfg_init_handle()) == NULL) {
3703 		zperror(cmd_to_str(CMD_CLONE), B_TRUE);
3704 		zonecfg_fini_handle(t_handle);
3705 		return (Z_ERR);
3706 	}
3707 	if ((err = zonecfg_get_handle(source_zone, s_handle)) != Z_OK) {
3708 		errno = err;
3709 		zperror(cmd_to_str(CMD_CLONE), B_TRUE);
3710 		goto done;
3711 	}
3712 
3713 	/* verify new zone has same brand type */
3714 	err = valid_brand_clone(source_zone, target_zone);
3715 	if (err != Z_OK)
3716 		goto done;
3717 
3718 	/* verify new zone has same inherit-pkg-dirs */
3719 	err = valid_ipd_clone(s_handle, source_zone, t_handle, target_zone);
3720 
3721 	/* warn about imported fs's which are the same */
3722 	warn_fs_match(s_handle, source_zone, t_handle, target_zone);
3723 
3724 	/* warn about imported IP addresses which are the same */
3725 	warn_ip_match(s_handle, source_zone, t_handle, target_zone);
3726 
3727 	/* warn about imported devices which are the same */
3728 	warn_dev_match(s_handle, source_zone, t_handle, target_zone);
3729 
3730 	/* warn about imported datasets which are the same */
3731 	warn_dataset_match(s_handle, source_zone, t_handle, target_zone);
3732 
3733 done:
3734 	zonecfg_fini_handle(t_handle);
3735 	zonecfg_fini_handle(s_handle);
3736 
3737 	return ((err == Z_OK) ? Z_OK : Z_ERR);
3738 }
3739 
3740 static int
3741 copy_zone(char *src, char *dst)
3742 {
3743 	boolean_t out_null = B_FALSE;
3744 	int status;
3745 	char *outfile;
3746 	char cmdbuf[MAXPATHLEN * 2 + 128];
3747 
3748 	if ((outfile = tempnam("/var/log", "zone")) == NULL) {
3749 		outfile = "/dev/null";
3750 		out_null = B_TRUE;
3751 	}
3752 
3753 	/*
3754 	 * Use find to get the list of files to copy.  We need to skip
3755 	 * files of type "socket" since cpio can't handle those but that
3756 	 * should be ok since the app will recreate the socket when it runs.
3757 	 * We also need to filter out anything under the .zfs subdir.  Since
3758 	 * find is running depth-first, we need the extra egrep to filter .zfs.
3759 	 */
3760 	(void) snprintf(cmdbuf, sizeof (cmdbuf),
3761 	    "cd %s && /usr/bin/find . -type s -prune -o -depth -print | "
3762 	    "/usr/bin/egrep -v '^\\./\\.zfs$|^\\./\\.zfs/' | "
3763 	    "/usr/bin/cpio -pdmuP@ %s > %s 2>&1",
3764 	    src, dst, outfile);
3765 
3766 	status = do_subproc(cmdbuf);
3767 
3768 	if (subproc_status("copy", status, B_TRUE) != ZONE_SUBPROC_OK) {
3769 		if (!out_null)
3770 			(void) fprintf(stderr, gettext("\nThe copy failed.\n"
3771 			    "More information can be found in %s\n"), outfile);
3772 		return (Z_ERR);
3773 	}
3774 
3775 	if (!out_null)
3776 		(void) unlink(outfile);
3777 
3778 	return (Z_OK);
3779 }
3780 
3781 static int
3782 zone_postclone(char *zonepath)
3783 {
3784 	char cmdbuf[MAXPATHLEN];
3785 	int status;
3786 	brand_handle_t bh;
3787 	int err = Z_OK;
3788 
3789 	/*
3790 	 * Fetch the post-clone command, if any, from the brand
3791 	 * configuration.
3792 	 */
3793 	if ((bh = brand_open(target_brand)) == NULL) {
3794 		zerror(gettext("missing or invalid brand"));
3795 		return (Z_ERR);
3796 	}
3797 	(void) strcpy(cmdbuf, EXEC_PREFIX);
3798 	err = brand_get_postclone(bh, target_zone, zonepath, cmdbuf + EXEC_LEN,
3799 	    sizeof (cmdbuf) - EXEC_LEN, 0, NULL);
3800 	brand_close(bh);
3801 
3802 	if (err == 0 && strlen(cmdbuf) > EXEC_LEN) {
3803 		status = do_subproc(cmdbuf);
3804 		if ((err = subproc_status("postclone", status, B_FALSE))
3805 		    != ZONE_SUBPROC_OK) {
3806 			zerror(gettext("post-clone configuration failed."));
3807 			err = Z_ERR;
3808 		}
3809 	}
3810 
3811 	return (err);
3812 }
3813 
3814 /* ARGSUSED */
3815 static int
3816 zfm_print(const char *p, void *r) {
3817 	zerror("  %s\n", p);
3818 	return (0);
3819 }
3820 
3821 int
3822 clone_copy(char *source_zonepath, char *zonepath)
3823 {
3824 	int err;
3825 
3826 	/* Don't clone the zone if anything is still mounted there */
3827 	if (zonecfg_find_mounts(source_zonepath, NULL, NULL)) {
3828 		zerror(gettext("These file systems are mounted on "
3829 		    "subdirectories of %s.\n"), source_zonepath);
3830 		(void) zonecfg_find_mounts(source_zonepath, zfm_print, NULL);
3831 		return (Z_ERR);
3832 	}
3833 
3834 	/*
3835 	 * Attempt to create a ZFS fs for the zonepath.  As usual, we don't
3836 	 * care if this works or not since we always have the default behavior
3837 	 * of a simple directory for the zonepath.
3838 	 */
3839 	create_zfs_zonepath(zonepath);
3840 
3841 	(void) printf(gettext("Copying %s..."), source_zonepath);
3842 	(void) fflush(stdout);
3843 
3844 	err = copy_zone(source_zonepath, zonepath);
3845 
3846 	(void) printf("\n");
3847 
3848 	return (err);
3849 }
3850 
3851 static int
3852 clone_func(int argc, char *argv[])
3853 {
3854 	char *source_zone = NULL;
3855 	int lockfd;
3856 	int err, arg;
3857 	char zonepath[MAXPATHLEN];
3858 	char source_zonepath[MAXPATHLEN];
3859 	zone_state_t state;
3860 	zone_entry_t *zent;
3861 	char *method = NULL;
3862 	char *snapshot = NULL;
3863 
3864 	if (zonecfg_in_alt_root()) {
3865 		zerror(gettext("cannot clone zone in alternate root"));
3866 		return (Z_ERR);
3867 	}
3868 
3869 	optind = 0;
3870 	if ((arg = getopt(argc, argv, "?m:s:")) != EOF) {
3871 		switch (arg) {
3872 		case '?':
3873 			sub_usage(SHELP_CLONE, CMD_CLONE);
3874 			return (optopt == '?' ? Z_OK : Z_USAGE);
3875 		case 'm':
3876 			method = optarg;
3877 			break;
3878 		case 's':
3879 			snapshot = optarg;
3880 			break;
3881 		default:
3882 			sub_usage(SHELP_CLONE, CMD_CLONE);
3883 			return (Z_USAGE);
3884 		}
3885 	}
3886 	if (argc != (optind + 1) ||
3887 	    (method != NULL && strcmp(method, "copy") != 0)) {
3888 		sub_usage(SHELP_CLONE, CMD_CLONE);
3889 		return (Z_USAGE);
3890 	}
3891 	source_zone = argv[optind];
3892 	if (sanity_check(target_zone, CMD_CLONE, B_FALSE, B_TRUE, B_FALSE)
3893 	    != Z_OK)
3894 		return (Z_ERR);
3895 	if (verify_details(CMD_CLONE, argv) != Z_OK)
3896 		return (Z_ERR);
3897 
3898 	/*
3899 	 * We also need to do some extra validation on the source zone.
3900 	 */
3901 	if (strcmp(source_zone, GLOBAL_ZONENAME) == 0) {
3902 		zerror(gettext("%s operation is invalid for the global zone."),
3903 		    cmd_to_str(CMD_CLONE));
3904 		return (Z_ERR);
3905 	}
3906 
3907 	if (strncmp(source_zone, "SUNW", 4) == 0) {
3908 		zerror(gettext("%s operation is invalid for zones starting "
3909 		    "with SUNW."), cmd_to_str(CMD_CLONE));
3910 		return (Z_ERR);
3911 	}
3912 
3913 	zent = lookup_running_zone(source_zone);
3914 	if (zent != NULL) {
3915 		/* check whether the zone is ready or running */
3916 		if ((err = zone_get_state(zent->zname, &zent->zstate_num))
3917 		    != Z_OK) {
3918 			errno = err;
3919 			zperror2(zent->zname, gettext("could not get state"));
3920 			/* can't tell, so hedge */
3921 			zent->zstate_str = "ready/running";
3922 		} else {
3923 			zent->zstate_str = zone_state_str(zent->zstate_num);
3924 		}
3925 		zerror(gettext("%s operation is invalid for %s zones."),
3926 		    cmd_to_str(CMD_CLONE), zent->zstate_str);
3927 		return (Z_ERR);
3928 	}
3929 
3930 	if ((err = zone_get_state(source_zone, &state)) != Z_OK) {
3931 		errno = err;
3932 		zperror2(source_zone, gettext("could not get state"));
3933 		return (Z_ERR);
3934 	}
3935 	if (state != ZONE_STATE_INSTALLED) {
3936 		(void) fprintf(stderr,
3937 		    gettext("%s: zone %s is %s; %s is required.\n"),
3938 		    execname, source_zone, zone_state_str(state),
3939 		    zone_state_str(ZONE_STATE_INSTALLED));
3940 		return (Z_ERR);
3941 	}
3942 
3943 	/*
3944 	 * The source zone checks out ok, continue with the clone.
3945 	 */
3946 
3947 	if (validate_clone(source_zone, target_zone) != Z_OK)
3948 		return (Z_ERR);
3949 
3950 	if (grab_lock_file(target_zone, &lockfd) != Z_OK) {
3951 		zerror(gettext("another %s may have an operation in progress."),
3952 		    "zoneadm");
3953 		return (Z_ERR);
3954 	}
3955 
3956 	if ((err = zone_get_zonepath(source_zone, source_zonepath,
3957 	    sizeof (source_zonepath))) != Z_OK) {
3958 		errno = err;
3959 		zperror2(source_zone, gettext("could not get zone path"));
3960 		goto done;
3961 	}
3962 
3963 	if ((err = zone_get_zonepath(target_zone, zonepath, sizeof (zonepath)))
3964 	    != Z_OK) {
3965 		errno = err;
3966 		zperror2(target_zone, gettext("could not get zone path"));
3967 		goto done;
3968 	}
3969 
3970 	if ((err = zone_set_state(target_zone, ZONE_STATE_INCOMPLETE))
3971 	    != Z_OK) {
3972 		errno = err;
3973 		zperror2(target_zone, gettext("could not set state"));
3974 		goto done;
3975 	}
3976 
3977 	if (snapshot != NULL) {
3978 		err = clone_snapshot_zfs(snapshot, zonepath);
3979 	} else {
3980 		/*
3981 		 * We always copy the clone unless the source is ZFS and a
3982 		 * ZFS clone worked.  We fallback to copying if the ZFS clone
3983 		 * fails for some reason.
3984 		 */
3985 		err = Z_ERR;
3986 		if (method == NULL && is_zonepath_zfs(source_zonepath))
3987 			err = clone_zfs(source_zone, source_zonepath, zonepath);
3988 
3989 		if (err != Z_OK)
3990 			err = clone_copy(source_zonepath, zonepath);
3991 	}
3992 
3993 	/*
3994 	 * Trusted Extensions requires that cloned zones use the same sysid
3995 	 * configuration, so it is not appropriate to perform any
3996 	 * post-clone reconfiguration.
3997 	 */
3998 	if ((err == Z_OK) && !is_system_labeled())
3999 		err = zone_postclone(zonepath);
4000 
4001 done:
4002 	/*
4003 	 * If everything went well, we mark the zone as installed.
4004 	 */
4005 	if (err == Z_OK) {
4006 		err = zone_set_state(target_zone, ZONE_STATE_INSTALLED);
4007 		if (err != Z_OK) {
4008 			errno = err;
4009 			zperror2(target_zone, gettext("could not set state"));
4010 		}
4011 	}
4012 	release_lock_file(lockfd);
4013 	return ((err == Z_OK) ? Z_OK : Z_ERR);
4014 }
4015 
4016 /*
4017  * Used when removing a zonepath after uninstalling or cleaning up after
4018  * the move subcommand.  This handles a zonepath that has non-standard
4019  * contents so that we will only cleanup the stuff we know about and leave
4020  * any user data alone.
4021  *
4022  * If the "all" parameter is true then we should remove the whole zonepath
4023  * even if it has non-standard files/directories in it.  This can be used when
4024  * we need to cleanup after moving the zonepath across file systems.
4025  *
4026  * We "exec" the RMCOMMAND so that the returned status is that of RMCOMMAND
4027  * and not the shell.
4028  */
4029 static int
4030 cleanup_zonepath(char *zonepath, boolean_t all)
4031 {
4032 	int		status;
4033 	int		i;
4034 	boolean_t	non_std = B_FALSE;
4035 	struct dirent	*dp;
4036 	DIR		*dirp;
4037 			/*
4038 			 * The SUNWattached.xml file is expected since it might
4039 			 * exist if the zone was force-attached after a
4040 			 * migration.
4041 			 */
4042 	char		*std_entries[] = {"dev", "lu", "root",
4043 			    "SUNWattached.xml", NULL};
4044 			/* (MAXPATHLEN * 3) is for the 3 std_entries dirs */
4045 	char		cmdbuf[sizeof (RMCOMMAND) + (MAXPATHLEN * 3) + 64];
4046 
4047 	/*
4048 	 * We shouldn't need these checks but lets be paranoid since we
4049 	 * could blow away the whole system here if we got the wrong zonepath.
4050 	 */
4051 	if (*zonepath == NULL || strcmp(zonepath, "/") == 0) {
4052 		(void) fprintf(stderr, "invalid zonepath '%s'\n", zonepath);
4053 		return (Z_INVAL);
4054 	}
4055 
4056 	/*
4057 	 * If the dirpath is already gone (maybe it was manually removed) then
4058 	 * we just return Z_OK so that the cleanup is successful.
4059 	 */
4060 	if ((dirp = opendir(zonepath)) == NULL)
4061 		return (Z_OK);
4062 
4063 	/*
4064 	 * Look through the zonepath directory to see if there are any
4065 	 * non-standard files/dirs.  Also skip .zfs since that might be
4066 	 * there but we'll handle ZFS file systems as a special case.
4067 	 */
4068 	while ((dp = readdir(dirp)) != NULL) {
4069 		if (strcmp(dp->d_name, ".") == 0 ||
4070 		    strcmp(dp->d_name, "..") == 0 ||
4071 		    strcmp(dp->d_name, ".zfs") == 0)
4072 			continue;
4073 
4074 		for (i = 0; std_entries[i] != NULL; i++)
4075 			if (strcmp(dp->d_name, std_entries[i]) == 0)
4076 				break;
4077 
4078 		if (std_entries[i] == NULL)
4079 			non_std = B_TRUE;
4080 	}
4081 	(void) closedir(dirp);
4082 
4083 	if (!all && non_std) {
4084 		/*
4085 		 * There are extra, non-standard directories/files in the
4086 		 * zonepath so we don't want to remove the zonepath.  We
4087 		 * just want to remove the standard directories and leave
4088 		 * the user data alone.
4089 		 */
4090 		(void) snprintf(cmdbuf, sizeof (cmdbuf), "exec " RMCOMMAND);
4091 
4092 		for (i = 0; std_entries[i] != NULL; i++) {
4093 			char tmpbuf[MAXPATHLEN];
4094 
4095 			if (snprintf(tmpbuf, sizeof (tmpbuf), " %s/%s",
4096 			    zonepath, std_entries[i]) >= sizeof (tmpbuf) ||
4097 			    strlcat(cmdbuf, tmpbuf, sizeof (cmdbuf)) >=
4098 			    sizeof (cmdbuf)) {
4099 				(void) fprintf(stderr,
4100 				    gettext("path is too long\n"));
4101 				return (Z_INVAL);
4102 			}
4103 		}
4104 
4105 		status = do_subproc(cmdbuf);
4106 
4107 		(void) fprintf(stderr, gettext("WARNING: Unable to completely "
4108 		    "remove %s\nbecause it contains additional user data.  "
4109 		    "Only the standard directory\nentries have been "
4110 		    "removed.\n"),
4111 		    zonepath);
4112 
4113 		return ((subproc_status(RMCOMMAND, status, B_TRUE) ==
4114 		    ZONE_SUBPROC_OK) ? Z_OK : Z_ERR);
4115 	}
4116 
4117 	/*
4118 	 * There is nothing unexpected in the zonepath, try to get rid of the
4119 	 * whole zonepath directory.
4120 	 *
4121 	 * If the zonepath is its own zfs file system, try to destroy the
4122 	 * file system.  If that fails for some reason (e.g. it has clones)
4123 	 * then we'll just remove the contents of the zonepath.
4124 	 */
4125 	if (is_zonepath_zfs(zonepath)) {
4126 		if (destroy_zfs(zonepath) == Z_OK)
4127 			return (Z_OK);
4128 		(void) snprintf(cmdbuf, sizeof (cmdbuf), "exec " RMCOMMAND
4129 		    " %s/*", zonepath);
4130 		status = do_subproc(cmdbuf);
4131 		return ((subproc_status(RMCOMMAND, status, B_TRUE) ==
4132 		    ZONE_SUBPROC_OK) ? Z_OK : Z_ERR);
4133 	}
4134 
4135 	(void) snprintf(cmdbuf, sizeof (cmdbuf), "exec " RMCOMMAND " %s",
4136 	    zonepath);
4137 	status = do_subproc(cmdbuf);
4138 
4139 	return ((subproc_status(RMCOMMAND, status, B_TRUE) == ZONE_SUBPROC_OK)
4140 	    ? Z_OK : Z_ERR);
4141 }
4142 
4143 static int
4144 move_func(int argc, char *argv[])
4145 {
4146 	char *new_zonepath = NULL;
4147 	int lockfd;
4148 	int err, arg;
4149 	char zonepath[MAXPATHLEN];
4150 	zone_dochandle_t handle;
4151 	boolean_t fast;
4152 	boolean_t is_zfs = B_FALSE;
4153 	struct dirent *dp;
4154 	DIR *dirp;
4155 	boolean_t empty = B_TRUE;
4156 	boolean_t revert;
4157 	struct stat zonepath_buf;
4158 	struct stat new_zonepath_buf;
4159 
4160 	if (zonecfg_in_alt_root()) {
4161 		zerror(gettext("cannot move zone in alternate root"));
4162 		return (Z_ERR);
4163 	}
4164 
4165 	optind = 0;
4166 	if ((arg = getopt(argc, argv, "?")) != EOF) {
4167 		switch (arg) {
4168 		case '?':
4169 			sub_usage(SHELP_MOVE, CMD_MOVE);
4170 			return (optopt == '?' ? Z_OK : Z_USAGE);
4171 		default:
4172 			sub_usage(SHELP_MOVE, CMD_MOVE);
4173 			return (Z_USAGE);
4174 		}
4175 	}
4176 	if (argc != (optind + 1)) {
4177 		sub_usage(SHELP_MOVE, CMD_MOVE);
4178 		return (Z_USAGE);
4179 	}
4180 	new_zonepath = argv[optind];
4181 	if (sanity_check(target_zone, CMD_MOVE, B_FALSE, B_TRUE, B_FALSE)
4182 	    != Z_OK)
4183 		return (Z_ERR);
4184 	if (verify_details(CMD_MOVE, argv) != Z_OK)
4185 		return (Z_ERR);
4186 
4187 	/*
4188 	 * Check out the new zonepath.  This has the side effect of creating
4189 	 * a directory for the new zonepath.  We depend on this later when we
4190 	 * stat to see if we are doing a cross file system move or not.
4191 	 */
4192 	if (validate_zonepath(new_zonepath, CMD_MOVE) != Z_OK)
4193 		return (Z_ERR);
4194 
4195 	if ((err = zone_get_zonepath(target_zone, zonepath, sizeof (zonepath)))
4196 	    != Z_OK) {
4197 		errno = err;
4198 		zperror2(target_zone, gettext("could not get zone path"));
4199 		return (Z_ERR);
4200 	}
4201 
4202 	if (stat(zonepath, &zonepath_buf) == -1) {
4203 		zperror(gettext("could not stat zone path"), B_FALSE);
4204 		return (Z_ERR);
4205 	}
4206 
4207 	if (stat(new_zonepath, &new_zonepath_buf) == -1) {
4208 		zperror(gettext("could not stat new zone path"), B_FALSE);
4209 		return (Z_ERR);
4210 	}
4211 
4212 	/*
4213 	 * Check if the destination directory is empty.
4214 	 */
4215 	if ((dirp = opendir(new_zonepath)) == NULL) {
4216 		zperror(gettext("could not open new zone path"), B_FALSE);
4217 		return (Z_ERR);
4218 	}
4219 	while ((dp = readdir(dirp)) != (struct dirent *)0) {
4220 		if (strcmp(dp->d_name, ".") == 0 ||
4221 		    strcmp(dp->d_name, "..") == 0)
4222 			continue;
4223 		empty = B_FALSE;
4224 		break;
4225 	}
4226 	(void) closedir(dirp);
4227 
4228 	/* Error if there is anything in the destination directory. */
4229 	if (!empty) {
4230 		(void) fprintf(stderr, gettext("could not move zone to %s: "
4231 		    "directory not empty\n"), new_zonepath);
4232 		return (Z_ERR);
4233 	}
4234 
4235 	/* Don't move the zone if anything is still mounted there */
4236 	if (zonecfg_find_mounts(zonepath, NULL, NULL)) {
4237 		zerror(gettext("These file systems are mounted on "
4238 		    "subdirectories of %s.\n"), zonepath);
4239 		(void) zonecfg_find_mounts(zonepath, zfm_print, NULL);
4240 		return (Z_ERR);
4241 	}
4242 
4243 	/*
4244 	 * Check if we are moving in the same file system and can do a fast
4245 	 * move or if we are crossing file systems and have to copy the data.
4246 	 */
4247 	fast = (zonepath_buf.st_dev == new_zonepath_buf.st_dev);
4248 
4249 	if ((handle = zonecfg_init_handle()) == NULL) {
4250 		zperror(cmd_to_str(CMD_MOVE), B_TRUE);
4251 		return (Z_ERR);
4252 	}
4253 
4254 	if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) {
4255 		errno = err;
4256 		zperror(cmd_to_str(CMD_MOVE), B_TRUE);
4257 		zonecfg_fini_handle(handle);
4258 		return (Z_ERR);
4259 	}
4260 
4261 	if (grab_lock_file(target_zone, &lockfd) != Z_OK) {
4262 		zerror(gettext("another %s may have an operation in progress."),
4263 		    "zoneadm");
4264 		zonecfg_fini_handle(handle);
4265 		return (Z_ERR);
4266 	}
4267 
4268 	/*
4269 	 * We're making some file system changes now so we have to clean up
4270 	 * the file system before we are done.  This will either clean up the
4271 	 * new zonepath if the zonecfg update failed or it will clean up the
4272 	 * old zonepath if everything is ok.
4273 	 */
4274 	revert = B_TRUE;
4275 
4276 	if (is_zonepath_zfs(zonepath) &&
4277 	    move_zfs(zonepath, new_zonepath) != Z_ERR) {
4278 		is_zfs = B_TRUE;
4279 
4280 	} else if (fast) {
4281 		/* same file system, use rename for a quick move */
4282 
4283 		/*
4284 		 * Remove the new_zonepath directory that got created above
4285 		 * during the validation.  It gets in the way of the rename.
4286 		 */
4287 		if (rmdir(new_zonepath) != 0) {
4288 			zperror(gettext("could not rmdir new zone path"),
4289 			    B_FALSE);
4290 			zonecfg_fini_handle(handle);
4291 			release_lock_file(lockfd);
4292 			return (Z_ERR);
4293 		}
4294 
4295 		if (rename(zonepath, new_zonepath) != 0) {
4296 			/*
4297 			 * If this fails we don't need to do all of the
4298 			 * cleanup that happens for the rest of the code
4299 			 * so just return from this error.
4300 			 */
4301 			zperror(gettext("could not move zone"), B_FALSE);
4302 			zonecfg_fini_handle(handle);
4303 			release_lock_file(lockfd);
4304 			return (Z_ERR);
4305 		}
4306 
4307 	} else {
4308 		/*
4309 		 * Attempt to create a ZFS fs for the new zonepath.  As usual,
4310 		 * we don't care if this works or not since we always have the
4311 		 * default behavior of a simple directory for the zonepath.
4312 		 */
4313 		create_zfs_zonepath(new_zonepath);
4314 
4315 		(void) printf(gettext(
4316 		    "Moving across file systems; copying zonepath %s..."),
4317 		    zonepath);
4318 		(void) fflush(stdout);
4319 
4320 		err = copy_zone(zonepath, new_zonepath);
4321 
4322 		(void) printf("\n");
4323 		if (err != Z_OK)
4324 			goto done;
4325 	}
4326 
4327 	if ((err = zonecfg_set_zonepath(handle, new_zonepath)) != Z_OK) {
4328 		errno = err;
4329 		zperror(gettext("could not set new zonepath"), B_TRUE);
4330 		goto done;
4331 	}
4332 
4333 	if ((err = zonecfg_save(handle)) != Z_OK) {
4334 		errno = err;
4335 		zperror(gettext("zonecfg save failed"), B_TRUE);
4336 		goto done;
4337 	}
4338 
4339 	revert = B_FALSE;
4340 
4341 done:
4342 	zonecfg_fini_handle(handle);
4343 	release_lock_file(lockfd);
4344 
4345 	/*
4346 	 * Clean up the file system based on how things went.  We either
4347 	 * clean up the new zonepath if the operation failed for some reason
4348 	 * or we clean up the old zonepath if everything is ok.
4349 	 */
4350 	if (revert) {
4351 		/* The zonecfg update failed, cleanup the new zonepath. */
4352 		if (is_zfs) {
4353 			if (move_zfs(new_zonepath, zonepath) == Z_ERR) {
4354 				(void) fprintf(stderr, gettext("could not "
4355 				    "restore zonepath, the zfs mountpoint is "
4356 				    "set as:\n%s\n"), new_zonepath);
4357 				/*
4358 				 * err is already != Z_OK since we're reverting
4359 				 */
4360 			}
4361 
4362 		} else if (fast) {
4363 			if (rename(new_zonepath, zonepath) != 0) {
4364 				zperror(gettext("could not restore zonepath"),
4365 				    B_FALSE);
4366 				/*
4367 				 * err is already != Z_OK since we're reverting
4368 				 */
4369 			}
4370 		} else {
4371 			(void) printf(gettext("Cleaning up zonepath %s..."),
4372 			    new_zonepath);
4373 			(void) fflush(stdout);
4374 			err = cleanup_zonepath(new_zonepath, B_TRUE);
4375 			(void) printf("\n");
4376 
4377 			if (err != Z_OK) {
4378 				errno = err;
4379 				zperror(gettext("could not remove new "
4380 				    "zonepath"), B_TRUE);
4381 			} else {
4382 				/*
4383 				 * Because we're reverting we know the mainline
4384 				 * code failed but we just reused the err
4385 				 * variable so we reset it back to Z_ERR.
4386 				 */
4387 				err = Z_ERR;
4388 			}
4389 		}
4390 
4391 	} else {
4392 		/* The move was successful, cleanup the old zonepath. */
4393 		if (!is_zfs && !fast) {
4394 			(void) printf(
4395 			    gettext("Cleaning up zonepath %s..."), zonepath);
4396 			(void) fflush(stdout);
4397 			err = cleanup_zonepath(zonepath, B_TRUE);
4398 			(void) printf("\n");
4399 
4400 			if (err != Z_OK) {
4401 				errno = err;
4402 				zperror(gettext("could not remove zonepath"),
4403 				    B_TRUE);
4404 			}
4405 		}
4406 	}
4407 
4408 	return ((err == Z_OK) ? Z_OK : Z_ERR);
4409 }
4410 
4411 static int
4412 detach_func(int argc, char *argv[])
4413 {
4414 	int lockfd;
4415 	int err, arg;
4416 	char zonepath[MAXPATHLEN];
4417 	zone_dochandle_t handle;
4418 	boolean_t execute = B_TRUE;
4419 
4420 	if (zonecfg_in_alt_root()) {
4421 		zerror(gettext("cannot detach zone in alternate root"));
4422 		return (Z_ERR);
4423 	}
4424 
4425 	optind = 0;
4426 	if ((arg = getopt(argc, argv, "?n")) != EOF) {
4427 		switch (arg) {
4428 		case '?':
4429 			sub_usage(SHELP_DETACH, CMD_DETACH);
4430 			return (optopt == '?' ? Z_OK : Z_USAGE);
4431 		case 'n':
4432 			execute = B_FALSE;
4433 			break;
4434 		default:
4435 			sub_usage(SHELP_DETACH, CMD_DETACH);
4436 			return (Z_USAGE);
4437 		}
4438 	}
4439 
4440 	if (execute) {
4441 		if (sanity_check(target_zone, CMD_DETACH, B_FALSE, B_TRUE,
4442 		    B_FALSE) != Z_OK)
4443 			return (Z_ERR);
4444 		if (verify_details(CMD_DETACH, argv) != Z_OK)
4445 			return (Z_ERR);
4446 	} else {
4447 		/*
4448 		 * We want a dry-run to work for a non-privileged user so we
4449 		 * only do minimal validation.
4450 		 */
4451 		if (target_zone == NULL) {
4452 			zerror(gettext("no zone specified"));
4453 			return (Z_ERR);
4454 		}
4455 
4456 		if (strcmp(target_zone, GLOBAL_ZONENAME) == 0) {
4457 			zerror(gettext("%s operation is invalid for the "
4458 			    "global zone."), cmd_to_str(CMD_DETACH));
4459 			return (Z_ERR);
4460 		}
4461 	}
4462 
4463 	if ((err = zone_get_zonepath(target_zone, zonepath, sizeof (zonepath)))
4464 	    != Z_OK) {
4465 		errno = err;
4466 		zperror2(target_zone, gettext("could not get zone path"));
4467 		return (Z_ERR);
4468 	}
4469 
4470 	/* Don't detach the zone if anything is still mounted there */
4471 	if (execute && zonecfg_find_mounts(zonepath, NULL, NULL)) {
4472 		zerror(gettext("These file systems are mounted on "
4473 		    "subdirectories of %s.\n"), zonepath);
4474 		(void) zonecfg_find_mounts(zonepath, zfm_print, NULL);
4475 		return (Z_ERR);
4476 	}
4477 
4478 	if ((handle = zonecfg_init_handle()) == NULL) {
4479 		zperror(cmd_to_str(CMD_DETACH), B_TRUE);
4480 		return (Z_ERR);
4481 	}
4482 
4483 	if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) {
4484 		errno = err;
4485 		zperror(cmd_to_str(CMD_DETACH), B_TRUE);
4486 		zonecfg_fini_handle(handle);
4487 		return (Z_ERR);
4488 	}
4489 
4490 	if (execute && grab_lock_file(target_zone, &lockfd) != Z_OK) {
4491 		zerror(gettext("another %s may have an operation in progress."),
4492 		    "zoneadm");
4493 		zonecfg_fini_handle(handle);
4494 		return (Z_ERR);
4495 	}
4496 
4497 	if ((err = zonecfg_get_detach_info(handle, B_TRUE)) != Z_OK) {
4498 		errno = err;
4499 		zperror(gettext("getting the detach information failed"),
4500 		    B_TRUE);
4501 		goto done;
4502 	}
4503 
4504 	if ((err = zonecfg_detach_save(handle, (execute ? 0 : ZONE_DRY_RUN)))
4505 	    != Z_OK) {
4506 		errno = err;
4507 		zperror(gettext("saving the detach manifest failed"), B_TRUE);
4508 		goto done;
4509 	}
4510 
4511 	/*
4512 	 * Set the zone state back to configured unless we are running with the
4513 	 * no-execute option.
4514 	 */
4515 	if (execute && (err = zone_set_state(target_zone,
4516 	    ZONE_STATE_CONFIGURED)) != Z_OK) {
4517 		errno = err;
4518 		zperror(gettext("could not reset state"), B_TRUE);
4519 	}
4520 
4521 done:
4522 	zonecfg_fini_handle(handle);
4523 	if (execute)
4524 		release_lock_file(lockfd);
4525 
4526 	return ((err == Z_OK) ? Z_OK : Z_ERR);
4527 }
4528 
4529 /*
4530  * During attach we go through and fix up the /dev entries for the zone
4531  * we are attaching.  In order to regenerate /dev with the correct devices,
4532  * the old /dev will be removed, the zone readied (which generates a new
4533  * /dev) then halted, then we use the info from the manifest to update
4534  * the modes, owners, etc. on the new /dev.
4535  */
4536 static int
4537 dev_fix(zone_dochandle_t handle)
4538 {
4539 	int			res;
4540 	int			err;
4541 	int			status;
4542 	struct zone_devpermtab	devtab;
4543 	zone_cmd_arg_t		zarg;
4544 	char			devpath[MAXPATHLEN];
4545 				/* 6: "exec " and " " */
4546 	char			cmdbuf[sizeof (RMCOMMAND) + MAXPATHLEN + 6];
4547 
4548 	if ((res = zonecfg_get_zonepath(handle, devpath, sizeof (devpath)))
4549 	    != Z_OK)
4550 		return (res);
4551 
4552 	if (strlcat(devpath, "/dev", sizeof (devpath)) >= sizeof (devpath))
4553 		return (Z_TOO_BIG);
4554 
4555 	/*
4556 	 * "exec" the command so that the returned status is that of
4557 	 * RMCOMMAND and not the shell.
4558 	 */
4559 	(void) snprintf(cmdbuf, sizeof (cmdbuf), EXEC_PREFIX RMCOMMAND " %s",
4560 	    devpath);
4561 	status = do_subproc(cmdbuf);
4562 	if ((err = subproc_status(RMCOMMAND, status, B_TRUE)) !=
4563 	    ZONE_SUBPROC_OK) {
4564 		(void) fprintf(stderr,
4565 		    gettext("could not remove existing /dev\n"));
4566 		return (Z_ERR);
4567 	}
4568 
4569 	/* In order to ready the zone, it must be in the installed state */
4570 	if ((err = zone_set_state(target_zone, ZONE_STATE_INSTALLED)) != Z_OK) {
4571 		errno = err;
4572 		zperror(gettext("could not reset state"), B_TRUE);
4573 		return (Z_ERR);
4574 	}
4575 
4576 	/* We have to ready the zone to regen the dev tree */
4577 	zarg.cmd = Z_READY;
4578 	if (call_zoneadmd(target_zone, &zarg) != 0) {
4579 		zerror(gettext("call to %s failed"), "zoneadmd");
4580 		/* attempt to restore zone to configured state */
4581 		(void) zone_set_state(target_zone, ZONE_STATE_CONFIGURED);
4582 		return (Z_ERR);
4583 	}
4584 
4585 	zarg.cmd = Z_HALT;
4586 	if (call_zoneadmd(target_zone, &zarg) != 0) {
4587 		zerror(gettext("call to %s failed"), "zoneadmd");
4588 		/* attempt to restore zone to configured state */
4589 		(void) zone_set_state(target_zone, ZONE_STATE_CONFIGURED);
4590 		return (Z_ERR);
4591 	}
4592 
4593 	/* attempt to restore zone to configured state */
4594 	(void) zone_set_state(target_zone, ZONE_STATE_CONFIGURED);
4595 
4596 	if (zonecfg_setdevperment(handle) != Z_OK) {
4597 		(void) fprintf(stderr,
4598 		    gettext("unable to enumerate device entries\n"));
4599 		return (Z_ERR);
4600 	}
4601 
4602 	while (zonecfg_getdevperment(handle, &devtab) == Z_OK) {
4603 		int err;
4604 
4605 		if ((err = zonecfg_devperms_apply(handle,
4606 		    devtab.zone_devperm_name, devtab.zone_devperm_uid,
4607 		    devtab.zone_devperm_gid, devtab.zone_devperm_mode,
4608 		    devtab.zone_devperm_acl)) != Z_OK && err != Z_INVAL)
4609 			(void) fprintf(stderr, gettext("error updating device "
4610 			    "%s: %s\n"), devtab.zone_devperm_name,
4611 			    zonecfg_strerror(err));
4612 
4613 		free(devtab.zone_devperm_acl);
4614 	}
4615 
4616 	(void) zonecfg_enddevperment(handle);
4617 
4618 	return (Z_OK);
4619 }
4620 
4621 /*
4622  * Validate attaching a zone but don't actually do the work.  The zone
4623  * does not have to exist, so there is some complexity getting a new zone
4624  * configuration set up so that we can perform the validation.  This is
4625  * handled within zonecfg_attach_manifest() which returns two handles; one
4626  * for the the full configuration to validate (rem_handle) and the other
4627  * (local_handle) containing only the zone configuration derived from the
4628  * manifest.
4629  */
4630 static int
4631 dryrun_attach(char *manifest_path, char *argv[])
4632 {
4633 	int fd;
4634 	int err;
4635 	int res;
4636 	zone_dochandle_t local_handle;
4637 	zone_dochandle_t rem_handle = NULL;
4638 
4639 	if (strcmp(manifest_path, "-") == 0) {
4640 		fd = 0;
4641 	} else if ((fd = open(manifest_path, O_RDONLY)) < 0) {
4642 		zperror(gettext("could not open manifest path"), B_FALSE);
4643 		return (Z_ERR);
4644 	}
4645 
4646 	if ((local_handle = zonecfg_init_handle()) == NULL) {
4647 		zperror(cmd_to_str(CMD_ATTACH), B_TRUE);
4648 		res = Z_ERR;
4649 		goto done;
4650 	}
4651 
4652 	if ((rem_handle = zonecfg_init_handle()) == NULL) {
4653 		zperror(cmd_to_str(CMD_ATTACH), B_TRUE);
4654 		res = Z_ERR;
4655 		goto done;
4656 	}
4657 
4658 	if ((err = zonecfg_attach_manifest(fd, local_handle, rem_handle))
4659 	    != Z_OK) {
4660 		res = Z_ERR;
4661 
4662 		if (err == Z_INVALID_DOCUMENT) {
4663 			struct stat st;
4664 			char buf[6];
4665 
4666 			if (strcmp(manifest_path, "-") == 0) {
4667 				zerror(gettext("Input is not a valid XML "
4668 				    "file"));
4669 				goto done;
4670 			}
4671 
4672 			if (fstat(fd, &st) == -1 || !S_ISREG(st.st_mode)) {
4673 				zerror(gettext("%s is not an XML file"),
4674 				    manifest_path);
4675 				goto done;
4676 			}
4677 
4678 			bzero(buf, sizeof (buf));
4679 			(void) lseek(fd, 0L, SEEK_SET);
4680 			if (read(fd, buf, sizeof (buf) - 1) < 0 ||
4681 			    strncmp(buf, "<?xml", 5) != 0)
4682 				zerror(gettext("%s is not an XML file"),
4683 				    manifest_path);
4684 			else
4685 				zerror(gettext("Cannot attach to an earlier "
4686 				    "release of the operating system"));
4687 		} else {
4688 			zperror(cmd_to_str(CMD_ATTACH), B_TRUE);
4689 		}
4690 		goto done;
4691 	}
4692 
4693 	/*
4694 	 * Retrieve remote handle brand type and determine whether it is
4695 	 * native or not.
4696 	 */
4697 	if (zonecfg_get_brand(rem_handle, target_brand, sizeof (target_brand))
4698 	    != Z_OK) {
4699 		zerror(gettext("missing or invalid brand"));
4700 		exit(Z_ERR);
4701 	}
4702 	is_native_zone = (strcmp(target_brand, NATIVE_BRAND_NAME) == 0);
4703 
4704 	res = verify_handle(CMD_ATTACH, local_handle, argv);
4705 
4706 	/* Get the detach information for the locally defined zone. */
4707 	if ((err = zonecfg_get_detach_info(local_handle, B_FALSE)) != Z_OK) {
4708 		errno = err;
4709 		zperror(gettext("getting the attach information failed"),
4710 		    B_TRUE);
4711 		res = Z_ERR;
4712 	} else {
4713 		/* sw_cmp prints error msgs as necessary */
4714 		if (sw_cmp(local_handle, rem_handle, SW_CMP_NONE) != Z_OK)
4715 			res = Z_ERR;
4716 	}
4717 
4718 done:
4719 	if (strcmp(manifest_path, "-") != 0)
4720 		(void) close(fd);
4721 
4722 	zonecfg_fini_handle(local_handle);
4723 	zonecfg_fini_handle(rem_handle);
4724 
4725 	return ((res == Z_OK) ? Z_OK : Z_ERR);
4726 }
4727 
4728 /*
4729  * Attempt to generate the information we need to make the zone look like
4730  * it was properly detached by using the pkg information contained within
4731  * the zone itself.
4732  *
4733  * We will perform a dry-run detach within the zone to generate the xml file.
4734  * To do this we need to be able to get a handle on the zone so we can see
4735  * how it is configured.  In order to get a handle, we need a copy of the
4736  * zone configuration within the zone.  Since the zone's configuration is
4737  * not available within the zone itself, we need to temporarily copy it into
4738  * the zone.
4739  *
4740  * The sequence of actions we are doing is this:
4741  *	[set zone state to installed]
4742  *	[mount zone]
4743  *	zlogin {zone} </etc/zones/{zone}.xml 'cat >/etc/zones/{zone}.xml'
4744  *	zlogin {zone} 'zoneadm -z {zone} detach -n' >{zonepath}/SUNWdetached.xml
4745  *	zlogin {zone} 'rm -f /etc/zones/{zone}.xml'
4746  *	[unmount zone]
4747  *	[set zone state to configured]
4748  *
4749  * The successful result of this function is that we will have a
4750  * SUNWdetached.xml file in the zonepath and we can use that to attach the zone.
4751  */
4752 static boolean_t
4753 gen_detach_info(char *zonepath)
4754 {
4755 	int		status;
4756 	boolean_t	mounted = B_FALSE;
4757 	boolean_t	res = B_FALSE;
4758 	char		cmdbuf[2 * MAXPATHLEN];
4759 
4760 	/*
4761 	 * The zone has to be installed to mount and zlogin.  Temporarily set
4762 	 * the state to 'installed'.
4763 	 */
4764 	if (zone_set_state(target_zone, ZONE_STATE_INSTALLED) != Z_OK)
4765 		return (B_FALSE);
4766 
4767 	/* Mount the zone so we can zlogin. */
4768 	if (mount_func(0, NULL) != Z_OK)
4769 		goto cleanup;
4770 	mounted = B_TRUE;
4771 
4772 	/*
4773 	 * We need to copy the zones xml configuration file into the
4774 	 * zone so we can get a handle for the zone while running inside
4775 	 * the zone.
4776 	 */
4777 	if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/sbin/zlogin -S %s "
4778 	    "</etc/zones/%s.xml '/usr/bin/cat >/etc/zones/%s.xml'",
4779 	    target_zone, target_zone, target_zone) >= sizeof (cmdbuf))
4780 		goto cleanup;
4781 
4782 	status = do_subproc_interactive(cmdbuf);
4783 	if (subproc_status("copy", status, B_TRUE) != ZONE_SUBPROC_OK)
4784 		goto cleanup;
4785 
4786 	/* Now run the detach command within the mounted zone. */
4787 	if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/sbin/zlogin -S %s "
4788 	    "'/usr/sbin/zoneadm -z %s detach -n' >%s/SUNWdetached.xml",
4789 	    target_zone, target_zone, zonepath) >= sizeof (cmdbuf))
4790 		goto cleanup;
4791 
4792 	status = do_subproc_interactive(cmdbuf);
4793 	if (subproc_status("detach", status, B_TRUE) != ZONE_SUBPROC_OK)
4794 		goto cleanup;
4795 
4796 	res = B_TRUE;
4797 
4798 cleanup:
4799 	/* Cleanup from the previous actions. */
4800 	if (mounted) {
4801 		if (snprintf(cmdbuf, sizeof (cmdbuf),
4802 		    "/usr/sbin/zlogin -S %s '/usr/bin/rm -f /etc/zones/%s.xml'",
4803 		    target_zone, target_zone) >= sizeof (cmdbuf)) {
4804 			res = B_FALSE;
4805 		} else {
4806 			status = do_subproc(cmdbuf);
4807 			if (subproc_status("rm", status, B_TRUE)
4808 			    != ZONE_SUBPROC_OK)
4809 				res = B_FALSE;
4810 		}
4811 
4812 		if (unmount_func(0, NULL) != Z_OK)
4813 			res =  B_FALSE;
4814 	}
4815 
4816 	if (zone_set_state(target_zone, ZONE_STATE_CONFIGURED) != Z_OK)
4817 		res = B_FALSE;
4818 
4819 	return (res);
4820 }
4821 
4822 static int
4823 attach_func(int argc, char *argv[])
4824 {
4825 	int lockfd;
4826 	int err, arg;
4827 	boolean_t force = B_FALSE;
4828 	zone_dochandle_t handle;
4829 	zone_dochandle_t athandle = NULL;
4830 	char zonepath[MAXPATHLEN];
4831 	char brand[MAXNAMELEN], atbrand[MAXNAMELEN];
4832 	boolean_t execute = B_TRUE;
4833 	boolean_t retried = B_FALSE;
4834 	char *manifest_path;
4835 
4836 	if (zonecfg_in_alt_root()) {
4837 		zerror(gettext("cannot attach zone in alternate root"));
4838 		return (Z_ERR);
4839 	}
4840 
4841 	optind = 0;
4842 	if ((arg = getopt(argc, argv, "?Fn:")) != EOF) {
4843 		switch (arg) {
4844 		case '?':
4845 			sub_usage(SHELP_ATTACH, CMD_ATTACH);
4846 			return (optopt == '?' ? Z_OK : Z_USAGE);
4847 		case 'F':
4848 			force = B_TRUE;
4849 			break;
4850 		case 'n':
4851 			execute = B_FALSE;
4852 			manifest_path = optarg;
4853 			break;
4854 		default:
4855 			sub_usage(SHELP_ATTACH, CMD_ATTACH);
4856 			return (Z_USAGE);
4857 		}
4858 	}
4859 
4860 	/*
4861 	 * If the no-execute option was specified, we need to branch down
4862 	 * a completely different path since there is no zone required to be
4863 	 * configured for this option.
4864 	 */
4865 	if (!execute)
4866 		return (dryrun_attach(manifest_path, argv));
4867 
4868 	if (sanity_check(target_zone, CMD_ATTACH, B_FALSE, B_TRUE, B_FALSE)
4869 	    != Z_OK)
4870 		return (Z_ERR);
4871 	if (verify_details(CMD_ATTACH, argv) != Z_OK)
4872 		return (Z_ERR);
4873 
4874 	if ((err = zone_get_zonepath(target_zone, zonepath, sizeof (zonepath)))
4875 	    != Z_OK) {
4876 		errno = err;
4877 		zperror2(target_zone, gettext("could not get zone path"));
4878 		return (Z_ERR);
4879 	}
4880 
4881 	if ((handle = zonecfg_init_handle()) == NULL) {
4882 		zperror(cmd_to_str(CMD_ATTACH), B_TRUE);
4883 		return (Z_ERR);
4884 	}
4885 
4886 	if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) {
4887 		errno = err;
4888 		zperror(cmd_to_str(CMD_ATTACH), B_TRUE);
4889 		zonecfg_fini_handle(handle);
4890 		return (Z_ERR);
4891 	}
4892 
4893 	if (grab_lock_file(target_zone, &lockfd) != Z_OK) {
4894 		zerror(gettext("another %s may have an operation in progress."),
4895 		    "zoneadm");
4896 		zonecfg_fini_handle(handle);
4897 		return (Z_ERR);
4898 	}
4899 
4900 	if (force)
4901 		goto forced;
4902 
4903 	if ((athandle = zonecfg_init_handle()) == NULL) {
4904 		zperror(cmd_to_str(CMD_ATTACH), B_TRUE);
4905 		goto done;
4906 	}
4907 
4908 retry:
4909 	if ((err = zonecfg_get_attach_handle(zonepath, target_zone, B_TRUE,
4910 	    athandle)) != Z_OK) {
4911 		if (err == Z_NO_ZONE) {
4912 			/*
4913 			 * Zone was not detached.  Try to fall back to getting
4914 			 * the needed information from within the zone.
4915 			 * However, we can only try to generate the attach
4916 			 * information for native branded zones, so fail if the
4917 			 * zone is not native.
4918 			 */
4919 			if (!is_native_zone) {
4920 				zerror(gettext("Not a detached zone."));
4921 				goto done;
4922 			}
4923 
4924 			if (!retried) {
4925 				zerror(gettext("The zone was not properly "
4926 				    "detached.\n\tAttempting to attach "
4927 				    "anyway."));
4928 				if (gen_detach_info(zonepath)) {
4929 					retried = B_TRUE;
4930 					goto retry;
4931 				}
4932 			}
4933 			zerror(gettext("Cannot generate the information "
4934 			    "needed to attach this zone."));
4935 		} else if (err == Z_INVALID_DOCUMENT) {
4936 			zerror(gettext("Cannot attach to an earlier release "
4937 			    "of the operating system"));
4938 		} else {
4939 			zperror(cmd_to_str(CMD_ATTACH), B_TRUE);
4940 		}
4941 		goto done;
4942 	}
4943 
4944 	/* Get the detach information for the locally defined zone. */
4945 	if ((err = zonecfg_get_detach_info(handle, B_FALSE)) != Z_OK) {
4946 		errno = err;
4947 		zperror(gettext("getting the attach information failed"),
4948 		    B_TRUE);
4949 		goto done;
4950 	}
4951 
4952 	/*
4953 	 * Ensure that the detached and locally defined zones are both of
4954 	 * the same brand.
4955 	 */
4956 	if ((zonecfg_get_brand(handle, brand, sizeof (brand)) != 0) ||
4957 	    (zonecfg_get_brand(athandle, atbrand, sizeof (atbrand)) != 0)) {
4958 		err = Z_ERR;
4959 		zerror(gettext("missing or invalid brand"));
4960 		goto done;
4961 	}
4962 
4963 	if (strcmp(atbrand, brand) != NULL) {
4964 		err = Z_ERR;
4965 		zerror(gettext("Trying to attach a '%s' zone to a '%s' "
4966 		    "configuration."), atbrand, brand);
4967 		goto done;
4968 	}
4969 
4970 	/* sw_cmp prints error msgs as necessary */
4971 	if ((err = sw_cmp(handle, athandle, SW_CMP_NONE)) != Z_OK)
4972 		goto done;
4973 
4974 	if ((err = dev_fix(athandle)) != Z_OK)
4975 		goto done;
4976 
4977 forced:
4978 
4979 	zonecfg_rm_detached(handle, force);
4980 
4981 	if ((err = zone_set_state(target_zone, ZONE_STATE_INSTALLED)) != Z_OK) {
4982 		errno = err;
4983 		zperror(gettext("could not reset state"), B_TRUE);
4984 	}
4985 
4986 done:
4987 	zonecfg_fini_handle(handle);
4988 	release_lock_file(lockfd);
4989 	if (athandle != NULL)
4990 		zonecfg_fini_handle(athandle);
4991 
4992 	return ((err == Z_OK) ? Z_OK : Z_ERR);
4993 }
4994 
4995 /*
4996  * On input, TRUE => yes, FALSE => no.
4997  * On return, TRUE => 1, FALSE => 0, could not ask => -1.
4998  */
4999 
5000 static int
5001 ask_yesno(boolean_t default_answer, const char *question)
5002 {
5003 	char line[64];	/* should be large enough to answer yes or no */
5004 
5005 	if (!isatty(STDIN_FILENO))
5006 		return (-1);
5007 	for (;;) {
5008 		(void) printf("%s (%s)? ", question,
5009 		    default_answer ? "[y]/n" : "y/[n]");
5010 		if (fgets(line, sizeof (line), stdin) == NULL ||
5011 		    line[0] == '\n')
5012 			return (default_answer ? 1 : 0);
5013 		if (tolower(line[0]) == 'y')
5014 			return (1);
5015 		if (tolower(line[0]) == 'n')
5016 			return (0);
5017 	}
5018 }
5019 
5020 static int
5021 uninstall_func(int argc, char *argv[])
5022 {
5023 	char line[ZONENAME_MAX + 128];	/* Enough for "Are you sure ..." */
5024 	char rootpath[MAXPATHLEN], zonepath[MAXPATHLEN];
5025 	boolean_t force = B_FALSE;
5026 	int lockfd, answer;
5027 	int err, arg;
5028 
5029 	if (zonecfg_in_alt_root()) {
5030 		zerror(gettext("cannot uninstall zone in alternate root"));
5031 		return (Z_ERR);
5032 	}
5033 
5034 	optind = 0;
5035 	while ((arg = getopt(argc, argv, "?F")) != EOF) {
5036 		switch (arg) {
5037 		case '?':
5038 			sub_usage(SHELP_UNINSTALL, CMD_UNINSTALL);
5039 			return (optopt == '?' ? Z_OK : Z_USAGE);
5040 		case 'F':
5041 			force = B_TRUE;
5042 			break;
5043 		default:
5044 			sub_usage(SHELP_UNINSTALL, CMD_UNINSTALL);
5045 			return (Z_USAGE);
5046 		}
5047 	}
5048 	if (argc > optind) {
5049 		sub_usage(SHELP_UNINSTALL, CMD_UNINSTALL);
5050 		return (Z_USAGE);
5051 	}
5052 
5053 	if (sanity_check(target_zone, CMD_UNINSTALL, B_FALSE, B_TRUE, B_FALSE)
5054 	    != Z_OK)
5055 		return (Z_ERR);
5056 
5057 	/*
5058 	 * Invoke brand-specific handler.
5059 	 */
5060 	if (invoke_brand_handler(CMD_UNINSTALL, argv) != Z_OK)
5061 		return (Z_ERR);
5062 
5063 	if (!force) {
5064 		(void) snprintf(line, sizeof (line),
5065 		    gettext("Are you sure you want to %s zone %s"),
5066 		    cmd_to_str(CMD_UNINSTALL), target_zone);
5067 		if ((answer = ask_yesno(B_FALSE, line)) == 0) {
5068 			return (Z_OK);
5069 		} else if (answer == -1) {
5070 			zerror(gettext("Input not from terminal and -F "
5071 			    "not specified: %s not done."),
5072 			    cmd_to_str(CMD_UNINSTALL));
5073 			return (Z_ERR);
5074 		}
5075 	}
5076 
5077 	if ((err = zone_get_zonepath(target_zone, zonepath,
5078 	    sizeof (zonepath))) != Z_OK) {
5079 		errno = err;
5080 		zperror2(target_zone, gettext("could not get zone path"));
5081 		return (Z_ERR);
5082 	}
5083 	if ((err = zone_get_rootpath(target_zone, rootpath,
5084 	    sizeof (rootpath))) != Z_OK) {
5085 		errno = err;
5086 		zperror2(target_zone, gettext("could not get root path"));
5087 		return (Z_ERR);
5088 	}
5089 
5090 	/*
5091 	 * If there seems to be a zoneadmd running for this zone, call it
5092 	 * to tell it that an uninstall is happening; if all goes well it
5093 	 * will then shut itself down.
5094 	 */
5095 	if (ping_zoneadmd(target_zone) == Z_OK) {
5096 		zone_cmd_arg_t zarg;
5097 		zarg.cmd = Z_NOTE_UNINSTALLING;
5098 		/* we don't care too much if this fails... just plow on */
5099 		(void) call_zoneadmd(target_zone, &zarg);
5100 	}
5101 
5102 	if (grab_lock_file(target_zone, &lockfd) != Z_OK) {
5103 		zerror(gettext("another %s may have an operation in progress."),
5104 		    "zoneadm");
5105 		return (Z_ERR);
5106 	}
5107 
5108 	/* Don't uninstall the zone if anything is mounted there */
5109 	err = zonecfg_find_mounts(rootpath, NULL, NULL);
5110 	if (err) {
5111 		zerror(gettext("These file systems are mounted on "
5112 		    "subdirectories of %s.\n"), rootpath);
5113 		(void) zonecfg_find_mounts(rootpath, zfm_print, NULL);
5114 		return (Z_ERR);
5115 	}
5116 
5117 	err = zone_set_state(target_zone, ZONE_STATE_INCOMPLETE);
5118 	if (err != Z_OK) {
5119 		errno = err;
5120 		zperror2(target_zone, gettext("could not set state"));
5121 		goto bad;
5122 	}
5123 
5124 	if ((err = cleanup_zonepath(zonepath, B_FALSE)) != Z_OK) {
5125 		errno = err;
5126 		zperror2(target_zone, gettext("cleaning up zonepath failed"));
5127 		goto bad;
5128 	}
5129 
5130 	err = zone_set_state(target_zone, ZONE_STATE_CONFIGURED);
5131 	if (err != Z_OK) {
5132 		errno = err;
5133 		zperror2(target_zone, gettext("could not reset state"));
5134 	}
5135 bad:
5136 	release_lock_file(lockfd);
5137 	return (err);
5138 }
5139 
5140 /* ARGSUSED */
5141 static int
5142 mount_func(int argc, char *argv[])
5143 {
5144 	zone_cmd_arg_t zarg;
5145 	boolean_t force = B_FALSE;
5146 	int arg;
5147 
5148 	/*
5149 	 * The only supported subargument to the "mount" subcommand is
5150 	 * "-f", which forces us to mount a zone in the INCOMPLETE state.
5151 	 */
5152 	optind = 0;
5153 	if ((arg = getopt(argc, argv, "f")) != EOF) {
5154 		switch (arg) {
5155 		case 'f':
5156 			force = B_TRUE;
5157 			break;
5158 		default:
5159 			return (Z_USAGE);
5160 		}
5161 	}
5162 	if (argc > optind)
5163 		return (Z_USAGE);
5164 
5165 	if (sanity_check(target_zone, CMD_MOUNT, B_FALSE, B_FALSE, force)
5166 	    != Z_OK)
5167 		return (Z_ERR);
5168 	if (verify_details(CMD_MOUNT, argv) != Z_OK)
5169 		return (Z_ERR);
5170 
5171 	zarg.cmd = force ? Z_FORCEMOUNT : Z_MOUNT;
5172 	if (call_zoneadmd(target_zone, &zarg) != 0) {
5173 		zerror(gettext("call to %s failed"), "zoneadmd");
5174 		return (Z_ERR);
5175 	}
5176 	return (Z_OK);
5177 }
5178 
5179 /* ARGSUSED */
5180 static int
5181 unmount_func(int argc, char *argv[])
5182 {
5183 	zone_cmd_arg_t zarg;
5184 
5185 	if (argc > 0)
5186 		return (Z_USAGE);
5187 	if (sanity_check(target_zone, CMD_UNMOUNT, B_FALSE, B_FALSE, B_FALSE)
5188 	    != Z_OK)
5189 		return (Z_ERR);
5190 
5191 	zarg.cmd = Z_UNMOUNT;
5192 	if (call_zoneadmd(target_zone, &zarg) != 0) {
5193 		zerror(gettext("call to %s failed"), "zoneadmd");
5194 		return (Z_ERR);
5195 	}
5196 	return (Z_OK);
5197 }
5198 
5199 static int
5200 mark_func(int argc, char *argv[])
5201 {
5202 	int err, lockfd;
5203 
5204 	if (argc != 1 || strcmp(argv[0], "incomplete") != 0)
5205 		return (Z_USAGE);
5206 	if (sanity_check(target_zone, CMD_MARK, B_FALSE, B_FALSE, B_FALSE)
5207 	    != Z_OK)
5208 		return (Z_ERR);
5209 
5210 	/*
5211 	 * Invoke brand-specific handler.
5212 	 */
5213 	if (invoke_brand_handler(CMD_MARK, argv) != Z_OK)
5214 		return (Z_ERR);
5215 
5216 	if (grab_lock_file(target_zone, &lockfd) != Z_OK) {
5217 		zerror(gettext("another %s may have an operation in progress."),
5218 		    "zoneadm");
5219 		return (Z_ERR);
5220 	}
5221 
5222 	err = zone_set_state(target_zone, ZONE_STATE_INCOMPLETE);
5223 	if (err != Z_OK) {
5224 		errno = err;
5225 		zperror2(target_zone, gettext("could not set state"));
5226 	}
5227 	release_lock_file(lockfd);
5228 
5229 	return (err);
5230 }
5231 
5232 /*
5233  * Check what scheduling class we're running under and print a warning if
5234  * we're not using FSS.
5235  */
5236 static int
5237 check_sched_fss(zone_dochandle_t handle)
5238 {
5239 	char class_name[PC_CLNMSZ];
5240 
5241 	if (zonecfg_get_dflt_sched_class(handle, class_name,
5242 	    sizeof (class_name)) != Z_OK) {
5243 		zerror(gettext("WARNING: unable to determine the zone's "
5244 		    "scheduling class"));
5245 	} else if (strcmp("FSS", class_name) != 0) {
5246 		zerror(gettext("WARNING: The zone.cpu-shares rctl is set but\n"
5247 		    "FSS is not the default scheduling class for this zone.  "
5248 		    "FSS will be\nused for processes in the zone but to get "
5249 		    "the full benefit of FSS,\nit should be the default "
5250 		    "scheduling class.  See dispadmin(1M) for\nmore details."));
5251 		return (Z_SYSTEM);
5252 	}
5253 
5254 	return (Z_OK);
5255 }
5256 
5257 static int
5258 check_cpu_shares_sched(zone_dochandle_t handle)
5259 {
5260 	int err;
5261 	int res = Z_OK;
5262 	struct zone_rctltab rctl;
5263 
5264 	if ((err = zonecfg_setrctlent(handle)) != Z_OK) {
5265 		errno = err;
5266 		zperror(cmd_to_str(CMD_APPLY), B_TRUE);
5267 		return (err);
5268 	}
5269 
5270 	while (zonecfg_getrctlent(handle, &rctl) == Z_OK) {
5271 		if (strcmp(rctl.zone_rctl_name, "zone.cpu-shares") == 0) {
5272 			if (check_sched_fss(handle) != Z_OK)
5273 				res = Z_SYSTEM;
5274 			break;
5275 		}
5276 	}
5277 
5278 	(void) zonecfg_endrctlent(handle);
5279 
5280 	return (res);
5281 }
5282 
5283 /*
5284  * Check if there is a mix of processes running in different pools within the
5285  * zone.  This is currently only going to be called for the global zone from
5286  * apply_func but that could be generalized in the future.
5287  */
5288 static boolean_t
5289 mixed_pools(zoneid_t zoneid)
5290 {
5291 	DIR *dirp;
5292 	dirent_t *dent;
5293 	boolean_t mixed = B_FALSE;
5294 	boolean_t poolid_set = B_FALSE;
5295 	poolid_t last_poolid = 0;
5296 
5297 	if ((dirp = opendir("/proc")) == NULL) {
5298 		zerror(gettext("could not open /proc"));
5299 		return (B_FALSE);
5300 	}
5301 
5302 	while ((dent = readdir(dirp)) != NULL) {
5303 		int procfd;
5304 		psinfo_t ps;
5305 		char procpath[MAXPATHLEN];
5306 
5307 		if (dent->d_name[0] == '.')
5308 			continue;
5309 
5310 		(void) snprintf(procpath, sizeof (procpath), "/proc/%s/psinfo",
5311 		    dent->d_name);
5312 
5313 		if ((procfd = open(procpath, O_RDONLY)) == -1)
5314 			continue;
5315 
5316 		if (read(procfd, &ps, sizeof (ps)) == sizeof (psinfo_t)) {
5317 			/* skip processes in other zones and system processes */
5318 			if (zoneid != ps.pr_zoneid || ps.pr_flag & SSYS) {
5319 				(void) close(procfd);
5320 				continue;
5321 			}
5322 
5323 			if (poolid_set) {
5324 				if (ps.pr_poolid != last_poolid)
5325 					mixed = B_TRUE;
5326 			} else {
5327 				last_poolid = ps.pr_poolid;
5328 				poolid_set = B_TRUE;
5329 			}
5330 		}
5331 
5332 		(void) close(procfd);
5333 
5334 		if (mixed)
5335 			break;
5336 	}
5337 
5338 	(void) closedir(dirp);
5339 
5340 	return (mixed);
5341 }
5342 
5343 /*
5344  * Check if a persistent or temporary pool is configured for the zone.
5345  * This is currently only going to be called for the global zone from
5346  * apply_func but that could be generalized in the future.
5347  */
5348 static boolean_t
5349 pool_configured(zone_dochandle_t handle)
5350 {
5351 	int err1, err2;
5352 	struct zone_psettab pset_tab;
5353 	char poolname[MAXPATHLEN];
5354 
5355 	err1 = zonecfg_lookup_pset(handle, &pset_tab);
5356 	err2 = zonecfg_get_pool(handle, poolname, sizeof (poolname));
5357 
5358 	if (err1 == Z_NO_ENTRY &&
5359 	    (err2 == Z_NO_ENTRY || (err2 == Z_OK && strlen(poolname) == 0)))
5360 		return (B_FALSE);
5361 
5362 	return (B_TRUE);
5363 }
5364 
5365 /*
5366  * This is an undocumented interface which is currently only used to apply
5367  * the global zone resource management settings when the system boots.
5368  * This function does not yet properly handle updating a running system so
5369  * any projects running in the zone would be trashed if this function
5370  * were to run after the zone had booted.  It also does not reset any
5371  * rctl settings that were removed from zonecfg.  There is still work to be
5372  * done before we can properly support dynamically updating the resource
5373  * management settings for a running zone (global or non-global).  Thus, this
5374  * functionality is undocumented for now.
5375  */
5376 /* ARGSUSED */
5377 static int
5378 apply_func(int argc, char *argv[])
5379 {
5380 	int err;
5381 	int res = Z_OK;
5382 	priv_set_t *privset;
5383 	zoneid_t zoneid;
5384 	zone_dochandle_t handle;
5385 	struct zone_mcaptab mcap;
5386 	char pool_err[128];
5387 
5388 	zoneid = getzoneid();
5389 
5390 	if (zonecfg_in_alt_root() || zoneid != GLOBAL_ZONEID ||
5391 	    target_zone == NULL || strcmp(target_zone, GLOBAL_ZONENAME) != 0)
5392 		return (usage(B_FALSE));
5393 
5394 	if ((privset = priv_allocset()) == NULL) {
5395 		zerror(gettext("%s failed"), "priv_allocset");
5396 		return (Z_ERR);
5397 	}
5398 
5399 	if (getppriv(PRIV_EFFECTIVE, privset) != 0) {
5400 		zerror(gettext("%s failed"), "getppriv");
5401 		priv_freeset(privset);
5402 		return (Z_ERR);
5403 	}
5404 
5405 	if (priv_isfullset(privset) == B_FALSE) {
5406 		(void) usage(B_FALSE);
5407 		priv_freeset(privset);
5408 		return (Z_ERR);
5409 	}
5410 	priv_freeset(privset);
5411 
5412 	if ((handle = zonecfg_init_handle()) == NULL) {
5413 		zperror(cmd_to_str(CMD_APPLY), B_TRUE);
5414 		return (Z_ERR);
5415 	}
5416 
5417 	if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) {
5418 		errno = err;
5419 		zperror(cmd_to_str(CMD_APPLY), B_TRUE);
5420 		zonecfg_fini_handle(handle);
5421 		return (Z_ERR);
5422 	}
5423 
5424 	/* specific error msgs are printed within apply_rctls */
5425 	if ((err = zonecfg_apply_rctls(target_zone, handle)) != Z_OK) {
5426 		errno = err;
5427 		zperror(cmd_to_str(CMD_APPLY), B_TRUE);
5428 		res = Z_ERR;
5429 	}
5430 
5431 	if ((err = check_cpu_shares_sched(handle)) != Z_OK)
5432 		res = Z_ERR;
5433 
5434 	if (pool_configured(handle)) {
5435 		if (mixed_pools(zoneid)) {
5436 			zerror(gettext("Zone is using multiple resource "
5437 			    "pools.  The pool\nconfiguration cannot be "
5438 			    "applied without rebooting."));
5439 			res = Z_ERR;
5440 		} else {
5441 
5442 			/*
5443 			 * The next two blocks of code attempt to set up
5444 			 * temporary pools as well as persistent pools.  In
5445 			 * both cases we call the functions unconditionally.
5446 			 * Within each funtion the code will check if the zone
5447 			 * is actually configured for a temporary pool or
5448 			 * persistent pool and just return if there is nothing
5449 			 * to do.
5450 			 */
5451 			if ((err = zonecfg_bind_tmp_pool(handle, zoneid,
5452 			    pool_err, sizeof (pool_err))) != Z_OK) {
5453 				if (err == Z_POOL || err == Z_POOL_CREATE ||
5454 				    err == Z_POOL_BIND)
5455 					zerror("%s: %s", zonecfg_strerror(err),
5456 					    pool_err);
5457 				else
5458 					zerror(gettext("could not bind zone to "
5459 					    "temporary pool: %s"),
5460 					    zonecfg_strerror(err));
5461 				res = Z_ERR;
5462 			}
5463 
5464 			if ((err = zonecfg_bind_pool(handle, zoneid, pool_err,
5465 			    sizeof (pool_err))) != Z_OK) {
5466 				if (err == Z_POOL || err == Z_POOL_BIND)
5467 					zerror("%s: %s", zonecfg_strerror(err),
5468 					    pool_err);
5469 				else
5470 					zerror("%s", zonecfg_strerror(err));
5471 			}
5472 		}
5473 	}
5474 
5475 	/*
5476 	 * If a memory cap is configured, set the cap in the kernel using
5477 	 * zone_setattr() and make sure the rcapd SMF service is enabled.
5478 	 */
5479 	if (zonecfg_getmcapent(handle, &mcap) == Z_OK) {
5480 		uint64_t num;
5481 		char smf_err[128];
5482 
5483 		num = (uint64_t)strtoll(mcap.zone_physmem_cap, NULL, 10);
5484 		if (zone_setattr(zoneid, ZONE_ATTR_PHYS_MCAP, &num, 0) == -1) {
5485 			zerror(gettext("could not set zone memory cap"));
5486 			res = Z_ERR;
5487 		}
5488 
5489 		if (zonecfg_enable_rcapd(smf_err, sizeof (smf_err)) != Z_OK) {
5490 			zerror(gettext("enabling system/rcap service failed: "
5491 			    "%s"), smf_err);
5492 			res = Z_ERR;
5493 		}
5494 	}
5495 
5496 	zonecfg_fini_handle(handle);
5497 
5498 	return (res);
5499 }
5500 
5501 static int
5502 help_func(int argc, char *argv[])
5503 {
5504 	int arg, cmd_num;
5505 
5506 	if (argc == 0) {
5507 		(void) usage(B_TRUE);
5508 		return (Z_OK);
5509 	}
5510 	optind = 0;
5511 	if ((arg = getopt(argc, argv, "?")) != EOF) {
5512 		switch (arg) {
5513 		case '?':
5514 			sub_usage(SHELP_HELP, CMD_HELP);
5515 			return (optopt == '?' ? Z_OK : Z_USAGE);
5516 		default:
5517 			sub_usage(SHELP_HELP, CMD_HELP);
5518 			return (Z_USAGE);
5519 		}
5520 	}
5521 	while (optind < argc) {
5522 		/* Private commands have NULL short_usage; omit them */
5523 		if ((cmd_num = cmd_match(argv[optind])) < 0 ||
5524 		    cmdtab[cmd_num].short_usage == NULL) {
5525 			sub_usage(SHELP_HELP, CMD_HELP);
5526 			return (Z_USAGE);
5527 		}
5528 		sub_usage(cmdtab[cmd_num].short_usage, cmd_num);
5529 		optind++;
5530 	}
5531 	return (Z_OK);
5532 }
5533 
5534 /*
5535  * Returns: CMD_MIN thru CMD_MAX on success, -1 on error
5536  */
5537 
5538 static int
5539 cmd_match(char *cmd)
5540 {
5541 	int i;
5542 
5543 	for (i = CMD_MIN; i <= CMD_MAX; i++) {
5544 		/* return only if there is an exact match */
5545 		if (strcmp(cmd, cmdtab[i].cmd_name) == 0)
5546 			return (cmdtab[i].cmd_num);
5547 	}
5548 	return (-1);
5549 }
5550 
5551 static int
5552 parse_and_run(int argc, char *argv[])
5553 {
5554 	int i = cmd_match(argv[0]);
5555 
5556 	if (i < 0)
5557 		return (usage(B_FALSE));
5558 	return (cmdtab[i].handler(argc - 1, &(argv[1])));
5559 }
5560 
5561 static char *
5562 get_execbasename(char *execfullname)
5563 {
5564 	char *last_slash, *execbasename;
5565 
5566 	/* guard against '/' at end of command invocation */
5567 	for (;;) {
5568 		last_slash = strrchr(execfullname, '/');
5569 		if (last_slash == NULL) {
5570 			execbasename = execfullname;
5571 			break;
5572 		} else {
5573 			execbasename = last_slash + 1;
5574 			if (*execbasename == '\0') {
5575 				*last_slash = '\0';
5576 				continue;
5577 			}
5578 			break;
5579 		}
5580 	}
5581 	return (execbasename);
5582 }
5583 
5584 int
5585 main(int argc, char **argv)
5586 {
5587 	int arg;
5588 	zoneid_t zid;
5589 	struct stat st;
5590 	char *zone_lock_env;
5591 	int err;
5592 
5593 	if ((locale = setlocale(LC_ALL, "")) == NULL)
5594 		locale = "C";
5595 	(void) textdomain(TEXT_DOMAIN);
5596 	setbuf(stdout, NULL);
5597 	(void) sigset(SIGHUP, SIG_IGN);
5598 	execname = get_execbasename(argv[0]);
5599 	target_zone = NULL;
5600 	if (chdir("/") != 0) {
5601 		zerror(gettext("could not change directory to /."));
5602 		exit(Z_ERR);
5603 	}
5604 
5605 	if (init_zfs() != Z_OK)
5606 		exit(Z_ERR);
5607 
5608 	while ((arg = getopt(argc, argv, "?u:z:R:")) != EOF) {
5609 		switch (arg) {
5610 		case '?':
5611 			return (usage(B_TRUE));
5612 		case 'u':
5613 			target_uuid = optarg;
5614 			break;
5615 		case 'z':
5616 			target_zone = optarg;
5617 			break;
5618 		case 'R':	/* private option for admin/install use */
5619 			if (*optarg != '/') {
5620 				zerror(gettext("root path must be absolute."));
5621 				exit(Z_ERR);
5622 			}
5623 			if (stat(optarg, &st) == -1 || !S_ISDIR(st.st_mode)) {
5624 				zerror(
5625 				    gettext("root path must be a directory."));
5626 				exit(Z_ERR);
5627 			}
5628 			zonecfg_set_root(optarg);
5629 			break;
5630 		default:
5631 			return (usage(B_FALSE));
5632 		}
5633 	}
5634 
5635 	if (optind >= argc)
5636 		return (usage(B_FALSE));
5637 
5638 	if (target_uuid != NULL && *target_uuid != '\0') {
5639 		uuid_t uuid;
5640 		static char newtarget[ZONENAME_MAX];
5641 
5642 		if (uuid_parse(target_uuid, uuid) == -1) {
5643 			zerror(gettext("illegal UUID value specified"));
5644 			exit(Z_ERR);
5645 		}
5646 		if (zonecfg_get_name_by_uuid(uuid, newtarget,
5647 		    sizeof (newtarget)) == Z_OK)
5648 			target_zone = newtarget;
5649 	}
5650 
5651 	if (target_zone != NULL && zone_get_id(target_zone, &zid) != 0) {
5652 		errno = Z_NO_ZONE;
5653 		zperror(target_zone, B_TRUE);
5654 		exit(Z_ERR);
5655 	}
5656 
5657 	/*
5658 	 * See if we have inherited the right to manipulate this zone from
5659 	 * a zoneadm instance in our ancestry.  If so, set zone_lock_cnt to
5660 	 * indicate it.  If not, make that explicit in our environment.
5661 	 */
5662 	zone_lock_env = getenv(LOCK_ENV_VAR);
5663 	if (zone_lock_env == NULL) {
5664 		if (putenv(zoneadm_lock_not_held) != 0) {
5665 			zperror(target_zone, B_TRUE);
5666 			exit(Z_ERR);
5667 		}
5668 	} else {
5669 		zoneadm_is_nested = B_TRUE;
5670 		if (atoi(zone_lock_env) == 1)
5671 			zone_lock_cnt = 1;
5672 	}
5673 
5674 	/*
5675 	 * If we are going to be operating on a single zone, retrieve its
5676 	 * brand type and determine whether it is native or not.
5677 	 */
5678 	if ((target_zone != NULL) &&
5679 	    (strcmp(target_zone, GLOBAL_ZONENAME) != NULL)) {
5680 		if (zone_get_brand(target_zone, target_brand,
5681 		    sizeof (target_brand)) != Z_OK) {
5682 			zerror(gettext("missing or invalid brand"));
5683 			exit(Z_ERR);
5684 		}
5685 		is_native_zone = (strcmp(target_brand, NATIVE_BRAND_NAME) == 0);
5686 	}
5687 
5688 	err = parse_and_run(argc - optind, &argv[optind]);
5689 
5690 	return (err);
5691 }
5692