1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22/*
23 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright (c) 2013, Joyent Inc. All rights reserved.
25 * Copyright (c) 2015, 2016 by Delphix. All rights reserved.
26 * Copyright 2019 OmniOS Community Edition (OmniOSce) Association.
27 */
28
29/*
30 * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
31 */
32
33/*
34 * This module contains functions used to bring up and tear down the
35 * Virtual Platform: [un]mounting file-systems, [un]plumbing network
36 * interfaces, [un]configuring devices, establishing resource controls,
37 * and creating/destroying the zone in the kernel.  These actions, on
38 * the way up, ready the zone; on the way down, they halt the zone.
39 * See the much longer block comment at the beginning of zoneadmd.c
40 * for a bigger picture of how the whole program functions.
41 *
42 * This module also has primary responsibility for the layout of "scratch
43 * zones."  These are mounted, but inactive, zones that are used during
44 * operating system upgrade and potentially other administrative action.  The
45 * scratch zone environment is similar to the miniroot environment.  The zone's
46 * actual root is mounted read-write on /a, and the standard paths (/usr,
47 * /sbin, /lib) all lead to read-only copies of the running system's binaries.
48 * This allows the administrative tools to manipulate the zone using "-R /a"
49 * without relying on any binaries in the zone itself.
50 *
51 * If the scratch zone is on an alternate root (Live Upgrade [LU] boot
52 * environment), then we must resolve the lofs mounts used there to uncover
53 * writable (unshared) resources.  Shared resources, though, are always
54 * read-only.  In addition, if the "same" zone with a different root path is
55 * currently running, then "/b" inside the zone points to the running zone's
56 * root.  This allows LU to synchronize configuration files during the upgrade
57 * process.
58 *
59 * To construct this environment, this module creates a tmpfs mount on
60 * $ZONEPATH/lu.  Inside this scratch area, the miniroot-like environment as
61 * described above is constructed on the fly.  The zone is then created using
62 * $ZONEPATH/lu as the root.
63 *
64 * Note that scratch zones are inactive.  The zone's bits are not running and
65 * likely cannot be run correctly until upgrade is done.  Init is not running
66 * there, nor is SMF.  Because of this, the "mounted" state of a scratch zone
67 * is not a part of the usual halt/ready/boot state machine.
68 */
69
70#include <sys/param.h>
71#include <sys/mount.h>
72#include <sys/mntent.h>
73#include <sys/socket.h>
74#include <sys/utsname.h>
75#include <sys/types.h>
76#include <sys/stat.h>
77#include <sys/sockio.h>
78#include <sys/stropts.h>
79#include <sys/conf.h>
80#include <sys/systeminfo.h>
81#include <sys/secflags.h>
82
83#include <libdlpi.h>
84#include <libdllink.h>
85#include <libdlvlan.h>
86
87#include <inet/tcp.h>
88#include <arpa/inet.h>
89#include <netinet/in.h>
90#include <net/route.h>
91
92#include <stdio.h>
93#include <errno.h>
94#include <fcntl.h>
95#include <unistd.h>
96#include <rctl.h>
97#include <stdlib.h>
98#include <string.h>
99#include <strings.h>
100#include <wait.h>
101#include <limits.h>
102#include <libgen.h>
103#include <libzfs.h>
104#include <libdevinfo.h>
105#include <zone.h>
106#include <assert.h>
107#include <libcontract.h>
108#include <libcontract_priv.h>
109#include <uuid/uuid.h>
110
111#include <sys/mntio.h>
112#include <sys/mnttab.h>
113#include <sys/fs/autofs.h>	/* for _autofssys() */
114#include <sys/fs/lofs_info.h>
115#include <sys/fs/zfs.h>
116
117#include <pool.h>
118#include <sys/pool.h>
119#include <sys/priocntl.h>
120
121#include <libbrand.h>
122#include <sys/brand.h>
123#include <libzonecfg.h>
124#include <synch.h>
125
126#include "zoneadmd.h"
127#include <tsol/label.h>
128#include <libtsnet.h>
129#include <sys/priv.h>
130#include <libinetutil.h>
131
132#define	V4_ADDR_LEN	32
133#define	V6_ADDR_LEN	128
134
135#define	RESOURCE_DEFAULT_OPTS \
136	MNTOPT_RO "," MNTOPT_LOFS_NOSUB "," MNTOPT_NODEVICES
137
138#define	DFSTYPES	"/etc/dfs/fstypes"
139#define	MAXTNZLEN	2048
140
141#define	ALT_MOUNT(mount_cmd)	((mount_cmd) != Z_MNT_BOOT)
142
143/* a reasonable estimate for the number of lwps per process */
144#define	LWPS_PER_PROCESS	10
145
146/* for routing socket */
147static int rts_seqno = 0;
148
149/* mangled zone name when mounting in an alternate root environment */
150static char kernzone[ZONENAME_MAX];
151
152/* array of cached mount entries for resolve_lofs */
153static struct mnttab *resolve_lofs_mnts, *resolve_lofs_mnt_max;
154
155/* for Trusted Extensions */
156static tsol_zcent_t *get_zone_label(zlog_t *, priv_set_t *);
157static int tsol_mounts(zlog_t *, char *, char *);
158static void tsol_unmounts(zlog_t *, char *);
159
160static m_label_t *zlabel = NULL;
161static m_label_t *zid_label = NULL;
162static priv_set_t *zprivs = NULL;
163
164static const char *DFLT_FS_ALLOWED = "hsfs,smbfs,nfs,nfs3,nfs4,nfsdyn";
165
166/* from libsocket, not in any header file */
167extern int getnetmaskbyaddr(struct in_addr, struct in_addr *);
168
169/* from zoneadmd */
170extern char query_hook[];
171
172/*
173 * For each "net" resource configured in zonecfg, we track a zone_addr_list_t
174 * node in a linked list that is sorted by linkid.  The list is constructed as
175 * the xml configuration file is parsed, and the information
176 * contained in each node is added to the kernel before the zone is
177 * booted, to be retrieved and applied from within the exclusive-IP NGZ
178 * on boot.
179 */
180typedef struct zone_addr_list {
181	struct zone_addr_list *za_next;
182	datalink_id_t za_linkid;	/* datalink_id_t of interface */
183	struct zone_nwiftab za_nwiftab; /* address, defrouter properties */
184} zone_addr_list_t;
185
186/*
187 * An optimization for build_mnttable: reallocate (and potentially copy the
188 * data) only once every N times through the loop.
189 */
190#define	MNTTAB_HUNK	32
191
192/* some handy macros */
193#define	SIN(s)	((struct sockaddr_in *)s)
194#define	SIN6(s)	((struct sockaddr_in6 *)s)
195
196/*
197 * Private autofs system call
198 */
199extern int _autofssys(int, void *);
200
201static int
202autofs_cleanup(zoneid_t zoneid)
203{
204	/*
205	 * Ask autofs to unmount all trigger nodes in the given zone.
206	 */
207	return (_autofssys(AUTOFS_UNMOUNTALL, (void *)zoneid));
208}
209
210static void
211free_mnttable(struct mnttab *mnt_array, uint_t nelem)
212{
213	uint_t i;
214
215	if (mnt_array == NULL)
216		return;
217	for (i = 0; i < nelem; i++) {
218		free(mnt_array[i].mnt_mountp);
219		free(mnt_array[i].mnt_fstype);
220		free(mnt_array[i].mnt_special);
221		free(mnt_array[i].mnt_mntopts);
222		assert(mnt_array[i].mnt_time == NULL);
223	}
224	free(mnt_array);
225}
226
227/*
228 * Build the mount table for the zone rooted at "zroot", storing the resulting
229 * array of struct mnttabs in "mnt_arrayp" and the number of elements in the
230 * array in "nelemp".
231 */
232static int
233build_mnttable(zlog_t *zlogp, const char *zroot, size_t zrootlen, FILE *mnttab,
234    struct mnttab **mnt_arrayp, uint_t *nelemp)
235{
236	struct mnttab mnt;
237	struct mnttab *mnts;
238	struct mnttab *mnp;
239	uint_t nmnt;
240
241	rewind(mnttab);
242	resetmnttab(mnttab);
243	nmnt = 0;
244	mnts = NULL;
245	while (getmntent(mnttab, &mnt) == 0) {
246		struct mnttab *tmp_array;
247
248		if (strncmp(mnt.mnt_mountp, zroot, zrootlen) != 0)
249			continue;
250		if (nmnt % MNTTAB_HUNK == 0) {
251			tmp_array = realloc(mnts,
252			    (nmnt + MNTTAB_HUNK) * sizeof (*mnts));
253			if (tmp_array == NULL) {
254				free_mnttable(mnts, nmnt);
255				return (-1);
256			}
257			mnts = tmp_array;
258		}
259		mnp = &mnts[nmnt++];
260
261		/*
262		 * Zero out any fields we're not using.
263		 */
264		(void) memset(mnp, 0, sizeof (*mnp));
265
266		if (mnt.mnt_special != NULL)
267			mnp->mnt_special = strdup(mnt.mnt_special);
268		if (mnt.mnt_mntopts != NULL)
269			mnp->mnt_mntopts = strdup(mnt.mnt_mntopts);
270		mnp->mnt_mountp = strdup(mnt.mnt_mountp);
271		mnp->mnt_fstype = strdup(mnt.mnt_fstype);
272		if ((mnt.mnt_special != NULL && mnp->mnt_special == NULL) ||
273		    (mnt.mnt_mntopts != NULL && mnp->mnt_mntopts == NULL) ||
274		    mnp->mnt_mountp == NULL || mnp->mnt_fstype == NULL) {
275			zerror(zlogp, B_TRUE, "memory allocation failed");
276			free_mnttable(mnts, nmnt);
277			return (-1);
278		}
279	}
280	*mnt_arrayp = mnts;
281	*nelemp = nmnt;
282	return (0);
283}
284
285/*
286 * This is an optimization.  The resolve_lofs function is used quite frequently
287 * to manipulate file paths, and on a machine with a large number of zones,
288 * there will be a huge number of mounted file systems.  Thus, we trigger a
289 * reread of the list of mount points
290 */
291static void
292lofs_discard_mnttab(void)
293{
294	free_mnttable(resolve_lofs_mnts,
295	    resolve_lofs_mnt_max - resolve_lofs_mnts);
296	resolve_lofs_mnts = resolve_lofs_mnt_max = NULL;
297}
298
299static int
300lofs_read_mnttab(zlog_t *zlogp)
301{
302	FILE *mnttab;
303	uint_t nmnts;
304
305	if ((mnttab = fopen(MNTTAB, "r")) == NULL)
306		return (-1);
307	if (build_mnttable(zlogp, "", 0, mnttab, &resolve_lofs_mnts,
308	    &nmnts) == -1) {
309		(void) fclose(mnttab);
310		return (-1);
311	}
312	(void) fclose(mnttab);
313	resolve_lofs_mnt_max = resolve_lofs_mnts + nmnts;
314	return (0);
315}
316
317/*
318 * This function loops over potential loopback mounts and symlinks in a given
319 * path and resolves them all down to an absolute path.
320 */
321void
322resolve_lofs(zlog_t *zlogp, char *path, size_t pathlen)
323{
324	int len, arlen;
325	const char *altroot;
326	char tmppath[MAXPATHLEN];
327	boolean_t outside_altroot;
328
329	if ((len = resolvepath(path, tmppath, sizeof (tmppath))) == -1)
330		return;
331	tmppath[len] = '\0';
332	(void) strlcpy(path, tmppath, sizeof (tmppath));
333
334	/* This happens once per zoneadmd operation. */
335	if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
336		return;
337
338	altroot = zonecfg_get_root();
339	arlen = strlen(altroot);
340	outside_altroot = B_FALSE;
341	for (;;) {
342		struct mnttab *mnp;
343
344		/* Search in reverse order to find longest match */
345		for (mnp = resolve_lofs_mnt_max - 1; mnp >= resolve_lofs_mnts;
346		    mnp--) {
347			if (mnp->mnt_fstype == NULL ||
348			    mnp->mnt_mountp == NULL ||
349			    mnp->mnt_special == NULL)
350				continue;
351			len = strlen(mnp->mnt_mountp);
352			if (strncmp(mnp->mnt_mountp, path, len) == 0 &&
353			    (path[len] == '/' || path[len] == '\0'))
354				break;
355		}
356		if (mnp < resolve_lofs_mnts)
357			break;
358		/* If it's not a lofs then we're done */
359		if (strcmp(mnp->mnt_fstype, MNTTYPE_LOFS) != 0)
360			break;
361		if (outside_altroot) {
362			char *cp;
363			int olen = sizeof (MNTOPT_RO) - 1;
364
365			/*
366			 * If we run into a read-only mount outside of the
367			 * alternate root environment, then the user doesn't
368			 * want this path to be made read-write.
369			 */
370			if (mnp->mnt_mntopts != NULL &&
371			    (cp = strstr(mnp->mnt_mntopts, MNTOPT_RO)) !=
372			    NULL &&
373			    (cp == mnp->mnt_mntopts || cp[-1] == ',') &&
374			    (cp[olen] == '\0' || cp[olen] == ',')) {
375				break;
376			}
377		} else if (arlen > 0 &&
378		    (strncmp(mnp->mnt_special, altroot, arlen) != 0 ||
379		    (mnp->mnt_special[arlen] != '\0' &&
380		    mnp->mnt_special[arlen] != '/'))) {
381			outside_altroot = B_TRUE;
382		}
383		/* use temporary buffer because new path might be longer */
384		(void) snprintf(tmppath, sizeof (tmppath), "%s%s",
385		    mnp->mnt_special, path + len);
386		if ((len = resolvepath(tmppath, path, pathlen)) == -1)
387			break;
388		path[len] = '\0';
389	}
390}
391
392/*
393 * For a regular mount, check if a replacement lofs mount is needed because the
394 * referenced device is already mounted somewhere.
395 */
396static int
397check_lofs_needed(zlog_t *zlogp, struct zone_fstab *fsptr)
398{
399	struct mnttab *mnp;
400	zone_fsopt_t *optptr, *onext;
401
402	/* This happens once per zoneadmd operation. */
403	if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
404		return (-1);
405
406	/*
407	 * If this special node isn't already in use, then it's ours alone;
408	 * no need to worry about conflicting mounts.
409	 */
410	for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max;
411	    mnp++) {
412		if (strcmp(mnp->mnt_special, fsptr->zone_fs_special) == 0)
413			break;
414	}
415	if (mnp >= resolve_lofs_mnt_max)
416		return (0);
417
418	/*
419	 * Convert this duplicate mount into a lofs mount.
420	 */
421	(void) strlcpy(fsptr->zone_fs_special, mnp->mnt_mountp,
422	    sizeof (fsptr->zone_fs_special));
423	(void) strlcpy(fsptr->zone_fs_type, MNTTYPE_LOFS,
424	    sizeof (fsptr->zone_fs_type));
425	fsptr->zone_fs_raw[0] = '\0';
426
427	/*
428	 * Discard all but one of the original options and set that to our
429	 * default set of options used for resources.
430	 */
431	optptr = fsptr->zone_fs_options;
432	if (optptr == NULL) {
433		optptr = malloc(sizeof (*optptr));
434		if (optptr == NULL) {
435			zerror(zlogp, B_TRUE, "cannot mount %s",
436			    fsptr->zone_fs_dir);
437			return (-1);
438		}
439	} else {
440		while ((onext = optptr->zone_fsopt_next) != NULL) {
441			optptr->zone_fsopt_next = onext->zone_fsopt_next;
442			free(onext);
443		}
444	}
445	(void) strcpy(optptr->zone_fsopt_opt, RESOURCE_DEFAULT_OPTS);
446	optptr->zone_fsopt_next = NULL;
447	fsptr->zone_fs_options = optptr;
448	return (0);
449}
450
451int
452make_one_dir(zlog_t *zlogp, const char *prefix, const char *subdir, mode_t mode,
453    uid_t userid, gid_t groupid)
454{
455	char path[MAXPATHLEN];
456	struct stat st;
457
458	if (snprintf(path, sizeof (path), "%s%s", prefix, subdir) >
459	    sizeof (path)) {
460		zerror(zlogp, B_FALSE, "pathname %s%s is too long", prefix,
461		    subdir);
462		return (-1);
463	}
464
465	if (lstat(path, &st) == 0) {
466		/*
467		 * We don't check the file mode since presumably the zone
468		 * administrator may have had good reason to change the mode,
469		 * and we don't need to second guess them.
470		 */
471		if (!S_ISDIR(st.st_mode)) {
472			if (S_ISREG(st.st_mode)) {
473				/*
474				 * Allow readonly mounts of /etc/ files; this
475				 * is needed most by Trusted Extensions.
476				 */
477				if (strncmp(subdir, "/etc/",
478				    strlen("/etc/")) != 0) {
479					zerror(zlogp, B_FALSE,
480					    "%s is not in /etc", path);
481					return (-1);
482				}
483			} else {
484				zerror(zlogp, B_FALSE,
485				    "%s is not a directory", path);
486				return (-1);
487			}
488		}
489		return (0);
490	}
491
492	if (mkdirp(path, mode) != 0) {
493		if (errno == EROFS)
494			zerror(zlogp, B_FALSE, "Could not mkdir %s.\nIt is on "
495			    "a read-only file system in this local zone.\nMake "
496			    "sure %s exists in the global zone.", path, subdir);
497		else
498			zerror(zlogp, B_TRUE, "mkdirp of %s failed", path);
499		return (-1);
500	}
501
502	(void) chown(path, userid, groupid);
503	return (0);
504}
505
506static void
507free_remote_fstypes(char **types)
508{
509	uint_t i;
510
511	if (types == NULL)
512		return;
513	for (i = 0; types[i] != NULL; i++)
514		free(types[i]);
515	free(types);
516}
517
518static char **
519get_remote_fstypes(zlog_t *zlogp)
520{
521	char **types = NULL;
522	FILE *fp;
523	char buf[MAXPATHLEN];
524	char fstype[MAXPATHLEN];
525	uint_t lines = 0;
526	uint_t i;
527
528	if ((fp = fopen(DFSTYPES, "r")) == NULL) {
529		zerror(zlogp, B_TRUE, "failed to open %s", DFSTYPES);
530		return (NULL);
531	}
532	/*
533	 * Count the number of lines
534	 */
535	while (fgets(buf, sizeof (buf), fp) != NULL)
536		lines++;
537	if (lines == 0)	/* didn't read anything; empty file */
538		goto out;
539	rewind(fp);
540	/*
541	 * Allocate enough space for a NULL-terminated array.
542	 */
543	types = calloc(lines + 1, sizeof (char *));
544	if (types == NULL) {
545		zerror(zlogp, B_TRUE, "memory allocation failed");
546		goto out;
547	}
548	i = 0;
549	while (fgets(buf, sizeof (buf), fp) != NULL) {
550		/* LINTED - fstype is big enough to hold buf */
551		if (sscanf(buf, "%s", fstype) == 0) {
552			zerror(zlogp, B_FALSE, "unable to parse %s", DFSTYPES);
553			free_remote_fstypes(types);
554			types = NULL;
555			goto out;
556		}
557		types[i] = strdup(fstype);
558		if (types[i] == NULL) {
559			zerror(zlogp, B_TRUE, "memory allocation failed");
560			free_remote_fstypes(types);
561			types = NULL;
562			goto out;
563		}
564		i++;
565	}
566out:
567	(void) fclose(fp);
568	return (types);
569}
570
571static boolean_t
572is_remote_fstype(const char *fstype, char *const *remote_fstypes)
573{
574	uint_t i;
575
576	if (remote_fstypes == NULL)
577		return (B_FALSE);
578	for (i = 0; remote_fstypes[i] != NULL; i++) {
579		if (strcmp(remote_fstypes[i], fstype) == 0)
580			return (B_TRUE);
581	}
582	return (B_FALSE);
583}
584
585/*
586 * This converts a zone root path (normally of the form .../root) to a Live
587 * Upgrade scratch zone root (of the form .../lu).
588 */
589static void
590root_to_lu(zlog_t *zlogp, char *zroot, size_t zrootlen, boolean_t isresolved)
591{
592	if (!isresolved && zonecfg_in_alt_root())
593		resolve_lofs(zlogp, zroot, zrootlen);
594	(void) strcpy(strrchr(zroot, '/') + 1, "lu");
595}
596
597/*
598 * The general strategy for unmounting filesystems is as follows:
599 *
600 * - Remote filesystems may be dead, and attempting to contact them as
601 * part of a regular unmount may hang forever; we want to always try to
602 * forcibly unmount such filesystems and only fall back to regular
603 * unmounts if the filesystem doesn't support forced unmounts.
604 *
605 * - We don't want to unnecessarily corrupt metadata on local
606 * filesystems (ie UFS), so we want to start off with graceful unmounts,
607 * and only escalate to doing forced unmounts if we get stuck.
608 *
609 * We start off walking backwards through the mount table.  This doesn't
610 * give us strict ordering but ensures that we try to unmount submounts
611 * first.  We thus limit the number of failed umount2(2) calls.
612 *
613 * The mechanism for determining if we're stuck is to count the number
614 * of failed unmounts each iteration through the mount table.  This
615 * gives us an upper bound on the number of filesystems which remain
616 * mounted (autofs trigger nodes are dealt with separately).  If at the
617 * end of one unmount+autofs_cleanup cycle we still have the same number
618 * of mounts that we started out with, we're stuck and try a forced
619 * unmount.  If that fails (filesystem doesn't support forced unmounts)
620 * then we bail and are unable to teardown the zone.  If it succeeds,
621 * we're no longer stuck so we continue with our policy of trying
622 * graceful mounts first.
623 *
624 * Zone must be down (ie, no processes or threads active).
625 */
626static int
627unmount_filesystems(zlog_t *zlogp, zoneid_t zoneid, boolean_t unmount_cmd)
628{
629	int error = 0;
630	FILE *mnttab;
631	struct mnttab *mnts;
632	uint_t nmnt;
633	char zroot[MAXPATHLEN + 1];
634	size_t zrootlen;
635	uint_t oldcount = UINT_MAX;
636	boolean_t stuck = B_FALSE;
637	char **remote_fstypes = NULL;
638
639	if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
640		zerror(zlogp, B_FALSE, "unable to determine zone root");
641		return (-1);
642	}
643	if (unmount_cmd)
644		root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
645
646	(void) strcat(zroot, "/");
647	zrootlen = strlen(zroot);
648
649	/*
650	 * For Trusted Extensions unmount each higher level zone's mount
651	 * of our zone's /export/home
652	 */
653	if (!unmount_cmd)
654		tsol_unmounts(zlogp, zone_name);
655
656	if ((mnttab = fopen(MNTTAB, "r")) == NULL) {
657		zerror(zlogp, B_TRUE, "failed to open %s", MNTTAB);
658		return (-1);
659	}
660	/*
661	 * Use our hacky mntfs ioctl so we see everything, even mounts with
662	 * MS_NOMNTTAB.
663	 */
664	if (ioctl(fileno(mnttab), MNTIOC_SHOWHIDDEN, NULL) < 0) {
665		zerror(zlogp, B_TRUE, "unable to configure %s", MNTTAB);
666		error++;
667		goto out;
668	}
669
670	/*
671	 * Build the list of remote fstypes so we know which ones we
672	 * should forcibly unmount.
673	 */
674	remote_fstypes = get_remote_fstypes(zlogp);
675	for (; /* ever */; ) {
676		uint_t newcount = 0;
677		boolean_t unmounted;
678		struct mnttab *mnp;
679		char *path;
680		uint_t i;
681
682		mnts = NULL;
683		nmnt = 0;
684		/*
685		 * MNTTAB gives us a way to walk through mounted
686		 * filesystems; we need to be able to walk them in
687		 * reverse order, so we build a list of all mounted
688		 * filesystems.
689		 */
690		if (build_mnttable(zlogp, zroot, zrootlen, mnttab, &mnts,
691		    &nmnt) != 0) {
692			error++;
693			goto out;
694		}
695		for (i = 0; i < nmnt; i++) {
696			mnp = &mnts[nmnt - i - 1]; /* access in reverse order */
697			path = mnp->mnt_mountp;
698			unmounted = B_FALSE;
699			/*
700			 * Try forced unmount first for remote filesystems.
701			 *
702			 * Not all remote filesystems support forced unmounts,
703			 * so if this fails (ENOTSUP) we'll continue on
704			 * and try a regular unmount.
705			 */
706			if (is_remote_fstype(mnp->mnt_fstype, remote_fstypes)) {
707				if (umount2(path, MS_FORCE) == 0)
708					unmounted = B_TRUE;
709			}
710			/*
711			 * Try forced unmount if we're stuck.
712			 */
713			if (stuck) {
714				if (umount2(path, MS_FORCE) == 0) {
715					unmounted = B_TRUE;
716					stuck = B_FALSE;
717				} else {
718					/*
719					 * The first failure indicates a
720					 * mount we won't be able to get
721					 * rid of automatically, so we
722					 * bail.
723					 */
724					error++;
725					zerror(zlogp, B_FALSE,
726					    "unable to unmount '%s'", path);
727					free_mnttable(mnts, nmnt);
728					goto out;
729				}
730			}
731			/*
732			 * Try regular unmounts for everything else.
733			 */
734			if (!unmounted && umount2(path, 0) != 0)
735				newcount++;
736		}
737		free_mnttable(mnts, nmnt);
738
739		if (newcount == 0)
740			break;
741		if (newcount >= oldcount) {
742			/*
743			 * Last round didn't unmount anything; we're stuck and
744			 * should start trying forced unmounts.
745			 */
746			stuck = B_TRUE;
747		}
748		oldcount = newcount;
749
750		/*
751		 * Autofs doesn't let you unmount its trigger nodes from
752		 * userland so we have to tell the kernel to cleanup for us.
753		 */
754		if (autofs_cleanup(zoneid) != 0) {
755			zerror(zlogp, B_TRUE, "unable to remove autofs nodes");
756			error++;
757			goto out;
758		}
759	}
760
761out:
762	free_remote_fstypes(remote_fstypes);
763	(void) fclose(mnttab);
764	return (error ? -1 : 0);
765}
766
767static int
768fs_compare(const void *m1, const void *m2)
769{
770	struct zone_fstab *i = (struct zone_fstab *)m1;
771	struct zone_fstab *j = (struct zone_fstab *)m2;
772
773	return (strcmp(i->zone_fs_dir, j->zone_fs_dir));
774}
775
776/*
777 * Fork and exec (and wait for) the mentioned binary with the provided
778 * arguments.  Returns (-1) if something went wrong with fork(2) or exec(2),
779 * returns the exit status otherwise.
780 *
781 * If we were unable to exec the provided pathname (for whatever
782 * reason), we return the special token ZEXIT_EXEC.  The current value
783 * of ZEXIT_EXEC doesn't conflict with legitimate exit codes of the
784 * consumers of this function; any future consumers must make sure this
785 * remains the case.
786 */
787static int
788forkexec(zlog_t *zlogp, const char *path, char *const argv[])
789{
790	pid_t child_pid;
791	int child_status = 0;
792
793	/*
794	 * Do not let another thread localize a message while we are forking.
795	 */
796	(void) mutex_lock(&msglock);
797	child_pid = fork();
798	(void) mutex_unlock(&msglock);
799	if (child_pid == -1) {
800		zerror(zlogp, B_TRUE, "could not fork for %s", argv[0]);
801		return (-1);
802	} else if (child_pid == 0) {
803		closefrom(0);
804		/* redirect stdin, stdout & stderr to /dev/null */
805		(void) open("/dev/null", O_RDONLY);	/* stdin */
806		(void) open("/dev/null", O_WRONLY);	/* stdout */
807		(void) open("/dev/null", O_WRONLY);	/* stderr */
808		(void) execv(path, argv);
809		/*
810		 * Since we are in the child, there is no point calling zerror()
811		 * since there is nobody waiting to consume it.  So exit with a
812		 * special code that the parent will recognize and call zerror()
813		 * accordingly.
814		 */
815
816		_exit(ZEXIT_EXEC);
817	} else {
818		(void) waitpid(child_pid, &child_status, 0);
819	}
820
821	if (WIFSIGNALED(child_status)) {
822		zerror(zlogp, B_FALSE, "%s unexpectedly terminated due to "
823		    "signal %d", path, WTERMSIG(child_status));
824		return (-1);
825	}
826	assert(WIFEXITED(child_status));
827	if (WEXITSTATUS(child_status) == ZEXIT_EXEC) {
828		zerror(zlogp, B_FALSE, "failed to exec %s", path);
829		return (-1);
830	}
831	return (WEXITSTATUS(child_status));
832}
833
834static int
835isregfile(const char *path)
836{
837	struct stat64 st;
838
839	if (stat64(path, &st) == -1)
840		return (-1);
841
842	return (S_ISREG(st.st_mode));
843}
844
845static int
846dofsck(zlog_t *zlogp, const char *fstype, const char *rawdev)
847{
848	char cmdbuf[MAXPATHLEN];
849	char *argv[5];
850	int status;
851
852	/*
853	 * We could alternatively have called /usr/sbin/fsck -F <fstype>, but
854	 * that would cost us an extra fork/exec without buying us anything.
855	 */
856	if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/fsck", fstype)
857	    >= sizeof (cmdbuf)) {
858		zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
859		return (-1);
860	}
861
862	/*
863	 * If it doesn't exist, that's OK: we verified this previously
864	 * in zoneadm.
865	 */
866	if (isregfile(cmdbuf) == -1)
867		return (0);
868
869	argv[0] = "fsck";
870	argv[1] = "-o";
871	argv[2] = "p";
872	argv[3] = (char *)rawdev;
873	argv[4] = NULL;
874
875	status = forkexec(zlogp, cmdbuf, argv);
876	if (status == 0 || status == -1)
877		return (status);
878	zerror(zlogp, B_FALSE, "fsck of '%s' failed with exit status %d; "
879	    "run fsck manually", rawdev, status);
880	return (-1);
881}
882
883static int
884domount(zlog_t *zlogp, const char *fstype, const char *opts,
885    const char *special, const char *directory)
886{
887	char cmdbuf[MAXPATHLEN];
888	char *argv[6];
889	int status;
890
891	/*
892	 * We could alternatively have called /usr/sbin/mount -F <fstype>, but
893	 * that would cost us an extra fork/exec without buying us anything.
894	 */
895	if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/mount", fstype)
896	    >= sizeof (cmdbuf)) {
897		zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
898		return (-1);
899	}
900	argv[0] = "mount";
901	if (opts[0] == '\0') {
902		argv[1] = (char *)special;
903		argv[2] = (char *)directory;
904		argv[3] = NULL;
905	} else {
906		argv[1] = "-o";
907		argv[2] = (char *)opts;
908		argv[3] = (char *)special;
909		argv[4] = (char *)directory;
910		argv[5] = NULL;
911	}
912
913	status = forkexec(zlogp, cmdbuf, argv);
914	if (status == 0 || status == -1)
915		return (status);
916	if (opts[0] == '\0')
917		zerror(zlogp, B_FALSE, "\"%s %s %s\" "
918		    "failed with exit code %d",
919		    cmdbuf, special, directory, status);
920	else
921		zerror(zlogp, B_FALSE, "\"%s -o %s %s %s\" "
922		    "failed with exit code %d",
923		    cmdbuf, opts, special, directory, status);
924	return (-1);
925}
926
927/*
928 * Check if a given mount point path exists.
929 * If it does, make sure it doesn't contain any symlinks.
930 * Note that if "leaf" is false we're checking an intermediate
931 * component of the mount point path, so it must be a directory.
932 * If "leaf" is true, then we're checking the entire mount point
933 * path, so the mount point itself can be anything aside from a
934 * symbolic link.
935 *
936 * If the path is invalid then a negative value is returned.  If the
937 * path exists and is a valid mount point path then 0 is returned.
938 * If the path doesn't exist return a positive value.
939 */
940static int
941valid_mount_point(zlog_t *zlogp, const char *path, const boolean_t leaf)
942{
943	struct stat statbuf;
944	char respath[MAXPATHLEN];
945	int res;
946
947	if (lstat(path, &statbuf) != 0) {
948		if (errno == ENOENT)
949			return (1);
950		zerror(zlogp, B_TRUE, "can't stat %s", path);
951		return (-1);
952	}
953	if (S_ISLNK(statbuf.st_mode)) {
954		zerror(zlogp, B_FALSE, "%s is a symlink", path);
955		return (-1);
956	}
957	if (!leaf && !S_ISDIR(statbuf.st_mode)) {
958		zerror(zlogp, B_FALSE, "%s is not a directory", path);
959		return (-1);
960	}
961	if ((res = resolvepath(path, respath, sizeof (respath))) == -1) {
962		zerror(zlogp, B_TRUE, "unable to resolve path %s", path);
963		return (-1);
964	}
965	respath[res] = '\0';
966	if (strcmp(path, respath) != 0) {
967		/*
968		 * We don't like ".."s, "."s, or "//"s throwing us off
969		 */
970		zerror(zlogp, B_FALSE, "%s is not a canonical path", path);
971		return (-1);
972	}
973	return (0);
974}
975
976/*
977 * Validate a mount point path.  A valid mount point path is an
978 * absolute path that either doesn't exist, or, if it does exists it
979 * must be an absolute canonical path that doesn't have any symbolic
980 * links in it.  The target of a mount point path can be any filesystem
981 * object.  (Different filesystems can support different mount points,
982 * for example "lofs" and "mntfs" both support files and directories
983 * while "ufs" just supports directories.)
984 *
985 * If the path is invalid then a negative value is returned.  If the
986 * path exists and is a valid mount point path then 0 is returned.
987 * If the path doesn't exist return a positive value.
988 */
989int
990valid_mount_path(zlog_t *zlogp, const char *rootpath, const char *spec,
991    const char *dir, const char *fstype)
992{
993	char abspath[MAXPATHLEN], *slashp, *slashp_next;
994	int rv;
995
996	/*
997	 * Sanity check the target mount point path.
998	 * It must be a non-null string that starts with a '/'.
999	 */
1000	if (dir[0] != '/') {
1001		/* Something went wrong. */
1002		zerror(zlogp, B_FALSE, "invalid mount directory, "
1003		    "type: \"%s\", special: \"%s\", dir: \"%s\"",
1004		    fstype, spec, dir);
1005		return (-1);
1006	}
1007
1008	/*
1009	 * Join rootpath and dir.  Make sure abspath ends with '/', this
1010	 * is added to all paths (even non-directory paths) to allow us
1011	 * to detect the end of paths below.  If the path already ends
1012	 * in a '/', then that's ok too (although we'll fail the
1013	 * cannonical path check in valid_mount_point()).
1014	 */
1015	if (snprintf(abspath, sizeof (abspath),
1016	    "%s%s/", rootpath, dir) >= sizeof (abspath)) {
1017		zerror(zlogp, B_FALSE, "pathname %s%s is too long",
1018		    rootpath, dir);
1019		return (-1);
1020	}
1021
1022	/*
1023	 * Starting with rootpath, verify the mount path one component
1024	 * at a time.  Continue until we've evaluated all of abspath.
1025	 */
1026	slashp = &abspath[strlen(rootpath)];
1027	assert(*slashp == '/');
1028	do {
1029		slashp_next = strchr(slashp + 1, '/');
1030		*slashp = '\0';
1031		if (slashp_next != NULL) {
1032			/* This is an intermediary mount path component. */
1033			rv = valid_mount_point(zlogp, abspath, B_FALSE);
1034		} else {
1035			/* This is the last component of the mount path. */
1036			rv = valid_mount_point(zlogp, abspath, B_TRUE);
1037		}
1038		if (rv < 0)
1039			return (rv);
1040		*slashp = '/';
1041	} while ((slashp = slashp_next) != NULL);
1042	return (rv);
1043}
1044
1045static int
1046mount_one_dev_device_cb(void *arg, const char *match, const char *name)
1047{
1048	di_prof_t prof = arg;
1049
1050	if (name == NULL)
1051		return (di_prof_add_dev(prof, match));
1052	return (di_prof_add_map(prof, match, name));
1053}
1054
1055static int
1056mount_one_dev_symlink_cb(void *arg, const char *source, const char *target)
1057{
1058	di_prof_t prof = arg;
1059
1060	return (di_prof_add_symlink(prof, source, target));
1061}
1062
1063int
1064vplat_get_iptype(zlog_t *zlogp, zone_iptype_t *iptypep)
1065{
1066	zone_dochandle_t handle;
1067
1068	if ((handle = zonecfg_init_handle()) == NULL) {
1069		zerror(zlogp, B_TRUE, "getting zone configuration handle");
1070		return (-1);
1071	}
1072	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
1073		zerror(zlogp, B_FALSE, "invalid configuration");
1074		zonecfg_fini_handle(handle);
1075		return (-1);
1076	}
1077	if (zonecfg_get_iptype(handle, iptypep) != Z_OK) {
1078		zerror(zlogp, B_FALSE, "invalid ip-type configuration");
1079		zonecfg_fini_handle(handle);
1080		return (-1);
1081	}
1082	zonecfg_fini_handle(handle);
1083	return (0);
1084}
1085
1086/*
1087 * Apply the standard lists of devices/symlinks/mappings and the user-specified
1088 * list of devices (via zonecfg) to the /dev filesystem.  The filesystem will
1089 * use these as a profile/filter to determine what exists in /dev.
1090 */
1091static int
1092mount_one_dev(zlog_t *zlogp, char *devpath, zone_mnt_t mount_cmd)
1093{
1094	char			brand[MAXNAMELEN];
1095	zone_dochandle_t	handle = NULL;
1096	brand_handle_t		bh = NULL;
1097	struct zone_devtab	ztab;
1098	di_prof_t		prof = NULL;
1099	int			err;
1100	int			retval = -1;
1101	zone_iptype_t		iptype;
1102	const char		*curr_iptype;
1103
1104	if (di_prof_init(devpath, &prof)) {
1105		zerror(zlogp, B_TRUE, "failed to initialize profile");
1106		goto cleanup;
1107	}
1108
1109	/*
1110	 * Get a handle to the brand info for this zone.
1111	 * If we are mounting the zone, then we must always use the default
1112	 * brand device mounts.
1113	 */
1114	if (ALT_MOUNT(mount_cmd)) {
1115		(void) strlcpy(brand, default_brand, sizeof (brand));
1116	} else {
1117		(void) strlcpy(brand, brand_name, sizeof (brand));
1118	}
1119
1120	if ((bh = brand_open(brand)) == NULL) {
1121		zerror(zlogp, B_FALSE, "unable to determine zone brand");
1122		goto cleanup;
1123	}
1124
1125	if (vplat_get_iptype(zlogp, &iptype) < 0) {
1126		zerror(zlogp, B_TRUE, "unable to determine ip-type");
1127		goto cleanup;
1128	}
1129	switch (iptype) {
1130	case ZS_SHARED:
1131		curr_iptype = "shared";
1132		break;
1133	case ZS_EXCLUSIVE:
1134		curr_iptype = "exclusive";
1135		break;
1136	}
1137
1138	if (brand_platform_iter_devices(bh, zone_name,
1139	    mount_one_dev_device_cb, prof, curr_iptype) != 0) {
1140		zerror(zlogp, B_TRUE, "failed to add standard device");
1141		goto cleanup;
1142	}
1143
1144	if (brand_platform_iter_link(bh,
1145	    mount_one_dev_symlink_cb, prof) != 0) {
1146		zerror(zlogp, B_TRUE, "failed to add standard symlink");
1147		goto cleanup;
1148	}
1149
1150	/* Add user-specified devices and directories */
1151	if ((handle = zonecfg_init_handle()) == NULL) {
1152		zerror(zlogp, B_FALSE, "can't initialize zone handle");
1153		goto cleanup;
1154	}
1155	if (err = zonecfg_get_handle(zone_name, handle)) {
1156		zerror(zlogp, B_FALSE, "can't get handle for zone "
1157		    "%s: %s", zone_name, zonecfg_strerror(err));
1158		goto cleanup;
1159	}
1160	if (err = zonecfg_setdevent(handle)) {
1161		zerror(zlogp, B_FALSE, "%s: %s", zone_name,
1162		    zonecfg_strerror(err));
1163		goto cleanup;
1164	}
1165	while (zonecfg_getdevent(handle, &ztab) == Z_OK) {
1166		if (di_prof_add_dev(prof, ztab.zone_dev_match)) {
1167			zerror(zlogp, B_TRUE, "failed to add "
1168			    "user-specified device");
1169			goto cleanup;
1170		}
1171	}
1172	(void) zonecfg_enddevent(handle);
1173
1174	/* Send profile to kernel */
1175	if (di_prof_commit(prof)) {
1176		zerror(zlogp, B_TRUE, "failed to commit profile");
1177		goto cleanup;
1178	}
1179
1180	retval = 0;
1181
1182cleanup:
1183	if (bh != NULL)
1184		brand_close(bh);
1185	if (handle != NULL)
1186		zonecfg_fini_handle(handle);
1187	if (prof)
1188		di_prof_fini(prof);
1189	return (retval);
1190}
1191
1192static int
1193mount_one(zlog_t *zlogp, struct zone_fstab *fsptr, const char *rootpath,
1194    zone_mnt_t mount_cmd)
1195{
1196	char path[MAXPATHLEN];
1197	char optstr[MAX_MNTOPT_STR];
1198	zone_fsopt_t *optptr;
1199	int rv;
1200
1201	if ((rv = valid_mount_path(zlogp, rootpath, fsptr->zone_fs_special,
1202	    fsptr->zone_fs_dir, fsptr->zone_fs_type)) < 0) {
1203		zerror(zlogp, B_FALSE, "%s%s is not a valid mount point",
1204		    rootpath, fsptr->zone_fs_dir);
1205		return (-1);
1206	} else if (rv > 0) {
1207		/* The mount point path doesn't exist, create it now. */
1208		if (make_one_dir(zlogp, rootpath, fsptr->zone_fs_dir,
1209		    DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
1210		    DEFAULT_DIR_GROUP) != 0) {
1211			zerror(zlogp, B_FALSE, "failed to create mount point");
1212			return (-1);
1213		}
1214
1215		/*
1216		 * Now this might seem weird, but we need to invoke
1217		 * valid_mount_path() again.  Why?  Because it checks
1218		 * to make sure that the mount point path is canonical,
1219		 * which it can only do if the path exists, so now that
1220		 * we've created the path we have to verify it again.
1221		 */
1222		if ((rv = valid_mount_path(zlogp, rootpath,
1223		    fsptr->zone_fs_special, fsptr->zone_fs_dir,
1224		    fsptr->zone_fs_type)) < 0) {
1225			zerror(zlogp, B_FALSE,
1226			    "%s%s is not a valid mount point",
1227			    rootpath, fsptr->zone_fs_dir);
1228			return (-1);
1229		}
1230	}
1231
1232	(void) snprintf(path, sizeof (path), "%s%s", rootpath,
1233	    fsptr->zone_fs_dir);
1234
1235	/*
1236	 * In general the strategy here is to do just as much verification as
1237	 * necessary to avoid crashing or otherwise doing something bad; if the
1238	 * administrator initiated the operation via zoneadm(1m), they'll get
1239	 * auto-verification which will let them know what's wrong.  If they
1240	 * modify the zone configuration of a running zone, and don't attempt
1241	 * to verify that it's OK, then we won't crash but won't bother trying
1242	 * to be too helpful either. zoneadm verify is only a couple keystrokes
1243	 * away.
1244	 */
1245	if (!zonecfg_valid_fs_type(fsptr->zone_fs_type)) {
1246		zerror(zlogp, B_FALSE, "cannot mount %s on %s: "
1247		    "invalid file-system type %s", fsptr->zone_fs_special,
1248		    fsptr->zone_fs_dir, fsptr->zone_fs_type);
1249		return (-1);
1250	}
1251
1252	/*
1253	 * If we're looking at an alternate root environment, then construct
1254	 * read-only loopback mounts as necessary.  Note that any special
1255	 * paths for lofs zone mounts in an alternate root must have
1256	 * already been pre-pended with any alternate root path by the
1257	 * time we get here.
1258	 */
1259	if (zonecfg_in_alt_root()) {
1260		struct stat64 st;
1261
1262		if (stat64(fsptr->zone_fs_special, &st) != -1 &&
1263		    S_ISBLK(st.st_mode)) {
1264			/*
1265			 * If we're going to mount a block device we need
1266			 * to check if that device is already mounted
1267			 * somewhere else, and if so, do a lofs mount
1268			 * of the device instead of a direct mount
1269			 */
1270			if (check_lofs_needed(zlogp, fsptr) == -1)
1271				return (-1);
1272		} else if (strcmp(fsptr->zone_fs_type, MNTTYPE_LOFS) == 0) {
1273			/*
1274			 * For lofs mounts, the special node is inside the
1275			 * alternate root.  We need lofs resolution for
1276			 * this case in order to get at the underlying
1277			 * read-write path.
1278			 */
1279			resolve_lofs(zlogp, fsptr->zone_fs_special,
1280			    sizeof (fsptr->zone_fs_special));
1281		}
1282	}
1283
1284	/*
1285	 * Run 'fsck -m' if there's a device to fsck.
1286	 */
1287	if (fsptr->zone_fs_raw[0] != '\0' &&
1288	    dofsck(zlogp, fsptr->zone_fs_type, fsptr->zone_fs_raw) != 0) {
1289		return (-1);
1290	} else if (isregfile(fsptr->zone_fs_special) == 1 &&
1291	    dofsck(zlogp, fsptr->zone_fs_type, fsptr->zone_fs_special) != 0) {
1292		return (-1);
1293	}
1294
1295	/*
1296	 * Build up mount option string.
1297	 */
1298	optstr[0] = '\0';
1299	if (fsptr->zone_fs_options != NULL) {
1300		(void) strlcpy(optstr, fsptr->zone_fs_options->zone_fsopt_opt,
1301		    sizeof (optstr));
1302		for (optptr = fsptr->zone_fs_options->zone_fsopt_next;
1303		    optptr != NULL; optptr = optptr->zone_fsopt_next) {
1304			(void) strlcat(optstr, ",", sizeof (optstr));
1305			(void) strlcat(optstr, optptr->zone_fsopt_opt,
1306			    sizeof (optstr));
1307		}
1308	}
1309
1310	if ((rv = domount(zlogp, fsptr->zone_fs_type, optstr,
1311	    fsptr->zone_fs_special, path)) != 0)
1312		return (rv);
1313
1314	/*
1315	 * The mount succeeded.  If this was not a mount of /dev then
1316	 * we're done.
1317	 */
1318	if (strcmp(fsptr->zone_fs_type, MNTTYPE_DEV) != 0)
1319		return (0);
1320
1321	/*
1322	 * We just mounted an instance of a /dev filesystem, so now we
1323	 * need to configure it.
1324	 */
1325	return (mount_one_dev(zlogp, path, mount_cmd));
1326}
1327
1328static void
1329free_fs_data(struct zone_fstab *fsarray, uint_t nelem)
1330{
1331	uint_t i;
1332
1333	if (fsarray == NULL)
1334		return;
1335	for (i = 0; i < nelem; i++)
1336		zonecfg_free_fs_option_list(fsarray[i].zone_fs_options);
1337	free(fsarray);
1338}
1339
1340/*
1341 * This function initiates the creation of a small Solaris Environment for
1342 * scratch zone. The Environment creation process is split up into two
1343 * functions(build_mounted_pre_var() and build_mounted_post_var()). It
1344 * is done this way because:
1345 *	We need to have both /etc and /var in the root of the scratchzone.
1346 *	We loopback mount zone's own /etc and /var into the root of the
1347 *	scratch zone. Unlike /etc, /var can be a seperate filesystem. So we
1348 *	need to delay the mount of /var till the zone's root gets populated.
1349 *	So mounting of localdirs[](/etc and /var) have been moved to the
1350 *	build_mounted_post_var() which gets called only after the zone
1351 *	specific filesystems are mounted.
1352 *
1353 * Note that the scratch zone we set up for updating the zone (Z_MNT_UPDATE)
1354 * does not loopback mount the zone's own /etc and /var into the root of the
1355 * scratch zone.
1356 */
1357static boolean_t
1358build_mounted_pre_var(zlog_t *zlogp, char *rootpath,
1359    size_t rootlen, const char *zonepath, char *luroot, size_t lurootlen)
1360{
1361	char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1362	const char **cpp;
1363	static const char *mkdirs[] = {
1364		"/system", "/system/contract", "/system/object", "/proc",
1365		"/dev", "/tmp", "/a", NULL
1366	};
1367	char *altstr;
1368	FILE *fp;
1369	uuid_t uuid;
1370
1371	resolve_lofs(zlogp, rootpath, rootlen);
1372	(void) snprintf(luroot, lurootlen, "%s/lu", zonepath);
1373	resolve_lofs(zlogp, luroot, lurootlen);
1374	(void) snprintf(tmp, sizeof (tmp), "%s/bin", luroot);
1375	(void) symlink("./usr/bin", tmp);
1376
1377	/*
1378	 * These are mostly special mount points; not handled here.  (See
1379	 * zone_mount_early.)
1380	 */
1381	for (cpp = mkdirs; *cpp != NULL; cpp++) {
1382		(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1383		if (mkdir(tmp, 0755) != 0) {
1384			zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1385			return (B_FALSE);
1386		}
1387	}
1388	/*
1389	 * This is here to support lucopy.  If there's an instance of this same
1390	 * zone on the current running system, then we mount its root up as
1391	 * read-only inside the scratch zone.
1392	 */
1393	(void) zonecfg_get_uuid(zone_name, uuid);
1394	altstr = strdup(zonecfg_get_root());
1395	if (altstr == NULL) {
1396		zerror(zlogp, B_TRUE, "memory allocation failed");
1397		return (B_FALSE);
1398	}
1399	zonecfg_set_root("");
1400	(void) strlcpy(tmp, zone_name, sizeof (tmp));
1401	(void) zonecfg_get_name_by_uuid(uuid, tmp, sizeof (tmp));
1402	if (zone_get_rootpath(tmp, fromdir, sizeof (fromdir)) == Z_OK &&
1403	    strcmp(fromdir, rootpath) != 0) {
1404		(void) snprintf(tmp, sizeof (tmp), "%s/b", luroot);
1405		if (mkdir(tmp, 0755) != 0) {
1406			zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1407			return (B_FALSE);
1408		}
1409		if (domount(zlogp, MNTTYPE_LOFS, RESOURCE_DEFAULT_OPTS, fromdir,
1410		    tmp) != 0) {
1411			zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1412			    fromdir);
1413			return (B_FALSE);
1414		}
1415	}
1416	zonecfg_set_root(altstr);
1417	free(altstr);
1418
1419	if ((fp = zonecfg_open_scratch(luroot, B_TRUE)) == NULL) {
1420		zerror(zlogp, B_TRUE, "cannot open zone mapfile");
1421		return (B_FALSE);
1422	}
1423	(void) ftruncate(fileno(fp), 0);
1424	if (zonecfg_add_scratch(fp, zone_name, kernzone, "/") == -1) {
1425		zerror(zlogp, B_TRUE, "cannot add zone mapfile entry");
1426	}
1427	zonecfg_close_scratch(fp);
1428	(void) snprintf(tmp, sizeof (tmp), "%s/a", luroot);
1429	if (domount(zlogp, MNTTYPE_LOFS, "", rootpath, tmp) != 0)
1430		return (B_FALSE);
1431	(void) strlcpy(rootpath, tmp, rootlen);
1432	return (B_TRUE);
1433}
1434
1435
1436static boolean_t
1437build_mounted_post_var(zlog_t *zlogp, zone_mnt_t mount_cmd, char *rootpath,
1438    const char *luroot)
1439{
1440	char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1441	const char **cpp;
1442	const char **loopdirs;
1443	const char **tmpdirs;
1444	static const char *localdirs[] = {
1445		"/etc", "/var", NULL
1446	};
1447	static const char *scr_loopdirs[] = {
1448		"/etc/lib", "/etc/fs", "/lib", "/sbin", "/platform",
1449		"/usr", NULL
1450	};
1451	static const char *upd_loopdirs[] = {
1452		"/etc", "/kernel", "/lib", "/opt", "/platform", "/sbin",
1453		"/usr", "/var", NULL
1454	};
1455	static const char *scr_tmpdirs[] = {
1456		"/tmp", "/var/run", NULL
1457	};
1458	static const char *upd_tmpdirs[] = {
1459		"/tmp", "/var/run", "/var/tmp", NULL
1460	};
1461	struct stat st;
1462
1463	if (mount_cmd == Z_MNT_SCRATCH) {
1464		/*
1465		 * These are mounted read-write from the zone undergoing
1466		 * upgrade.  We must be careful not to 'leak' things from the
1467		 * main system into the zone, and this accomplishes that goal.
1468		 */
1469		for (cpp = localdirs; *cpp != NULL; cpp++) {
1470			(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot,
1471			    *cpp);
1472			(void) snprintf(fromdir, sizeof (fromdir), "%s%s",
1473			    rootpath, *cpp);
1474			if (mkdir(tmp, 0755) != 0) {
1475				zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1476				return (B_FALSE);
1477			}
1478			if (domount(zlogp, MNTTYPE_LOFS, "", fromdir, tmp)
1479			    != 0) {
1480				zerror(zlogp, B_TRUE, "cannot mount %s on %s",
1481				    tmp, *cpp);
1482				return (B_FALSE);
1483			}
1484		}
1485	}
1486
1487	if (mount_cmd == Z_MNT_UPDATE)
1488		loopdirs = upd_loopdirs;
1489	else
1490		loopdirs = scr_loopdirs;
1491
1492	/*
1493	 * These are things mounted read-only from the running system because
1494	 * they contain binaries that must match system.
1495	 */
1496	for (cpp = loopdirs; *cpp != NULL; cpp++) {
1497		(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1498		if (mkdir(tmp, 0755) != 0) {
1499			if (errno != EEXIST) {
1500				zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1501				return (B_FALSE);
1502			}
1503			if (lstat(tmp, &st) != 0) {
1504				zerror(zlogp, B_TRUE, "cannot stat %s", tmp);
1505				return (B_FALSE);
1506			}
1507			/*
1508			 * Ignore any non-directories encountered.  These are
1509			 * things that have been converted into symlinks
1510			 * (/etc/fs and /etc/lib) and no longer need a lofs
1511			 * fixup.
1512			 */
1513			if (!S_ISDIR(st.st_mode))
1514				continue;
1515		}
1516		if (domount(zlogp, MNTTYPE_LOFS, RESOURCE_DEFAULT_OPTS, *cpp,
1517		    tmp) != 0) {
1518			zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1519			    *cpp);
1520			return (B_FALSE);
1521		}
1522	}
1523
1524	if (mount_cmd == Z_MNT_UPDATE)
1525		tmpdirs = upd_tmpdirs;
1526	else
1527		tmpdirs = scr_tmpdirs;
1528
1529	/*
1530	 * These are things with tmpfs mounted inside.
1531	 */
1532	for (cpp = tmpdirs; *cpp != NULL; cpp++) {
1533		(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1534		if (mount_cmd == Z_MNT_SCRATCH && mkdir(tmp, 0755) != 0 &&
1535		    errno != EEXIST) {
1536			zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1537			return (B_FALSE);
1538		}
1539
1540		/*
1541		 * We could set the mode for /tmp when we do the mkdir but
1542		 * since that can be modified by the umask we will just set
1543		 * the correct mode for /tmp now.
1544		 */
1545		if (strcmp(*cpp, "/tmp") == 0 && chmod(tmp, 01777) != 0) {
1546			zerror(zlogp, B_TRUE, "cannot chmod %s", tmp);
1547			return (B_FALSE);
1548		}
1549
1550		if (domount(zlogp, MNTTYPE_TMPFS, "", "swap", tmp) != 0) {
1551			zerror(zlogp, B_TRUE, "cannot mount swap on %s", *cpp);
1552			return (B_FALSE);
1553		}
1554	}
1555	return (B_TRUE);
1556}
1557
1558typedef struct plat_gmount_cb_data {
1559	zlog_t			*pgcd_zlogp;
1560	struct zone_fstab	**pgcd_fs_tab;
1561	int			*pgcd_num_fs;
1562} plat_gmount_cb_data_t;
1563
1564/*
1565 * plat_gmount_cb() is a callback function invoked by libbrand to iterate
1566 * through all global brand platform mounts.
1567 */
1568int
1569plat_gmount_cb(void *data, const char *spec, const char *dir,
1570    const char *fstype, const char *opt)
1571{
1572	plat_gmount_cb_data_t	*cp = data;
1573	zlog_t			*zlogp = cp->pgcd_zlogp;
1574	struct zone_fstab	*fs_ptr = *cp->pgcd_fs_tab;
1575	int			num_fs = *cp->pgcd_num_fs;
1576	struct zone_fstab	*fsp, *tmp_ptr;
1577
1578	num_fs++;
1579	if ((tmp_ptr = realloc(fs_ptr, num_fs * sizeof (*tmp_ptr))) == NULL) {
1580		zerror(zlogp, B_TRUE, "memory allocation failed");
1581		return (-1);
1582	}
1583
1584	fs_ptr = tmp_ptr;
1585	fsp = &fs_ptr[num_fs - 1];
1586
1587	/* update the callback struct passed in */
1588	*cp->pgcd_fs_tab = fs_ptr;
1589	*cp->pgcd_num_fs = num_fs;
1590
1591	fsp->zone_fs_raw[0] = '\0';
1592	(void) strlcpy(fsp->zone_fs_special, spec,
1593	    sizeof (fsp->zone_fs_special));
1594	(void) strlcpy(fsp->zone_fs_dir, dir, sizeof (fsp->zone_fs_dir));
1595	(void) strlcpy(fsp->zone_fs_type, fstype, sizeof (fsp->zone_fs_type));
1596	fsp->zone_fs_options = NULL;
1597	if ((opt != NULL) &&
1598	    (zonecfg_add_fs_option(fsp, (char *)opt) != Z_OK)) {
1599		zerror(zlogp, B_FALSE, "error adding property");
1600		return (-1);
1601	}
1602
1603	return (0);
1604}
1605
1606static int
1607mount_filesystems_fsent(zone_dochandle_t handle, zlog_t *zlogp,
1608    struct zone_fstab **fs_tabp, int *num_fsp, zone_mnt_t mount_cmd)
1609{
1610	struct zone_fstab *tmp_ptr, *fs_ptr, *fsp, fstab;
1611	int num_fs;
1612
1613	num_fs = *num_fsp;
1614	fs_ptr = *fs_tabp;
1615
1616	if (zonecfg_setfsent(handle) != Z_OK) {
1617		zerror(zlogp, B_FALSE, "invalid configuration");
1618		return (-1);
1619	}
1620	while (zonecfg_getfsent(handle, &fstab) == Z_OK) {
1621		/*
1622		 * ZFS filesystems will not be accessible under an alternate
1623		 * root, since the pool will not be known.  Ignore them in this
1624		 * case.
1625		 */
1626		if (ALT_MOUNT(mount_cmd) &&
1627		    strcmp(fstab.zone_fs_type, MNTTYPE_ZFS) == 0)
1628			continue;
1629
1630		num_fs++;
1631		if ((tmp_ptr = realloc(fs_ptr,
1632		    num_fs * sizeof (*tmp_ptr))) == NULL) {
1633			zerror(zlogp, B_TRUE, "memory allocation failed");
1634			(void) zonecfg_endfsent(handle);
1635			return (-1);
1636		}
1637		/* update the pointers passed in */
1638		*fs_tabp = tmp_ptr;
1639		*num_fsp = num_fs;
1640
1641		fs_ptr = tmp_ptr;
1642		fsp = &fs_ptr[num_fs - 1];
1643		(void) strlcpy(fsp->zone_fs_dir,
1644		    fstab.zone_fs_dir, sizeof (fsp->zone_fs_dir));
1645		(void) strlcpy(fsp->zone_fs_raw, fstab.zone_fs_raw,
1646		    sizeof (fsp->zone_fs_raw));
1647		(void) strlcpy(fsp->zone_fs_type, fstab.zone_fs_type,
1648		    sizeof (fsp->zone_fs_type));
1649		fsp->zone_fs_options = fstab.zone_fs_options;
1650
1651		/*
1652		 * For all lofs mounts, make sure that the 'special'
1653		 * entry points inside the alternate root.  The
1654		 * source path for a lofs mount in a given zone needs
1655		 * to be relative to the root of the boot environment
1656		 * that contains the zone.  Note that we don't do this
1657		 * for non-lofs mounts since they will have a device
1658		 * as a backing store and device paths must always be
1659		 * specified relative to the current boot environment.
1660		 */
1661		fsp->zone_fs_special[0] = '\0';
1662		if (strcmp(fsp->zone_fs_type, MNTTYPE_LOFS) == 0) {
1663			(void) strlcat(fsp->zone_fs_special, zonecfg_get_root(),
1664			    sizeof (fsp->zone_fs_special));
1665		}
1666		(void) strlcat(fsp->zone_fs_special, fstab.zone_fs_special,
1667		    sizeof (fsp->zone_fs_special));
1668	}
1669	(void) zonecfg_endfsent(handle);
1670	return (0);
1671}
1672
1673static int
1674mount_filesystems(zlog_t *zlogp, zone_mnt_t mount_cmd)
1675{
1676	char rootpath[MAXPATHLEN];
1677	char zonepath[MAXPATHLEN];
1678	char brand[MAXNAMELEN];
1679	char luroot[MAXPATHLEN];
1680	int i, num_fs = 0;
1681	struct zone_fstab *fs_ptr = NULL;
1682	zone_dochandle_t handle = NULL;
1683	zone_state_t zstate;
1684	brand_handle_t bh;
1685	plat_gmount_cb_data_t cb;
1686
1687	if (zone_get_state(zone_name, &zstate) != Z_OK ||
1688	    (zstate != ZONE_STATE_READY && zstate != ZONE_STATE_MOUNTED)) {
1689		zerror(zlogp, B_FALSE,
1690		    "zone must be in '%s' or '%s' state to mount file-systems",
1691		    zone_state_str(ZONE_STATE_READY),
1692		    zone_state_str(ZONE_STATE_MOUNTED));
1693		goto bad;
1694	}
1695
1696	if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
1697		zerror(zlogp, B_TRUE, "unable to determine zone path");
1698		goto bad;
1699	}
1700
1701	if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
1702		zerror(zlogp, B_TRUE, "unable to determine zone root");
1703		goto bad;
1704	}
1705
1706	if ((handle = zonecfg_init_handle()) == NULL) {
1707		zerror(zlogp, B_TRUE, "getting zone configuration handle");
1708		goto bad;
1709	}
1710	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK ||
1711	    zonecfg_setfsent(handle) != Z_OK) {
1712		zerror(zlogp, B_FALSE, "invalid configuration");
1713		goto bad;
1714	}
1715
1716	/*
1717	 * If we are mounting the zone, then we must always use the default
1718	 * brand global mounts.
1719	 */
1720	if (ALT_MOUNT(mount_cmd)) {
1721		(void) strlcpy(brand, default_brand, sizeof (brand));
1722	} else {
1723		(void) strlcpy(brand, brand_name, sizeof (brand));
1724	}
1725
1726	/* Get a handle to the brand info for this zone */
1727	if ((bh = brand_open(brand)) == NULL) {
1728		zerror(zlogp, B_FALSE, "unable to determine zone brand");
1729		zonecfg_fini_handle(handle);
1730		return (-1);
1731	}
1732
1733	/*
1734	 * Get the list of global filesystems to mount from the brand
1735	 * configuration.
1736	 */
1737	cb.pgcd_zlogp = zlogp;
1738	cb.pgcd_fs_tab = &fs_ptr;
1739	cb.pgcd_num_fs = &num_fs;
1740	if (brand_platform_iter_gmounts(bh, zone_name, zonepath,
1741	    plat_gmount_cb, &cb) != 0) {
1742		zerror(zlogp, B_FALSE, "unable to mount filesystems");
1743		brand_close(bh);
1744		zonecfg_fini_handle(handle);
1745		return (-1);
1746	}
1747	brand_close(bh);
1748
1749	/*
1750	 * Iterate through the rest of the filesystems. Sort them all,
1751	 * then mount them in sorted order. This is to make sure the
1752	 * higher level directories (e.g., /usr) get mounted before
1753	 * any beneath them (e.g., /usr/local).
1754	 */
1755	if (mount_filesystems_fsent(handle, zlogp, &fs_ptr, &num_fs,
1756	    mount_cmd) != 0)
1757		goto bad;
1758
1759	zonecfg_fini_handle(handle);
1760	handle = NULL;
1761
1762	/*
1763	 * Normally when we mount a zone all the zone filesystems
1764	 * get mounted relative to rootpath, which is usually
1765	 * <zonepath>/root.  But when mounting a zone for administration
1766	 * purposes via the zone "mount" state, build_mounted_pre_var()
1767	 * updates rootpath to be <zonepath>/lu/a so we'll mount all
1768	 * the zones filesystems there instead.
1769	 *
1770	 * build_mounted_pre_var() and build_mounted_post_var() will
1771	 * also do some extra work to create directories and lofs mount
1772	 * a bunch of global zone file system paths into <zonepath>/lu.
1773	 *
1774	 * This allows us to be able to enter the zone (now rooted at
1775	 * <zonepath>/lu) and run the upgrade/patch tools that are in the
1776	 * global zone and have them upgrade the to-be-modified zone's
1777	 * files mounted on /a.  (Which mirrors the existing standard
1778	 * upgrade environment.)
1779	 *
1780	 * There is of course one catch.  When doing the upgrade
1781	 * we need <zoneroot>/lu/dev to be the /dev filesystem
1782	 * for the zone and we don't want to have any /dev filesystem
1783	 * mounted at <zoneroot>/lu/a/dev.  Since /dev is specified
1784	 * as a normal zone filesystem by default we'll try to mount
1785	 * it at <zoneroot>/lu/a/dev, so we have to detect this
1786	 * case and instead mount it at <zoneroot>/lu/dev.
1787	 *
1788	 * All this work is done in three phases:
1789	 *   1) Create and populate lu directory (build_mounted_pre_var()).
1790	 *   2) Mount the required filesystems as per the zone configuration.
1791	 *   3) Set up the rest of the scratch zone environment
1792	 *	(build_mounted_post_var()).
1793	 */
1794	if (ALT_MOUNT(mount_cmd) && !build_mounted_pre_var(zlogp,
1795	    rootpath, sizeof (rootpath), zonepath, luroot, sizeof (luroot)))
1796		goto bad;
1797
1798	qsort(fs_ptr, num_fs, sizeof (*fs_ptr), fs_compare);
1799
1800	for (i = 0; i < num_fs; i++) {
1801		if (ALT_MOUNT(mount_cmd) &&
1802		    strcmp(fs_ptr[i].zone_fs_dir, "/dev") == 0) {
1803			size_t slen = strlen(rootpath) - 2;
1804
1805			/*
1806			 * By default we'll try to mount /dev as /a/dev
1807			 * but /dev is special and always goes at the top
1808			 * so strip the trailing '/a' from the rootpath.
1809			 */
1810			assert(strcmp(&rootpath[slen], "/a") == 0);
1811			rootpath[slen] = '\0';
1812			if (mount_one(zlogp, &fs_ptr[i], rootpath, mount_cmd)
1813			    != 0)
1814				goto bad;
1815			rootpath[slen] = '/';
1816			continue;
1817		}
1818		if (mount_one(zlogp, &fs_ptr[i], rootpath, mount_cmd) != 0)
1819			goto bad;
1820	}
1821	if (ALT_MOUNT(mount_cmd) &&
1822	    !build_mounted_post_var(zlogp, mount_cmd, rootpath, luroot))
1823		goto bad;
1824
1825	/*
1826	 * For Trusted Extensions cross-mount each lower level /export/home
1827	 */
1828	if (mount_cmd == Z_MNT_BOOT &&
1829	    tsol_mounts(zlogp, zone_name, rootpath) != 0)
1830		goto bad;
1831
1832	free_fs_data(fs_ptr, num_fs);
1833
1834	/*
1835	 * Everything looks fine.
1836	 */
1837	return (0);
1838
1839bad:
1840	if (handle != NULL)
1841		zonecfg_fini_handle(handle);
1842	free_fs_data(fs_ptr, num_fs);
1843	return (-1);
1844}
1845
1846/* caller makes sure neither parameter is NULL */
1847static int
1848addr2netmask(char *prefixstr, int maxprefixlen, uchar_t *maskstr)
1849{
1850	int prefixlen;
1851
1852	prefixlen = atoi(prefixstr);
1853	if (prefixlen < 0 || prefixlen > maxprefixlen)
1854		return (1);
1855	while (prefixlen > 0) {
1856		if (prefixlen >= 8) {
1857			*maskstr++ = 0xFF;
1858			prefixlen -= 8;
1859			continue;
1860		}
1861		*maskstr |= 1 << (8 - prefixlen);
1862		prefixlen--;
1863	}
1864	return (0);
1865}
1866
1867/*
1868 * Tear down all interfaces belonging to the given zone.  This should
1869 * be called with the zone in a state other than "running", so that
1870 * interfaces can't be assigned to the zone after this returns.
1871 *
1872 * If anything goes wrong, log an error message and return an error.
1873 */
1874static int
1875unconfigure_shared_network_interfaces(zlog_t *zlogp, zoneid_t zone_id)
1876{
1877	struct lifnum lifn;
1878	struct lifconf lifc;
1879	struct lifreq *lifrp, lifrl;
1880	int64_t lifc_flags = LIFC_NOXMIT | LIFC_ALLZONES;
1881	int num_ifs, s, i, ret_code = 0;
1882	uint_t bufsize;
1883	char *buf = NULL;
1884
1885	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
1886		zerror(zlogp, B_TRUE, "could not get socket");
1887		ret_code = -1;
1888		goto bad;
1889	}
1890	lifn.lifn_family = AF_UNSPEC;
1891	lifn.lifn_flags = (int)lifc_flags;
1892	if (ioctl(s, SIOCGLIFNUM, (char *)&lifn) < 0) {
1893		zerror(zlogp, B_TRUE,
1894		    "could not determine number of network interfaces");
1895		ret_code = -1;
1896		goto bad;
1897	}
1898	num_ifs = lifn.lifn_count;
1899	bufsize = num_ifs * sizeof (struct lifreq);
1900	if ((buf = malloc(bufsize)) == NULL) {
1901		zerror(zlogp, B_TRUE, "memory allocation failed");
1902		ret_code = -1;
1903		goto bad;
1904	}
1905	lifc.lifc_family = AF_UNSPEC;
1906	lifc.lifc_flags = (int)lifc_flags;
1907	lifc.lifc_len = bufsize;
1908	lifc.lifc_buf = buf;
1909	if (ioctl(s, SIOCGLIFCONF, (char *)&lifc) < 0) {
1910		zerror(zlogp, B_TRUE, "could not get configured network "
1911		    "interfaces");
1912		ret_code = -1;
1913		goto bad;
1914	}
1915	lifrp = lifc.lifc_req;
1916	for (i = lifc.lifc_len / sizeof (struct lifreq); i > 0; i--, lifrp++) {
1917		(void) close(s);
1918		if ((s = socket(lifrp->lifr_addr.ss_family, SOCK_DGRAM, 0)) <
1919		    0) {
1920			zerror(zlogp, B_TRUE, "%s: could not get socket",
1921			    lifrl.lifr_name);
1922			ret_code = -1;
1923			continue;
1924		}
1925		(void) memset(&lifrl, 0, sizeof (lifrl));
1926		(void) strncpy(lifrl.lifr_name, lifrp->lifr_name,
1927		    sizeof (lifrl.lifr_name));
1928		if (ioctl(s, SIOCGLIFZONE, (caddr_t)&lifrl) < 0) {
1929			if (errno == ENXIO)
1930				/*
1931				 * Interface may have been removed by admin or
1932				 * another zone halting.
1933				 */
1934				continue;
1935			zerror(zlogp, B_TRUE,
1936			    "%s: could not determine the zone to which this "
1937			    "network interface is bound", lifrl.lifr_name);
1938			ret_code = -1;
1939			continue;
1940		}
1941		if (lifrl.lifr_zoneid == zone_id) {
1942			if (ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifrl) < 0) {
1943				zerror(zlogp, B_TRUE,
1944				    "%s: could not remove network interface",
1945				    lifrl.lifr_name);
1946				ret_code = -1;
1947				continue;
1948			}
1949		}
1950	}
1951bad:
1952	if (s > 0)
1953		(void) close(s);
1954	if (buf)
1955		free(buf);
1956	return (ret_code);
1957}
1958
1959static union	sockunion {
1960	struct	sockaddr sa;
1961	struct	sockaddr_in sin;
1962	struct	sockaddr_dl sdl;
1963	struct	sockaddr_in6 sin6;
1964} so_dst, so_ifp;
1965
1966static struct {
1967	struct	rt_msghdr hdr;
1968	char	space[512];
1969} rtmsg;
1970
1971static int
1972salen(struct sockaddr *sa)
1973{
1974	switch (sa->sa_family) {
1975	case AF_INET:
1976		return (sizeof (struct sockaddr_in));
1977	case AF_LINK:
1978		return (sizeof (struct sockaddr_dl));
1979	case AF_INET6:
1980		return (sizeof (struct sockaddr_in6));
1981	default:
1982		return (sizeof (struct sockaddr));
1983	}
1984}
1985
1986#define	ROUNDUP_LONG(a) \
1987	((a) > 0 ? (1 + (((a) - 1) | (sizeof (long) - 1))) : sizeof (long))
1988
1989/*
1990 * Look up which zone is using a given IP address.  The address in question
1991 * is expected to have been stuffed into the structure to which lifr points
1992 * via a previous SIOCGLIFADDR ioctl().
1993 *
1994 * This is done using black router socket magic.
1995 *
1996 * Return the name of the zone on success or NULL on failure.
1997 *
1998 * This is a lot of code for a simple task; a new ioctl request to take care
1999 * of this might be a useful RFE.
2000 */
2001
2002static char *
2003who_is_using(zlog_t *zlogp, struct lifreq *lifr)
2004{
2005	static char answer[ZONENAME_MAX];
2006	pid_t pid;
2007	int s, rlen, l, i;
2008	char *cp = rtmsg.space;
2009	struct sockaddr_dl *ifp = NULL;
2010	struct sockaddr *sa;
2011	char save_if_name[LIFNAMSIZ];
2012
2013	answer[0] = '\0';
2014
2015	pid = getpid();
2016	if ((s = socket(PF_ROUTE, SOCK_RAW, 0)) < 0) {
2017		zerror(zlogp, B_TRUE, "could not get routing socket");
2018		return (NULL);
2019	}
2020
2021	if (lifr->lifr_addr.ss_family == AF_INET) {
2022		struct sockaddr_in *sin4;
2023
2024		so_dst.sa.sa_family = AF_INET;
2025		sin4 = (struct sockaddr_in *)&lifr->lifr_addr;
2026		so_dst.sin.sin_addr = sin4->sin_addr;
2027	} else {
2028		struct sockaddr_in6 *sin6;
2029
2030		so_dst.sa.sa_family = AF_INET6;
2031		sin6 = (struct sockaddr_in6 *)&lifr->lifr_addr;
2032		so_dst.sin6.sin6_addr = sin6->sin6_addr;
2033	}
2034
2035	so_ifp.sa.sa_family = AF_LINK;
2036
2037	(void) memset(&rtmsg, 0, sizeof (rtmsg));
2038	rtmsg.hdr.rtm_type = RTM_GET;
2039	rtmsg.hdr.rtm_flags = RTF_UP | RTF_HOST;
2040	rtmsg.hdr.rtm_version = RTM_VERSION;
2041	rtmsg.hdr.rtm_seq = ++rts_seqno;
2042	rtmsg.hdr.rtm_addrs = RTA_IFP | RTA_DST;
2043
2044	l = ROUNDUP_LONG(salen(&so_dst.sa));
2045	(void) memmove(cp, &(so_dst), l);
2046	cp += l;
2047	l = ROUNDUP_LONG(salen(&so_ifp.sa));
2048	(void) memmove(cp, &(so_ifp), l);
2049	cp += l;
2050
2051	rtmsg.hdr.rtm_msglen = l = cp - (char *)&rtmsg;
2052
2053	if ((rlen = write(s, &rtmsg, l)) < 0) {
2054		zerror(zlogp, B_TRUE, "writing to routing socket");
2055		return (NULL);
2056	} else if (rlen < (int)rtmsg.hdr.rtm_msglen) {
2057		zerror(zlogp, B_TRUE,
2058		    "write to routing socket got only %d for len\n", rlen);
2059		return (NULL);
2060	}
2061	do {
2062		l = read(s, &rtmsg, sizeof (rtmsg));
2063	} while (l > 0 && (rtmsg.hdr.rtm_seq != rts_seqno ||
2064	    rtmsg.hdr.rtm_pid != pid));
2065	if (l < 0) {
2066		zerror(zlogp, B_TRUE, "reading from routing socket");
2067		return (NULL);
2068	}
2069
2070	if (rtmsg.hdr.rtm_version != RTM_VERSION) {
2071		zerror(zlogp, B_FALSE,
2072		    "routing message version %d not understood",
2073		    rtmsg.hdr.rtm_version);
2074		return (NULL);
2075	}
2076	if (rtmsg.hdr.rtm_msglen != (ushort_t)l) {
2077		zerror(zlogp, B_FALSE, "message length mismatch, "
2078		    "expected %d bytes, returned %d bytes",
2079		    rtmsg.hdr.rtm_msglen, l);
2080		return (NULL);
2081	}
2082	if (rtmsg.hdr.rtm_errno != 0)  {
2083		errno = rtmsg.hdr.rtm_errno;
2084		zerror(zlogp, B_TRUE, "RTM_GET routing socket message");
2085		return (NULL);
2086	}
2087	if ((rtmsg.hdr.rtm_addrs & RTA_IFP) == 0) {
2088		zerror(zlogp, B_FALSE, "network interface not found");
2089		return (NULL);
2090	}
2091	cp = ((char *)(&rtmsg.hdr + 1));
2092	for (i = 1; i != 0; i <<= 1) {
2093		/* LINTED E_BAD_PTR_CAST_ALIGN */
2094		sa = (struct sockaddr *)cp;
2095		if (i != RTA_IFP) {
2096			if ((i & rtmsg.hdr.rtm_addrs) != 0)
2097				cp += ROUNDUP_LONG(salen(sa));
2098			continue;
2099		}
2100		if (sa->sa_family == AF_LINK &&
2101		    ((struct sockaddr_dl *)sa)->sdl_nlen != 0)
2102			ifp = (struct sockaddr_dl *)sa;
2103		break;
2104	}
2105	if (ifp == NULL) {
2106		zerror(zlogp, B_FALSE, "network interface could not be "
2107		    "determined");
2108		return (NULL);
2109	}
2110
2111	/*
2112	 * We need to set the I/F name to what we got above, then do the
2113	 * appropriate ioctl to get its zone name.  But lifr->lifr_name is
2114	 * used by the calling function to do a REMOVEIF, so if we leave the
2115	 * "good" zone's I/F name in place, *that* I/F will be removed instead
2116	 * of the bad one.  So we save the old (bad) I/F name before over-
2117	 * writing it and doing the ioctl, then restore it after the ioctl.
2118	 */
2119	(void) strlcpy(save_if_name, lifr->lifr_name, sizeof (save_if_name));
2120	(void) strncpy(lifr->lifr_name, ifp->sdl_data, ifp->sdl_nlen);
2121	lifr->lifr_name[ifp->sdl_nlen] = '\0';
2122	i = ioctl(s, SIOCGLIFZONE, lifr);
2123	(void) strlcpy(lifr->lifr_name, save_if_name, sizeof (save_if_name));
2124	if (i < 0) {
2125		zerror(zlogp, B_TRUE,
2126		    "%s: could not determine the zone network interface "
2127		    "belongs to", lifr->lifr_name);
2128		return (NULL);
2129	}
2130	if (getzonenamebyid(lifr->lifr_zoneid, answer, sizeof (answer)) < 0)
2131		(void) snprintf(answer, sizeof (answer), "%d",
2132		    lifr->lifr_zoneid);
2133
2134	if (strlen(answer) > 0)
2135		return (answer);
2136	return (NULL);
2137}
2138
2139/*
2140 * Configures a single interface: a new virtual interface is added, based on
2141 * the physical interface nwiftabptr->zone_nwif_physical, with the address
2142 * specified in nwiftabptr->zone_nwif_address, for zone zone_id.  Note that
2143 * the "address" can be an IPv6 address (with a /prefixlength required), an
2144 * IPv4 address (with a /prefixlength optional), or a name; for the latter,
2145 * an IPv4 name-to-address resolution will be attempted.
2146 *
2147 * If anything goes wrong, we log an detailed error message, attempt to tear
2148 * down whatever we set up and return an error.
2149 */
2150static int
2151configure_one_interface(zlog_t *zlogp, zoneid_t zone_id,
2152    struct zone_nwiftab *nwiftabptr)
2153{
2154	struct lifreq lifr;
2155	struct sockaddr_in netmask4;
2156	struct sockaddr_in6 netmask6;
2157	struct sockaddr_storage laddr;
2158	struct in_addr in4;
2159	sa_family_t af;
2160	char *slashp = strchr(nwiftabptr->zone_nwif_address, '/');
2161	int s;
2162	boolean_t got_netmask = B_FALSE;
2163	boolean_t is_loopback = B_FALSE;
2164	char addrstr4[INET_ADDRSTRLEN];
2165	int res;
2166
2167	res = zonecfg_valid_net_address(nwiftabptr->zone_nwif_address, &lifr);
2168	if (res != Z_OK) {
2169		zerror(zlogp, B_FALSE, "%s: %s", zonecfg_strerror(res),
2170		    nwiftabptr->zone_nwif_address);
2171		return (-1);
2172	}
2173	af = lifr.lifr_addr.ss_family;
2174	if (af == AF_INET)
2175		in4 = ((struct sockaddr_in *)(&lifr.lifr_addr))->sin_addr;
2176	if ((s = socket(af, SOCK_DGRAM, 0)) < 0) {
2177		zerror(zlogp, B_TRUE, "could not get socket");
2178		return (-1);
2179	}
2180
2181	/*
2182	 * This is a similar kind of "hack" like in addif() to get around
2183	 * the problem of SIOCLIFADDIF.  The problem is that this ioctl
2184	 * does not include the netmask when adding a logical interface.
2185	 * To get around this problem, we first add the logical interface
2186	 * with a 0 address.  After that, we set the netmask if provided.
2187	 * Finally we set the interface address.
2188	 */
2189	laddr = lifr.lifr_addr;
2190	(void) strlcpy(lifr.lifr_name, nwiftabptr->zone_nwif_physical,
2191	    sizeof (lifr.lifr_name));
2192	(void) memset(&lifr.lifr_addr, 0, sizeof (lifr.lifr_addr));
2193
2194	if (ioctl(s, SIOCLIFADDIF, (caddr_t)&lifr) < 0) {
2195		/*
2196		 * Here, we know that the interface can't be brought up.
2197		 * A similar warning message was already printed out to
2198		 * the console by zoneadm(1M) so instead we log the
2199		 * message to syslog and continue.
2200		 */
2201		zerror(&logsys, B_TRUE, "WARNING: skipping network interface "
2202		    "'%s' which may not be present/plumbed in the "
2203		    "global zone.", lifr.lifr_name);
2204		(void) close(s);
2205		return (Z_OK);
2206	}
2207
2208	/* Preserve literal IPv4 address for later potential printing. */
2209	if (af == AF_INET)
2210		(void) inet_ntop(AF_INET, &in4, addrstr4, INET_ADDRSTRLEN);
2211
2212	lifr.lifr_zoneid = zone_id;
2213	if (ioctl(s, SIOCSLIFZONE, (caddr_t)&lifr) < 0) {
2214		zerror(zlogp, B_TRUE, "%s: could not place network interface "
2215		    "into zone", lifr.lifr_name);
2216		goto bad;
2217	}
2218
2219	/*
2220	 * Loopback interface will use the default netmask assigned, if no
2221	 * netmask is found.
2222	 */
2223	if (strcmp(nwiftabptr->zone_nwif_physical, "lo0") == 0) {
2224		is_loopback = B_TRUE;
2225	}
2226	if (af == AF_INET) {
2227		/*
2228		 * The IPv4 netmask can be determined either
2229		 * directly if a prefix length was supplied with
2230		 * the address or via the netmasks database.  Not
2231		 * being able to determine it is a common failure,
2232		 * but it often is not fatal to operation of the
2233		 * interface.  In that case, a warning will be
2234		 * printed after the rest of the interface's
2235		 * parameters have been configured.
2236		 */
2237		(void) memset(&netmask4, 0, sizeof (netmask4));
2238		if (slashp != NULL) {
2239			if (addr2netmask(slashp + 1, V4_ADDR_LEN,
2240			    (uchar_t *)&netmask4.sin_addr) != 0) {
2241				*slashp = '/';
2242				zerror(zlogp, B_FALSE,
2243				    "%s: invalid prefix length in %s",
2244				    lifr.lifr_name,
2245				    nwiftabptr->zone_nwif_address);
2246				goto bad;
2247			}
2248			got_netmask = B_TRUE;
2249		} else if (getnetmaskbyaddr(in4,
2250		    &netmask4.sin_addr) == 0) {
2251			got_netmask = B_TRUE;
2252		}
2253		if (got_netmask) {
2254			netmask4.sin_family = af;
2255			(void) memcpy(&lifr.lifr_addr, &netmask4,
2256			    sizeof (netmask4));
2257		}
2258	} else {
2259		(void) memset(&netmask6, 0, sizeof (netmask6));
2260		if (addr2netmask(slashp + 1, V6_ADDR_LEN,
2261		    (uchar_t *)&netmask6.sin6_addr) != 0) {
2262			*slashp = '/';
2263			zerror(zlogp, B_FALSE,
2264			    "%s: invalid prefix length in %s",
2265			    lifr.lifr_name,
2266			    nwiftabptr->zone_nwif_address);
2267			goto bad;
2268		}
2269		got_netmask = B_TRUE;
2270		netmask6.sin6_family = af;
2271		(void) memcpy(&lifr.lifr_addr, &netmask6,
2272		    sizeof (netmask6));
2273	}
2274	if (got_netmask &&
2275	    ioctl(s, SIOCSLIFNETMASK, (caddr_t)&lifr) < 0) {
2276		zerror(zlogp, B_TRUE, "%s: could not set netmask",
2277		    lifr.lifr_name);
2278		goto bad;
2279	}
2280
2281	/* Set the interface address */
2282	lifr.lifr_addr = laddr;
2283	if (ioctl(s, SIOCSLIFADDR, (caddr_t)&lifr) < 0) {
2284		zerror(zlogp, B_TRUE,
2285		    "%s: could not set IP address to %s",
2286		    lifr.lifr_name, nwiftabptr->zone_nwif_address);
2287		goto bad;
2288	}
2289
2290	if (ioctl(s, SIOCGLIFFLAGS, (caddr_t)&lifr) < 0) {
2291		zerror(zlogp, B_TRUE, "%s: could not get flags",
2292		    lifr.lifr_name);
2293		goto bad;
2294	}
2295	lifr.lifr_flags |= IFF_UP;
2296	if (ioctl(s, SIOCSLIFFLAGS, (caddr_t)&lifr) < 0) {
2297		int save_errno = errno;
2298		char *zone_using;
2299
2300		/*
2301		 * If we failed with something other than EADDRNOTAVAIL,
2302		 * then skip to the end.  Otherwise, look up our address,
2303		 * then call a function to determine which zone is already
2304		 * using that address.
2305		 */
2306		if (errno != EADDRNOTAVAIL) {
2307			zerror(zlogp, B_TRUE,
2308			    "%s: could not bring network interface up",
2309			    lifr.lifr_name);
2310			goto bad;
2311		}
2312		if (ioctl(s, SIOCGLIFADDR, (caddr_t)&lifr) < 0) {
2313			zerror(zlogp, B_TRUE, "%s: could not get address",
2314			    lifr.lifr_name);
2315			goto bad;
2316		}
2317		zone_using = who_is_using(zlogp, &lifr);
2318		errno = save_errno;
2319		if (zone_using == NULL)
2320			zerror(zlogp, B_TRUE,
2321			    "%s: could not bring network interface up",
2322			    lifr.lifr_name);
2323		else
2324			zerror(zlogp, B_TRUE, "%s: could not bring network "
2325			    "interface up: address in use by zone '%s'",
2326			    lifr.lifr_name, zone_using);
2327		goto bad;
2328	}
2329
2330	if (!got_netmask && !is_loopback) {
2331		/*
2332		 * A common, but often non-fatal problem, is that the system
2333		 * cannot find the netmask for an interface address. This is
2334		 * often caused by it being only in /etc/inet/netmasks, but
2335		 * /etc/nsswitch.conf says to use NIS or NIS+ and it's not
2336		 * in that. This doesn't show up at boot because the netmask
2337		 * is obtained from /etc/inet/netmasks when no network
2338		 * interfaces are up, but isn't consulted when NIS/NIS+ is
2339		 * available. We warn the user here that something like this
2340		 * has happened and we're just running with a default and
2341		 * possible incorrect netmask.
2342		 */
2343		char buffer[INET6_ADDRSTRLEN];
2344		void  *addr;
2345		const char *nomatch = "no matching subnet found in netmasks(4)";
2346
2347		if (af == AF_INET)
2348			addr = &((struct sockaddr_in *)
2349			    (&lifr.lifr_addr))->sin_addr;
2350		else
2351			addr = &((struct sockaddr_in6 *)
2352			    (&lifr.lifr_addr))->sin6_addr;
2353
2354		/*
2355		 * Find out what netmask the interface is going to be using.
2356		 * If we just brought up an IPMP data address on an underlying
2357		 * interface above, the address will have already migrated, so
2358		 * the SIOCGLIFNETMASK won't be able to find it (but we need
2359		 * to bring the address up to get the actual netmask).  Just
2360		 * omit printing the actual netmask in this corner-case.
2361		 */
2362		if (ioctl(s, SIOCGLIFNETMASK, (caddr_t)&lifr) < 0 ||
2363		    inet_ntop(af, addr, buffer, sizeof (buffer)) == NULL) {
2364			zerror(zlogp, B_FALSE, "WARNING: %s; using default.",
2365			    nomatch);
2366		} else {
2367			zerror(zlogp, B_FALSE,
2368			    "WARNING: %s: %s: %s; using default of %s.",
2369			    lifr.lifr_name, nomatch, addrstr4, buffer);
2370		}
2371	}
2372
2373	/*
2374	 * If a default router was specified for this interface
2375	 * set the route now. Ignore if already set.
2376	 */
2377	if (strlen(nwiftabptr->zone_nwif_defrouter) > 0) {
2378		int status;
2379		char *argv[7];
2380
2381		argv[0] = "route";
2382		argv[1] = "add";
2383		argv[2] = "-ifp";
2384		argv[3] = nwiftabptr->zone_nwif_physical;
2385		argv[4] = "default";
2386		argv[5] = nwiftabptr->zone_nwif_defrouter;
2387		argv[6] = NULL;
2388
2389		status = forkexec(zlogp, "/usr/sbin/route", argv);
2390		if (status != 0 && status != EEXIST)
2391			zerror(zlogp, B_FALSE, "Unable to set route for "
2392			    "interface %s to %s\n",
2393			    nwiftabptr->zone_nwif_physical,
2394			    nwiftabptr->zone_nwif_defrouter);
2395	}
2396
2397	(void) close(s);
2398	return (Z_OK);
2399bad:
2400	(void) ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifr);
2401	(void) close(s);
2402	return (-1);
2403}
2404
2405/*
2406 * Sets up network interfaces based on information from the zone configuration.
2407 * IPv4 and IPv6 loopback interfaces are set up "for free", modeling the global
2408 * system.
2409 *
2410 * If anything goes wrong, we log a general error message, attempt to tear down
2411 * whatever we set up, and return an error.
2412 */
2413static int
2414configure_shared_network_interfaces(zlog_t *zlogp)
2415{
2416	zone_dochandle_t handle;
2417	struct zone_nwiftab nwiftab, loopback_iftab;
2418	zoneid_t zoneid;
2419
2420	if ((zoneid = getzoneidbyname(zone_name)) == ZONE_ID_UNDEFINED) {
2421		zerror(zlogp, B_TRUE, "unable to get zoneid");
2422		return (-1);
2423	}
2424
2425	if ((handle = zonecfg_init_handle()) == NULL) {
2426		zerror(zlogp, B_TRUE, "getting zone configuration handle");
2427		return (-1);
2428	}
2429	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2430		zerror(zlogp, B_FALSE, "invalid configuration");
2431		zonecfg_fini_handle(handle);
2432		return (-1);
2433	}
2434	if (zonecfg_setnwifent(handle) == Z_OK) {
2435		for (;;) {
2436			if (zonecfg_getnwifent(handle, &nwiftab) != Z_OK)
2437				break;
2438			if (configure_one_interface(zlogp, zoneid, &nwiftab) !=
2439			    Z_OK) {
2440				(void) zonecfg_endnwifent(handle);
2441				zonecfg_fini_handle(handle);
2442				return (-1);
2443			}
2444		}
2445		(void) zonecfg_endnwifent(handle);
2446	}
2447	zonecfg_fini_handle(handle);
2448	if (is_system_labeled()) {
2449		/*
2450		 * Labeled zones share the loopback interface
2451		 * so it is not plumbed for shared stack instances.
2452		 */
2453		return (0);
2454	}
2455	(void) strlcpy(loopback_iftab.zone_nwif_physical, "lo0",
2456	    sizeof (loopback_iftab.zone_nwif_physical));
2457	(void) strlcpy(loopback_iftab.zone_nwif_address, "127.0.0.1",
2458	    sizeof (loopback_iftab.zone_nwif_address));
2459	loopback_iftab.zone_nwif_defrouter[0] = '\0';
2460	if (configure_one_interface(zlogp, zoneid, &loopback_iftab) != Z_OK)
2461		return (-1);
2462
2463	/* Always plumb up the IPv6 loopback interface. */
2464	(void) strlcpy(loopback_iftab.zone_nwif_address, "::1/128",
2465	    sizeof (loopback_iftab.zone_nwif_address));
2466	if (configure_one_interface(zlogp, zoneid, &loopback_iftab) != Z_OK)
2467		return (-1);
2468	return (0);
2469}
2470
2471static void
2472zdlerror(zlog_t *zlogp, dladm_status_t err, const char *dlname, const char *str)
2473{
2474	char errmsg[DLADM_STRSIZE];
2475
2476	(void) dladm_status2str(err, errmsg);
2477	zerror(zlogp, B_FALSE, "%s '%s': %s", str, dlname, errmsg);
2478}
2479
2480static int
2481add_datalink(zlog_t *zlogp, char *zone_name, datalink_id_t linkid, char *dlname)
2482{
2483	dladm_status_t err;
2484	boolean_t cpuset, poolset;
2485	char *poolp;
2486
2487	/* First check if it's in use by global zone. */
2488	if (zonecfg_ifname_exists(AF_INET, dlname) ||
2489	    zonecfg_ifname_exists(AF_INET6, dlname)) {
2490		zerror(zlogp, B_FALSE, "WARNING: skipping network interface "
2491		    "'%s' which is used in the global zone", dlname);
2492		return (-1);
2493	}
2494
2495	/* Set zoneid of this link. */
2496	err = dladm_set_linkprop(dld_handle, linkid, "zone", &zone_name, 1,
2497	    DLADM_OPT_ACTIVE);
2498	if (err != DLADM_STATUS_OK) {
2499		zdlerror(zlogp, err, dlname,
2500		    "WARNING: unable to add network interface");
2501		return (-1);
2502	}
2503
2504	/*
2505	 * Set the pool of this link if the zone has a pool and
2506	 * neither the cpus nor the pool datalink property is
2507	 * already set.
2508	 */
2509	err = dladm_linkprop_is_set(dld_handle, linkid, DLADM_PROP_VAL_CURRENT,
2510	    "cpus", &cpuset);
2511	if (err != DLADM_STATUS_OK) {
2512		zdlerror(zlogp, err, dlname,
2513		    "WARNING: unable to check if cpus link property is set");
2514	}
2515	err = dladm_linkprop_is_set(dld_handle, linkid, DLADM_PROP_VAL_CURRENT,
2516	    "pool", &poolset);
2517	if (err != DLADM_STATUS_OK) {
2518		zdlerror(zlogp, err, dlname,
2519		    "WARNING: unable to check if pool link property is set");
2520	}
2521
2522	if ((strlen(pool_name) != 0) && !cpuset && !poolset) {
2523		poolp = pool_name;
2524		err = dladm_set_linkprop(dld_handle, linkid, "pool",
2525		    &poolp, 1, DLADM_OPT_ACTIVE);
2526		if (err != DLADM_STATUS_OK) {
2527			zerror(zlogp, B_FALSE, "WARNING: unable to set "
2528			    "pool %s to datalink %s", pool_name, dlname);
2529			bzero(pool_name, sizeof (pool_name));
2530		}
2531	} else {
2532		bzero(pool_name, sizeof (pool_name));
2533	}
2534	return (0);
2535}
2536
2537static boolean_t
2538sockaddr_to_str(sa_family_t af, const struct sockaddr *sockaddr,
2539    char *straddr, size_t len)
2540{
2541	struct sockaddr_in *sin;
2542	struct sockaddr_in6 *sin6;
2543	const char *str = NULL;
2544
2545	if (af == AF_INET) {
2546		/* LINTED E_BAD_PTR_CAST_ALIGN */
2547		sin = SIN(sockaddr);
2548		str = inet_ntop(AF_INET, (void *)&sin->sin_addr, straddr, len);
2549	} else if (af == AF_INET6) {
2550		/* LINTED E_BAD_PTR_CAST_ALIGN */
2551		sin6 = SIN6(sockaddr);
2552		str = inet_ntop(AF_INET6, (void *)&sin6->sin6_addr, straddr,
2553		    len);
2554	}
2555
2556	return (str != NULL);
2557}
2558
2559static int
2560ipv4_prefixlen(struct sockaddr_in *sin)
2561{
2562	struct sockaddr_in *m;
2563	struct sockaddr_storage mask;
2564
2565	m = SIN(&mask);
2566	m->sin_family = AF_INET;
2567	if (getnetmaskbyaddr(sin->sin_addr, &m->sin_addr) == 0) {
2568		return (mask2plen((struct sockaddr *)&mask));
2569	} else if (IN_CLASSA(htonl(sin->sin_addr.s_addr))) {
2570		return (8);
2571	} else if (IN_CLASSB(ntohl(sin->sin_addr.s_addr))) {
2572		return (16);
2573	} else if (IN_CLASSC(ntohl(sin->sin_addr.s_addr))) {
2574		return (24);
2575	}
2576	return (0);
2577}
2578
2579static int
2580zone_setattr_network(int type, zoneid_t zoneid, datalink_id_t linkid,
2581    void *buf, size_t bufsize)
2582{
2583	zone_net_data_t *zndata;
2584	size_t znsize;
2585	int err;
2586
2587	znsize = sizeof (*zndata) + bufsize;
2588	zndata = calloc(1, znsize);
2589	if (zndata == NULL)
2590		return (ENOMEM);
2591	zndata->zn_type = type;
2592	zndata->zn_len = bufsize;
2593	zndata->zn_linkid = linkid;
2594	bcopy(buf, zndata->zn_val, zndata->zn_len);
2595	err = zone_setattr(zoneid, ZONE_ATTR_NETWORK, zndata, znsize);
2596	free(zndata);
2597	return (err);
2598}
2599
2600static int
2601add_net_for_linkid(zlog_t *zlogp, zoneid_t zoneid, zone_addr_list_t *start)
2602{
2603	struct lifreq lifr;
2604	char **astr, *address;
2605	dladm_status_t dlstatus;
2606	char *ip_nospoof = "ip-nospoof";
2607	int nnet, naddr, err = 0, j;
2608	size_t zlen, cpleft;
2609	zone_addr_list_t *ptr, *end;
2610	char  tmp[INET6_ADDRSTRLEN], *maskstr;
2611	char *zaddr, *cp;
2612	struct in6_addr *routes = NULL;
2613	boolean_t is_set;
2614	datalink_id_t linkid;
2615
2616	assert(start != NULL);
2617	naddr = 0; /* number of addresses */
2618	nnet = 0; /* number of net resources */
2619	linkid = start->za_linkid;
2620	for (ptr = start; ptr != NULL && ptr->za_linkid == linkid;
2621	    ptr = ptr->za_next) {
2622		nnet++;
2623	}
2624	end = ptr;
2625	zlen = nnet * (INET6_ADDRSTRLEN + 1);
2626	astr = calloc(1, nnet * sizeof (uintptr_t));
2627	zaddr = calloc(1, zlen);
2628	if (astr == NULL || zaddr == NULL) {
2629		err = ENOMEM;
2630		goto done;
2631	}
2632	cp = zaddr;
2633	cpleft = zlen;
2634	j = 0;
2635	for (ptr = start; ptr != end; ptr = ptr->za_next) {
2636		address = ptr->za_nwiftab.zone_nwif_allowed_address;
2637		if (address[0] == '\0')
2638			continue;
2639		(void) snprintf(tmp, sizeof (tmp), "%s", address);
2640		/*
2641		 * Validate the data. zonecfg_valid_net_address() clobbers
2642		 * the /<mask> in the address string.
2643		 */
2644		if (zonecfg_valid_net_address(address, &lifr) != Z_OK) {
2645			zerror(zlogp, B_FALSE, "invalid address [%s]\n",
2646			    address);
2647			err = EINVAL;
2648			goto done;
2649		}
2650		/*
2651		 * convert any hostnames to numeric address strings.
2652		 */
2653		if (!sockaddr_to_str(lifr.lifr_addr.ss_family,
2654		    (const struct sockaddr *)&lifr.lifr_addr, cp, cpleft)) {
2655			err = EINVAL;
2656			goto done;
2657		}
2658		/*
2659		 * make a copy of the numeric string for the data needed
2660		 * by the "allowed-ips" datalink property.
2661		 */
2662		astr[j] = strdup(cp);
2663		if (astr[j] == NULL) {
2664			err = ENOMEM;
2665			goto done;
2666		}
2667		j++;
2668		/*
2669		 * compute the default netmask from the address, if necessary
2670		 */
2671		if ((maskstr = strchr(tmp, '/')) == NULL) {
2672			int prefixlen;
2673
2674			if (lifr.lifr_addr.ss_family == AF_INET) {
2675				prefixlen = ipv4_prefixlen(
2676				    SIN(&lifr.lifr_addr));
2677			} else {
2678				struct sockaddr_in6 *sin6;
2679
2680				sin6 = SIN6(&lifr.lifr_addr);
2681				if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2682					prefixlen = 10;
2683				else
2684					prefixlen = 64;
2685			}
2686			(void) snprintf(tmp, sizeof (tmp), "%d", prefixlen);
2687			maskstr = tmp;
2688		} else {
2689			maskstr++;
2690		}
2691		/* append the "/<netmask>" */
2692		(void) strlcat(cp, "/", cpleft);
2693		(void) strlcat(cp, maskstr, cpleft);
2694		(void) strlcat(cp, ",", cpleft);
2695		cp += strnlen(cp, zlen);
2696		cpleft = &zaddr[INET6_ADDRSTRLEN] - cp;
2697	}
2698	naddr = j; /* the actual number of addresses in the net resource */
2699	assert(naddr <= nnet);
2700
2701	/*
2702	 * zonecfg has already verified that the defrouter property can only
2703	 * be set if there is at least one address defined for the net resource.
2704	 * If j is 0, there are no addresses defined, and therefore no routers
2705	 * to configure, and we are done at that point.
2706	 */
2707	if (j == 0)
2708		goto done;
2709
2710	/* over-write last ',' with '\0' */
2711	zaddr[strnlen(zaddr, zlen) - 1] = '\0';
2712
2713	/*
2714	 * First make sure L3 protection is not already set on the link.
2715	 */
2716	dlstatus = dladm_linkprop_is_set(dld_handle, linkid, DLADM_OPT_ACTIVE,
2717	    "protection", &is_set);
2718	if (dlstatus != DLADM_STATUS_OK) {
2719		err = EINVAL;
2720		zerror(zlogp, B_FALSE, "unable to check if protection is set");
2721		goto done;
2722	}
2723	if (is_set) {
2724		err = EINVAL;
2725		zerror(zlogp, B_FALSE, "Protection is already set");
2726		goto done;
2727	}
2728	dlstatus = dladm_linkprop_is_set(dld_handle, linkid, DLADM_OPT_ACTIVE,
2729	    "allowed-ips", &is_set);
2730	if (dlstatus != DLADM_STATUS_OK) {
2731		err = EINVAL;
2732		zerror(zlogp, B_FALSE, "unable to check if allowed-ips is set");
2733		goto done;
2734	}
2735	if (is_set) {
2736		zerror(zlogp, B_FALSE, "allowed-ips is already set");
2737		err = EINVAL;
2738		goto done;
2739	}
2740
2741	/*
2742	 * Enable ip-nospoof for the link, and add address to the allowed-ips
2743	 * list.
2744	 */
2745	dlstatus = dladm_set_linkprop(dld_handle, linkid, "protection",
2746	    &ip_nospoof, 1, DLADM_OPT_ACTIVE);
2747	if (dlstatus != DLADM_STATUS_OK) {
2748		zerror(zlogp, B_FALSE, "could not set protection\n");
2749		err = EINVAL;
2750		goto done;
2751	}
2752	dlstatus = dladm_set_linkprop(dld_handle, linkid, "allowed-ips",
2753	    astr, naddr, DLADM_OPT_ACTIVE);
2754	if (dlstatus != DLADM_STATUS_OK) {
2755		zerror(zlogp, B_FALSE, "could not set allowed-ips\n");
2756		err = EINVAL;
2757		goto done;
2758	}
2759
2760	/* now set the address in the data-store */
2761	err = zone_setattr_network(ZONE_NETWORK_ADDRESS, zoneid, linkid,
2762	    zaddr, strnlen(zaddr, zlen) + 1);
2763	if (err != 0)
2764		goto done;
2765
2766	/*
2767	 * add the defaultrouters
2768	 */
2769	routes = calloc(1, nnet * sizeof (*routes));
2770	j = 0;
2771	for (ptr = start; ptr != end; ptr = ptr->za_next) {
2772		address = ptr->za_nwiftab.zone_nwif_defrouter;
2773		if (address[0] == '\0')
2774			continue;
2775		if (strchr(address, '/') == NULL && strchr(address, ':') != 0) {
2776			/*
2777			 * zonecfg_valid_net_address() expects numeric IPv6
2778			 * addresses to have a CIDR format netmask.
2779			 */
2780			(void) snprintf(tmp, sizeof (tmp), "/%d", V6_ADDR_LEN);
2781			(void) strlcat(address, tmp, INET6_ADDRSTRLEN);
2782		}
2783		if (zonecfg_valid_net_address(address, &lifr) != Z_OK) {
2784			zerror(zlogp, B_FALSE,
2785			    "invalid router [%s]\n", address);
2786			err = EINVAL;
2787			goto done;
2788		}
2789		if (lifr.lifr_addr.ss_family == AF_INET6) {
2790			routes[j] = SIN6(&lifr.lifr_addr)->sin6_addr;
2791		} else {
2792			IN6_INADDR_TO_V4MAPPED(&SIN(&lifr.lifr_addr)->sin_addr,
2793			    &routes[j]);
2794		}
2795		j++;
2796	}
2797	assert(j <= nnet);
2798	if (j > 0) {
2799		err = zone_setattr_network(ZONE_NETWORK_DEFROUTER, zoneid,
2800		    linkid, routes, j * sizeof (*routes));
2801	}
2802done:
2803	free(routes);
2804	for (j = 0; j < naddr; j++)
2805		free(astr[j]);
2806	free(astr);
2807	free(zaddr);
2808	return (err);
2809
2810}
2811
2812static int
2813add_net(zlog_t *zlogp, zoneid_t zoneid, zone_addr_list_t *zalist)
2814{
2815	zone_addr_list_t *ptr;
2816	datalink_id_t linkid;
2817	int err;
2818
2819	if (zalist == NULL)
2820		return (0);
2821
2822	linkid = zalist->za_linkid;
2823
2824	err = add_net_for_linkid(zlogp, zoneid, zalist);
2825	if (err != 0)
2826		return (err);
2827
2828	for (ptr = zalist; ptr != NULL; ptr = ptr->za_next) {
2829		if (ptr->za_linkid == linkid)
2830			continue;
2831		linkid = ptr->za_linkid;
2832		err = add_net_for_linkid(zlogp, zoneid, ptr);
2833		if (err != 0)
2834			return (err);
2835	}
2836	return (0);
2837}
2838
2839/*
2840 * Add "new" to the list of network interfaces to be configured  by
2841 * add_net on zone boot in "old". The list of interfaces in "old" is
2842 * sorted by datalink_id_t, with interfaces sorted FIFO for a given
2843 * datalink_id_t.
2844 *
2845 * Returns the merged list of IP interfaces containing "old" and "new"
2846 */
2847static zone_addr_list_t *
2848add_ip_interface(zone_addr_list_t *old, zone_addr_list_t *new)
2849{
2850	zone_addr_list_t *ptr, *next;
2851	datalink_id_t linkid = new->za_linkid;
2852
2853	assert(old != new);
2854
2855	if (old == NULL)
2856		return (new);
2857	for (ptr = old; ptr != NULL; ptr = ptr->za_next) {
2858		if (ptr->za_linkid == linkid)
2859			break;
2860	}
2861	if (ptr == NULL) {
2862		/* linkid does not already exist, add to the beginning */
2863		new->za_next = old;
2864		return (new);
2865	}
2866	/*
2867	 * adding to the middle of the list; ptr points at the first
2868	 * occurrence of linkid. Find the last occurrence.
2869	 */
2870	while ((next = ptr->za_next) != NULL) {
2871		if (next->za_linkid != linkid)
2872			break;
2873		ptr = next;
2874	}
2875	/* insert new after ptr */
2876	new->za_next = next;
2877	ptr->za_next = new;
2878	return (old);
2879}
2880
2881void
2882free_ip_interface(zone_addr_list_t *zalist)
2883{
2884	zone_addr_list_t *ptr, *new;
2885
2886	for (ptr = zalist; ptr != NULL; ) {
2887		new = ptr;
2888		ptr = ptr->za_next;
2889		free(new);
2890	}
2891}
2892
2893/*
2894 * Add the kernel access control information for the interface names.
2895 * If anything goes wrong, we log a general error message, attempt to tear down
2896 * whatever we set up, and return an error.
2897 */
2898static int
2899configure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
2900{
2901	zone_dochandle_t handle;
2902	struct zone_nwiftab nwiftab;
2903	char rootpath[MAXPATHLEN];
2904	char path[MAXPATHLEN];
2905	datalink_id_t linkid;
2906	di_prof_t prof = NULL;
2907	boolean_t added = B_FALSE;
2908	zone_addr_list_t *zalist = NULL, *new;
2909
2910	if ((handle = zonecfg_init_handle()) == NULL) {
2911		zerror(zlogp, B_TRUE, "getting zone configuration handle");
2912		return (-1);
2913	}
2914	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2915		zerror(zlogp, B_FALSE, "invalid configuration");
2916		zonecfg_fini_handle(handle);
2917		return (-1);
2918	}
2919
2920	if (zonecfg_setnwifent(handle) != Z_OK) {
2921		zonecfg_fini_handle(handle);
2922		return (0);
2923	}
2924
2925	for (;;) {
2926		if (zonecfg_getnwifent(handle, &nwiftab) != Z_OK)
2927			break;
2928
2929		if (prof == NULL) {
2930			if (zone_get_devroot(zone_name, rootpath,
2931			    sizeof (rootpath)) != Z_OK) {
2932				(void) zonecfg_endnwifent(handle);
2933				zonecfg_fini_handle(handle);
2934				zerror(zlogp, B_TRUE,
2935				    "unable to determine dev root");
2936				return (-1);
2937			}
2938			(void) snprintf(path, sizeof (path), "%s%s", rootpath,
2939			    "/dev");
2940			if (di_prof_init(path, &prof) != 0) {
2941				(void) zonecfg_endnwifent(handle);
2942				zonecfg_fini_handle(handle);
2943				zerror(zlogp, B_TRUE,
2944				    "failed to initialize profile");
2945				return (-1);
2946			}
2947		}
2948
2949		/*
2950		 * Create the /dev entry for backward compatibility.
2951		 * Only create the /dev entry if it's not in use.
2952		 * Note that the zone still boots when the assigned
2953		 * interface is inaccessible, used by others, etc.
2954		 * Also, when vanity naming is used, some interface do
2955		 * do not have corresponding /dev node names (for example,
2956		 * vanity named aggregations).  The /dev entry is not
2957		 * created in that case.  The /dev/net entry is always
2958		 * accessible.
2959		 */
2960		if (dladm_name2info(dld_handle, nwiftab.zone_nwif_physical,
2961		    &linkid, NULL, NULL, NULL) == DLADM_STATUS_OK &&
2962		    add_datalink(zlogp, zone_name, linkid,
2963		    nwiftab.zone_nwif_physical) == 0) {
2964			added = B_TRUE;
2965		} else {
2966			(void) zonecfg_endnwifent(handle);
2967			zonecfg_fini_handle(handle);
2968			zerror(zlogp, B_TRUE, "failed to add network device");
2969			return (-1);
2970		}
2971		/* set up the new IP interface, and add them all later */
2972		new = malloc(sizeof (*new));
2973		if (new == NULL) {
2974			zerror(zlogp, B_TRUE, "no memory for %s",
2975			    nwiftab.zone_nwif_physical);
2976			zonecfg_fini_handle(handle);
2977			free_ip_interface(zalist);
2978		}
2979		bzero(new, sizeof (*new));
2980		new->za_nwiftab = nwiftab;
2981		new->za_linkid = linkid;
2982		zalist = add_ip_interface(zalist, new);
2983	}
2984	if (zalist != NULL) {
2985		if ((errno = add_net(zlogp, zoneid, zalist)) != 0) {
2986			(void) zonecfg_endnwifent(handle);
2987			zonecfg_fini_handle(handle);
2988			zerror(zlogp, B_TRUE, "failed to add address");
2989			free_ip_interface(zalist);
2990			return (-1);
2991		}
2992		free_ip_interface(zalist);
2993	}
2994	(void) zonecfg_endnwifent(handle);
2995	zonecfg_fini_handle(handle);
2996
2997	if (prof != NULL && added) {
2998		if (di_prof_commit(prof) != 0) {
2999			zerror(zlogp, B_TRUE, "failed to commit profile");
3000			return (-1);
3001		}
3002	}
3003	if (prof != NULL)
3004		di_prof_fini(prof);
3005
3006	return (0);
3007}
3008
3009static int
3010remove_datalink_pool(zlog_t *zlogp, zoneid_t zoneid)
3011{
3012	ushort_t flags;
3013	zone_iptype_t iptype;
3014	int i, dlnum = 0;
3015	datalink_id_t *dllink, *dllinks = NULL;
3016	dladm_status_t err;
3017
3018	if (strlen(pool_name) == 0)
3019		return (0);
3020
3021	if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
3022	    sizeof (flags)) < 0) {
3023		if (vplat_get_iptype(zlogp, &iptype) < 0) {
3024			zerror(zlogp, B_FALSE, "unable to determine ip-type");
3025			return (-1);
3026		}
3027	} else {
3028		if (flags & ZF_NET_EXCL)
3029			iptype = ZS_EXCLUSIVE;
3030		else
3031			iptype = ZS_SHARED;
3032	}
3033
3034	if (iptype == ZS_EXCLUSIVE) {
3035		/*
3036		 * Get the datalink count and for each datalink,
3037		 * attempt to clear the pool property and clear
3038		 * the pool_name.
3039		 */
3040		if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
3041			zerror(zlogp, B_TRUE, "unable to count network "
3042			    "interfaces");
3043			return (-1);
3044		}
3045
3046		if (dlnum == 0)
3047			return (0);
3048
3049		if ((dllinks = malloc(dlnum * sizeof (datalink_id_t)))
3050		    == NULL) {
3051			zerror(zlogp, B_TRUE, "memory allocation failed");
3052			return (-1);
3053		}
3054		if (zone_list_datalink(zoneid, &dlnum, dllinks) != 0) {
3055			zerror(zlogp, B_TRUE, "unable to list network "
3056			    "interfaces");
3057			return (-1);
3058		}
3059
3060		bzero(pool_name, sizeof (pool_name));
3061		for (i = 0, dllink = dllinks; i < dlnum; i++, dllink++) {
3062			err = dladm_set_linkprop(dld_handle, *dllink, "pool",
3063			    NULL, 0, DLADM_OPT_ACTIVE);
3064			if (err != DLADM_STATUS_OK) {
3065				zerror(zlogp, B_TRUE,
3066				    "WARNING: unable to clear pool");
3067			}
3068		}
3069		free(dllinks);
3070	}
3071	return (0);
3072}
3073
3074static int
3075remove_datalink_protect(zlog_t *zlogp, zoneid_t zoneid)
3076{
3077	ushort_t flags;
3078	zone_iptype_t iptype;
3079	int i, dlnum = 0;
3080	dladm_status_t dlstatus;
3081	datalink_id_t *dllink, *dllinks = NULL;
3082
3083	if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
3084	    sizeof (flags)) < 0) {
3085		if (vplat_get_iptype(zlogp, &iptype) < 0) {
3086			zerror(zlogp, B_FALSE, "unable to determine ip-type");
3087			return (-1);
3088		}
3089	} else {
3090		if (flags & ZF_NET_EXCL)
3091			iptype = ZS_EXCLUSIVE;
3092		else
3093			iptype = ZS_SHARED;
3094	}
3095
3096	if (iptype != ZS_EXCLUSIVE)
3097		return (0);
3098
3099	/*
3100	 * Get the datalink count and for each datalink,
3101	 * attempt to clear the pool property and clear
3102	 * the pool_name.
3103	 */
3104	if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
3105		zerror(zlogp, B_TRUE, "unable to count network interfaces");
3106		return (-1);
3107	}
3108
3109	if (dlnum == 0)
3110		return (0);
3111
3112	if ((dllinks = malloc(dlnum * sizeof (datalink_id_t))) == NULL) {
3113		zerror(zlogp, B_TRUE, "memory allocation failed");
3114		return (-1);
3115	}
3116	if (zone_list_datalink(zoneid, &dlnum, dllinks) != 0) {
3117		zerror(zlogp, B_TRUE, "unable to list network interfaces");
3118		free(dllinks);
3119		return (-1);
3120	}
3121
3122	for (i = 0, dllink = dllinks; i < dlnum; i++, dllink++) {
3123		char dlerr[DLADM_STRSIZE];
3124
3125		dlstatus = dladm_set_linkprop(dld_handle, *dllink,
3126		    "protection", NULL, 0, DLADM_OPT_ACTIVE);
3127		if (dlstatus == DLADM_STATUS_NOTFOUND) {
3128			/* datalink does not belong to the GZ */
3129			continue;
3130		}
3131		if (dlstatus != DLADM_STATUS_OK) {
3132			zerror(zlogp, B_FALSE,
3133			    dladm_status2str(dlstatus, dlerr));
3134			free(dllinks);
3135			return (-1);
3136		}
3137		dlstatus = dladm_set_linkprop(dld_handle, *dllink,
3138		    "allowed-ips", NULL, 0, DLADM_OPT_ACTIVE);
3139		if (dlstatus != DLADM_STATUS_OK) {
3140			zerror(zlogp, B_FALSE,
3141			    dladm_status2str(dlstatus, dlerr));
3142			free(dllinks);
3143			return (-1);
3144		}
3145	}
3146	free(dllinks);
3147	return (0);
3148}
3149
3150static int
3151unconfigure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
3152{
3153	int dlnum = 0;
3154
3155	/*
3156	 * The kernel shutdown callback for the dls module should have removed
3157	 * all datalinks from this zone.  If any remain, then there's a
3158	 * problem.
3159	 */
3160	if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
3161		zerror(zlogp, B_TRUE, "unable to list network interfaces");
3162		return (-1);
3163	}
3164	if (dlnum != 0) {
3165		zerror(zlogp, B_FALSE,
3166		    "datalinks remain in zone after shutdown");
3167		return (-1);
3168	}
3169	return (0);
3170}
3171
3172static int
3173tcp_abort_conn(zlog_t *zlogp, zoneid_t zoneid,
3174    const struct sockaddr_storage *local, const struct sockaddr_storage *remote)
3175{
3176	int fd;
3177	struct strioctl ioc;
3178	tcp_ioc_abort_conn_t conn;
3179	int error;
3180
3181	conn.ac_local = *local;
3182	conn.ac_remote = *remote;
3183	conn.ac_start = TCPS_SYN_SENT;
3184	conn.ac_end = TCPS_TIME_WAIT;
3185	conn.ac_zoneid = zoneid;
3186
3187	ioc.ic_cmd = TCP_IOC_ABORT_CONN;
3188	ioc.ic_timout = -1; /* infinite timeout */
3189	ioc.ic_len = sizeof (conn);
3190	ioc.ic_dp = (char *)&conn;
3191
3192	if ((fd = open("/dev/tcp", O_RDONLY)) < 0) {
3193		zerror(zlogp, B_TRUE, "unable to open %s", "/dev/tcp");
3194		return (-1);
3195	}
3196
3197	error = ioctl(fd, I_STR, &ioc);
3198	(void) close(fd);
3199	if (error == 0 || errno == ENOENT)	/* ENOENT is not an error */
3200		return (0);
3201	return (-1);
3202}
3203
3204static int
3205tcp_abort_connections(zlog_t *zlogp, zoneid_t zoneid)
3206{
3207	struct sockaddr_storage l, r;
3208	struct sockaddr_in *local, *remote;
3209	struct sockaddr_in6 *local6, *remote6;
3210	int error;
3211
3212	/*
3213	 * Abort IPv4 connections.
3214	 */
3215	bzero(&l, sizeof (*local));
3216	local = (struct sockaddr_in *)&l;
3217	local->sin_family = AF_INET;
3218	local->sin_addr.s_addr = INADDR_ANY;
3219	local->sin_port = 0;
3220
3221	bzero(&r, sizeof (*remote));
3222	remote = (struct sockaddr_in *)&r;
3223	remote->sin_family = AF_INET;
3224	remote->sin_addr.s_addr = INADDR_ANY;
3225	remote->sin_port = 0;
3226
3227	if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
3228		return (error);
3229
3230	/*
3231	 * Abort IPv6 connections.
3232	 */
3233	bzero(&l, sizeof (*local6));
3234	local6 = (struct sockaddr_in6 *)&l;
3235	local6->sin6_family = AF_INET6;
3236	local6->sin6_port = 0;
3237	local6->sin6_addr = in6addr_any;
3238
3239	bzero(&r, sizeof (*remote6));
3240	remote6 = (struct sockaddr_in6 *)&r;
3241	remote6->sin6_family = AF_INET6;
3242	remote6->sin6_port = 0;
3243	remote6->sin6_addr = in6addr_any;
3244
3245	if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
3246		return (error);
3247	return (0);
3248}
3249
3250static int
3251get_privset(zlog_t *zlogp, priv_set_t *privs, zone_mnt_t mount_cmd)
3252{
3253	int error = -1;
3254	zone_dochandle_t handle;
3255	char *privname = NULL;
3256
3257	if ((handle = zonecfg_init_handle()) == NULL) {
3258		zerror(zlogp, B_TRUE, "getting zone configuration handle");
3259		return (-1);
3260	}
3261	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
3262		zerror(zlogp, B_FALSE, "invalid configuration");
3263		zonecfg_fini_handle(handle);
3264		return (-1);
3265	}
3266
3267	if (ALT_MOUNT(mount_cmd)) {
3268		zone_iptype_t	iptype;
3269		const char	*curr_iptype;
3270
3271		if (zonecfg_get_iptype(handle, &iptype) != Z_OK) {
3272			zerror(zlogp, B_TRUE, "unable to determine ip-type");
3273			zonecfg_fini_handle(handle);
3274			return (-1);
3275		}
3276
3277		switch (iptype) {
3278		case ZS_SHARED:
3279			curr_iptype = "shared";
3280			break;
3281		case ZS_EXCLUSIVE:
3282			curr_iptype = "exclusive";
3283			break;
3284		}
3285
3286		if (zonecfg_default_privset(privs, curr_iptype) == Z_OK) {
3287			zonecfg_fini_handle(handle);
3288			return (0);
3289		}
3290		zerror(zlogp, B_FALSE,
3291		    "failed to determine the zone's default privilege set");
3292		zonecfg_fini_handle(handle);
3293		return (-1);
3294	}
3295
3296	switch (zonecfg_get_privset(handle, privs, &privname)) {
3297	case Z_OK:
3298		error = 0;
3299		break;
3300	case Z_PRIV_PROHIBITED:
3301		zerror(zlogp, B_FALSE, "privilege \"%s\" is not permitted "
3302		    "within the zone's privilege set", privname);
3303		break;
3304	case Z_PRIV_REQUIRED:
3305		zerror(zlogp, B_FALSE, "required privilege \"%s\" is missing "
3306		    "from the zone's privilege set", privname);
3307		break;
3308	case Z_PRIV_UNKNOWN:
3309		zerror(zlogp, B_FALSE, "unknown privilege \"%s\" specified "
3310		    "in the zone's privilege set", privname);
3311		break;
3312	default:
3313		zerror(zlogp, B_FALSE, "failed to determine the zone's "
3314		    "privilege set");
3315		break;
3316	}
3317
3318	free(privname);
3319	zonecfg_fini_handle(handle);
3320	return (error);
3321}
3322
3323static int
3324get_rctls(zlog_t *zlogp, char **bufp, size_t *bufsizep)
3325{
3326	nvlist_t *nvl = NULL;
3327	char *nvl_packed = NULL;
3328	size_t nvl_size = 0;
3329	nvlist_t **nvlv = NULL;
3330	int rctlcount = 0;
3331	int error = -1;
3332	zone_dochandle_t handle;
3333	struct zone_rctltab rctltab;
3334	rctlblk_t *rctlblk = NULL;
3335	uint64_t maxlwps;
3336	uint64_t maxprocs;
3337
3338	*bufp = NULL;
3339	*bufsizep = 0;
3340
3341	if ((handle = zonecfg_init_handle()) == NULL) {
3342		zerror(zlogp, B_TRUE, "getting zone configuration handle");
3343		return (-1);
3344	}
3345	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
3346		zerror(zlogp, B_FALSE, "invalid configuration");
3347		zonecfg_fini_handle(handle);
3348		return (-1);
3349	}
3350
3351	rctltab.zone_rctl_valptr = NULL;
3352	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0) {
3353		zerror(zlogp, B_TRUE, "%s failed", "nvlist_alloc");
3354		goto out;
3355	}
3356
3357	/*
3358	 * Allow the administrator to control both the maximum number of
3359	 * process table slots and the maximum number of lwps with just the
3360	 * max-processes property.  If only the max-processes property is set,
3361	 * we add a max-lwps property with a limit derived from max-processes.
3362	 */
3363	if (zonecfg_get_aliased_rctl(handle, ALIAS_MAXPROCS, &maxprocs)
3364	    == Z_OK &&
3365	    zonecfg_get_aliased_rctl(handle, ALIAS_MAXLWPS, &maxlwps)
3366	    == Z_NO_ENTRY) {
3367		if (zonecfg_set_aliased_rctl(handle, ALIAS_MAXLWPS,
3368		    maxprocs * LWPS_PER_PROCESS) != Z_OK) {
3369			zerror(zlogp, B_FALSE, "unable to set max-lwps alias");
3370			goto out;
3371		}
3372	}
3373
3374	if (zonecfg_setrctlent(handle) != Z_OK) {
3375		zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setrctlent");
3376		goto out;
3377	}
3378
3379	if ((rctlblk = malloc(rctlblk_size())) == NULL) {
3380		zerror(zlogp, B_TRUE, "memory allocation failed");
3381		goto out;
3382	}
3383	while (zonecfg_getrctlent(handle, &rctltab) == Z_OK) {
3384		struct zone_rctlvaltab *rctlval;
3385		uint_t i, count;
3386		const char *name = rctltab.zone_rctl_name;
3387
3388		/* zoneadm should have already warned about unknown rctls. */
3389		if (!zonecfg_is_rctl(name)) {
3390			zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3391			rctltab.zone_rctl_valptr = NULL;
3392			continue;
3393		}
3394		count = 0;
3395		for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
3396		    rctlval = rctlval->zone_rctlval_next) {
3397			count++;
3398		}
3399		if (count == 0) {	/* ignore */
3400			continue;	/* Nothing to free */
3401		}
3402		if ((nvlv = malloc(sizeof (*nvlv) * count)) == NULL)
3403			goto out;
3404		i = 0;
3405		for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
3406		    rctlval = rctlval->zone_rctlval_next, i++) {
3407			if (nvlist_alloc(&nvlv[i], NV_UNIQUE_NAME, 0) != 0) {
3408				zerror(zlogp, B_TRUE, "%s failed",
3409				    "nvlist_alloc");
3410				goto out;
3411			}
3412			if (zonecfg_construct_rctlblk(rctlval, rctlblk)
3413			    != Z_OK) {
3414				zerror(zlogp, B_FALSE, "invalid rctl value: "
3415				    "(priv=%s,limit=%s,action=%s)",
3416				    rctlval->zone_rctlval_priv,
3417				    rctlval->zone_rctlval_limit,
3418				    rctlval->zone_rctlval_action);
3419				goto out;
3420			}
3421			if (!zonecfg_valid_rctl(name, rctlblk)) {
3422				zerror(zlogp, B_FALSE,
3423				    "(priv=%s,limit=%s,action=%s) is not a "
3424				    "valid value for rctl '%s'",
3425				    rctlval->zone_rctlval_priv,
3426				    rctlval->zone_rctlval_limit,
3427				    rctlval->zone_rctlval_action,
3428				    name);
3429				goto out;
3430			}
3431			if (nvlist_add_uint64(nvlv[i], "privilege",
3432			    rctlblk_get_privilege(rctlblk)) != 0) {
3433				zerror(zlogp, B_FALSE, "%s failed",
3434				    "nvlist_add_uint64");
3435				goto out;
3436			}
3437			if (nvlist_add_uint64(nvlv[i], "limit",
3438			    rctlblk_get_value(rctlblk)) != 0) {
3439				zerror(zlogp, B_FALSE, "%s failed",
3440				    "nvlist_add_uint64");
3441				goto out;
3442			}
3443			if (nvlist_add_uint64(nvlv[i], "action",
3444			    (uint_t)rctlblk_get_local_action(rctlblk, NULL))
3445			    != 0) {
3446				zerror(zlogp, B_FALSE, "%s failed",
3447				    "nvlist_add_uint64");
3448				goto out;
3449			}
3450		}
3451		zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3452		rctltab.zone_rctl_valptr = NULL;
3453		if (nvlist_add_nvlist_array(nvl, (char *)name, nvlv, count)
3454		    != 0) {
3455			zerror(zlogp, B_FALSE, "%s failed",
3456			    "nvlist_add_nvlist_array");
3457			goto out;
3458		}
3459		for (i = 0; i < count; i++)
3460			nvlist_free(nvlv[i]);
3461		free(nvlv);
3462		nvlv = NULL;
3463		rctlcount++;
3464	}
3465	(void) zonecfg_endrctlent(handle);
3466
3467	if (rctlcount == 0) {
3468		error = 0;
3469		goto out;
3470	}
3471	if (nvlist_pack(nvl, &nvl_packed, &nvl_size, NV_ENCODE_NATIVE, 0)
3472	    != 0) {
3473		zerror(zlogp, B_FALSE, "%s failed", "nvlist_pack");
3474		goto out;
3475	}
3476
3477	error = 0;
3478	*bufp = nvl_packed;
3479	*bufsizep = nvl_size;
3480
3481out:
3482	free(rctlblk);
3483	zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3484	if (error && nvl_packed != NULL)
3485		free(nvl_packed);
3486	nvlist_free(nvl);
3487	if (nvlv != NULL)
3488		free(nvlv);
3489	if (handle != NULL)
3490		zonecfg_fini_handle(handle);
3491	return (error);
3492}
3493
3494static int
3495get_implicit_datasets(zlog_t *zlogp, char **retstr)
3496{
3497	char cmdbuf[2 * MAXPATHLEN];
3498
3499	if (query_hook[0] == '\0')
3500		return (0);
3501
3502	if (snprintf(cmdbuf, sizeof (cmdbuf), "%s datasets", query_hook)
3503	    > sizeof (cmdbuf))
3504		return (-1);
3505
3506	if (do_subproc(zlogp, cmdbuf, retstr) != 0)
3507		return (-1);
3508
3509	return (0);
3510}
3511
3512static int
3513get_datasets(zlog_t *zlogp, char **bufp, size_t *bufsizep)
3514{
3515	zone_dochandle_t handle;
3516	struct zone_dstab dstab;
3517	size_t total, offset, len;
3518	int error = -1;
3519	char *str = NULL;
3520	char *implicit_datasets = NULL;
3521	int implicit_len = 0;
3522
3523	*bufp = NULL;
3524	*bufsizep = 0;
3525
3526	if ((handle = zonecfg_init_handle()) == NULL) {
3527		zerror(zlogp, B_TRUE, "getting zone configuration handle");
3528		return (-1);
3529	}
3530	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
3531		zerror(zlogp, B_FALSE, "invalid configuration");
3532		zonecfg_fini_handle(handle);
3533		return (-1);
3534	}
3535
3536	if (get_implicit_datasets(zlogp, &implicit_datasets) != 0) {
3537		zerror(zlogp, B_FALSE, "getting implicit datasets failed");
3538		goto out;
3539	}
3540
3541	if (zonecfg_setdsent(handle) != Z_OK) {
3542		zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
3543		goto out;
3544	}
3545
3546	total = 0;
3547	while (zonecfg_getdsent(handle, &dstab) == Z_OK)
3548		total += strlen(dstab.zone_dataset_name) + 1;
3549	(void) zonecfg_enddsent(handle);
3550
3551	if (implicit_datasets != NULL)
3552		implicit_len = strlen(implicit_datasets);
3553	if (implicit_len > 0)
3554		total += implicit_len + 1;
3555
3556	if (total == 0) {
3557		error = 0;
3558		goto out;
3559	}
3560
3561	if ((str = malloc(total)) == NULL) {
3562		zerror(zlogp, B_TRUE, "memory allocation failed");
3563		goto out;
3564	}
3565
3566	if (zonecfg_setdsent(handle) != Z_OK) {
3567		zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
3568		goto out;
3569	}
3570	offset = 0;
3571	while (zonecfg_getdsent(handle, &dstab) == Z_OK) {
3572		len = strlen(dstab.zone_dataset_name);
3573		(void) strlcpy(str + offset, dstab.zone_dataset_name,
3574		    total - offset);
3575		offset += len;
3576		if (offset < total - 1)
3577			str[offset++] = ',';
3578	}
3579	(void) zonecfg_enddsent(handle);
3580
3581	if (implicit_len > 0)
3582		(void) strlcpy(str + offset, implicit_datasets, total - offset);
3583
3584	error = 0;
3585	*bufp = str;
3586	*bufsizep = total;
3587
3588out:
3589	if (error != 0 && str != NULL)
3590		free(str);
3591	if (handle != NULL)
3592		zonecfg_fini_handle(handle);
3593	if (implicit_datasets != NULL)
3594		free(implicit_datasets);
3595
3596	return (error);
3597}
3598
3599static int
3600validate_datasets(zlog_t *zlogp)
3601{
3602	zone_dochandle_t handle;
3603	struct zone_dstab dstab;
3604	zfs_handle_t *zhp;
3605	libzfs_handle_t *hdl;
3606
3607	if ((handle = zonecfg_init_handle()) == NULL) {
3608		zerror(zlogp, B_TRUE, "getting zone configuration handle");
3609		return (-1);
3610	}
3611	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
3612		zerror(zlogp, B_FALSE, "invalid configuration");
3613		zonecfg_fini_handle(handle);
3614		return (-1);
3615	}
3616
3617	if (zonecfg_setdsent(handle) != Z_OK) {
3618		zerror(zlogp, B_FALSE, "invalid configuration");
3619		zonecfg_fini_handle(handle);
3620		return (-1);
3621	}
3622
3623	if ((hdl = libzfs_init()) == NULL) {
3624		zerror(zlogp, B_FALSE, "opening ZFS library");
3625		zonecfg_fini_handle(handle);
3626		return (-1);
3627	}
3628
3629	while (zonecfg_getdsent(handle, &dstab) == Z_OK) {
3630
3631		if ((zhp = zfs_open(hdl, dstab.zone_dataset_name,
3632		    ZFS_TYPE_FILESYSTEM)) == NULL) {
3633			zerror(zlogp, B_FALSE, "cannot open ZFS dataset '%s'",
3634			    dstab.zone_dataset_name);
3635			zonecfg_fini_handle(handle);
3636			libzfs_fini(hdl);
3637			return (-1);
3638		}
3639
3640		/*
3641		 * Automatically set the 'zoned' property.  We check the value
3642		 * first because we'll get EPERM if it is already set.
3643		 */
3644		if (!zfs_prop_get_int(zhp, ZFS_PROP_ZONED) &&
3645		    zfs_prop_set(zhp, zfs_prop_to_name(ZFS_PROP_ZONED),
3646		    "on") != 0) {
3647			zerror(zlogp, B_FALSE, "cannot set 'zoned' "
3648			    "property for ZFS dataset '%s'\n",
3649			    dstab.zone_dataset_name);
3650			zonecfg_fini_handle(handle);
3651			zfs_close(zhp);
3652			libzfs_fini(hdl);
3653			return (-1);
3654		}
3655
3656		zfs_close(zhp);
3657	}
3658	(void) zonecfg_enddsent(handle);
3659
3660	zonecfg_fini_handle(handle);
3661	libzfs_fini(hdl);
3662
3663	return (0);
3664}
3665
3666/*
3667 * Return true if the path is its own zfs file system.  We determine this
3668 * by stat-ing the path to see if it is zfs and stat-ing the parent to see
3669 * if it is a different fs.
3670 */
3671boolean_t
3672is_zonepath_zfs(char *zonepath)
3673{
3674	int res;
3675	char *path;
3676	char *parent;
3677	struct statvfs64 buf1, buf2;
3678
3679	if (statvfs64(zonepath, &buf1) != 0)
3680		return (B_FALSE);
3681
3682	if (strcmp(buf1.f_basetype, "zfs") != 0)
3683		return (B_FALSE);
3684
3685	if ((path = strdup(zonepath)) == NULL)
3686		return (B_FALSE);
3687
3688	parent = dirname(path);
3689	res = statvfs64(parent, &buf2);
3690	free(path);
3691
3692	if (res != 0)
3693		return (B_FALSE);
3694
3695	if (buf1.f_fsid == buf2.f_fsid)
3696		return (B_FALSE);
3697
3698	return (B_TRUE);
3699}
3700
3701/*
3702 * Verify the MAC label in the root dataset for the zone.
3703 * If the label exists, it must match the label configured for the zone.
3704 * Otherwise if there's no label on the dataset, create one here.
3705 */
3706
3707static int
3708validate_rootds_label(zlog_t *zlogp, char *rootpath, m_label_t *zone_sl)
3709{
3710	int		error = -1;
3711	zfs_handle_t	*zhp;
3712	libzfs_handle_t	*hdl;
3713	m_label_t	ds_sl;
3714	char		zonepath[MAXPATHLEN];
3715	char		ds_hexsl[MAXNAMELEN];
3716
3717	if (!is_system_labeled())
3718		return (0);
3719
3720	if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
3721		zerror(zlogp, B_TRUE, "unable to determine zone path");
3722		return (-1);
3723	}
3724
3725	if (!is_zonepath_zfs(zonepath))
3726		return (0);
3727
3728	if ((hdl = libzfs_init()) == NULL) {
3729		zerror(zlogp, B_FALSE, "opening ZFS library");
3730		return (-1);
3731	}
3732
3733	if ((zhp = zfs_path_to_zhandle(hdl, rootpath,
3734	    ZFS_TYPE_FILESYSTEM)) == NULL) {
3735		zerror(zlogp, B_FALSE, "cannot open ZFS dataset for path '%s'",
3736		    rootpath);
3737		libzfs_fini(hdl);
3738		return (-1);
3739	}
3740
3741	/* Get the mlslabel property if it exists. */
3742	if ((zfs_prop_get(zhp, ZFS_PROP_MLSLABEL, ds_hexsl, MAXNAMELEN,
3743	    NULL, NULL, 0, B_TRUE) != 0) ||
3744	    (strcmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) == 0)) {
3745		char		*str2 = NULL;
3746
3747		/*
3748		 * No label on the dataset (or default only); create one.
3749		 * (Only do this automatic labeling for the labeled brand.)
3750		 */
3751		if (strcmp(brand_name, LABELED_BRAND_NAME) != 0) {
3752			error = 0;
3753			goto out;
3754		}
3755
3756		error = l_to_str_internal(zone_sl, &str2);
3757		if (error)
3758			goto out;
3759		if (str2 == NULL) {
3760			error = -1;
3761			goto out;
3762		}
3763		if ((error = zfs_prop_set(zhp,
3764		    zfs_prop_to_name(ZFS_PROP_MLSLABEL), str2)) != 0) {
3765			zerror(zlogp, B_FALSE, "cannot set 'mlslabel' "
3766			    "property for root dataset at '%s'\n", rootpath);
3767		}
3768		free(str2);
3769		goto out;
3770	}
3771
3772	/* Convert the retrieved dataset label to binary form. */
3773	error = hexstr_to_label(ds_hexsl, &ds_sl);
3774	if (error) {
3775		zerror(zlogp, B_FALSE, "invalid 'mlslabel' "
3776		    "property on root dataset at '%s'\n", rootpath);
3777		goto out;			/* exit with error */
3778	}
3779
3780	/*
3781	 * Perform a MAC check by comparing the zone label with the
3782	 * dataset label.
3783	 */
3784	error = (!blequal(zone_sl, &ds_sl));
3785	if (error)
3786		zerror(zlogp, B_FALSE, "Rootpath dataset has mismatched label");
3787out:
3788	zfs_close(zhp);
3789	libzfs_fini(hdl);
3790
3791	return (error);
3792}
3793
3794/*
3795 * Mount lower level home directories into/from current zone
3796 * Share exported directories specified in dfstab for zone
3797 */
3798static int
3799tsol_mounts(zlog_t *zlogp, char *zone_name, char *rootpath)
3800{
3801	zoneid_t *zids = NULL;
3802	priv_set_t *zid_privs;
3803	const priv_impl_info_t *ip = NULL;
3804	uint_t nzents_saved;
3805	uint_t nzents;
3806	int i;
3807	char readonly[] = "ro";
3808	struct zone_fstab lower_fstab;
3809	char *argv[4];
3810
3811	if (!is_system_labeled())
3812		return (0);
3813
3814	if (zid_label == NULL) {
3815		zid_label = m_label_alloc(MAC_LABEL);
3816		if (zid_label == NULL)
3817			return (-1);
3818	}
3819
3820	/* Make sure our zone has an /export/home dir */
3821	(void) make_one_dir(zlogp, rootpath, "/export/home",
3822	    DEFAULT_DIR_MODE, DEFAULT_DIR_USER, DEFAULT_DIR_GROUP);
3823
3824	lower_fstab.zone_fs_raw[0] = '\0';
3825	(void) strlcpy(lower_fstab.zone_fs_type, MNTTYPE_LOFS,
3826	    sizeof (lower_fstab.zone_fs_type));
3827	lower_fstab.zone_fs_options = NULL;
3828	(void) zonecfg_add_fs_option(&lower_fstab, readonly);
3829
3830	/*
3831	 * Get the list of zones from the kernel
3832	 */
3833	if (zone_list(NULL, &nzents) != 0) {
3834		zerror(zlogp, B_TRUE, "unable to list zones");
3835		zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3836		return (-1);
3837	}
3838again:
3839	if (nzents == 0) {
3840		zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3841		return (-1);
3842	}
3843
3844	zids = malloc(nzents * sizeof (zoneid_t));
3845	if (zids == NULL) {
3846		zerror(zlogp, B_TRUE, "memory allocation failed");
3847		return (-1);
3848	}
3849	nzents_saved = nzents;
3850
3851	if (zone_list(zids, &nzents) != 0) {
3852		zerror(zlogp, B_TRUE, "unable to list zones");
3853		zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3854		free(zids);
3855		return (-1);
3856	}
3857	if (nzents != nzents_saved) {
3858		/* list changed, try again */
3859		free(zids);
3860		goto again;
3861	}
3862
3863	ip = getprivimplinfo();
3864	if ((zid_privs = priv_allocset()) == NULL) {
3865		zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
3866		zonecfg_free_fs_option_list(
3867		    lower_fstab.zone_fs_options);
3868		free(zids);
3869		return (-1);
3870	}
3871
3872	for (i = 0; i < nzents; i++) {
3873		char zid_name[ZONENAME_MAX];
3874		zone_state_t zid_state;
3875		char zid_rpath[MAXPATHLEN];
3876		struct stat stat_buf;
3877
3878		if (zids[i] == GLOBAL_ZONEID)
3879			continue;
3880
3881		if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
3882			continue;
3883
3884		/*
3885		 * Do special setup for the zone we are booting
3886		 */
3887		if (strcmp(zid_name, zone_name) == 0) {
3888			struct zone_fstab autofs_fstab;
3889			char map_path[MAXPATHLEN];
3890			int fd;
3891
3892			/*
3893			 * Create auto_home_<zone> map for this zone
3894			 * in the global zone. The non-global zone entry
3895			 * will be created by automount when the zone
3896			 * is booted.
3897			 */
3898
3899			(void) snprintf(autofs_fstab.zone_fs_special,
3900			    MAXPATHLEN, "auto_home_%s", zid_name);
3901
3902			(void) snprintf(autofs_fstab.zone_fs_dir, MAXPATHLEN,
3903			    "/zone/%s/home", zid_name);
3904
3905			(void) snprintf(map_path, sizeof (map_path),
3906			    "/etc/%s", autofs_fstab.zone_fs_special);
3907			/*
3908			 * If the map file doesn't exist create a template
3909			 */
3910			if ((fd = open(map_path, O_RDWR | O_CREAT | O_EXCL,
3911			    S_IRUSR | S_IWUSR | S_IRGRP| S_IROTH)) != -1) {
3912				int len;
3913				char map_rec[MAXPATHLEN];
3914
3915				len = snprintf(map_rec, sizeof (map_rec),
3916				    "+%s\n*\t-fstype=lofs\t:%s/export/home/&\n",
3917				    autofs_fstab.zone_fs_special, rootpath);
3918				(void) write(fd, map_rec, len);
3919				(void) close(fd);
3920			}
3921
3922			/*
3923			 * Mount auto_home_<zone> in the global zone if absent.
3924			 * If it's already of type autofs, then
3925			 * don't mount it again.
3926			 */
3927			if ((stat(autofs_fstab.zone_fs_dir, &stat_buf) == -1) ||
3928			    strcmp(stat_buf.st_fstype, MNTTYPE_AUTOFS) != 0) {
3929				char optstr[] = "indirect,ignore,nobrowse";
3930
3931				(void) make_one_dir(zlogp, "",
3932				    autofs_fstab.zone_fs_dir, DEFAULT_DIR_MODE,
3933				    DEFAULT_DIR_USER, DEFAULT_DIR_GROUP);
3934
3935				/*
3936				 * Mount will fail if automounter has already
3937				 * processed the auto_home_<zonename> map
3938				 */
3939				(void) domount(zlogp, MNTTYPE_AUTOFS, optstr,
3940				    autofs_fstab.zone_fs_special,
3941				    autofs_fstab.zone_fs_dir);
3942			}
3943			continue;
3944		}
3945
3946
3947		if (zone_get_state(zid_name, &zid_state) != Z_OK ||
3948		    (zid_state != ZONE_STATE_READY &&
3949		    zid_state != ZONE_STATE_RUNNING))
3950			/* Skip over zones without mounted filesystems */
3951			continue;
3952
3953		if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
3954		    sizeof (m_label_t)) < 0)
3955			/* Skip over zones with unspecified label */
3956			continue;
3957
3958		if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
3959		    sizeof (zid_rpath)) == -1)
3960			/* Skip over zones with bad path */
3961			continue;
3962
3963		if (zone_getattr(zids[i], ZONE_ATTR_PRIVSET, zid_privs,
3964		    sizeof (priv_chunk_t) * ip->priv_setsize) == -1)
3965			/* Skip over zones with bad privs */
3966			continue;
3967
3968		/*
3969		 * Reading down is valid according to our label model
3970		 * but some customers want to disable it because it
3971		 * allows execute down and other possible attacks.
3972		 * Therefore, we restrict this feature to zones that
3973		 * have the NET_MAC_AWARE privilege which is required
3974		 * for NFS read-down semantics.
3975		 */
3976		if ((bldominates(zlabel, zid_label)) &&
3977		    (priv_ismember(zprivs, PRIV_NET_MAC_AWARE))) {
3978			/*
3979			 * Our zone dominates this one.
3980			 * Create a lofs mount from lower zone's /export/home
3981			 */
3982			(void) snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
3983			    "%s/zone/%s/export/home", rootpath, zid_name);
3984
3985			/*
3986			 * If the target is already an LOFS mount
3987			 * then don't do it again.
3988			 */
3989			if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
3990			    strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
3991
3992				if (snprintf(lower_fstab.zone_fs_special,
3993				    MAXPATHLEN, "%s/export",
3994				    zid_rpath) > MAXPATHLEN)
3995					continue;
3996
3997				/*
3998				 * Make sure the lower-level home exists
3999				 */
4000				if (make_one_dir(zlogp,
4001				    lower_fstab.zone_fs_special, "/home",
4002				    DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
4003				    DEFAULT_DIR_GROUP) != 0)
4004					continue;
4005
4006				(void) strlcat(lower_fstab.zone_fs_special,
4007				    "/home", MAXPATHLEN);
4008
4009				/*
4010				 * Mount can fail because the lower-level
4011				 * zone may have already done a mount up.
4012				 */
4013				(void) mount_one(zlogp, &lower_fstab, "",
4014				    Z_MNT_BOOT);
4015			}
4016		} else if ((bldominates(zid_label, zlabel)) &&
4017		    (priv_ismember(zid_privs, PRIV_NET_MAC_AWARE))) {
4018			/*
4019			 * This zone dominates our zone.
4020			 * Create a lofs mount from our zone's /export/home
4021			 */
4022			if (snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
4023			    "%s/zone/%s/export/home", zid_rpath,
4024			    zone_name) > MAXPATHLEN)
4025				continue;
4026
4027			/*
4028			 * If the target is already an LOFS mount
4029			 * then don't do it again.
4030			 */
4031			if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
4032			    strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
4033
4034				(void) snprintf(lower_fstab.zone_fs_special,
4035				    MAXPATHLEN, "%s/export/home", rootpath);
4036
4037				/*
4038				 * Mount can fail because the higher-level
4039				 * zone may have already done a mount down.
4040				 */
4041				(void) mount_one(zlogp, &lower_fstab, "",
4042				    Z_MNT_BOOT);
4043			}
4044		}
4045	}
4046	zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
4047	priv_freeset(zid_privs);
4048	free(zids);
4049
4050	/*
4051	 * Now share any exported directories from this zone.
4052	 * Each zone can have its own dfstab.
4053	 */
4054
4055	argv[0] = "zoneshare";
4056	argv[1] = "-z";
4057	argv[2] = zone_name;
4058	argv[3] = NULL;
4059
4060	(void) forkexec(zlogp, "/usr/lib/zones/zoneshare", argv);
4061	/* Don't check for errors since they don't affect the zone */
4062
4063	return (0);
4064}
4065
4066/*
4067 * Unmount lofs mounts from higher level zones
4068 * Unshare nfs exported directories
4069 */
4070static void
4071tsol_unmounts(zlog_t *zlogp, char *zone_name)
4072{
4073	zoneid_t *zids = NULL;
4074	uint_t nzents_saved;
4075	uint_t nzents;
4076	int i;
4077	char *argv[4];
4078	char path[MAXPATHLEN];
4079
4080	if (!is_system_labeled())
4081		return;
4082
4083	/*
4084	 * Get the list of zones from the kernel
4085	 */
4086	if (zone_list(NULL, &nzents) != 0) {
4087		return;
4088	}
4089
4090	if (zid_label == NULL) {
4091		zid_label = m_label_alloc(MAC_LABEL);
4092		if (zid_label == NULL)
4093			return;
4094	}
4095
4096again:
4097	if (nzents == 0)
4098		return;
4099
4100	zids = malloc(nzents * sizeof (zoneid_t));
4101	if (zids == NULL) {
4102		zerror(zlogp, B_TRUE, "memory allocation failed");
4103		return;
4104	}
4105	nzents_saved = nzents;
4106
4107	if (zone_list(zids, &nzents) != 0) {
4108		free(zids);
4109		return;
4110	}
4111	if (nzents != nzents_saved) {
4112		/* list changed, try again */
4113		free(zids);
4114		goto again;
4115	}
4116
4117	for (i = 0; i < nzents; i++) {
4118		char zid_name[ZONENAME_MAX];
4119		zone_state_t zid_state;
4120		char zid_rpath[MAXPATHLEN];
4121
4122		if (zids[i] == GLOBAL_ZONEID)
4123			continue;
4124
4125		if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
4126			continue;
4127
4128		/*
4129		 * Skip the zone we are halting
4130		 */
4131		if (strcmp(zid_name, zone_name) == 0)
4132			continue;
4133
4134		if ((zone_getattr(zids[i], ZONE_ATTR_STATUS, &zid_state,
4135		    sizeof (zid_state)) < 0) ||
4136		    (zid_state < ZONE_IS_READY))
4137			/* Skip over zones without mounted filesystems */
4138			continue;
4139
4140		if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
4141		    sizeof (m_label_t)) < 0)
4142			/* Skip over zones with unspecified label */
4143			continue;
4144
4145		if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
4146		    sizeof (zid_rpath)) == -1)
4147			/* Skip over zones with bad path */
4148			continue;
4149
4150		if (zlabel != NULL && bldominates(zid_label, zlabel)) {
4151			/*
4152			 * This zone dominates our zone.
4153			 * Unmount the lofs mount of our zone's /export/home
4154			 */
4155
4156			if (snprintf(path, MAXPATHLEN,
4157			    "%s/zone/%s/export/home", zid_rpath,
4158			    zone_name) > MAXPATHLEN)
4159				continue;
4160
4161			/* Skip over mount failures */
4162			(void) umount(path);
4163		}
4164	}
4165	free(zids);
4166
4167	/*
4168	 * Unmount global zone autofs trigger for this zone
4169	 */
4170	(void) snprintf(path, MAXPATHLEN, "/zone/%s/home", zone_name);
4171	/* Skip over mount failures */
4172	(void) umount(path);
4173
4174	/*
4175	 * Next unshare any exported directories from this zone.
4176	 */
4177
4178	argv[0] = "zoneunshare";
4179	argv[1] = "-z";
4180	argv[2] = zone_name;
4181	argv[3] = NULL;
4182
4183	(void) forkexec(zlogp, "/usr/lib/zones/zoneunshare", argv);
4184	/* Don't check for errors since they don't affect the zone */
4185
4186	/*
4187	 * Finally, deallocate any devices in the zone.
4188	 */
4189
4190	argv[0] = "deallocate";
4191	argv[1] = "-Isz";
4192	argv[2] = zone_name;
4193	argv[3] = NULL;
4194
4195	(void) forkexec(zlogp, "/usr/sbin/deallocate", argv);
4196	/* Don't check for errors since they don't affect the zone */
4197}
4198
4199/*
4200 * Fetch the Trusted Extensions label and multi-level ports (MLPs) for
4201 * this zone.
4202 */
4203static tsol_zcent_t *
4204get_zone_label(zlog_t *zlogp, priv_set_t *privs)
4205{
4206	FILE *fp;
4207	tsol_zcent_t *zcent = NULL;
4208	char line[MAXTNZLEN];
4209
4210	if ((fp = fopen(TNZONECFG_PATH, "r")) == NULL) {
4211		zerror(zlogp, B_TRUE, "%s", TNZONECFG_PATH);
4212		return (NULL);
4213	}
4214
4215	while (fgets(line, sizeof (line), fp) != NULL) {
4216		/*
4217		 * Check for malformed database
4218		 */
4219		if (strlen(line) == MAXTNZLEN - 1)
4220			break;
4221		if ((zcent = tsol_sgetzcent(line, NULL, NULL)) == NULL)
4222			continue;
4223		if (strcmp(zcent->zc_name, zone_name) == 0)
4224			break;
4225		tsol_freezcent(zcent);
4226		zcent = NULL;
4227	}
4228	(void) fclose(fp);
4229
4230	if (zcent == NULL) {
4231		zerror(zlogp, B_FALSE, "zone requires a label assignment. "
4232		    "See tnzonecfg(4)");
4233	} else {
4234		if (zlabel == NULL)
4235			zlabel = m_label_alloc(MAC_LABEL);
4236		/*
4237		 * Save this zone's privileges for later read-down processing
4238		 */
4239		if ((zprivs = priv_allocset()) == NULL) {
4240			zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
4241			return (NULL);
4242		} else {
4243			priv_copyset(privs, zprivs);
4244		}
4245	}
4246	return (zcent);
4247}
4248
4249/*
4250 * Add the Trusted Extensions multi-level ports for this zone.
4251 */
4252static void
4253set_mlps(zlog_t *zlogp, zoneid_t zoneid, tsol_zcent_t *zcent)
4254{
4255	tsol_mlp_t *mlp;
4256	tsol_mlpent_t tsme;
4257
4258	if (!is_system_labeled())
4259		return;
4260
4261	tsme.tsme_zoneid = zoneid;
4262	tsme.tsme_flags = 0;
4263	for (mlp = zcent->zc_private_mlp; !TSOL_MLP_END(mlp); mlp++) {
4264		tsme.tsme_mlp = *mlp;
4265		if (tnmlp(TNDB_LOAD, &tsme) != 0) {
4266			zerror(zlogp, B_TRUE, "cannot set zone-specific MLP "
4267			    "on %d-%d/%d", mlp->mlp_port,
4268			    mlp->mlp_port_upper, mlp->mlp_ipp);
4269		}
4270	}
4271
4272	tsme.tsme_flags = TSOL_MEF_SHARED;
4273	for (mlp = zcent->zc_shared_mlp; !TSOL_MLP_END(mlp); mlp++) {
4274		tsme.tsme_mlp = *mlp;
4275		if (tnmlp(TNDB_LOAD, &tsme) != 0) {
4276			zerror(zlogp, B_TRUE, "cannot set shared MLP "
4277			    "on %d-%d/%d", mlp->mlp_port,
4278			    mlp->mlp_port_upper, mlp->mlp_ipp);
4279		}
4280	}
4281}
4282
4283static void
4284remove_mlps(zlog_t *zlogp, zoneid_t zoneid)
4285{
4286	tsol_mlpent_t tsme;
4287
4288	if (!is_system_labeled())
4289		return;
4290
4291	(void) memset(&tsme, 0, sizeof (tsme));
4292	tsme.tsme_zoneid = zoneid;
4293	if (tnmlp(TNDB_FLUSH, &tsme) != 0)
4294		zerror(zlogp, B_TRUE, "cannot flush MLPs");
4295}
4296
4297int
4298prtmount(const struct mnttab *fs, void *x)
4299{
4300	zerror((zlog_t *)x, B_FALSE, "  %s", fs->mnt_mountp);
4301	return (0);
4302}
4303
4304/*
4305 * Look for zones running on the main system that are using this root (or any
4306 * subdirectory of it).  Return B_TRUE and print an error if a conflicting zone
4307 * is found or if we can't tell.
4308 */
4309static boolean_t
4310duplicate_zone_root(zlog_t *zlogp, const char *rootpath)
4311{
4312	zoneid_t *zids = NULL;
4313	uint_t nzids = 0;
4314	boolean_t retv;
4315	int rlen, zlen;
4316	char zroot[MAXPATHLEN];
4317	char zonename[ZONENAME_MAX];
4318
4319	for (;;) {
4320		nzids += 10;
4321		zids = malloc(nzids * sizeof (*zids));
4322		if (zids == NULL) {
4323			zerror(zlogp, B_TRUE, "memory allocation failed");
4324			return (B_TRUE);
4325		}
4326		if (zone_list(zids, &nzids) == 0)
4327			break;
4328		free(zids);
4329	}
4330	retv = B_FALSE;
4331	rlen = strlen(rootpath);
4332	while (nzids > 0) {
4333		/*
4334		 * Ignore errors; they just mean that the zone has disappeared
4335		 * while we were busy.
4336		 */
4337		if (zone_getattr(zids[--nzids], ZONE_ATTR_ROOT, zroot,
4338		    sizeof (zroot)) == -1)
4339			continue;
4340		zlen = strlen(zroot);
4341		if (zlen > rlen)
4342			zlen = rlen;
4343		if (strncmp(rootpath, zroot, zlen) == 0 &&
4344		    (zroot[zlen] == '\0' || zroot[zlen] == '/') &&
4345		    (rootpath[zlen] == '\0' || rootpath[zlen] == '/')) {
4346			if (getzonenamebyid(zids[nzids], zonename,
4347			    sizeof (zonename)) == -1)
4348				(void) snprintf(zonename, sizeof (zonename),
4349				    "id %d", (int)zids[nzids]);
4350			zerror(zlogp, B_FALSE,
4351			    "zone root %s already in use by zone %s",
4352			    rootpath, zonename);
4353			retv = B_TRUE;
4354			break;
4355		}
4356	}
4357	free(zids);
4358	return (retv);
4359}
4360
4361/*
4362 * Search for loopback mounts that use this same source node (same device and
4363 * inode).  Return B_TRUE if there is one or if we can't tell.
4364 */
4365static boolean_t
4366duplicate_reachable_path(zlog_t *zlogp, const char *rootpath)
4367{
4368	struct stat64 rst, zst;
4369	struct mnttab *mnp;
4370
4371	if (stat64(rootpath, &rst) == -1) {
4372		zerror(zlogp, B_TRUE, "can't stat %s", rootpath);
4373		return (B_TRUE);
4374	}
4375	if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
4376		return (B_TRUE);
4377	for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max; mnp++) {
4378		if (mnp->mnt_fstype == NULL ||
4379		    strcmp(MNTTYPE_LOFS, mnp->mnt_fstype) != 0)
4380			continue;
4381		/* We're looking at a loopback mount.  Stat it. */
4382		if (mnp->mnt_special != NULL &&
4383		    stat64(mnp->mnt_special, &zst) != -1 &&
4384		    rst.st_dev == zst.st_dev && rst.st_ino == zst.st_ino) {
4385			zerror(zlogp, B_FALSE,
4386			    "zone root %s is reachable through %s",
4387			    rootpath, mnp->mnt_mountp);
4388			return (B_TRUE);
4389		}
4390	}
4391	return (B_FALSE);
4392}
4393
4394/*
4395 * Set memory cap and pool info for the zone's resource management
4396 * configuration.
4397 */
4398static int
4399setup_zone_rm(zlog_t *zlogp, char *zone_name, zoneid_t zoneid)
4400{
4401	int res;
4402	uint64_t tmp;
4403	struct zone_mcaptab mcap;
4404	char sched[MAXNAMELEN];
4405	zone_dochandle_t handle = NULL;
4406	char pool_err[128];
4407
4408	if ((handle = zonecfg_init_handle()) == NULL) {
4409		zerror(zlogp, B_TRUE, "getting zone configuration handle");
4410		return (Z_BAD_HANDLE);
4411	}
4412
4413	if ((res = zonecfg_get_snapshot_handle(zone_name, handle)) != Z_OK) {
4414		zerror(zlogp, B_FALSE, "invalid configuration");
4415		zonecfg_fini_handle(handle);
4416		return (res);
4417	}
4418
4419	/*
4420	 * If a memory cap is configured, set the cap in the kernel using
4421	 * zone_setattr() and make sure the rcapd SMF service is enabled.
4422	 */
4423	if (zonecfg_getmcapent(handle, &mcap) == Z_OK) {
4424		uint64_t num;
4425		char smf_err[128];
4426
4427		num = (uint64_t)strtoull(mcap.zone_physmem_cap, NULL, 10);
4428		if (zone_setattr(zoneid, ZONE_ATTR_PHYS_MCAP, &num, 0) == -1) {
4429			zerror(zlogp, B_TRUE, "could not set zone memory cap");
4430			zonecfg_fini_handle(handle);
4431			return (Z_INVAL);
4432		}
4433
4434		if (zonecfg_enable_rcapd(smf_err, sizeof (smf_err)) != Z_OK) {
4435			zerror(zlogp, B_FALSE, "enabling system/rcap service "
4436			    "failed: %s", smf_err);
4437			zonecfg_fini_handle(handle);
4438			return (Z_INVAL);
4439		}
4440	}
4441
4442	/* Get the scheduling class set in the zone configuration. */
4443	if (zonecfg_get_sched_class(handle, sched, sizeof (sched)) == Z_OK &&
4444	    strlen(sched) > 0) {
4445		if (zone_setattr(zoneid, ZONE_ATTR_SCHED_CLASS, sched,
4446		    strlen(sched)) == -1)
4447			zerror(zlogp, B_TRUE, "WARNING: unable to set the "
4448			    "default scheduling class");
4449
4450	} else if (zonecfg_get_aliased_rctl(handle, ALIAS_SHARES, &tmp)
4451	    == Z_OK) {
4452		/*
4453		 * If the zone has the zone.cpu-shares rctl set then we want to
4454		 * use the Fair Share Scheduler (FSS) for processes in the
4455		 * zone.  Check what scheduling class the zone would be running
4456		 * in by default so we can print a warning and modify the class
4457		 * if we wouldn't be using FSS.
4458		 */
4459		char class_name[PC_CLNMSZ];
4460
4461		if (zonecfg_get_dflt_sched_class(handle, class_name,
4462		    sizeof (class_name)) != Z_OK) {
4463			zerror(zlogp, B_FALSE, "WARNING: unable to determine "
4464			    "the zone's scheduling class");
4465
4466		} else if (strcmp("FSS", class_name) != 0) {
4467			zerror(zlogp, B_FALSE, "WARNING: The zone.cpu-shares "
4468			    "rctl is set but\nFSS is not the default "
4469			    "scheduling class for\nthis zone.  FSS will be "
4470			    "used for processes\nin the zone but to get the "
4471			    "full benefit of FSS,\nit should be the default "
4472			    "scheduling class.\nSee dispadmin(1M) for more "
4473			    "details.");
4474
4475			if (zone_setattr(zoneid, ZONE_ATTR_SCHED_CLASS, "FSS",
4476			    strlen("FSS")) == -1)
4477				zerror(zlogp, B_TRUE, "WARNING: unable to set "
4478				    "zone scheduling class to FSS");
4479		}
4480	}
4481
4482	/*
4483	 * The next few blocks of code attempt to set up temporary pools as
4484	 * well as persistent pools.  In all cases we call the functions
4485	 * unconditionally.  Within each funtion the code will check if the
4486	 * zone is actually configured for a temporary pool or persistent pool
4487	 * and just return if there is nothing to do.
4488	 *
4489	 * If we are rebooting we want to attempt to reuse any temporary pool
4490	 * that was previously set up.  zonecfg_bind_tmp_pool() will do the
4491	 * right thing in all cases (reuse or create) based on the current
4492	 * zonecfg.
4493	 */
4494	if ((res = zonecfg_bind_tmp_pool(handle, zoneid, pool_err,
4495	    sizeof (pool_err))) != Z_OK) {
4496		if (res == Z_POOL || res == Z_POOL_CREATE || res == Z_POOL_BIND)
4497			zerror(zlogp, B_FALSE, "%s: %s\ndedicated-cpu setting "
4498			    "cannot be instantiated", zonecfg_strerror(res),
4499			    pool_err);
4500		else
4501			zerror(zlogp, B_FALSE, "could not bind zone to "
4502			    "temporary pool: %s", zonecfg_strerror(res));
4503		zonecfg_fini_handle(handle);
4504		return (Z_POOL_BIND);
4505	}
4506
4507	/*
4508	 * Check if we need to warn about poold not being enabled.
4509	 */
4510	if (zonecfg_warn_poold(handle)) {
4511		zerror(zlogp, B_FALSE, "WARNING: A range of dedicated-cpus has "
4512		    "been specified\nbut the dynamic pool service is not "
4513		    "enabled.\nThe system will not dynamically adjust the\n"
4514		    "processor allocation within the specified range\n"
4515		    "until svc:/system/pools/dynamic is enabled.\n"
4516		    "See poold(1M).");
4517	}
4518
4519	/* The following is a warning, not an error. */
4520	if ((res = zonecfg_bind_pool(handle, zoneid, pool_err,
4521	    sizeof (pool_err))) != Z_OK) {
4522		if (res == Z_POOL_BIND)
4523			zerror(zlogp, B_FALSE, "WARNING: unable to bind to "
4524			    "pool '%s'; using default pool.", pool_err);
4525		else if (res == Z_POOL)
4526			zerror(zlogp, B_FALSE, "WARNING: %s: %s",
4527			    zonecfg_strerror(res), pool_err);
4528		else
4529			zerror(zlogp, B_FALSE, "WARNING: %s",
4530			    zonecfg_strerror(res));
4531	}
4532
4533	/* Update saved pool name in case it has changed */
4534	(void) zonecfg_get_poolname(handle, zone_name, pool_name,
4535	    sizeof (pool_name));
4536
4537	zonecfg_fini_handle(handle);
4538	return (Z_OK);
4539}
4540
4541static void
4542report_prop_err(zlog_t *zlogp, const char *name, const char *value, int res)
4543{
4544	switch (res) {
4545	case Z_TOO_BIG:
4546		zerror(zlogp, B_FALSE, "%s property value is too large.", name);
4547		break;
4548
4549	case Z_INVALID_PROPERTY:
4550		zerror(zlogp, B_FALSE, "%s property value \"%s\" is not valid",
4551		    name, value);
4552		break;
4553
4554	default:
4555		zerror(zlogp, B_TRUE, "fetching property %s: %d", name, res);
4556		break;
4557	}
4558}
4559
4560/*
4561 * Sets the hostid of the new zone based on its configured value.  The zone's
4562 * zone_t structure must already exist in kernel memory.  'zlogp' refers to the
4563 * log used to report errors and warnings and must be non-NULL.  'zone_namep'
4564 * is the name of the new zone and must be non-NULL.  'zoneid' is the numeric
4565 * ID of the new zone.
4566 *
4567 * This function returns zero on success and a nonzero error code on failure.
4568 */
4569static int
4570setup_zone_hostid(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4571{
4572	int res;
4573	char hostidp[HW_HOSTID_LEN];
4574	unsigned int hostid;
4575
4576	res = zonecfg_get_hostid(handle, hostidp, sizeof (hostidp));
4577
4578	if (res == Z_BAD_PROPERTY) {
4579		return (Z_OK);
4580	} else if (res != Z_OK) {
4581		report_prop_err(zlogp, "hostid", hostidp, res);
4582		return (res);
4583	}
4584
4585	hostid = (unsigned int)strtoul(hostidp, NULL, 16);
4586	if ((res = zone_setattr(zoneid, ZONE_ATTR_HOSTID, &hostid,
4587	    sizeof (hostid))) != 0) {
4588		zerror(zlogp, B_TRUE,
4589		    "zone hostid is not valid: %s: %d", hostidp, res);
4590		return (Z_SYSTEM);
4591	}
4592
4593	return (res);
4594}
4595
4596static int
4597setup_zone_secflags(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4598{
4599	psecflags_t secflags;
4600	struct zone_secflagstab tab = {0};
4601	secflagdelta_t delt;
4602	int res;
4603
4604	res = zonecfg_lookup_secflags(handle, &tab);
4605
4606	if ((res != Z_OK) &&
4607	    /* The general defaulting code will handle this */
4608	    (res != Z_NO_ENTRY) && (res != Z_BAD_PROPERTY)) {
4609		zerror(zlogp, B_FALSE, "security-flags property is "
4610		    "invalid: %d", res);
4611		return (res);
4612	}
4613
4614	if (strlen(tab.zone_secflags_lower) == 0)
4615		(void) strlcpy(tab.zone_secflags_lower, "none",
4616		    sizeof (tab.zone_secflags_lower));
4617	if (strlen(tab.zone_secflags_default) == 0)
4618		(void) strlcpy(tab.zone_secflags_default,
4619		    tab.zone_secflags_lower,
4620		    sizeof (tab.zone_secflags_default));
4621	if (strlen(tab.zone_secflags_upper) == 0)
4622		(void) strlcpy(tab.zone_secflags_upper, "all",
4623		    sizeof (tab.zone_secflags_upper));
4624
4625	if (secflags_parse(NULL, tab.zone_secflags_default,
4626	    &delt) == -1) {
4627		zerror(zlogp, B_FALSE, "default security-flags: '%s'"
4628		    "are invalid", tab.zone_secflags_default);
4629		return (Z_BAD_PROPERTY);
4630	} else if (delt.psd_ass_active != B_TRUE) {
4631		zerror(zlogp, B_FALSE, "relative security-flags are not "
4632		    "allowed in zone configuration (default "
4633		    "security-flags: '%s')",
4634		    tab.zone_secflags_default);
4635		return (Z_BAD_PROPERTY);
4636	} else {
4637		secflags_copy(&secflags.psf_inherit, &delt.psd_assign);
4638		secflags_copy(&secflags.psf_effective, &delt.psd_assign);
4639	}
4640
4641	if (secflags_parse(NULL, tab.zone_secflags_lower,
4642	    &delt) == -1) {
4643		zerror(zlogp, B_FALSE, "lower security-flags: '%s'"
4644		    "are invalid", tab.zone_secflags_lower);
4645		return (Z_BAD_PROPERTY);
4646	} else if (delt.psd_ass_active != B_TRUE) {
4647		zerror(zlogp, B_FALSE, "relative security-flags are not "
4648		    "allowed in zone configuration (lower "
4649		    "security-flags: '%s')",
4650		    tab.zone_secflags_lower);
4651		return (Z_BAD_PROPERTY);
4652	} else {
4653		secflags_copy(&secflags.psf_lower, &delt.psd_assign);
4654	}
4655
4656	if (secflags_parse(NULL, tab.zone_secflags_upper,
4657	    &delt) == -1) {
4658		zerror(zlogp, B_FALSE, "upper security-flags: '%s'"
4659		    "are invalid", tab.zone_secflags_upper);
4660		return (Z_BAD_PROPERTY);
4661	} else if (delt.psd_ass_active != B_TRUE) {
4662		zerror(zlogp, B_FALSE, "relative security-flags are not "
4663		    "allowed in zone configuration (upper "
4664		    "security-flags: '%s')",
4665		    tab.zone_secflags_upper);
4666		return (Z_BAD_PROPERTY);
4667	} else {
4668		secflags_copy(&secflags.psf_upper, &delt.psd_assign);
4669	}
4670
4671	if (!psecflags_validate(&secflags)) {
4672		zerror(zlogp, B_TRUE, "security-flags violate invariants");
4673		return (Z_BAD_PROPERTY);
4674	}
4675
4676	if ((res = zone_setattr(zoneid, ZONE_ATTR_SECFLAGS, &secflags,
4677	    sizeof (secflags))) != 0) {
4678		zerror(zlogp, B_TRUE,
4679		    "security-flags couldn't be set: %d", res);
4680		return (Z_SYSTEM);
4681	}
4682
4683	return (Z_OK);
4684}
4685
4686static int
4687setup_zone_fs_allowed(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4688{
4689	char fsallowed[ZONE_FS_ALLOWED_MAX];
4690	char *fsallowedp = fsallowed;
4691	int len = sizeof (fsallowed);
4692	int res;
4693
4694	res = zonecfg_get_fs_allowed(handle, fsallowed, len);
4695
4696	if (res == Z_BAD_PROPERTY) {
4697		/* No value, set the defaults */
4698		(void) strlcpy(fsallowed, DFLT_FS_ALLOWED, len);
4699	} else if (res != Z_OK) {
4700		report_prop_err(zlogp, "fs-allowed", fsallowed, res);
4701		return (res);
4702	} else if (fsallowed[0] == '-') {
4703		/* dropping default filesystems - use remaining list */
4704		if (fsallowed[1] != ',')
4705			return (Z_OK);
4706		fsallowedp += 2;
4707		len -= 2;
4708	} else {
4709		/* Has a value, append the defaults */
4710		if (strlcat(fsallowed, ",", len) >= len ||
4711		    strlcat(fsallowed, DFLT_FS_ALLOWED, len) >= len) {
4712			report_prop_err(zlogp, "fs-allowed", fsallowed,
4713			    Z_TOO_BIG);
4714			return (Z_TOO_BIG);
4715		}
4716	}
4717
4718	if (zone_setattr(zoneid, ZONE_ATTR_FS_ALLOWED, fsallowedp, len) != 0) {
4719		zerror(zlogp, B_TRUE,
4720		    "fs-allowed couldn't be set: %s: %d", fsallowedp, res);
4721		return (Z_SYSTEM);
4722	}
4723
4724	return (Z_OK);
4725}
4726
4727static int
4728setup_zone_attrs(zlog_t *zlogp, char *zone_namep, zoneid_t zoneid)
4729{
4730	zone_dochandle_t handle;
4731	int res = Z_OK;
4732
4733	if ((handle = zonecfg_init_handle()) == NULL) {
4734		zerror(zlogp, B_TRUE, "getting zone configuration handle");
4735		return (Z_BAD_HANDLE);
4736	}
4737	if ((res = zonecfg_get_snapshot_handle(zone_namep, handle)) != Z_OK) {
4738		zerror(zlogp, B_FALSE, "invalid configuration");
4739		goto out;
4740	}
4741
4742	if ((res = setup_zone_hostid(handle, zlogp, zoneid)) != Z_OK)
4743		goto out;
4744
4745	if ((res = setup_zone_fs_allowed(handle, zlogp, zoneid)) != Z_OK)
4746		goto out;
4747
4748	if ((res = setup_zone_secflags(handle, zlogp, zoneid)) != Z_OK)
4749		goto out;
4750
4751out:
4752	zonecfg_fini_handle(handle);
4753	return (res);
4754}
4755
4756zoneid_t
4757vplat_create(zlog_t *zlogp, zone_mnt_t mount_cmd)
4758{
4759	zoneid_t rval = -1;
4760	priv_set_t *privs;
4761	char rootpath[MAXPATHLEN];
4762	char *rctlbuf = NULL;
4763	size_t rctlbufsz = 0;
4764	char *zfsbuf = NULL;
4765	size_t zfsbufsz = 0;
4766	zoneid_t zoneid = -1;
4767	int xerr;
4768	char *kzone;
4769	FILE *fp = NULL;
4770	tsol_zcent_t *zcent = NULL;
4771	int match = 0;
4772	int doi = 0;
4773	int flags;
4774	zone_iptype_t iptype;
4775
4776	if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
4777		zerror(zlogp, B_TRUE, "unable to determine zone root");
4778		return (-1);
4779	}
4780	if (zonecfg_in_alt_root())
4781		resolve_lofs(zlogp, rootpath, sizeof (rootpath));
4782
4783	if (vplat_get_iptype(zlogp, &iptype) < 0) {
4784		zerror(zlogp, B_TRUE, "unable to determine ip-type");
4785		return (-1);
4786	}
4787	switch (iptype) {
4788	case ZS_SHARED:
4789		flags = 0;
4790		break;
4791	case ZS_EXCLUSIVE:
4792		flags = ZCF_NET_EXCL;
4793		break;
4794	}
4795
4796	if ((privs = priv_allocset()) == NULL) {
4797		zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
4798		return (-1);
4799	}
4800	priv_emptyset(privs);
4801	if (get_privset(zlogp, privs, mount_cmd) != 0)
4802		goto error;
4803
4804	if (mount_cmd == Z_MNT_BOOT &&
4805	    get_rctls(zlogp, &rctlbuf, &rctlbufsz) != 0) {
4806		zerror(zlogp, B_FALSE, "Unable to get list of rctls");
4807		goto error;
4808	}
4809
4810	if (get_datasets(zlogp, &zfsbuf, &zfsbufsz) != 0) {
4811		zerror(zlogp, B_FALSE, "Unable to get list of ZFS datasets");
4812		goto error;
4813	}
4814
4815	if (mount_cmd == Z_MNT_BOOT && is_system_labeled()) {
4816		zcent = get_zone_label(zlogp, privs);
4817		if (zcent != NULL) {
4818			match = zcent->zc_match;
4819			doi = zcent->zc_doi;
4820			*zlabel = zcent->zc_label;
4821		} else {
4822			goto error;
4823		}
4824		if (validate_rootds_label(zlogp, rootpath, zlabel) != 0)
4825			goto error;
4826	}
4827
4828	kzone = zone_name;
4829
4830	/*
4831	 * We must do this scan twice.  First, we look for zones running on the
4832	 * main system that are using this root (or any subdirectory of it).
4833	 * Next, we reduce to the shortest path and search for loopback mounts
4834	 * that use this same source node (same device and inode).
4835	 */
4836	if (duplicate_zone_root(zlogp, rootpath))
4837		goto error;
4838	if (duplicate_reachable_path(zlogp, rootpath))
4839		goto error;
4840
4841	if (ALT_MOUNT(mount_cmd)) {
4842		root_to_lu(zlogp, rootpath, sizeof (rootpath), B_TRUE);
4843
4844		/*
4845		 * Forge up a special root for this zone.  When a zone is
4846		 * mounted, we can't let the zone have its own root because the
4847		 * tools that will be used in this "scratch zone" need access
4848		 * to both the zone's resources and the running machine's
4849		 * executables.
4850		 *
4851		 * Note that the mkdir here also catches read-only filesystems.
4852		 */
4853		if (mkdir(rootpath, 0755) != 0 && errno != EEXIST) {
4854			zerror(zlogp, B_TRUE, "cannot create %s", rootpath);
4855			goto error;
4856		}
4857		if (domount(zlogp, "tmpfs", "", "swap", rootpath) != 0)
4858			goto error;
4859	}
4860
4861	if (zonecfg_in_alt_root()) {
4862		/*
4863		 * If we are mounting up a zone in an alternate root partition,
4864		 * then we have some additional work to do before starting the
4865		 * zone.  First, resolve the root path down so that we're not
4866		 * fooled by duplicates.  Then forge up an internal name for
4867		 * the zone.
4868		 */
4869		if ((fp = zonecfg_open_scratch("", B_TRUE)) == NULL) {
4870			zerror(zlogp, B_TRUE, "cannot open mapfile");
4871			goto error;
4872		}
4873		if (zonecfg_lock_scratch(fp) != 0) {
4874			zerror(zlogp, B_TRUE, "cannot lock mapfile");
4875			goto error;
4876		}
4877		if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
4878		    NULL, 0) == 0) {
4879			zerror(zlogp, B_FALSE, "scratch zone already running");
4880			goto error;
4881		}
4882		/* This is the preferred name */
4883		(void) snprintf(kernzone, sizeof (kernzone), "SUNWlu-%s",
4884		    zone_name);
4885		srandom(getpid());
4886		while (zonecfg_reverse_scratch(fp, kernzone, NULL, 0, NULL,
4887		    0) == 0) {
4888			/* This is just an arbitrary name; note "." usage */
4889			(void) snprintf(kernzone, sizeof (kernzone),
4890			    "SUNWlu.%08lX%08lX", random(), random());
4891		}
4892		kzone = kernzone;
4893	}
4894
4895	xerr = 0;
4896	if ((zoneid = zone_create(kzone, rootpath, privs, rctlbuf,
4897	    rctlbufsz, zfsbuf, zfsbufsz, &xerr, match, doi, zlabel,
4898	    flags)) == -1) {
4899		if (xerr == ZE_AREMOUNTS) {
4900			if (zonecfg_find_mounts(rootpath, NULL, NULL) < 1) {
4901				zerror(zlogp, B_FALSE,
4902				    "An unknown file-system is mounted on "
4903				    "a subdirectory of %s", rootpath);
4904			} else {
4905
4906				zerror(zlogp, B_FALSE,
4907				    "These file-systems are mounted on "
4908				    "subdirectories of %s:", rootpath);
4909				(void) zonecfg_find_mounts(rootpath,
4910				    prtmount, zlogp);
4911			}
4912		} else if (xerr == ZE_CHROOTED) {
4913			zerror(zlogp, B_FALSE, "%s: "
4914			    "cannot create a zone from a chrooted "
4915			    "environment", "zone_create");
4916		} else if (xerr == ZE_LABELINUSE) {
4917			char zonename[ZONENAME_MAX];
4918			(void) getzonenamebyid(getzoneidbylabel(zlabel),
4919			    zonename, ZONENAME_MAX);
4920			zerror(zlogp, B_FALSE, "The zone label is already "
4921			    "used by the zone '%s'.", zonename);
4922		} else {
4923			zerror(zlogp, B_TRUE, "%s failed", "zone_create");
4924		}
4925		goto error;
4926	}
4927
4928	if (zonecfg_in_alt_root() &&
4929	    zonecfg_add_scratch(fp, zone_name, kernzone,
4930	    zonecfg_get_root()) == -1) {
4931		zerror(zlogp, B_TRUE, "cannot add mapfile entry");
4932		goto error;
4933	}
4934
4935	/*
4936	 * The following actions are not performed when merely mounting a zone
4937	 * for administrative use.
4938	 */
4939	if (mount_cmd == Z_MNT_BOOT) {
4940		brand_handle_t bh;
4941		struct brand_attr attr;
4942		char modname[MAXPATHLEN];
4943
4944		if (setup_zone_attrs(zlogp, zone_name, zoneid) != Z_OK)
4945			goto error;
4946
4947		if ((bh = brand_open(brand_name)) == NULL) {
4948			zerror(zlogp, B_FALSE,
4949			    "unable to determine brand name");
4950			goto error;
4951		}
4952
4953		if (!is_system_labeled() &&
4954		    (strcmp(brand_name, LABELED_BRAND_NAME) == 0)) {
4955			brand_close(bh);
4956			zerror(zlogp, B_FALSE,
4957			    "cannot boot labeled zone on unlabeled system");
4958			goto error;
4959		}
4960
4961		/*
4962		 * If this brand requires any kernel support, now is the time to
4963		 * get it loaded and initialized.
4964		 */
4965		if (brand_get_modname(bh, modname, MAXPATHLEN) < 0) {
4966			brand_close(bh);
4967			zerror(zlogp, B_FALSE,
4968			    "unable to determine brand kernel module");
4969			goto error;
4970		}
4971		brand_close(bh);
4972
4973		if (strlen(modname) > 0) {
4974			(void) strlcpy(attr.ba_brandname, brand_name,
4975			    sizeof (attr.ba_brandname));
4976			(void) strlcpy(attr.ba_modname, modname,
4977			    sizeof (attr.ba_modname));
4978			if (zone_setattr(zoneid, ZONE_ATTR_BRAND, &attr,
4979			    sizeof (attr) != 0)) {
4980				zerror(zlogp, B_TRUE,
4981				    "could not set zone brand attribute.");
4982				goto error;
4983			}
4984		}
4985
4986		if (setup_zone_rm(zlogp, zone_name, zoneid) != Z_OK)
4987			goto error;
4988
4989		set_mlps(zlogp, zoneid, zcent);
4990	}
4991
4992	rval = zoneid;
4993	zoneid = -1;
4994
4995error:
4996	if (zoneid != -1) {
4997		(void) zone_shutdown(zoneid);
4998		(void) zone_destroy(zoneid);
4999	}
5000	if (rctlbuf != NULL)
5001		free(rctlbuf);
5002	priv_freeset(privs);
5003	if (fp != NULL)
5004		zonecfg_close_scratch(fp);
5005	lofs_discard_mnttab();
5006	if (zcent != NULL)
5007		tsol_freezcent(zcent);
5008	return (rval);
5009}
5010
5011/*
5012 * Enter the zone and write a /etc/zones/index file there.  This allows
5013 * libzonecfg (and thus zoneadm) to report the UUID and potentially other zone
5014 * details from inside the zone.
5015 */
5016static void
5017write_index_file(zoneid_t zoneid)
5018{
5019	FILE *zef;
5020	FILE *zet;
5021	struct zoneent *zep;
5022	pid_t child;
5023	int tmpl_fd;
5024	ctid_t ct;
5025	int fd;
5026	char uuidstr[UUID_PRINTABLE_STRING_LENGTH];
5027
5028	/* Locate the zone entry in the global zone's index file */
5029	if ((zef = setzoneent()) == NULL)
5030		return;
5031	while ((zep = getzoneent_private(zef)) != NULL) {
5032		if (strcmp(zep->zone_name, zone_name) == 0)
5033			break;
5034		free(zep);
5035	}
5036	endzoneent(zef);
5037	if (zep == NULL)
5038		return;
5039
5040	if ((tmpl_fd = init_template()) == -1) {
5041		free(zep);
5042		return;
5043	}
5044
5045	if ((child = fork()) == -1) {
5046		(void) ct_tmpl_clear(tmpl_fd);
5047		(void) close(tmpl_fd);
5048		free(zep);
5049		return;
5050	}
5051
5052	/* parent waits for child to finish */
5053	if (child != 0) {
5054		free(zep);
5055		if (contract_latest(&ct) == -1)
5056			ct = -1;
5057		(void) ct_tmpl_clear(tmpl_fd);
5058		(void) close(tmpl_fd);
5059		(void) waitpid(child, NULL, 0);
5060		(void) contract_abandon_id(ct);
5061		return;
5062	}
5063
5064	/* child enters zone and sets up index file */
5065	(void) ct_tmpl_clear(tmpl_fd);
5066	if (zone_enter(zoneid) != -1) {
5067		(void) mkdir(ZONE_CONFIG_ROOT, ZONE_CONFIG_MODE);
5068		(void) chown(ZONE_CONFIG_ROOT, ZONE_CONFIG_UID,
5069		    ZONE_CONFIG_GID);
5070		fd = open(ZONE_INDEX_FILE, O_WRONLY|O_CREAT|O_TRUNC,
5071		    ZONE_INDEX_MODE);
5072		if (fd != -1 && (zet = fdopen(fd, "w")) != NULL) {
5073			(void) fchown(fd, ZONE_INDEX_UID, ZONE_INDEX_GID);
5074			if (uuid_is_null(zep->zone_uuid))
5075				uuidstr[0] = '\0';
5076			else
5077				uuid_unparse(zep->zone_uuid, uuidstr);
5078			(void) fprintf(zet, "%s:%s:/:%s\n", zep->zone_name,
5079			    zone_state_str(zep->zone_state),
5080			    uuidstr);
5081			(void) fclose(zet);
5082		}
5083	}
5084	_exit(0);
5085}
5086
5087int
5088vplat_bringup(zlog_t *zlogp, zone_mnt_t mount_cmd, zoneid_t zoneid)
5089{
5090	char zonepath[MAXPATHLEN];
5091
5092	if (mount_cmd == Z_MNT_BOOT && validate_datasets(zlogp) != 0) {
5093		lofs_discard_mnttab();
5094		return (-1);
5095	}
5096
5097	/*
5098	 * Before we try to mount filesystems we need to create the
5099	 * attribute backing store for /dev
5100	 */
5101	if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
5102		lofs_discard_mnttab();
5103		return (-1);
5104	}
5105	resolve_lofs(zlogp, zonepath, sizeof (zonepath));
5106
5107	/* Make /dev directory owned by root, grouped sys */
5108	if (make_one_dir(zlogp, zonepath, "/dev", DEFAULT_DIR_MODE,
5109	    0, 3) != 0) {
5110		lofs_discard_mnttab();
5111		return (-1);
5112	}
5113
5114	if (mount_filesystems(zlogp, mount_cmd) != 0) {
5115		lofs_discard_mnttab();
5116		return (-1);
5117	}
5118
5119	if (mount_cmd == Z_MNT_BOOT) {
5120		zone_iptype_t iptype;
5121
5122		if (vplat_get_iptype(zlogp, &iptype) < 0) {
5123			zerror(zlogp, B_TRUE, "unable to determine ip-type");
5124			lofs_discard_mnttab();
5125			return (-1);
5126		}
5127
5128		switch (iptype) {
5129		case ZS_SHARED:
5130			/* Always do this to make lo0 get configured */
5131			if (configure_shared_network_interfaces(zlogp) != 0) {
5132				lofs_discard_mnttab();
5133				return (-1);
5134			}
5135			break;
5136		case ZS_EXCLUSIVE:
5137			if (configure_exclusive_network_interfaces(zlogp,
5138			    zoneid) !=
5139			    0) {
5140				lofs_discard_mnttab();
5141				return (-1);
5142			}
5143			break;
5144		}
5145	}
5146
5147	write_index_file(zoneid);
5148
5149	lofs_discard_mnttab();
5150	return (0);
5151}
5152
5153static int
5154lu_root_teardown(zlog_t *zlogp)
5155{
5156	char zroot[MAXPATHLEN];
5157
5158	if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
5159		zerror(zlogp, B_FALSE, "unable to determine zone root");
5160		return (-1);
5161	}
5162	root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
5163
5164	/*
5165	 * At this point, the processes are gone, the filesystems (save the
5166	 * root) are unmounted, and the zone is on death row.  But there may
5167	 * still be creds floating about in the system that reference the
5168	 * zone_t, and which pin down zone_rootvp causing this call to fail
5169	 * with EBUSY.  Thus, we try for a little while before just giving up.
5170	 * (How I wish this were not true, and umount2 just did the right
5171	 * thing, or tmpfs supported MS_FORCE This is a gross hack.)
5172	 */
5173	if (umount2(zroot, MS_FORCE) != 0) {
5174		if (errno == ENOTSUP && umount2(zroot, 0) == 0)
5175			goto unmounted;
5176		if (errno == EBUSY) {
5177			int tries = 10;
5178
5179			while (--tries >= 0) {
5180				(void) sleep(1);
5181				if (umount2(zroot, 0) == 0)
5182					goto unmounted;
5183				if (errno != EBUSY)
5184					break;
5185			}
5186		}
5187		zerror(zlogp, B_TRUE, "unable to unmount '%s'", zroot);
5188		return (-1);
5189	}
5190unmounted:
5191
5192	/*
5193	 * Only zones in an alternate root environment have scratch zone
5194	 * entries.
5195	 */
5196	if (zonecfg_in_alt_root()) {
5197		FILE *fp;
5198		int retv;
5199
5200		if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
5201			zerror(zlogp, B_TRUE, "cannot open mapfile");
5202			return (-1);
5203		}
5204		retv = -1;
5205		if (zonecfg_lock_scratch(fp) != 0)
5206			zerror(zlogp, B_TRUE, "cannot lock mapfile");
5207		else if (zonecfg_delete_scratch(fp, kernzone) != 0)
5208			zerror(zlogp, B_TRUE, "cannot delete map entry");
5209		else
5210			retv = 0;
5211		zonecfg_close_scratch(fp);
5212		return (retv);
5213	} else {
5214		return (0);
5215	}
5216}
5217
5218int
5219vplat_teardown(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting)
5220{
5221	char *kzone;
5222	zoneid_t zoneid;
5223	int res;
5224	char pool_err[128];
5225	char zpath[MAXPATHLEN];
5226	char cmdbuf[MAXPATHLEN];
5227	brand_handle_t bh = NULL;
5228	dladm_status_t status;
5229	char errmsg[DLADM_STRSIZE];
5230	ushort_t flags;
5231
5232	kzone = zone_name;
5233	if (zonecfg_in_alt_root()) {
5234		FILE *fp;
5235
5236		if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
5237			zerror(zlogp, B_TRUE, "unable to open map file");
5238			goto error;
5239		}
5240		if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
5241		    kernzone, sizeof (kernzone)) != 0) {
5242			zerror(zlogp, B_FALSE, "unable to find scratch zone");
5243			zonecfg_close_scratch(fp);
5244			goto error;
5245		}
5246		zonecfg_close_scratch(fp);
5247		kzone = kernzone;
5248	}
5249
5250	if ((zoneid = getzoneidbyname(kzone)) == ZONE_ID_UNDEFINED) {
5251		if (!bringup_failure_recovery)
5252			zerror(zlogp, B_TRUE, "unable to get zoneid");
5253		if (unmount_cmd)
5254			(void) lu_root_teardown(zlogp);
5255		goto error;
5256	}
5257
5258	if (remove_datalink_pool(zlogp, zoneid) != 0) {
5259		zerror(zlogp, B_FALSE, "unable clear datalink pool property");
5260		goto error;
5261	}
5262
5263	if (remove_datalink_protect(zlogp, zoneid) != 0) {
5264		zerror(zlogp, B_FALSE,
5265		    "unable clear datalink protect property");
5266		goto error;
5267	}
5268
5269	/*
5270	 * The datalinks assigned to the zone will be removed from the NGZ as
5271	 * part of zone_shutdown() so that we need to remove protect/pool etc.
5272	 * before zone_shutdown(). Even if the shutdown itself fails, the zone
5273	 * will not be able to violate any constraints applied because the
5274	 * datalinks are no longer available to the zone.
5275	 */
5276	if (zone_shutdown(zoneid) != 0) {
5277		zerror(zlogp, B_TRUE, "unable to shutdown zone");
5278		goto error;
5279	}
5280
5281	/* Get the zonepath of this zone */
5282	if (zone_get_zonepath(zone_name, zpath, sizeof (zpath)) != Z_OK) {
5283		zerror(zlogp, B_FALSE, "unable to determine zone path");
5284		goto error;
5285	}
5286
5287	/* Get a handle to the brand info for this zone */
5288	if ((bh = brand_open(brand_name)) == NULL) {
5289		zerror(zlogp, B_FALSE, "unable to determine zone brand");
5290		return (-1);
5291	}
5292	/*
5293	 * If there is a brand 'halt' callback, execute it now to give the
5294	 * brand a chance to cleanup any custom configuration.
5295	 */
5296	(void) strcpy(cmdbuf, EXEC_PREFIX);
5297	if (brand_get_halt(bh, zone_name, zpath, cmdbuf + EXEC_LEN,
5298	    sizeof (cmdbuf) - EXEC_LEN) < 0) {
5299		brand_close(bh);
5300		zerror(zlogp, B_FALSE, "unable to determine branded zone's "
5301		    "halt callback.");
5302		goto error;
5303	}
5304	brand_close(bh);
5305
5306	if ((strlen(cmdbuf) > EXEC_LEN) &&
5307	    (do_subproc(zlogp, cmdbuf, NULL) != Z_OK)) {
5308		zerror(zlogp, B_FALSE, "%s failed", cmdbuf);
5309		goto error;
5310	}
5311
5312	if (!unmount_cmd) {
5313		zone_iptype_t iptype;
5314
5315		if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
5316		    sizeof (flags)) < 0) {
5317			if (vplat_get_iptype(zlogp, &iptype) < 0) {
5318				zerror(zlogp, B_TRUE, "unable to determine "
5319				    "ip-type");
5320				goto error;
5321			}
5322		} else {
5323			if (flags & ZF_NET_EXCL)
5324				iptype = ZS_EXCLUSIVE;
5325			else
5326				iptype = ZS_SHARED;
5327		}
5328
5329		switch (iptype) {
5330		case ZS_SHARED:
5331			if (unconfigure_shared_network_interfaces(zlogp,
5332			    zoneid) != 0) {
5333				zerror(zlogp, B_FALSE, "unable to unconfigure "
5334				    "network interfaces in zone");
5335				goto error;
5336			}
5337			break;
5338		case ZS_EXCLUSIVE:
5339			if (unconfigure_exclusive_network_interfaces(zlogp,
5340			    zoneid) != 0) {
5341				zerror(zlogp, B_FALSE, "unable to unconfigure "
5342				    "network interfaces in zone");
5343				goto error;
5344			}
5345			status = dladm_zone_halt(dld_handle, zoneid);
5346			if (status != DLADM_STATUS_OK) {
5347				zerror(zlogp, B_FALSE, "unable to notify "
5348				    "dlmgmtd of zone halt: %s",
5349				    dladm_status2str(status, errmsg));
5350			}
5351			break;
5352		}
5353	}
5354
5355	if (!unmount_cmd && tcp_abort_connections(zlogp, zoneid) != 0) {
5356		zerror(zlogp, B_TRUE, "unable to abort TCP connections");
5357		goto error;
5358	}
5359
5360	if (unmount_filesystems(zlogp, zoneid, unmount_cmd) != 0) {
5361		zerror(zlogp, B_FALSE,
5362		    "unable to unmount file systems in zone");
5363		goto error;
5364	}
5365
5366	/*
5367	 * If we are rebooting then we normally don't want to destroy an
5368	 * existing temporary pool at this point so that we can just reuse it
5369	 * when the zone boots back up.  However, it is also possible we were
5370	 * running with a temporary pool and the zone configuration has been
5371	 * modified to no longer use a temporary pool.  In that case we need
5372	 * to destroy the temporary pool now.  This case looks like the case
5373	 * where we never had a temporary pool configured but
5374	 * zonecfg_destroy_tmp_pool will do the right thing either way.
5375	 */
5376	if (!unmount_cmd) {
5377		boolean_t destroy_tmp_pool = B_TRUE;
5378
5379		if (rebooting) {
5380			struct zone_psettab pset_tab;
5381			zone_dochandle_t handle;
5382
5383			if ((handle = zonecfg_init_handle()) != NULL &&
5384			    zonecfg_get_handle(zone_name, handle) == Z_OK &&
5385			    zonecfg_lookup_pset(handle, &pset_tab) == Z_OK)
5386				destroy_tmp_pool = B_FALSE;
5387
5388			zonecfg_fini_handle(handle);
5389		}
5390
5391		if (destroy_tmp_pool) {
5392			if ((res = zonecfg_destroy_tmp_pool(zone_name, pool_err,
5393			    sizeof (pool_err))) != Z_OK) {
5394				if (res == Z_POOL)
5395					zerror(zlogp, B_FALSE, pool_err);
5396			}
5397		}
5398	}
5399
5400	remove_mlps(zlogp, zoneid);
5401
5402	if (zone_destroy(zoneid) != 0) {
5403		zerror(zlogp, B_TRUE, "unable to destroy zone");
5404		goto error;
5405	}
5406
5407	/*
5408	 * Special teardown for alternate boot environments: remove the tmpfs
5409	 * root for the zone and then remove it from the map file.
5410	 */
5411	if (unmount_cmd && lu_root_teardown(zlogp) != 0)
5412		goto error;
5413
5414	lofs_discard_mnttab();
5415	return (0);
5416
5417error:
5418	lofs_discard_mnttab();
5419	return (-1);
5420}
5421