1#!/bin/ksh -p
2#
3# CDDL HEADER START
4#
5# The contents of this file are subject to the terms of the
6# Common Development and Distribution License (the "License").
7# You may not use this file except in compliance with the License.
8#
9# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10# or http://www.opensolaris.org/os/licensing.
11# See the License for the specific language governing permissions
12# and limitations under the License.
13#
14# When distributing Covered Code, include this CDDL HEADER in each
15# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16# If applicable, add the following below this CDDL HEADER, with the
17# fields enclosed by brackets "[]" replaced with your own identifying
18# information: Portions Copyright [yyyy] [name of copyright owner]
19#
20# CDDL HEADER END
21#
22#
23# Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
24# Copyright 2024 OmniOS Community Edition (OmniOSce) Association.
25#
26# s10 boot script.
27#
28# The arguments to this script are the zone name and the zonepath.
29#
30
31. /usr/lib/brand/solaris10/common.ksh
32
33ZONENAME=$1
34ZONEPATH=$2
35ZONEROOT=$ZONEPATH/root
36
37w_missing=$(gettext "Warning: \"%s\" is not installed in the global zone")
38
39arch=`uname -p`
40if [ "$arch" = "i386" ]; then
41	ARCH32=i86
42        ARCH64=amd64
43elif [ "$arch" = "sparc" ]; then
44	# 32-bit SPARC not supported!
45	ARCH32=
46        ARCH64=sparcv9
47else
48        echo "Unsupported architecture: $arch"
49        exit 2
50fi
51
52#
53# Run the s10_support boot hook.
54#
55/usr/lib/brand/solaris10/s10_support boot $ZONENAME
56if (( $? != 0 )) ; then
57        exit 1
58fi
59
60BRANDDIR=/.SUNWnative/usr/lib/brand/solaris10;
61FILEDIR=$BRANDDIR/files;
62EXIT_CODE=1
63
64#
65# Replace the specified file in the booting zone with a wrapper script that
66# invokes s10_isaexec_wrapper.  This is a convenience function that reduces
67# clutter and code duplication.
68#
69# Parameters:
70#	$1	The full path of the file to replace (e.g., /sbin/ifconfig)
71#	$2	The access mode of the replacement file in hex (e.g., 0555)
72#	$3	The name of the replacement file's owner (e.g., root:bin)
73#
74# NOTE: The checks performed in the 'if' statement below are not generic: they
75# depend on the success of the zone filesystem structure validation performed
76# above to ensure that intermediate directories exist and aren't symlinks.
77#
78replace_with_native() {
79	path_dname=$ZONEROOT/`dirname $1`
80
81	[ ! -f $1 ] && printf "$w_missing" "$1"
82	if [ ! -h $path_dname -a -d $path_dname ]; then
83		safe_replace $ZONEROOT/$1 $BRANDDIR/s10_isaexec_wrapper $2 $3 \
84		    remove
85	fi
86}
87
88#
89# Create a new wrapper script that invokes s10_isaexec_wrapper in the
90# brand (for a non-existing s10c file) pointing to the native brand file.
91#
92# Parameters:
93#	$1	The full path of the wrapper file to create
94#	$2	The access mode of the replacement file in hex (e.g., 0555)
95#	$3	The name of the replacement file's owner (e.g., root:bin)
96#
97wrap_with_native() {
98
99	[ ! -f $1 ] && printf "$w_missing" "$1"
100
101	path_dname=$ZONEROOT/`dirname $1`
102	if [ ! -h $path_dname -a -d $path_dname -a ! -f $ZONEROOT/$1 ]; then
103		safe_wrap $ZONEROOT/$1 $BRANDDIR/s10_isaexec_wrapper $2 $3
104	fi
105}
106
107#
108# Before we boot we validate and fix, if necessary, the required files within
109# the zone.  These modifications can be lost if a patch is applied within the
110# zone, so we validate and fix the zone every time it boots.
111#
112
113#
114# BINARY REPLACEMENT
115#
116# This section of the boot script is responsible for replacing Solaris 10
117# binaries within the booting zone with Nevada binaries.  This is a two-step
118# process: First, the directory structure of the zone is validated to ensure
119# that binary replacement will proceed safely.  Second, Solaris 10 binaries
120# are replaced with Nevada binaries.
121#
122# Here's an example.  Suppose that you want to replace /usr/bin/zcat with the
123# Nevada /usr/bin/zcat binary.  Then you should do the following:
124#
125#	1.  Go to the section below labeled "STEP ONE" and add the following
126#	    two lines:
127#
128#		safe_dir /usr
129#		safe_dir /usr/bin
130#
131#	    These lines ensure that both /usr and /usr/bin are directories
132#	    within the booting zone that can be safely accessed by the global
133#	    zone.
134#	2.  Go to the section below labeled "STEP TWO" and add the following
135#	    line:
136#
137#		replace_with_native /usr/bin/zcat 0555 root:bin
138#
139# Details about the binary replacement procedure can be found in the Solaris 10
140# Containers Developer Guide.
141#
142
143#
144# STEP ONE
145#
146# Validate that the zone filesystem looks like we expect it to.
147#
148safe_dir /lib
149safe_dir /lib/svc
150safe_dir /lib/svc/method
151safe_dir /lib/svc/share
152safe_dir /usr
153safe_dir /usr/bin
154safe_dir /usr/lib
155safe_dir /usr/lib/autofs
156safe_dir /usr/lib/fs
157safe_dir /usr/lib/fs/autofs
158safe_dir /usr/lib/fs/ufs
159safe_dir /usr/lib/fs/zfs
160safe_dir /usr/lib/inet
161safe_dir /usr/lib/zfs
162safe_dir /usr/sbin
163if [ -n "$ARCH32" ]; then
164	safe_dir /usr/lib/ipf/$ARCH32
165	safe_dir /usr/sbin/$ARCH32
166fi
167if [ -n "$ARCH64" ]; then
168	safe_dir /usr/lib/ipf/$ARCH64
169	safe_dir /usr/sbin/$ARCH64
170fi
171safe_dir /sbin
172safe_dir /var
173safe_dir /var/svc
174safe_dir /var/svc/manifest
175safe_dir /var/svc/manifest/network
176
177#
178# Some of the native networking daemons such as in.mpathd are
179# expected under /lib/inet
180#
181mkdir -m 0755 -p $ZONEROOT/lib/inet
182chown root:bin $ZONEROOT/lib/inet
183safe_dir /lib/inet
184
185#
186# STEP TWO
187#
188# Replace Solaris 10 binaries with Nevada binaries.
189#
190
191#
192# Replace various network-related programs with native wrappers.
193#
194replace_with_native /sbin/dhcpagent 0555 root:bin
195replace_with_native /sbin/dhcpinfo 0555 root:bin
196replace_with_native /sbin/ifconfig 0555 root:bin
197replace_with_native /usr/bin/netstat 0555 root:bin
198replace_with_native /usr/lib/inet/in.ndpd 0555 root:bin
199replace_with_native /usr/sbin/in.routed 0555 root:bin
200replace_with_native /usr/sbin/ndd 0555 root:bin
201replace_with_native /usr/sbin/snoop 0555 root:bin
202replace_with_native /usr/sbin/if_mpadm 0555 root:bin
203
204#
205# Replace IPFilter commands with native wrappers
206#
207replace_with_native /usr/lib/ipf/ipftest 0555 root:bin
208replace_with_native /usr/sbin/ipf 0555 root:bin
209replace_with_native /usr/sbin/ipfs 0555 root:bin
210replace_with_native /usr/sbin/ipfstat 0555 root:bin
211replace_with_native /usr/sbin/ipmon 0555 root:bin
212replace_with_native /usr/sbin/ipnat 0555 root:bin
213replace_with_native /usr/sbin/ippool 0555 root:bin
214
215#
216# Replace in.mpathd daemon at /usr/lib/inet by native wrapper
217#
218if [ ! -h $ZONEROOT/usr/lib/inet -a -d $ZONEROOT/usr/lib/inet ]; then
219	safe_replace $ZONEROOT/usr/lib/inet/in.mpathd \
220	    /lib/inet/in.mpathd 0555 root:bin remove
221fi
222
223#
224# Create wrapper at /lib/inet/in.mpathd as well because native ifconfig
225# looks up in.mpathd under /lib/inet.
226#
227wrap_with_native /lib/inet/in.mpathd 0555 root:bin
228
229# Create native wrapper for /sbin/ipmpstat
230wrap_with_native /sbin/ipmpstat 0555 root:bin
231
232#
233# Create ipmgmtd wrapper to native binary in s10 container
234# and copy ipmgmt service manifest and method.
235#
236wrap_with_native /lib/inet/ipmgmtd 0555 root:bin
237safe_copy /lib/svc/manifest/network/network-ipmgmt.xml \
238    $ZONEROOT/var/svc/manifest/network/network-ipmgmt.xml
239safe_copy /lib/svc/method/net-ipmgmt \
240    $ZONEROOT/lib/svc/method/net-ipmgmt
241
242#
243# To handle certain IPMP configurations, we need updated
244# net-physical method script and native net_include.sh
245#
246filename=$ZONEROOT/lib/svc/method/net-physical
247safe_backup $filename $filename.pre_p2v
248safe_copy /usr/lib/brand/solaris10/s10_net_physical $filename
249filename=$ZONEROOT/lib/svc/share/net_include.sh
250safe_backup $filename $filename.pre_p2v
251safe_copy /lib/svc/share/net_include.sh $filename
252
253#
254# PSARC 2009/306 removed the ND_SET/ND_GET ioctl's for modifying
255# IP/TCP/UDP/SCTP/ICMP tunables. If S10 ndd(8) is used within an
256# S10 container, the kernel will return EINVAL. So we need this.
257#
258replace_with_native /usr/sbin/ndd 0555 root:bin
259
260#
261# Replace various ZFS-related programs with native wrappers.  These commands
262# either link with libzfs, dlopen libzfs or link with libraries that link
263# or dlopen libzfs.  Commands which fall into these categories but which can
264# only be used in the global zone are not wrapped.  The libdiskmgt dm_in_use
265# code uses libfs, but only the zpool_in_use() -> zpool_read_label() code path.
266# That code does not issue ioctls on /dev/zfs and does not need wrapping.
267#
268replace_with_native /sbin/zfs 0555 root:bin
269replace_with_native /sbin/zpool 0555 root:bin
270replace_with_native /usr/lib/fs/ufs/quota 0555 root:bin
271replace_with_native /usr/lib/fs/zfs/fstyp 0555 root:bin
272replace_with_native /usr/lib/zfs/availdevs 0555 root:bin
273replace_with_native /usr/sbin/df 0555 root:bin
274replace_with_native /usr/sbin/zstreamdump 0555 root:bin
275
276#
277# Replace automount and automountd with native wrappers.
278#
279replace_with_native /usr/lib/fs/autofs/automount 0555 root:bin
280replace_with_native /usr/lib/autofs/automountd 0555 root:bin
281
282#
283# The class-specific dispadmin(8) and priocntl(1) binaries must be native
284# wrappers, and we must have all of the ones the native zone does.  This
285# allows new scheduling classes to appear without causing dispadmin and
286# priocntl to be unhappy.
287#
288rm -rf $ZONEROOT/usr/lib/class
289mkdir $ZONEROOT/usr/lib/class || exit 1
290
291find /usr/lib/class -type d -o -type f | while read x; do
292	[ -d $x ] && mkdir -p -m 755 $ZONEROOT$x
293	[ -f $x ] && wrap_with_native $x 0555 root:bin
294done
295
296#
297# END OF STEP TWO
298#
299
300#
301# Replace add_drv and rem_drv with /usr/bin/true so that pkgs/patches which
302# install or remove drivers will work.  NOTE: add_drv and rem_drv are hard
303# linked to isaexec so we want to remove the current executable and
304# then copy true so that we don't clobber isaexec.
305#
306filename=$ZONEROOT/usr/sbin/add_drv
307[ ! -f $filename.pre_p2v ] && safe_backup $filename $filename.pre_p2v
308rm -f $filename
309safe_copy $ZONEROOT/usr/bin/true $filename
310
311filename=$ZONEROOT/usr/sbin/rem_drv
312[ ! -f $filename.pre_p2v ] && safe_backup $filename $filename.pre_p2v
313rm -f $filename
314safe_copy $ZONEROOT/usr/bin/true $filename
315
316exit 0
317