1753a6d45SSherry Moore /*
2753a6d45SSherry Moore  * CDDL HEADER START
3753a6d45SSherry Moore  *
4753a6d45SSherry Moore  * The contents of this file are subject to the terms of the
5753a6d45SSherry Moore  * Common Development and Distribution License (the "License").
6753a6d45SSherry Moore  * You may not use this file except in compliance with the License.
7753a6d45SSherry Moore  *
8753a6d45SSherry Moore  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9753a6d45SSherry Moore  * or http://www.opensolaris.org/os/licensing.
10753a6d45SSherry Moore  * See the License for the specific language governing permissions
11753a6d45SSherry Moore  * and limitations under the License.
12753a6d45SSherry Moore  *
13753a6d45SSherry Moore  * When distributing Covered Code, include this CDDL HEADER in each
14753a6d45SSherry Moore  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15753a6d45SSherry Moore  * If applicable, add the following below this CDDL HEADER, with the
16753a6d45SSherry Moore  * fields enclosed by brackets "[]" replaced with your own identifying
17753a6d45SSherry Moore  * information: Portions Copyright [yyyy] [name of copyright owner]
18753a6d45SSherry Moore  *
19753a6d45SSherry Moore  * CDDL HEADER END
20753a6d45SSherry Moore  */
21753a6d45SSherry Moore 
22753a6d45SSherry Moore /*
23e557d412SChristopher Kiick  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
24753a6d45SSherry Moore  * Use is subject to license terms.
25753a6d45SSherry Moore  */
26753a6d45SSherry Moore 
27753a6d45SSherry Moore /*
28753a6d45SSherry Moore  * This file contains high level functions used by multiple utilities.
29753a6d45SSherry Moore  */
30753a6d45SSherry Moore 
31753a6d45SSherry Moore #include "libscf_impl.h"
32753a6d45SSherry Moore 
33753a6d45SSherry Moore #include <assert.h>
34753a6d45SSherry Moore #include <libuutil.h>
35753a6d45SSherry Moore #include <string.h>
36d2a70789SRichard Lowe #include <strings.h>
37753a6d45SSherry Moore #include <stdlib.h>
38753a6d45SSherry Moore #include <sys/systeminfo.h>
39753a6d45SSherry Moore #include <sys/uadmin.h>
40753a6d45SSherry Moore #include <sys/utsname.h>
41d2a70789SRichard Lowe #include <sys/secflags.h>
42753a6d45SSherry Moore 
43753a6d45SSherry Moore #ifdef	__x86
44753a6d45SSherry Moore #include <smbios.h>
45753a6d45SSherry Moore 
46753a6d45SSherry Moore /*
47753a6d45SSherry Moore  * Check whether the platform is on the fastreboot_blacklist.
48753a6d45SSherry Moore  * Return 1 if the platform has been blacklisted, 0 otherwise.
49753a6d45SSherry Moore  */
50753a6d45SSherry Moore static int
scf_is_fb_blacklisted(void)51753a6d45SSherry Moore scf_is_fb_blacklisted(void)
52753a6d45SSherry Moore {
53753a6d45SSherry Moore 	smbios_hdl_t *shp;
54753a6d45SSherry Moore 	smbios_system_t sys;
55753a6d45SSherry Moore 	smbios_info_t info;
56753a6d45SSherry Moore 
57753a6d45SSherry Moore 	id_t id;
58753a6d45SSherry Moore 	int err;
59753a6d45SSherry Moore 	int i;
60753a6d45SSherry Moore 
61753a6d45SSherry Moore 	scf_simple_prop_t *prop = NULL;
62753a6d45SSherry Moore 	ssize_t numvals;
63753a6d45SSherry Moore 	char *platform_name;
64753a6d45SSherry Moore 
65753a6d45SSherry Moore 	int blacklisted = 0;
66753a6d45SSherry Moore 
67753a6d45SSherry Moore 	/*
68753a6d45SSherry Moore 	 * If there's no SMBIOS, assume it's blacklisted.
69753a6d45SSherry Moore 	 */
70753a6d45SSherry Moore 	if ((shp = smbios_open(NULL, SMB_VERSION, 0, &err)) == NULL)
71753a6d45SSherry Moore 		return (1);
72753a6d45SSherry Moore 
73753a6d45SSherry Moore 	/*
74753a6d45SSherry Moore 	 * If we can't read system info, assume it's blacklisted.
75753a6d45SSherry Moore 	 */
76753a6d45SSherry Moore 	if ((id = smbios_info_system(shp, &sys)) == SMB_ERR ||
77753a6d45SSherry Moore 	    smbios_info_common(shp, id, &info) == SMB_ERR) {
78753a6d45SSherry Moore 		blacklisted = 1;
79753a6d45SSherry Moore 		goto fb_out;
80753a6d45SSherry Moore 	}
81753a6d45SSherry Moore 
82753a6d45SSherry Moore 	/*
83753a6d45SSherry Moore 	 * If we can't read the "platforms" property from property group
84753a6d45SSherry Moore 	 * BOOT_CONFIG_PG_FBBLACKLIST, assume no platforms have
85753a6d45SSherry Moore 	 * been blacklisted.
86753a6d45SSherry Moore 	 */
87753a6d45SSherry Moore 	if ((prop = scf_simple_prop_get(NULL, FMRI_BOOT_CONFIG,
88753a6d45SSherry Moore 	    BOOT_CONFIG_PG_FBBLACKLIST, "platforms")) == NULL)
89753a6d45SSherry Moore 		goto fb_out;
90753a6d45SSherry Moore 
91753a6d45SSherry Moore 	numvals = scf_simple_prop_numvalues(prop);
92753a6d45SSherry Moore 
93753a6d45SSherry Moore 	for (i = 0; i < numvals; i++) {
94753a6d45SSherry Moore 		platform_name = scf_simple_prop_next_astring(prop);
95753a6d45SSherry Moore 		if (platform_name == NULL)
96753a6d45SSherry Moore 			break;
97753a6d45SSherry Moore 		if (strcmp(platform_name, info.smbi_product) == 0) {
98753a6d45SSherry Moore 			blacklisted = 1;
99753a6d45SSherry Moore 			break;
100753a6d45SSherry Moore 		}
101753a6d45SSherry Moore 	}
102753a6d45SSherry Moore 
103753a6d45SSherry Moore fb_out:
104753a6d45SSherry Moore 	smbios_close(shp);
105753a6d45SSherry Moore 	scf_simple_prop_free(prop);
106753a6d45SSherry Moore 
107753a6d45SSherry Moore 	return (blacklisted);
108753a6d45SSherry Moore }
1094196e263SSherry Moore 
1104196e263SSherry Moore /*
1114196e263SSherry Moore  * Add or get a property group given an FMRI.
1124196e263SSherry Moore  * Return SCF_SUCCESS on success, SCF_FAILED on failure.
1134196e263SSherry Moore  */
1144196e263SSherry Moore static int
scf_fmri_pg_get_or_add(const char * fmri,const char * pgname,const char * pgtype,uint32_t pgflags,int add)1154196e263SSherry Moore scf_fmri_pg_get_or_add(const char *fmri, const char *pgname,
1164196e263SSherry Moore     const char *pgtype, uint32_t pgflags, int add)
1174196e263SSherry Moore {
1184196e263SSherry Moore 	scf_handle_t	*handle = NULL;
1194196e263SSherry Moore 	scf_instance_t	*inst = NULL;
1204196e263SSherry Moore 	int		rc = SCF_FAILED;
12157b30532SSherry Moore 	int		error;
1224196e263SSherry Moore 
1234196e263SSherry Moore 	if ((handle = scf_handle_create(SCF_VERSION)) == NULL ||
1244196e263SSherry Moore 	    scf_handle_bind(handle) != 0 ||
1254196e263SSherry Moore 	    (inst = scf_instance_create(handle)) == NULL ||
1264196e263SSherry Moore 	    scf_handle_decode_fmri(handle, fmri, NULL, NULL,
1274196e263SSherry Moore 	    inst, NULL, NULL, SCF_DECODE_FMRI_EXACT) != SCF_SUCCESS)
1284196e263SSherry Moore 		goto scferror;
1294196e263SSherry Moore 
1304196e263SSherry Moore 	if (add) {
1314196e263SSherry Moore 		rc = scf_instance_add_pg(inst, pgname, pgtype, pgflags, NULL);
1324196e263SSherry Moore 		/*
1334196e263SSherry Moore 		 * If the property group already exists, return SCF_SUCCESS.
1344196e263SSherry Moore 		 */
13557b30532SSherry Moore 		if (rc != SCF_SUCCESS && scf_error() == SCF_ERROR_EXISTS)
1364196e263SSherry Moore 			rc = SCF_SUCCESS;
1374196e263SSherry Moore 	} else {
1384196e263SSherry Moore 		rc = scf_instance_get_pg(inst, pgname, NULL);
1394196e263SSherry Moore 	}
1404196e263SSherry Moore 
1414196e263SSherry Moore scferror:
14257b30532SSherry Moore 	if (rc != SCF_SUCCESS)
14357b30532SSherry Moore 		error = scf_error();
1444196e263SSherry Moore 
1454196e263SSherry Moore 	scf_instance_destroy(inst);
1464196e263SSherry Moore 	if (handle)
1474196e263SSherry Moore 		(void) scf_handle_unbind(handle);
1484196e263SSherry Moore 	scf_handle_destroy(handle);
1494196e263SSherry Moore 
15057b30532SSherry Moore 	if (rc != SCF_SUCCESS)
1514196e263SSherry Moore 		(void) scf_set_error(error);
15257b30532SSherry Moore 
1534196e263SSherry Moore 	return (rc);
1544196e263SSherry Moore }
155753a6d45SSherry Moore #endif	/* __x86 */
156753a6d45SSherry Moore 
157753a6d45SSherry Moore /*
158753a6d45SSherry Moore  * Get config properties from svc:/system/boot-config:default.
159753a6d45SSherry Moore  * It prints errors with uu_warn().
160753a6d45SSherry Moore  */
161753a6d45SSherry Moore void
scf_get_boot_config(uint8_t * boot_config)162753a6d45SSherry Moore scf_get_boot_config(uint8_t *boot_config)
163753a6d45SSherry Moore {
164d0b2dca5SRichard Lowe 	uint64_t ret = 0;
165d0b2dca5SRichard Lowe 
166753a6d45SSherry Moore 	assert(boot_config);
167753a6d45SSherry Moore 	*boot_config = 0;
168753a6d45SSherry Moore 
169753a6d45SSherry Moore 	{
170753a6d45SSherry Moore 		/*
171753a6d45SSherry Moore 		 * Property vector for BOOT_CONFIG_PG_PARAMS property group.
172753a6d45SSherry Moore 		 */
173753a6d45SSherry Moore 		scf_propvec_t ua_boot_config[] = {
175753a6d45SSherry Moore 			    UA_FASTREBOOT_DEFAULT },
177753a6d45SSherry Moore 			    UA_FASTREBOOT_ONPANIC },
178753a6d45SSherry Moore 			{ NULL }
179753a6d45SSherry Moore 		};
180753a6d45SSherry Moore 		scf_propvec_t	*prop;
181753a6d45SSherry Moore 
182753a6d45SSherry Moore 		for (prop = ua_boot_config; prop->pv_prop != NULL; prop++)
183d0b2dca5SRichard Lowe 			prop->pv_ptr = &ret;
184753a6d45SSherry Moore 		prop = NULL;
185753a6d45SSherry Moore 		if (scf_read_propvec(FMRI_BOOT_CONFIG, BOOT_CONFIG_PG_PARAMS,
186753a6d45SSherry Moore 		    B_TRUE, ua_boot_config, &prop) != SCF_FAILED) {
187e557d412SChristopher Kiick 
188e557d412SChristopher Kiick #ifdef	__x86
189753a6d45SSherry Moore 			/*
190753a6d45SSherry Moore 			 * Unset both flags if the platform has been
191753a6d45SSherry Moore 			 * blacklisted.
192753a6d45SSherry Moore 			 */
193753a6d45SSherry Moore 			if (scf_is_fb_blacklisted())
194d0b2dca5SRichard Lowe 				return;
195e557d412SChristopher Kiick #endif	/* __x86 */
196d0b2dca5SRichard Lowe 			*boot_config = (uint8_t)ret;
197753a6d45SSherry Moore 			return;
198753a6d45SSherry Moore 		}
199753a6d45SSherry Moore #if defined(FASTREBOOT_DEBUG)
200753a6d45SSherry Moore 		if (prop != NULL) {
201753a6d45SSherry Moore 			(void) uu_warn("Service %s property '%s/%s' "
202753a6d45SSherry Moore 			    "not found.\n", FMRI_BOOT_CONFIG,
203753a6d45SSherry Moore 			    BOOT_CONFIG_PG_PARAMS, prop->pv_prop);
204753a6d45SSherry Moore 		} else {
205753a6d45SSherry Moore 			(void) uu_warn("Unable to read service %s "
206753a6d45SSherry Moore 			    "property '%s': %s\n", FMRI_BOOT_CONFIG,
207753a6d45SSherry Moore 			    BOOT_CONFIG_PG_PARAMS, scf_strerror(scf_error()));
208753a6d45SSherry Moore 		}
209753a6d45SSherry Moore #endif	/* FASTREBOOT_DEBUG */
210753a6d45SSherry Moore 	}
211753a6d45SSherry Moore }
212753a6d45SSherry Moore 
2134196e263SSherry Moore /*
2144196e263SSherry Moore  * Get or set properties in non-persistent "config_ovr" property group
2154196e263SSherry Moore  * in svc:/system/boot-config:default.
2164196e263SSherry Moore  * It prints errors with uu_warn().
2174196e263SSherry Moore  */
2184196e263SSherry Moore /*ARGSUSED*/
2194196e263SSherry Moore static int
scf_getset_boot_config_ovr(int set,uint8_t * boot_config_ovr)2204196e263SSherry Moore scf_getset_boot_config_ovr(int set, uint8_t *boot_config_ovr)
2214196e263SSherry Moore {
2224196e263SSherry Moore 	int rc = SCF_SUCCESS;
2234196e263SSherry Moore 
2244196e263SSherry Moore 	assert(boot_config_ovr);
2254196e263SSherry Moore 
2264196e263SSherry Moore #ifndef	__x86
2274196e263SSherry Moore 	return (rc);
2284196e263SSherry Moore #else
2294196e263SSherry Moore 	{
2304196e263SSherry Moore 		/*
2314196e263SSherry Moore 		 * Property vector for BOOT_CONFIG_PG_OVR property group.
2324196e263SSherry Moore 		 */
2334196e263SSherry Moore 		scf_propvec_t ua_boot_config_ovr[] = {
2354196e263SSherry Moore 			    UA_FASTREBOOT_DEFAULT },
237c90a5fbeSSherry Moore 			    UA_FASTREBOOT_ONPANIC },
2384196e263SSherry Moore 			{ NULL }
2394196e263SSherry Moore 		};
2404196e263SSherry Moore 		scf_propvec_t	*prop;
2414196e263SSherry Moore 
2424196e263SSherry Moore 		rc = scf_fmri_pg_get_or_add(FMRI_BOOT_CONFIG,
2444196e263SSherry Moore 		    SCF_PG_FLAG_NONPERSISTENT, set);
2454196e263SSherry Moore 
2464196e263SSherry Moore 		if (rc != SCF_SUCCESS) {
2474196e263SSherry Moore #if defined(FASTREBOOT_DEBUG)
2484196e263SSherry Moore 			if (set)
2494196e263SSherry Moore 				(void) uu_warn("Unable to add service %s "
2504196e263SSherry Moore 				    "property group '%s'\n",
2514196e263SSherry Moore 				    FMRI_BOOT_CONFIG, BOOT_CONFIG_PG_OVR);
2524196e263SSherry Moore #endif	/* FASTREBOOT_DEBUG */
2534196e263SSherry Moore 			return (rc);
2544196e263SSherry Moore 		}
2554196e263SSherry Moore 
2564196e263SSherry Moore 		for (prop = ua_boot_config_ovr; prop->pv_prop != NULL; prop++)
2574196e263SSherry Moore 			prop->pv_ptr = boot_config_ovr;
2584196e263SSherry Moore 		prop = NULL;
2594196e263SSherry Moore 
2604196e263SSherry Moore 		if (set)
2614196e263SSherry Moore 			rc = scf_write_propvec(FMRI_BOOT_CONFIG,
2624196e263SSherry Moore 			    BOOT_CONFIG_PG_OVR, ua_boot_config_ovr, &prop);
2634196e263SSherry Moore 		else
2644196e263SSherry Moore 			rc = scf_read_propvec(FMRI_BOOT_CONFIG,
2654196e263SSherry Moore 			    BOOT_CONFIG_PG_OVR, B_FALSE, ua_boot_config_ovr,
2664196e263SSherry Moore 			    &prop);
2674196e263SSherry Moore 
2684196e263SSherry Moore #if defined(FASTREBOOT_DEBUG)
2694196e263SSherry Moore 		if (rc != SCF_SUCCESS) {
2704196e263SSherry Moore 			if (prop != NULL) {
2714196e263SSherry Moore 				(void) uu_warn("Service %s property '%s/%s' "
2724196e263SSherry Moore 				    "not found.\n", FMRI_BOOT_CONFIG,
2734196e263SSherry Moore 				    BOOT_CONFIG_PG_OVR, prop->pv_prop);
2744196e263SSherry Moore 			} else {
2754196e263SSherry Moore 				(void) uu_warn("Unable to %s service %s "
2764196e263SSherry Moore 				    "property '%s': %s\n", set ? "set" : "get",
2774196e263SSherry Moore 				    FMRI_BOOT_CONFIG, BOOT_CONFIG_PG_OVR,
2784196e263SSherry Moore 				    scf_strerror(scf_error()));
2794196e263SSherry Moore 			}
2804196e263SSherry Moore 		}
2814196e263SSherry Moore #endif	/* FASTREBOOT_DEBUG */
282c90a5fbeSSherry Moore 
283c90a5fbeSSherry Moore 		if (set)
284c90a5fbeSSherry Moore 			(void) smf_refresh_instance(FMRI_BOOT_CONFIG);
285c90a5fbeSSherry Moore 
2864196e263SSherry Moore 		return (rc);
2874196e263SSherry Moore 
2884196e263SSherry Moore 	}
2894196e263SSherry Moore #endif	/* __x86 */
2904196e263SSherry Moore }
2914196e263SSherry Moore 
2924196e263SSherry Moore /*
2934196e263SSherry Moore  * Get values of properties in non-persistent "config_ovr" property group.
2944196e263SSherry Moore  */
295c90a5fbeSSherry Moore void
scf_get_boot_config_ovr(uint8_t * boot_config_ovr)2964196e263SSherry Moore scf_get_boot_config_ovr(uint8_t *boot_config_ovr)
2974196e263SSherry Moore {
2984196e263SSherry Moore 	(void) scf_getset_boot_config_ovr(B_FALSE, boot_config_ovr);
2994196e263SSherry Moore }
3004196e263SSherry Moore 
3014196e263SSherry Moore /*
3024196e263SSherry Moore  * Set value of "config_ovr/fastreboot_default".
3034196e263SSherry Moore  */
3044196e263SSherry Moore int
scf_fastreboot_default_set_transient(boolean_t value)3054196e263SSherry Moore scf_fastreboot_default_set_transient(boolean_t value)
3064196e263SSherry Moore {
307c90a5fbeSSherry Moore 	uint8_t	boot_config_ovr = 0;
308c90a5fbeSSherry Moore 
309c90a5fbeSSherry Moore 	if (value == B_TRUE)
310c90a5fbeSSherry Moore 		boot_config_ovr = UA_FASTREBOOT_DEFAULT | UA_FASTREBOOT_ONPANIC;
3114196e263SSherry Moore 
3124196e263SSherry Moore 	return (scf_getset_boot_config_ovr(B_TRUE, &boot_config_ovr));
3134196e263SSherry Moore }
3144196e263SSherry Moore 
315753a6d45SSherry Moore /*
316753a6d45SSherry Moore  * Check whether Fast Reboot is the default operating mode.
317753a6d45SSherry Moore  * Return 0 if
318753a6d45SSherry Moore  *   1. the platform is xVM
319753a6d45SSherry Moore  * or
320753a6d45SSherry Moore  *   2. svc:/system/boot-config:default service doesn't exist,
321753a6d45SSherry Moore  * or
3224196e263SSherry Moore  *   3. property "config/fastreboot_default" doesn't exist,
323753a6d45SSherry Moore  * or
3244196e263SSherry Moore  *   4. value of property "config/fastreboot_default" is set to "false"
3254196e263SSherry Moore  *      and "config_ovr/fastreboot_default" is not set to "true",
326753a6d45SSherry Moore  * or
327753a6d45SSherry Moore  *   5. the platform has been blacklisted.
3284196e263SSherry Moore  * or
3294196e263SSherry Moore  *   6. value of property "config_ovr/fastreboot_default" is set to "false".
330753a6d45SSherry Moore  * Return non-zero otherwise.
331753a6d45SSherry Moore  */
332753a6d45SSherry Moore int
scf_is_fastboot_default(void)333753a6d45SSherry Moore scf_is_fastboot_default(void)
334753a6d45SSherry Moore {
3354196e263SSherry Moore 	uint8_t	boot_config = 0, boot_config_ovr;
336753a6d45SSherry Moore 	char procbuf[SYS_NMLN];
337753a6d45SSherry Moore 
338753a6d45SSherry Moore 	/*
339753a6d45SSherry Moore 	 * If we are on xVM, do not fast reboot by default.
340753a6d45SSherry Moore 	 */
341753a6d45SSherry Moore 	if (sysinfo(SI_PLATFORM, procbuf, sizeof (procbuf)) == -1 ||
342753a6d45SSherry Moore 	    strcmp(procbuf, "i86xpv") == 0)
343753a6d45SSherry Moore 		return (0);
344753a6d45SSherry Moore 
3454196e263SSherry Moore 	/*
3464196e263SSherry Moore 	 * Get property values from "config" property group
3474196e263SSherry Moore 	 */
348753a6d45SSherry Moore 	scf_get_boot_config(&boot_config);
3494196e263SSherry Moore 
3504196e263SSherry Moore 	/*
3514196e263SSherry Moore 	 * Get property values from non-persistent "config_ovr" property group
3524196e263SSherry Moore 	 */
3534196e263SSherry Moore 	boot_config_ovr = boot_config;
3544196e263SSherry Moore 	scf_get_boot_config_ovr(&boot_config_ovr);
3554196e263SSherry Moore 
3564196e263SSherry Moore 	return (boot_config & boot_config_ovr & UA_FASTREBOOT_DEFAULT);
357753a6d45SSherry Moore }
358d2a70789SRichard Lowe 
359d2a70789SRichard Lowe /*
360d2a70789SRichard Lowe  * Read the default security-flags from system/process-security and return a
361d2a70789SRichard Lowe  * secflagset_t suitable for psecflags(2)
362d2a70789SRichard Lowe  *
363d2a70789SRichard Lowe  * Unfortunately, this symbol must _exist_ in the native build, for the sake
364d2a70789SRichard Lowe  * of the mapfile, even though we don't ever use it, and it will never work.
365d2a70789SRichard Lowe  */
366d2a70789SRichard Lowe struct group_desc {
367d2a70789SRichard Lowe 	secflagdelta_t *delta;
368d2a70789SRichard Lowe 	char *fmri;
369d2a70789SRichard Lowe };
370d2a70789SRichard Lowe 
371d2a70789SRichard Lowe int
scf_default_secflags(scf_handle_t * hndl,scf_secflags_t * flags)372d2a70789SRichard Lowe scf_default_secflags(scf_handle_t *hndl, scf_secflags_t *flags)
373d2a70789SRichard Lowe {
374d2a70789SRichard Lowe #if !defined(NATIVE_BUILD)
375d2a70789SRichard Lowe 	scf_property_t *prop;
376d2a70789SRichard Lowe 	scf_value_t *val;
377d2a70789SRichard Lowe 	const char *flagname;
378d2a70789SRichard Lowe 	int flag;
379d2a70789SRichard Lowe 	struct group_desc *g;
380d2a70789SRichard Lowe 	struct group_desc groups[] = {
381d2a70789SRichard Lowe 		{NULL, "svc:/system/process-security/"
382d2a70789SRichard Lowe 		    ":properties/default"},
383d2a70789SRichard Lowe 		{NULL, "svc:/system/process-security/"
384d2a70789SRichard Lowe 		    ":properties/lower"},
385d2a70789SRichard Lowe 		{NULL, "svc:/system/process-security/"
386d2a70789SRichard Lowe 		    ":properties/upper"},
387d2a70789SRichard Lowe 		{NULL, NULL}
388d2a70789SRichard Lowe 	};
389d2a70789SRichard Lowe 
390d2a70789SRichard Lowe 	bzero(flags, sizeof (*flags));
391d2a70789SRichard Lowe 
392d2a70789SRichard Lowe 	groups[0].delta = &flags->ss_default;
393d2a70789SRichard Lowe 	groups[1].delta = &flags->ss_lower;
394d2a70789SRichard Lowe 	groups[2].delta = &flags->ss_upper;
395d2a70789SRichard Lowe 
396d2a70789SRichard Lowe 	for (g = groups; g->delta != NULL; g++) {
397d2a70789SRichard Lowe 		for (flag = 0; (flagname = secflag_to_str(flag)) != NULL;
398d2a70789SRichard Lowe 		    flag++) {
399d2a70789SRichard Lowe 			char *pfmri;
400d2a70789SRichard Lowe 			uint8_t flagval = 0;
401d2a70789SRichard Lowe 
402d2a70789SRichard Lowe 			if ((val = scf_value_create(hndl)) == NULL)
403d2a70789SRichard Lowe 				return (-1);
404d2a70789SRichard Lowe 
405d2a70789SRichard Lowe 			if ((prop = scf_property_create(hndl)) == NULL) {
406d2a70789SRichard Lowe 				scf_value_destroy(val);
407d2a70789SRichard Lowe 				return (-1);
408d2a70789SRichard Lowe 			}
409d2a70789SRichard Lowe 
410d2a70789SRichard Lowe 			if ((pfmri = uu_msprintf("%s/%s", g->fmri,
411d2a70789SRichard Lowe 			    flagname)) == NULL)
412d2a70789SRichard Lowe 				uu_die("Allocation failure\n");
413d2a70789SRichard Lowe 
414d2a70789SRichard Lowe 			if (scf_handle_decode_fmri(hndl, pfmri,
415*4a014300SToomas Soome 			    NULL, NULL, NULL, NULL, prop, 0) != 0)
416d2a70789SRichard Lowe 				goto next;
417d2a70789SRichard Lowe 
418d2a70789SRichard Lowe 			if (scf_property_get_value(prop, val) != 0)
419d2a70789SRichard Lowe 				goto next;
420d2a70789SRichard Lowe 
421d2a70789SRichard Lowe 			(void) scf_value_get_boolean(val, &flagval);
422d2a70789SRichard Lowe 
423d2a70789SRichard Lowe 			if (flagval != 0)
424d2a70789SRichard Lowe 				secflag_set(&g->delta->psd_add, flag);
425d2a70789SRichard Lowe 			else
426d2a70789SRichard Lowe 				secflag_set(&g->delta->psd_rem, flag);
427d2a70789SRichard Lowe 
428d2a70789SRichard Lowe next:
429d2a70789SRichard Lowe 			uu_free(pfmri);
430d2a70789SRichard Lowe 			scf_value_destroy(val);
431d2a70789SRichard Lowe 			scf_property_destroy(prop);
432d2a70789SRichard Lowe 		}
433d2a70789SRichard Lowe 	}
434d2a70789SRichard Lowe 
435d2a70789SRichard Lowe 	return (0);
436d2a70789SRichard Lowe #else
437d2a70789SRichard Lowe 	assert(0);
438d2a70789SRichard Lowe 	abort();
439d2a70789SRichard Lowe #endif /* !NATIVE_BUILD */
440d2a70789SRichard Lowe }