17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5ee519a1fSgjelinek * Common Development and Distribution License (the "License"). 6ee519a1fSgjelinek * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 21ffbafc53Scomay 227c478bd9Sstevel@tonic-gate /* 235e74f94dSGary Mills * Copyright 2014 Gary Mills 24a20ee416SGlenn Faden * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved. 25bd93c05dSAlexander Eremin * Copyright 2015 Nexenta Systems, Inc. All rights reserved. 267c478bd9Sstevel@tonic-gate */ 277c478bd9Sstevel@tonic-gate 28cf8f45c7Sdstaff #include <libsysevent.h> 29cf8f45c7Sdstaff #include <pthread.h> 30cf8f45c7Sdstaff #include <stdlib.h> 317c478bd9Sstevel@tonic-gate #include <errno.h> 327c478bd9Sstevel@tonic-gate #include <fnmatch.h> 337c478bd9Sstevel@tonic-gate #include <strings.h> 347c478bd9Sstevel@tonic-gate #include <unistd.h> 357c478bd9Sstevel@tonic-gate #include <assert.h> 367c478bd9Sstevel@tonic-gate #include <libgen.h> 377c478bd9Sstevel@tonic-gate #include <libintl.h> 387c478bd9Sstevel@tonic-gate #include <alloca.h> 397c478bd9Sstevel@tonic-gate #include <ctype.h> 409acbbeafSnn #include <sys/acl.h> 419acbbeafSnn #include <sys/stat.h> 429acbbeafSnn #include <sys/brand.h> 437c478bd9Sstevel@tonic-gate #include <sys/mntio.h> 447c478bd9Sstevel@tonic-gate #include <sys/mnttab.h> 45cf8f45c7Sdstaff #include <sys/nvpair.h> 469acbbeafSnn #include <sys/types.h> 47f4b3ec61Sdh #include <sys/sockio.h> 485679c89fSjv #include <sys/systeminfo.h> 49ee519a1fSgjelinek #include <ftw.h> 500209230bSgjelinek #include <pool.h> 510209230bSgjelinek #include <libscf.h> 520209230bSgjelinek #include <libproc.h> 530209230bSgjelinek #include <sys/priocntl.h> 5439935be5Sgjelinek #include <libuutil.h> 55ff17c8bfSgjelinek #include <wait.h> 56ff17c8bfSgjelinek #include <bsm/adt.h> 57cb8a054bSGlenn Faden #include <auth_attr.h> 58cb8a054bSGlenn Faden #include <auth_list.h> 59cb8a054bSGlenn Faden #include <secdb.h> 60cb8a054bSGlenn Faden #include <user_attr.h> 61cb8a054bSGlenn Faden #include <prof_attr.h> 627c478bd9Sstevel@tonic-gate 637c478bd9Sstevel@tonic-gate #include <arpa/inet.h> 647c478bd9Sstevel@tonic-gate #include <netdb.h> 657c478bd9Sstevel@tonic-gate 667c478bd9Sstevel@tonic-gate #include <libxml/xmlmemory.h> 677c478bd9Sstevel@tonic-gate #include <libxml/parser.h> 687c478bd9Sstevel@tonic-gate 697c478bd9Sstevel@tonic-gate #include <libdevinfo.h> 70108322fbScarlsonj #include <uuid/uuid.h> 71ee519a1fSgjelinek #include <dirent.h> 729acbbeafSnn #include <libbrand.h> 73ee519a1fSgjelinek 747c478bd9Sstevel@tonic-gate #include <libzonecfg.h> 757c478bd9Sstevel@tonic-gate #include "zonecfg_impl.h" 767c478bd9Sstevel@tonic-gate 777c478bd9Sstevel@tonic-gate #define _PATH_TMPFILE "/zonecfg.XXXXXX" 78cf8f45c7Sdstaff #define ZONE_CB_RETRY_COUNT 10 79cf8f45c7Sdstaff #define ZONE_EVENT_PING_SUBCLASS "ping" 80cf8f45c7Sdstaff #define ZONE_EVENT_PING_PUBLISHER "solaris" 817c478bd9Sstevel@tonic-gate 827c478bd9Sstevel@tonic-gate /* Hard-code the DTD element/attribute/entity names just once, here. */ 837c478bd9Sstevel@tonic-gate #define DTD_ELEM_ATTR (const xmlChar *) "attr" 847c478bd9Sstevel@tonic-gate #define DTD_ELEM_COMMENT (const xmlChar *) "comment" 857c478bd9Sstevel@tonic-gate #define DTD_ELEM_DEVICE (const xmlChar *) "device" 867c478bd9Sstevel@tonic-gate #define DTD_ELEM_FS (const xmlChar *) "filesystem" 877c478bd9Sstevel@tonic-gate #define DTD_ELEM_FSOPTION (const xmlChar *) "fsoption" 887c478bd9Sstevel@tonic-gate #define DTD_ELEM_NET (const xmlChar *) "network" 897c478bd9Sstevel@tonic-gate #define DTD_ELEM_RCTL (const xmlChar *) "rctl" 907c478bd9Sstevel@tonic-gate #define DTD_ELEM_RCTLVALUE (const xmlChar *) "rctl-value" 917c478bd9Sstevel@tonic-gate #define DTD_ELEM_ZONE (const xmlChar *) "zone" 92fa9e4066Sahrens #define DTD_ELEM_DATASET (const xmlChar *) "dataset" 930209230bSgjelinek #define DTD_ELEM_TMPPOOL (const xmlChar *) "tmp_pool" 940209230bSgjelinek #define DTD_ELEM_PSET (const xmlChar *) "pset" 950209230bSgjelinek #define DTD_ELEM_MCAP (const xmlChar *) "mcap" 96ee519a1fSgjelinek #define DTD_ELEM_PACKAGE (const xmlChar *) "package" 976cfd72c6Sgjelinek #define DTD_ELEM_OBSOLETES (const xmlChar *) "obsoletes" 98ee519a1fSgjelinek #define DTD_ELEM_DEV_PERM (const xmlChar *) "dev-perm" 99cb8a054bSGlenn Faden #define DTD_ELEM_ADMIN (const xmlChar *) "admin" 100*d2a70789SRichard Lowe #define DTD_ELEM_SECFLAGS (const xmlChar *) "security-flags" 1017c478bd9Sstevel@tonic-gate 1027c478bd9Sstevel@tonic-gate #define DTD_ATTR_ACTION (const xmlChar *) "action" 1037c478bd9Sstevel@tonic-gate #define DTD_ATTR_ADDRESS (const xmlChar *) "address" 104550b6e40SSowmini Varadhan #define DTD_ATTR_ALLOWED_ADDRESS (const xmlChar *) "allowed-address" 1057c478bd9Sstevel@tonic-gate #define DTD_ATTR_AUTOBOOT (const xmlChar *) "autoboot" 106f4b3ec61Sdh #define DTD_ATTR_IPTYPE (const xmlChar *) "ip-type" 107de860bd9Sgfaden #define DTD_ATTR_DEFROUTER (const xmlChar *) "defrouter" 1087c478bd9Sstevel@tonic-gate #define DTD_ATTR_DIR (const xmlChar *) "directory" 1097c478bd9Sstevel@tonic-gate #define DTD_ATTR_LIMIT (const xmlChar *) "limit" 110ffbafc53Scomay #define DTD_ATTR_LIMITPRIV (const xmlChar *) "limitpriv" 1113f2f09c1Sdp #define DTD_ATTR_BOOTARGS (const xmlChar *) "bootargs" 1120209230bSgjelinek #define DTD_ATTR_SCHED (const xmlChar *) "scheduling-class" 1137c478bd9Sstevel@tonic-gate #define DTD_ATTR_MATCH (const xmlChar *) "match" 1147c478bd9Sstevel@tonic-gate #define DTD_ATTR_NAME (const xmlChar *) "name" 1157c478bd9Sstevel@tonic-gate #define DTD_ATTR_PHYSICAL (const xmlChar *) "physical" 1167c478bd9Sstevel@tonic-gate #define DTD_ATTR_POOL (const xmlChar *) "pool" 1177c478bd9Sstevel@tonic-gate #define DTD_ATTR_PRIV (const xmlChar *) "priv" 1187c478bd9Sstevel@tonic-gate #define DTD_ATTR_RAW (const xmlChar *) "raw" 1197c478bd9Sstevel@tonic-gate #define DTD_ATTR_SPECIAL (const xmlChar *) "special" 1207c478bd9Sstevel@tonic-gate #define DTD_ATTR_TYPE (const xmlChar *) "type" 1217c478bd9Sstevel@tonic-gate #define DTD_ATTR_VALUE (const xmlChar *) "value" 1227c478bd9Sstevel@tonic-gate #define DTD_ATTR_ZONEPATH (const xmlChar *) "zonepath" 1230209230bSgjelinek #define DTD_ATTR_NCPU_MIN (const xmlChar *) "ncpu_min" 1240209230bSgjelinek #define DTD_ATTR_NCPU_MAX (const xmlChar *) "ncpu_max" 1250209230bSgjelinek #define DTD_ATTR_IMPORTANCE (const xmlChar *) "importance" 1260209230bSgjelinek #define DTD_ATTR_PHYSCAP (const xmlChar *) "physcap" 127ee519a1fSgjelinek #define DTD_ATTR_VERSION (const xmlChar *) "version" 128ee519a1fSgjelinek #define DTD_ATTR_ID (const xmlChar *) "id" 129ee519a1fSgjelinek #define DTD_ATTR_UID (const xmlChar *) "uid" 130ee519a1fSgjelinek #define DTD_ATTR_GID (const xmlChar *) "gid" 131ee519a1fSgjelinek #define DTD_ATTR_MODE (const xmlChar *) "mode" 132ee519a1fSgjelinek #define DTD_ATTR_ACL (const xmlChar *) "acl" 1339acbbeafSnn #define DTD_ATTR_BRAND (const xmlChar *) "brand" 1345679c89fSjv #define DTD_ATTR_HOSTID (const xmlChar *) "hostid" 135cb8a054bSGlenn Faden #define DTD_ATTR_USER (const xmlChar *) "user" 136cb8a054bSGlenn Faden #define DTD_ATTR_AUTHS (const xmlChar *) "auths" 1370fbb751dSJohn Levon #define DTD_ATTR_FS_ALLOWED (const xmlChar *) "fs-allowed" 138*d2a70789SRichard Lowe #define DTD_ATTR_DEFAULT (const xmlChar *) "default" 139*d2a70789SRichard Lowe #define DTD_ATTR_LOWER (const xmlChar *) "lower" 140*d2a70789SRichard Lowe #define DTD_ATTR_UPPER (const xmlChar *) "upper" 141*d2a70789SRichard Lowe 1427c478bd9Sstevel@tonic-gate 1437c478bd9Sstevel@tonic-gate #define DTD_ENTITY_BOOLEAN "boolean" 1447c478bd9Sstevel@tonic-gate #define DTD_ENTITY_DEVPATH "devpath" 1457c478bd9Sstevel@tonic-gate #define DTD_ENTITY_DRIVER "driver" 1467c478bd9Sstevel@tonic-gate #define DTD_ENTITY_DRVMIN "drv_min" 1477c478bd9Sstevel@tonic-gate #define DTD_ENTITY_FALSE "false" 1487c478bd9Sstevel@tonic-gate #define DTD_ENTITY_INT "int" 1497c478bd9Sstevel@tonic-gate #define DTD_ENTITY_STRING "string" 1507c478bd9Sstevel@tonic-gate #define DTD_ENTITY_TRUE "true" 1517c478bd9Sstevel@tonic-gate #define DTD_ENTITY_UINT "uint" 1527c478bd9Sstevel@tonic-gate 153a1be23daSdp #define DTD_ENTITY_BOOL_LEN 6 /* "false" */ 154a1be23daSdp 155ee519a1fSgjelinek #define ATTACH_FORCED "SUNWattached.xml" 156ee519a1fSgjelinek 1570209230bSgjelinek #define TMP_POOL_NAME "SUNWtmp_%s" 1580209230bSgjelinek #define MAX_TMP_POOL_NAME (ZONENAME_MAX + 9) 1590209230bSgjelinek #define RCAP_SERVICE "system/rcap:default" 1600209230bSgjelinek #define POOLD_SERVICE "system/pools/dynamic:default" 1610209230bSgjelinek 1620209230bSgjelinek /* 1630209230bSgjelinek * rctl alias definitions 1640209230bSgjelinek * 1650209230bSgjelinek * This holds the alias, the full rctl name, the default priv value, action 1660209230bSgjelinek * and lower limit. The functions that handle rctl aliases step through 1670209230bSgjelinek * this table, matching on the alias, and using the full values for setting 1680209230bSgjelinek * the rctl entry as well the limit for validation. 1690209230bSgjelinek */ 1700209230bSgjelinek static struct alias { 1710209230bSgjelinek char *shortname; 1720209230bSgjelinek char *realname; 1730209230bSgjelinek char *priv; 1740209230bSgjelinek char *action; 1750209230bSgjelinek uint64_t low_limit; 1760209230bSgjelinek } aliases[] = { 1770209230bSgjelinek {ALIAS_MAXLWPS, "zone.max-lwps", "privileged", "deny", 100}, 1780209230bSgjelinek {ALIAS_MAXSHMMEM, "zone.max-shm-memory", "privileged", "deny", 0}, 1790209230bSgjelinek {ALIAS_MAXSHMIDS, "zone.max-shm-ids", "privileged", "deny", 0}, 1800209230bSgjelinek {ALIAS_MAXMSGIDS, "zone.max-msg-ids", "privileged", "deny", 0}, 1810209230bSgjelinek {ALIAS_MAXSEMIDS, "zone.max-sem-ids", "privileged", "deny", 0}, 1820209230bSgjelinek {ALIAS_MAXLOCKEDMEM, "zone.max-locked-memory", "privileged", "deny", 0}, 1830209230bSgjelinek {ALIAS_MAXSWAP, "zone.max-swap", "privileged", "deny", 0}, 1840209230bSgjelinek {ALIAS_SHARES, "zone.cpu-shares", "privileged", "none", 0}, 185c97ad5cdSakolb {ALIAS_CPUCAP, "zone.cpu-cap", "privileged", "deny", 0}, 186ff19e029SMenno Lageman {ALIAS_MAXPROCS, "zone.max-processes", "privileged", "deny", 100}, 1870209230bSgjelinek {NULL, NULL, NULL, NULL, 0} 1880209230bSgjelinek }; 1890209230bSgjelinek 1900209230bSgjelinek /* 1910209230bSgjelinek * Structure for applying rctls to a running zone. It allows important 1920209230bSgjelinek * process values to be passed together easily. 1930209230bSgjelinek */ 1940209230bSgjelinek typedef struct pr_info_handle { 1950209230bSgjelinek struct ps_prochandle *pr; 1960209230bSgjelinek pid_t pid; 1970209230bSgjelinek } pr_info_handle_t; 1980209230bSgjelinek 1997c478bd9Sstevel@tonic-gate struct zone_dochandle { 2007c478bd9Sstevel@tonic-gate char *zone_dh_rootdir; 2017c478bd9Sstevel@tonic-gate xmlDocPtr zone_dh_doc; 2027c478bd9Sstevel@tonic-gate xmlNodePtr zone_dh_cur; 2037c478bd9Sstevel@tonic-gate xmlNodePtr zone_dh_top; 204087719fdSdp boolean_t zone_dh_newzone; 205087719fdSdp boolean_t zone_dh_snapshot; 206ee519a1fSgjelinek boolean_t zone_dh_sw_inv; 207cb8a054bSGlenn Faden zone_userauths_t *zone_dh_userauths; 208087719fdSdp char zone_dh_delete_name[ZONENAME_MAX]; 2097c478bd9Sstevel@tonic-gate }; 2107c478bd9Sstevel@tonic-gate 211cf8f45c7Sdstaff struct znotify { 212cf8f45c7Sdstaff void * zn_private; 213cf8f45c7Sdstaff evchan_t *zn_eventchan; 214cf8f45c7Sdstaff int (*zn_callback)(const char *zonename, zoneid_t zid, 215cf8f45c7Sdstaff const char *newstate, const char *oldstate, hrtime_t when, void *p); 216cf8f45c7Sdstaff pthread_mutex_t zn_mutex; 217cf8f45c7Sdstaff pthread_cond_t zn_cond; 218cf8f45c7Sdstaff pthread_mutex_t zn_bigmutex; 219cf8f45c7Sdstaff volatile enum {ZN_UNLOCKED, ZN_LOCKED, ZN_PING_INFLIGHT, 220cf8f45c7Sdstaff ZN_PING_RECEIVED} zn_state; 221cf8f45c7Sdstaff char zn_subscriber_id[MAX_SUBID_LEN]; 222cf8f45c7Sdstaff volatile boolean_t zn_failed; 223cf8f45c7Sdstaff int zn_failure_count; 224cf8f45c7Sdstaff }; 225cf8f45c7Sdstaff 226ff17c8bfSgjelinek /* used to track nested zone-lock operations */ 227ff17c8bfSgjelinek static int zone_lock_cnt = 0; 2286cfd72c6Sgjelinek 229ff17c8bfSgjelinek /* used to communicate lock status to children */ 230ff17c8bfSgjelinek #define LOCK_ENV_VAR "_ZONEADM_LOCK_HELD" 231ff17c8bfSgjelinek static char zoneadm_lock_held[] = LOCK_ENV_VAR"=1"; 232ff17c8bfSgjelinek static char zoneadm_lock_not_held[] = LOCK_ENV_VAR"=0"; 23339935be5Sgjelinek 234108322fbScarlsonj char *zonecfg_root = ""; 235108322fbScarlsonj 2367c478bd9Sstevel@tonic-gate /* 2377c478bd9Sstevel@tonic-gate * For functions which return int, which is most of the functions herein, 2387c478bd9Sstevel@tonic-gate * the return values should be from the Z_foo set defined in <libzonecfg.h>. 2397c478bd9Sstevel@tonic-gate * In some instances, we take pains mapping some libc errno values to Z_foo 2407c478bd9Sstevel@tonic-gate * values from this set. 2417c478bd9Sstevel@tonic-gate */ 2427c478bd9Sstevel@tonic-gate 243108322fbScarlsonj /* 244108322fbScarlsonj * Set the root (/) path for all zonecfg configuration files. This is a 245108322fbScarlsonj * private interface used by Live Upgrade extensions to access zone 246108322fbScarlsonj * configuration inside mounted alternate boot environments. 2472a8b76b2SSusan Kamm-Worrell * This interface is also used by zoneadm mount and unmount subcommands. 248108322fbScarlsonj */ 249108322fbScarlsonj void 250108322fbScarlsonj zonecfg_set_root(const char *rootpath) 251108322fbScarlsonj { 252108322fbScarlsonj if (*zonecfg_root != '\0') 253108322fbScarlsonj free(zonecfg_root); 254108322fbScarlsonj if (rootpath == NULL || rootpath[0] == '\0' || rootpath[1] == '\0' || 255108322fbScarlsonj (zonecfg_root = strdup(rootpath)) == NULL) 256108322fbScarlsonj zonecfg_root = ""; 257108322fbScarlsonj } 258108322fbScarlsonj 259108322fbScarlsonj const char * 260108322fbScarlsonj zonecfg_get_root(void) 261108322fbScarlsonj { 262108322fbScarlsonj return (zonecfg_root); 263108322fbScarlsonj } 264108322fbScarlsonj 265108322fbScarlsonj boolean_t 266108322fbScarlsonj zonecfg_in_alt_root(void) 267108322fbScarlsonj { 268108322fbScarlsonj return (*zonecfg_root != '\0'); 269108322fbScarlsonj } 270108322fbScarlsonj 2717c478bd9Sstevel@tonic-gate /* 2727c478bd9Sstevel@tonic-gate * Callers of the _file_path() functions are expected to have the second 2737c478bd9Sstevel@tonic-gate * parameter be a (char foo[MAXPATHLEN]). 2747c478bd9Sstevel@tonic-gate */ 2757c478bd9Sstevel@tonic-gate 276108322fbScarlsonj static boolean_t 2777c478bd9Sstevel@tonic-gate config_file_path(const char *zonename, char *answer) 2787c478bd9Sstevel@tonic-gate { 279108322fbScarlsonj return (snprintf(answer, MAXPATHLEN, "%s%s/%s.xml", zonecfg_root, 280108322fbScarlsonj ZONE_CONFIG_ROOT, zonename) < MAXPATHLEN); 2817c478bd9Sstevel@tonic-gate } 2827c478bd9Sstevel@tonic-gate 283108322fbScarlsonj static boolean_t 284108322fbScarlsonj snap_file_path(const char *zonename, char *answer) 2857c478bd9Sstevel@tonic-gate { 286108322fbScarlsonj return (snprintf(answer, MAXPATHLEN, "%s%s/%s.snapshot.xml", 287108322fbScarlsonj zonecfg_root, ZONE_SNAPSHOT_ROOT, zonename) < MAXPATHLEN); 2887c478bd9Sstevel@tonic-gate } 2897c478bd9Sstevel@tonic-gate 2907c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 2917c478bd9Sstevel@tonic-gate static void 2927c478bd9Sstevel@tonic-gate zonecfg_error_func(void *ctx, const char *msg, ...) 2937c478bd9Sstevel@tonic-gate { 2947c478bd9Sstevel@tonic-gate /* 2957c478bd9Sstevel@tonic-gate * This function does nothing by design. Its purpose is to prevent 2967c478bd9Sstevel@tonic-gate * libxml from dumping unwanted messages to stdout/stderr. 2977c478bd9Sstevel@tonic-gate */ 2987c478bd9Sstevel@tonic-gate } 2997c478bd9Sstevel@tonic-gate 3007c478bd9Sstevel@tonic-gate zone_dochandle_t 3017c478bd9Sstevel@tonic-gate zonecfg_init_handle(void) 3027c478bd9Sstevel@tonic-gate { 303087719fdSdp zone_dochandle_t handle = calloc(1, sizeof (struct zone_dochandle)); 3047c478bd9Sstevel@tonic-gate if (handle == NULL) { 3057c478bd9Sstevel@tonic-gate errno = Z_NOMEM; 3067c478bd9Sstevel@tonic-gate return (NULL); 3077c478bd9Sstevel@tonic-gate } 3087c478bd9Sstevel@tonic-gate 3097c478bd9Sstevel@tonic-gate /* generic libxml initialization */ 310ced33dd6Sjv (void) xmlLineNumbersDefault(1); 3117c478bd9Sstevel@tonic-gate xmlLoadExtDtdDefaultValue |= XML_DETECT_IDS; 3127c478bd9Sstevel@tonic-gate xmlDoValidityCheckingDefaultValue = 1; 3137c478bd9Sstevel@tonic-gate (void) xmlKeepBlanksDefault(0); 3147c478bd9Sstevel@tonic-gate xmlGetWarningsDefaultValue = 0; 3157c478bd9Sstevel@tonic-gate xmlSetGenericErrorFunc(NULL, zonecfg_error_func); 3167c478bd9Sstevel@tonic-gate 3177c478bd9Sstevel@tonic-gate return (handle); 3187c478bd9Sstevel@tonic-gate } 3197c478bd9Sstevel@tonic-gate 3207c478bd9Sstevel@tonic-gate int 3217c478bd9Sstevel@tonic-gate zonecfg_check_handle(zone_dochandle_t handle) 3227c478bd9Sstevel@tonic-gate { 3237c478bd9Sstevel@tonic-gate if (handle == NULL || handle->zone_dh_doc == NULL) 3247c478bd9Sstevel@tonic-gate return (Z_BAD_HANDLE); 3257c478bd9Sstevel@tonic-gate return (Z_OK); 3267c478bd9Sstevel@tonic-gate } 3277c478bd9Sstevel@tonic-gate 3287c478bd9Sstevel@tonic-gate void 3297c478bd9Sstevel@tonic-gate zonecfg_fini_handle(zone_dochandle_t handle) 3307c478bd9Sstevel@tonic-gate { 3317c478bd9Sstevel@tonic-gate if (zonecfg_check_handle(handle) == Z_OK) 3327c478bd9Sstevel@tonic-gate xmlFreeDoc(handle->zone_dh_doc); 3337c478bd9Sstevel@tonic-gate if (handle != NULL) 3347c478bd9Sstevel@tonic-gate free(handle); 3357c478bd9Sstevel@tonic-gate } 3367c478bd9Sstevel@tonic-gate 3377c478bd9Sstevel@tonic-gate static int 3387c478bd9Sstevel@tonic-gate zonecfg_destroy_impl(char *filename) 3397c478bd9Sstevel@tonic-gate { 3407c478bd9Sstevel@tonic-gate if (unlink(filename) == -1) { 3417c478bd9Sstevel@tonic-gate if (errno == EACCES) 3427c478bd9Sstevel@tonic-gate return (Z_ACCES); 3437c478bd9Sstevel@tonic-gate if (errno == ENOENT) 3447c478bd9Sstevel@tonic-gate return (Z_NO_ZONE); 3457c478bd9Sstevel@tonic-gate return (Z_MISC_FS); 3467c478bd9Sstevel@tonic-gate } 3477c478bd9Sstevel@tonic-gate return (Z_OK); 3487c478bd9Sstevel@tonic-gate } 3497c478bd9Sstevel@tonic-gate 3507c478bd9Sstevel@tonic-gate int 351087719fdSdp zonecfg_destroy(const char *zonename, boolean_t force) 3527c478bd9Sstevel@tonic-gate { 3537c478bd9Sstevel@tonic-gate char path[MAXPATHLEN]; 354087719fdSdp struct zoneent ze; 355087719fdSdp int err, state_err; 356087719fdSdp zone_state_t state; 3577c478bd9Sstevel@tonic-gate 358108322fbScarlsonj if (!config_file_path(zonename, path)) 359108322fbScarlsonj return (Z_MISC_FS); 360087719fdSdp 361087719fdSdp state_err = zone_get_state((char *)zonename, &state); 362087719fdSdp err = access(path, W_OK); 363087719fdSdp 364087719fdSdp /* 365087719fdSdp * If there is no file, and no index entry, reliably indicate that no 366087719fdSdp * such zone exists. 367087719fdSdp */ 368087719fdSdp if ((state_err == Z_NO_ZONE) && (err == -1) && (errno == ENOENT)) 369087719fdSdp return (Z_NO_ZONE); 370087719fdSdp 371087719fdSdp /* 372087719fdSdp * Handle any other filesystem related errors (except if the XML 373087719fdSdp * file is missing, which we treat silently), unless we're forcing, 374087719fdSdp * in which case we plow on. 375087719fdSdp */ 376087719fdSdp if (err == -1 && errno != ENOENT) { 377087719fdSdp if (errno == EACCES) 378087719fdSdp return (Z_ACCES); 379087719fdSdp else if (!force) 380087719fdSdp return (Z_MISC_FS); 381087719fdSdp } 382087719fdSdp 383087719fdSdp if (state > ZONE_STATE_INSTALLED) 384087719fdSdp return (Z_BAD_ZONE_STATE); 385087719fdSdp 386087719fdSdp if (!force && state > ZONE_STATE_CONFIGURED) 387087719fdSdp return (Z_BAD_ZONE_STATE); 388087719fdSdp 389087719fdSdp /* 390087719fdSdp * Index deletion succeeds even if the entry doesn't exist. So this 391087719fdSdp * will fail only if we've had some more severe problem. 392087719fdSdp */ 393087719fdSdp bzero(&ze, sizeof (ze)); 394087719fdSdp (void) strlcpy(ze.zone_name, zonename, sizeof (ze.zone_name)); 395087719fdSdp if ((err = putzoneent(&ze, PZE_REMOVE)) != Z_OK) 396087719fdSdp if (!force) 397087719fdSdp return (err); 398087719fdSdp 399087719fdSdp err = zonecfg_destroy_impl(path); 400087719fdSdp 401087719fdSdp /* 402087719fdSdp * Treat failure to find the XML file silently, since, well, it's 403087719fdSdp * gone, and with the index file cleaned up, we're done. 404087719fdSdp */ 405087719fdSdp if (err == Z_OK || err == Z_NO_ZONE) 406087719fdSdp return (Z_OK); 407087719fdSdp return (err); 4087c478bd9Sstevel@tonic-gate } 4097c478bd9Sstevel@tonic-gate 4107c478bd9Sstevel@tonic-gate int 411108322fbScarlsonj zonecfg_destroy_snapshot(const char *zonename) 4127c478bd9Sstevel@tonic-gate { 4137c478bd9Sstevel@tonic-gate char path[MAXPATHLEN]; 4147c478bd9Sstevel@tonic-gate 415108322fbScarlsonj if (!snap_file_path(zonename, path)) 416108322fbScarlsonj return (Z_MISC_FS); 4177c478bd9Sstevel@tonic-gate return (zonecfg_destroy_impl(path)); 4187c478bd9Sstevel@tonic-gate } 4197c478bd9Sstevel@tonic-gate 4207c478bd9Sstevel@tonic-gate static int 421a1be23daSdp getroot(zone_dochandle_t handle, xmlNodePtr *root) 4227c478bd9Sstevel@tonic-gate { 4237c478bd9Sstevel@tonic-gate if (zonecfg_check_handle(handle) == Z_BAD_HANDLE) 4247c478bd9Sstevel@tonic-gate return (Z_BAD_HANDLE); 4257c478bd9Sstevel@tonic-gate 426a1be23daSdp *root = xmlDocGetRootElement(handle->zone_dh_doc); 427a1be23daSdp 428a1be23daSdp if (*root == NULL) 4297c478bd9Sstevel@tonic-gate return (Z_EMPTY_DOCUMENT); 4307c478bd9Sstevel@tonic-gate 431a1be23daSdp if (xmlStrcmp((*root)->name, DTD_ELEM_ZONE)) 4327c478bd9Sstevel@tonic-gate return (Z_WRONG_DOC_TYPE); 433a1be23daSdp 434a1be23daSdp return (Z_OK); 435a1be23daSdp } 436a1be23daSdp 437a1be23daSdp static int 438a1be23daSdp operation_prep(zone_dochandle_t handle) 439a1be23daSdp { 440a1be23daSdp xmlNodePtr root; 441a1be23daSdp int err; 442a1be23daSdp 443a1be23daSdp if ((err = getroot(handle, &root)) != 0) 444a1be23daSdp return (err); 445a1be23daSdp 446a1be23daSdp handle->zone_dh_cur = root; 447a1be23daSdp handle->zone_dh_top = root; 448a1be23daSdp return (Z_OK); 449a1be23daSdp } 450a1be23daSdp 451ffbafc53Scomay static int 452ffbafc53Scomay fetchprop(xmlNodePtr cur, const xmlChar *propname, char *dst, size_t dstsize) 453ffbafc53Scomay { 454ffbafc53Scomay xmlChar *property; 455ffbafc53Scomay size_t srcsize; 456ffbafc53Scomay 457ffbafc53Scomay if ((property = xmlGetProp(cur, propname)) == NULL) 458ffbafc53Scomay return (Z_BAD_PROPERTY); 459ffbafc53Scomay srcsize = strlcpy(dst, (char *)property, dstsize); 460ffbafc53Scomay xmlFree(property); 461ffbafc53Scomay if (srcsize >= dstsize) 462ffbafc53Scomay return (Z_TOO_BIG); 463ffbafc53Scomay return (Z_OK); 464ffbafc53Scomay } 465ffbafc53Scomay 466ffbafc53Scomay static int 467ffbafc53Scomay fetch_alloc_prop(xmlNodePtr cur, const xmlChar *propname, char **dst) 468ffbafc53Scomay { 469ffbafc53Scomay xmlChar *property; 470ffbafc53Scomay 471ffbafc53Scomay if ((property = xmlGetProp(cur, propname)) == NULL) 472ffbafc53Scomay return (Z_BAD_PROPERTY); 473ffbafc53Scomay if ((*dst = strdup((char *)property)) == NULL) { 474ffbafc53Scomay xmlFree(property); 475ffbafc53Scomay return (Z_NOMEM); 476ffbafc53Scomay } 477ffbafc53Scomay xmlFree(property); 478ffbafc53Scomay return (Z_OK); 479ffbafc53Scomay } 480ffbafc53Scomay 481a1be23daSdp static int 482a1be23daSdp getrootattr(zone_dochandle_t handle, const xmlChar *propname, 483a1be23daSdp char *propval, size_t propsize) 484a1be23daSdp { 485a1be23daSdp xmlNodePtr root; 486a1be23daSdp int err; 487a1be23daSdp 488a1be23daSdp if ((err = getroot(handle, &root)) != 0) 489a1be23daSdp return (err); 490a1be23daSdp 491ffbafc53Scomay return (fetchprop(root, propname, propval, propsize)); 492ffbafc53Scomay } 493ffbafc53Scomay 494ffbafc53Scomay static int 495ffbafc53Scomay get_alloc_rootattr(zone_dochandle_t handle, const xmlChar *propname, 496ffbafc53Scomay char **propval) 497ffbafc53Scomay { 498ffbafc53Scomay xmlNodePtr root; 499ffbafc53Scomay int err; 500ffbafc53Scomay 501ffbafc53Scomay if ((err = getroot(handle, &root)) != 0) 502ffbafc53Scomay return (err); 503ffbafc53Scomay 504ffbafc53Scomay return (fetch_alloc_prop(root, propname, propval)); 505a1be23daSdp } 506a1be23daSdp 507a1be23daSdp static int 508108322fbScarlsonj setrootattr(zone_dochandle_t handle, const xmlChar *propname, 509108322fbScarlsonj const char *propval) 510a1be23daSdp { 511a1be23daSdp int err; 512a1be23daSdp xmlNodePtr root; 513a1be23daSdp 514a1be23daSdp if ((err = getroot(handle, &root)) != Z_OK) 515a1be23daSdp return (err); 516a1be23daSdp 5170209230bSgjelinek /* 5180209230bSgjelinek * If we get a null propval remove the property (ignore return since it 5190209230bSgjelinek * may not be set to begin with). 5200209230bSgjelinek */ 5210209230bSgjelinek if (propval == NULL) { 5220209230bSgjelinek (void) xmlUnsetProp(root, propname); 5230209230bSgjelinek } else { 5240209230bSgjelinek if (xmlSetProp(root, propname, (const xmlChar *) propval) 5250209230bSgjelinek == NULL) 5260209230bSgjelinek return (Z_INVAL); 5270209230bSgjelinek } 5287c478bd9Sstevel@tonic-gate return (Z_OK); 5297c478bd9Sstevel@tonic-gate } 5307c478bd9Sstevel@tonic-gate 531087719fdSdp static void 532087719fdSdp addcomment(zone_dochandle_t handle, const char *comment) 533087719fdSdp { 534087719fdSdp xmlNodePtr node; 535087719fdSdp node = xmlNewComment((xmlChar *) comment); 536087719fdSdp 537087719fdSdp if (node != NULL) 538087719fdSdp (void) xmlAddPrevSibling(handle->zone_dh_top, node); 539087719fdSdp } 540087719fdSdp 541087719fdSdp static void 542087719fdSdp stripcomments(zone_dochandle_t handle) 543087719fdSdp { 544087719fdSdp xmlDocPtr top; 545087719fdSdp xmlNodePtr child, next; 546087719fdSdp 547087719fdSdp top = handle->zone_dh_doc; 548087719fdSdp for (child = top->xmlChildrenNode; child != NULL; child = next) { 549087719fdSdp next = child->next; 550087719fdSdp if (child->name == NULL) 551087719fdSdp continue; 552087719fdSdp if (xmlStrcmp(child->name, DTD_ELEM_COMMENT) == 0) { 553087719fdSdp next = child->next; 554087719fdSdp xmlUnlinkNode(child); 555087719fdSdp xmlFreeNode(child); 556087719fdSdp } 557087719fdSdp } 558087719fdSdp } 559087719fdSdp 560ee519a1fSgjelinek static void 561ee519a1fSgjelinek strip_sw_inv(zone_dochandle_t handle) 562ee519a1fSgjelinek { 563ee519a1fSgjelinek xmlNodePtr root, child, next; 564ee519a1fSgjelinek 565ee519a1fSgjelinek root = xmlDocGetRootElement(handle->zone_dh_doc); 566ee519a1fSgjelinek for (child = root->xmlChildrenNode; child != NULL; child = next) { 567ee519a1fSgjelinek next = child->next; 568ee519a1fSgjelinek if (child->name == NULL) 569ee519a1fSgjelinek continue; 5704656d474SGarrett D'Amore if (xmlStrcmp(child->name, DTD_ELEM_PACKAGE) == 0) { 571ee519a1fSgjelinek next = child->next; 572ee519a1fSgjelinek xmlUnlinkNode(child); 573ee519a1fSgjelinek xmlFreeNode(child); 574ee519a1fSgjelinek } 575ee519a1fSgjelinek } 576ee519a1fSgjelinek } 577ee519a1fSgjelinek 5787c478bd9Sstevel@tonic-gate static int 579108322fbScarlsonj zonecfg_get_handle_impl(const char *zonename, const char *filename, 580108322fbScarlsonj zone_dochandle_t handle) 5817c478bd9Sstevel@tonic-gate { 5827c478bd9Sstevel@tonic-gate xmlValidCtxtPtr cvp; 5837c478bd9Sstevel@tonic-gate struct stat statbuf; 5847c478bd9Sstevel@tonic-gate int valid; 5857c478bd9Sstevel@tonic-gate 5867c478bd9Sstevel@tonic-gate if (zonename == NULL) 5877c478bd9Sstevel@tonic-gate return (Z_NO_ZONE); 5889acbbeafSnn 5897c478bd9Sstevel@tonic-gate if ((handle->zone_dh_doc = xmlParseFile(filename)) == NULL) { 5907c478bd9Sstevel@tonic-gate /* distinguish file not found vs. found but not parsed */ 5917c478bd9Sstevel@tonic-gate if (stat(filename, &statbuf) == 0) 5927c478bd9Sstevel@tonic-gate return (Z_INVALID_DOCUMENT); 5937c478bd9Sstevel@tonic-gate return (Z_NO_ZONE); 5947c478bd9Sstevel@tonic-gate } 5957c478bd9Sstevel@tonic-gate if ((cvp = xmlNewValidCtxt()) == NULL) 5967c478bd9Sstevel@tonic-gate return (Z_NOMEM); 5977c478bd9Sstevel@tonic-gate cvp->error = zonecfg_error_func; 5987c478bd9Sstevel@tonic-gate cvp->warning = zonecfg_error_func; 5997c478bd9Sstevel@tonic-gate valid = xmlValidateDocument(cvp, handle->zone_dh_doc); 6007c478bd9Sstevel@tonic-gate xmlFreeValidCtxt(cvp); 6017c478bd9Sstevel@tonic-gate if (valid == 0) 6027c478bd9Sstevel@tonic-gate return (Z_INVALID_DOCUMENT); 603087719fdSdp 6047c478bd9Sstevel@tonic-gate /* delete any comments such as inherited Sun copyright / ident str */ 605087719fdSdp stripcomments(handle); 6067c478bd9Sstevel@tonic-gate return (Z_OK); 6077c478bd9Sstevel@tonic-gate } 6087c478bd9Sstevel@tonic-gate 6097c478bd9Sstevel@tonic-gate int 610108322fbScarlsonj zonecfg_get_handle(const char *zonename, zone_dochandle_t handle) 6117c478bd9Sstevel@tonic-gate { 6127c478bd9Sstevel@tonic-gate char path[MAXPATHLEN]; 6137c478bd9Sstevel@tonic-gate 614108322fbScarlsonj if (!config_file_path(zonename, path)) 615108322fbScarlsonj return (Z_MISC_FS); 616087719fdSdp handle->zone_dh_newzone = B_FALSE; 617087719fdSdp 6187c478bd9Sstevel@tonic-gate return (zonecfg_get_handle_impl(zonename, path, handle)); 6197c478bd9Sstevel@tonic-gate } 6207c478bd9Sstevel@tonic-gate 621ee519a1fSgjelinek int 62216ab8c7bSgjelinek zonecfg_get_attach_handle(const char *path, const char *fname, 62316ab8c7bSgjelinek const char *zonename, boolean_t preserve_sw, zone_dochandle_t handle) 624ee519a1fSgjelinek { 625ee519a1fSgjelinek char migpath[MAXPATHLEN]; 626ee519a1fSgjelinek int err; 627ee519a1fSgjelinek struct stat buf; 628ee519a1fSgjelinek 629ee519a1fSgjelinek if (snprintf(migpath, sizeof (migpath), "%s/root", path) >= 630ee519a1fSgjelinek sizeof (migpath)) 631ee519a1fSgjelinek return (Z_NOMEM); 632ee519a1fSgjelinek 633ee519a1fSgjelinek if (stat(migpath, &buf) == -1 || !S_ISDIR(buf.st_mode)) 634ee519a1fSgjelinek return (Z_NO_ZONE); 635ee519a1fSgjelinek 63616ab8c7bSgjelinek if (snprintf(migpath, sizeof (migpath), "%s/%s", path, fname) >= 637ee519a1fSgjelinek sizeof (migpath)) 638ee519a1fSgjelinek return (Z_NOMEM); 639ee519a1fSgjelinek 640ee519a1fSgjelinek if ((err = zonecfg_get_handle_impl(zonename, migpath, handle)) != Z_OK) 641ee519a1fSgjelinek return (err); 642ee519a1fSgjelinek 643ee519a1fSgjelinek if (!preserve_sw) 644ee519a1fSgjelinek strip_sw_inv(handle); 645ee519a1fSgjelinek 646ee519a1fSgjelinek handle->zone_dh_newzone = B_TRUE; 647ee519a1fSgjelinek if ((err = setrootattr(handle, DTD_ATTR_ZONEPATH, path)) != Z_OK) 648ee519a1fSgjelinek return (err); 649ee519a1fSgjelinek 650ee519a1fSgjelinek return (setrootattr(handle, DTD_ATTR_NAME, zonename)); 651ee519a1fSgjelinek } 652ee519a1fSgjelinek 6537c478bd9Sstevel@tonic-gate int 654108322fbScarlsonj zonecfg_get_snapshot_handle(const char *zonename, zone_dochandle_t handle) 6557c478bd9Sstevel@tonic-gate { 6567c478bd9Sstevel@tonic-gate char path[MAXPATHLEN]; 6577c478bd9Sstevel@tonic-gate 658108322fbScarlsonj if (!snap_file_path(zonename, path)) 659108322fbScarlsonj return (Z_MISC_FS); 660087719fdSdp handle->zone_dh_newzone = B_FALSE; 6617c478bd9Sstevel@tonic-gate return (zonecfg_get_handle_impl(zonename, path, handle)); 6627c478bd9Sstevel@tonic-gate } 6637c478bd9Sstevel@tonic-gate 664087719fdSdp int 665108322fbScarlsonj zonecfg_get_template_handle(const char *template, const char *zonename, 666087719fdSdp zone_dochandle_t handle) 667087719fdSdp { 668087719fdSdp char path[MAXPATHLEN]; 669087719fdSdp int err; 670087719fdSdp 671108322fbScarlsonj if (!config_file_path(template, path)) 672108322fbScarlsonj return (Z_MISC_FS); 673087719fdSdp 674087719fdSdp if ((err = zonecfg_get_handle_impl(template, path, handle)) != Z_OK) 675087719fdSdp return (err); 676087719fdSdp handle->zone_dh_newzone = B_TRUE; 677087719fdSdp return (setrootattr(handle, DTD_ATTR_NAME, zonename)); 678087719fdSdp } 679087719fdSdp 6809acbbeafSnn int 6819acbbeafSnn zonecfg_get_xml_handle(const char *path, zone_dochandle_t handle) 6829acbbeafSnn { 6839acbbeafSnn struct stat buf; 6849acbbeafSnn int err; 6859acbbeafSnn 6869acbbeafSnn if (stat(path, &buf) == -1) 6879acbbeafSnn return (Z_MISC_FS); 6889acbbeafSnn 6899acbbeafSnn if ((err = zonecfg_get_handle_impl("xml", path, handle)) != Z_OK) 6909acbbeafSnn return (err); 6919acbbeafSnn handle->zone_dh_newzone = B_TRUE; 6929acbbeafSnn return (Z_OK); 6939acbbeafSnn } 6949acbbeafSnn 6958cd327d5Sgjelinek /* 6968cd327d5Sgjelinek * Initialize two handles from the manifest read on fd. The rem_handle 6978cd327d5Sgjelinek * is initialized from the input file, including the sw inventory. The 6988cd327d5Sgjelinek * local_handle is initialized with the same zone configuration but with 6998cd327d5Sgjelinek * no sw inventory. 7008cd327d5Sgjelinek */ 7018cd327d5Sgjelinek int 7028cd327d5Sgjelinek zonecfg_attach_manifest(int fd, zone_dochandle_t local_handle, 7038cd327d5Sgjelinek zone_dochandle_t rem_handle) 7048cd327d5Sgjelinek { 7058cd327d5Sgjelinek xmlValidCtxtPtr cvp; 7068cd327d5Sgjelinek int valid; 7078cd327d5Sgjelinek 7088cd327d5Sgjelinek /* load the manifest into the handle for the remote system */ 7098cd327d5Sgjelinek if ((rem_handle->zone_dh_doc = xmlReadFd(fd, NULL, NULL, 0)) == NULL) { 7108cd327d5Sgjelinek return (Z_INVALID_DOCUMENT); 7118cd327d5Sgjelinek } 7128cd327d5Sgjelinek if ((cvp = xmlNewValidCtxt()) == NULL) 7138cd327d5Sgjelinek return (Z_NOMEM); 7148cd327d5Sgjelinek cvp->error = zonecfg_error_func; 7158cd327d5Sgjelinek cvp->warning = zonecfg_error_func; 7168cd327d5Sgjelinek valid = xmlValidateDocument(cvp, rem_handle->zone_dh_doc); 7178cd327d5Sgjelinek xmlFreeValidCtxt(cvp); 7188cd327d5Sgjelinek if (valid == 0) 7198cd327d5Sgjelinek return (Z_INVALID_DOCUMENT); 7208cd327d5Sgjelinek 7218cd327d5Sgjelinek /* delete any comments such as inherited Sun copyright / ident str */ 7228cd327d5Sgjelinek stripcomments(rem_handle); 7238cd327d5Sgjelinek 7248cd327d5Sgjelinek rem_handle->zone_dh_newzone = B_TRUE; 7258cd327d5Sgjelinek rem_handle->zone_dh_sw_inv = B_TRUE; 7268cd327d5Sgjelinek 7278cd327d5Sgjelinek /* 7288cd327d5Sgjelinek * Now use the remote system handle to generate a local system handle 7298cd327d5Sgjelinek * with an identical zones configuration but no sw inventory. 7308cd327d5Sgjelinek */ 7318cd327d5Sgjelinek if ((local_handle->zone_dh_doc = xmlCopyDoc(rem_handle->zone_dh_doc, 7328cd327d5Sgjelinek 1)) == NULL) { 7338cd327d5Sgjelinek return (Z_INVALID_DOCUMENT); 7348cd327d5Sgjelinek } 7358cd327d5Sgjelinek 7368cd327d5Sgjelinek /* 7378cd327d5Sgjelinek * We need to re-run xmlValidateDocument on local_handle to properly 7388cd327d5Sgjelinek * update the in-core representation of the configuration. 7398cd327d5Sgjelinek */ 7408cd327d5Sgjelinek if ((cvp = xmlNewValidCtxt()) == NULL) 7418cd327d5Sgjelinek return (Z_NOMEM); 7428cd327d5Sgjelinek cvp->error = zonecfg_error_func; 7438cd327d5Sgjelinek cvp->warning = zonecfg_error_func; 7448cd327d5Sgjelinek valid = xmlValidateDocument(cvp, local_handle->zone_dh_doc); 7458cd327d5Sgjelinek xmlFreeValidCtxt(cvp); 7468cd327d5Sgjelinek if (valid == 0) 7478cd327d5Sgjelinek return (Z_INVALID_DOCUMENT); 7488cd327d5Sgjelinek 7498cd327d5Sgjelinek strip_sw_inv(local_handle); 7508cd327d5Sgjelinek 7518cd327d5Sgjelinek local_handle->zone_dh_newzone = B_TRUE; 7528cd327d5Sgjelinek local_handle->zone_dh_sw_inv = B_FALSE; 7538cd327d5Sgjelinek 7548cd327d5Sgjelinek return (Z_OK); 7558cd327d5Sgjelinek } 7568cd327d5Sgjelinek 757087719fdSdp static boolean_t 758087719fdSdp is_renaming(zone_dochandle_t handle) 759087719fdSdp { 760087719fdSdp if (handle->zone_dh_newzone) 761087719fdSdp return (B_FALSE); 762087719fdSdp if (strlen(handle->zone_dh_delete_name) > 0) 763087719fdSdp return (B_TRUE); 764087719fdSdp return (B_FALSE); 765087719fdSdp } 766087719fdSdp 767087719fdSdp static boolean_t 768087719fdSdp is_new(zone_dochandle_t handle) 769087719fdSdp { 770087719fdSdp return (handle->zone_dh_newzone || handle->zone_dh_snapshot); 771087719fdSdp } 772087719fdSdp 773087719fdSdp static boolean_t 774087719fdSdp is_snapshot(zone_dochandle_t handle) 775087719fdSdp { 776087719fdSdp return (handle->zone_dh_snapshot); 777087719fdSdp } 778087719fdSdp 779087719fdSdp /* 780087719fdSdp * It would be great to be able to use libc's ctype(3c) macros, but we 781087719fdSdp * can't, as they are locale sensitive, and it would break our limited thread 782087719fdSdp * safety if this routine had to change the app locale on the fly. 783087719fdSdp */ 784087719fdSdp int 785108322fbScarlsonj zonecfg_validate_zonename(const char *zone) 786087719fdSdp { 787087719fdSdp int i; 788087719fdSdp 789087719fdSdp if (strcmp(zone, GLOBAL_ZONENAME) == 0) 790087719fdSdp return (Z_BOGUS_ZONE_NAME); 791087719fdSdp 792087719fdSdp if (strlen(zone) >= ZONENAME_MAX) 793087719fdSdp return (Z_BOGUS_ZONE_NAME); 794087719fdSdp 795087719fdSdp if (!((zone[0] >= 'a' && zone[0] <= 'z') || 796087719fdSdp (zone[0] >= 'A' && zone[0] <= 'Z') || 797087719fdSdp (zone[0] >= '0' && zone[0] <= '9'))) 798087719fdSdp return (Z_BOGUS_ZONE_NAME); 799087719fdSdp 800087719fdSdp for (i = 1; zone[i] != '\0'; i++) { 801087719fdSdp if (!((zone[i] >= 'a' && zone[i] <= 'z') || 802087719fdSdp (zone[i] >= 'A' && zone[i] <= 'Z') || 803087719fdSdp (zone[i] >= '0' && zone[i] <= '9') || 804087719fdSdp (zone[i] == '-') || (zone[i] == '_') || (zone[i] == '.'))) 805087719fdSdp return (Z_BOGUS_ZONE_NAME); 806087719fdSdp } 807087719fdSdp 808087719fdSdp return (Z_OK); 809087719fdSdp } 810087719fdSdp 811087719fdSdp /* 812087719fdSdp * Changing the zone name requires us to track both the old and new 813087719fdSdp * name of the zone until commit time. 814087719fdSdp */ 8157c478bd9Sstevel@tonic-gate int 8167c478bd9Sstevel@tonic-gate zonecfg_get_name(zone_dochandle_t handle, char *name, size_t namesize) 8177c478bd9Sstevel@tonic-gate { 818a1be23daSdp return (getrootattr(handle, DTD_ATTR_NAME, name, namesize)); 819a1be23daSdp } 8207c478bd9Sstevel@tonic-gate 821cb8a054bSGlenn Faden static int 822cb8a054bSGlenn Faden insert_admins(zone_dochandle_t handle, char *zonename) 823cb8a054bSGlenn Faden { 824cb8a054bSGlenn Faden int err; 825cb8a054bSGlenn Faden struct zone_admintab admintab; 826cb8a054bSGlenn Faden 827cb8a054bSGlenn Faden if ((err = zonecfg_setadminent(handle)) != Z_OK) { 828cb8a054bSGlenn Faden return (err); 829cb8a054bSGlenn Faden } 830cb8a054bSGlenn Faden while (zonecfg_getadminent(handle, &admintab) == Z_OK) { 831cb8a054bSGlenn Faden err = zonecfg_insert_userauths(handle, 832cb8a054bSGlenn Faden admintab.zone_admin_user, zonename); 833cb8a054bSGlenn Faden if (err != Z_OK) { 834cb8a054bSGlenn Faden (void) zonecfg_endadminent(handle); 835cb8a054bSGlenn Faden return (err); 836cb8a054bSGlenn Faden } 837cb8a054bSGlenn Faden } 838cb8a054bSGlenn Faden (void) zonecfg_endadminent(handle); 839cb8a054bSGlenn Faden return (Z_OK); 840cb8a054bSGlenn Faden } 841cb8a054bSGlenn Faden 842a1be23daSdp int 843a1be23daSdp zonecfg_set_name(zone_dochandle_t handle, char *name) 844a1be23daSdp { 845087719fdSdp zone_state_t state; 846087719fdSdp char curname[ZONENAME_MAX], old_delname[ZONENAME_MAX]; 847087719fdSdp int err; 848087719fdSdp 849087719fdSdp if ((err = getrootattr(handle, DTD_ATTR_NAME, curname, 850087719fdSdp sizeof (curname))) != Z_OK) 851087719fdSdp return (err); 852087719fdSdp 853087719fdSdp if (strcmp(name, curname) == 0) 854087719fdSdp return (Z_OK); 855087719fdSdp 856087719fdSdp /* 857087719fdSdp * Switching zone names to one beginning with SUNW is not permitted. 858087719fdSdp */ 859087719fdSdp if (strncmp(name, "SUNW", 4) == 0) 860087719fdSdp return (Z_BOGUS_ZONE_NAME); 861087719fdSdp 862087719fdSdp if ((err = zonecfg_validate_zonename(name)) != Z_OK) 863087719fdSdp return (err); 864087719fdSdp 865087719fdSdp /* 866087719fdSdp * Setting the name back to the original name (effectively a revert of 867087719fdSdp * the name) is fine. But if we carry on, we'll falsely identify the 868087719fdSdp * name as "in use," so special case here. 869087719fdSdp */ 870087719fdSdp if (strcmp(name, handle->zone_dh_delete_name) == 0) { 871087719fdSdp err = setrootattr(handle, DTD_ATTR_NAME, name); 872087719fdSdp handle->zone_dh_delete_name[0] = '\0'; 873087719fdSdp return (err); 874087719fdSdp } 875087719fdSdp 876087719fdSdp /* Check to see if new name chosen is already in use */ 877087719fdSdp if (zone_get_state(name, &state) != Z_NO_ZONE) 878087719fdSdp return (Z_NAME_IN_USE); 879087719fdSdp 880087719fdSdp /* 881087719fdSdp * If this isn't already "new" or in a renaming transition, then 882087719fdSdp * we're initiating a rename here; so stash the "delete name" 883087719fdSdp * (i.e. the name of the zone we'll be removing) for the rename. 884087719fdSdp */ 885087719fdSdp (void) strlcpy(old_delname, handle->zone_dh_delete_name, 886087719fdSdp sizeof (old_delname)); 887087719fdSdp if (!is_new(handle) && !is_renaming(handle)) { 888087719fdSdp /* 889087719fdSdp * Name change is allowed only when the zone we're altering 890087719fdSdp * is not ready or running. 891087719fdSdp */ 892087719fdSdp err = zone_get_state(curname, &state); 893087719fdSdp if (err == Z_OK) { 894087719fdSdp if (state > ZONE_STATE_INSTALLED) 895087719fdSdp return (Z_BAD_ZONE_STATE); 896087719fdSdp } else if (err != Z_NO_ZONE) { 897087719fdSdp return (err); 898087719fdSdp } 899087719fdSdp 900087719fdSdp (void) strlcpy(handle->zone_dh_delete_name, curname, 901087719fdSdp sizeof (handle->zone_dh_delete_name)); 902087719fdSdp assert(is_renaming(handle)); 903087719fdSdp } else if (is_renaming(handle)) { 904087719fdSdp err = zone_get_state(handle->zone_dh_delete_name, &state); 905087719fdSdp if (err == Z_OK) { 906087719fdSdp if (state > ZONE_STATE_INSTALLED) 907087719fdSdp return (Z_BAD_ZONE_STATE); 908087719fdSdp } else if (err != Z_NO_ZONE) { 909087719fdSdp return (err); 910087719fdSdp } 911087719fdSdp } 912087719fdSdp 913087719fdSdp if ((err = setrootattr(handle, DTD_ATTR_NAME, name)) != Z_OK) { 914087719fdSdp /* 915087719fdSdp * Restore the deletename to whatever it was at the 916087719fdSdp * top of the routine, since we've had a failure. 917087719fdSdp */ 918087719fdSdp (void) strlcpy(handle->zone_dh_delete_name, old_delname, 919087719fdSdp sizeof (handle->zone_dh_delete_name)); 920087719fdSdp return (err); 921087719fdSdp } 922087719fdSdp 923cb8a054bSGlenn Faden /* 924cb8a054bSGlenn Faden * Record the old admins from the old zonename 925cb8a054bSGlenn Faden * so that they can be deleted when the operation is committed. 926cb8a054bSGlenn Faden */ 927cb8a054bSGlenn Faden if ((err = insert_admins(handle, curname)) != Z_OK) 928cb8a054bSGlenn Faden return (err); 929cb8a054bSGlenn Faden else 930cb8a054bSGlenn Faden return (Z_OK); 931a1be23daSdp } 9327c478bd9Sstevel@tonic-gate 933a1be23daSdp int 934a1be23daSdp zonecfg_get_zonepath(zone_dochandle_t handle, char *path, size_t pathsize) 935a1be23daSdp { 936108322fbScarlsonj size_t len; 937108322fbScarlsonj 938108322fbScarlsonj if ((len = strlcpy(path, zonecfg_root, pathsize)) >= pathsize) 939108322fbScarlsonj return (Z_TOO_BIG); 940108322fbScarlsonj return (getrootattr(handle, DTD_ATTR_ZONEPATH, path + len, 941108322fbScarlsonj pathsize - len)); 942a1be23daSdp } 9437c478bd9Sstevel@tonic-gate 944a1be23daSdp int 945a1be23daSdp zonecfg_set_zonepath(zone_dochandle_t handle, char *zonepath) 946a1be23daSdp { 947555afedfScarlsonj size_t len; 9486fb06a2bSSusan Kamm-Worrell char *modpath, *copy_mp, *curr_mp; /* modified path ptrs */ 9496fb06a2bSSusan Kamm-Worrell char last_copied; 9506fb06a2bSSusan Kamm-Worrell int ret; 9516fb06a2bSSusan Kamm-Worrell 9526fb06a2bSSusan Kamm-Worrell /* 9536fb06a2bSSusan Kamm-Worrell * Collapse multiple contiguous slashes and remove trailing slash. 9546fb06a2bSSusan Kamm-Worrell */ 9556fb06a2bSSusan Kamm-Worrell modpath = strdup(zonepath); 9566fb06a2bSSusan Kamm-Worrell if (modpath == NULL) 9576fb06a2bSSusan Kamm-Worrell return (Z_NOMEM); 9586fb06a2bSSusan Kamm-Worrell last_copied = '\0'; 9596fb06a2bSSusan Kamm-Worrell for (copy_mp = curr_mp = modpath; *curr_mp != '\0'; curr_mp++) { 9606fb06a2bSSusan Kamm-Worrell if (*curr_mp != '/' || last_copied != '/') { 9616fb06a2bSSusan Kamm-Worrell last_copied = *copy_mp = *curr_mp; 9626fb06a2bSSusan Kamm-Worrell copy_mp++; 9636fb06a2bSSusan Kamm-Worrell } 9646fb06a2bSSusan Kamm-Worrell } 9656fb06a2bSSusan Kamm-Worrell if (last_copied == '/') 9666fb06a2bSSusan Kamm-Worrell copy_mp--; 9676fb06a2bSSusan Kamm-Worrell *copy_mp = '\0'; 968555afedfScarlsonj 969555afedfScarlsonj /* 970555afedfScarlsonj * The user deals in absolute paths in the running global zone, but the 971555afedfScarlsonj * internal configuration files deal with boot environment relative 972555afedfScarlsonj * paths. Strip out the alternate root when specified. 973555afedfScarlsonj */ 974555afedfScarlsonj len = strlen(zonecfg_root); 9756fb06a2bSSusan Kamm-Worrell if (strncmp(modpath, zonecfg_root, len) != 0 || modpath[len] != '/') { 9766fb06a2bSSusan Kamm-Worrell free(modpath); 977555afedfScarlsonj return (Z_BAD_PROPERTY); 9786fb06a2bSSusan Kamm-Worrell } 9796fb06a2bSSusan Kamm-Worrell curr_mp = modpath + len; 9806fb06a2bSSusan Kamm-Worrell ret = setrootattr(handle, DTD_ATTR_ZONEPATH, curr_mp); 9816fb06a2bSSusan Kamm-Worrell free(modpath); 9826fb06a2bSSusan Kamm-Worrell return (ret); 983a1be23daSdp } 984a1be23daSdp 985e5816e35SEdward Pilatowicz static int 986e5816e35SEdward Pilatowicz i_zonecfg_get_brand(zone_dochandle_t handle, char *brand, size_t brandsize, 987e5816e35SEdward Pilatowicz boolean_t default_query) 9889acbbeafSnn { 9899acbbeafSnn int ret, sz; 9909acbbeafSnn 9919acbbeafSnn ret = getrootattr(handle, DTD_ATTR_BRAND, brand, brandsize); 9929acbbeafSnn 993e5816e35SEdward Pilatowicz /* 994e5816e35SEdward Pilatowicz * If the lookup failed, or succeeded in finding a non-null brand 995e5816e35SEdward Pilatowicz * string then return. 996e5816e35SEdward Pilatowicz */ 997e5816e35SEdward Pilatowicz if (ret != Z_OK || brand[0] != '\0') 998e5816e35SEdward Pilatowicz return (ret); 999e5816e35SEdward Pilatowicz 1000e5816e35SEdward Pilatowicz if (!default_query) { 1001e5816e35SEdward Pilatowicz /* If the zone has no brand, it is the default brand. */ 1002b08d9f75SEdward Pilatowicz return (zonecfg_default_brand(brand, brandsize)); 10039acbbeafSnn } 10049acbbeafSnn 1005e5816e35SEdward Pilatowicz /* if SUNWdefault didn't specify a brand, fallback to "native" */ 1006e5816e35SEdward Pilatowicz sz = strlcpy(brand, NATIVE_BRAND_NAME, brandsize); 1007e5816e35SEdward Pilatowicz if (sz >= brandsize) 1008e5816e35SEdward Pilatowicz return (Z_TOO_BIG); 1009e5816e35SEdward Pilatowicz return (Z_OK); 1010e5816e35SEdward Pilatowicz } 1011e5816e35SEdward Pilatowicz 1012e5816e35SEdward Pilatowicz int 1013e5816e35SEdward Pilatowicz zonecfg_get_brand(zone_dochandle_t handle, char *brand, size_t brandsize) 1014e5816e35SEdward Pilatowicz { 1015e5816e35SEdward Pilatowicz return (i_zonecfg_get_brand(handle, brand, brandsize, B_FALSE)); 10169acbbeafSnn } 10179acbbeafSnn 10189acbbeafSnn int 10199acbbeafSnn zonecfg_set_brand(zone_dochandle_t handle, char *brand) 10209acbbeafSnn { 10219acbbeafSnn return (setrootattr(handle, DTD_ATTR_BRAND, brand)); 10229acbbeafSnn } 10239acbbeafSnn 1024a1be23daSdp int 1025a1be23daSdp zonecfg_get_autoboot(zone_dochandle_t handle, boolean_t *autoboot) 1026a1be23daSdp { 1027a1be23daSdp char autobootstr[DTD_ENTITY_BOOL_LEN]; 1028a1be23daSdp int ret; 1029a1be23daSdp 1030a1be23daSdp if ((ret = getrootattr(handle, DTD_ATTR_AUTOBOOT, autobootstr, 1031a1be23daSdp sizeof (autobootstr))) != Z_OK) 1032a1be23daSdp return (ret); 1033a1be23daSdp 1034a1be23daSdp if (strcmp(autobootstr, DTD_ENTITY_TRUE) == 0) 1035a1be23daSdp *autoboot = B_TRUE; 1036a1be23daSdp else if (strcmp(autobootstr, DTD_ENTITY_FALSE) == 0) 1037a1be23daSdp *autoboot = B_FALSE; 1038a1be23daSdp else 1039a1be23daSdp ret = Z_BAD_PROPERTY; 1040a1be23daSdp return (ret); 1041a1be23daSdp } 1042a1be23daSdp 1043a1be23daSdp int 1044a1be23daSdp zonecfg_set_autoboot(zone_dochandle_t handle, boolean_t autoboot) 1045a1be23daSdp { 1046a1be23daSdp return (setrootattr(handle, DTD_ATTR_AUTOBOOT, 1047a1be23daSdp autoboot ? DTD_ENTITY_TRUE : DTD_ENTITY_FALSE)); 1048a1be23daSdp } 1049a1be23daSdp 1050a1be23daSdp int 1051a1be23daSdp zonecfg_get_pool(zone_dochandle_t handle, char *pool, size_t poolsize) 1052a1be23daSdp { 1053a1be23daSdp return (getrootattr(handle, DTD_ATTR_POOL, pool, poolsize)); 1054a1be23daSdp } 1055a1be23daSdp 1056a1be23daSdp int 1057a1be23daSdp zonecfg_set_pool(zone_dochandle_t handle, char *pool) 1058a1be23daSdp { 1059a1be23daSdp return (setrootattr(handle, DTD_ATTR_POOL, pool)); 1060a1be23daSdp } 1061a1be23daSdp 1062ffbafc53Scomay int 1063ffbafc53Scomay zonecfg_get_limitpriv(zone_dochandle_t handle, char **limitpriv) 1064ffbafc53Scomay { 1065ffbafc53Scomay return (get_alloc_rootattr(handle, DTD_ATTR_LIMITPRIV, limitpriv)); 1066ffbafc53Scomay } 1067ffbafc53Scomay 1068ffbafc53Scomay int 10693f2f09c1Sdp zonecfg_set_limitpriv(zone_dochandle_t handle, char *limitpriv) 1070ffbafc53Scomay { 10713f2f09c1Sdp return (setrootattr(handle, DTD_ATTR_LIMITPRIV, limitpriv)); 10723f2f09c1Sdp } 10733f2f09c1Sdp 10743f2f09c1Sdp int 10753f2f09c1Sdp zonecfg_get_bootargs(zone_dochandle_t handle, char *bargs, size_t bargssize) 10763f2f09c1Sdp { 10773f2f09c1Sdp return (getrootattr(handle, DTD_ATTR_BOOTARGS, bargs, bargssize)); 10783f2f09c1Sdp } 10793f2f09c1Sdp 10803f2f09c1Sdp int 10813f2f09c1Sdp zonecfg_set_bootargs(zone_dochandle_t handle, char *bargs) 10823f2f09c1Sdp { 10833f2f09c1Sdp return (setrootattr(handle, DTD_ATTR_BOOTARGS, bargs)); 1084ffbafc53Scomay } 1085ffbafc53Scomay 10860209230bSgjelinek int 10870209230bSgjelinek zonecfg_get_sched_class(zone_dochandle_t handle, char *sched, size_t schedsize) 10880209230bSgjelinek { 10890209230bSgjelinek return (getrootattr(handle, DTD_ATTR_SCHED, sched, schedsize)); 10900209230bSgjelinek } 10910209230bSgjelinek 10920209230bSgjelinek int 10930209230bSgjelinek zonecfg_set_sched(zone_dochandle_t handle, char *sched) 10940209230bSgjelinek { 10950209230bSgjelinek return (setrootattr(handle, DTD_ATTR_SCHED, sched)); 10960209230bSgjelinek } 10970209230bSgjelinek 1098a1be23daSdp /* 1099a1be23daSdp * /etc/zones/index caches a vital piece of information which is also 1100a1be23daSdp * in the <zonename>.xml file: the path to the zone. This is for performance, 1101a1be23daSdp * since we need to walk all zonepath's in order to be able to detect conflicts 1102a1be23daSdp * (see crosscheck_zonepaths() in the zoneadm command). 1103087719fdSdp * 1104087719fdSdp * An additional complexity is that when doing a rename, we'd like the entire 1105087719fdSdp * index update operation (rename, and potential state changes) to be atomic. 1106087719fdSdp * In general, the operation of this function should succeed or fail as 1107087719fdSdp * a unit. 1108a1be23daSdp */ 1109a1be23daSdp int 1110a1be23daSdp zonecfg_refresh_index_file(zone_dochandle_t handle) 1111a1be23daSdp { 1112a1be23daSdp char name[ZONENAME_MAX], zonepath[MAXPATHLEN]; 1113a1be23daSdp struct zoneent ze; 1114a1be23daSdp int err; 1115087719fdSdp int opcode; 1116087719fdSdp char *zn; 1117087719fdSdp 1118087719fdSdp bzero(&ze, sizeof (ze)); 1119087719fdSdp ze.zone_state = -1; /* Preserve existing state in index */ 1120a1be23daSdp 1121a1be23daSdp if ((err = zonecfg_get_name(handle, name, sizeof (name))) != Z_OK) 1122a1be23daSdp return (err); 1123087719fdSdp (void) strlcpy(ze.zone_name, name, sizeof (ze.zone_name)); 1124087719fdSdp 1125a1be23daSdp if ((err = zonecfg_get_zonepath(handle, zonepath, 1126a1be23daSdp sizeof (zonepath))) != Z_OK) 1127a1be23daSdp return (err); 1128555afedfScarlsonj (void) strlcpy(ze.zone_path, zonepath + strlen(zonecfg_root), 1129555afedfScarlsonj sizeof (ze.zone_path)); 1130087719fdSdp 1131087719fdSdp if (is_renaming(handle)) { 1132087719fdSdp opcode = PZE_MODIFY; 1133087719fdSdp (void) strlcpy(ze.zone_name, handle->zone_dh_delete_name, 1134087719fdSdp sizeof (ze.zone_name)); 1135087719fdSdp (void) strlcpy(ze.zone_newname, name, sizeof (ze.zone_newname)); 1136087719fdSdp } else if (is_new(handle)) { 1137087719fdSdp FILE *cookie; 1138087719fdSdp /* 1139087719fdSdp * Be tolerant of the zone already existing in the index file, 1140087719fdSdp * since we might be forcibly overwriting an existing 1141087719fdSdp * configuration with a new one (for example 'create -F' 1142087719fdSdp * in zonecfg). 1143087719fdSdp */ 1144087719fdSdp opcode = PZE_ADD; 1145087719fdSdp cookie = setzoneent(); 1146087719fdSdp while ((zn = getzoneent(cookie)) != NULL) { 1147087719fdSdp if (strcmp(zn, name) == 0) { 1148087719fdSdp opcode = PZE_MODIFY; 1149087719fdSdp free(zn); 1150087719fdSdp break; 1151087719fdSdp } 1152087719fdSdp free(zn); 1153087719fdSdp } 1154087719fdSdp endzoneent(cookie); 1155087719fdSdp ze.zone_state = ZONE_STATE_CONFIGURED; 1156087719fdSdp } else { 1157087719fdSdp opcode = PZE_MODIFY; 1158087719fdSdp } 1159087719fdSdp 1160087719fdSdp if ((err = putzoneent(&ze, opcode)) != Z_OK) 1161087719fdSdp return (err); 1162087719fdSdp 1163087719fdSdp return (Z_OK); 11647c478bd9Sstevel@tonic-gate } 11657c478bd9Sstevel@tonic-gate 1166087719fdSdp /* 1167087719fdSdp * The goal of this routine is to cause the index file update and the 1168087719fdSdp * document save to happen as an atomic operation. We do the document 1169087719fdSdp * first, saving a backup copy using a hard link; if that succeeds, we go 1170087719fdSdp * on to the index. If that fails, we roll the document back into place. 1171087719fdSdp * 1172087719fdSdp * Strategy: 1173087719fdSdp * 1174087719fdSdp * New zone 'foo' configuration: 1175087719fdSdp * Create tmpfile (zonecfg.xxxxxx) 1176087719fdSdp * Write XML to tmpfile 1177087719fdSdp * Rename tmpfile to xmlfile (zonecfg.xxxxxx -> foo.xml) 1178087719fdSdp * Add entry to index file 1179087719fdSdp * If it fails, delete foo.xml, leaving nothing behind. 1180087719fdSdp * 1181087719fdSdp * Save existing zone 'foo': 1182087719fdSdp * Make backup of foo.xml -> .backup 1183087719fdSdp * Create tmpfile (zonecfg.xxxxxx) 1184087719fdSdp * Write XML to tmpfile 1185087719fdSdp * Rename tmpfile to xmlfile (zonecfg.xxxxxx -> foo.xml) 1186087719fdSdp * Modify index file as needed 1187087719fdSdp * If it fails, recover from .backup -> foo.xml 1188087719fdSdp * 1189087719fdSdp * Rename 'foo' to 'bar': 1190087719fdSdp * Create tmpfile (zonecfg.xxxxxx) 1191087719fdSdp * Write XML to tmpfile 1192087719fdSdp * Rename tmpfile to xmlfile (zonecfg.xxxxxx -> bar.xml) 1193087719fdSdp * Add entry for 'bar' to index file, Remove entry for 'foo' (refresh) 1194087719fdSdp * If it fails, delete bar.xml; foo.xml is left behind. 1195087719fdSdp */ 11967c478bd9Sstevel@tonic-gate static int 11977c478bd9Sstevel@tonic-gate zonecfg_save_impl(zone_dochandle_t handle, char *filename) 11987c478bd9Sstevel@tonic-gate { 11997c478bd9Sstevel@tonic-gate char tmpfile[MAXPATHLEN]; 1200087719fdSdp char bakdir[MAXPATHLEN], bakbase[MAXPATHLEN], bakfile[MAXPATHLEN]; 12019acbbeafSnn int tmpfd, err, valid; 12027c478bd9Sstevel@tonic-gate xmlValidCtxt cvp = { NULL }; 1203087719fdSdp boolean_t backup; 12047c478bd9Sstevel@tonic-gate 12057c478bd9Sstevel@tonic-gate (void) strlcpy(tmpfile, filename, sizeof (tmpfile)); 12067c478bd9Sstevel@tonic-gate (void) dirname(tmpfile); 12077c478bd9Sstevel@tonic-gate (void) strlcat(tmpfile, _PATH_TMPFILE, sizeof (tmpfile)); 12087c478bd9Sstevel@tonic-gate 12097c478bd9Sstevel@tonic-gate tmpfd = mkstemp(tmpfile); 12107c478bd9Sstevel@tonic-gate if (tmpfd == -1) { 12117c478bd9Sstevel@tonic-gate (void) unlink(tmpfile); 12127c478bd9Sstevel@tonic-gate return (Z_TEMP_FILE); 12137c478bd9Sstevel@tonic-gate } 12147c478bd9Sstevel@tonic-gate (void) close(tmpfd); 12157c478bd9Sstevel@tonic-gate 12167c478bd9Sstevel@tonic-gate cvp.error = zonecfg_error_func; 12177c478bd9Sstevel@tonic-gate cvp.warning = zonecfg_error_func; 12187c478bd9Sstevel@tonic-gate 1219087719fdSdp /* 12209acbbeafSnn * We do a final validation of the document. Since the library has 12219acbbeafSnn * malfunctioned if it fails to validate, we follow-up with an 12229acbbeafSnn * assert() that the doc is valid. 1223087719fdSdp */ 12249acbbeafSnn valid = xmlValidateDocument(&cvp, handle->zone_dh_doc); 12259acbbeafSnn assert(valid != 0); 12267c478bd9Sstevel@tonic-gate 12277c478bd9Sstevel@tonic-gate if (xmlSaveFormatFile(tmpfile, handle->zone_dh_doc, 1) <= 0) 12287c478bd9Sstevel@tonic-gate goto err; 1229087719fdSdp 12307c478bd9Sstevel@tonic-gate (void) chmod(tmpfile, 0644); 12317c478bd9Sstevel@tonic-gate 1232087719fdSdp /* 1233087719fdSdp * In the event we are doing a standard save, hard link a copy of the 1234087719fdSdp * original file in .backup.<pid>.filename so we can restore it if 1235087719fdSdp * something goes wrong. 1236087719fdSdp */ 1237087719fdSdp if (!is_new(handle) && !is_renaming(handle)) { 1238087719fdSdp backup = B_TRUE; 1239087719fdSdp 1240087719fdSdp (void) strlcpy(bakdir, filename, sizeof (bakdir)); 1241087719fdSdp (void) strlcpy(bakbase, filename, sizeof (bakbase)); 1242087719fdSdp (void) snprintf(bakfile, sizeof (bakfile), "%s/.backup.%d.%s", 1243087719fdSdp dirname(bakdir), getpid(), basename(bakbase)); 1244087719fdSdp 1245087719fdSdp if (link(filename, bakfile) == -1) { 1246087719fdSdp err = errno; 1247087719fdSdp (void) unlink(tmpfile); 1248087719fdSdp if (errno == EACCES) 1249087719fdSdp return (Z_ACCES); 1250087719fdSdp return (Z_MISC_FS); 1251087719fdSdp } 1252087719fdSdp } 1253087719fdSdp 1254087719fdSdp /* 1255087719fdSdp * Move the new document over top of the old. 1256087719fdSdp * i.e.: zonecfg.XXXXXX -> myzone.xml 1257087719fdSdp */ 12587c478bd9Sstevel@tonic-gate if (rename(tmpfile, filename) == -1) { 1259087719fdSdp err = errno; 12607c478bd9Sstevel@tonic-gate (void) unlink(tmpfile); 1261087719fdSdp if (backup) 1262087719fdSdp (void) unlink(bakfile); 1263087719fdSdp if (err == EACCES) 12647c478bd9Sstevel@tonic-gate return (Z_ACCES); 12657c478bd9Sstevel@tonic-gate return (Z_MISC_FS); 12667c478bd9Sstevel@tonic-gate } 1267a1be23daSdp 1268087719fdSdp /* 1269087719fdSdp * If this is a snapshot, we're done-- don't add an index entry. 1270087719fdSdp */ 1271087719fdSdp if (is_snapshot(handle)) 1272087719fdSdp return (Z_OK); 1273087719fdSdp 1274087719fdSdp /* now update the index file to reflect whatever we just did */ 1275087719fdSdp if ((err = zonecfg_refresh_index_file(handle)) != Z_OK) { 1276087719fdSdp if (backup) { 1277087719fdSdp /* 1278087719fdSdp * Try to restore from our backup. 1279087719fdSdp */ 1280087719fdSdp (void) unlink(filename); 1281087719fdSdp (void) rename(bakfile, filename); 1282087719fdSdp } else { 1283087719fdSdp /* 1284087719fdSdp * Either the zone is new, in which case we can delete 1285087719fdSdp * new.xml, or we're doing a rename, so ditto. 1286087719fdSdp */ 1287087719fdSdp assert(is_new(handle) || is_renaming(handle)); 1288087719fdSdp (void) unlink(filename); 1289087719fdSdp } 1290087719fdSdp return (Z_UPDATING_INDEX); 1291087719fdSdp } 1292087719fdSdp 1293087719fdSdp if (backup) 1294087719fdSdp (void) unlink(bakfile); 1295087719fdSdp 1296087719fdSdp return (Z_OK); 12977c478bd9Sstevel@tonic-gate 12987c478bd9Sstevel@tonic-gate err: 12997c478bd9Sstevel@tonic-gate (void) unlink(tmpfile); 13007c478bd9Sstevel@tonic-gate return (Z_SAVING_FILE); 13017c478bd9Sstevel@tonic-gate } 13027c478bd9Sstevel@tonic-gate 13037c478bd9Sstevel@tonic-gate int 13047c478bd9Sstevel@tonic-gate zonecfg_save(zone_dochandle_t handle) 13057c478bd9Sstevel@tonic-gate { 1306087719fdSdp char zname[ZONENAME_MAX], path[MAXPATHLEN]; 1307087719fdSdp char delpath[MAXPATHLEN]; 1308087719fdSdp int err = Z_SAVING_FILE; 1309087719fdSdp 1310087719fdSdp if (zonecfg_check_handle(handle) != Z_OK) 1311087719fdSdp return (Z_BAD_HANDLE); 13127c478bd9Sstevel@tonic-gate 1313087719fdSdp /* 1314ee519a1fSgjelinek * We don't support saving snapshots or a tree containing a sw 1315ee519a1fSgjelinek * inventory at this time. 1316087719fdSdp */ 1317ee519a1fSgjelinek if (handle->zone_dh_snapshot || handle->zone_dh_sw_inv) 1318087719fdSdp return (Z_INVAL); 1319087719fdSdp 1320087719fdSdp if ((err = zonecfg_get_name(handle, zname, sizeof (zname))) != Z_OK) 13217c478bd9Sstevel@tonic-gate return (err); 1322087719fdSdp 1323108322fbScarlsonj if (!config_file_path(zname, path)) 1324108322fbScarlsonj return (Z_MISC_FS); 1325087719fdSdp 1326087719fdSdp addcomment(handle, "\n DO NOT EDIT THIS " 1327087719fdSdp "FILE. Use zonecfg(1M) instead.\n"); 1328087719fdSdp 1329cb8a054bSGlenn Faden /* 1330cb8a054bSGlenn Faden * Update user_attr first so that it will be older 1331cb8a054bSGlenn Faden * than the config file. 1332cb8a054bSGlenn Faden */ 1333cb8a054bSGlenn Faden (void) zonecfg_authorize_users(handle, zname); 1334087719fdSdp err = zonecfg_save_impl(handle, path); 1335087719fdSdp 1336087719fdSdp stripcomments(handle); 1337087719fdSdp 1338087719fdSdp if (err != Z_OK) 1339087719fdSdp return (err); 1340087719fdSdp 1341087719fdSdp handle->zone_dh_newzone = B_FALSE; 1342087719fdSdp 1343087719fdSdp if (is_renaming(handle)) { 1344108322fbScarlsonj if (config_file_path(handle->zone_dh_delete_name, delpath)) 1345108322fbScarlsonj (void) unlink(delpath); 1346087719fdSdp handle->zone_dh_delete_name[0] = '\0'; 1347087719fdSdp } 1348087719fdSdp 1349087719fdSdp return (Z_OK); 13507c478bd9Sstevel@tonic-gate } 13517c478bd9Sstevel@tonic-gate 13529acbbeafSnn int 13539acbbeafSnn zonecfg_verify_save(zone_dochandle_t handle, char *filename) 13549acbbeafSnn { 13559acbbeafSnn int valid; 13569acbbeafSnn 13579acbbeafSnn xmlValidCtxt cvp = { NULL }; 13589acbbeafSnn 13599acbbeafSnn if (zonecfg_check_handle(handle) != Z_OK) 13609acbbeafSnn return (Z_BAD_HANDLE); 13619acbbeafSnn 13629acbbeafSnn cvp.error = zonecfg_error_func; 13639acbbeafSnn cvp.warning = zonecfg_error_func; 13649acbbeafSnn 13659acbbeafSnn /* 13669acbbeafSnn * We do a final validation of the document. Since the library has 13679acbbeafSnn * malfunctioned if it fails to validate, we follow-up with an 13689acbbeafSnn * assert() that the doc is valid. 13699acbbeafSnn */ 13709acbbeafSnn valid = xmlValidateDocument(&cvp, handle->zone_dh_doc); 13719acbbeafSnn assert(valid != 0); 13729acbbeafSnn 13739acbbeafSnn if (xmlSaveFormatFile(filename, handle->zone_dh_doc, 1) <= 0) 13749acbbeafSnn return (Z_SAVING_FILE); 13759acbbeafSnn 13769acbbeafSnn return (Z_OK); 13779acbbeafSnn } 13789acbbeafSnn 1379ee519a1fSgjelinek int 13808cd327d5Sgjelinek zonecfg_detach_save(zone_dochandle_t handle, uint_t flags) 1381ee519a1fSgjelinek { 1382ee519a1fSgjelinek char zname[ZONENAME_MAX]; 1383ee519a1fSgjelinek char path[MAXPATHLEN]; 1384ee519a1fSgjelinek char migpath[MAXPATHLEN]; 1385ee519a1fSgjelinek xmlValidCtxt cvp = { NULL }; 1386ee519a1fSgjelinek int err = Z_SAVING_FILE; 13879acbbeafSnn int valid; 1388ee519a1fSgjelinek 1389ee519a1fSgjelinek if (zonecfg_check_handle(handle) != Z_OK) 1390ee519a1fSgjelinek return (Z_BAD_HANDLE); 1391ee519a1fSgjelinek 13928cd327d5Sgjelinek if (flags & ZONE_DRY_RUN) { 13938cd327d5Sgjelinek (void) strlcpy(migpath, "-", sizeof (migpath)); 13948cd327d5Sgjelinek } else { 13958cd327d5Sgjelinek if ((err = zonecfg_get_name(handle, zname, sizeof (zname))) 13968cd327d5Sgjelinek != Z_OK) 13978cd327d5Sgjelinek return (err); 1398ee519a1fSgjelinek 13998cd327d5Sgjelinek if ((err = zone_get_zonepath(zname, path, sizeof (path))) 14008cd327d5Sgjelinek != Z_OK) 14018cd327d5Sgjelinek return (err); 1402ee519a1fSgjelinek 140316ab8c7bSgjelinek if (snprintf(migpath, sizeof (migpath), "%s/%s", path, 140416ab8c7bSgjelinek ZONE_DETACHED) >= sizeof (migpath)) 14058cd327d5Sgjelinek return (Z_NOMEM); 14068cd327d5Sgjelinek } 1407ee519a1fSgjelinek 1408ee519a1fSgjelinek if ((err = operation_prep(handle)) != Z_OK) 1409ee519a1fSgjelinek return (err); 1410ee519a1fSgjelinek 1411ee519a1fSgjelinek addcomment(handle, "\n DO NOT EDIT THIS FILE. " 1412ee519a1fSgjelinek "Use zonecfg(1M) and zoneadm(1M) attach.\n"); 1413ee519a1fSgjelinek 1414ee519a1fSgjelinek cvp.error = zonecfg_error_func; 1415ee519a1fSgjelinek cvp.warning = zonecfg_error_func; 1416ee519a1fSgjelinek 1417ee519a1fSgjelinek /* 14189acbbeafSnn * We do a final validation of the document. Since the library has 14199acbbeafSnn * malfunctioned if it fails to validate, we follow-up with an 14209acbbeafSnn * assert() that the doc is valid. 1421ee519a1fSgjelinek */ 14229acbbeafSnn valid = xmlValidateDocument(&cvp, handle->zone_dh_doc); 14239acbbeafSnn assert(valid != 0); 1424ee519a1fSgjelinek 1425ee519a1fSgjelinek if (xmlSaveFormatFile(migpath, handle->zone_dh_doc, 1) <= 0) 1426ee519a1fSgjelinek return (Z_SAVING_FILE); 1427ee519a1fSgjelinek 14288cd327d5Sgjelinek if (!(flags & ZONE_DRY_RUN)) 14298cd327d5Sgjelinek (void) chmod(migpath, 0644); 1430ee519a1fSgjelinek 1431ee519a1fSgjelinek stripcomments(handle); 1432ee519a1fSgjelinek 1433ee519a1fSgjelinek handle->zone_dh_newzone = B_FALSE; 1434ee519a1fSgjelinek 1435ee519a1fSgjelinek return (Z_OK); 1436ee519a1fSgjelinek } 1437ee519a1fSgjelinek 1438ee519a1fSgjelinek boolean_t 1439ee519a1fSgjelinek zonecfg_detached(const char *path) 1440ee519a1fSgjelinek { 1441ee519a1fSgjelinek char migpath[MAXPATHLEN]; 1442ee519a1fSgjelinek struct stat buf; 1443ee519a1fSgjelinek 144416ab8c7bSgjelinek if (snprintf(migpath, sizeof (migpath), "%s/%s", path, ZONE_DETACHED) >= 1445ee519a1fSgjelinek sizeof (migpath)) 1446ee519a1fSgjelinek return (B_FALSE); 1447ee519a1fSgjelinek 1448ee519a1fSgjelinek if (stat(migpath, &buf) != -1) 1449ee519a1fSgjelinek return (B_TRUE); 1450ee519a1fSgjelinek 1451ee519a1fSgjelinek return (B_FALSE); 1452ee519a1fSgjelinek } 1453ee519a1fSgjelinek 1454ee519a1fSgjelinek void 1455ee519a1fSgjelinek zonecfg_rm_detached(zone_dochandle_t handle, boolean_t forced) 1456ee519a1fSgjelinek { 1457ee519a1fSgjelinek char zname[ZONENAME_MAX]; 1458ee519a1fSgjelinek char path[MAXPATHLEN]; 1459ee519a1fSgjelinek char detached[MAXPATHLEN]; 1460ee519a1fSgjelinek char attached[MAXPATHLEN]; 1461ee519a1fSgjelinek 1462ee519a1fSgjelinek if (zonecfg_check_handle(handle) != Z_OK) 1463ee519a1fSgjelinek return; 1464ee519a1fSgjelinek 1465ee519a1fSgjelinek if (zonecfg_get_name(handle, zname, sizeof (zname)) != Z_OK) 1466ee519a1fSgjelinek return; 1467ee519a1fSgjelinek 1468ee519a1fSgjelinek if (zone_get_zonepath(zname, path, sizeof (path)) != Z_OK) 1469ee519a1fSgjelinek return; 1470ee519a1fSgjelinek 147116ab8c7bSgjelinek (void) snprintf(detached, sizeof (detached), "%s/%s", path, 147216ab8c7bSgjelinek ZONE_DETACHED); 1473ee519a1fSgjelinek (void) snprintf(attached, sizeof (attached), "%s/%s", path, 1474ee519a1fSgjelinek ATTACH_FORCED); 1475ee519a1fSgjelinek 1476ee519a1fSgjelinek if (forced) { 1477ee519a1fSgjelinek (void) rename(detached, attached); 1478ee519a1fSgjelinek } else { 1479ee519a1fSgjelinek (void) unlink(attached); 1480ee519a1fSgjelinek (void) unlink(detached); 1481ee519a1fSgjelinek } 1482ee519a1fSgjelinek } 1483ee519a1fSgjelinek 14847c478bd9Sstevel@tonic-gate /* 14857c478bd9Sstevel@tonic-gate * Special case: if access(2) fails with ENOENT, then try again using 14867c478bd9Sstevel@tonic-gate * ZONE_CONFIG_ROOT instead of config_file_path(zonename). This is how we 14877c478bd9Sstevel@tonic-gate * work around the case of a config file which has not been created yet: 14887c478bd9Sstevel@tonic-gate * the user will need access to the directory so use that as a heuristic. 14897c478bd9Sstevel@tonic-gate */ 14907c478bd9Sstevel@tonic-gate 14917c478bd9Sstevel@tonic-gate int 14927c478bd9Sstevel@tonic-gate zonecfg_access(const char *zonename, int amode) 14937c478bd9Sstevel@tonic-gate { 14947c478bd9Sstevel@tonic-gate char path[MAXPATHLEN]; 14957c478bd9Sstevel@tonic-gate 1496108322fbScarlsonj if (!config_file_path(zonename, path)) 1497108322fbScarlsonj return (Z_INVAL); 14987c478bd9Sstevel@tonic-gate if (access(path, amode) == 0) 14997c478bd9Sstevel@tonic-gate return (Z_OK); 1500108322fbScarlsonj if (errno == ENOENT) { 1501108322fbScarlsonj if (snprintf(path, sizeof (path), "%s%s", zonecfg_root, 1502108322fbScarlsonj ZONE_CONFIG_ROOT) >= sizeof (path)) 1503108322fbScarlsonj return (Z_INVAL); 1504108322fbScarlsonj if (access(path, amode) == 0) 1505108322fbScarlsonj return (Z_OK); 1506108322fbScarlsonj } 15077c478bd9Sstevel@tonic-gate if (errno == EACCES) 15087c478bd9Sstevel@tonic-gate return (Z_ACCES); 15097c478bd9Sstevel@tonic-gate if (errno == EINVAL) 15107c478bd9Sstevel@tonic-gate return (Z_INVAL); 15117c478bd9Sstevel@tonic-gate return (Z_MISC_FS); 15127c478bd9Sstevel@tonic-gate } 15137c478bd9Sstevel@tonic-gate 15147c478bd9Sstevel@tonic-gate int 1515108322fbScarlsonj zonecfg_create_snapshot(const char *zonename) 15167c478bd9Sstevel@tonic-gate { 15177c478bd9Sstevel@tonic-gate zone_dochandle_t handle; 15187c478bd9Sstevel@tonic-gate char path[MAXPATHLEN], zonepath[MAXPATHLEN], rpath[MAXPATHLEN]; 15197c478bd9Sstevel@tonic-gate int error = Z_OK, res; 15207c478bd9Sstevel@tonic-gate 15217c478bd9Sstevel@tonic-gate if ((handle = zonecfg_init_handle()) == NULL) { 15227c478bd9Sstevel@tonic-gate return (Z_NOMEM); 15237c478bd9Sstevel@tonic-gate } 15247c478bd9Sstevel@tonic-gate 1525087719fdSdp handle->zone_dh_newzone = B_TRUE; 1526087719fdSdp handle->zone_dh_snapshot = B_TRUE; 1527087719fdSdp 15287c478bd9Sstevel@tonic-gate if ((error = zonecfg_get_handle(zonename, handle)) != Z_OK) 15297c478bd9Sstevel@tonic-gate goto out; 15307c478bd9Sstevel@tonic-gate if ((error = operation_prep(handle)) != Z_OK) 15317c478bd9Sstevel@tonic-gate goto out; 15327c478bd9Sstevel@tonic-gate error = zonecfg_get_zonepath(handle, zonepath, sizeof (zonepath)); 15337c478bd9Sstevel@tonic-gate if (error != Z_OK) 15347c478bd9Sstevel@tonic-gate goto out; 15357c478bd9Sstevel@tonic-gate if ((res = resolvepath(zonepath, rpath, sizeof (rpath))) == -1) { 15367c478bd9Sstevel@tonic-gate error = Z_RESOLVED_PATH; 15377c478bd9Sstevel@tonic-gate goto out; 15387c478bd9Sstevel@tonic-gate } 15397c478bd9Sstevel@tonic-gate /* 15407c478bd9Sstevel@tonic-gate * If the resolved path is not the same as the original path, then 15417c478bd9Sstevel@tonic-gate * save the resolved path in the snapshot, thus preventing any 15427c478bd9Sstevel@tonic-gate * potential problems down the line when zoneadmd goes to unmount 15437c478bd9Sstevel@tonic-gate * file systems and depends on initial string matches with resolved 15447c478bd9Sstevel@tonic-gate * paths. 15457c478bd9Sstevel@tonic-gate */ 15467c478bd9Sstevel@tonic-gate rpath[res] = '\0'; 15477c478bd9Sstevel@tonic-gate if (strcmp(zonepath, rpath) != 0) { 15487c478bd9Sstevel@tonic-gate if ((error = zonecfg_set_zonepath(handle, rpath)) != Z_OK) 15497c478bd9Sstevel@tonic-gate goto out; 15507c478bd9Sstevel@tonic-gate } 1551108322fbScarlsonj if (snprintf(path, sizeof (path), "%s%s", zonecfg_root, 1552108322fbScarlsonj ZONE_SNAPSHOT_ROOT) >= sizeof (path)) { 1553108322fbScarlsonj error = Z_MISC_FS; 1554108322fbScarlsonj goto out; 1555108322fbScarlsonj } 1556108322fbScarlsonj if ((mkdir(path, S_IRWXU) == -1) && (errno != EEXIST)) { 15577c478bd9Sstevel@tonic-gate error = Z_MISC_FS; 15587c478bd9Sstevel@tonic-gate goto out; 15597c478bd9Sstevel@tonic-gate } 15607c478bd9Sstevel@tonic-gate 1561108322fbScarlsonj if (!snap_file_path(zonename, path)) { 1562108322fbScarlsonj error = Z_MISC_FS; 1563108322fbScarlsonj goto out; 1564108322fbScarlsonj } 1565087719fdSdp 1566087719fdSdp addcomment(handle, "\n DO NOT EDIT THIS FILE. " 1567087719fdSdp "It is a snapshot of running zone state.\n"); 1568087719fdSdp 15697c478bd9Sstevel@tonic-gate error = zonecfg_save_impl(handle, path); 15707c478bd9Sstevel@tonic-gate 1571087719fdSdp stripcomments(handle); 1572087719fdSdp 15737c478bd9Sstevel@tonic-gate out: 15747c478bd9Sstevel@tonic-gate zonecfg_fini_handle(handle); 15757c478bd9Sstevel@tonic-gate return (error); 15767c478bd9Sstevel@tonic-gate } 15777c478bd9Sstevel@tonic-gate 1578f4b3ec61Sdh int 1579f4b3ec61Sdh zonecfg_get_iptype(zone_dochandle_t handle, zone_iptype_t *iptypep) 1580f4b3ec61Sdh { 1581f4b3ec61Sdh char property[10]; /* 10 is big enough for "shared"/"exclusive" */ 1582f4b3ec61Sdh int err; 1583f4b3ec61Sdh 1584f4b3ec61Sdh err = getrootattr(handle, DTD_ATTR_IPTYPE, property, sizeof (property)); 1585f4b3ec61Sdh if (err == Z_BAD_PROPERTY) { 1586f4b3ec61Sdh /* Return default value */ 1587f4b3ec61Sdh *iptypep = ZS_SHARED; 1588f4b3ec61Sdh return (Z_OK); 1589f4b3ec61Sdh } else if (err != Z_OK) { 1590f4b3ec61Sdh return (err); 1591f4b3ec61Sdh } 1592f4b3ec61Sdh 1593f4b3ec61Sdh if (strlen(property) == 0 || 1594f4b3ec61Sdh strcmp(property, "shared") == 0) 1595f4b3ec61Sdh *iptypep = ZS_SHARED; 1596f4b3ec61Sdh else if (strcmp(property, "exclusive") == 0) 1597f4b3ec61Sdh *iptypep = ZS_EXCLUSIVE; 1598f4b3ec61Sdh else 1599f4b3ec61Sdh return (Z_INVAL); 1600f4b3ec61Sdh 1601f4b3ec61Sdh return (Z_OK); 1602f4b3ec61Sdh } 1603f4b3ec61Sdh 1604f4b3ec61Sdh int 1605f4b3ec61Sdh zonecfg_set_iptype(zone_dochandle_t handle, zone_iptype_t iptype) 1606f4b3ec61Sdh { 1607f4b3ec61Sdh xmlNodePtr cur; 1608f4b3ec61Sdh 1609f4b3ec61Sdh if (handle == NULL) 1610f4b3ec61Sdh return (Z_INVAL); 1611f4b3ec61Sdh 1612f4b3ec61Sdh cur = xmlDocGetRootElement(handle->zone_dh_doc); 1613f4b3ec61Sdh if (cur == NULL) { 1614f4b3ec61Sdh return (Z_EMPTY_DOCUMENT); 1615f4b3ec61Sdh } 1616f4b3ec61Sdh 1617f4b3ec61Sdh if (xmlStrcmp(cur->name, DTD_ELEM_ZONE) != 0) { 1618f4b3ec61Sdh return (Z_WRONG_DOC_TYPE); 1619f4b3ec61Sdh } 1620f4b3ec61Sdh switch (iptype) { 1621f4b3ec61Sdh case ZS_SHARED: 1622f4b3ec61Sdh /* 1623f4b3ec61Sdh * Since "shared" is the default, we don't write it to the 1624f4b3ec61Sdh * configuration file, so that it's easier to migrate those 1625f4b3ec61Sdh * zones elsewhere, eg., to systems which are not IP-Instances 1626f4b3ec61Sdh * aware. 1627f4b3ec61Sdh * xmlUnsetProp only fails when the attribute doesn't exist, 1628f4b3ec61Sdh * which we don't care. 1629f4b3ec61Sdh */ 1630f4b3ec61Sdh (void) xmlUnsetProp(cur, DTD_ATTR_IPTYPE); 1631f4b3ec61Sdh break; 1632f4b3ec61Sdh case ZS_EXCLUSIVE: 1633f4b3ec61Sdh if (xmlSetProp(cur, DTD_ATTR_IPTYPE, 1634f4b3ec61Sdh (const xmlChar *) "exclusive") == NULL) 1635f4b3ec61Sdh return (Z_INVAL); 1636f4b3ec61Sdh break; 1637f4b3ec61Sdh } 1638f4b3ec61Sdh return (Z_OK); 1639f4b3ec61Sdh } 1640f4b3ec61Sdh 16417c478bd9Sstevel@tonic-gate static int 1642a1be23daSdp newprop(xmlNodePtr node, const xmlChar *attrname, char *src) 16437c478bd9Sstevel@tonic-gate { 16447c478bd9Sstevel@tonic-gate xmlAttrPtr newattr; 16457c478bd9Sstevel@tonic-gate 16467c478bd9Sstevel@tonic-gate newattr = xmlNewProp(node, attrname, (xmlChar *)src); 16477c478bd9Sstevel@tonic-gate if (newattr == NULL) { 16487c478bd9Sstevel@tonic-gate xmlUnlinkNode(node); 16497c478bd9Sstevel@tonic-gate xmlFreeNode(node); 16507c478bd9Sstevel@tonic-gate return (Z_BAD_PROPERTY); 16517c478bd9Sstevel@tonic-gate } 16527c478bd9Sstevel@tonic-gate return (Z_OK); 16537c478bd9Sstevel@tonic-gate } 16547c478bd9Sstevel@tonic-gate 16557c478bd9Sstevel@tonic-gate static int 16567c478bd9Sstevel@tonic-gate zonecfg_add_filesystem_core(zone_dochandle_t handle, struct zone_fstab *tabptr) 16577c478bd9Sstevel@tonic-gate { 16587c478bd9Sstevel@tonic-gate xmlNodePtr newnode, cur = handle->zone_dh_cur, options_node; 16597c478bd9Sstevel@tonic-gate zone_fsopt_t *ptr; 16607c478bd9Sstevel@tonic-gate int err; 16617c478bd9Sstevel@tonic-gate 16627c478bd9Sstevel@tonic-gate newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_FS, NULL); 1663a1be23daSdp if ((err = newprop(newnode, DTD_ATTR_SPECIAL, 16647c478bd9Sstevel@tonic-gate tabptr->zone_fs_special)) != Z_OK) 16657c478bd9Sstevel@tonic-gate return (err); 16667c478bd9Sstevel@tonic-gate if (tabptr->zone_fs_raw[0] != '\0' && 1667a1be23daSdp (err = newprop(newnode, DTD_ATTR_RAW, tabptr->zone_fs_raw)) != Z_OK) 16687c478bd9Sstevel@tonic-gate return (err); 1669a1be23daSdp if ((err = newprop(newnode, DTD_ATTR_DIR, tabptr->zone_fs_dir)) != Z_OK) 16707c478bd9Sstevel@tonic-gate return (err); 1671a1be23daSdp if ((err = newprop(newnode, DTD_ATTR_TYPE, 16727c478bd9Sstevel@tonic-gate tabptr->zone_fs_type)) != Z_OK) 16737c478bd9Sstevel@tonic-gate return (err); 16747c478bd9Sstevel@tonic-gate if (tabptr->zone_fs_options != NULL) { 16757c478bd9Sstevel@tonic-gate for (ptr = tabptr->zone_fs_options; ptr != NULL; 16767c478bd9Sstevel@tonic-gate ptr = ptr->zone_fsopt_next) { 16777c478bd9Sstevel@tonic-gate options_node = xmlNewTextChild(newnode, NULL, 16787c478bd9Sstevel@tonic-gate DTD_ELEM_FSOPTION, NULL); 1679a1be23daSdp if ((err = newprop(options_node, DTD_ATTR_NAME, 16807c478bd9Sstevel@tonic-gate ptr->zone_fsopt_opt)) != Z_OK) 16817c478bd9Sstevel@tonic-gate return (err); 16827c478bd9Sstevel@tonic-gate } 16837c478bd9Sstevel@tonic-gate } 16847c478bd9Sstevel@tonic-gate return (Z_OK); 16857c478bd9Sstevel@tonic-gate } 16867c478bd9Sstevel@tonic-gate 16877c478bd9Sstevel@tonic-gate int 16887c478bd9Sstevel@tonic-gate zonecfg_add_filesystem(zone_dochandle_t handle, struct zone_fstab *tabptr) 16897c478bd9Sstevel@tonic-gate { 16907c478bd9Sstevel@tonic-gate int err; 16917c478bd9Sstevel@tonic-gate 16927c478bd9Sstevel@tonic-gate if (tabptr == NULL) 16937c478bd9Sstevel@tonic-gate return (Z_INVAL); 16947c478bd9Sstevel@tonic-gate 16957c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 16967c478bd9Sstevel@tonic-gate return (err); 16977c478bd9Sstevel@tonic-gate 16987c478bd9Sstevel@tonic-gate if ((err = zonecfg_add_filesystem_core(handle, tabptr)) != Z_OK) 16997c478bd9Sstevel@tonic-gate return (err); 17007c478bd9Sstevel@tonic-gate 17017c478bd9Sstevel@tonic-gate return (Z_OK); 17027c478bd9Sstevel@tonic-gate } 17037c478bd9Sstevel@tonic-gate 17047c478bd9Sstevel@tonic-gate int 17057c478bd9Sstevel@tonic-gate zonecfg_add_fs_option(struct zone_fstab *tabptr, char *option) 17067c478bd9Sstevel@tonic-gate { 17077c478bd9Sstevel@tonic-gate zone_fsopt_t *last, *old, *new; 17087c478bd9Sstevel@tonic-gate 17097c478bd9Sstevel@tonic-gate last = tabptr->zone_fs_options; 17107c478bd9Sstevel@tonic-gate for (old = last; old != NULL; old = old->zone_fsopt_next) 17117c478bd9Sstevel@tonic-gate last = old; /* walk to the end of the list */ 17127c478bd9Sstevel@tonic-gate new = (zone_fsopt_t *)malloc(sizeof (zone_fsopt_t)); 17137c478bd9Sstevel@tonic-gate if (new == NULL) 17147c478bd9Sstevel@tonic-gate return (Z_NOMEM); 17157c478bd9Sstevel@tonic-gate (void) strlcpy(new->zone_fsopt_opt, option, 17167c478bd9Sstevel@tonic-gate sizeof (new->zone_fsopt_opt)); 17177c478bd9Sstevel@tonic-gate new->zone_fsopt_next = NULL; 17187c478bd9Sstevel@tonic-gate if (last == NULL) 17197c478bd9Sstevel@tonic-gate tabptr->zone_fs_options = new; 17207c478bd9Sstevel@tonic-gate else 17217c478bd9Sstevel@tonic-gate last->zone_fsopt_next = new; 17227c478bd9Sstevel@tonic-gate return (Z_OK); 17237c478bd9Sstevel@tonic-gate } 17247c478bd9Sstevel@tonic-gate 17257c478bd9Sstevel@tonic-gate int 17267c478bd9Sstevel@tonic-gate zonecfg_remove_fs_option(struct zone_fstab *tabptr, char *option) 17277c478bd9Sstevel@tonic-gate { 17287c478bd9Sstevel@tonic-gate zone_fsopt_t *last, *this, *next; 17297c478bd9Sstevel@tonic-gate 17307c478bd9Sstevel@tonic-gate last = tabptr->zone_fs_options; 17317c478bd9Sstevel@tonic-gate for (this = last; this != NULL; this = this->zone_fsopt_next) { 17327c478bd9Sstevel@tonic-gate if (strcmp(this->zone_fsopt_opt, option) == 0) { 17337c478bd9Sstevel@tonic-gate next = this->zone_fsopt_next; 17347c478bd9Sstevel@tonic-gate if (this == tabptr->zone_fs_options) 17357c478bd9Sstevel@tonic-gate tabptr->zone_fs_options = next; 17367c478bd9Sstevel@tonic-gate else 17377c478bd9Sstevel@tonic-gate last->zone_fsopt_next = next; 17387c478bd9Sstevel@tonic-gate free(this); 17397c478bd9Sstevel@tonic-gate return (Z_OK); 17407c478bd9Sstevel@tonic-gate } else 17417c478bd9Sstevel@tonic-gate last = this; 17427c478bd9Sstevel@tonic-gate } 17437c478bd9Sstevel@tonic-gate return (Z_NO_PROPERTY_ID); 17447c478bd9Sstevel@tonic-gate } 17457c478bd9Sstevel@tonic-gate 17467c478bd9Sstevel@tonic-gate void 17477c478bd9Sstevel@tonic-gate zonecfg_free_fs_option_list(zone_fsopt_t *list) 17487c478bd9Sstevel@tonic-gate { 17497c478bd9Sstevel@tonic-gate zone_fsopt_t *this, *next; 17507c478bd9Sstevel@tonic-gate 17517c478bd9Sstevel@tonic-gate for (this = list; this != NULL; this = next) { 17527c478bd9Sstevel@tonic-gate next = this->zone_fsopt_next; 17537c478bd9Sstevel@tonic-gate free(this); 17547c478bd9Sstevel@tonic-gate } 17557c478bd9Sstevel@tonic-gate } 17567c478bd9Sstevel@tonic-gate 17577c478bd9Sstevel@tonic-gate void 17587c478bd9Sstevel@tonic-gate zonecfg_free_rctl_value_list(struct zone_rctlvaltab *valtab) 17597c478bd9Sstevel@tonic-gate { 17607c478bd9Sstevel@tonic-gate if (valtab == NULL) 17617c478bd9Sstevel@tonic-gate return; 17627c478bd9Sstevel@tonic-gate zonecfg_free_rctl_value_list(valtab->zone_rctlval_next); 17637c478bd9Sstevel@tonic-gate free(valtab); 17647c478bd9Sstevel@tonic-gate } 17657c478bd9Sstevel@tonic-gate 17667c478bd9Sstevel@tonic-gate static boolean_t 17677c478bd9Sstevel@tonic-gate match_prop(xmlNodePtr cur, const xmlChar *attr, char *user_prop) 17687c478bd9Sstevel@tonic-gate { 17697c478bd9Sstevel@tonic-gate xmlChar *gotten_prop; 17707c478bd9Sstevel@tonic-gate int prop_result; 17717c478bd9Sstevel@tonic-gate 17727c478bd9Sstevel@tonic-gate gotten_prop = xmlGetProp(cur, attr); 17737c478bd9Sstevel@tonic-gate if (gotten_prop == NULL) /* shouldn't happen */ 17747c478bd9Sstevel@tonic-gate return (B_FALSE); 17757c478bd9Sstevel@tonic-gate prop_result = xmlStrcmp(gotten_prop, (const xmlChar *) user_prop); 17767c478bd9Sstevel@tonic-gate xmlFree(gotten_prop); 17775e74f94dSGary Mills return ((prop_result == 0)); /* empty strings will match */ 17787c478bd9Sstevel@tonic-gate } 17797c478bd9Sstevel@tonic-gate 17807c478bd9Sstevel@tonic-gate static int 17817c478bd9Sstevel@tonic-gate zonecfg_delete_filesystem_core(zone_dochandle_t handle, 17827c478bd9Sstevel@tonic-gate struct zone_fstab *tabptr) 17837c478bd9Sstevel@tonic-gate { 17847c478bd9Sstevel@tonic-gate xmlNodePtr cur = handle->zone_dh_cur; 17857c478bd9Sstevel@tonic-gate boolean_t dir_match, spec_match, raw_match, type_match; 17867c478bd9Sstevel@tonic-gate 17877c478bd9Sstevel@tonic-gate for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 17887c478bd9Sstevel@tonic-gate if (xmlStrcmp(cur->name, DTD_ELEM_FS)) 17897c478bd9Sstevel@tonic-gate continue; 17907c478bd9Sstevel@tonic-gate dir_match = match_prop(cur, DTD_ATTR_DIR, tabptr->zone_fs_dir); 17917c478bd9Sstevel@tonic-gate spec_match = match_prop(cur, DTD_ATTR_SPECIAL, 17927c478bd9Sstevel@tonic-gate tabptr->zone_fs_special); 17937c478bd9Sstevel@tonic-gate raw_match = match_prop(cur, DTD_ATTR_RAW, 17947c478bd9Sstevel@tonic-gate tabptr->zone_fs_raw); 17957c478bd9Sstevel@tonic-gate type_match = match_prop(cur, DTD_ATTR_TYPE, 17967c478bd9Sstevel@tonic-gate tabptr->zone_fs_type); 17977c478bd9Sstevel@tonic-gate if (dir_match && spec_match && raw_match && type_match) { 17987c478bd9Sstevel@tonic-gate xmlUnlinkNode(cur); 17997c478bd9Sstevel@tonic-gate xmlFreeNode(cur); 18007c478bd9Sstevel@tonic-gate return (Z_OK); 18017c478bd9Sstevel@tonic-gate } 18027c478bd9Sstevel@tonic-gate } 18037c478bd9Sstevel@tonic-gate return (Z_NO_RESOURCE_ID); 18047c478bd9Sstevel@tonic-gate } 18057c478bd9Sstevel@tonic-gate 18067c478bd9Sstevel@tonic-gate int 18077c478bd9Sstevel@tonic-gate zonecfg_delete_filesystem(zone_dochandle_t handle, struct zone_fstab *tabptr) 18087c478bd9Sstevel@tonic-gate { 18097c478bd9Sstevel@tonic-gate int err; 18107c478bd9Sstevel@tonic-gate 18117c478bd9Sstevel@tonic-gate if (tabptr == NULL) 18127c478bd9Sstevel@tonic-gate return (Z_INVAL); 18137c478bd9Sstevel@tonic-gate 18147c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 18157c478bd9Sstevel@tonic-gate return (err); 18167c478bd9Sstevel@tonic-gate 18177c478bd9Sstevel@tonic-gate if ((err = zonecfg_delete_filesystem_core(handle, tabptr)) != Z_OK) 18187c478bd9Sstevel@tonic-gate return (err); 18197c478bd9Sstevel@tonic-gate 18207c478bd9Sstevel@tonic-gate return (Z_OK); 18217c478bd9Sstevel@tonic-gate } 18227c478bd9Sstevel@tonic-gate 18237c478bd9Sstevel@tonic-gate int 18247c478bd9Sstevel@tonic-gate zonecfg_modify_filesystem( 18257c478bd9Sstevel@tonic-gate zone_dochandle_t handle, 18267c478bd9Sstevel@tonic-gate struct zone_fstab *oldtabptr, 18277c478bd9Sstevel@tonic-gate struct zone_fstab *newtabptr) 18287c478bd9Sstevel@tonic-gate { 18297c478bd9Sstevel@tonic-gate int err; 18307c478bd9Sstevel@tonic-gate 18317c478bd9Sstevel@tonic-gate if (oldtabptr == NULL || newtabptr == NULL) 18327c478bd9Sstevel@tonic-gate return (Z_INVAL); 18337c478bd9Sstevel@tonic-gate 18347c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 18357c478bd9Sstevel@tonic-gate return (err); 18367c478bd9Sstevel@tonic-gate 18377c478bd9Sstevel@tonic-gate if ((err = zonecfg_delete_filesystem_core(handle, oldtabptr)) != Z_OK) 18387c478bd9Sstevel@tonic-gate return (err); 18397c478bd9Sstevel@tonic-gate 18407c478bd9Sstevel@tonic-gate if ((err = zonecfg_add_filesystem_core(handle, newtabptr)) != Z_OK) 18417c478bd9Sstevel@tonic-gate return (err); 18427c478bd9Sstevel@tonic-gate 18437c478bd9Sstevel@tonic-gate return (Z_OK); 18447c478bd9Sstevel@tonic-gate } 18457c478bd9Sstevel@tonic-gate 18467c478bd9Sstevel@tonic-gate int 18477c478bd9Sstevel@tonic-gate zonecfg_lookup_filesystem( 18487c478bd9Sstevel@tonic-gate zone_dochandle_t handle, 18497c478bd9Sstevel@tonic-gate struct zone_fstab *tabptr) 18507c478bd9Sstevel@tonic-gate { 18517c478bd9Sstevel@tonic-gate xmlNodePtr cur, options, firstmatch; 18527c478bd9Sstevel@tonic-gate int err; 18537c478bd9Sstevel@tonic-gate char dirname[MAXPATHLEN], special[MAXPATHLEN], raw[MAXPATHLEN]; 18547c478bd9Sstevel@tonic-gate char type[FSTYPSZ]; 18557c478bd9Sstevel@tonic-gate char options_str[MAX_MNTOPT_STR]; 18567c478bd9Sstevel@tonic-gate 18577c478bd9Sstevel@tonic-gate if (tabptr == NULL) 18587c478bd9Sstevel@tonic-gate return (Z_INVAL); 18597c478bd9Sstevel@tonic-gate 18607c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 18617c478bd9Sstevel@tonic-gate return (err); 18627c478bd9Sstevel@tonic-gate 18637c478bd9Sstevel@tonic-gate /* 18647c478bd9Sstevel@tonic-gate * Walk the list of children looking for matches on any properties 18657c478bd9Sstevel@tonic-gate * specified in the fstab parameter. If more than one resource 18667c478bd9Sstevel@tonic-gate * matches, we return Z_INSUFFICIENT_SPEC; if none match, we return 18677c478bd9Sstevel@tonic-gate * Z_NO_RESOURCE_ID. 18687c478bd9Sstevel@tonic-gate */ 18697c478bd9Sstevel@tonic-gate cur = handle->zone_dh_cur; 18707c478bd9Sstevel@tonic-gate firstmatch = NULL; 18717c478bd9Sstevel@tonic-gate for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 18727c478bd9Sstevel@tonic-gate if (xmlStrcmp(cur->name, DTD_ELEM_FS)) 18737c478bd9Sstevel@tonic-gate continue; 18747c478bd9Sstevel@tonic-gate if (strlen(tabptr->zone_fs_dir) > 0) { 18757c478bd9Sstevel@tonic-gate if ((fetchprop(cur, DTD_ATTR_DIR, dirname, 18767c478bd9Sstevel@tonic-gate sizeof (dirname)) == Z_OK) && 18777c478bd9Sstevel@tonic-gate (strcmp(tabptr->zone_fs_dir, dirname) == 0)) { 18787c478bd9Sstevel@tonic-gate if (firstmatch == NULL) 18797c478bd9Sstevel@tonic-gate firstmatch = cur; 18807c478bd9Sstevel@tonic-gate else 18817c478bd9Sstevel@tonic-gate return (Z_INSUFFICIENT_SPEC); 18827c478bd9Sstevel@tonic-gate } 18837c478bd9Sstevel@tonic-gate } 18847c478bd9Sstevel@tonic-gate if (strlen(tabptr->zone_fs_special) > 0) { 18857c478bd9Sstevel@tonic-gate if ((fetchprop(cur, DTD_ATTR_SPECIAL, special, 18867c478bd9Sstevel@tonic-gate sizeof (special)) == Z_OK)) { 18877c478bd9Sstevel@tonic-gate if (strcmp(tabptr->zone_fs_special, 18887c478bd9Sstevel@tonic-gate special) == 0) { 18897c478bd9Sstevel@tonic-gate if (firstmatch == NULL) 18907c478bd9Sstevel@tonic-gate firstmatch = cur; 18917c478bd9Sstevel@tonic-gate else if (firstmatch != cur) 18927c478bd9Sstevel@tonic-gate return (Z_INSUFFICIENT_SPEC); 18937c478bd9Sstevel@tonic-gate } else { 18947c478bd9Sstevel@tonic-gate /* 18957c478bd9Sstevel@tonic-gate * If another property matched but this 18967c478bd9Sstevel@tonic-gate * one doesn't then reset firstmatch. 18977c478bd9Sstevel@tonic-gate */ 18987c478bd9Sstevel@tonic-gate if (firstmatch == cur) 18997c478bd9Sstevel@tonic-gate firstmatch = NULL; 19007c478bd9Sstevel@tonic-gate } 19017c478bd9Sstevel@tonic-gate } 19027c478bd9Sstevel@tonic-gate } 19037c478bd9Sstevel@tonic-gate if (strlen(tabptr->zone_fs_raw) > 0) { 19047c478bd9Sstevel@tonic-gate if ((fetchprop(cur, DTD_ATTR_RAW, raw, 19057c478bd9Sstevel@tonic-gate sizeof (raw)) == Z_OK)) { 19067c478bd9Sstevel@tonic-gate if (strcmp(tabptr->zone_fs_raw, raw) == 0) { 19077c478bd9Sstevel@tonic-gate if (firstmatch == NULL) 19087c478bd9Sstevel@tonic-gate firstmatch = cur; 19097c478bd9Sstevel@tonic-gate else if (firstmatch != cur) 19107c478bd9Sstevel@tonic-gate return (Z_INSUFFICIENT_SPEC); 19117c478bd9Sstevel@tonic-gate } else { 19127c478bd9Sstevel@tonic-gate /* 19137c478bd9Sstevel@tonic-gate * If another property matched but this 19147c478bd9Sstevel@tonic-gate * one doesn't then reset firstmatch. 19157c478bd9Sstevel@tonic-gate */ 19167c478bd9Sstevel@tonic-gate if (firstmatch == cur) 19177c478bd9Sstevel@tonic-gate firstmatch = NULL; 19187c478bd9Sstevel@tonic-gate } 19197c478bd9Sstevel@tonic-gate } 19207c478bd9Sstevel@tonic-gate } 19217c478bd9Sstevel@tonic-gate if (strlen(tabptr->zone_fs_type) > 0) { 19227c478bd9Sstevel@tonic-gate if ((fetchprop(cur, DTD_ATTR_TYPE, type, 19237c478bd9Sstevel@tonic-gate sizeof (type)) == Z_OK)) { 19247c478bd9Sstevel@tonic-gate if (strcmp(tabptr->zone_fs_type, type) == 0) { 19257c478bd9Sstevel@tonic-gate if (firstmatch == NULL) 19267c478bd9Sstevel@tonic-gate firstmatch = cur; 19277c478bd9Sstevel@tonic-gate else if (firstmatch != cur) 19287c478bd9Sstevel@tonic-gate return (Z_INSUFFICIENT_SPEC); 19297c478bd9Sstevel@tonic-gate } else { 19307c478bd9Sstevel@tonic-gate /* 19317c478bd9Sstevel@tonic-gate * If another property matched but this 19327c478bd9Sstevel@tonic-gate * one doesn't then reset firstmatch. 19337c478bd9Sstevel@tonic-gate */ 19347c478bd9Sstevel@tonic-gate if (firstmatch == cur) 19357c478bd9Sstevel@tonic-gate firstmatch = NULL; 19367c478bd9Sstevel@tonic-gate } 19377c478bd9Sstevel@tonic-gate } 19387c478bd9Sstevel@tonic-gate } 19397c478bd9Sstevel@tonic-gate } 19407c478bd9Sstevel@tonic-gate 19417c478bd9Sstevel@tonic-gate if (firstmatch == NULL) 19427c478bd9Sstevel@tonic-gate return (Z_NO_RESOURCE_ID); 19437c478bd9Sstevel@tonic-gate 19447c478bd9Sstevel@tonic-gate cur = firstmatch; 19457c478bd9Sstevel@tonic-gate 19467c478bd9Sstevel@tonic-gate if ((err = fetchprop(cur, DTD_ATTR_DIR, tabptr->zone_fs_dir, 19477c478bd9Sstevel@tonic-gate sizeof (tabptr->zone_fs_dir))) != Z_OK) 19487c478bd9Sstevel@tonic-gate return (err); 19497c478bd9Sstevel@tonic-gate 19507c478bd9Sstevel@tonic-gate if ((err = fetchprop(cur, DTD_ATTR_SPECIAL, tabptr->zone_fs_special, 19517c478bd9Sstevel@tonic-gate sizeof (tabptr->zone_fs_special))) != Z_OK) 19527c478bd9Sstevel@tonic-gate return (err); 19537c478bd9Sstevel@tonic-gate 19547c478bd9Sstevel@tonic-gate if ((err = fetchprop(cur, DTD_ATTR_RAW, tabptr->zone_fs_raw, 19557c478bd9Sstevel@tonic-gate sizeof (tabptr->zone_fs_raw))) != Z_OK) 19567c478bd9Sstevel@tonic-gate return (err); 19577c478bd9Sstevel@tonic-gate 19587c478bd9Sstevel@tonic-gate if ((err = fetchprop(cur, DTD_ATTR_TYPE, tabptr->zone_fs_type, 19597c478bd9Sstevel@tonic-gate sizeof (tabptr->zone_fs_type))) != Z_OK) 19607c478bd9Sstevel@tonic-gate return (err); 19617c478bd9Sstevel@tonic-gate 19627c478bd9Sstevel@tonic-gate /* options are optional */ 19637c478bd9Sstevel@tonic-gate tabptr->zone_fs_options = NULL; 19647c478bd9Sstevel@tonic-gate for (options = cur->xmlChildrenNode; options != NULL; 19657c478bd9Sstevel@tonic-gate options = options->next) { 19667c478bd9Sstevel@tonic-gate if ((fetchprop(options, DTD_ATTR_NAME, options_str, 19677c478bd9Sstevel@tonic-gate sizeof (options_str)) != Z_OK)) 19687c478bd9Sstevel@tonic-gate break; 19697c478bd9Sstevel@tonic-gate if (zonecfg_add_fs_option(tabptr, options_str) != Z_OK) 19707c478bd9Sstevel@tonic-gate break; 19717c478bd9Sstevel@tonic-gate } 19727c478bd9Sstevel@tonic-gate return (Z_OK); 19737c478bd9Sstevel@tonic-gate } 19747c478bd9Sstevel@tonic-gate 19757c478bd9Sstevel@tonic-gate /* 19767c478bd9Sstevel@tonic-gate * Compare two IP addresses in string form. Allow for the possibility that 19777c478bd9Sstevel@tonic-gate * one might have "/<prefix-length>" at the end: allow a match on just the 19787c478bd9Sstevel@tonic-gate * IP address (or host name) part. 19797c478bd9Sstevel@tonic-gate */ 19807c478bd9Sstevel@tonic-gate 19817c478bd9Sstevel@tonic-gate boolean_t 19827c478bd9Sstevel@tonic-gate zonecfg_same_net_address(char *a1, char *a2) 19837c478bd9Sstevel@tonic-gate { 19847c478bd9Sstevel@tonic-gate char *slashp, *slashp1, *slashp2; 19857c478bd9Sstevel@tonic-gate int result; 19867c478bd9Sstevel@tonic-gate 19877c478bd9Sstevel@tonic-gate if (strcmp(a1, a2) == 0) 19887c478bd9Sstevel@tonic-gate return (B_TRUE); 19897c478bd9Sstevel@tonic-gate 19907c478bd9Sstevel@tonic-gate /* 19917c478bd9Sstevel@tonic-gate * If neither has a slash or both do, they need to match to be 19927c478bd9Sstevel@tonic-gate * considered the same, but they did not match above, so fail. 19937c478bd9Sstevel@tonic-gate */ 19947c478bd9Sstevel@tonic-gate slashp1 = strchr(a1, '/'); 19957c478bd9Sstevel@tonic-gate slashp2 = strchr(a2, '/'); 19967c478bd9Sstevel@tonic-gate if ((slashp1 == NULL && slashp2 == NULL) || 19977c478bd9Sstevel@tonic-gate (slashp1 != NULL && slashp2 != NULL)) 19987c478bd9Sstevel@tonic-gate return (B_FALSE); 19997c478bd9Sstevel@tonic-gate 20007c478bd9Sstevel@tonic-gate /* 20017c478bd9Sstevel@tonic-gate * Only one had a slash: pick that one, zero out the slash, compare 20027c478bd9Sstevel@tonic-gate * the "address only" strings, restore the slash, and return the 20037c478bd9Sstevel@tonic-gate * result of the comparison. 20047c478bd9Sstevel@tonic-gate */ 20057c478bd9Sstevel@tonic-gate slashp = (slashp1 == NULL) ? slashp2 : slashp1; 20067c478bd9Sstevel@tonic-gate *slashp = '\0'; 20077c478bd9Sstevel@tonic-gate result = strcmp(a1, a2); 20087c478bd9Sstevel@tonic-gate *slashp = '/'; 20097c478bd9Sstevel@tonic-gate return ((result == 0)); 20107c478bd9Sstevel@tonic-gate } 20117c478bd9Sstevel@tonic-gate 20127c478bd9Sstevel@tonic-gate int 20137c478bd9Sstevel@tonic-gate zonecfg_valid_net_address(char *address, struct lifreq *lifr) 20147c478bd9Sstevel@tonic-gate { 20157c478bd9Sstevel@tonic-gate struct sockaddr_in *sin4; 20167c478bd9Sstevel@tonic-gate struct sockaddr_in6 *sin6; 20177c478bd9Sstevel@tonic-gate struct addrinfo hints, *result; 20187c478bd9Sstevel@tonic-gate char *slashp = strchr(address, '/'); 20197c478bd9Sstevel@tonic-gate 20207c478bd9Sstevel@tonic-gate bzero(lifr, sizeof (struct lifreq)); 20217c478bd9Sstevel@tonic-gate sin4 = (struct sockaddr_in *)&lifr->lifr_addr; 20227c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)&lifr->lifr_addr; 20237c478bd9Sstevel@tonic-gate if (slashp != NULL) 20247c478bd9Sstevel@tonic-gate *slashp = '\0'; 20257c478bd9Sstevel@tonic-gate if (inet_pton(AF_INET, address, &sin4->sin_addr) == 1) { 20267c478bd9Sstevel@tonic-gate sin4->sin_family = AF_INET; 20277c478bd9Sstevel@tonic-gate } else if (inet_pton(AF_INET6, address, &sin6->sin6_addr) == 1) { 20287c478bd9Sstevel@tonic-gate if (slashp == NULL) 20297c478bd9Sstevel@tonic-gate return (Z_IPV6_ADDR_PREFIX_LEN); 20307c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 20317c478bd9Sstevel@tonic-gate } else { 20327c478bd9Sstevel@tonic-gate /* "address" may be a host name */ 20337c478bd9Sstevel@tonic-gate (void) memset(&hints, 0, sizeof (hints)); 20347c478bd9Sstevel@tonic-gate hints.ai_family = PF_INET; 20357c478bd9Sstevel@tonic-gate if (getaddrinfo(address, NULL, &hints, &result) != 0) 20367c478bd9Sstevel@tonic-gate return (Z_BOGUS_ADDRESS); 20377c478bd9Sstevel@tonic-gate sin4->sin_family = result->ai_family; 2038a1be23daSdp 20397c478bd9Sstevel@tonic-gate (void) memcpy(&sin4->sin_addr, 20407c478bd9Sstevel@tonic-gate /* LINTED E_BAD_PTR_CAST_ALIGN */ 20417c478bd9Sstevel@tonic-gate &((struct sockaddr_in *)result->ai_addr)->sin_addr, 20427c478bd9Sstevel@tonic-gate sizeof (struct in_addr)); 2043a1be23daSdp 20447c478bd9Sstevel@tonic-gate freeaddrinfo(result); 20457c478bd9Sstevel@tonic-gate } 20467c478bd9Sstevel@tonic-gate return (Z_OK); 20477c478bd9Sstevel@tonic-gate } 20487c478bd9Sstevel@tonic-gate 2049f4b3ec61Sdh boolean_t 2050f4b3ec61Sdh zonecfg_ifname_exists(sa_family_t af, char *ifname) 2051f4b3ec61Sdh { 2052f4b3ec61Sdh struct lifreq lifr; 2053f4b3ec61Sdh int so; 2054f4b3ec61Sdh int save_errno; 2055f4b3ec61Sdh 2056f4b3ec61Sdh (void) memset(&lifr, 0, sizeof (lifr)); 2057f4b3ec61Sdh (void) strlcpy(lifr.lifr_name, ifname, sizeof (lifr.lifr_name)); 2058f4b3ec61Sdh lifr.lifr_addr.ss_family = af; 2059f4b3ec61Sdh if ((so = socket(af, SOCK_DGRAM, 0)) < 0) { 2060f4b3ec61Sdh /* Odd - can't tell if the ifname exists */ 2061f4b3ec61Sdh return (B_FALSE); 2062f4b3ec61Sdh } 2063f4b3ec61Sdh if (ioctl(so, SIOCGLIFFLAGS, (caddr_t)&lifr) < 0) { 2064f4b3ec61Sdh save_errno = errno; 2065f4b3ec61Sdh (void) close(so); 2066f4b3ec61Sdh errno = save_errno; 2067f4b3ec61Sdh return (B_FALSE); 2068f4b3ec61Sdh } 2069f4b3ec61Sdh (void) close(so); 2070f4b3ec61Sdh return (B_TRUE); 2071f4b3ec61Sdh } 2072f4b3ec61Sdh 2073a8053275Sjv /* 207434eb7836Sjv * Determines whether there is a net resource with the physical interface, IP 207534eb7836Sjv * address, and default router specified by 'tabptr' in the zone configuration 207634eb7836Sjv * to which 'handle' refers. 'tabptr' must have an interface, an address, a 207734eb7836Sjv * default router, or a combination of the three. This function returns Z_OK 207834eb7836Sjv * iff there is exactly one net resource matching the query specified by 207934eb7836Sjv * 'tabptr'. The function returns Z_INSUFFICIENT_SPEC if there are multiple 208034eb7836Sjv * matches or 'tabptr' does not specify a physical interface, address, or 208134eb7836Sjv * default router. The function returns Z_NO_RESOURCE_ID if are no matches. 2082a8053275Sjv * 2083a8053275Sjv * Errors might also be returned if the entry that exactly matches the 2084a8053275Sjv * query lacks critical network resource information. 2085a8053275Sjv * 208634eb7836Sjv * If there is a single match, then the matching entry's physical interface, IP 208734eb7836Sjv * address, and default router information are stored in 'tabptr'. 2088a8053275Sjv */ 20897c478bd9Sstevel@tonic-gate int 20907c478bd9Sstevel@tonic-gate zonecfg_lookup_nwif(zone_dochandle_t handle, struct zone_nwiftab *tabptr) 20917c478bd9Sstevel@tonic-gate { 2092a8053275Sjv xmlNodePtr cur; 2093a8053275Sjv xmlNodePtr firstmatch; 20947c478bd9Sstevel@tonic-gate int err; 2095a8053275Sjv char address[INET6_ADDRSTRLEN]; 2096a8053275Sjv char physical[LIFNAMSIZ]; 2097a8053275Sjv size_t addrspec; /* nonzero if tabptr has IP addr */ 2098a8053275Sjv size_t physspec; /* nonzero if tabptr has interface */ 209934eb7836Sjv size_t defrouterspec; /* nonzero if tabptr has def. router */ 2100550b6e40SSowmini Varadhan size_t allowed_addrspec; 2101550b6e40SSowmini Varadhan zone_iptype_t iptype; 21027c478bd9Sstevel@tonic-gate 21037c478bd9Sstevel@tonic-gate if (tabptr == NULL) 21047c478bd9Sstevel@tonic-gate return (Z_INVAL); 21057c478bd9Sstevel@tonic-gate 2106a8053275Sjv /* 210734eb7836Sjv * Determine the fields that will be searched. There must be at least 210834eb7836Sjv * one. 210934eb7836Sjv * 211034eb7836Sjv * zone_nwif_address, zone_nwif_physical, and zone_nwif_defrouter are 211134eb7836Sjv * arrays, so no NULL checks are necessary. 2112a8053275Sjv */ 2113a8053275Sjv addrspec = strlen(tabptr->zone_nwif_address); 2114a8053275Sjv physspec = strlen(tabptr->zone_nwif_physical); 211534eb7836Sjv defrouterspec = strlen(tabptr->zone_nwif_defrouter); 2116550b6e40SSowmini Varadhan allowed_addrspec = strlen(tabptr->zone_nwif_allowed_address); 2117550b6e40SSowmini Varadhan if (addrspec != 0 && allowed_addrspec != 0) 2118550b6e40SSowmini Varadhan return (Z_INVAL); /* can't specify both */ 2119550b6e40SSowmini Varadhan if (addrspec == 0 && physspec == 0 && defrouterspec == 0 && 2120550b6e40SSowmini Varadhan allowed_addrspec == 0) 212134eb7836Sjv return (Z_INSUFFICIENT_SPEC); 2122a8053275Sjv 21237c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 21247c478bd9Sstevel@tonic-gate return (err); 21257c478bd9Sstevel@tonic-gate 2126550b6e40SSowmini Varadhan if ((err = zonecfg_get_iptype(handle, &iptype)) != Z_OK) 2127550b6e40SSowmini Varadhan return (err); 212834eb7836Sjv /* 212934eb7836Sjv * Iterate over the configuration's elements and look for net elements 213034eb7836Sjv * that match the query. 213134eb7836Sjv */ 21327c478bd9Sstevel@tonic-gate firstmatch = NULL; 2133a8053275Sjv cur = handle->zone_dh_cur; 21347c478bd9Sstevel@tonic-gate for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 2135a8053275Sjv /* Skip non-net elements */ 21367c478bd9Sstevel@tonic-gate if (xmlStrcmp(cur->name, DTD_ELEM_NET)) 21377c478bd9Sstevel@tonic-gate continue; 2138a8053275Sjv 2139a8053275Sjv /* 214034eb7836Sjv * If any relevant fields don't match the query, then skip 214134eb7836Sjv * the current net element. 2142a8053275Sjv */ 214334eb7836Sjv if (physspec != 0 && (fetchprop(cur, DTD_ATTR_PHYSICAL, 214434eb7836Sjv physical, sizeof (physical)) != Z_OK || 214534eb7836Sjv strcmp(tabptr->zone_nwif_physical, physical) != 0)) 214634eb7836Sjv continue; 2147550b6e40SSowmini Varadhan if (iptype == ZS_SHARED && addrspec != 0 && 2148550b6e40SSowmini Varadhan (fetchprop(cur, DTD_ATTR_ADDRESS, address, 214934eb7836Sjv sizeof (address)) != Z_OK || 215034eb7836Sjv !zonecfg_same_net_address(tabptr->zone_nwif_address, 215134eb7836Sjv address))) 215234eb7836Sjv continue; 2153550b6e40SSowmini Varadhan if (iptype == ZS_EXCLUSIVE && allowed_addrspec != 0 && 2154550b6e40SSowmini Varadhan (fetchprop(cur, DTD_ATTR_ALLOWED_ADDRESS, address, 2155550b6e40SSowmini Varadhan sizeof (address)) != Z_OK || 2156550b6e40SSowmini Varadhan !zonecfg_same_net_address(tabptr->zone_nwif_allowed_address, 2157550b6e40SSowmini Varadhan address))) 2158550b6e40SSowmini Varadhan continue; 215934eb7836Sjv if (defrouterspec != 0 && (fetchprop(cur, DTD_ATTR_DEFROUTER, 216034eb7836Sjv address, sizeof (address)) != Z_OK || 216134eb7836Sjv !zonecfg_same_net_address(tabptr->zone_nwif_defrouter, 216234eb7836Sjv address))) 216334eb7836Sjv continue; 216434eb7836Sjv 216534eb7836Sjv /* 216634eb7836Sjv * The current net element matches the query. Select it if 216734eb7836Sjv * it's the first match; otherwise, abort the search. 216834eb7836Sjv */ 216934eb7836Sjv if (firstmatch == NULL) 217034eb7836Sjv firstmatch = cur; 217134eb7836Sjv else 217234eb7836Sjv return (Z_INSUFFICIENT_SPEC); 21737c478bd9Sstevel@tonic-gate } 21747c478bd9Sstevel@tonic-gate if (firstmatch == NULL) 21757c478bd9Sstevel@tonic-gate return (Z_NO_RESOURCE_ID); 21767c478bd9Sstevel@tonic-gate 21777c478bd9Sstevel@tonic-gate cur = firstmatch; 21787c478bd9Sstevel@tonic-gate 21797c478bd9Sstevel@tonic-gate if ((err = fetchprop(cur, DTD_ATTR_PHYSICAL, tabptr->zone_nwif_physical, 21807c478bd9Sstevel@tonic-gate sizeof (tabptr->zone_nwif_physical))) != Z_OK) 21817c478bd9Sstevel@tonic-gate return (err); 21827c478bd9Sstevel@tonic-gate 2183550b6e40SSowmini Varadhan if (iptype == ZS_SHARED && 2184550b6e40SSowmini Varadhan (err = fetchprop(cur, DTD_ATTR_ADDRESS, tabptr->zone_nwif_address, 21857c478bd9Sstevel@tonic-gate sizeof (tabptr->zone_nwif_address))) != Z_OK) 21867c478bd9Sstevel@tonic-gate return (err); 21877c478bd9Sstevel@tonic-gate 2188550b6e40SSowmini Varadhan if (iptype == ZS_EXCLUSIVE && 2189550b6e40SSowmini Varadhan (err = fetchprop(cur, DTD_ATTR_ALLOWED_ADDRESS, 2190550b6e40SSowmini Varadhan tabptr->zone_nwif_allowed_address, 2191550b6e40SSowmini Varadhan sizeof (tabptr->zone_nwif_allowed_address))) != Z_OK) 2192550b6e40SSowmini Varadhan return (err); 2193550b6e40SSowmini Varadhan 2194de860bd9Sgfaden if ((err = fetchprop(cur, DTD_ATTR_DEFROUTER, 2195de860bd9Sgfaden tabptr->zone_nwif_defrouter, 2196de860bd9Sgfaden sizeof (tabptr->zone_nwif_defrouter))) != Z_OK) 2197de860bd9Sgfaden return (err); 2198de860bd9Sgfaden 21997c478bd9Sstevel@tonic-gate return (Z_OK); 22007c478bd9Sstevel@tonic-gate } 22017c478bd9Sstevel@tonic-gate 22027c478bd9Sstevel@tonic-gate static int 22037c478bd9Sstevel@tonic-gate zonecfg_add_nwif_core(zone_dochandle_t handle, struct zone_nwiftab *tabptr) 22047c478bd9Sstevel@tonic-gate { 22057c478bd9Sstevel@tonic-gate xmlNodePtr newnode, cur = handle->zone_dh_cur; 22067c478bd9Sstevel@tonic-gate int err; 22077c478bd9Sstevel@tonic-gate 22087c478bd9Sstevel@tonic-gate newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_NET, NULL); 2209550b6e40SSowmini Varadhan if (strlen(tabptr->zone_nwif_address) > 0 && 2210550b6e40SSowmini Varadhan (err = newprop(newnode, DTD_ATTR_ADDRESS, 22117c478bd9Sstevel@tonic-gate tabptr->zone_nwif_address)) != Z_OK) 22127c478bd9Sstevel@tonic-gate return (err); 2213550b6e40SSowmini Varadhan if (strlen(tabptr->zone_nwif_allowed_address) > 0 && 2214550b6e40SSowmini Varadhan (err = newprop(newnode, DTD_ATTR_ALLOWED_ADDRESS, 2215550b6e40SSowmini Varadhan tabptr->zone_nwif_allowed_address)) != Z_OK) 2216550b6e40SSowmini Varadhan return (err); 2217a1be23daSdp if ((err = newprop(newnode, DTD_ATTR_PHYSICAL, 22187c478bd9Sstevel@tonic-gate tabptr->zone_nwif_physical)) != Z_OK) 22197c478bd9Sstevel@tonic-gate return (err); 222044ce818bSjparcel /* 222144ce818bSjparcel * Do not add this property when it is not set, for backwards 222244ce818bSjparcel * compatibility and because it is optional. 222344ce818bSjparcel */ 222444ce818bSjparcel if ((strlen(tabptr->zone_nwif_defrouter) > 0) && 222544ce818bSjparcel ((err = newprop(newnode, DTD_ATTR_DEFROUTER, 222644ce818bSjparcel tabptr->zone_nwif_defrouter)) != Z_OK)) 2227de860bd9Sgfaden return (err); 22287c478bd9Sstevel@tonic-gate return (Z_OK); 22297c478bd9Sstevel@tonic-gate } 22307c478bd9Sstevel@tonic-gate 22317c478bd9Sstevel@tonic-gate int 22327c478bd9Sstevel@tonic-gate zonecfg_add_nwif(zone_dochandle_t handle, struct zone_nwiftab *tabptr) 22337c478bd9Sstevel@tonic-gate { 22347c478bd9Sstevel@tonic-gate int err; 22357c478bd9Sstevel@tonic-gate 22367c478bd9Sstevel@tonic-gate if (tabptr == NULL) 22377c478bd9Sstevel@tonic-gate return (Z_INVAL); 22387c478bd9Sstevel@tonic-gate 22397c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 22407c478bd9Sstevel@tonic-gate return (err); 22417c478bd9Sstevel@tonic-gate 22427c478bd9Sstevel@tonic-gate if ((err = zonecfg_add_nwif_core(handle, tabptr)) != Z_OK) 22437c478bd9Sstevel@tonic-gate return (err); 22447c478bd9Sstevel@tonic-gate 22457c478bd9Sstevel@tonic-gate return (Z_OK); 22467c478bd9Sstevel@tonic-gate } 22477c478bd9Sstevel@tonic-gate 22487c478bd9Sstevel@tonic-gate static int 22497c478bd9Sstevel@tonic-gate zonecfg_delete_nwif_core(zone_dochandle_t handle, struct zone_nwiftab *tabptr) 22507c478bd9Sstevel@tonic-gate { 22517c478bd9Sstevel@tonic-gate xmlNodePtr cur = handle->zone_dh_cur; 2252550b6e40SSowmini Varadhan boolean_t addr_match, phys_match, allowed_addr_match; 22537c478bd9Sstevel@tonic-gate 22547c478bd9Sstevel@tonic-gate for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 22557c478bd9Sstevel@tonic-gate if (xmlStrcmp(cur->name, DTD_ELEM_NET)) 22567c478bd9Sstevel@tonic-gate continue; 22577c478bd9Sstevel@tonic-gate 22587c478bd9Sstevel@tonic-gate addr_match = match_prop(cur, DTD_ATTR_ADDRESS, 22597c478bd9Sstevel@tonic-gate tabptr->zone_nwif_address); 2260550b6e40SSowmini Varadhan allowed_addr_match = match_prop(cur, DTD_ATTR_ALLOWED_ADDRESS, 2261550b6e40SSowmini Varadhan tabptr->zone_nwif_allowed_address); 22627c478bd9Sstevel@tonic-gate phys_match = match_prop(cur, DTD_ATTR_PHYSICAL, 22637c478bd9Sstevel@tonic-gate tabptr->zone_nwif_physical); 22647c478bd9Sstevel@tonic-gate 22655e74f94dSGary Mills if (addr_match && allowed_addr_match && phys_match) { 22667c478bd9Sstevel@tonic-gate xmlUnlinkNode(cur); 22677c478bd9Sstevel@tonic-gate xmlFreeNode(cur); 22687c478bd9Sstevel@tonic-gate return (Z_OK); 22697c478bd9Sstevel@tonic-gate } 22707c478bd9Sstevel@tonic-gate } 22717c478bd9Sstevel@tonic-gate return (Z_NO_RESOURCE_ID); 22727c478bd9Sstevel@tonic-gate } 22737c478bd9Sstevel@tonic-gate 22747c478bd9Sstevel@tonic-gate int 22757c478bd9Sstevel@tonic-gate zonecfg_delete_nwif(zone_dochandle_t handle, struct zone_nwiftab *tabptr) 22767c478bd9Sstevel@tonic-gate { 22777c478bd9Sstevel@tonic-gate int err; 22787c478bd9Sstevel@tonic-gate 22797c478bd9Sstevel@tonic-gate if (tabptr == NULL) 22807c478bd9Sstevel@tonic-gate return (Z_INVAL); 22817c478bd9Sstevel@tonic-gate 22827c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 22837c478bd9Sstevel@tonic-gate return (err); 22847c478bd9Sstevel@tonic-gate 22857c478bd9Sstevel@tonic-gate if ((err = zonecfg_delete_nwif_core(handle, tabptr)) != Z_OK) 22867c478bd9Sstevel@tonic-gate return (err); 22877c478bd9Sstevel@tonic-gate 22887c478bd9Sstevel@tonic-gate return (Z_OK); 22897c478bd9Sstevel@tonic-gate } 22907c478bd9Sstevel@tonic-gate 22917c478bd9Sstevel@tonic-gate int 22927c478bd9Sstevel@tonic-gate zonecfg_modify_nwif( 22937c478bd9Sstevel@tonic-gate zone_dochandle_t handle, 22947c478bd9Sstevel@tonic-gate struct zone_nwiftab *oldtabptr, 22957c478bd9Sstevel@tonic-gate struct zone_nwiftab *newtabptr) 22967c478bd9Sstevel@tonic-gate { 22977c478bd9Sstevel@tonic-gate int err; 22987c478bd9Sstevel@tonic-gate 22997c478bd9Sstevel@tonic-gate if (oldtabptr == NULL || newtabptr == NULL) 23007c478bd9Sstevel@tonic-gate return (Z_INVAL); 23017c478bd9Sstevel@tonic-gate 23027c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 23037c478bd9Sstevel@tonic-gate return (err); 23047c478bd9Sstevel@tonic-gate 23057c478bd9Sstevel@tonic-gate if ((err = zonecfg_delete_nwif_core(handle, oldtabptr)) != Z_OK) 23067c478bd9Sstevel@tonic-gate return (err); 23077c478bd9Sstevel@tonic-gate 23087c478bd9Sstevel@tonic-gate if ((err = zonecfg_add_nwif_core(handle, newtabptr)) != Z_OK) 23097c478bd9Sstevel@tonic-gate return (err); 23107c478bd9Sstevel@tonic-gate 23117c478bd9Sstevel@tonic-gate return (Z_OK); 23127c478bd9Sstevel@tonic-gate } 23137c478bd9Sstevel@tonic-gate 23145679c89fSjv /* 23150fbb751dSJohn Levon * Must be a comma-separated list of alpha-numeric file system names. 23165679c89fSjv */ 23170fbb751dSJohn Levon static int 23180fbb751dSJohn Levon zonecfg_valid_fs_allowed(const char *fsallowedp) 23190fbb751dSJohn Levon { 23200fbb751dSJohn Levon char tmp[ZONE_FS_ALLOWED_MAX]; 23210fbb751dSJohn Levon char *cp = tmp; 23220fbb751dSJohn Levon char *p; 23230fbb751dSJohn Levon 23240fbb751dSJohn Levon if (strlen(fsallowedp) > ZONE_FS_ALLOWED_MAX) 23250fbb751dSJohn Levon return (Z_TOO_BIG); 23260fbb751dSJohn Levon 23270fbb751dSJohn Levon (void) strlcpy(tmp, fsallowedp, sizeof (tmp)); 23280fbb751dSJohn Levon 23290fbb751dSJohn Levon while (*cp != '\0') { 23300fbb751dSJohn Levon p = cp; 23310fbb751dSJohn Levon while (*p != '\0' && *p != ',') { 23328cd81a20SJerry Jelinek if (!isalnum(*p) && *p != '-') 23330fbb751dSJohn Levon return (Z_INVALID_PROPERTY); 23340fbb751dSJohn Levon p++; 23350fbb751dSJohn Levon } 23360fbb751dSJohn Levon 23370fbb751dSJohn Levon if (*p == ',') { 23380fbb751dSJohn Levon if (p == cp) 23390fbb751dSJohn Levon return (Z_INVALID_PROPERTY); 23400fbb751dSJohn Levon 23410fbb751dSJohn Levon p++; 23420fbb751dSJohn Levon 23430fbb751dSJohn Levon if (*p == '\0') 23440fbb751dSJohn Levon return (Z_INVALID_PROPERTY); 23450fbb751dSJohn Levon } 23460fbb751dSJohn Levon 23470fbb751dSJohn Levon cp = p; 23480fbb751dSJohn Levon } 23490fbb751dSJohn Levon 23500fbb751dSJohn Levon return (Z_OK); 23510fbb751dSJohn Levon } 23520fbb751dSJohn Levon 23535679c89fSjv int 23540fbb751dSJohn Levon zonecfg_get_fs_allowed(zone_dochandle_t handle, char *bufp, size_t buflen) 23555679c89fSjv { 23565679c89fSjv int err; 23575679c89fSjv 23580fbb751dSJohn Levon if ((err = getrootattr(handle, DTD_ATTR_FS_ALLOWED, 23590fbb751dSJohn Levon bufp, buflen)) != Z_OK) 23605679c89fSjv return (err); 23615679c89fSjv if (bufp[0] == '\0') 23625679c89fSjv return (Z_BAD_PROPERTY); 23630fbb751dSJohn Levon return (zonecfg_valid_fs_allowed(bufp)); 23645679c89fSjv } 23655679c89fSjv 23665679c89fSjv int 23670fbb751dSJohn Levon zonecfg_set_fs_allowed(zone_dochandle_t handle, const char *bufp) 23685679c89fSjv { 23695679c89fSjv int err; 23705679c89fSjv 23710fbb751dSJohn Levon if (bufp == NULL || (err = zonecfg_valid_fs_allowed(bufp)) == Z_OK) 23720fbb751dSJohn Levon return (setrootattr(handle, DTD_ATTR_FS_ALLOWED, bufp)); 23735679c89fSjv return (err); 23745679c89fSjv } 23755679c89fSjv 23765679c89fSjv /* 23775679c89fSjv * Determines if the specified string is a valid hostid string. This function 23785679c89fSjv * returns Z_OK if the string is a valid hostid string. It returns Z_INVAL if 23795679c89fSjv * 'hostidp' is NULL, Z_TOO_BIG if 'hostidp' refers to a string buffer 23800fbb751dSJohn Levon * containing a hex string with more than 8 digits, and Z_INVALID_PROPERTY if 23810fbb751dSJohn Levon * the string has an invalid format. 23825679c89fSjv */ 23830fbb751dSJohn Levon static int 23845679c89fSjv zonecfg_valid_hostid(const char *hostidp) 23855679c89fSjv { 23865679c89fSjv char *currentp; 23875679c89fSjv u_longlong_t hostidval; 23885679c89fSjv size_t len; 23895679c89fSjv 23905679c89fSjv if (hostidp == NULL) 23915679c89fSjv return (Z_INVAL); 23925679c89fSjv 23935679c89fSjv /* Empty strings and strings with whitespace are invalid. */ 23945679c89fSjv if (*hostidp == '\0') 23950fbb751dSJohn Levon return (Z_INVALID_PROPERTY); 23965679c89fSjv for (currentp = (char *)hostidp; *currentp != '\0'; ++currentp) { 23975679c89fSjv if (isspace(*currentp)) 23980fbb751dSJohn Levon return (Z_INVALID_PROPERTY); 23995679c89fSjv } 24005679c89fSjv len = (size_t)(currentp - hostidp); 24015679c89fSjv 24025679c89fSjv /* 24035679c89fSjv * The caller might pass a hostid that is larger than the maximum 24045679c89fSjv * unsigned 32-bit integral value. Check for this! Also, make sure 24055679c89fSjv * that the whole string is converted (this helps us find illegal 24065679c89fSjv * characters) and that the whole string fits within a buffer of size 24075679c89fSjv * HW_HOSTID_LEN. 24085679c89fSjv */ 24095679c89fSjv currentp = (char *)hostidp; 24105679c89fSjv if (strncmp(hostidp, "0x", 2) == 0 || strncmp(hostidp, "0X", 2) == 0) 24115679c89fSjv currentp += 2; 24125679c89fSjv hostidval = strtoull(currentp, ¤tp, 16); 24135679c89fSjv if ((size_t)(currentp - hostidp) >= HW_HOSTID_LEN) 24145679c89fSjv return (Z_TOO_BIG); 24155679c89fSjv if (hostidval > UINT_MAX || hostidval == HW_INVALID_HOSTID || 24165679c89fSjv currentp != hostidp + len) 24170fbb751dSJohn Levon return (Z_INVALID_PROPERTY); 24185679c89fSjv return (Z_OK); 24195679c89fSjv } 24205679c89fSjv 24210fbb751dSJohn Levon /* 24220fbb751dSJohn Levon * Gets the zone hostid string stored in the specified zone configuration 24230fbb751dSJohn Levon * document. This function returns Z_OK on success. Z_BAD_PROPERTY is returned 24240fbb751dSJohn Levon * if the config file doesn't specify a hostid or if the hostid is blank. 24250fbb751dSJohn Levon * 24260fbb751dSJohn Levon * Note that buflen should be at least HW_HOSTID_LEN. 24270fbb751dSJohn Levon */ 24280fbb751dSJohn Levon int 24290fbb751dSJohn Levon zonecfg_get_hostid(zone_dochandle_t handle, char *bufp, size_t buflen) 24300fbb751dSJohn Levon { 24310fbb751dSJohn Levon int err; 24320fbb751dSJohn Levon 24330fbb751dSJohn Levon if ((err = getrootattr(handle, DTD_ATTR_HOSTID, bufp, buflen)) != Z_OK) 24340fbb751dSJohn Levon return (err); 24350fbb751dSJohn Levon if (bufp[0] == '\0') 24360fbb751dSJohn Levon return (Z_BAD_PROPERTY); 24370fbb751dSJohn Levon return (zonecfg_valid_hostid(bufp)); 24380fbb751dSJohn Levon } 24390fbb751dSJohn Levon 24400fbb751dSJohn Levon /* 24410fbb751dSJohn Levon * Sets the hostid string in the specified zone config document to the given 24420fbb751dSJohn Levon * string value. If 'hostidp' is NULL, then the config document's hostid 24430fbb751dSJohn Levon * attribute is cleared. Non-NULL hostids are validated. This function returns 24440fbb751dSJohn Levon * Z_OK on success. Any other return value indicates failure. 24450fbb751dSJohn Levon */ 24460fbb751dSJohn Levon int 24470fbb751dSJohn Levon zonecfg_set_hostid(zone_dochandle_t handle, const char *hostidp) 24480fbb751dSJohn Levon { 24490fbb751dSJohn Levon int err; 24500fbb751dSJohn Levon 24510fbb751dSJohn Levon /* 24520fbb751dSJohn Levon * A NULL hostid string is interpreted as a request to clear the 24530fbb751dSJohn Levon * hostid. 24540fbb751dSJohn Levon */ 24550fbb751dSJohn Levon if (hostidp == NULL || (err = zonecfg_valid_hostid(hostidp)) == Z_OK) 24560fbb751dSJohn Levon return (setrootattr(handle, DTD_ATTR_HOSTID, hostidp)); 24570fbb751dSJohn Levon return (err); 24580fbb751dSJohn Levon } 24590fbb751dSJohn Levon 24607c478bd9Sstevel@tonic-gate int 24617c478bd9Sstevel@tonic-gate zonecfg_lookup_dev(zone_dochandle_t handle, struct zone_devtab *tabptr) 24627c478bd9Sstevel@tonic-gate { 24637c478bd9Sstevel@tonic-gate xmlNodePtr cur, firstmatch; 24647c478bd9Sstevel@tonic-gate int err; 24657c478bd9Sstevel@tonic-gate char match[MAXPATHLEN]; 24667c478bd9Sstevel@tonic-gate 24677c478bd9Sstevel@tonic-gate if (tabptr == NULL) 24687c478bd9Sstevel@tonic-gate return (Z_INVAL); 24697c478bd9Sstevel@tonic-gate 24707c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 24717c478bd9Sstevel@tonic-gate return (err); 24727c478bd9Sstevel@tonic-gate 24737c478bd9Sstevel@tonic-gate cur = handle->zone_dh_cur; 24747c478bd9Sstevel@tonic-gate firstmatch = NULL; 24757c478bd9Sstevel@tonic-gate for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 24767c478bd9Sstevel@tonic-gate if (xmlStrcmp(cur->name, DTD_ELEM_DEVICE)) 24777c478bd9Sstevel@tonic-gate continue; 24787c478bd9Sstevel@tonic-gate if (strlen(tabptr->zone_dev_match) == 0) 24797c478bd9Sstevel@tonic-gate continue; 24807c478bd9Sstevel@tonic-gate 24817c478bd9Sstevel@tonic-gate if ((fetchprop(cur, DTD_ATTR_MATCH, match, 24827c478bd9Sstevel@tonic-gate sizeof (match)) == Z_OK)) { 24837c478bd9Sstevel@tonic-gate if (strcmp(tabptr->zone_dev_match, 24847c478bd9Sstevel@tonic-gate match) == 0) { 24857c478bd9Sstevel@tonic-gate if (firstmatch == NULL) 24867c478bd9Sstevel@tonic-gate firstmatch = cur; 24877c478bd9Sstevel@tonic-gate else if (firstmatch != cur) 24887c478bd9Sstevel@tonic-gate return (Z_INSUFFICIENT_SPEC); 24897c478bd9Sstevel@tonic-gate } else { 24907c478bd9Sstevel@tonic-gate /* 24917c478bd9Sstevel@tonic-gate * If another property matched but this 24927c478bd9Sstevel@tonic-gate * one doesn't then reset firstmatch. 24937c478bd9Sstevel@tonic-gate */ 24947c478bd9Sstevel@tonic-gate if (firstmatch == cur) 24957c478bd9Sstevel@tonic-gate firstmatch = NULL; 24967c478bd9Sstevel@tonic-gate } 24977c478bd9Sstevel@tonic-gate } 24987c478bd9Sstevel@tonic-gate } 24997c478bd9Sstevel@tonic-gate if (firstmatch == NULL) 25007c478bd9Sstevel@tonic-gate return (Z_NO_RESOURCE_ID); 25017c478bd9Sstevel@tonic-gate 25027c478bd9Sstevel@tonic-gate cur = firstmatch; 25037c478bd9Sstevel@tonic-gate 25047c478bd9Sstevel@tonic-gate if ((err = fetchprop(cur, DTD_ATTR_MATCH, tabptr->zone_dev_match, 25057c478bd9Sstevel@tonic-gate sizeof (tabptr->zone_dev_match))) != Z_OK) 25067c478bd9Sstevel@tonic-gate return (err); 25077c478bd9Sstevel@tonic-gate 25087c478bd9Sstevel@tonic-gate return (Z_OK); 25097c478bd9Sstevel@tonic-gate } 25107c478bd9Sstevel@tonic-gate 25117c478bd9Sstevel@tonic-gate static int 25127c478bd9Sstevel@tonic-gate zonecfg_add_dev_core(zone_dochandle_t handle, struct zone_devtab *tabptr) 25137c478bd9Sstevel@tonic-gate { 25147c478bd9Sstevel@tonic-gate xmlNodePtr newnode, cur = handle->zone_dh_cur; 25157c478bd9Sstevel@tonic-gate int err; 25167c478bd9Sstevel@tonic-gate 25177c478bd9Sstevel@tonic-gate newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_DEVICE, NULL); 25187c478bd9Sstevel@tonic-gate 2519a1be23daSdp if ((err = newprop(newnode, DTD_ATTR_MATCH, 25207c478bd9Sstevel@tonic-gate tabptr->zone_dev_match)) != Z_OK) 25217c478bd9Sstevel@tonic-gate return (err); 25227c478bd9Sstevel@tonic-gate 25237c478bd9Sstevel@tonic-gate return (Z_OK); 25247c478bd9Sstevel@tonic-gate } 25257c478bd9Sstevel@tonic-gate 25267c478bd9Sstevel@tonic-gate int 25277c478bd9Sstevel@tonic-gate zonecfg_add_dev(zone_dochandle_t handle, struct zone_devtab *tabptr) 25287c478bd9Sstevel@tonic-gate { 25297c478bd9Sstevel@tonic-gate int err; 25307c478bd9Sstevel@tonic-gate 25317c478bd9Sstevel@tonic-gate if (tabptr == NULL) 25327c478bd9Sstevel@tonic-gate return (Z_INVAL); 25337c478bd9Sstevel@tonic-gate 25347c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 25357c478bd9Sstevel@tonic-gate return (err); 25367c478bd9Sstevel@tonic-gate 25377c478bd9Sstevel@tonic-gate if ((err = zonecfg_add_dev_core(handle, tabptr)) != Z_OK) 25387c478bd9Sstevel@tonic-gate return (err); 25397c478bd9Sstevel@tonic-gate 25407c478bd9Sstevel@tonic-gate return (Z_OK); 25417c478bd9Sstevel@tonic-gate } 25427c478bd9Sstevel@tonic-gate 25437c478bd9Sstevel@tonic-gate static int 25447c478bd9Sstevel@tonic-gate zonecfg_delete_dev_core(zone_dochandle_t handle, struct zone_devtab *tabptr) 25457c478bd9Sstevel@tonic-gate { 2546facf4a8dSllai xmlNodePtr cur = handle->zone_dh_cur; 25477c478bd9Sstevel@tonic-gate int match_match; 25487c478bd9Sstevel@tonic-gate 25497c478bd9Sstevel@tonic-gate for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 25507c478bd9Sstevel@tonic-gate if (xmlStrcmp(cur->name, DTD_ELEM_DEVICE)) 25517c478bd9Sstevel@tonic-gate continue; 25527c478bd9Sstevel@tonic-gate 25537c478bd9Sstevel@tonic-gate match_match = match_prop(cur, DTD_ATTR_MATCH, 25547c478bd9Sstevel@tonic-gate tabptr->zone_dev_match); 25557c478bd9Sstevel@tonic-gate 25567c478bd9Sstevel@tonic-gate if (match_match) { 25577c478bd9Sstevel@tonic-gate xmlUnlinkNode(cur); 25587c478bd9Sstevel@tonic-gate xmlFreeNode(cur); 25597c478bd9Sstevel@tonic-gate return (Z_OK); 25607c478bd9Sstevel@tonic-gate } 25617c478bd9Sstevel@tonic-gate } 25627c478bd9Sstevel@tonic-gate return (Z_NO_RESOURCE_ID); 25637c478bd9Sstevel@tonic-gate } 25647c478bd9Sstevel@tonic-gate 25657c478bd9Sstevel@tonic-gate int 25667c478bd9Sstevel@tonic-gate zonecfg_delete_dev(zone_dochandle_t handle, struct zone_devtab *tabptr) 25677c478bd9Sstevel@tonic-gate { 25687c478bd9Sstevel@tonic-gate int err; 25697c478bd9Sstevel@tonic-gate 25707c478bd9Sstevel@tonic-gate if (tabptr == NULL) 25717c478bd9Sstevel@tonic-gate return (Z_INVAL); 25727c478bd9Sstevel@tonic-gate 25737c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 25747c478bd9Sstevel@tonic-gate return (err); 25757c478bd9Sstevel@tonic-gate 25767c478bd9Sstevel@tonic-gate if ((err = zonecfg_delete_dev_core(handle, tabptr)) != Z_OK) 25777c478bd9Sstevel@tonic-gate return (err); 25787c478bd9Sstevel@tonic-gate 25797c478bd9Sstevel@tonic-gate return (Z_OK); 25807c478bd9Sstevel@tonic-gate } 25817c478bd9Sstevel@tonic-gate 25827c478bd9Sstevel@tonic-gate int 25837c478bd9Sstevel@tonic-gate zonecfg_modify_dev( 25847c478bd9Sstevel@tonic-gate zone_dochandle_t handle, 25857c478bd9Sstevel@tonic-gate struct zone_devtab *oldtabptr, 25867c478bd9Sstevel@tonic-gate struct zone_devtab *newtabptr) 25877c478bd9Sstevel@tonic-gate { 25887c478bd9Sstevel@tonic-gate int err; 25897c478bd9Sstevel@tonic-gate 25907c478bd9Sstevel@tonic-gate if (oldtabptr == NULL || newtabptr == NULL) 25917c478bd9Sstevel@tonic-gate return (Z_INVAL); 25927c478bd9Sstevel@tonic-gate 25937c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 25947c478bd9Sstevel@tonic-gate return (err); 25957c478bd9Sstevel@tonic-gate 25967c478bd9Sstevel@tonic-gate if ((err = zonecfg_delete_dev_core(handle, oldtabptr)) != Z_OK) 25977c478bd9Sstevel@tonic-gate return (err); 25987c478bd9Sstevel@tonic-gate 25997c478bd9Sstevel@tonic-gate if ((err = zonecfg_add_dev_core(handle, newtabptr)) != Z_OK) 26007c478bd9Sstevel@tonic-gate return (err); 26017c478bd9Sstevel@tonic-gate 26027c478bd9Sstevel@tonic-gate return (Z_OK); 26037c478bd9Sstevel@tonic-gate } 26047c478bd9Sstevel@tonic-gate 2605cb8a054bSGlenn Faden static int 2606cb8a054bSGlenn Faden zonecfg_add_auth_core(zone_dochandle_t handle, struct zone_admintab *tabptr, 2607cb8a054bSGlenn Faden char *zonename) 2608cb8a054bSGlenn Faden { 2609cb8a054bSGlenn Faden xmlNodePtr newnode, cur = handle->zone_dh_cur; 2610cb8a054bSGlenn Faden int err; 2611cb8a054bSGlenn Faden 2612cb8a054bSGlenn Faden newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_ADMIN, NULL); 2613cb8a054bSGlenn Faden err = newprop(newnode, DTD_ATTR_USER, tabptr->zone_admin_user); 2614cb8a054bSGlenn Faden if (err != Z_OK) 2615cb8a054bSGlenn Faden return (err); 2616cb8a054bSGlenn Faden err = newprop(newnode, DTD_ATTR_AUTHS, tabptr->zone_admin_auths); 2617cb8a054bSGlenn Faden if (err != Z_OK) 2618cb8a054bSGlenn Faden return (err); 2619cb8a054bSGlenn Faden if ((err = zonecfg_remove_userauths( 2620cb8a054bSGlenn Faden handle, tabptr->zone_admin_user, zonename, B_FALSE)) != Z_OK) 2621cb8a054bSGlenn Faden return (err); 2622cb8a054bSGlenn Faden return (Z_OK); 2623cb8a054bSGlenn Faden } 2624cb8a054bSGlenn Faden 2625cb8a054bSGlenn Faden int 2626cb8a054bSGlenn Faden zonecfg_add_admin(zone_dochandle_t handle, struct zone_admintab *tabptr, 2627cb8a054bSGlenn Faden char *zonename) 2628cb8a054bSGlenn Faden { 2629cb8a054bSGlenn Faden int err; 2630cb8a054bSGlenn Faden 2631cb8a054bSGlenn Faden if (tabptr == NULL) 2632cb8a054bSGlenn Faden return (Z_INVAL); 2633cb8a054bSGlenn Faden 2634cb8a054bSGlenn Faden if ((err = operation_prep(handle)) != Z_OK) 2635cb8a054bSGlenn Faden return (err); 2636cb8a054bSGlenn Faden 2637cb8a054bSGlenn Faden if ((err = zonecfg_add_auth_core(handle, tabptr, 2638cb8a054bSGlenn Faden zonename)) != Z_OK) 2639cb8a054bSGlenn Faden return (err); 2640cb8a054bSGlenn Faden 2641cb8a054bSGlenn Faden return (Z_OK); 2642cb8a054bSGlenn Faden } 2643*d2a70789SRichard Lowe 2644cb8a054bSGlenn Faden static int 2645cb8a054bSGlenn Faden zonecfg_delete_auth_core(zone_dochandle_t handle, struct zone_admintab *tabptr, 2646cb8a054bSGlenn Faden char *zonename) 2647cb8a054bSGlenn Faden { 2648cb8a054bSGlenn Faden xmlNodePtr cur = handle->zone_dh_cur; 2649cb8a054bSGlenn Faden boolean_t auth_match; 2650cb8a054bSGlenn Faden int err; 2651cb8a054bSGlenn Faden 2652cb8a054bSGlenn Faden for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 2653cb8a054bSGlenn Faden if (xmlStrcmp(cur->name, DTD_ELEM_ADMIN)) 2654cb8a054bSGlenn Faden continue; 2655cb8a054bSGlenn Faden auth_match = match_prop(cur, DTD_ATTR_USER, 2656cb8a054bSGlenn Faden tabptr->zone_admin_user); 2657cb8a054bSGlenn Faden if (auth_match) { 2658cb8a054bSGlenn Faden if ((err = zonecfg_insert_userauths( 2659cb8a054bSGlenn Faden handle, tabptr->zone_admin_user, 2660cb8a054bSGlenn Faden zonename)) != Z_OK) 2661cb8a054bSGlenn Faden return (err); 2662cb8a054bSGlenn Faden xmlUnlinkNode(cur); 2663cb8a054bSGlenn Faden xmlFreeNode(cur); 2664cb8a054bSGlenn Faden return (Z_OK); 2665cb8a054bSGlenn Faden } 2666cb8a054bSGlenn Faden } 2667cb8a054bSGlenn Faden return (Z_NO_RESOURCE_ID); 2668cb8a054bSGlenn Faden } 2669cb8a054bSGlenn Faden 2670cb8a054bSGlenn Faden int 2671cb8a054bSGlenn Faden zonecfg_delete_admin(zone_dochandle_t handle, struct zone_admintab *tabptr, 2672cb8a054bSGlenn Faden char *zonename) 2673cb8a054bSGlenn Faden { 2674cb8a054bSGlenn Faden int err; 2675cb8a054bSGlenn Faden 2676cb8a054bSGlenn Faden if (tabptr == NULL) 2677cb8a054bSGlenn Faden return (Z_INVAL); 2678cb8a054bSGlenn Faden 2679cb8a054bSGlenn Faden if ((err = operation_prep(handle)) != Z_OK) 2680cb8a054bSGlenn Faden return (err); 2681cb8a054bSGlenn Faden 2682cb8a054bSGlenn Faden if ((err = zonecfg_delete_auth_core(handle, tabptr, zonename)) != Z_OK) 2683cb8a054bSGlenn Faden return (err); 2684cb8a054bSGlenn Faden 2685cb8a054bSGlenn Faden return (Z_OK); 2686cb8a054bSGlenn Faden } 2687cb8a054bSGlenn Faden 2688cb8a054bSGlenn Faden int 2689cb8a054bSGlenn Faden zonecfg_modify_admin(zone_dochandle_t handle, struct zone_admintab *oldtabptr, 2690cb8a054bSGlenn Faden struct zone_admintab *newtabptr, char *zonename) 2691cb8a054bSGlenn Faden { 2692cb8a054bSGlenn Faden int err; 2693cb8a054bSGlenn Faden 2694cb8a054bSGlenn Faden if (oldtabptr == NULL || newtabptr == NULL) 2695cb8a054bSGlenn Faden return (Z_INVAL); 2696cb8a054bSGlenn Faden 2697cb8a054bSGlenn Faden if ((err = operation_prep(handle)) != Z_OK) 2698cb8a054bSGlenn Faden return (err); 2699cb8a054bSGlenn Faden 2700cb8a054bSGlenn Faden if ((err = zonecfg_delete_auth_core(handle, oldtabptr, zonename)) 2701cb8a054bSGlenn Faden != Z_OK) 2702cb8a054bSGlenn Faden return (err); 2703cb8a054bSGlenn Faden 2704cb8a054bSGlenn Faden if ((err = zonecfg_add_auth_core(handle, newtabptr, 2705cb8a054bSGlenn Faden zonename)) != Z_OK) 2706cb8a054bSGlenn Faden return (err); 2707cb8a054bSGlenn Faden 2708cb8a054bSGlenn Faden return (Z_OK); 2709cb8a054bSGlenn Faden } 2710cb8a054bSGlenn Faden 2711cb8a054bSGlenn Faden int 2712cb8a054bSGlenn Faden zonecfg_lookup_admin(zone_dochandle_t handle, struct zone_admintab *tabptr) 2713cb8a054bSGlenn Faden { 2714cb8a054bSGlenn Faden xmlNodePtr cur, firstmatch; 2715cb8a054bSGlenn Faden int err; 2716cb8a054bSGlenn Faden char user[MAXUSERNAME]; 2717cb8a054bSGlenn Faden 2718cb8a054bSGlenn Faden if (tabptr == NULL) 2719cb8a054bSGlenn Faden return (Z_INVAL); 2720cb8a054bSGlenn Faden 2721cb8a054bSGlenn Faden if ((err = operation_prep(handle)) != Z_OK) 2722cb8a054bSGlenn Faden return (err); 2723cb8a054bSGlenn Faden 2724cb8a054bSGlenn Faden cur = handle->zone_dh_cur; 2725cb8a054bSGlenn Faden firstmatch = NULL; 2726cb8a054bSGlenn Faden for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 2727cb8a054bSGlenn Faden if (xmlStrcmp(cur->name, DTD_ELEM_ADMIN)) 2728cb8a054bSGlenn Faden continue; 2729cb8a054bSGlenn Faden if (strlen(tabptr->zone_admin_user) > 0) { 2730cb8a054bSGlenn Faden if ((fetchprop(cur, DTD_ATTR_USER, user, 2731cb8a054bSGlenn Faden sizeof (user)) == Z_OK) && 2732cb8a054bSGlenn Faden (strcmp(tabptr->zone_admin_user, user) == 0)) { 2733cb8a054bSGlenn Faden if (firstmatch == NULL) 2734cb8a054bSGlenn Faden firstmatch = cur; 2735cb8a054bSGlenn Faden else 2736cb8a054bSGlenn Faden return (Z_INSUFFICIENT_SPEC); 2737cb8a054bSGlenn Faden } 2738cb8a054bSGlenn Faden } 2739cb8a054bSGlenn Faden } 2740cb8a054bSGlenn Faden if (firstmatch == NULL) 2741cb8a054bSGlenn Faden return (Z_NO_RESOURCE_ID); 2742cb8a054bSGlenn Faden 2743cb8a054bSGlenn Faden cur = firstmatch; 2744cb8a054bSGlenn Faden 2745cb8a054bSGlenn Faden if ((err = fetchprop(cur, DTD_ATTR_USER, tabptr->zone_admin_user, 2746cb8a054bSGlenn Faden sizeof (tabptr->zone_admin_user))) != Z_OK) 2747cb8a054bSGlenn Faden return (err); 2748cb8a054bSGlenn Faden 2749cb8a054bSGlenn Faden if ((err = fetchprop(cur, DTD_ATTR_AUTHS, tabptr->zone_admin_auths, 2750cb8a054bSGlenn Faden sizeof (tabptr->zone_admin_auths))) != Z_OK) 2751cb8a054bSGlenn Faden return (err); 2752cb8a054bSGlenn Faden 2753cb8a054bSGlenn Faden return (Z_OK); 2754cb8a054bSGlenn Faden } 2755cb8a054bSGlenn Faden 2756*d2a70789SRichard Lowe static int 2757*d2a70789SRichard Lowe zonecfg_add_secflags_core(zone_dochandle_t handle, 2758*d2a70789SRichard Lowe struct zone_secflagstab *tabptr) 2759*d2a70789SRichard Lowe { 2760*d2a70789SRichard Lowe xmlNodePtr newnode, cur = handle->zone_dh_cur; 2761*d2a70789SRichard Lowe int err; 2762*d2a70789SRichard Lowe 2763*d2a70789SRichard Lowe newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_SECFLAGS, NULL); 2764*d2a70789SRichard Lowe err = newprop(newnode, DTD_ATTR_DEFAULT, tabptr->zone_secflags_default); 2765*d2a70789SRichard Lowe if (err != Z_OK) 2766*d2a70789SRichard Lowe return (err); 2767*d2a70789SRichard Lowe err = newprop(newnode, DTD_ATTR_LOWER, tabptr->zone_secflags_lower); 2768*d2a70789SRichard Lowe if (err != Z_OK) 2769*d2a70789SRichard Lowe return (err); 2770*d2a70789SRichard Lowe err = newprop(newnode, DTD_ATTR_UPPER, tabptr->zone_secflags_upper); 2771*d2a70789SRichard Lowe if (err != Z_OK) 2772*d2a70789SRichard Lowe return (err); 2773*d2a70789SRichard Lowe 2774*d2a70789SRichard Lowe return (Z_OK); 2775*d2a70789SRichard Lowe } 2776*d2a70789SRichard Lowe 2777*d2a70789SRichard Lowe int 2778*d2a70789SRichard Lowe zonecfg_add_secflags(zone_dochandle_t handle, struct zone_secflagstab *tabptr) 2779*d2a70789SRichard Lowe { 2780*d2a70789SRichard Lowe int err; 2781*d2a70789SRichard Lowe 2782*d2a70789SRichard Lowe 2783*d2a70789SRichard Lowe if (tabptr == NULL) 2784*d2a70789SRichard Lowe return (Z_INVAL); 2785*d2a70789SRichard Lowe 2786*d2a70789SRichard Lowe if ((err = operation_prep(handle)) != Z_OK) 2787*d2a70789SRichard Lowe return (err); 2788*d2a70789SRichard Lowe 2789*d2a70789SRichard Lowe if ((err = zonecfg_add_secflags_core(handle, tabptr)) != Z_OK) 2790*d2a70789SRichard Lowe return (err); 2791*d2a70789SRichard Lowe 2792*d2a70789SRichard Lowe return (Z_OK); 2793*d2a70789SRichard Lowe } 2794*d2a70789SRichard Lowe 2795*d2a70789SRichard Lowe static int 2796*d2a70789SRichard Lowe zonecfg_delete_secflags_core(zone_dochandle_t handle, 2797*d2a70789SRichard Lowe struct zone_secflagstab *tabptr) 2798*d2a70789SRichard Lowe { 2799*d2a70789SRichard Lowe xmlNodePtr cur = handle->zone_dh_cur; 2800*d2a70789SRichard Lowe boolean_t def_match, low_match, up_match; 2801*d2a70789SRichard Lowe 2802*d2a70789SRichard Lowe for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 2803*d2a70789SRichard Lowe if (xmlStrcmp(cur->name, DTD_ELEM_SECFLAGS) != 0) 2804*d2a70789SRichard Lowe continue; 2805*d2a70789SRichard Lowe 2806*d2a70789SRichard Lowe def_match = match_prop(cur, DTD_ATTR_DEFAULT, 2807*d2a70789SRichard Lowe tabptr->zone_secflags_default); 2808*d2a70789SRichard Lowe low_match = match_prop(cur, DTD_ATTR_LOWER, 2809*d2a70789SRichard Lowe tabptr->zone_secflags_lower); 2810*d2a70789SRichard Lowe up_match = match_prop(cur, DTD_ATTR_UPPER, 2811*d2a70789SRichard Lowe tabptr->zone_secflags_upper); 2812*d2a70789SRichard Lowe 2813*d2a70789SRichard Lowe if (def_match && low_match && up_match) { 2814*d2a70789SRichard Lowe xmlUnlinkNode(cur); 2815*d2a70789SRichard Lowe xmlFreeNode(cur); 2816*d2a70789SRichard Lowe return (Z_OK); 2817*d2a70789SRichard Lowe } 2818*d2a70789SRichard Lowe 2819*d2a70789SRichard Lowe } 2820*d2a70789SRichard Lowe return (Z_NO_RESOURCE_ID); 2821*d2a70789SRichard Lowe } 2822*d2a70789SRichard Lowe 2823*d2a70789SRichard Lowe int 2824*d2a70789SRichard Lowe zonecfg_delete_secflags(zone_dochandle_t handle, 2825*d2a70789SRichard Lowe struct zone_secflagstab *tabptr) 2826*d2a70789SRichard Lowe { 2827*d2a70789SRichard Lowe int err; 2828*d2a70789SRichard Lowe 2829*d2a70789SRichard Lowe if (tabptr == NULL) 2830*d2a70789SRichard Lowe return (Z_INVAL); 2831*d2a70789SRichard Lowe 2832*d2a70789SRichard Lowe if ((err = operation_prep(handle)) != Z_OK) 2833*d2a70789SRichard Lowe return (err); 2834*d2a70789SRichard Lowe 2835*d2a70789SRichard Lowe if ((err = zonecfg_delete_secflags_core(handle, tabptr)) != Z_OK) 2836*d2a70789SRichard Lowe return (err); 2837*d2a70789SRichard Lowe 2838*d2a70789SRichard Lowe return (Z_OK); 2839*d2a70789SRichard Lowe } 2840*d2a70789SRichard Lowe 2841*d2a70789SRichard Lowe int 2842*d2a70789SRichard Lowe zonecfg_modify_secflags(zone_dochandle_t handle, 2843*d2a70789SRichard Lowe struct zone_secflagstab *oldtabptr, 2844*d2a70789SRichard Lowe struct zone_secflagstab *newtabptr) 2845*d2a70789SRichard Lowe { 2846*d2a70789SRichard Lowe int err; 2847*d2a70789SRichard Lowe 2848*d2a70789SRichard Lowe if (oldtabptr == NULL || newtabptr == NULL) 2849*d2a70789SRichard Lowe return (Z_INVAL); 2850*d2a70789SRichard Lowe 2851*d2a70789SRichard Lowe if ((err = operation_prep(handle)) != Z_OK) 2852*d2a70789SRichard Lowe return (err); 2853*d2a70789SRichard Lowe 2854*d2a70789SRichard Lowe if ((err = zonecfg_delete_secflags_core(handle, oldtabptr)) 2855*d2a70789SRichard Lowe != Z_OK) 2856*d2a70789SRichard Lowe return (err); 2857*d2a70789SRichard Lowe 2858*d2a70789SRichard Lowe if ((err = zonecfg_add_secflags_core(handle, newtabptr)) != Z_OK) 2859*d2a70789SRichard Lowe return (err); 2860*d2a70789SRichard Lowe 2861*d2a70789SRichard Lowe return (Z_OK); 2862*d2a70789SRichard Lowe } 2863*d2a70789SRichard Lowe 2864*d2a70789SRichard Lowe int 2865*d2a70789SRichard Lowe zonecfg_lookup_secflags(zone_dochandle_t handle, 2866*d2a70789SRichard Lowe struct zone_secflagstab *tabptr) 2867*d2a70789SRichard Lowe { 2868*d2a70789SRichard Lowe xmlNodePtr cur; 2869*d2a70789SRichard Lowe int err; 2870*d2a70789SRichard Lowe 2871*d2a70789SRichard Lowe if (tabptr == NULL) 2872*d2a70789SRichard Lowe return (Z_INVAL); 2873*d2a70789SRichard Lowe 2874*d2a70789SRichard Lowe if ((err = operation_prep(handle)) != Z_OK) 2875*d2a70789SRichard Lowe return (err); 2876*d2a70789SRichard Lowe 2877*d2a70789SRichard Lowe cur = handle->zone_dh_cur; 2878*d2a70789SRichard Lowe 2879*d2a70789SRichard Lowe for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 2880*d2a70789SRichard Lowe if (xmlStrcmp(cur->name, DTD_ELEM_SECFLAGS) != 0) 2881*d2a70789SRichard Lowe continue; 2882*d2a70789SRichard Lowe 2883*d2a70789SRichard Lowe if ((err = fetchprop(cur, DTD_ATTR_DEFAULT, 2884*d2a70789SRichard Lowe tabptr->zone_secflags_default, 2885*d2a70789SRichard Lowe sizeof (tabptr->zone_secflags_default))) != Z_OK) { 2886*d2a70789SRichard Lowe handle->zone_dh_cur = handle->zone_dh_top; 2887*d2a70789SRichard Lowe return (err); 2888*d2a70789SRichard Lowe } 2889*d2a70789SRichard Lowe 2890*d2a70789SRichard Lowe if ((err = fetchprop(cur, DTD_ATTR_LOWER, 2891*d2a70789SRichard Lowe tabptr->zone_secflags_lower, 2892*d2a70789SRichard Lowe sizeof (tabptr->zone_secflags_lower))) != Z_OK) { 2893*d2a70789SRichard Lowe handle->zone_dh_cur = handle->zone_dh_top; 2894*d2a70789SRichard Lowe return (err); 2895*d2a70789SRichard Lowe } 2896*d2a70789SRichard Lowe 2897*d2a70789SRichard Lowe if ((err = fetchprop(cur, DTD_ATTR_UPPER, 2898*d2a70789SRichard Lowe tabptr->zone_secflags_upper, 2899*d2a70789SRichard Lowe sizeof (tabptr->zone_secflags_upper))) != Z_OK) { 2900*d2a70789SRichard Lowe handle->zone_dh_cur = handle->zone_dh_top; 2901*d2a70789SRichard Lowe return (err); 2902*d2a70789SRichard Lowe } 2903*d2a70789SRichard Lowe 2904*d2a70789SRichard Lowe return (Z_OK); 2905*d2a70789SRichard Lowe } 2906*d2a70789SRichard Lowe 2907*d2a70789SRichard Lowe return (Z_NO_ENTRY); 2908*d2a70789SRichard Lowe } 2909cb8a054bSGlenn Faden 2910ff17c8bfSgjelinek /* Lock to serialize all devwalks */ 2911ee519a1fSgjelinek static pthread_mutex_t zonecfg_devwalk_lock = PTHREAD_MUTEX_INITIALIZER; 2912ee519a1fSgjelinek /* 2913ff17c8bfSgjelinek * Global variables used to pass data from zonecfg_dev_manifest to the nftw 2914ee519a1fSgjelinek * call-back (zonecfg_devwalk_cb). g_devwalk_data is really the void* 2915ff17c8bfSgjelinek * parameter and g_devwalk_cb is really the *cb parameter from 2916ff17c8bfSgjelinek * zonecfg_dev_manifest. 2917ee519a1fSgjelinek */ 2918ff17c8bfSgjelinek typedef struct __g_devwalk_data *g_devwalk_data_t; 2919ff17c8bfSgjelinek static g_devwalk_data_t g_devwalk_data; 2920ee519a1fSgjelinek static int (*g_devwalk_cb)(const char *, uid_t, gid_t, mode_t, const char *, 2921ee519a1fSgjelinek void *); 2922ee519a1fSgjelinek static size_t g_devwalk_skip_prefix; 2923ee519a1fSgjelinek 2924ee519a1fSgjelinek /* 2925ff17c8bfSgjelinek * zonecfg_dev_manifest call-back function used during detach to generate the 2926ff17c8bfSgjelinek * dev info in the manifest. 2927ff17c8bfSgjelinek */ 2928ff17c8bfSgjelinek static int 2929ff17c8bfSgjelinek get_detach_dev_entry(const char *name, uid_t uid, gid_t gid, mode_t mode, 2930ff17c8bfSgjelinek const char *acl, void *hdl) 2931ff17c8bfSgjelinek { 2932ff17c8bfSgjelinek zone_dochandle_t handle = (zone_dochandle_t)hdl; 2933ff17c8bfSgjelinek xmlNodePtr newnode; 2934ff17c8bfSgjelinek xmlNodePtr cur; 2935ff17c8bfSgjelinek int err; 2936ff17c8bfSgjelinek char buf[128]; 2937ff17c8bfSgjelinek 2938ff17c8bfSgjelinek if ((err = operation_prep(handle)) != Z_OK) 2939ff17c8bfSgjelinek return (err); 2940ff17c8bfSgjelinek 2941ff17c8bfSgjelinek cur = handle->zone_dh_cur; 2942ff17c8bfSgjelinek newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_DEV_PERM, NULL); 2943ff17c8bfSgjelinek if ((err = newprop(newnode, DTD_ATTR_NAME, (char *)name)) != Z_OK) 2944ff17c8bfSgjelinek return (err); 2945ff17c8bfSgjelinek (void) snprintf(buf, sizeof (buf), "%lu", uid); 2946ff17c8bfSgjelinek if ((err = newprop(newnode, DTD_ATTR_UID, buf)) != Z_OK) 2947ff17c8bfSgjelinek return (err); 2948ff17c8bfSgjelinek (void) snprintf(buf, sizeof (buf), "%lu", gid); 2949ff17c8bfSgjelinek if ((err = newprop(newnode, DTD_ATTR_GID, buf)) != Z_OK) 2950ff17c8bfSgjelinek return (err); 2951ff17c8bfSgjelinek (void) snprintf(buf, sizeof (buf), "%o", mode); 2952ff17c8bfSgjelinek if ((err = newprop(newnode, DTD_ATTR_MODE, buf)) != Z_OK) 2953ff17c8bfSgjelinek return (err); 2954ff17c8bfSgjelinek if ((err = newprop(newnode, DTD_ATTR_ACL, (char *)acl)) != Z_OK) 2955ff17c8bfSgjelinek return (err); 2956ff17c8bfSgjelinek return (Z_OK); 2957ff17c8bfSgjelinek } 2958ff17c8bfSgjelinek 2959ff17c8bfSgjelinek /* 2960ff17c8bfSgjelinek * This is the nftw call-back function used by zonecfg_dev_manifest. It is 2961ff17c8bfSgjelinek * responsible for calling the actual call-back. 2962ee519a1fSgjelinek */ 2963ee519a1fSgjelinek /* ARGSUSED2 */ 2964ee519a1fSgjelinek static int 2965ee519a1fSgjelinek zonecfg_devwalk_cb(const char *path, const struct stat *st, int f, 2966ee519a1fSgjelinek struct FTW *ftw) 2967ee519a1fSgjelinek { 2968ee519a1fSgjelinek acl_t *acl; 2969ee519a1fSgjelinek char *acl_txt = NULL; 2970ee519a1fSgjelinek 2971ee519a1fSgjelinek /* skip all but character and block devices */ 2972ee519a1fSgjelinek if (!S_ISBLK(st->st_mode) && !S_ISCHR(st->st_mode)) 2973ee519a1fSgjelinek return (0); 2974ee519a1fSgjelinek 2975ee519a1fSgjelinek if ((acl_get(path, ACL_NO_TRIVIAL, &acl) == 0) && 2976ee519a1fSgjelinek acl != NULL) { 2977ee519a1fSgjelinek acl_txt = acl_totext(acl, ACL_NORESOLVE); 2978ee519a1fSgjelinek acl_free(acl); 2979ee519a1fSgjelinek } 2980ee519a1fSgjelinek 2981ee519a1fSgjelinek if (strlen(path) <= g_devwalk_skip_prefix) 2982ee519a1fSgjelinek return (0); 2983ee519a1fSgjelinek 2984ee519a1fSgjelinek g_devwalk_cb(path + g_devwalk_skip_prefix, st->st_uid, st->st_gid, 2985ee519a1fSgjelinek st->st_mode & S_IAMB, acl_txt != NULL ? acl_txt : "", 2986ee519a1fSgjelinek g_devwalk_data); 2987ee519a1fSgjelinek free(acl_txt); 2988ee519a1fSgjelinek return (0); 2989ee519a1fSgjelinek } 2990ee519a1fSgjelinek 2991ee519a1fSgjelinek /* 2992ff17c8bfSgjelinek * Walk the dev tree for the zone specified by hdl and call the 2993ff17c8bfSgjelinek * get_detach_dev_entry call-back function for each entry in the tree. The 2994ff17c8bfSgjelinek * call-back will be passed the name, uid, gid, mode, acl string and the 2995ff17c8bfSgjelinek * handle input parameter for each dev entry. 2996ee519a1fSgjelinek * 2997ff17c8bfSgjelinek * Data is passed to get_detach_dev_entry through the global variables 2998ee519a1fSgjelinek * g_devwalk_data, *g_devwalk_cb, and g_devwalk_skip_prefix. The 2999ff17c8bfSgjelinek * zonecfg_devwalk_cb function will actually call get_detach_dev_entry. 3000ee519a1fSgjelinek */ 3001ee519a1fSgjelinek int 3002ff17c8bfSgjelinek zonecfg_dev_manifest(zone_dochandle_t hdl) 3003ee519a1fSgjelinek { 3004ee519a1fSgjelinek char path[MAXPATHLEN]; 3005ee519a1fSgjelinek int ret; 3006ee519a1fSgjelinek 3007ee519a1fSgjelinek if ((ret = zonecfg_get_zonepath(hdl, path, sizeof (path))) != Z_OK) 3008ee519a1fSgjelinek return (ret); 3009ee519a1fSgjelinek 3010ee519a1fSgjelinek if (strlcat(path, "/dev", sizeof (path)) >= sizeof (path)) 3011ee519a1fSgjelinek return (Z_TOO_BIG); 3012ee519a1fSgjelinek 3013ee519a1fSgjelinek /* 3014ff17c8bfSgjelinek * We have to serialize all devwalks in the same process 3015ee519a1fSgjelinek * (which should be fine), since nftw() is so badly designed. 3016ee519a1fSgjelinek */ 3017ee519a1fSgjelinek (void) pthread_mutex_lock(&zonecfg_devwalk_lock); 3018ee519a1fSgjelinek 3019ff17c8bfSgjelinek g_devwalk_skip_prefix = strlen(path) + 1; 3020ff17c8bfSgjelinek g_devwalk_data = (g_devwalk_data_t)hdl; 3021ff17c8bfSgjelinek g_devwalk_cb = get_detach_dev_entry; 3022ee519a1fSgjelinek (void) nftw(path, zonecfg_devwalk_cb, 0, FTW_PHYS); 3023ee519a1fSgjelinek 3024ee519a1fSgjelinek (void) pthread_mutex_unlock(&zonecfg_devwalk_lock); 3025ee519a1fSgjelinek return (Z_OK); 3026ee519a1fSgjelinek } 3027ee519a1fSgjelinek 3028ee519a1fSgjelinek /* 3029ee519a1fSgjelinek * Update the owner, group, mode and acl on the specified dev (inpath) for 3030ee519a1fSgjelinek * the zone (hdl). This function can be used to fix up the dev tree after 3031ee519a1fSgjelinek * attaching a migrated zone. 3032ee519a1fSgjelinek */ 3033ee519a1fSgjelinek int 3034ee519a1fSgjelinek zonecfg_devperms_apply(zone_dochandle_t hdl, const char *inpath, uid_t owner, 3035ee519a1fSgjelinek gid_t group, mode_t mode, const char *acltxt) 3036ee519a1fSgjelinek { 3037ee519a1fSgjelinek int ret; 3038ee519a1fSgjelinek char path[MAXPATHLEN]; 3039ee519a1fSgjelinek struct stat st; 3040ee519a1fSgjelinek acl_t *aclp; 3041ee519a1fSgjelinek 3042ee519a1fSgjelinek if ((ret = zonecfg_get_zonepath(hdl, path, sizeof (path))) != Z_OK) 3043ee519a1fSgjelinek return (ret); 3044ee519a1fSgjelinek 3045ee519a1fSgjelinek if (strlcat(path, "/dev/", sizeof (path)) >= sizeof (path)) 3046ee519a1fSgjelinek return (Z_TOO_BIG); 3047ee519a1fSgjelinek if (strlcat(path, inpath, sizeof (path)) >= sizeof (path)) 3048ee519a1fSgjelinek return (Z_TOO_BIG); 3049ee519a1fSgjelinek 3050ee519a1fSgjelinek if (stat(path, &st) == -1) 3051ee519a1fSgjelinek return (Z_INVAL); 3052ee519a1fSgjelinek 3053ee519a1fSgjelinek /* make sure we're only touching device nodes */ 3054ee519a1fSgjelinek if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode)) 3055ee519a1fSgjelinek return (Z_INVAL); 3056ee519a1fSgjelinek 3057ee519a1fSgjelinek if (chown(path, owner, group) == -1) 3058ee519a1fSgjelinek return (Z_SYSTEM); 3059ee519a1fSgjelinek 3060ee519a1fSgjelinek if (chmod(path, mode) == -1) 3061ee519a1fSgjelinek return (Z_SYSTEM); 3062ee519a1fSgjelinek 3063ee519a1fSgjelinek if ((acltxt == NULL) || (strcmp(acltxt, "") == 0)) 3064ee519a1fSgjelinek return (Z_OK); 3065ee519a1fSgjelinek 30662ad45a84Sjv if (acl_fromtext(acltxt, &aclp) != 0) { 30672ad45a84Sjv errno = EINVAL; 3068ee519a1fSgjelinek return (Z_SYSTEM); 30692ad45a84Sjv } 3070ee519a1fSgjelinek 3071ee519a1fSgjelinek errno = 0; 3072ee519a1fSgjelinek if (acl_set(path, aclp) == -1) { 3073ee519a1fSgjelinek free(aclp); 3074ee519a1fSgjelinek return (Z_SYSTEM); 3075ee519a1fSgjelinek } 3076ee519a1fSgjelinek 3077ee519a1fSgjelinek free(aclp); 3078ee519a1fSgjelinek return (Z_OK); 3079ee519a1fSgjelinek } 3080ee519a1fSgjelinek 30817c478bd9Sstevel@tonic-gate /* 30827c478bd9Sstevel@tonic-gate * This function finds everything mounted under a zone's rootpath. 30837c478bd9Sstevel@tonic-gate * This returns the number of mounts under rootpath, or -1 on error. 30847c478bd9Sstevel@tonic-gate * callback is called once per mount found with the first argument 30850094b373Sjv * pointing to a mnttab structure containing the mount's information. 30867c478bd9Sstevel@tonic-gate * 30877c478bd9Sstevel@tonic-gate * If the callback function returns non-zero zonecfg_find_mounts 30887c478bd9Sstevel@tonic-gate * aborts with an error. 30897c478bd9Sstevel@tonic-gate */ 30907c478bd9Sstevel@tonic-gate int 30910094b373Sjv zonecfg_find_mounts(char *rootpath, int (*callback)(const struct mnttab *, 3092*d2a70789SRichard Lowe void *), void *priv) 3093*d2a70789SRichard Lowe { 30947c478bd9Sstevel@tonic-gate FILE *mnttab; 30957c478bd9Sstevel@tonic-gate struct mnttab m; 30967c478bd9Sstevel@tonic-gate size_t l; 309707b574eeSgjelinek int zfsl; 30987c478bd9Sstevel@tonic-gate int rv = 0; 309907b574eeSgjelinek char zfs_path[MAXPATHLEN]; 31007c478bd9Sstevel@tonic-gate 31017c478bd9Sstevel@tonic-gate assert(rootpath != NULL); 31027c478bd9Sstevel@tonic-gate 310307b574eeSgjelinek if ((zfsl = snprintf(zfs_path, sizeof (zfs_path), "%s/.zfs/", rootpath)) 310407b574eeSgjelinek >= sizeof (zfs_path)) 310507b574eeSgjelinek return (-1); 310607b574eeSgjelinek 31077c478bd9Sstevel@tonic-gate l = strlen(rootpath); 31087c478bd9Sstevel@tonic-gate 31097c478bd9Sstevel@tonic-gate mnttab = fopen("/etc/mnttab", "r"); 31107c478bd9Sstevel@tonic-gate 31117c478bd9Sstevel@tonic-gate if (mnttab == NULL) 31127c478bd9Sstevel@tonic-gate return (-1); 31137c478bd9Sstevel@tonic-gate 31147c478bd9Sstevel@tonic-gate if (ioctl(fileno(mnttab), MNTIOC_SHOWHIDDEN, NULL) < 0) { 31157c478bd9Sstevel@tonic-gate rv = -1; 31167c478bd9Sstevel@tonic-gate goto out; 31177c478bd9Sstevel@tonic-gate } 31187c478bd9Sstevel@tonic-gate 31197c478bd9Sstevel@tonic-gate while (!getmntent(mnttab, &m)) { 31207c478bd9Sstevel@tonic-gate if ((strncmp(rootpath, m.mnt_mountp, l) == 0) && 312107b574eeSgjelinek (m.mnt_mountp[l] == '/') && 312207b574eeSgjelinek (strncmp(zfs_path, m.mnt_mountp, zfsl) != 0)) { 31237c478bd9Sstevel@tonic-gate rv++; 31247c478bd9Sstevel@tonic-gate if (callback == NULL) 31257c478bd9Sstevel@tonic-gate continue; 31260094b373Sjv if (callback(&m, priv)) { 31277c478bd9Sstevel@tonic-gate rv = -1; 31287c478bd9Sstevel@tonic-gate goto out; 31297c478bd9Sstevel@tonic-gate 31307c478bd9Sstevel@tonic-gate } 31317c478bd9Sstevel@tonic-gate } 31327c478bd9Sstevel@tonic-gate } 31337c478bd9Sstevel@tonic-gate 31347c478bd9Sstevel@tonic-gate out: 31357c478bd9Sstevel@tonic-gate (void) fclose(mnttab); 31367c478bd9Sstevel@tonic-gate return (rv); 31377c478bd9Sstevel@tonic-gate } 31387c478bd9Sstevel@tonic-gate 31397c478bd9Sstevel@tonic-gate int 31407c478bd9Sstevel@tonic-gate zonecfg_lookup_attr(zone_dochandle_t handle, struct zone_attrtab *tabptr) 31417c478bd9Sstevel@tonic-gate { 31427c478bd9Sstevel@tonic-gate xmlNodePtr cur, firstmatch; 31437c478bd9Sstevel@tonic-gate int err; 31447c478bd9Sstevel@tonic-gate char name[MAXNAMELEN], type[MAXNAMELEN], value[MAXNAMELEN]; 31457c478bd9Sstevel@tonic-gate 31467c478bd9Sstevel@tonic-gate if (tabptr == NULL) 31477c478bd9Sstevel@tonic-gate return (Z_INVAL); 31487c478bd9Sstevel@tonic-gate 31497c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 31507c478bd9Sstevel@tonic-gate return (err); 31517c478bd9Sstevel@tonic-gate 31527c478bd9Sstevel@tonic-gate cur = handle->zone_dh_cur; 31537c478bd9Sstevel@tonic-gate firstmatch = NULL; 31547c478bd9Sstevel@tonic-gate for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 31557c478bd9Sstevel@tonic-gate if (xmlStrcmp(cur->name, DTD_ELEM_ATTR)) 31567c478bd9Sstevel@tonic-gate continue; 31577c478bd9Sstevel@tonic-gate if (strlen(tabptr->zone_attr_name) > 0) { 31587c478bd9Sstevel@tonic-gate if ((fetchprop(cur, DTD_ATTR_NAME, name, 31597c478bd9Sstevel@tonic-gate sizeof (name)) == Z_OK) && 31607c478bd9Sstevel@tonic-gate (strcmp(tabptr->zone_attr_name, name) == 0)) { 31617c478bd9Sstevel@tonic-gate if (firstmatch == NULL) 31627c478bd9Sstevel@tonic-gate firstmatch = cur; 31637c478bd9Sstevel@tonic-gate else 31647c478bd9Sstevel@tonic-gate return (Z_INSUFFICIENT_SPEC); 31657c478bd9Sstevel@tonic-gate } 31667c478bd9Sstevel@tonic-gate } 31677c478bd9Sstevel@tonic-gate if (strlen(tabptr->zone_attr_type) > 0) { 31687c478bd9Sstevel@tonic-gate if ((fetchprop(cur, DTD_ATTR_TYPE, type, 31697c478bd9Sstevel@tonic-gate sizeof (type)) == Z_OK)) { 31707c478bd9Sstevel@tonic-gate if (strcmp(tabptr->zone_attr_type, type) == 0) { 31717c478bd9Sstevel@tonic-gate if (firstmatch == NULL) 31727c478bd9Sstevel@tonic-gate firstmatch = cur; 31737c478bd9Sstevel@tonic-gate else if (firstmatch != cur) 31747c478bd9Sstevel@tonic-gate return (Z_INSUFFICIENT_SPEC); 31757c478bd9Sstevel@tonic-gate } else { 31767c478bd9Sstevel@tonic-gate /* 31777c478bd9Sstevel@tonic-gate * If another property matched but this 31787c478bd9Sstevel@tonic-gate * one doesn't then reset firstmatch. 31797c478bd9Sstevel@tonic-gate */ 31807c478bd9Sstevel@tonic-gate if (firstmatch == cur) 31817c478bd9Sstevel@tonic-gate firstmatch = NULL; 31827c478bd9Sstevel@tonic-gate } 31837c478bd9Sstevel@tonic-gate } 31847c478bd9Sstevel@tonic-gate } 31857c478bd9Sstevel@tonic-gate if (strlen(tabptr->zone_attr_value) > 0) { 31867c478bd9Sstevel@tonic-gate if ((fetchprop(cur, DTD_ATTR_VALUE, value, 31877c478bd9Sstevel@tonic-gate sizeof (value)) == Z_OK)) { 31887c478bd9Sstevel@tonic-gate if (strcmp(tabptr->zone_attr_value, value) == 31897c478bd9Sstevel@tonic-gate 0) { 31907c478bd9Sstevel@tonic-gate if (firstmatch == NULL) 31917c478bd9Sstevel@tonic-gate firstmatch = cur; 31927c478bd9Sstevel@tonic-gate else if (firstmatch != cur) 31937c478bd9Sstevel@tonic-gate return (Z_INSUFFICIENT_SPEC); 31947c478bd9Sstevel@tonic-gate } else { 31957c478bd9Sstevel@tonic-gate /* 31967c478bd9Sstevel@tonic-gate * If another property matched but this 31977c478bd9Sstevel@tonic-gate * one doesn't then reset firstmatch. 31987c478bd9Sstevel@tonic-gate */ 31997c478bd9Sstevel@tonic-gate if (firstmatch == cur) 32007c478bd9Sstevel@tonic-gate firstmatch = NULL; 32017c478bd9Sstevel@tonic-gate } 32027c478bd9Sstevel@tonic-gate } 32037c478bd9Sstevel@tonic-gate } 32047c478bd9Sstevel@tonic-gate } 32057c478bd9Sstevel@tonic-gate if (firstmatch == NULL) 32067c478bd9Sstevel@tonic-gate return (Z_NO_RESOURCE_ID); 32077c478bd9Sstevel@tonic-gate 32087c478bd9Sstevel@tonic-gate cur = firstmatch; 32097c478bd9Sstevel@tonic-gate 32107c478bd9Sstevel@tonic-gate if ((err = fetchprop(cur, DTD_ATTR_NAME, tabptr->zone_attr_name, 32117c478bd9Sstevel@tonic-gate sizeof (tabptr->zone_attr_name))) != Z_OK) 32127c478bd9Sstevel@tonic-gate return (err); 32137c478bd9Sstevel@tonic-gate 32147c478bd9Sstevel@tonic-gate if ((err = fetchprop(cur, DTD_ATTR_TYPE, tabptr->zone_attr_type, 32157c478bd9Sstevel@tonic-gate sizeof (tabptr->zone_attr_type))) != Z_OK) 32167c478bd9Sstevel@tonic-gate return (err); 32177c478bd9Sstevel@tonic-gate 32187c478bd9Sstevel@tonic-gate if ((err = fetchprop(cur, DTD_ATTR_VALUE, tabptr->zone_attr_value, 32197c478bd9Sstevel@tonic-gate sizeof (tabptr->zone_attr_value))) != Z_OK) 32207c478bd9Sstevel@tonic-gate return (err); 32217c478bd9Sstevel@tonic-gate 32227c478bd9Sstevel@tonic-gate return (Z_OK); 32237c478bd9Sstevel@tonic-gate } 32247c478bd9Sstevel@tonic-gate 32257c478bd9Sstevel@tonic-gate static int 32267c478bd9Sstevel@tonic-gate zonecfg_add_attr_core(zone_dochandle_t handle, struct zone_attrtab *tabptr) 32277c478bd9Sstevel@tonic-gate { 32287c478bd9Sstevel@tonic-gate xmlNodePtr newnode, cur = handle->zone_dh_cur; 32297c478bd9Sstevel@tonic-gate int err; 32307c478bd9Sstevel@tonic-gate 32317c478bd9Sstevel@tonic-gate newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_ATTR, NULL); 3232a1be23daSdp err = newprop(newnode, DTD_ATTR_NAME, tabptr->zone_attr_name); 32337c478bd9Sstevel@tonic-gate if (err != Z_OK) 32347c478bd9Sstevel@tonic-gate return (err); 3235a1be23daSdp err = newprop(newnode, DTD_ATTR_TYPE, tabptr->zone_attr_type); 32367c478bd9Sstevel@tonic-gate if (err != Z_OK) 32377c478bd9Sstevel@tonic-gate return (err); 3238a1be23daSdp err = newprop(newnode, DTD_ATTR_VALUE, tabptr->zone_attr_value); 32397c478bd9Sstevel@tonic-gate if (err != Z_OK) 32407c478bd9Sstevel@tonic-gate return (err); 32417c478bd9Sstevel@tonic-gate return (Z_OK); 32427c478bd9Sstevel@tonic-gate } 32437c478bd9Sstevel@tonic-gate 32447c478bd9Sstevel@tonic-gate int 32457c478bd9Sstevel@tonic-gate zonecfg_add_attr(zone_dochandle_t handle, struct zone_attrtab *tabptr) 32467c478bd9Sstevel@tonic-gate { 32477c478bd9Sstevel@tonic-gate int err; 32487c478bd9Sstevel@tonic-gate 32497c478bd9Sstevel@tonic-gate if (tabptr == NULL) 32507c478bd9Sstevel@tonic-gate return (Z_INVAL); 32517c478bd9Sstevel@tonic-gate 32527c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 32537c478bd9Sstevel@tonic-gate return (err); 32547c478bd9Sstevel@tonic-gate 32557c478bd9Sstevel@tonic-gate if ((err = zonecfg_add_attr_core(handle, tabptr)) != Z_OK) 32567c478bd9Sstevel@tonic-gate return (err); 32577c478bd9Sstevel@tonic-gate 32587c478bd9Sstevel@tonic-gate return (Z_OK); 32597c478bd9Sstevel@tonic-gate } 32607c478bd9Sstevel@tonic-gate 32617c478bd9Sstevel@tonic-gate static int 32627c478bd9Sstevel@tonic-gate zonecfg_delete_attr_core(zone_dochandle_t handle, struct zone_attrtab *tabptr) 32637c478bd9Sstevel@tonic-gate { 32647c478bd9Sstevel@tonic-gate xmlNodePtr cur = handle->zone_dh_cur; 32657c478bd9Sstevel@tonic-gate int name_match, type_match, value_match; 32667c478bd9Sstevel@tonic-gate 32677c478bd9Sstevel@tonic-gate for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 32687c478bd9Sstevel@tonic-gate if (xmlStrcmp(cur->name, DTD_ELEM_ATTR)) 32697c478bd9Sstevel@tonic-gate continue; 32707c478bd9Sstevel@tonic-gate 32717c478bd9Sstevel@tonic-gate name_match = match_prop(cur, DTD_ATTR_NAME, 32727c478bd9Sstevel@tonic-gate tabptr->zone_attr_name); 32737c478bd9Sstevel@tonic-gate type_match = match_prop(cur, DTD_ATTR_TYPE, 32747c478bd9Sstevel@tonic-gate tabptr->zone_attr_type); 32757c478bd9Sstevel@tonic-gate value_match = match_prop(cur, DTD_ATTR_VALUE, 32767c478bd9Sstevel@tonic-gate tabptr->zone_attr_value); 32777c478bd9Sstevel@tonic-gate 32787c478bd9Sstevel@tonic-gate if (name_match && type_match && value_match) { 32797c478bd9Sstevel@tonic-gate xmlUnlinkNode(cur); 32807c478bd9Sstevel@tonic-gate xmlFreeNode(cur); 32817c478bd9Sstevel@tonic-gate return (Z_OK); 32827c478bd9Sstevel@tonic-gate } 32837c478bd9Sstevel@tonic-gate } 32847c478bd9Sstevel@tonic-gate return (Z_NO_RESOURCE_ID); 32857c478bd9Sstevel@tonic-gate } 32867c478bd9Sstevel@tonic-gate 32877c478bd9Sstevel@tonic-gate int 32887c478bd9Sstevel@tonic-gate zonecfg_delete_attr(zone_dochandle_t handle, struct zone_attrtab *tabptr) 32897c478bd9Sstevel@tonic-gate { 32907c478bd9Sstevel@tonic-gate int err; 32917c478bd9Sstevel@tonic-gate 32927c478bd9Sstevel@tonic-gate if (tabptr == NULL) 32937c478bd9Sstevel@tonic-gate return (Z_INVAL); 32947c478bd9Sstevel@tonic-gate 32957c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 32967c478bd9Sstevel@tonic-gate return (err); 32977c478bd9Sstevel@tonic-gate 32987c478bd9Sstevel@tonic-gate if ((err = zonecfg_delete_attr_core(handle, tabptr)) != Z_OK) 32997c478bd9Sstevel@tonic-gate return (err); 33007c478bd9Sstevel@tonic-gate 33017c478bd9Sstevel@tonic-gate return (Z_OK); 33027c478bd9Sstevel@tonic-gate } 33037c478bd9Sstevel@tonic-gate 33047c478bd9Sstevel@tonic-gate int 33057c478bd9Sstevel@tonic-gate zonecfg_modify_attr( 33067c478bd9Sstevel@tonic-gate zone_dochandle_t handle, 33077c478bd9Sstevel@tonic-gate struct zone_attrtab *oldtabptr, 33087c478bd9Sstevel@tonic-gate struct zone_attrtab *newtabptr) 33097c478bd9Sstevel@tonic-gate { 33107c478bd9Sstevel@tonic-gate int err; 33117c478bd9Sstevel@tonic-gate 33127c478bd9Sstevel@tonic-gate if (oldtabptr == NULL || newtabptr == NULL) 33137c478bd9Sstevel@tonic-gate return (Z_INVAL); 33147c478bd9Sstevel@tonic-gate 33157c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 33167c478bd9Sstevel@tonic-gate return (err); 33177c478bd9Sstevel@tonic-gate 33187c478bd9Sstevel@tonic-gate if ((err = zonecfg_delete_attr_core(handle, oldtabptr)) != Z_OK) 33197c478bd9Sstevel@tonic-gate return (err); 33207c478bd9Sstevel@tonic-gate 33217c478bd9Sstevel@tonic-gate if ((err = zonecfg_add_attr_core(handle, newtabptr)) != Z_OK) 33227c478bd9Sstevel@tonic-gate return (err); 33237c478bd9Sstevel@tonic-gate 33247c478bd9Sstevel@tonic-gate return (Z_OK); 33257c478bd9Sstevel@tonic-gate } 33267c478bd9Sstevel@tonic-gate 33277c478bd9Sstevel@tonic-gate int 33287c478bd9Sstevel@tonic-gate zonecfg_get_attr_boolean(const struct zone_attrtab *attr, boolean_t *value) 33297c478bd9Sstevel@tonic-gate { 33307c478bd9Sstevel@tonic-gate if (attr == NULL) 33317c478bd9Sstevel@tonic-gate return (Z_INVAL); 33327c478bd9Sstevel@tonic-gate 33337c478bd9Sstevel@tonic-gate if (strcmp(attr->zone_attr_type, DTD_ENTITY_BOOLEAN) != 0) 33347c478bd9Sstevel@tonic-gate return (Z_INVAL); 33357c478bd9Sstevel@tonic-gate 33367c478bd9Sstevel@tonic-gate if (strcmp(attr->zone_attr_value, DTD_ENTITY_TRUE) == 0) { 33377c478bd9Sstevel@tonic-gate *value = B_TRUE; 33387c478bd9Sstevel@tonic-gate return (Z_OK); 33397c478bd9Sstevel@tonic-gate } 33407c478bd9Sstevel@tonic-gate if (strcmp(attr->zone_attr_value, DTD_ENTITY_FALSE) == 0) { 33417c478bd9Sstevel@tonic-gate *value = B_FALSE; 33427c478bd9Sstevel@tonic-gate return (Z_OK); 33437c478bd9Sstevel@tonic-gate } 33447c478bd9Sstevel@tonic-gate return (Z_INVAL); 33457c478bd9Sstevel@tonic-gate } 33467c478bd9Sstevel@tonic-gate 33477c478bd9Sstevel@tonic-gate int 33487c478bd9Sstevel@tonic-gate zonecfg_get_attr_int(const struct zone_attrtab *attr, int64_t *value) 33497c478bd9Sstevel@tonic-gate { 33507c478bd9Sstevel@tonic-gate long long result; 33517c478bd9Sstevel@tonic-gate char *endptr; 33527c478bd9Sstevel@tonic-gate 33537c478bd9Sstevel@tonic-gate if (attr == NULL) 33547c478bd9Sstevel@tonic-gate return (Z_INVAL); 33557c478bd9Sstevel@tonic-gate 33567c478bd9Sstevel@tonic-gate if (strcmp(attr->zone_attr_type, DTD_ENTITY_INT) != 0) 33577c478bd9Sstevel@tonic-gate return (Z_INVAL); 33587c478bd9Sstevel@tonic-gate 33597c478bd9Sstevel@tonic-gate errno = 0; 33607c478bd9Sstevel@tonic-gate result = strtoll(attr->zone_attr_value, &endptr, 10); 33617c478bd9Sstevel@tonic-gate if (errno != 0 || *endptr != '\0') 33627c478bd9Sstevel@tonic-gate return (Z_INVAL); 33637c478bd9Sstevel@tonic-gate *value = result; 33647c478bd9Sstevel@tonic-gate return (Z_OK); 33657c478bd9Sstevel@tonic-gate } 33667c478bd9Sstevel@tonic-gate 33677c478bd9Sstevel@tonic-gate int 33687c478bd9Sstevel@tonic-gate zonecfg_get_attr_string(const struct zone_attrtab *attr, char *value, 33697c478bd9Sstevel@tonic-gate size_t val_sz) 33707c478bd9Sstevel@tonic-gate { 33717c478bd9Sstevel@tonic-gate if (attr == NULL) 33727c478bd9Sstevel@tonic-gate return (Z_INVAL); 33737c478bd9Sstevel@tonic-gate 33747c478bd9Sstevel@tonic-gate if (strcmp(attr->zone_attr_type, DTD_ENTITY_STRING) != 0) 33757c478bd9Sstevel@tonic-gate return (Z_INVAL); 33767c478bd9Sstevel@tonic-gate 33777c478bd9Sstevel@tonic-gate if (strlcpy(value, attr->zone_attr_value, val_sz) >= val_sz) 33787c478bd9Sstevel@tonic-gate return (Z_TOO_BIG); 33797c478bd9Sstevel@tonic-gate return (Z_OK); 33807c478bd9Sstevel@tonic-gate } 33817c478bd9Sstevel@tonic-gate 33827c478bd9Sstevel@tonic-gate int 33837c478bd9Sstevel@tonic-gate zonecfg_get_attr_uint(const struct zone_attrtab *attr, uint64_t *value) 33847c478bd9Sstevel@tonic-gate { 33857c478bd9Sstevel@tonic-gate unsigned long long result; 33867c478bd9Sstevel@tonic-gate long long neg_result; 33877c478bd9Sstevel@tonic-gate char *endptr; 33887c478bd9Sstevel@tonic-gate 33897c478bd9Sstevel@tonic-gate if (attr == NULL) 33907c478bd9Sstevel@tonic-gate return (Z_INVAL); 33917c478bd9Sstevel@tonic-gate 33927c478bd9Sstevel@tonic-gate if (strcmp(attr->zone_attr_type, DTD_ENTITY_UINT) != 0) 33937c478bd9Sstevel@tonic-gate return (Z_INVAL); 33947c478bd9Sstevel@tonic-gate 33957c478bd9Sstevel@tonic-gate errno = 0; 33967c478bd9Sstevel@tonic-gate result = strtoull(attr->zone_attr_value, &endptr, 10); 33977c478bd9Sstevel@tonic-gate if (errno != 0 || *endptr != '\0') 33987c478bd9Sstevel@tonic-gate return (Z_INVAL); 33997c478bd9Sstevel@tonic-gate errno = 0; 34007c478bd9Sstevel@tonic-gate neg_result = strtoll(attr->zone_attr_value, &endptr, 10); 34017c478bd9Sstevel@tonic-gate /* 34027c478bd9Sstevel@tonic-gate * Incredibly, strtoull("<negative number>", ...) will not fail but 34037c478bd9Sstevel@tonic-gate * return whatever (negative) number cast as a u_longlong_t, so we 34047c478bd9Sstevel@tonic-gate * need to look for this here. 34057c478bd9Sstevel@tonic-gate */ 34067c478bd9Sstevel@tonic-gate if (errno == 0 && neg_result < 0) 34077c478bd9Sstevel@tonic-gate return (Z_INVAL); 34087c478bd9Sstevel@tonic-gate *value = result; 34097c478bd9Sstevel@tonic-gate return (Z_OK); 34107c478bd9Sstevel@tonic-gate } 34117c478bd9Sstevel@tonic-gate 34127c478bd9Sstevel@tonic-gate int 34137c478bd9Sstevel@tonic-gate zonecfg_lookup_rctl(zone_dochandle_t handle, struct zone_rctltab *tabptr) 34147c478bd9Sstevel@tonic-gate { 34157c478bd9Sstevel@tonic-gate xmlNodePtr cur, val; 34167c478bd9Sstevel@tonic-gate char savedname[MAXNAMELEN]; 34177c478bd9Sstevel@tonic-gate struct zone_rctlvaltab *valptr; 34187c478bd9Sstevel@tonic-gate int err; 34197c478bd9Sstevel@tonic-gate 34202ad45a84Sjv if (strlen(tabptr->zone_rctl_name) == 0) 34217c478bd9Sstevel@tonic-gate return (Z_INVAL); 34227c478bd9Sstevel@tonic-gate 34237c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 34247c478bd9Sstevel@tonic-gate return (err); 34257c478bd9Sstevel@tonic-gate 34267c478bd9Sstevel@tonic-gate cur = handle->zone_dh_cur; 34277c478bd9Sstevel@tonic-gate for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 34287c478bd9Sstevel@tonic-gate if (xmlStrcmp(cur->name, DTD_ELEM_RCTL)) 34297c478bd9Sstevel@tonic-gate continue; 34307c478bd9Sstevel@tonic-gate if ((fetchprop(cur, DTD_ATTR_NAME, savedname, 34317c478bd9Sstevel@tonic-gate sizeof (savedname)) == Z_OK) && 34327c478bd9Sstevel@tonic-gate (strcmp(savedname, tabptr->zone_rctl_name) == 0)) { 34337c478bd9Sstevel@tonic-gate tabptr->zone_rctl_valptr = NULL; 34347c478bd9Sstevel@tonic-gate for (val = cur->xmlChildrenNode; val != NULL; 34357c478bd9Sstevel@tonic-gate val = val->next) { 34367c478bd9Sstevel@tonic-gate valptr = (struct zone_rctlvaltab *)malloc( 34377c478bd9Sstevel@tonic-gate sizeof (struct zone_rctlvaltab)); 34387c478bd9Sstevel@tonic-gate if (valptr == NULL) 34397c478bd9Sstevel@tonic-gate return (Z_NOMEM); 34407c478bd9Sstevel@tonic-gate if ((fetchprop(val, DTD_ATTR_PRIV, 34417c478bd9Sstevel@tonic-gate valptr->zone_rctlval_priv, 34427c478bd9Sstevel@tonic-gate sizeof (valptr->zone_rctlval_priv)) != 34437c478bd9Sstevel@tonic-gate Z_OK)) 34447c478bd9Sstevel@tonic-gate break; 34457c478bd9Sstevel@tonic-gate if ((fetchprop(val, DTD_ATTR_LIMIT, 34467c478bd9Sstevel@tonic-gate valptr->zone_rctlval_limit, 34477c478bd9Sstevel@tonic-gate sizeof (valptr->zone_rctlval_limit)) != 34487c478bd9Sstevel@tonic-gate Z_OK)) 34497c478bd9Sstevel@tonic-gate break; 34507c478bd9Sstevel@tonic-gate if ((fetchprop(val, DTD_ATTR_ACTION, 34517c478bd9Sstevel@tonic-gate valptr->zone_rctlval_action, 34527c478bd9Sstevel@tonic-gate sizeof (valptr->zone_rctlval_action)) != 34537c478bd9Sstevel@tonic-gate Z_OK)) 34547c478bd9Sstevel@tonic-gate break; 34557c478bd9Sstevel@tonic-gate if (zonecfg_add_rctl_value(tabptr, valptr) != 34567c478bd9Sstevel@tonic-gate Z_OK) 34577c478bd9Sstevel@tonic-gate break; 34587c478bd9Sstevel@tonic-gate } 34597c478bd9Sstevel@tonic-gate return (Z_OK); 34607c478bd9Sstevel@tonic-gate } 34617c478bd9Sstevel@tonic-gate } 34627c478bd9Sstevel@tonic-gate return (Z_NO_RESOURCE_ID); 34637c478bd9Sstevel@tonic-gate } 34647c478bd9Sstevel@tonic-gate 34657c478bd9Sstevel@tonic-gate static int 34667c478bd9Sstevel@tonic-gate zonecfg_add_rctl_core(zone_dochandle_t handle, struct zone_rctltab *tabptr) 34677c478bd9Sstevel@tonic-gate { 34687c478bd9Sstevel@tonic-gate xmlNodePtr newnode, cur = handle->zone_dh_cur, valnode; 34697c478bd9Sstevel@tonic-gate struct zone_rctlvaltab *valptr; 34707c478bd9Sstevel@tonic-gate int err; 34717c478bd9Sstevel@tonic-gate 34727c478bd9Sstevel@tonic-gate newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_RCTL, NULL); 3473a1be23daSdp err = newprop(newnode, DTD_ATTR_NAME, tabptr->zone_rctl_name); 34747c478bd9Sstevel@tonic-gate if (err != Z_OK) 34757c478bd9Sstevel@tonic-gate return (err); 34767c478bd9Sstevel@tonic-gate for (valptr = tabptr->zone_rctl_valptr; valptr != NULL; 34777c478bd9Sstevel@tonic-gate valptr = valptr->zone_rctlval_next) { 34787c478bd9Sstevel@tonic-gate valnode = xmlNewTextChild(newnode, NULL, 34797c478bd9Sstevel@tonic-gate DTD_ELEM_RCTLVALUE, NULL); 3480a1be23daSdp err = newprop(valnode, DTD_ATTR_PRIV, 34817c478bd9Sstevel@tonic-gate valptr->zone_rctlval_priv); 34827c478bd9Sstevel@tonic-gate if (err != Z_OK) 34837c478bd9Sstevel@tonic-gate return (err); 3484a1be23daSdp err = newprop(valnode, DTD_ATTR_LIMIT, 34857c478bd9Sstevel@tonic-gate valptr->zone_rctlval_limit); 34867c478bd9Sstevel@tonic-gate if (err != Z_OK) 34877c478bd9Sstevel@tonic-gate return (err); 3488a1be23daSdp err = newprop(valnode, DTD_ATTR_ACTION, 34897c478bd9Sstevel@tonic-gate valptr->zone_rctlval_action); 34907c478bd9Sstevel@tonic-gate if (err != Z_OK) 34917c478bd9Sstevel@tonic-gate return (err); 34927c478bd9Sstevel@tonic-gate } 34937c478bd9Sstevel@tonic-gate return (Z_OK); 34947c478bd9Sstevel@tonic-gate } 34957c478bd9Sstevel@tonic-gate 34967c478bd9Sstevel@tonic-gate int 34977c478bd9Sstevel@tonic-gate zonecfg_add_rctl(zone_dochandle_t handle, struct zone_rctltab *tabptr) 34987c478bd9Sstevel@tonic-gate { 34997c478bd9Sstevel@tonic-gate int err; 35007c478bd9Sstevel@tonic-gate 35012ad45a84Sjv if (tabptr == NULL) 35027c478bd9Sstevel@tonic-gate return (Z_INVAL); 35037c478bd9Sstevel@tonic-gate 35047c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 35057c478bd9Sstevel@tonic-gate return (err); 35067c478bd9Sstevel@tonic-gate 35077c478bd9Sstevel@tonic-gate if ((err = zonecfg_add_rctl_core(handle, tabptr)) != Z_OK) 35087c478bd9Sstevel@tonic-gate return (err); 35097c478bd9Sstevel@tonic-gate 35107c478bd9Sstevel@tonic-gate return (Z_OK); 35117c478bd9Sstevel@tonic-gate } 35127c478bd9Sstevel@tonic-gate 35137c478bd9Sstevel@tonic-gate static int 35147c478bd9Sstevel@tonic-gate zonecfg_delete_rctl_core(zone_dochandle_t handle, struct zone_rctltab *tabptr) 35157c478bd9Sstevel@tonic-gate { 35167c478bd9Sstevel@tonic-gate xmlNodePtr cur = handle->zone_dh_cur; 35177c478bd9Sstevel@tonic-gate xmlChar *savedname; 35187c478bd9Sstevel@tonic-gate int name_result; 35197c478bd9Sstevel@tonic-gate 35207c478bd9Sstevel@tonic-gate for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 35217c478bd9Sstevel@tonic-gate if (xmlStrcmp(cur->name, DTD_ELEM_RCTL)) 35227c478bd9Sstevel@tonic-gate continue; 35237c478bd9Sstevel@tonic-gate 35247c478bd9Sstevel@tonic-gate savedname = xmlGetProp(cur, DTD_ATTR_NAME); 35257c478bd9Sstevel@tonic-gate if (savedname == NULL) /* shouldn't happen */ 35267c478bd9Sstevel@tonic-gate continue; 35277c478bd9Sstevel@tonic-gate name_result = xmlStrcmp(savedname, 35287c478bd9Sstevel@tonic-gate (const xmlChar *) tabptr->zone_rctl_name); 35297c478bd9Sstevel@tonic-gate xmlFree(savedname); 35307c478bd9Sstevel@tonic-gate 35317c478bd9Sstevel@tonic-gate if (name_result == 0) { 35327c478bd9Sstevel@tonic-gate xmlUnlinkNode(cur); 35337c478bd9Sstevel@tonic-gate xmlFreeNode(cur); 35347c478bd9Sstevel@tonic-gate return (Z_OK); 35357c478bd9Sstevel@tonic-gate } 35367c478bd9Sstevel@tonic-gate } 35377c478bd9Sstevel@tonic-gate return (Z_NO_RESOURCE_ID); 35387c478bd9Sstevel@tonic-gate } 35397c478bd9Sstevel@tonic-gate 35407c478bd9Sstevel@tonic-gate int 35417c478bd9Sstevel@tonic-gate zonecfg_delete_rctl(zone_dochandle_t handle, struct zone_rctltab *tabptr) 35427c478bd9Sstevel@tonic-gate { 35437c478bd9Sstevel@tonic-gate int err; 35447c478bd9Sstevel@tonic-gate 35452ad45a84Sjv if (tabptr == NULL) 35467c478bd9Sstevel@tonic-gate return (Z_INVAL); 35477c478bd9Sstevel@tonic-gate 35487c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 35497c478bd9Sstevel@tonic-gate return (err); 35507c478bd9Sstevel@tonic-gate 35517c478bd9Sstevel@tonic-gate if ((err = zonecfg_delete_rctl_core(handle, tabptr)) != Z_OK) 35527c478bd9Sstevel@tonic-gate return (err); 35537c478bd9Sstevel@tonic-gate 35547c478bd9Sstevel@tonic-gate return (Z_OK); 35557c478bd9Sstevel@tonic-gate } 35567c478bd9Sstevel@tonic-gate 35577c478bd9Sstevel@tonic-gate int 35587c478bd9Sstevel@tonic-gate zonecfg_modify_rctl( 35597c478bd9Sstevel@tonic-gate zone_dochandle_t handle, 35607c478bd9Sstevel@tonic-gate struct zone_rctltab *oldtabptr, 35617c478bd9Sstevel@tonic-gate struct zone_rctltab *newtabptr) 35627c478bd9Sstevel@tonic-gate { 35637c478bd9Sstevel@tonic-gate int err; 35647c478bd9Sstevel@tonic-gate 35652ad45a84Sjv if (oldtabptr == NULL || newtabptr == NULL) 35667c478bd9Sstevel@tonic-gate return (Z_INVAL); 35677c478bd9Sstevel@tonic-gate 35687c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) 35697c478bd9Sstevel@tonic-gate return (err); 35707c478bd9Sstevel@tonic-gate 35717c478bd9Sstevel@tonic-gate if ((err = zonecfg_delete_rctl_core(handle, oldtabptr)) != Z_OK) 35727c478bd9Sstevel@tonic-gate return (err); 35737c478bd9Sstevel@tonic-gate 35747c478bd9Sstevel@tonic-gate if ((err = zonecfg_add_rctl_core(handle, newtabptr)) != Z_OK) 35757c478bd9Sstevel@tonic-gate return (err); 35767c478bd9Sstevel@tonic-gate 35777c478bd9Sstevel@tonic-gate return (Z_OK); 35787c478bd9Sstevel@tonic-gate } 35797c478bd9Sstevel@tonic-gate 35807c478bd9Sstevel@tonic-gate int 35817c478bd9Sstevel@tonic-gate zonecfg_add_rctl_value( 35827c478bd9Sstevel@tonic-gate struct zone_rctltab *tabptr, 35837c478bd9Sstevel@tonic-gate struct zone_rctlvaltab *valtabptr) 35847c478bd9Sstevel@tonic-gate { 35857c478bd9Sstevel@tonic-gate struct zone_rctlvaltab *last, *old, *new; 35867c478bd9Sstevel@tonic-gate rctlblk_t *rctlblk = alloca(rctlblk_size()); 35877c478bd9Sstevel@tonic-gate 35887c478bd9Sstevel@tonic-gate last = tabptr->zone_rctl_valptr; 35897c478bd9Sstevel@tonic-gate for (old = last; old != NULL; old = old->zone_rctlval_next) 35907c478bd9Sstevel@tonic-gate last = old; /* walk to the end of the list */ 35917c478bd9Sstevel@tonic-gate new = valtabptr; /* alloc'd by caller */ 35927c478bd9Sstevel@tonic-gate new->zone_rctlval_next = NULL; 35937c478bd9Sstevel@tonic-gate if (zonecfg_construct_rctlblk(valtabptr, rctlblk) != Z_OK) 35947c478bd9Sstevel@tonic-gate return (Z_INVAL); 35957c478bd9Sstevel@tonic-gate if (!zonecfg_valid_rctlblk(rctlblk)) 35967c478bd9Sstevel@tonic-gate return (Z_INVAL); 35977c478bd9Sstevel@tonic-gate if (last == NULL) 35987c478bd9Sstevel@tonic-gate tabptr->zone_rctl_valptr = new; 35997c478bd9Sstevel@tonic-gate else 36007c478bd9Sstevel@tonic-gate last->zone_rctlval_next = new; 36017c478bd9Sstevel@tonic-gate return (Z_OK); 36027c478bd9Sstevel@tonic-gate } 36037c478bd9Sstevel@tonic-gate 36047c478bd9Sstevel@tonic-gate int 36057c478bd9Sstevel@tonic-gate zonecfg_remove_rctl_value( 36067c478bd9Sstevel@tonic-gate struct zone_rctltab *tabptr, 36077c478bd9Sstevel@tonic-gate struct zone_rctlvaltab *valtabptr) 36087c478bd9Sstevel@tonic-gate { 36097c478bd9Sstevel@tonic-gate struct zone_rctlvaltab *last, *this, *next; 36107c478bd9Sstevel@tonic-gate 36117c478bd9Sstevel@tonic-gate last = tabptr->zone_rctl_valptr; 36127c478bd9Sstevel@tonic-gate for (this = last; this != NULL; this = this->zone_rctlval_next) { 36137c478bd9Sstevel@tonic-gate if (strcmp(this->zone_rctlval_priv, 36147c478bd9Sstevel@tonic-gate valtabptr->zone_rctlval_priv) == 0 && 36157c478bd9Sstevel@tonic-gate strcmp(this->zone_rctlval_limit, 36167c478bd9Sstevel@tonic-gate valtabptr->zone_rctlval_limit) == 0 && 36177c478bd9Sstevel@tonic-gate strcmp(this->zone_rctlval_action, 36187c478bd9Sstevel@tonic-gate valtabptr->zone_rctlval_action) == 0) { 36197c478bd9Sstevel@tonic-gate next = this->zone_rctlval_next; 36207c478bd9Sstevel@tonic-gate if (this == tabptr->zone_rctl_valptr) 36217c478bd9Sstevel@tonic-gate tabptr->zone_rctl_valptr = next; 36227c478bd9Sstevel@tonic-gate else 36237c478bd9Sstevel@tonic-gate last->zone_rctlval_next = next; 36247c478bd9Sstevel@tonic-gate free(this); 36257c478bd9Sstevel@tonic-gate return (Z_OK); 36267c478bd9Sstevel@tonic-gate } else 36277c478bd9Sstevel@tonic-gate last = this; 36287c478bd9Sstevel@tonic-gate } 36297c478bd9Sstevel@tonic-gate return (Z_NO_PROPERTY_ID); 36307c478bd9Sstevel@tonic-gate } 36317c478bd9Sstevel@tonic-gate 3632ff17c8bfSgjelinek void 3633ff17c8bfSgjelinek zonecfg_set_swinv(zone_dochandle_t handle) 3634ff17c8bfSgjelinek { 3635ff17c8bfSgjelinek handle->zone_dh_sw_inv = B_TRUE; 3636ff17c8bfSgjelinek } 3637ff17c8bfSgjelinek 3638ff17c8bfSgjelinek /* 3639ff17c8bfSgjelinek * Add the pkg to the sw inventory on the handle. 3640ff17c8bfSgjelinek */ 3641ff17c8bfSgjelinek int 3642ff17c8bfSgjelinek zonecfg_add_pkg(zone_dochandle_t handle, char *name, char *version) 3643ff17c8bfSgjelinek { 3644ff17c8bfSgjelinek xmlNodePtr newnode; 3645ff17c8bfSgjelinek xmlNodePtr cur; 3646ff17c8bfSgjelinek int err; 3647ff17c8bfSgjelinek 3648ff17c8bfSgjelinek if ((err = operation_prep(handle)) != Z_OK) 3649ff17c8bfSgjelinek return (err); 3650ff17c8bfSgjelinek 3651ff17c8bfSgjelinek cur = handle->zone_dh_cur; 3652ff17c8bfSgjelinek newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_PACKAGE, NULL); 3653ff17c8bfSgjelinek if ((err = newprop(newnode, DTD_ATTR_NAME, name)) != Z_OK) 3654ff17c8bfSgjelinek return (err); 3655ff17c8bfSgjelinek if ((err = newprop(newnode, DTD_ATTR_VERSION, version)) != Z_OK) 3656ff17c8bfSgjelinek return (err); 3657ff17c8bfSgjelinek return (Z_OK); 3658ff17c8bfSgjelinek } 3659ff17c8bfSgjelinek 36607c478bd9Sstevel@tonic-gate char * 36617c478bd9Sstevel@tonic-gate zonecfg_strerror(int errnum) 36627c478bd9Sstevel@tonic-gate { 36637c478bd9Sstevel@tonic-gate switch (errnum) { 36647c478bd9Sstevel@tonic-gate case Z_OK: 36657c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "OK")); 36667c478bd9Sstevel@tonic-gate case Z_EMPTY_DOCUMENT: 36677c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Empty document")); 36687c478bd9Sstevel@tonic-gate case Z_WRONG_DOC_TYPE: 36697c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Wrong document type")); 36707c478bd9Sstevel@tonic-gate case Z_BAD_PROPERTY: 36717c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Bad document property")); 36727c478bd9Sstevel@tonic-gate case Z_TEMP_FILE: 36737c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, 36747c478bd9Sstevel@tonic-gate "Problem creating temporary file")); 36757c478bd9Sstevel@tonic-gate case Z_SAVING_FILE: 36767c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Problem saving file")); 36777c478bd9Sstevel@tonic-gate case Z_NO_ENTRY: 36787c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "No such entry")); 36797c478bd9Sstevel@tonic-gate case Z_BOGUS_ZONE_NAME: 36807c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Bogus zone name")); 36817c478bd9Sstevel@tonic-gate case Z_REQD_RESOURCE_MISSING: 36827c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Required resource missing")); 36837c478bd9Sstevel@tonic-gate case Z_REQD_PROPERTY_MISSING: 36847c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Required property missing")); 36857c478bd9Sstevel@tonic-gate case Z_BAD_HANDLE: 36867c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Bad handle")); 36877c478bd9Sstevel@tonic-gate case Z_NOMEM: 36887c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Out of memory")); 36897c478bd9Sstevel@tonic-gate case Z_INVAL: 36907c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Invalid argument")); 36917c478bd9Sstevel@tonic-gate case Z_ACCES: 36927c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Permission denied")); 36937c478bd9Sstevel@tonic-gate case Z_TOO_BIG: 36947c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Argument list too long")); 36957c478bd9Sstevel@tonic-gate case Z_MISC_FS: 36967c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, 36977c478bd9Sstevel@tonic-gate "Miscellaneous file system error")); 36987c478bd9Sstevel@tonic-gate case Z_NO_ZONE: 36997c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "No such zone configured")); 37007c478bd9Sstevel@tonic-gate case Z_NO_RESOURCE_TYPE: 37017c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "No such resource type")); 37027c478bd9Sstevel@tonic-gate case Z_NO_RESOURCE_ID: 37037c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "No such resource with that id")); 37047c478bd9Sstevel@tonic-gate case Z_NO_PROPERTY_TYPE: 37057c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "No such property type")); 37067c478bd9Sstevel@tonic-gate case Z_NO_PROPERTY_ID: 37077c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "No such property with that id")); 3708087719fdSdp case Z_BAD_ZONE_STATE: 37097c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, 3710087719fdSdp "Zone state is invalid for the requested operation")); 37117c478bd9Sstevel@tonic-gate case Z_INVALID_DOCUMENT: 37127c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Invalid document")); 3713087719fdSdp case Z_NAME_IN_USE: 3714087719fdSdp return (dgettext(TEXT_DOMAIN, "Zone name already in use")); 37157c478bd9Sstevel@tonic-gate case Z_NO_SUCH_ID: 37167c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "No such zone ID")); 37177c478bd9Sstevel@tonic-gate case Z_UPDATING_INDEX: 37187c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Problem updating index file")); 37197c478bd9Sstevel@tonic-gate case Z_LOCKING_FILE: 37207c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Locking index file")); 37217c478bd9Sstevel@tonic-gate case Z_UNLOCKING_FILE: 37227c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Unlocking index file")); 37237c478bd9Sstevel@tonic-gate case Z_INSUFFICIENT_SPEC: 37247c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Insufficient specification")); 37257c478bd9Sstevel@tonic-gate case Z_RESOLVED_PATH: 37267c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Resolved path mismatch")); 37277c478bd9Sstevel@tonic-gate case Z_IPV6_ADDR_PREFIX_LEN: 37287c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, 37297c478bd9Sstevel@tonic-gate "IPv6 address missing required prefix length")); 37307c478bd9Sstevel@tonic-gate case Z_BOGUS_ADDRESS: 37317c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, 37327c478bd9Sstevel@tonic-gate "Neither an IPv4 nor an IPv6 address nor a host name")); 3733ffbafc53Scomay case Z_PRIV_PROHIBITED: 3734ffbafc53Scomay return (dgettext(TEXT_DOMAIN, 3735ffbafc53Scomay "Specified privilege is prohibited")); 3736ffbafc53Scomay case Z_PRIV_REQUIRED: 3737ffbafc53Scomay return (dgettext(TEXT_DOMAIN, 3738ffbafc53Scomay "Required privilege is missing")); 3739ffbafc53Scomay case Z_PRIV_UNKNOWN: 3740ffbafc53Scomay return (dgettext(TEXT_DOMAIN, 3741ffbafc53Scomay "Specified privilege is unknown")); 37429acbbeafSnn case Z_BRAND_ERROR: 37439acbbeafSnn return (dgettext(TEXT_DOMAIN, 37449acbbeafSnn "Brand-specific error")); 37450209230bSgjelinek case Z_INCOMPATIBLE: 37460209230bSgjelinek return (dgettext(TEXT_DOMAIN, "Incompatible settings")); 37470209230bSgjelinek case Z_ALIAS_DISALLOW: 37480209230bSgjelinek return (dgettext(TEXT_DOMAIN, 37490209230bSgjelinek "An incompatible rctl already exists for this property")); 37500209230bSgjelinek case Z_CLEAR_DISALLOW: 37510209230bSgjelinek return (dgettext(TEXT_DOMAIN, 37520209230bSgjelinek "Clearing this property is not allowed")); 37530209230bSgjelinek case Z_POOL: 37540209230bSgjelinek return (dgettext(TEXT_DOMAIN, "libpool(3LIB) error")); 37550209230bSgjelinek case Z_POOLS_NOT_ACTIVE: 37560209230bSgjelinek return (dgettext(TEXT_DOMAIN, "Pools facility not active; " 37570209230bSgjelinek "zone will not be bound to pool")); 37580209230bSgjelinek case Z_POOL_ENABLE: 37590209230bSgjelinek return (dgettext(TEXT_DOMAIN, 37600209230bSgjelinek "Could not enable pools facility")); 37610209230bSgjelinek case Z_NO_POOL: 37620209230bSgjelinek return (dgettext(TEXT_DOMAIN, 37630209230bSgjelinek "Pool not found; using default pool")); 37640209230bSgjelinek case Z_POOL_CREATE: 37650209230bSgjelinek return (dgettext(TEXT_DOMAIN, 37660209230bSgjelinek "Could not create a temporary pool")); 37670209230bSgjelinek case Z_POOL_BIND: 37680209230bSgjelinek return (dgettext(TEXT_DOMAIN, "Could not bind zone to pool")); 37690fbb751dSJohn Levon case Z_INVALID_PROPERTY: 37700fbb751dSJohn Levon return (dgettext(TEXT_DOMAIN, "Specified property is invalid")); 37712ad45a84Sjv case Z_SYSTEM: 37722ad45a84Sjv return (strerror(errno)); 37737c478bd9Sstevel@tonic-gate default: 37747c478bd9Sstevel@tonic-gate return (dgettext(TEXT_DOMAIN, "Unknown error")); 37757c478bd9Sstevel@tonic-gate } 37767c478bd9Sstevel@tonic-gate } 37777c478bd9Sstevel@tonic-gate 37787c478bd9Sstevel@tonic-gate /* 37797c478bd9Sstevel@tonic-gate * Note that the zonecfg_setXent() and zonecfg_endXent() calls are all the 37807c478bd9Sstevel@tonic-gate * same, as they just turn around and call zonecfg_setent() / zonecfg_endent(). 37817c478bd9Sstevel@tonic-gate */ 37827c478bd9Sstevel@tonic-gate 37837c478bd9Sstevel@tonic-gate static int 37847c478bd9Sstevel@tonic-gate zonecfg_setent(zone_dochandle_t handle) 37857c478bd9Sstevel@tonic-gate { 37867c478bd9Sstevel@tonic-gate xmlNodePtr cur; 37877c478bd9Sstevel@tonic-gate int err; 37887c478bd9Sstevel@tonic-gate 37897c478bd9Sstevel@tonic-gate if (handle == NULL) 37907c478bd9Sstevel@tonic-gate return (Z_INVAL); 37917c478bd9Sstevel@tonic-gate 37927c478bd9Sstevel@tonic-gate if ((err = operation_prep(handle)) != Z_OK) { 37937c478bd9Sstevel@tonic-gate handle->zone_dh_cur = NULL; 37947c478bd9Sstevel@tonic-gate return (err); 37957c478bd9Sstevel@tonic-gate } 37967c478bd9Sstevel@tonic-gate cur = handle->zone_dh_cur; 37977c478bd9Sstevel@tonic-gate cur = cur->xmlChildrenNode; 37987c478bd9Sstevel@tonic-gate handle->zone_dh_cur = cur; 37997c478bd9Sstevel@tonic-gate return (Z_OK); 38007c478bd9Sstevel@tonic-gate } 38017c478bd9Sstevel@tonic-gate 38027c478bd9Sstevel@tonic-gate static int 38037c478bd9Sstevel@tonic-gate zonecfg_endent(zone_dochandle_t handle) 38047c478bd9Sstevel@tonic-gate { 38057c478bd9Sstevel@tonic-gate if (handle == NULL) 38067c478bd9Sstevel@tonic-gate return (Z_INVAL); 38077c478bd9Sstevel@tonic-gate 38087c478bd9Sstevel@tonic-gate handle->zone_dh_cur = handle->zone_dh_top; 38097c478bd9Sstevel@tonic-gate return (Z_OK); 38107c478bd9Sstevel@tonic-gate } 38117c478bd9Sstevel@tonic-gate 38120209230bSgjelinek /* 38130209230bSgjelinek * Do the work required to manipulate a process through libproc. 38140209230bSgjelinek * If grab_process() returns no errors (0), then release_process() 38150209230bSgjelinek * must eventually be called. 38160209230bSgjelinek * 38170209230bSgjelinek * Return values: 38180209230bSgjelinek * 0 Successful creation of agent thread 38190209230bSgjelinek * 1 Error grabbing 38200209230bSgjelinek * 2 Error creating agent 38210209230bSgjelinek */ 38220209230bSgjelinek static int 38230209230bSgjelinek grab_process(pr_info_handle_t *p) 38247c478bd9Sstevel@tonic-gate { 38250209230bSgjelinek int ret; 38260209230bSgjelinek 38270209230bSgjelinek if ((p->pr = Pgrab(p->pid, 0, &ret)) != NULL) { 38280209230bSgjelinek 38290209230bSgjelinek if (Psetflags(p->pr, PR_RLC) != 0) { 38300209230bSgjelinek Prelease(p->pr, 0); 38310209230bSgjelinek return (1); 38320209230bSgjelinek } 38330209230bSgjelinek if (Pcreate_agent(p->pr) == 0) { 38340209230bSgjelinek return (0); 38350209230bSgjelinek 38360209230bSgjelinek } else { 38370209230bSgjelinek Prelease(p->pr, 0); 38380209230bSgjelinek return (2); 38390209230bSgjelinek } 38400209230bSgjelinek } else { 38410209230bSgjelinek return (1); 38420209230bSgjelinek } 38437c478bd9Sstevel@tonic-gate } 38447c478bd9Sstevel@tonic-gate 38450209230bSgjelinek /* 38460209230bSgjelinek * Release the specified process. This destroys the agent 38470209230bSgjelinek * and releases the process. If the process is NULL, nothing 38480209230bSgjelinek * is done. This function should only be called if grab_process() 38490209230bSgjelinek * has previously been called and returned success. 38500209230bSgjelinek * 38510209230bSgjelinek * This function is Pgrab-safe. 38520209230bSgjelinek */ 38530209230bSgjelinek static void 38540209230bSgjelinek release_process(struct ps_prochandle *Pr) 38557c478bd9Sstevel@tonic-gate { 38560209230bSgjelinek if (Pr == NULL) 38570209230bSgjelinek return; 38587c478bd9Sstevel@tonic-gate 38590209230bSgjelinek Pdestroy_agent(Pr); 38600209230bSgjelinek Prelease(Pr, 0); 38610209230bSgjelinek } 38627c478bd9Sstevel@tonic-gate 38630209230bSgjelinek static boolean_t 38640209230bSgjelinek grab_zone_proc(char *zonename, pr_info_handle_t *p) 38650209230bSgjelinek { 38660209230bSgjelinek DIR *dirp; 38670209230bSgjelinek struct dirent *dentp; 38680209230bSgjelinek zoneid_t zoneid; 38690209230bSgjelinek int pid_self; 38700209230bSgjelinek psinfo_t psinfo; 38717c478bd9Sstevel@tonic-gate 38720209230bSgjelinek if (zone_get_id(zonename, &zoneid) != 0) 38730209230bSgjelinek return (B_FALSE); 38747c478bd9Sstevel@tonic-gate 38750209230bSgjelinek pid_self = getpid(); 38767c478bd9Sstevel@tonic-gate 38770209230bSgjelinek if ((dirp = opendir("/proc")) == NULL) 38780209230bSgjelinek return (B_FALSE); 38797c478bd9Sstevel@tonic-gate 38800209230bSgjelinek while (dentp = readdir(dirp)) { 38810209230bSgjelinek p->pid = atoi(dentp->d_name); 38827c478bd9Sstevel@tonic-gate 38830209230bSgjelinek /* Skip self */ 38840209230bSgjelinek if (p->pid == pid_self) 38850209230bSgjelinek continue; 38867c478bd9Sstevel@tonic-gate 38870209230bSgjelinek if (proc_get_psinfo(p->pid, &psinfo) != 0) 38880209230bSgjelinek continue; 38890209230bSgjelinek 38900209230bSgjelinek if (psinfo.pr_zoneid != zoneid) 38910209230bSgjelinek continue; 38920209230bSgjelinek 38930209230bSgjelinek /* attempt to grab process */ 38940209230bSgjelinek if (grab_process(p) != 0) 38950209230bSgjelinek continue; 38960209230bSgjelinek 38970209230bSgjelinek if (pr_getzoneid(p->pr) != zoneid) { 38980209230bSgjelinek release_process(p->pr); 38990209230bSgjelinek continue; 39000209230bSgjelinek } 39010209230bSgjelinek 39020209230bSgjelinek (void) closedir(dirp); 39030209230bSgjelinek return (B_TRUE); 39047c478bd9Sstevel@tonic-gate } 39057c478bd9Sstevel@tonic-gate 39060209230bSgjelinek (void) closedir(dirp); 39070209230bSgjelinek return (B_FALSE); 39087c478bd9Sstevel@tonic-gate } 39097c478bd9Sstevel@tonic-gate 39100209230bSgjelinek static boolean_t 39110209230bSgjelinek get_priv_rctl(struct ps_prochandle *pr, char *name, rctlblk_t *rblk) 39127c478bd9Sstevel@tonic-gate { 39130209230bSgjelinek if (pr_getrctl(pr, name, NULL, rblk, RCTL_FIRST)) 39140209230bSgjelinek return (B_FALSE); 39157c478bd9Sstevel@tonic-gate 39160209230bSgjelinek if (rctlblk_get_privilege(rblk) == RCPRIV_PRIVILEGED) 39170209230bSgjelinek return (B_TRUE); 39180209230bSgjelinek 39190209230bSgjelinek while (pr_getrctl(pr, name, rblk, rblk, RCTL_NEXT) == 0) { 39200209230bSgjelinek if (rctlblk_get_privilege(rblk) == RCPRIV_PRIVILEGED) 39210209230bSgjelinek return (B_TRUE); 39220209230bSgjelinek } 39230209230bSgjelinek 39240209230bSgjelinek return (B_FALSE); 39257c478bd9Sstevel@tonic-gate } 39267c478bd9Sstevel@tonic-gate 39270209230bSgjelinek /* 39280209230bSgjelinek * Apply the current rctl settings to the specified, running zone. 39290209230bSgjelinek */ 39307c478bd9Sstevel@tonic-gate int 39310209230bSgjelinek zonecfg_apply_rctls(char *zone_name, zone_dochandle_t handle) 39327c478bd9Sstevel@tonic-gate { 39337c478bd9Sstevel@tonic-gate int err; 39340209230bSgjelinek int res = Z_OK; 39350209230bSgjelinek rctlblk_t *rblk; 39360209230bSgjelinek pr_info_handle_t p; 39370209230bSgjelinek struct zone_rctltab rctl; 39387c478bd9Sstevel@tonic-gate 39390209230bSgjelinek if ((err = zonecfg_setrctlent(handle)) != Z_OK) 39400209230bSgjelinek return (err); 39417c478bd9Sstevel@tonic-gate 39420209230bSgjelinek if ((rblk = (rctlblk_t *)malloc(rctlblk_size())) == NULL) { 39430209230bSgjelinek (void) zonecfg_endrctlent(handle); 39440209230bSgjelinek return (Z_NOMEM); 39450209230bSgjelinek } 39467c478bd9Sstevel@tonic-gate 39470209230bSgjelinek if (!grab_zone_proc(zone_name, &p)) { 39480209230bSgjelinek (void) zonecfg_endrctlent(handle); 39490209230bSgjelinek free(rblk); 39500209230bSgjelinek return (Z_SYSTEM); 39517c478bd9Sstevel@tonic-gate } 39527c478bd9Sstevel@tonic-gate 39530209230bSgjelinek while (zonecfg_getrctlent(handle, &rctl) == Z_OK) { 39540209230bSgjelinek char *rname; 39550209230bSgjelinek struct zone_rctlvaltab *valptr; 39560209230bSgjelinek 39570209230bSgjelinek rname = rctl.zone_rctl_name; 39580209230bSgjelinek 39590209230bSgjelinek /* first delete all current privileged settings for this rctl */ 39600209230bSgjelinek while (get_priv_rctl(p.pr, rname, rblk)) { 39610209230bSgjelinek if (pr_setrctl(p.pr, rname, NULL, rblk, RCTL_DELETE) != 39620209230bSgjelinek 0) { 39630209230bSgjelinek res = Z_SYSTEM; 39640209230bSgjelinek goto done; 39650209230bSgjelinek } 39660209230bSgjelinek } 39670209230bSgjelinek 39680209230bSgjelinek /* now set each new value for the rctl */ 39690209230bSgjelinek for (valptr = rctl.zone_rctl_valptr; valptr != NULL; 39700209230bSgjelinek valptr = valptr->zone_rctlval_next) { 39710209230bSgjelinek if ((err = zonecfg_construct_rctlblk(valptr, rblk)) 39720209230bSgjelinek != Z_OK) { 39730209230bSgjelinek res = errno = err; 39740209230bSgjelinek goto done; 39750209230bSgjelinek } 39760209230bSgjelinek 39770209230bSgjelinek if (pr_setrctl(p.pr, rname, NULL, rblk, RCTL_INSERT)) { 39780209230bSgjelinek res = Z_SYSTEM; 39790209230bSgjelinek goto done; 39800209230bSgjelinek } 39810209230bSgjelinek } 39827c478bd9Sstevel@tonic-gate } 39837c478bd9Sstevel@tonic-gate 39840209230bSgjelinek done: 39850209230bSgjelinek release_process(p.pr); 39860209230bSgjelinek free(rblk); 39870209230bSgjelinek (void) zonecfg_endrctlent(handle); 39880209230bSgjelinek 39890209230bSgjelinek return (res); 39907c478bd9Sstevel@tonic-gate } 39917c478bd9Sstevel@tonic-gate 39920209230bSgjelinek static const xmlChar * 39930209230bSgjelinek nm_to_dtd(char *nm) 39947c478bd9Sstevel@tonic-gate { 39950209230bSgjelinek if (strcmp(nm, "device") == 0) 39960209230bSgjelinek return (DTD_ELEM_DEVICE); 39970209230bSgjelinek if (strcmp(nm, "fs") == 0) 39980209230bSgjelinek return (DTD_ELEM_FS); 39990209230bSgjelinek if (strcmp(nm, "net") == 0) 40000209230bSgjelinek return (DTD_ELEM_NET); 40010209230bSgjelinek if (strcmp(nm, "attr") == 0) 40020209230bSgjelinek return (DTD_ELEM_ATTR); 40030209230bSgjelinek if (strcmp(nm, "rctl") == 0) 40040209230bSgjelinek return (DTD_ELEM_RCTL); 40050209230bSgjelinek if (strcmp(nm, "dataset") == 0) 40060209230bSgjelinek return (DTD_ELEM_DATASET); 4007cb8a054bSGlenn Faden if (strcmp(nm, "admin") == 0) 4008cb8a054bSGlenn Faden return (DTD_ELEM_ADMIN); 40090209230bSgjelinek 40100209230bSgjelinek return (NULL); 40117c478bd9Sstevel@tonic-gate } 40127c478bd9Sstevel@tonic-gate 40137c478bd9Sstevel@tonic-gate int 40140209230bSgjelinek zonecfg_num_resources(zone_dochandle_t handle, char *rsrc) 40157c478bd9Sstevel@tonic-gate { 40160209230bSgjelinek int num = 0; 40170209230bSgjelinek const xmlChar *dtd; 40180209230bSgjelinek xmlNodePtr cur; 40190209230bSgjelinek 40200209230bSgjelinek if ((dtd = nm_to_dtd(rsrc)) == NULL) 40210209230bSgjelinek return (num); 40220209230bSgjelinek 40230209230bSgjelinek if (zonecfg_setent(handle) != Z_OK) 40240209230bSgjelinek return (num); 40250209230bSgjelinek 40260209230bSgjelinek for (cur = handle->zone_dh_cur; cur != NULL; cur = cur->next) 40270209230bSgjelinek if (xmlStrcmp(cur->name, dtd) == 0) 40280209230bSgjelinek num++; 40290209230bSgjelinek 40300209230bSgjelinek (void) zonecfg_endent(handle); 40310209230bSgjelinek 40320209230bSgjelinek return (num); 40337c478bd9Sstevel@tonic-gate } 40347c478bd9Sstevel@tonic-gate 40357c478bd9Sstevel@tonic-gate int 40360209230bSgjelinek zonecfg_del_all_resources(zone_dochandle_t handle, char *rsrc) 40377c478bd9Sstevel@tonic-gate { 40387c478bd9Sstevel@tonic-gate int err; 40390209230bSgjelinek const xmlChar *dtd; 40400209230bSgjelinek xmlNodePtr cur; 40417c478bd9Sstevel@tonic-gate 40420209230bSgjelinek if ((dtd = nm_to_dtd(rsrc)) == NULL) 40430209230bSgjelinek return (Z_NO_RESOURCE_TYPE); 40447c478bd9Sstevel@tonic-gate 40450209230bSgjelinek if ((err = zonecfg_setent(handle)) != Z_OK) 40460209230bSgjelinek return (err); 40477c478bd9Sstevel@tonic-gate 40480209230bSgjelinek cur = handle->zone_dh_cur; 40490209230bSgjelinek while (cur != NULL) { 40500209230bSgjelinek xmlNodePtr tmp; 40517c478bd9Sstevel@tonic-gate 40520209230bSgjelinek if (xmlStrcmp(cur->name, dtd)) { 40530209230bSgjelinek cur = cur->next; 40540209230bSgjelinek continue; 40550209230bSgjelinek } 40567c478bd9Sstevel@tonic-gate 40570209230bSgjelinek tmp = cur->next; 40580209230bSgjelinek xmlUnlinkNode(cur); 40590209230bSgjelinek xmlFreeNode(cur); 40600209230bSgjelinek cur = tmp; 40617c478bd9Sstevel@tonic-gate } 40627c478bd9Sstevel@tonic-gate 40630209230bSgjelinek (void) zonecfg_endent(handle); 40647c478bd9Sstevel@tonic-gate return (Z_OK); 40657c478bd9Sstevel@tonic-gate } 40667c478bd9Sstevel@tonic-gate 40670209230bSgjelinek static boolean_t 40680209230bSgjelinek valid_uint(char *s, uint64_t *n) 40697c478bd9Sstevel@tonic-gate { 40700209230bSgjelinek char *endp; 40717c478bd9Sstevel@tonic-gate 40720209230bSgjelinek /* strtoull accepts '-'?! so we want to flag that as an error */ 40730209230bSgjelinek if (strchr(s, '-') != NULL) 40740209230bSgjelinek return (B_FALSE); 40750209230bSgjelinek 40760209230bSgjelinek errno = 0; 40770209230bSgjelinek *n = strtoull(s, &endp, 10); 40780209230bSgjelinek 40790209230bSgjelinek if (errno != 0 || *endp != '\0') 40800209230bSgjelinek return (B_FALSE); 40810209230bSgjelinek return (B_TRUE); 40827c478bd9Sstevel@tonic-gate } 40837c478bd9Sstevel@tonic-gate 40840209230bSgjelinek /* 40850209230bSgjelinek * Convert a string representing a number (possibly a fraction) into an integer. 40860209230bSgjelinek * The string can have a modifier (K, M, G or T). The modifiers are treated 40870209230bSgjelinek * as powers of two (not 10). 40880209230bSgjelinek */ 40897c478bd9Sstevel@tonic-gate int 40900209230bSgjelinek zonecfg_str_to_bytes(char *str, uint64_t *bytes) 40917c478bd9Sstevel@tonic-gate { 40920209230bSgjelinek long double val; 40930209230bSgjelinek char *unitp; 40940209230bSgjelinek uint64_t scale; 40957c478bd9Sstevel@tonic-gate 40960209230bSgjelinek if ((val = strtold(str, &unitp)) < 0) 40970209230bSgjelinek return (-1); 40987c478bd9Sstevel@tonic-gate 40990209230bSgjelinek /* remove any leading white space from units string */ 41000209230bSgjelinek while (isspace(*unitp) != 0) 41010209230bSgjelinek ++unitp; 41027c478bd9Sstevel@tonic-gate 41030209230bSgjelinek /* if no units explicitly set, error */ 41040209230bSgjelinek if (unitp == NULL || *unitp == '\0') { 41050209230bSgjelinek scale = 1; 41060209230bSgjelinek } else { 41070209230bSgjelinek int i; 41080209230bSgjelinek char *units[] = {"K", "M", "G", "T", NULL}; 41097c478bd9Sstevel@tonic-gate 41100209230bSgjelinek scale = 1024; 41110209230bSgjelinek 41120209230bSgjelinek /* update scale based on units */ 41130209230bSgjelinek for (i = 0; units[i] != NULL; i++) { 41140209230bSgjelinek if (strcasecmp(unitp, units[i]) == 0) 41150209230bSgjelinek break; 41160209230bSgjelinek scale <<= 10; 41170209230bSgjelinek } 41180209230bSgjelinek 41190209230bSgjelinek if (units[i] == NULL) 41200209230bSgjelinek return (-1); 41217c478bd9Sstevel@tonic-gate } 41227c478bd9Sstevel@tonic-gate 41230209230bSgjelinek *bytes = (uint64_t)(val * scale); 41240209230bSgjelinek return (0); 41257c478bd9Sstevel@tonic-gate } 41267c478bd9Sstevel@tonic-gate 41270209230bSgjelinek boolean_t 41280209230bSgjelinek zonecfg_valid_ncpus(char *lowstr, char *highstr) 41297c478bd9Sstevel@tonic-gate { 41300209230bSgjelinek uint64_t low, high; 41317c478bd9Sstevel@tonic-gate 41320209230bSgjelinek if (!valid_uint(lowstr, &low) || !valid_uint(highstr, &high) || 41330209230bSgjelinek low < 1 || low > high) 41340209230bSgjelinek return (B_FALSE); 41350209230bSgjelinek 41360209230bSgjelinek return (B_TRUE); 41377c478bd9Sstevel@tonic-gate } 41387c478bd9Sstevel@tonic-gate 41390209230bSgjelinek boolean_t 41400209230bSgjelinek zonecfg_valid_importance(char *impstr) 41417c478bd9Sstevel@tonic-gate { 41420209230bSgjelinek uint64_t num; 41437c478bd9Sstevel@tonic-gate 41440209230bSgjelinek if (!valid_uint(impstr, &num)) 41450209230bSgjelinek return (B_FALSE); 41467c478bd9Sstevel@tonic-gate 41470209230bSgjelinek return (B_TRUE); 41480209230bSgjelinek } 41497c478bd9Sstevel@tonic-gate 41500209230bSgjelinek boolean_t 41510209230bSgjelinek zonecfg_valid_alias_limit(char *name, char *limitstr, uint64_t *limit) 41520209230bSgjelinek { 41530209230bSgjelinek int i; 41540209230bSgjelinek 41550209230bSgjelinek for (i = 0; aliases[i].shortname != NULL; i++) 41560209230bSgjelinek if (strcmp(name, aliases[i].shortname) == 0) 41577c478bd9Sstevel@tonic-gate break; 41587c478bd9Sstevel@tonic-gate 41590209230bSgjelinek if (aliases[i].shortname == NULL) 41600209230bSgjelinek return (B_FALSE); 41617c478bd9Sstevel@tonic-gate 41620209230bSgjelinek if (!valid_uint(limitstr, limit) || *limit < aliases[i].low_limit) 41630209230bSgjelinek return (B_FALSE); 41647c478bd9Sstevel@tonic-gate 41650209230bSgjelinek return (B_TRUE); 41667c478bd9Sstevel@tonic-gate } 41677c478bd9Sstevel@tonic-gate 41680209230bSgjelinek boolean_t 41690209230bSgjelinek zonecfg_valid_memlimit(char *memstr, uint64_t *mem_val) 41707c478bd9Sstevel@tonic-gate { 41710209230bSgjelinek if (zonecfg_str_to_bytes(memstr, mem_val) != 0) 41720209230bSgjelinek return (B_FALSE); 41730209230bSgjelinek 41740209230bSgjelinek return (B_TRUE); 41757c478bd9Sstevel@tonic-gate } 41767c478bd9Sstevel@tonic-gate 41770209230bSgjelinek static int 41780209230bSgjelinek zerr_pool(char *pool_err, int err_size, int res) 41797c478bd9Sstevel@tonic-gate { 41800209230bSgjelinek (void) strlcpy(pool_err, pool_strerror(pool_error()), err_size); 41810209230bSgjelinek return (res); 41827c478bd9Sstevel@tonic-gate } 41837c478bd9Sstevel@tonic-gate 41840209230bSgjelinek static int 41850209230bSgjelinek create_tmp_pset(char *pool_err, int err_size, pool_conf_t *pconf, pool_t *pool, 41860209230bSgjelinek char *name, int min, int max) 41877c478bd9Sstevel@tonic-gate { 41880209230bSgjelinek pool_resource_t *res; 41890209230bSgjelinek pool_elem_t *elem; 41900209230bSgjelinek pool_value_t *val; 41917c478bd9Sstevel@tonic-gate 41920209230bSgjelinek if ((res = pool_resource_create(pconf, "pset", name)) == NULL) 41930209230bSgjelinek return (zerr_pool(pool_err, err_size, Z_POOL)); 41947c478bd9Sstevel@tonic-gate 41950209230bSgjelinek if (pool_associate(pconf, pool, res) != PO_SUCCESS) 41960209230bSgjelinek return (zerr_pool(pool_err, err_size, Z_POOL)); 41977c478bd9Sstevel@tonic-gate 41980209230bSgjelinek if ((elem = pool_resource_to_elem(pconf, res)) == NULL) 41990209230bSgjelinek return (zerr_pool(pool_err, err_size, Z_POOL)); 42007c478bd9Sstevel@tonic-gate 42010209230bSgjelinek if ((val = pool_value_alloc()) == NULL) 42020209230bSgjelinek return (zerr_pool(pool_err, err_size, Z_POOL)); 42037c478bd9Sstevel@tonic-gate 42040209230bSgjelinek /* set the maximum number of cpus for the pset */ 42050209230bSgjelinek pool_value_set_uint64(val, (uint64_t)max); 42060209230bSgjelinek 42070209230bSgjelinek if (pool_put_property(pconf, elem, "pset.max", val) != PO_SUCCESS) { 42080209230bSgjelinek pool_value_free(val); 42090209230bSgjelinek return (zerr_pool(pool_err, err_size, Z_POOL)); 42107c478bd9Sstevel@tonic-gate } 42117c478bd9Sstevel@tonic-gate 42120209230bSgjelinek /* set the minimum number of cpus for the pset */ 42130209230bSgjelinek pool_value_set_uint64(val, (uint64_t)min); 42140209230bSgjelinek 42150209230bSgjelinek if (pool_put_property(pconf, elem, "pset.min", val) != PO_SUCCESS) { 42160209230bSgjelinek pool_value_free(val); 42170209230bSgjelinek return (zerr_pool(pool_err, err_size, Z_POOL)); 42187c478bd9Sstevel@tonic-gate } 42197c478bd9Sstevel@tonic-gate 42200209230bSgjelinek pool_value_free(val); 42210209230bSgjelinek 42227c478bd9Sstevel@tonic-gate return (Z_OK); 42237c478bd9Sstevel@tonic-gate } 42247c478bd9Sstevel@tonic-gate 42250209230bSgjelinek static int 42260209230bSgjelinek create_tmp_pool(char *pool_err, int err_size, pool_conf_t *pconf, char *name, 42270209230bSgjelinek struct zone_psettab *pset_tab) 42287c478bd9Sstevel@tonic-gate { 42290209230bSgjelinek pool_t *pool; 42300209230bSgjelinek int res = Z_OK; 42317c478bd9Sstevel@tonic-gate 42320209230bSgjelinek /* create a temporary pool configuration */ 42330209230bSgjelinek if (pool_conf_open(pconf, NULL, PO_TEMP) != PO_SUCCESS) { 42340209230bSgjelinek res = zerr_pool(pool_err, err_size, Z_POOL); 42350209230bSgjelinek return (res); 42360209230bSgjelinek } 4237ffbafc53Scomay 42380209230bSgjelinek if ((pool = pool_create(pconf, name)) == NULL) { 42390209230bSgjelinek res = zerr_pool(pool_err, err_size, Z_POOL_CREATE); 42400209230bSgjelinek goto done; 42410209230bSgjelinek } 4242ffbafc53Scomay 42430209230bSgjelinek /* set pool importance */ 42440209230bSgjelinek if (pset_tab->zone_importance[0] != '\0') { 42450209230bSgjelinek pool_elem_t *elem; 42460209230bSgjelinek pool_value_t *val; 42479acbbeafSnn 42480209230bSgjelinek if ((elem = pool_to_elem(pconf, pool)) == NULL) { 42490209230bSgjelinek res = zerr_pool(pool_err, err_size, Z_POOL); 42500209230bSgjelinek goto done; 42510209230bSgjelinek } 42529acbbeafSnn 42530209230bSgjelinek if ((val = pool_value_alloc()) == NULL) { 42540209230bSgjelinek res = zerr_pool(pool_err, err_size, Z_POOL); 42550209230bSgjelinek goto done; 42560209230bSgjelinek } 42579acbbeafSnn 42580209230bSgjelinek pool_value_set_int64(val, 42590209230bSgjelinek (int64_t)atoi(pset_tab->zone_importance)); 42609acbbeafSnn 42610209230bSgjelinek if (pool_put_property(pconf, elem, "pool.importance", val) 42620209230bSgjelinek != PO_SUCCESS) { 42630209230bSgjelinek res = zerr_pool(pool_err, err_size, Z_POOL); 42640209230bSgjelinek pool_value_free(val); 42650209230bSgjelinek goto done; 42660209230bSgjelinek } 42679acbbeafSnn 42680209230bSgjelinek pool_value_free(val); 42699acbbeafSnn } 42709acbbeafSnn 42710209230bSgjelinek if ((res = create_tmp_pset(pool_err, err_size, pconf, pool, name, 42720209230bSgjelinek atoi(pset_tab->zone_ncpu_min), 42730209230bSgjelinek atoi(pset_tab->zone_ncpu_max))) != Z_OK) 42740209230bSgjelinek goto done; 42750209230bSgjelinek 42760209230bSgjelinek /* validation */ 42770209230bSgjelinek if (pool_conf_status(pconf) == POF_INVALID) { 42780209230bSgjelinek res = zerr_pool(pool_err, err_size, Z_POOL); 42790209230bSgjelinek goto done; 42809acbbeafSnn } 42819acbbeafSnn 42820209230bSgjelinek /* 42830209230bSgjelinek * This validation is the one we expect to fail if the user specified 42840209230bSgjelinek * an invalid configuration (too many cpus) for this system. 42850209230bSgjelinek */ 42860209230bSgjelinek if (pool_conf_validate(pconf, POV_RUNTIME) != PO_SUCCESS) { 42870209230bSgjelinek res = zerr_pool(pool_err, err_size, Z_POOL_CREATE); 42880209230bSgjelinek goto done; 42890209230bSgjelinek } 42909acbbeafSnn 42910209230bSgjelinek /* 42920209230bSgjelinek * Commit the dynamic configuration but not the pool configuration 42930209230bSgjelinek * file. 42940209230bSgjelinek */ 42950209230bSgjelinek if (pool_conf_commit(pconf, 1) != PO_SUCCESS) 42960209230bSgjelinek res = zerr_pool(pool_err, err_size, Z_POOL); 42979acbbeafSnn 42980209230bSgjelinek done: 42990209230bSgjelinek (void) pool_conf_close(pconf); 43000209230bSgjelinek return (res); 43019acbbeafSnn } 43029acbbeafSnn 43039acbbeafSnn static int 43040209230bSgjelinek get_running_tmp_pset(pool_conf_t *pconf, pool_t *pool, pool_resource_t *pset, 43050209230bSgjelinek struct zone_psettab *pset_tab) 43060209230bSgjelinek { 43070209230bSgjelinek int nfound = 0; 43080209230bSgjelinek pool_elem_t *pe; 43090209230bSgjelinek pool_value_t *pv = pool_value_alloc(); 43100209230bSgjelinek uint64_t val_uint; 43110209230bSgjelinek 43120209230bSgjelinek if (pool != NULL) { 43130209230bSgjelinek pe = pool_to_elem(pconf, pool); 43140209230bSgjelinek if (pool_get_property(pconf, pe, "pool.importance", pv) 43150209230bSgjelinek != POC_INVAL) { 43160209230bSgjelinek int64_t val_int; 43170209230bSgjelinek 43180209230bSgjelinek (void) pool_value_get_int64(pv, &val_int); 43190209230bSgjelinek (void) snprintf(pset_tab->zone_importance, 43200209230bSgjelinek sizeof (pset_tab->zone_importance), "%d", val_int); 43210209230bSgjelinek nfound++; 43220209230bSgjelinek } 43239acbbeafSnn } 43249acbbeafSnn 43250209230bSgjelinek if (pset != NULL) { 43260209230bSgjelinek pe = pool_resource_to_elem(pconf, pset); 43270209230bSgjelinek if (pool_get_property(pconf, pe, "pset.min", pv) != POC_INVAL) { 43280209230bSgjelinek (void) pool_value_get_uint64(pv, &val_uint); 43290209230bSgjelinek (void) snprintf(pset_tab->zone_ncpu_min, 43300209230bSgjelinek sizeof (pset_tab->zone_ncpu_min), "%u", val_uint); 43310209230bSgjelinek nfound++; 43320209230bSgjelinek } 43339acbbeafSnn 43340209230bSgjelinek if (pool_get_property(pconf, pe, "pset.max", pv) != POC_INVAL) { 43350209230bSgjelinek (void) pool_value_get_uint64(pv, &val_uint); 43360209230bSgjelinek (void) snprintf(pset_tab->zone_ncpu_max, 43370209230bSgjelinek sizeof (pset_tab->zone_ncpu_max), "%u", val_uint); 43380209230bSgjelinek nfound++; 43390209230bSgjelinek } 43409acbbeafSnn } 43419acbbeafSnn 43420209230bSgjelinek pool_value_free(pv); 43439acbbeafSnn 43440209230bSgjelinek if (nfound == 3) 43450209230bSgjelinek return (PO_SUCCESS); 43460209230bSgjelinek 43470209230bSgjelinek return (PO_FAIL); 43489acbbeafSnn } 43499acbbeafSnn 43500209230bSgjelinek /* 43510209230bSgjelinek * Determine if a tmp pool is configured and if so, if the configuration is 43520209230bSgjelinek * still valid or if it has been changed since the tmp pool was created. 43530209230bSgjelinek * If the tmp pool configuration is no longer valid, delete the tmp pool. 43540209230bSgjelinek * 43550209230bSgjelinek * Set *valid=B_TRUE if there is an existing, valid tmp pool configuration. 43560209230bSgjelinek */ 43579acbbeafSnn static int 43580209230bSgjelinek verify_del_tmp_pool(pool_conf_t *pconf, char *tmp_name, char *pool_err, 43590209230bSgjelinek int err_size, struct zone_psettab *pset_tab, boolean_t *exists) 43609acbbeafSnn { 43610209230bSgjelinek int res = Z_OK; 43620209230bSgjelinek pool_t *pool; 43630209230bSgjelinek pool_resource_t *pset; 43640209230bSgjelinek struct zone_psettab pset_current; 43657c478bd9Sstevel@tonic-gate 43660209230bSgjelinek *exists = B_FALSE; 43677c478bd9Sstevel@tonic-gate 43680209230bSgjelinek if (pool_conf_open(pconf, pool_dynamic_location(), PO_RDWR) 43690209230bSgjelinek != PO_SUCCESS) { 43700209230bSgjelinek res = zerr_pool(pool_err, err_size, Z_POOL); 43710209230bSgjelinek return (res); 43720209230bSgjelinek } 43737c478bd9Sstevel@tonic-gate 43740209230bSgjelinek pool = pool_get_pool(pconf, tmp_name); 43750209230bSgjelinek pset = pool_get_resource(pconf, "pset", tmp_name); 43760209230bSgjelinek 43770209230bSgjelinek if (pool == NULL && pset == NULL) { 43780209230bSgjelinek /* no tmp pool configured */ 43790209230bSgjelinek goto done; 43807c478bd9Sstevel@tonic-gate } 43819acbbeafSnn 43820209230bSgjelinek /* 43830209230bSgjelinek * If an existing tmp pool for this zone is configured with the proper 43840209230bSgjelinek * settings, then the tmp pool is valid. 43850209230bSgjelinek */ 43860209230bSgjelinek if (get_running_tmp_pset(pconf, pool, pset, &pset_current) 43870209230bSgjelinek == PO_SUCCESS && 43880209230bSgjelinek strcmp(pset_tab->zone_ncpu_min, 43890209230bSgjelinek pset_current.zone_ncpu_min) == 0 && 43900209230bSgjelinek strcmp(pset_tab->zone_ncpu_max, 43910209230bSgjelinek pset_current.zone_ncpu_max) == 0 && 43920209230bSgjelinek strcmp(pset_tab->zone_importance, 43930209230bSgjelinek pset_current.zone_importance) == 0) { 43940209230bSgjelinek *exists = B_TRUE; 43957c478bd9Sstevel@tonic-gate 43960209230bSgjelinek } else { 43970209230bSgjelinek /* 43980209230bSgjelinek * An out-of-date tmp pool configuration exists. Delete it 43990209230bSgjelinek * so that we can create the correct tmp pool config. 44000209230bSgjelinek */ 44010209230bSgjelinek if (pset != NULL && 44020209230bSgjelinek pool_resource_destroy(pconf, pset) != PO_SUCCESS) { 44030209230bSgjelinek res = zerr_pool(pool_err, err_size, Z_POOL); 44040209230bSgjelinek goto done; 44050209230bSgjelinek } 44069acbbeafSnn 44070209230bSgjelinek if (pool != NULL && 44080209230bSgjelinek pool_destroy(pconf, pool) != PO_SUCCESS) { 44090209230bSgjelinek res = zerr_pool(pool_err, err_size, Z_POOL); 44100209230bSgjelinek goto done; 44110209230bSgjelinek } 44129acbbeafSnn 44130209230bSgjelinek /* commit dynamic config */ 44140209230bSgjelinek if (pool_conf_commit(pconf, 0) != PO_SUCCESS) 44150209230bSgjelinek res = zerr_pool(pool_err, err_size, Z_POOL); 44160209230bSgjelinek } 44170209230bSgjelinek 44180209230bSgjelinek done: 44190209230bSgjelinek (void) pool_conf_close(pconf); 44200209230bSgjelinek 44210209230bSgjelinek return (res); 4422ffbafc53Scomay } 4423ffbafc53Scomay 4424ffbafc53Scomay /* 44250209230bSgjelinek * Destroy any existing tmp pool. 4426ffbafc53Scomay */ 44270209230bSgjelinek int 44280209230bSgjelinek zonecfg_destroy_tmp_pool(char *zone_name, char *pool_err, int err_size) 4429ffbafc53Scomay { 44300209230bSgjelinek int status; 44310209230bSgjelinek int res = Z_OK; 44320209230bSgjelinek pool_conf_t *pconf; 44330209230bSgjelinek pool_t *pool; 44340209230bSgjelinek pool_resource_t *pset; 44350209230bSgjelinek char tmp_name[MAX_TMP_POOL_NAME]; 4436ffbafc53Scomay 44370209230bSgjelinek /* if pools not enabled then nothing to do */ 44380209230bSgjelinek if (pool_get_status(&status) != PO_SUCCESS || status != POOL_ENABLED) 44390209230bSgjelinek return (Z_OK); 4440ffbafc53Scomay 44410209230bSgjelinek if ((pconf = pool_conf_alloc()) == NULL) 44420209230bSgjelinek return (zerr_pool(pool_err, err_size, Z_POOL)); 44439acbbeafSnn 44440209230bSgjelinek (void) snprintf(tmp_name, sizeof (tmp_name), TMP_POOL_NAME, zone_name); 4445ffbafc53Scomay 44460209230bSgjelinek if (pool_conf_open(pconf, pool_dynamic_location(), PO_RDWR) 44470209230bSgjelinek != PO_SUCCESS) { 44480209230bSgjelinek res = zerr_pool(pool_err, err_size, Z_POOL); 44490209230bSgjelinek pool_conf_free(pconf); 44500209230bSgjelinek return (res); 4451ffbafc53Scomay } 4452ffbafc53Scomay 44530209230bSgjelinek pool = pool_get_pool(pconf, tmp_name); 44540209230bSgjelinek pset = pool_get_resource(pconf, "pset", tmp_name); 4455ffbafc53Scomay 44560209230bSgjelinek if (pool == NULL && pset == NULL) { 44570209230bSgjelinek /* nothing to destroy, we're done */ 44580209230bSgjelinek goto done; 4459ffbafc53Scomay } 4460ffbafc53Scomay 44610209230bSgjelinek if (pset != NULL && pool_resource_destroy(pconf, pset) != PO_SUCCESS) { 44620209230bSgjelinek res = zerr_pool(pool_err, err_size, Z_POOL); 44630209230bSgjelinek goto done; 4464ffbafc53Scomay } 4465ffbafc53Scomay 44660209230bSgjelinek if (pool != NULL && pool_destroy(pconf, pool) != PO_SUCCESS) { 44670209230bSgjelinek res = zerr_pool(pool_err, err_size, Z_POOL); 44680209230bSgjelinek goto done; 4469ffbafc53Scomay } 4470ffbafc53Scomay 44710209230bSgjelinek /* commit dynamic config */ 44720209230bSgjelinek if (pool_conf_commit(pconf, 0) != PO_SUCCESS) 44730209230bSgjelinek res = zerr_pool(pool_err, err_size, Z_POOL); 44740209230bSgjelinek 44750209230bSgjelinek done: 44760209230bSgjelinek (void) pool_conf_close(pconf); 44770209230bSgjelinek pool_conf_free(pconf); 44780209230bSgjelinek 44790209230bSgjelinek return (res); 4480ffbafc53Scomay } 4481ffbafc53Scomay 4482ffbafc53Scomay /* 44830209230bSgjelinek * Attempt to bind to a tmp pool for this zone. If there is no tmp pool 44840209230bSgjelinek * configured, we just return Z_OK. 4485ffbafc53Scomay * 44860209230bSgjelinek * We either attempt to create the tmp pool for this zone or rebind to an 44870209230bSgjelinek * existing tmp pool for this zone. 44880209230bSgjelinek * 44890209230bSgjelinek * Rebinding is used when a zone with a tmp pool reboots so that we don't have 44900209230bSgjelinek * to recreate the tmp pool. To do this we need to be sure we work correctly 44910209230bSgjelinek * for the following cases: 44920209230bSgjelinek * 44930209230bSgjelinek * - there is an existing, properly configured tmp pool. 44940209230bSgjelinek * - zonecfg added tmp pool after zone was booted, must now create. 44950209230bSgjelinek * - zonecfg updated tmp pool config after zone was booted, in this case 44960209230bSgjelinek * we destroy the old tmp pool and create a new one. 4497ffbafc53Scomay */ 4498ffbafc53Scomay int 44990209230bSgjelinek zonecfg_bind_tmp_pool(zone_dochandle_t handle, zoneid_t zoneid, char *pool_err, 45000209230bSgjelinek int err_size) 4501ffbafc53Scomay { 45020209230bSgjelinek struct zone_psettab pset_tab; 45030209230bSgjelinek int err; 45040209230bSgjelinek int status; 45050209230bSgjelinek pool_conf_t *pconf; 45060209230bSgjelinek boolean_t exists; 45070209230bSgjelinek char zone_name[ZONENAME_MAX]; 45080209230bSgjelinek char tmp_name[MAX_TMP_POOL_NAME]; 45090209230bSgjelinek 45100209230bSgjelinek (void) getzonenamebyid(zoneid, zone_name, sizeof (zone_name)); 45110209230bSgjelinek 45120209230bSgjelinek err = zonecfg_lookup_pset(handle, &pset_tab); 45130209230bSgjelinek 45140209230bSgjelinek /* if no temporary pool configured, we're done */ 45150209230bSgjelinek if (err == Z_NO_ENTRY) 45160209230bSgjelinek return (Z_OK); 4517ffbafc53Scomay 4518ffbafc53Scomay /* 45190209230bSgjelinek * importance might not have a value but we need to validate it here, 45200209230bSgjelinek * so set the default. 4521ffbafc53Scomay */ 45220209230bSgjelinek if (pset_tab.zone_importance[0] == '\0') 45230209230bSgjelinek (void) strlcpy(pset_tab.zone_importance, "1", 45240209230bSgjelinek sizeof (pset_tab.zone_importance)); 45259acbbeafSnn 45260209230bSgjelinek /* if pools not enabled, enable them now */ 45270209230bSgjelinek if (pool_get_status(&status) != PO_SUCCESS || status != POOL_ENABLED) { 45280209230bSgjelinek if (pool_set_status(POOL_ENABLED) != PO_SUCCESS) 45290209230bSgjelinek return (Z_POOL_ENABLE); 4530ffbafc53Scomay } 4531ffbafc53Scomay 45320209230bSgjelinek if ((pconf = pool_conf_alloc()) == NULL) 45330209230bSgjelinek return (zerr_pool(pool_err, err_size, Z_POOL)); 45340209230bSgjelinek 45350209230bSgjelinek (void) snprintf(tmp_name, sizeof (tmp_name), TMP_POOL_NAME, zone_name); 45360209230bSgjelinek 4537ffbafc53Scomay /* 45380209230bSgjelinek * Check if a valid tmp pool/pset already exists. If so, we just 45390209230bSgjelinek * reuse it. 4540ffbafc53Scomay */ 45410209230bSgjelinek if ((err = verify_del_tmp_pool(pconf, tmp_name, pool_err, err_size, 45420209230bSgjelinek &pset_tab, &exists)) != Z_OK) { 45430209230bSgjelinek pool_conf_free(pconf); 45440209230bSgjelinek return (err); 45450209230bSgjelinek } 4546ffbafc53Scomay 45470209230bSgjelinek if (!exists) 45480209230bSgjelinek err = create_tmp_pool(pool_err, err_size, pconf, tmp_name, 45490209230bSgjelinek &pset_tab); 45500209230bSgjelinek 45510209230bSgjelinek pool_conf_free(pconf); 45520209230bSgjelinek 45530209230bSgjelinek if (err != Z_OK) 45540209230bSgjelinek return (err); 45550209230bSgjelinek 45560209230bSgjelinek /* Bind the zone to the pool. */ 45570209230bSgjelinek if (pool_set_binding(tmp_name, P_ZONEID, zoneid) != PO_SUCCESS) 45580209230bSgjelinek return (zerr_pool(pool_err, err_size, Z_POOL_BIND)); 45590209230bSgjelinek 45600209230bSgjelinek return (Z_OK); 4561ffbafc53Scomay } 4562ffbafc53Scomay 45630209230bSgjelinek /* 45640209230bSgjelinek * Attempt to bind to a permanent pool for this zone. If there is no 45650209230bSgjelinek * permanent pool configured, we just return Z_OK. 45660209230bSgjelinek */ 45677c478bd9Sstevel@tonic-gate int 45680209230bSgjelinek zonecfg_bind_pool(zone_dochandle_t handle, zoneid_t zoneid, char *pool_err, 45690209230bSgjelinek int err_size) 45707c478bd9Sstevel@tonic-gate { 45710209230bSgjelinek pool_conf_t *poolconf; 45720209230bSgjelinek pool_t *pool; 45730209230bSgjelinek char poolname[MAXPATHLEN]; 45740209230bSgjelinek int status; 45750209230bSgjelinek int error; 4576108322fbScarlsonj 45770209230bSgjelinek /* 45780209230bSgjelinek * Find the pool mentioned in the zone configuration, and bind to it. 45790209230bSgjelinek */ 45800209230bSgjelinek error = zonecfg_get_pool(handle, poolname, sizeof (poolname)); 45810209230bSgjelinek if (error == Z_NO_ENTRY || (error == Z_OK && strlen(poolname) == 0)) { 45820209230bSgjelinek /* 45830209230bSgjelinek * The property is not set on the zone, so the pool 45840209230bSgjelinek * should be bound to the default pool. But that's 45850209230bSgjelinek * already done by the kernel, so we can just return. 45860209230bSgjelinek */ 45877c478bd9Sstevel@tonic-gate return (Z_OK); 45887c478bd9Sstevel@tonic-gate } 45890209230bSgjelinek if (error != Z_OK) { 45900209230bSgjelinek /* 45910209230bSgjelinek * Not an error, even though it shouldn't be happening. 45920209230bSgjelinek */ 45930209230bSgjelinek return (Z_OK); 45940209230bSgjelinek } 45950209230bSgjelinek /* 45960209230bSgjelinek * Don't do anything if pools aren't enabled. 45970209230bSgjelinek */ 45980209230bSgjelinek if (pool_get_status(&status) != PO_SUCCESS || status != POOL_ENABLED) 45990209230bSgjelinek return (Z_POOLS_NOT_ACTIVE); 46007c478bd9Sstevel@tonic-gate 46017c478bd9Sstevel@tonic-gate /* 46020209230bSgjelinek * Try to provide a sane error message if the requested pool doesn't 46030209230bSgjelinek * exist. 46047c478bd9Sstevel@tonic-gate */ 46050209230bSgjelinek if ((poolconf = pool_conf_alloc()) == NULL) 46060209230bSgjelinek return (zerr_pool(pool_err, err_size, Z_POOL)); 46077c478bd9Sstevel@tonic-gate 46080209230bSgjelinek if (pool_conf_open(poolconf, pool_dynamic_location(), PO_RDONLY) != 46090209230bSgjelinek PO_SUCCESS) { 46100209230bSgjelinek pool_conf_free(poolconf); 46110209230bSgjelinek return (zerr_pool(pool_err, err_size, Z_POOL)); 46120209230bSgjelinek } 46130209230bSgjelinek pool = pool_get_pool(poolconf, poolname); 46140209230bSgjelinek (void) pool_conf_close(poolconf); 46150209230bSgjelinek pool_conf_free(poolconf); 46160209230bSgjelinek if (pool == NULL) 46170209230bSgjelinek return (Z_NO_POOL); 46187c478bd9Sstevel@tonic-gate 46197c478bd9Sstevel@tonic-gate /* 46200209230bSgjelinek * Bind the zone to the pool. 46217c478bd9Sstevel@tonic-gate */ 46220209230bSgjelinek if (pool_set_binding(poolname, P_ZONEID, zoneid) != PO_SUCCESS) { 46230209230bSgjelinek /* if bind fails, return poolname for the error msg */ 46240209230bSgjelinek (void) strlcpy(pool_err, poolname, err_size); 46250209230bSgjelinek return (Z_POOL_BIND); 46267c478bd9Sstevel@tonic-gate } 46270209230bSgjelinek 46280209230bSgjelinek return (Z_OK); 46290209230bSgjelinek } 46300209230bSgjelinek 46310dc2366fSVenugopal Iyer int 46320dc2366fSVenugopal Iyer zonecfg_get_poolname(zone_dochandle_t handle, char *zone, char *pool, 46330dc2366fSVenugopal Iyer size_t poolsize) 46340dc2366fSVenugopal Iyer { 46350dc2366fSVenugopal Iyer int err; 46360dc2366fSVenugopal Iyer struct zone_psettab pset_tab; 46370dc2366fSVenugopal Iyer 46380dc2366fSVenugopal Iyer err = zonecfg_lookup_pset(handle, &pset_tab); 46390dc2366fSVenugopal Iyer if ((err != Z_NO_ENTRY) && (err != Z_OK)) 46400dc2366fSVenugopal Iyer return (err); 46410dc2366fSVenugopal Iyer 46420dc2366fSVenugopal Iyer /* pset was found so a temporary pool was created */ 46430dc2366fSVenugopal Iyer if (err == Z_OK) { 46440dc2366fSVenugopal Iyer (void) snprintf(pool, poolsize, TMP_POOL_NAME, zone); 46450dc2366fSVenugopal Iyer return (Z_OK); 46460dc2366fSVenugopal Iyer } 46470dc2366fSVenugopal Iyer 46480dc2366fSVenugopal Iyer /* lookup the poolname in zonecfg */ 46490dc2366fSVenugopal Iyer return (zonecfg_get_pool(handle, pool, poolsize)); 46500dc2366fSVenugopal Iyer } 46510209230bSgjelinek 46520209230bSgjelinek static boolean_t 46530209230bSgjelinek svc_enabled(char *svc_name) 46540209230bSgjelinek { 46550209230bSgjelinek scf_simple_prop_t *prop; 46560209230bSgjelinek boolean_t found = B_FALSE; 46570209230bSgjelinek 46580209230bSgjelinek prop = scf_simple_prop_get(NULL, svc_name, SCF_PG_GENERAL, 46590209230bSgjelinek SCF_PROPERTY_ENABLED); 46600209230bSgjelinek 46610209230bSgjelinek if (scf_simple_prop_numvalues(prop) == 1 && 46620209230bSgjelinek *scf_simple_prop_next_boolean(prop) != 0) 46630209230bSgjelinek found = B_TRUE; 46640209230bSgjelinek 46650209230bSgjelinek scf_simple_prop_free(prop); 46660209230bSgjelinek 46670209230bSgjelinek return (found); 46687c478bd9Sstevel@tonic-gate } 46697c478bd9Sstevel@tonic-gate 46700209230bSgjelinek /* 46710209230bSgjelinek * If the zone has capped-memory, make sure the rcap service is enabled. 46720209230bSgjelinek */ 46737c478bd9Sstevel@tonic-gate int 46740209230bSgjelinek zonecfg_enable_rcapd(char *err, int size) 46757c478bd9Sstevel@tonic-gate { 46760209230bSgjelinek if (!svc_enabled(RCAP_SERVICE) && 46770209230bSgjelinek smf_enable_instance(RCAP_SERVICE, 0) == -1) { 46780209230bSgjelinek (void) strlcpy(err, scf_strerror(scf_error()), size); 46790209230bSgjelinek return (Z_SYSTEM); 46800209230bSgjelinek } 46817c478bd9Sstevel@tonic-gate 46827c478bd9Sstevel@tonic-gate return (Z_OK); 46837c478bd9Sstevel@tonic-gate } 46847c478bd9Sstevel@tonic-gate 46850209230bSgjelinek /* 46860209230bSgjelinek * Return true if pset has cpu range specified and poold is not enabled. 46870209230bSgjelinek */ 46880209230bSgjelinek boolean_t 46890209230bSgjelinek zonecfg_warn_poold(zone_dochandle_t handle) 46909acbbeafSnn { 46910209230bSgjelinek struct zone_psettab pset_tab; 46920209230bSgjelinek int min, max; 46939acbbeafSnn int err; 46949acbbeafSnn 46950209230bSgjelinek err = zonecfg_lookup_pset(handle, &pset_tab); 46960209230bSgjelinek 46970209230bSgjelinek /* if no temporary pool configured, we're done */ 46980209230bSgjelinek if (err == Z_NO_ENTRY) 46990209230bSgjelinek return (B_FALSE); 47000209230bSgjelinek 47010209230bSgjelinek min = atoi(pset_tab.zone_ncpu_min); 47020209230bSgjelinek max = atoi(pset_tab.zone_ncpu_max); 47030209230bSgjelinek 47040209230bSgjelinek /* range not specified, no need for poold */ 47050209230bSgjelinek if (min == max) 47060209230bSgjelinek return (B_FALSE); 47070209230bSgjelinek 47080209230bSgjelinek /* we have a range, check if poold service is enabled */ 47090209230bSgjelinek if (svc_enabled(POOLD_SERVICE)) 47100209230bSgjelinek return (B_FALSE); 47110209230bSgjelinek 47120209230bSgjelinek return (B_TRUE); 47130209230bSgjelinek } 47140209230bSgjelinek 471534eb7836Sjv /* 471634eb7836Sjv * Retrieve the specified pool's thread scheduling class. 'poolname' must 471734eb7836Sjv * refer to the name of a configured resource pool. The thread scheduling 471834eb7836Sjv * class specified by the pool will be stored in the buffer to which 'class' 471934eb7836Sjv * points. 'clsize' is the byte size of the buffer to which 'class' points. 472034eb7836Sjv * 472134eb7836Sjv * This function returns Z_OK if it successfully stored the specified pool's 472234eb7836Sjv * thread scheduling class into the buffer to which 'class' points. It returns 472334eb7836Sjv * Z_NO_POOL if resource pools are not enabled, the function is unable to 472434eb7836Sjv * access the system's resource pools configuration, or the specified pool 472534eb7836Sjv * does not exist. The function returns Z_TOO_BIG if the buffer to which 472634eb7836Sjv * 'class' points is not large enough to contain the thread scheduling class' 472734eb7836Sjv * name. The function returns Z_NO_ENTRY if the pool does not specify a thread 472834eb7836Sjv * scheduling class. 472934eb7836Sjv */ 47300209230bSgjelinek static int 47310209230bSgjelinek get_pool_sched_class(char *poolname, char *class, int clsize) 47320209230bSgjelinek { 47330209230bSgjelinek int status; 47340209230bSgjelinek pool_conf_t *poolconf; 47350209230bSgjelinek pool_t *pool; 47360209230bSgjelinek pool_elem_t *pe; 47370209230bSgjelinek pool_value_t *pv = pool_value_alloc(); 47380209230bSgjelinek const char *sched_str; 47390209230bSgjelinek 47400209230bSgjelinek if (pool_get_status(&status) != PO_SUCCESS || status != POOL_ENABLED) 47410209230bSgjelinek return (Z_NO_POOL); 47420209230bSgjelinek 47430209230bSgjelinek if ((poolconf = pool_conf_alloc()) == NULL) 47440209230bSgjelinek return (Z_NO_POOL); 47450209230bSgjelinek 47460209230bSgjelinek if (pool_conf_open(poolconf, pool_dynamic_location(), PO_RDONLY) != 47470209230bSgjelinek PO_SUCCESS) { 47480209230bSgjelinek pool_conf_free(poolconf); 47490209230bSgjelinek return (Z_NO_POOL); 47509acbbeafSnn } 47519acbbeafSnn 47520209230bSgjelinek if ((pool = pool_get_pool(poolconf, poolname)) == NULL) { 47530209230bSgjelinek (void) pool_conf_close(poolconf); 47540209230bSgjelinek pool_conf_free(poolconf); 47550209230bSgjelinek return (Z_NO_POOL); 47569acbbeafSnn } 47579acbbeafSnn 47580209230bSgjelinek pe = pool_to_elem(poolconf, pool); 475934eb7836Sjv if (pool_get_property(poolconf, pe, "pool.scheduler", pv) != 476034eb7836Sjv POC_STRING) { 476134eb7836Sjv (void) pool_conf_close(poolconf); 476234eb7836Sjv pool_conf_free(poolconf); 476334eb7836Sjv return (Z_NO_ENTRY); 47640209230bSgjelinek } 476534eb7836Sjv (void) pool_value_get_string(pv, &sched_str); 47660209230bSgjelinek (void) pool_conf_close(poolconf); 47670209230bSgjelinek pool_conf_free(poolconf); 476834eb7836Sjv if (strlcpy(class, sched_str, clsize) >= clsize) 476934eb7836Sjv return (Z_TOO_BIG); 47700209230bSgjelinek return (Z_OK); 47719acbbeafSnn } 47729acbbeafSnn 4773facf4a8dSllai /* 47740209230bSgjelinek * Get the default scheduling class for the zone. This will either be the 47750209230bSgjelinek * class set on the zone's pool or the system default scheduling class. 4776facf4a8dSllai */ 4777facf4a8dSllai int 47780209230bSgjelinek zonecfg_get_dflt_sched_class(zone_dochandle_t handle, char *class, int clsize) 4779facf4a8dSllai { 47800209230bSgjelinek char poolname[MAXPATHLEN]; 4781facf4a8dSllai 47820209230bSgjelinek if (zonecfg_get_pool(handle, poolname, sizeof (poolname)) == Z_OK) { 47830209230bSgjelinek /* check if the zone's pool specified a sched class */ 47840209230bSgjelinek if (get_pool_sched_class(poolname, class, clsize) == Z_OK) 47850209230bSgjelinek return (Z_OK); 47860209230bSgjelinek } 4787facf4a8dSllai 47880209230bSgjelinek if (priocntl(0, 0, PC_GETDFLCL, class, (uint64_t)clsize) == -1) 4789facf4a8dSllai return (Z_TOO_BIG); 47900209230bSgjelinek 4791facf4a8dSllai return (Z_OK); 4792facf4a8dSllai } 4793facf4a8dSllai 47940209230bSgjelinek int 47950209230bSgjelinek zonecfg_setfsent(zone_dochandle_t handle) 47967c478bd9Sstevel@tonic-gate { 47970209230bSgjelinek return (zonecfg_setent(handle)); 47987c478bd9Sstevel@tonic-gate } 47997c478bd9Sstevel@tonic-gate 48007c478bd9Sstevel@tonic-gate int 48010209230bSgjelinek zonecfg_getfsent(zone_dochandle_t handle, struct zone_fstab *tabptr) 48027c478bd9Sstevel@tonic-gate { 48030209230bSgjelinek xmlNodePtr cur, options; 48040209230bSgjelinek char options_str[MAX_MNTOPT_STR]; 48050209230bSgjelinek int err; 48067c478bd9Sstevel@tonic-gate 48070209230bSgjelinek if (handle == NULL) 48087c478bd9Sstevel@tonic-gate return (Z_INVAL); 48097c478bd9Sstevel@tonic-gate 48100209230bSgjelinek if ((cur = handle->zone_dh_cur) == NULL) 48110209230bSgjelinek return (Z_NO_ENTRY); 48120209230bSgjelinek 48130209230bSgjelinek for (; cur != NULL; cur = cur->next) 48140209230bSgjelinek if (!xmlStrcmp(cur->name, DTD_ELEM_FS)) 48150209230bSgjelinek break; 48160209230bSgjelinek if (cur == NULL) { 48170209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 48180209230bSgjelinek return (Z_NO_ENTRY); 4819108322fbScarlsonj } 4820108322fbScarlsonj 48210209230bSgjelinek if ((err = fetchprop(cur, DTD_ATTR_SPECIAL, tabptr->zone_fs_special, 48220209230bSgjelinek sizeof (tabptr->zone_fs_special))) != Z_OK) { 48230209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 48240209230bSgjelinek return (err); 48257c478bd9Sstevel@tonic-gate } 48267c478bd9Sstevel@tonic-gate 48270209230bSgjelinek if ((err = fetchprop(cur, DTD_ATTR_RAW, tabptr->zone_fs_raw, 48280209230bSgjelinek sizeof (tabptr->zone_fs_raw))) != Z_OK) { 48290209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 48300209230bSgjelinek return (err); 48310209230bSgjelinek } 48320209230bSgjelinek 48330209230bSgjelinek if ((err = fetchprop(cur, DTD_ATTR_DIR, tabptr->zone_fs_dir, 48340209230bSgjelinek sizeof (tabptr->zone_fs_dir))) != Z_OK) { 48350209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 48360209230bSgjelinek return (err); 48370209230bSgjelinek } 48380209230bSgjelinek 48390209230bSgjelinek if ((err = fetchprop(cur, DTD_ATTR_TYPE, tabptr->zone_fs_type, 48400209230bSgjelinek sizeof (tabptr->zone_fs_type))) != Z_OK) { 48410209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 48420209230bSgjelinek return (err); 48430209230bSgjelinek } 48440209230bSgjelinek 48450209230bSgjelinek /* OK for options to be NULL */ 48460209230bSgjelinek tabptr->zone_fs_options = NULL; 48470209230bSgjelinek for (options = cur->xmlChildrenNode; options != NULL; 48480209230bSgjelinek options = options->next) { 48490209230bSgjelinek if (fetchprop(options, DTD_ATTR_NAME, options_str, 48500209230bSgjelinek sizeof (options_str)) != Z_OK) 48510209230bSgjelinek break; 48520209230bSgjelinek if (zonecfg_add_fs_option(tabptr, options_str) != Z_OK) 48537c478bd9Sstevel@tonic-gate break; 48547c478bd9Sstevel@tonic-gate } 48550209230bSgjelinek 48560209230bSgjelinek handle->zone_dh_cur = cur->next; 48570209230bSgjelinek return (Z_OK); 48587c478bd9Sstevel@tonic-gate } 48597c478bd9Sstevel@tonic-gate 48607c478bd9Sstevel@tonic-gate int 48610209230bSgjelinek zonecfg_endfsent(zone_dochandle_t handle) 48627c478bd9Sstevel@tonic-gate { 48630209230bSgjelinek return (zonecfg_endent(handle)); 48647c478bd9Sstevel@tonic-gate } 48657c478bd9Sstevel@tonic-gate 4866108322fbScarlsonj int 48670209230bSgjelinek zonecfg_setnwifent(zone_dochandle_t handle) 4868108322fbScarlsonj { 48690209230bSgjelinek return (zonecfg_setent(handle)); 4870108322fbScarlsonj } 4871108322fbScarlsonj 4872108322fbScarlsonj int 48730209230bSgjelinek zonecfg_getnwifent(zone_dochandle_t handle, struct zone_nwiftab *tabptr) 4874108322fbScarlsonj { 48750209230bSgjelinek xmlNodePtr cur; 48760209230bSgjelinek int err; 4877108322fbScarlsonj 48780209230bSgjelinek if (handle == NULL) 48790209230bSgjelinek return (Z_INVAL); 48800209230bSgjelinek 48810209230bSgjelinek if ((cur = handle->zone_dh_cur) == NULL) 48820209230bSgjelinek return (Z_NO_ENTRY); 48830209230bSgjelinek 48840209230bSgjelinek for (; cur != NULL; cur = cur->next) 48850209230bSgjelinek if (!xmlStrcmp(cur->name, DTD_ELEM_NET)) 4886108322fbScarlsonj break; 48870209230bSgjelinek if (cur == NULL) { 48880209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 48890209230bSgjelinek return (Z_NO_ENTRY); 4890108322fbScarlsonj } 48910209230bSgjelinek 48920209230bSgjelinek if ((err = fetchprop(cur, DTD_ATTR_ADDRESS, tabptr->zone_nwif_address, 48930209230bSgjelinek sizeof (tabptr->zone_nwif_address))) != Z_OK) { 48940209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 48950209230bSgjelinek return (err); 48960209230bSgjelinek } 48970209230bSgjelinek 4898550b6e40SSowmini Varadhan if ((err = fetchprop(cur, DTD_ATTR_ALLOWED_ADDRESS, 4899550b6e40SSowmini Varadhan tabptr->zone_nwif_allowed_address, 4900550b6e40SSowmini Varadhan sizeof (tabptr->zone_nwif_allowed_address))) != Z_OK) { 4901550b6e40SSowmini Varadhan handle->zone_dh_cur = handle->zone_dh_top; 4902550b6e40SSowmini Varadhan return (err); 4903550b6e40SSowmini Varadhan } 4904550b6e40SSowmini Varadhan 49050209230bSgjelinek if ((err = fetchprop(cur, DTD_ATTR_PHYSICAL, tabptr->zone_nwif_physical, 49060209230bSgjelinek sizeof (tabptr->zone_nwif_physical))) != Z_OK) { 49070209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 4908de860bd9Sgfaden return (err); 4909de860bd9Sgfaden } 4910de860bd9Sgfaden 4911de860bd9Sgfaden if ((err = fetchprop(cur, DTD_ATTR_DEFROUTER, 4912de860bd9Sgfaden tabptr->zone_nwif_defrouter, 4913de860bd9Sgfaden sizeof (tabptr->zone_nwif_defrouter))) != Z_OK) { 4914de860bd9Sgfaden handle->zone_dh_cur = handle->zone_dh_top; 49150209230bSgjelinek return (err); 4916108322fbScarlsonj } 49170209230bSgjelinek 49180209230bSgjelinek handle->zone_dh_cur = cur->next; 49190209230bSgjelinek return (Z_OK); 4920108322fbScarlsonj } 4921108322fbScarlsonj 49220209230bSgjelinek int 49230209230bSgjelinek zonecfg_endnwifent(zone_dochandle_t handle) 49247c478bd9Sstevel@tonic-gate { 49250209230bSgjelinek return (zonecfg_endent(handle)); 49267c478bd9Sstevel@tonic-gate } 49277c478bd9Sstevel@tonic-gate 49280209230bSgjelinek int 49290209230bSgjelinek zonecfg_setdevent(zone_dochandle_t handle) 49300209230bSgjelinek { 49310209230bSgjelinek return (zonecfg_setent(handle)); 49320209230bSgjelinek } 49337c478bd9Sstevel@tonic-gate 49347c478bd9Sstevel@tonic-gate int 49350209230bSgjelinek zonecfg_getdevent(zone_dochandle_t handle, struct zone_devtab *tabptr) 49367c478bd9Sstevel@tonic-gate { 49370209230bSgjelinek xmlNodePtr cur; 49380209230bSgjelinek int err; 49397c478bd9Sstevel@tonic-gate 49400209230bSgjelinek if (handle == NULL) 49417c478bd9Sstevel@tonic-gate return (Z_INVAL); 49427c478bd9Sstevel@tonic-gate 49430209230bSgjelinek if ((cur = handle->zone_dh_cur) == NULL) 49440209230bSgjelinek return (Z_NO_ENTRY); 49450209230bSgjelinek 49460209230bSgjelinek for (; cur != NULL; cur = cur->next) 49470209230bSgjelinek if (!xmlStrcmp(cur->name, DTD_ELEM_DEVICE)) 49480209230bSgjelinek break; 49490209230bSgjelinek if (cur == NULL) { 49500209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 49510209230bSgjelinek return (Z_NO_ENTRY); 49527c478bd9Sstevel@tonic-gate } 49537c478bd9Sstevel@tonic-gate 49540209230bSgjelinek if ((err = fetchprop(cur, DTD_ATTR_MATCH, tabptr->zone_dev_match, 49550209230bSgjelinek sizeof (tabptr->zone_dev_match))) != Z_OK) { 49560209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 49570209230bSgjelinek return (err); 49587c478bd9Sstevel@tonic-gate } 49590209230bSgjelinek 49600209230bSgjelinek handle->zone_dh_cur = cur->next; 49617c478bd9Sstevel@tonic-gate return (Z_OK); 49627c478bd9Sstevel@tonic-gate } 49637c478bd9Sstevel@tonic-gate 49640209230bSgjelinek int 49650209230bSgjelinek zonecfg_enddevent(zone_dochandle_t handle) 49667c478bd9Sstevel@tonic-gate { 49670209230bSgjelinek return (zonecfg_endent(handle)); 49680209230bSgjelinek } 49697c478bd9Sstevel@tonic-gate 49700209230bSgjelinek int 49710209230bSgjelinek zonecfg_setrctlent(zone_dochandle_t handle) 49720209230bSgjelinek { 49730209230bSgjelinek return (zonecfg_setent(handle)); 49740209230bSgjelinek } 49750209230bSgjelinek 49760209230bSgjelinek int 49770209230bSgjelinek zonecfg_getrctlent(zone_dochandle_t handle, struct zone_rctltab *tabptr) 49780209230bSgjelinek { 49790209230bSgjelinek xmlNodePtr cur, val; 49800209230bSgjelinek struct zone_rctlvaltab *valptr; 49810209230bSgjelinek int err; 49820209230bSgjelinek 49830209230bSgjelinek if (handle == NULL) 49840209230bSgjelinek return (Z_INVAL); 49850209230bSgjelinek 49860209230bSgjelinek if ((cur = handle->zone_dh_cur) == NULL) 49870209230bSgjelinek return (Z_NO_ENTRY); 49880209230bSgjelinek 49890209230bSgjelinek for (; cur != NULL; cur = cur->next) 49900209230bSgjelinek if (!xmlStrcmp(cur->name, DTD_ELEM_RCTL)) 49910209230bSgjelinek break; 49920209230bSgjelinek if (cur == NULL) { 49930209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 49940209230bSgjelinek return (Z_NO_ENTRY); 49950209230bSgjelinek } 49960209230bSgjelinek 49970209230bSgjelinek if ((err = fetchprop(cur, DTD_ATTR_NAME, tabptr->zone_rctl_name, 49980209230bSgjelinek sizeof (tabptr->zone_rctl_name))) != Z_OK) { 49990209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 50000209230bSgjelinek return (err); 50010209230bSgjelinek } 50020209230bSgjelinek 50030209230bSgjelinek tabptr->zone_rctl_valptr = NULL; 50040209230bSgjelinek for (val = cur->xmlChildrenNode; val != NULL; val = val->next) { 50050209230bSgjelinek valptr = (struct zone_rctlvaltab *)malloc( 50060209230bSgjelinek sizeof (struct zone_rctlvaltab)); 50070209230bSgjelinek if (valptr == NULL) 50080209230bSgjelinek return (Z_NOMEM); 50090209230bSgjelinek if (fetchprop(val, DTD_ATTR_PRIV, valptr->zone_rctlval_priv, 50100209230bSgjelinek sizeof (valptr->zone_rctlval_priv)) != Z_OK) 50110209230bSgjelinek break; 50120209230bSgjelinek if (fetchprop(val, DTD_ATTR_LIMIT, valptr->zone_rctlval_limit, 50130209230bSgjelinek sizeof (valptr->zone_rctlval_limit)) != Z_OK) 50140209230bSgjelinek break; 50150209230bSgjelinek if (fetchprop(val, DTD_ATTR_ACTION, valptr->zone_rctlval_action, 50160209230bSgjelinek sizeof (valptr->zone_rctlval_action)) != Z_OK) 50170209230bSgjelinek break; 50180209230bSgjelinek if (zonecfg_add_rctl_value(tabptr, valptr) != Z_OK) 50190209230bSgjelinek break; 50200209230bSgjelinek } 50210209230bSgjelinek 50220209230bSgjelinek handle->zone_dh_cur = cur->next; 50230209230bSgjelinek return (Z_OK); 50240209230bSgjelinek } 50250209230bSgjelinek 50260209230bSgjelinek int 50270209230bSgjelinek zonecfg_endrctlent(zone_dochandle_t handle) 50280209230bSgjelinek { 50290209230bSgjelinek return (zonecfg_endent(handle)); 50300209230bSgjelinek } 50310209230bSgjelinek 50320209230bSgjelinek int 50330209230bSgjelinek zonecfg_setattrent(zone_dochandle_t handle) 50340209230bSgjelinek { 50350209230bSgjelinek return (zonecfg_setent(handle)); 50360209230bSgjelinek } 50370209230bSgjelinek 50380209230bSgjelinek int 50390209230bSgjelinek zonecfg_getattrent(zone_dochandle_t handle, struct zone_attrtab *tabptr) 50400209230bSgjelinek { 50410209230bSgjelinek xmlNodePtr cur; 50420209230bSgjelinek int err; 50430209230bSgjelinek 50440209230bSgjelinek if (handle == NULL) 50450209230bSgjelinek return (Z_INVAL); 50460209230bSgjelinek 50470209230bSgjelinek if ((cur = handle->zone_dh_cur) == NULL) 50480209230bSgjelinek return (Z_NO_ENTRY); 50490209230bSgjelinek 50500209230bSgjelinek for (; cur != NULL; cur = cur->next) 50510209230bSgjelinek if (!xmlStrcmp(cur->name, DTD_ELEM_ATTR)) 50520209230bSgjelinek break; 50530209230bSgjelinek if (cur == NULL) { 50540209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 50550209230bSgjelinek return (Z_NO_ENTRY); 50560209230bSgjelinek } 50570209230bSgjelinek 50580209230bSgjelinek if ((err = fetchprop(cur, DTD_ATTR_NAME, tabptr->zone_attr_name, 50590209230bSgjelinek sizeof (tabptr->zone_attr_name))) != Z_OK) { 50600209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 50610209230bSgjelinek return (err); 50620209230bSgjelinek } 50630209230bSgjelinek 50640209230bSgjelinek if ((err = fetchprop(cur, DTD_ATTR_TYPE, tabptr->zone_attr_type, 50650209230bSgjelinek sizeof (tabptr->zone_attr_type))) != Z_OK) { 50660209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 50670209230bSgjelinek return (err); 50680209230bSgjelinek } 50690209230bSgjelinek 50700209230bSgjelinek if ((err = fetchprop(cur, DTD_ATTR_VALUE, tabptr->zone_attr_value, 50710209230bSgjelinek sizeof (tabptr->zone_attr_value))) != Z_OK) { 50720209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 50730209230bSgjelinek return (err); 50740209230bSgjelinek } 50750209230bSgjelinek 50760209230bSgjelinek handle->zone_dh_cur = cur->next; 50770209230bSgjelinek return (Z_OK); 50780209230bSgjelinek } 50790209230bSgjelinek 50800209230bSgjelinek int 50810209230bSgjelinek zonecfg_endattrent(zone_dochandle_t handle) 50820209230bSgjelinek { 50830209230bSgjelinek return (zonecfg_endent(handle)); 50840209230bSgjelinek } 50850209230bSgjelinek 5086cb8a054bSGlenn Faden int 5087cb8a054bSGlenn Faden zonecfg_setadminent(zone_dochandle_t handle) 5088cb8a054bSGlenn Faden { 5089cb8a054bSGlenn Faden return (zonecfg_setent(handle)); 5090cb8a054bSGlenn Faden } 5091cb8a054bSGlenn Faden 5092cb8a054bSGlenn Faden int 5093cb8a054bSGlenn Faden zonecfg_getadminent(zone_dochandle_t handle, struct zone_admintab *tabptr) 5094cb8a054bSGlenn Faden { 5095cb8a054bSGlenn Faden xmlNodePtr cur; 5096cb8a054bSGlenn Faden int err; 5097cb8a054bSGlenn Faden 5098cb8a054bSGlenn Faden if (handle == NULL) 5099cb8a054bSGlenn Faden return (Z_INVAL); 5100cb8a054bSGlenn Faden 5101cb8a054bSGlenn Faden if ((cur = handle->zone_dh_cur) == NULL) 5102cb8a054bSGlenn Faden return (Z_NO_ENTRY); 5103cb8a054bSGlenn Faden 5104cb8a054bSGlenn Faden for (; cur != NULL; cur = cur->next) 5105cb8a054bSGlenn Faden if (!xmlStrcmp(cur->name, DTD_ELEM_ADMIN)) 5106cb8a054bSGlenn Faden break; 5107cb8a054bSGlenn Faden if (cur == NULL) { 5108cb8a054bSGlenn Faden handle->zone_dh_cur = handle->zone_dh_top; 5109cb8a054bSGlenn Faden return (Z_NO_ENTRY); 5110cb8a054bSGlenn Faden } 5111cb8a054bSGlenn Faden 5112cb8a054bSGlenn Faden if ((err = fetchprop(cur, DTD_ATTR_USER, tabptr->zone_admin_user, 5113cb8a054bSGlenn Faden sizeof (tabptr->zone_admin_user))) != Z_OK) { 5114cb8a054bSGlenn Faden handle->zone_dh_cur = handle->zone_dh_top; 5115cb8a054bSGlenn Faden return (err); 5116cb8a054bSGlenn Faden } 5117cb8a054bSGlenn Faden 5118cb8a054bSGlenn Faden 5119cb8a054bSGlenn Faden if ((err = fetchprop(cur, DTD_ATTR_AUTHS, tabptr->zone_admin_auths, 5120cb8a054bSGlenn Faden sizeof (tabptr->zone_admin_auths))) != Z_OK) { 5121cb8a054bSGlenn Faden handle->zone_dh_cur = handle->zone_dh_top; 5122cb8a054bSGlenn Faden return (err); 5123cb8a054bSGlenn Faden } 5124cb8a054bSGlenn Faden 5125cb8a054bSGlenn Faden handle->zone_dh_cur = cur->next; 5126cb8a054bSGlenn Faden return (Z_OK); 5127cb8a054bSGlenn Faden } 5128cb8a054bSGlenn Faden 5129cb8a054bSGlenn Faden int 5130cb8a054bSGlenn Faden zonecfg_endadminent(zone_dochandle_t handle) 5131cb8a054bSGlenn Faden { 5132cb8a054bSGlenn Faden return (zonecfg_endent(handle)); 5133cb8a054bSGlenn Faden } 5134cb8a054bSGlenn Faden 51350209230bSgjelinek /* 51360209230bSgjelinek * The privileges available on the system and described in privileges(5) 51370209230bSgjelinek * fall into four categories with respect to non-global zones: 51380209230bSgjelinek * 51390209230bSgjelinek * Default set of privileges considered safe for all non-global 51400209230bSgjelinek * zones. These privileges are "safe" in the sense that a 51410209230bSgjelinek * privileged process in the zone cannot affect processes in any 51420209230bSgjelinek * other zone on the system. 51430209230bSgjelinek * 51440209230bSgjelinek * Set of privileges not currently permitted within a non-global 51450209230bSgjelinek * zone. These privileges are considered by default, "unsafe," 51460209230bSgjelinek * and include ones which affect global resources (such as the 51470209230bSgjelinek * system clock or physical memory) or are overly broad and cover 51480209230bSgjelinek * more than one mechanism in the system. In other cases, there 51490209230bSgjelinek * has not been sufficient virtualization in the parts of the 51500209230bSgjelinek * system the privilege covers to allow its use within a 51510209230bSgjelinek * non-global zone. 51520209230bSgjelinek * 51530209230bSgjelinek * Set of privileges required in order to get a zone booted and 51540209230bSgjelinek * init(1M) started. These cannot be removed from the zone's 51550209230bSgjelinek * privilege set. 51560209230bSgjelinek * 51570209230bSgjelinek * All other privileges are optional and are potentially useful for 51580209230bSgjelinek * processes executing inside a non-global zone. 51590209230bSgjelinek * 51600209230bSgjelinek * When privileges are added to the system, a determination needs to be 51610209230bSgjelinek * made as to which category the privilege belongs to. Ideally, 51620209230bSgjelinek * privileges should be fine-grained enough and the mechanisms they cover 51630209230bSgjelinek * virtualized enough so that they can be made available to non-global 51640209230bSgjelinek * zones. 51650209230bSgjelinek */ 51660209230bSgjelinek 51670209230bSgjelinek /* 51680209230bSgjelinek * Define some of the tokens that priv_str_to_set(3C) recognizes. Since 51690209230bSgjelinek * the privilege string separator can be any character, although it is 51700209230bSgjelinek * usually a comma character, define these here as well in the event that 51710209230bSgjelinek * they change or are augmented in the future. 51720209230bSgjelinek */ 51730209230bSgjelinek #define BASIC_TOKEN "basic" 51740209230bSgjelinek #define DEFAULT_TOKEN "default" 51750209230bSgjelinek #define ZONE_TOKEN "zone" 51760209230bSgjelinek #define TOKEN_PRIV_CHAR ',' 51770209230bSgjelinek #define TOKEN_PRIV_STR "," 51780209230bSgjelinek 51790209230bSgjelinek typedef struct priv_node { 51800209230bSgjelinek struct priv_node *pn_next; /* Next privilege */ 51810209230bSgjelinek char *pn_priv; /* Privileges name */ 51820209230bSgjelinek } priv_node_t; 51830209230bSgjelinek 51840209230bSgjelinek /* Privileges lists can differ across brands */ 51850209230bSgjelinek typedef struct priv_lists { 51860209230bSgjelinek /* Privileges considered safe for all non-global zones of a brand */ 51870209230bSgjelinek struct priv_node *pl_default; 51880209230bSgjelinek 51890209230bSgjelinek /* Privileges not permitted for all non-global zones of a brand */ 51900209230bSgjelinek struct priv_node *pl_prohibited; 51910209230bSgjelinek 51920209230bSgjelinek /* Privileges required for all non-global zones of a brand */ 51930209230bSgjelinek struct priv_node *pl_required; 5194bf1d7e28Sdh 5195bf1d7e28Sdh /* 5196bf1d7e28Sdh * ip-type of the zone these privileges lists apply to. 5197bf1d7e28Sdh * It is used to pass ip-type to the callback function, 5198bf1d7e28Sdh * priv_lists_cb, which has no way of getting the ip-type. 5199bf1d7e28Sdh */ 5200bf1d7e28Sdh const char *pl_iptype; 52010209230bSgjelinek } priv_lists_t; 52020209230bSgjelinek 52030209230bSgjelinek static int 5204bf1d7e28Sdh priv_lists_cb(void *data, priv_iter_t *priv_iter) 52050209230bSgjelinek { 52060209230bSgjelinek priv_lists_t *plp = (priv_lists_t *)data; 52070209230bSgjelinek priv_node_t *pnp; 52080209230bSgjelinek 5209bf1d7e28Sdh /* Skip this privilege if ip-type does not match */ 5210bf1d7e28Sdh if ((strcmp(priv_iter->pi_iptype, "all") != 0) && 5211bf1d7e28Sdh (strcmp(priv_iter->pi_iptype, plp->pl_iptype) != 0)) 5212bf1d7e28Sdh return (0); 5213bf1d7e28Sdh 52140209230bSgjelinek /* Allocate a new priv list node. */ 52150209230bSgjelinek if ((pnp = malloc(sizeof (*pnp))) == NULL) 52160209230bSgjelinek return (-1); 5217bf1d7e28Sdh if ((pnp->pn_priv = strdup(priv_iter->pi_name)) == NULL) { 52180209230bSgjelinek free(pnp); 52190209230bSgjelinek return (-1); 52200209230bSgjelinek } 52210209230bSgjelinek 52220209230bSgjelinek /* Insert the new priv list node into the right list */ 5223bf1d7e28Sdh if (strcmp(priv_iter->pi_set, "default") == 0) { 52240209230bSgjelinek pnp->pn_next = plp->pl_default; 52250209230bSgjelinek plp->pl_default = pnp; 5226bf1d7e28Sdh } else if (strcmp(priv_iter->pi_set, "prohibited") == 0) { 52270209230bSgjelinek pnp->pn_next = plp->pl_prohibited; 52280209230bSgjelinek plp->pl_prohibited = pnp; 5229bf1d7e28Sdh } else if (strcmp(priv_iter->pi_set, "required") == 0) { 52300209230bSgjelinek pnp->pn_next = plp->pl_required; 52310209230bSgjelinek plp->pl_required = pnp; 52320209230bSgjelinek } else { 52330209230bSgjelinek free(pnp->pn_priv); 52340209230bSgjelinek free(pnp); 52350209230bSgjelinek return (-1); 52360209230bSgjelinek } 52370209230bSgjelinek return (0); 52380209230bSgjelinek } 52390209230bSgjelinek 52400209230bSgjelinek static void 52410209230bSgjelinek priv_lists_destroy(priv_lists_t *plp) 52420209230bSgjelinek { 52430209230bSgjelinek priv_node_t *pnp; 52440209230bSgjelinek 52450209230bSgjelinek assert(plp != NULL); 52460209230bSgjelinek 52470209230bSgjelinek while ((pnp = plp->pl_default) != NULL) { 52480209230bSgjelinek plp->pl_default = pnp->pn_next; 52490209230bSgjelinek free(pnp->pn_priv); 52500209230bSgjelinek free(pnp); 52510209230bSgjelinek } 52520209230bSgjelinek while ((pnp = plp->pl_prohibited) != NULL) { 52530209230bSgjelinek plp->pl_prohibited = pnp->pn_next; 52540209230bSgjelinek free(pnp->pn_priv); 52550209230bSgjelinek free(pnp); 52560209230bSgjelinek } 52570209230bSgjelinek while ((pnp = plp->pl_required) != NULL) { 52580209230bSgjelinek plp->pl_required = pnp->pn_next; 52590209230bSgjelinek free(pnp->pn_priv); 52600209230bSgjelinek free(pnp); 52610209230bSgjelinek } 52620209230bSgjelinek free(plp); 52630209230bSgjelinek } 52640209230bSgjelinek 52650209230bSgjelinek static int 5266e5816e35SEdward Pilatowicz priv_lists_create(zone_dochandle_t handle, char *brand, priv_lists_t **plpp, 5267bf1d7e28Sdh const char *curr_iptype) 52680209230bSgjelinek { 52690209230bSgjelinek priv_lists_t *plp; 52700209230bSgjelinek brand_handle_t bh; 5271e5816e35SEdward Pilatowicz char brand_str[MAXNAMELEN]; 5272e5816e35SEdward Pilatowicz 5273e5816e35SEdward Pilatowicz /* handle or brand must be set, but never both */ 5274e5816e35SEdward Pilatowicz assert((handle != NULL) || (brand != NULL)); 5275e5816e35SEdward Pilatowicz assert((handle == NULL) || (brand == NULL)); 52760209230bSgjelinek 52770209230bSgjelinek if (handle != NULL) { 5278e5816e35SEdward Pilatowicz brand = brand_str; 5279e5816e35SEdward Pilatowicz if (zonecfg_get_brand(handle, brand, sizeof (brand_str)) != 0) 52800209230bSgjelinek return (Z_BRAND_ERROR); 52810209230bSgjelinek } 52820209230bSgjelinek 52830209230bSgjelinek if ((bh = brand_open(brand)) == NULL) 52840209230bSgjelinek return (Z_BRAND_ERROR); 52850209230bSgjelinek 52860209230bSgjelinek if ((plp = calloc(1, sizeof (priv_lists_t))) == NULL) { 52870209230bSgjelinek brand_close(bh); 52880209230bSgjelinek return (Z_NOMEM); 52890209230bSgjelinek } 52900209230bSgjelinek 5291bf1d7e28Sdh plp->pl_iptype = curr_iptype; 5292bf1d7e28Sdh 52930209230bSgjelinek /* construct the privilege lists */ 52940209230bSgjelinek if (brand_config_iter_privilege(bh, priv_lists_cb, plp) != 0) { 52950209230bSgjelinek priv_lists_destroy(plp); 52960209230bSgjelinek brand_close(bh); 52970209230bSgjelinek return (Z_BRAND_ERROR); 52980209230bSgjelinek } 52990209230bSgjelinek 53000209230bSgjelinek brand_close(bh); 53010209230bSgjelinek *plpp = plp; 53020209230bSgjelinek return (Z_OK); 53030209230bSgjelinek } 53040209230bSgjelinek 53050209230bSgjelinek static int 53060209230bSgjelinek get_default_privset(priv_set_t *privs, priv_lists_t *plp) 53070209230bSgjelinek { 53080209230bSgjelinek priv_node_t *pnp; 53090209230bSgjelinek priv_set_t *basic; 53100209230bSgjelinek 53110209230bSgjelinek basic = priv_str_to_set(BASIC_TOKEN, TOKEN_PRIV_STR, NULL); 53120209230bSgjelinek if (basic == NULL) 53130209230bSgjelinek return (errno == ENOMEM ? Z_NOMEM : Z_INVAL); 53140209230bSgjelinek 53150209230bSgjelinek priv_union(basic, privs); 53160209230bSgjelinek priv_freeset(basic); 53170209230bSgjelinek 53180209230bSgjelinek for (pnp = plp->pl_default; pnp != NULL; pnp = pnp->pn_next) { 53190209230bSgjelinek if (priv_addset(privs, pnp->pn_priv) != 0) 53200209230bSgjelinek return (Z_INVAL); 53210209230bSgjelinek } 53220209230bSgjelinek 53230209230bSgjelinek return (Z_OK); 53240209230bSgjelinek } 53250209230bSgjelinek 5326e5816e35SEdward Pilatowicz int 5327e5816e35SEdward Pilatowicz zonecfg_default_brand(char *brand, size_t brandsize) 5328e5816e35SEdward Pilatowicz { 5329e5816e35SEdward Pilatowicz zone_dochandle_t handle; 53307522f2fcSEdward Pilatowicz int myzoneid = getzoneid(); 5331e5816e35SEdward Pilatowicz int ret; 5332e5816e35SEdward Pilatowicz 53337522f2fcSEdward Pilatowicz /* 53347522f2fcSEdward Pilatowicz * If we're running within a zone, then the default brand is the 53357522f2fcSEdward Pilatowicz * current zone's brand. 53367522f2fcSEdward Pilatowicz */ 53377522f2fcSEdward Pilatowicz if (myzoneid != GLOBAL_ZONEID) { 53387522f2fcSEdward Pilatowicz ret = zone_getattr(myzoneid, ZONE_ATTR_BRAND, brand, brandsize); 53397522f2fcSEdward Pilatowicz if (ret < 0) 53407522f2fcSEdward Pilatowicz return ((errno == EFAULT) ? Z_TOO_BIG : Z_INVAL); 53417522f2fcSEdward Pilatowicz return (Z_OK); 53427522f2fcSEdward Pilatowicz } 53437522f2fcSEdward Pilatowicz 5344e5816e35SEdward Pilatowicz if ((handle = zonecfg_init_handle()) == NULL) 5345e5816e35SEdward Pilatowicz return (Z_NOMEM); 5346e5816e35SEdward Pilatowicz if ((ret = zonecfg_get_handle("SUNWdefault", handle)) == Z_OK) { 5347e5816e35SEdward Pilatowicz ret = i_zonecfg_get_brand(handle, brand, brandsize, B_TRUE); 5348e5816e35SEdward Pilatowicz zonecfg_fini_handle(handle); 5349e5816e35SEdward Pilatowicz return (ret); 5350e5816e35SEdward Pilatowicz } 5351e5816e35SEdward Pilatowicz return (ret); 5352e5816e35SEdward Pilatowicz } 5353e5816e35SEdward Pilatowicz 53540209230bSgjelinek int 5355bf1d7e28Sdh zonecfg_default_privset(priv_set_t *privs, const char *curr_iptype) 53560209230bSgjelinek { 53570209230bSgjelinek priv_lists_t *plp; 5358e5816e35SEdward Pilatowicz char buf[MAXNAMELEN]; 53590209230bSgjelinek int ret; 53600209230bSgjelinek 5361e5816e35SEdward Pilatowicz if ((ret = zonecfg_default_brand(buf, sizeof (buf))) != Z_OK) 5362e5816e35SEdward Pilatowicz return (ret); 5363e5816e35SEdward Pilatowicz if ((ret = priv_lists_create(NULL, buf, &plp, curr_iptype)) != Z_OK) 53640209230bSgjelinek return (ret); 53650209230bSgjelinek ret = get_default_privset(privs, plp); 53660209230bSgjelinek priv_lists_destroy(plp); 53670209230bSgjelinek return (ret); 53680209230bSgjelinek } 53690209230bSgjelinek 53700209230bSgjelinek void 53710209230bSgjelinek append_priv_token(char *priv, char *str, size_t strlen) 53720209230bSgjelinek { 53730209230bSgjelinek if (*str != '\0') 53740209230bSgjelinek (void) strlcat(str, TOKEN_PRIV_STR, strlen); 53750209230bSgjelinek (void) strlcat(str, priv, strlen); 53760209230bSgjelinek } 53770209230bSgjelinek 53780209230bSgjelinek /* 53790209230bSgjelinek * Verify that the supplied string is a valid privilege limit set for a 53800209230bSgjelinek * non-global zone. This string must not only be acceptable to 53810209230bSgjelinek * priv_str_to_set(3C) which parses it, but it also must resolve to a 53820209230bSgjelinek * privilege set that includes certain required privileges and lacks 53830209230bSgjelinek * certain prohibited privileges. 53840209230bSgjelinek */ 53850209230bSgjelinek static int 53860209230bSgjelinek verify_privset(char *privbuf, priv_set_t *privs, char **privname, 53870209230bSgjelinek boolean_t add_default, priv_lists_t *plp) 53880209230bSgjelinek { 53890209230bSgjelinek priv_node_t *pnp; 53900209230bSgjelinek char *tmp, *cp, *lasts; 53910209230bSgjelinek size_t len; 53920209230bSgjelinek priv_set_t *mergeset; 53930209230bSgjelinek const char *token; 53940209230bSgjelinek 53950209230bSgjelinek /* 53960209230bSgjelinek * The verification of the privilege string occurs in several 53970209230bSgjelinek * phases. In the first phase, the supplied string is scanned for 53980209230bSgjelinek * the ZONE_TOKEN token which is not support as part of the 53990209230bSgjelinek * "limitpriv" property. 54000209230bSgjelinek * 54010209230bSgjelinek * Duplicate the supplied privilege string since strtok_r(3C) 54020209230bSgjelinek * tokenizes its input by null-terminating the tokens. 54030209230bSgjelinek */ 54040209230bSgjelinek if ((tmp = strdup(privbuf)) == NULL) 54050209230bSgjelinek return (Z_NOMEM); 54060209230bSgjelinek for (cp = strtok_r(tmp, TOKEN_PRIV_STR, &lasts); cp != NULL; 54070209230bSgjelinek cp = strtok_r(NULL, TOKEN_PRIV_STR, &lasts)) { 54080209230bSgjelinek if (strcmp(cp, ZONE_TOKEN) == 0) { 54090209230bSgjelinek free(tmp); 54100209230bSgjelinek if ((*privname = strdup(ZONE_TOKEN)) == NULL) 54110209230bSgjelinek return (Z_NOMEM); 54120209230bSgjelinek else 54130209230bSgjelinek return (Z_PRIV_UNKNOWN); 54140209230bSgjelinek } 54150209230bSgjelinek } 54160209230bSgjelinek free(tmp); 54170209230bSgjelinek 54180209230bSgjelinek if (add_default) { 54190209230bSgjelinek /* 54200209230bSgjelinek * If DEFAULT_TOKEN was specified, a string needs to be 54210209230bSgjelinek * built containing the privileges from the default, safe 54220209230bSgjelinek * set along with those of the "limitpriv" property. 54230209230bSgjelinek */ 54240209230bSgjelinek len = strlen(privbuf) + sizeof (BASIC_TOKEN) + 2; 54250209230bSgjelinek 54260209230bSgjelinek for (pnp = plp->pl_default; pnp != NULL; pnp = pnp->pn_next) 54270209230bSgjelinek len += strlen(pnp->pn_priv) + 1; 54280209230bSgjelinek tmp = alloca(len); 54290209230bSgjelinek *tmp = '\0'; 54300209230bSgjelinek 54310209230bSgjelinek append_priv_token(BASIC_TOKEN, tmp, len); 54320209230bSgjelinek for (pnp = plp->pl_default; pnp != NULL; pnp = pnp->pn_next) 54330209230bSgjelinek append_priv_token(pnp->pn_priv, tmp, len); 54340209230bSgjelinek (void) strlcat(tmp, TOKEN_PRIV_STR, len); 54350209230bSgjelinek (void) strlcat(tmp, privbuf, len); 54360209230bSgjelinek } else { 54370209230bSgjelinek tmp = privbuf; 54380209230bSgjelinek } 54390209230bSgjelinek 54400209230bSgjelinek 54410209230bSgjelinek /* 54420209230bSgjelinek * In the next phase, attempt to convert the merged privilege 54430209230bSgjelinek * string into a privilege set. In the case of an error, either 54440209230bSgjelinek * there was a memory allocation failure or there was an invalid 54450209230bSgjelinek * privilege token in the string. In either case, return an 54460209230bSgjelinek * appropriate error code but in the event of an invalid token, 54470209230bSgjelinek * allocate a string containing its name and return that back to 54480209230bSgjelinek * the caller. 54490209230bSgjelinek */ 54500209230bSgjelinek mergeset = priv_str_to_set(tmp, TOKEN_PRIV_STR, &token); 54510209230bSgjelinek if (mergeset == NULL) { 54520209230bSgjelinek if (token == NULL) 54530209230bSgjelinek return (Z_NOMEM); 54540209230bSgjelinek if ((cp = strchr(token, TOKEN_PRIV_CHAR)) != NULL) 54550209230bSgjelinek *cp = '\0'; 54560209230bSgjelinek if ((*privname = strdup(token)) == NULL) 54570209230bSgjelinek return (Z_NOMEM); 54580209230bSgjelinek else 54590209230bSgjelinek return (Z_PRIV_UNKNOWN); 54600209230bSgjelinek } 54610209230bSgjelinek 54620209230bSgjelinek /* 54630209230bSgjelinek * Next, verify that none of the prohibited zone privileges are 54640209230bSgjelinek * present in the merged privilege set. 54650209230bSgjelinek */ 54660209230bSgjelinek for (pnp = plp->pl_prohibited; pnp != NULL; pnp = pnp->pn_next) { 54670209230bSgjelinek if (priv_ismember(mergeset, pnp->pn_priv)) { 54680209230bSgjelinek priv_freeset(mergeset); 54690209230bSgjelinek if ((*privname = strdup(pnp->pn_priv)) == NULL) 54700209230bSgjelinek return (Z_NOMEM); 54710209230bSgjelinek else 54720209230bSgjelinek return (Z_PRIV_PROHIBITED); 54730209230bSgjelinek } 54740209230bSgjelinek } 54750209230bSgjelinek 54760209230bSgjelinek /* 54770209230bSgjelinek * Finally, verify that all of the required zone privileges are 54780209230bSgjelinek * present in the merged privilege set. 54790209230bSgjelinek */ 54800209230bSgjelinek for (pnp = plp->pl_required; pnp != NULL; pnp = pnp->pn_next) { 54810209230bSgjelinek if (!priv_ismember(mergeset, pnp->pn_priv)) { 54820209230bSgjelinek priv_freeset(mergeset); 54830209230bSgjelinek if ((*privname = strdup(pnp->pn_priv)) == NULL) 54840209230bSgjelinek return (Z_NOMEM); 54850209230bSgjelinek else 54860209230bSgjelinek return (Z_PRIV_REQUIRED); 54870209230bSgjelinek } 54880209230bSgjelinek } 54890209230bSgjelinek 54900209230bSgjelinek priv_copyset(mergeset, privs); 54910209230bSgjelinek priv_freeset(mergeset); 54920209230bSgjelinek return (Z_OK); 54930209230bSgjelinek } 54940209230bSgjelinek 54950209230bSgjelinek /* 54960209230bSgjelinek * Fill in the supplied privilege set with either the default, safe set of 54970209230bSgjelinek * privileges suitable for a non-global zone, or one based on the 54980209230bSgjelinek * "limitpriv" property in the zone's configuration. 54990209230bSgjelinek * 55000209230bSgjelinek * In the event of an invalid privilege specification in the 55010209230bSgjelinek * configuration, a string is allocated and returned containing the 55020209230bSgjelinek * "privilege" causing the issue. It is the caller's responsibility to 55030209230bSgjelinek * free this memory when it is done with it. 55040209230bSgjelinek */ 55050209230bSgjelinek int 55060209230bSgjelinek zonecfg_get_privset(zone_dochandle_t handle, priv_set_t *privs, 55070209230bSgjelinek char **privname) 55080209230bSgjelinek { 55090209230bSgjelinek priv_lists_t *plp; 55100209230bSgjelinek char *cp, *limitpriv = NULL; 55110209230bSgjelinek int err, limitlen; 5512bf1d7e28Sdh zone_iptype_t iptype; 5513bf1d7e28Sdh const char *curr_iptype; 55140209230bSgjelinek 55150209230bSgjelinek /* 55160209230bSgjelinek * Attempt to lookup the "limitpriv" property. If it does not 55170209230bSgjelinek * exist or matches the string DEFAULT_TOKEN exactly, then the 55180209230bSgjelinek * default, safe privilege set is returned. 55190209230bSgjelinek */ 55200209230bSgjelinek if ((err = zonecfg_get_limitpriv(handle, &limitpriv)) != Z_OK) 55210209230bSgjelinek return (err); 55220209230bSgjelinek 5523bf1d7e28Sdh if ((err = zonecfg_get_iptype(handle, &iptype)) != Z_OK) 5524bf1d7e28Sdh return (err); 5525bf1d7e28Sdh 5526bf1d7e28Sdh switch (iptype) { 5527bf1d7e28Sdh case ZS_SHARED: 5528bf1d7e28Sdh curr_iptype = "shared"; 5529bf1d7e28Sdh break; 5530bf1d7e28Sdh case ZS_EXCLUSIVE: 5531bf1d7e28Sdh curr_iptype = "exclusive"; 5532bf1d7e28Sdh break; 5533bf1d7e28Sdh } 5534bf1d7e28Sdh 5535e5816e35SEdward Pilatowicz if ((err = priv_lists_create(handle, NULL, &plp, curr_iptype)) != Z_OK) 55360209230bSgjelinek return (err); 55370209230bSgjelinek 55380209230bSgjelinek limitlen = strlen(limitpriv); 55390209230bSgjelinek if (limitlen == 0 || strcmp(limitpriv, DEFAULT_TOKEN) == 0) { 55400209230bSgjelinek free(limitpriv); 55410209230bSgjelinek err = get_default_privset(privs, plp); 55420209230bSgjelinek priv_lists_destroy(plp); 55430209230bSgjelinek return (err); 55440209230bSgjelinek } 55450209230bSgjelinek 55460209230bSgjelinek /* 55470209230bSgjelinek * Check if the string DEFAULT_TOKEN is the first token in a list 55480209230bSgjelinek * of privileges. 55490209230bSgjelinek */ 55500209230bSgjelinek cp = strchr(limitpriv, TOKEN_PRIV_CHAR); 55510209230bSgjelinek if (cp != NULL && 55520209230bSgjelinek strncmp(limitpriv, DEFAULT_TOKEN, cp - limitpriv) == 0) 55530209230bSgjelinek err = verify_privset(cp + 1, privs, privname, B_TRUE, plp); 55540209230bSgjelinek else 55550209230bSgjelinek err = verify_privset(limitpriv, privs, privname, B_FALSE, plp); 55560209230bSgjelinek 55570209230bSgjelinek free(limitpriv); 55580209230bSgjelinek priv_lists_destroy(plp); 55590209230bSgjelinek return (err); 55600209230bSgjelinek } 55610209230bSgjelinek 55620209230bSgjelinek int 55630209230bSgjelinek zone_get_zonepath(char *zone_name, char *zonepath, size_t rp_sz) 55640209230bSgjelinek { 55650209230bSgjelinek zone_dochandle_t handle; 55660209230bSgjelinek boolean_t found = B_FALSE; 55670209230bSgjelinek struct zoneent *ze; 55680209230bSgjelinek FILE *cookie; 55690209230bSgjelinek int err; 55700209230bSgjelinek char *cp; 55710209230bSgjelinek 55720209230bSgjelinek if (zone_name == NULL) 55730209230bSgjelinek return (Z_INVAL); 55740209230bSgjelinek 55750209230bSgjelinek (void) strlcpy(zonepath, zonecfg_root, rp_sz); 55760209230bSgjelinek cp = zonepath + strlen(zonepath); 55770209230bSgjelinek while (cp > zonepath && cp[-1] == '/') 55780209230bSgjelinek *--cp = '\0'; 55790209230bSgjelinek 55800209230bSgjelinek if (strcmp(zone_name, GLOBAL_ZONENAME) == 0) { 55810209230bSgjelinek if (zonepath[0] == '\0') 55820209230bSgjelinek (void) strlcpy(zonepath, "/", rp_sz); 55830209230bSgjelinek return (Z_OK); 55840209230bSgjelinek } 55850209230bSgjelinek 55860209230bSgjelinek /* 55870209230bSgjelinek * First check the index file. Because older versions did not have 55880209230bSgjelinek * a copy of the zone path, allow for it to be zero length, in which 55890209230bSgjelinek * case we ignore this result and fall back to the XML files. 55900209230bSgjelinek */ 55910209230bSgjelinek cookie = setzoneent(); 55920209230bSgjelinek while ((ze = getzoneent_private(cookie)) != NULL) { 55930209230bSgjelinek if (strcmp(ze->zone_name, zone_name) == 0) { 55940209230bSgjelinek found = B_TRUE; 55950209230bSgjelinek if (ze->zone_path[0] != '\0') 55960209230bSgjelinek (void) strlcpy(cp, ze->zone_path, 55970209230bSgjelinek rp_sz - (cp - zonepath)); 55980209230bSgjelinek } 55990209230bSgjelinek free(ze); 56000209230bSgjelinek if (found) 56010209230bSgjelinek break; 56020209230bSgjelinek } 56030209230bSgjelinek endzoneent(cookie); 56040209230bSgjelinek if (found && *cp != '\0') 56050209230bSgjelinek return (Z_OK); 56060209230bSgjelinek 56070209230bSgjelinek /* Fall back to the XML files. */ 56080209230bSgjelinek if ((handle = zonecfg_init_handle()) == NULL) 56090209230bSgjelinek return (Z_NOMEM); 56100209230bSgjelinek 56110209230bSgjelinek /* 56120209230bSgjelinek * Check the snapshot first: if a zone is running, its zonepath 56130209230bSgjelinek * may have changed. 56140209230bSgjelinek */ 56150209230bSgjelinek if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) { 5616e767a340Sgjelinek if ((err = zonecfg_get_handle(zone_name, handle)) != Z_OK) { 5617e767a340Sgjelinek zonecfg_fini_handle(handle); 56180209230bSgjelinek return (err); 5619e767a340Sgjelinek } 56200209230bSgjelinek } 56210209230bSgjelinek err = zonecfg_get_zonepath(handle, zonepath, rp_sz); 56220209230bSgjelinek zonecfg_fini_handle(handle); 56230209230bSgjelinek return (err); 56240209230bSgjelinek } 56250209230bSgjelinek 56260209230bSgjelinek int 56270209230bSgjelinek zone_get_rootpath(char *zone_name, char *rootpath, size_t rp_sz) 56280209230bSgjelinek { 56290209230bSgjelinek int err; 56300209230bSgjelinek 56310209230bSgjelinek /* This function makes sense for non-global zones only. */ 56320209230bSgjelinek if (strcmp(zone_name, GLOBAL_ZONENAME) == 0) 56330209230bSgjelinek return (Z_BOGUS_ZONE_NAME); 56340209230bSgjelinek if ((err = zone_get_zonepath(zone_name, rootpath, rp_sz)) != Z_OK) 56350209230bSgjelinek return (err); 56360209230bSgjelinek if (strlcat(rootpath, "/root", rp_sz) >= rp_sz) 56370209230bSgjelinek return (Z_TOO_BIG); 56380209230bSgjelinek return (Z_OK); 56390209230bSgjelinek } 56400209230bSgjelinek 56410209230bSgjelinek int 56420209230bSgjelinek zone_get_brand(char *zone_name, char *brandname, size_t rp_sz) 56430209230bSgjelinek { 56440209230bSgjelinek int err; 56450209230bSgjelinek zone_dochandle_t handle; 56460209230bSgjelinek char myzone[MAXNAMELEN]; 56470209230bSgjelinek int myzoneid = getzoneid(); 56480209230bSgjelinek 56490209230bSgjelinek /* 56500209230bSgjelinek * If we are not in the global zone, then we don't have the zone 56510209230bSgjelinek * .xml files with the brand name available. Thus, we are going to 56520209230bSgjelinek * have to ask the kernel for the information. 56530209230bSgjelinek */ 56540209230bSgjelinek if (myzoneid != GLOBAL_ZONEID) { 56552ec67e04Sgjelinek if (is_system_labeled()) { 56562ec67e04Sgjelinek (void) strlcpy(brandname, NATIVE_BRAND_NAME, rp_sz); 56572ec67e04Sgjelinek return (Z_OK); 56582ec67e04Sgjelinek } 56590209230bSgjelinek if (zone_getattr(myzoneid, ZONE_ATTR_NAME, myzone, 56600209230bSgjelinek sizeof (myzone)) < 0) 56610209230bSgjelinek return (Z_NO_ZONE); 56621d6979b7Ssaurabh vyas - Sun Microsystems - Bangalore India if (!zonecfg_is_scratch(myzone)) { 56631d6979b7Ssaurabh vyas - Sun Microsystems - Bangalore India if (strncmp(zone_name, myzone, MAXNAMELEN) != 0) 56641d6979b7Ssaurabh vyas - Sun Microsystems - Bangalore India return (Z_NO_ZONE); 56651d6979b7Ssaurabh vyas - Sun Microsystems - Bangalore India } 56660209230bSgjelinek err = zone_getattr(myzoneid, ZONE_ATTR_BRAND, brandname, rp_sz); 56670209230bSgjelinek if (err < 0) 56680209230bSgjelinek return ((errno == EFAULT) ? Z_TOO_BIG : Z_INVAL); 56691d6979b7Ssaurabh vyas - Sun Microsystems - Bangalore India 56700209230bSgjelinek return (Z_OK); 56710209230bSgjelinek } 56720209230bSgjelinek 5673e5816e35SEdward Pilatowicz if (strcmp(zone_name, "global") == 0) 5674e5816e35SEdward Pilatowicz return (zonecfg_default_brand(brandname, rp_sz)); 5675e5816e35SEdward Pilatowicz 56760209230bSgjelinek if ((handle = zonecfg_init_handle()) == NULL) 56770209230bSgjelinek return (Z_NOMEM); 56780209230bSgjelinek 56790209230bSgjelinek err = zonecfg_get_handle((char *)zone_name, handle); 56800209230bSgjelinek if (err == Z_OK) 56810209230bSgjelinek err = zonecfg_get_brand(handle, brandname, rp_sz); 56820209230bSgjelinek 56830209230bSgjelinek zonecfg_fini_handle(handle); 56840209230bSgjelinek return (err); 56850209230bSgjelinek } 56860209230bSgjelinek 56870209230bSgjelinek /* 56880209230bSgjelinek * Return the appropriate root for the active /dev. 56890209230bSgjelinek * For normal zone, the path is $ZONEPATH/root; 56900209230bSgjelinek * for scratch zone, the dev path is $ZONEPATH/lu. 56910209230bSgjelinek */ 56920209230bSgjelinek int 56930209230bSgjelinek zone_get_devroot(char *zone_name, char *devroot, size_t rp_sz) 56940209230bSgjelinek { 56950209230bSgjelinek int err; 56960209230bSgjelinek char *suffix; 56970209230bSgjelinek zone_state_t state; 56980209230bSgjelinek 56990209230bSgjelinek /* This function makes sense for non-global zones only. */ 57000209230bSgjelinek if (strcmp(zone_name, GLOBAL_ZONENAME) == 0) 57010209230bSgjelinek return (Z_BOGUS_ZONE_NAME); 57020209230bSgjelinek if ((err = zone_get_zonepath(zone_name, devroot, rp_sz)) != Z_OK) 57030209230bSgjelinek return (err); 57040209230bSgjelinek 57050209230bSgjelinek if (zone_get_state(zone_name, &state) == Z_OK && 57060209230bSgjelinek state == ZONE_STATE_MOUNTED) 57070209230bSgjelinek suffix = "/lu"; 57080209230bSgjelinek else 57090209230bSgjelinek suffix = "/root"; 57100209230bSgjelinek if (strlcat(devroot, suffix, rp_sz) >= rp_sz) 57110209230bSgjelinek return (Z_TOO_BIG); 57120209230bSgjelinek return (Z_OK); 57130209230bSgjelinek } 57140209230bSgjelinek 57150209230bSgjelinek static zone_state_t 57160209230bSgjelinek kernel_state_to_user_state(zoneid_t zoneid, zone_status_t kernel_state) 57170209230bSgjelinek { 57180209230bSgjelinek char zoneroot[MAXPATHLEN]; 57190209230bSgjelinek size_t zlen; 57200209230bSgjelinek 57210209230bSgjelinek assert(kernel_state <= ZONE_MAX_STATE); 57220209230bSgjelinek switch (kernel_state) { 57230209230bSgjelinek case ZONE_IS_UNINITIALIZED: 5724bd41d0a8Snordmark case ZONE_IS_INITIALIZED: 5725bd41d0a8Snordmark /* The kernel will not return these two states */ 57260209230bSgjelinek return (ZONE_STATE_READY); 57270209230bSgjelinek case ZONE_IS_READY: 57280209230bSgjelinek /* 57290209230bSgjelinek * If the zone's root is mounted on $ZONEPATH/lu, then 57300209230bSgjelinek * it's a mounted scratch zone. 57310209230bSgjelinek */ 57320209230bSgjelinek if (zone_getattr(zoneid, ZONE_ATTR_ROOT, zoneroot, 57330209230bSgjelinek sizeof (zoneroot)) >= 0) { 57340209230bSgjelinek zlen = strlen(zoneroot); 57350209230bSgjelinek if (zlen > 3 && 57360209230bSgjelinek strcmp(zoneroot + zlen - 3, "/lu") == 0) 57370209230bSgjelinek return (ZONE_STATE_MOUNTED); 57380209230bSgjelinek } 57390209230bSgjelinek return (ZONE_STATE_READY); 57400209230bSgjelinek case ZONE_IS_BOOTING: 57410209230bSgjelinek case ZONE_IS_RUNNING: 57420209230bSgjelinek return (ZONE_STATE_RUNNING); 57430209230bSgjelinek case ZONE_IS_SHUTTING_DOWN: 57440209230bSgjelinek case ZONE_IS_EMPTY: 57450209230bSgjelinek return (ZONE_STATE_SHUTTING_DOWN); 57460209230bSgjelinek case ZONE_IS_DOWN: 57470209230bSgjelinek case ZONE_IS_DYING: 57480209230bSgjelinek case ZONE_IS_DEAD: 57490209230bSgjelinek default: 57500209230bSgjelinek return (ZONE_STATE_DOWN); 57510209230bSgjelinek } 57520209230bSgjelinek /* NOTREACHED */ 57530209230bSgjelinek } 57540209230bSgjelinek 57550209230bSgjelinek int 57560209230bSgjelinek zone_get_state(char *zone_name, zone_state_t *state_num) 57570209230bSgjelinek { 57580209230bSgjelinek zone_status_t status; 57590209230bSgjelinek zoneid_t zone_id; 57600209230bSgjelinek struct zoneent *ze; 57610209230bSgjelinek boolean_t found = B_FALSE; 57620209230bSgjelinek FILE *cookie; 57630209230bSgjelinek char kernzone[ZONENAME_MAX]; 57640209230bSgjelinek FILE *fp; 57650209230bSgjelinek 57660209230bSgjelinek if (zone_name == NULL) 57670209230bSgjelinek return (Z_INVAL); 57680209230bSgjelinek 57690209230bSgjelinek /* 57700209230bSgjelinek * If we're looking at an alternate root, then we need to query the 57710209230bSgjelinek * kernel using the scratch zone name. 57720209230bSgjelinek */ 57730209230bSgjelinek zone_id = -1; 57740209230bSgjelinek if (*zonecfg_root != '\0' && !zonecfg_is_scratch(zone_name)) { 57750209230bSgjelinek if ((fp = zonecfg_open_scratch("", B_FALSE)) != NULL) { 57760209230bSgjelinek if (zonecfg_find_scratch(fp, zone_name, zonecfg_root, 57770209230bSgjelinek kernzone, sizeof (kernzone)) == 0) 57780209230bSgjelinek zone_id = getzoneidbyname(kernzone); 57790209230bSgjelinek zonecfg_close_scratch(fp); 57800209230bSgjelinek } 57810209230bSgjelinek } else { 57820209230bSgjelinek zone_id = getzoneidbyname(zone_name); 57830209230bSgjelinek } 57840209230bSgjelinek 57850209230bSgjelinek /* check to see if zone is running */ 57860209230bSgjelinek if (zone_id != -1 && 57870209230bSgjelinek zone_getattr(zone_id, ZONE_ATTR_STATUS, &status, 57880209230bSgjelinek sizeof (status)) >= 0) { 57890209230bSgjelinek *state_num = kernel_state_to_user_state(zone_id, status); 57900209230bSgjelinek return (Z_OK); 57910209230bSgjelinek } 57920209230bSgjelinek 57930209230bSgjelinek cookie = setzoneent(); 57940209230bSgjelinek while ((ze = getzoneent_private(cookie)) != NULL) { 57950209230bSgjelinek if (strcmp(ze->zone_name, zone_name) == 0) { 57960209230bSgjelinek found = B_TRUE; 57970209230bSgjelinek *state_num = ze->zone_state; 57980209230bSgjelinek } 57990209230bSgjelinek free(ze); 58000209230bSgjelinek if (found) 58010209230bSgjelinek break; 58020209230bSgjelinek } 58030209230bSgjelinek endzoneent(cookie); 58040209230bSgjelinek return ((found) ? Z_OK : Z_NO_ZONE); 58050209230bSgjelinek } 58060209230bSgjelinek 58070209230bSgjelinek int 58080209230bSgjelinek zone_set_state(char *zone, zone_state_t state) 58090209230bSgjelinek { 58100209230bSgjelinek struct zoneent ze; 58110209230bSgjelinek 58120209230bSgjelinek if (state != ZONE_STATE_CONFIGURED && state != ZONE_STATE_INSTALLED && 58130209230bSgjelinek state != ZONE_STATE_INCOMPLETE) 58140209230bSgjelinek return (Z_INVAL); 58150209230bSgjelinek 58160209230bSgjelinek bzero(&ze, sizeof (ze)); 58170209230bSgjelinek (void) strlcpy(ze.zone_name, zone, sizeof (ze.zone_name)); 58180209230bSgjelinek ze.zone_state = state; 58190209230bSgjelinek (void) strlcpy(ze.zone_path, "", sizeof (ze.zone_path)); 58200209230bSgjelinek return (putzoneent(&ze, PZE_MODIFY)); 58210209230bSgjelinek } 58220209230bSgjelinek 58230209230bSgjelinek /* 58240209230bSgjelinek * Get id (if any) for specified zone. There are four possible outcomes: 58250209230bSgjelinek * - If the string corresponds to the numeric id of an active (booted) 58260209230bSgjelinek * zone, sets *zip to the zone id and returns 0. 58270209230bSgjelinek * - If the string corresponds to the name of an active (booted) zone, 58280209230bSgjelinek * sets *zip to the zone id and returns 0. 58290209230bSgjelinek * - If the string is a name in the configuration but is not booted, 58300209230bSgjelinek * sets *zip to ZONE_ID_UNDEFINED and returns 0. 58310209230bSgjelinek * - Otherwise, leaves *zip unchanged and returns -1. 58320209230bSgjelinek * 58330209230bSgjelinek * This function acts as an auxiliary filter on the function of the same 58340209230bSgjelinek * name in libc; the linker binds to this version if libzonecfg exists, 58350209230bSgjelinek * and the libc version if it doesn't. Any changes to this version of 58360209230bSgjelinek * the function should probably be reflected in the libc version as well. 58370209230bSgjelinek */ 58380209230bSgjelinek int 58390209230bSgjelinek zone_get_id(const char *str, zoneid_t *zip) 58400209230bSgjelinek { 58410209230bSgjelinek zone_dochandle_t hdl; 58420209230bSgjelinek zoneid_t zoneid; 58430209230bSgjelinek char *cp; 58440209230bSgjelinek int err; 58450209230bSgjelinek 58460209230bSgjelinek /* first try looking for active zone by id */ 58470209230bSgjelinek errno = 0; 58480209230bSgjelinek zoneid = (zoneid_t)strtol(str, &cp, 0); 58490209230bSgjelinek if (errno == 0 && cp != str && *cp == '\0' && 58500209230bSgjelinek getzonenamebyid(zoneid, NULL, 0) != -1) { 58510209230bSgjelinek *zip = zoneid; 58520209230bSgjelinek return (0); 58530209230bSgjelinek } 58540209230bSgjelinek 58550209230bSgjelinek /* then look for active zone by name */ 58560209230bSgjelinek if ((zoneid = getzoneidbyname(str)) != -1) { 58570209230bSgjelinek *zip = zoneid; 58580209230bSgjelinek return (0); 58590209230bSgjelinek } 58600209230bSgjelinek 58610209230bSgjelinek /* if in global zone, try looking up name in configuration database */ 58620209230bSgjelinek if (getzoneid() != GLOBAL_ZONEID || 58630209230bSgjelinek (hdl = zonecfg_init_handle()) == NULL) 58640209230bSgjelinek return (-1); 58650209230bSgjelinek 58660209230bSgjelinek if (zonecfg_get_handle(str, hdl) == Z_OK) { 58670209230bSgjelinek /* zone exists but isn't active */ 58680209230bSgjelinek *zip = ZONE_ID_UNDEFINED; 58690209230bSgjelinek err = 0; 58700209230bSgjelinek } else { 58710209230bSgjelinek err = -1; 58720209230bSgjelinek } 58730209230bSgjelinek 58740209230bSgjelinek zonecfg_fini_handle(hdl); 58750209230bSgjelinek return (err); 58760209230bSgjelinek } 58770209230bSgjelinek 58780209230bSgjelinek char * 58790209230bSgjelinek zone_state_str(zone_state_t state_num) 58800209230bSgjelinek { 58810209230bSgjelinek switch (state_num) { 58820209230bSgjelinek case ZONE_STATE_CONFIGURED: 58830209230bSgjelinek return (ZONE_STATE_STR_CONFIGURED); 58840209230bSgjelinek case ZONE_STATE_INCOMPLETE: 58850209230bSgjelinek return (ZONE_STATE_STR_INCOMPLETE); 58860209230bSgjelinek case ZONE_STATE_INSTALLED: 58870209230bSgjelinek return (ZONE_STATE_STR_INSTALLED); 58880209230bSgjelinek case ZONE_STATE_READY: 58890209230bSgjelinek return (ZONE_STATE_STR_READY); 58900209230bSgjelinek case ZONE_STATE_MOUNTED: 58910209230bSgjelinek return (ZONE_STATE_STR_MOUNTED); 58920209230bSgjelinek case ZONE_STATE_RUNNING: 58930209230bSgjelinek return (ZONE_STATE_STR_RUNNING); 58940209230bSgjelinek case ZONE_STATE_SHUTTING_DOWN: 58950209230bSgjelinek return (ZONE_STATE_STR_SHUTTING_DOWN); 58960209230bSgjelinek case ZONE_STATE_DOWN: 58970209230bSgjelinek return (ZONE_STATE_STR_DOWN); 58980209230bSgjelinek default: 58990209230bSgjelinek return ("unknown"); 59000209230bSgjelinek } 59010209230bSgjelinek } 59020209230bSgjelinek 59030209230bSgjelinek /* 59040209230bSgjelinek * Given a UUID value, find an associated zone name. This is intended to be 59050209230bSgjelinek * used by callers who set up some 'default' name (corresponding to the 59060209230bSgjelinek * expected name for the zone) in the zonename buffer, and thus the function 59070209230bSgjelinek * doesn't touch this buffer on failure. 59080209230bSgjelinek */ 59090209230bSgjelinek int 59100209230bSgjelinek zonecfg_get_name_by_uuid(const uuid_t uuidin, char *zonename, size_t namelen) 59110209230bSgjelinek { 59120209230bSgjelinek FILE *fp; 59130209230bSgjelinek struct zoneent *ze; 59140209230bSgjelinek uchar_t *uuid; 59150209230bSgjelinek 59160209230bSgjelinek /* 59170209230bSgjelinek * A small amount of subterfuge via casts is necessary here because 59180209230bSgjelinek * libuuid doesn't use const correctly, but we don't want to export 59190209230bSgjelinek * this brokenness to our clients. 59200209230bSgjelinek */ 59210209230bSgjelinek uuid = (uchar_t *)uuidin; 59220209230bSgjelinek if (uuid_is_null(uuid)) 59230209230bSgjelinek return (Z_NO_ZONE); 59240209230bSgjelinek if ((fp = setzoneent()) == NULL) 59250209230bSgjelinek return (Z_NO_ZONE); 59260209230bSgjelinek while ((ze = getzoneent_private(fp)) != NULL) { 59270209230bSgjelinek if (uuid_compare(uuid, ze->zone_uuid) == 0) 59280209230bSgjelinek break; 59290209230bSgjelinek free(ze); 59300209230bSgjelinek } 59310209230bSgjelinek endzoneent(fp); 59320209230bSgjelinek if (ze != NULL) { 59330209230bSgjelinek (void) strlcpy(zonename, ze->zone_name, namelen); 59340209230bSgjelinek free(ze); 59350209230bSgjelinek return (Z_OK); 59360209230bSgjelinek } else { 59370209230bSgjelinek return (Z_NO_ZONE); 59380209230bSgjelinek } 59390209230bSgjelinek } 59400209230bSgjelinek 59410209230bSgjelinek /* 59420209230bSgjelinek * Given a zone name, get its UUID. Returns a "NULL" UUID value if the zone 59430209230bSgjelinek * exists but the file doesn't have a value set yet. Returns an error if the 59440209230bSgjelinek * zone cannot be located. 59450209230bSgjelinek */ 59460209230bSgjelinek int 59470209230bSgjelinek zonecfg_get_uuid(const char *zonename, uuid_t uuid) 59480209230bSgjelinek { 59490209230bSgjelinek FILE *fp; 59500209230bSgjelinek struct zoneent *ze; 59510209230bSgjelinek 59520209230bSgjelinek if ((fp = setzoneent()) == NULL) 59530209230bSgjelinek return (Z_NO_ZONE); 59540209230bSgjelinek while ((ze = getzoneent_private(fp)) != NULL) { 59550209230bSgjelinek if (strcmp(ze->zone_name, zonename) == 0) 59560209230bSgjelinek break; 59570209230bSgjelinek free(ze); 59580209230bSgjelinek } 59590209230bSgjelinek endzoneent(fp); 59600209230bSgjelinek if (ze != NULL) { 59610209230bSgjelinek uuid_copy(uuid, ze->zone_uuid); 59620209230bSgjelinek free(ze); 59630209230bSgjelinek return (Z_OK); 59640209230bSgjelinek } else { 59650209230bSgjelinek return (Z_NO_ZONE); 59660209230bSgjelinek } 59670209230bSgjelinek } 59680209230bSgjelinek 59690209230bSgjelinek /* 59700209230bSgjelinek * File-system convenience functions. 59710209230bSgjelinek */ 59720209230bSgjelinek boolean_t 59730209230bSgjelinek zonecfg_valid_fs_type(const char *type) 59740209230bSgjelinek { 59750209230bSgjelinek /* 59760209230bSgjelinek * We already know which FS types don't work. 59770209230bSgjelinek */ 59780209230bSgjelinek if (strcmp(type, "proc") == 0 || 59790209230bSgjelinek strcmp(type, "mntfs") == 0 || 59800209230bSgjelinek strcmp(type, "autofs") == 0 || 5981bd93c05dSAlexander Eremin strncmp(type, "nfs", sizeof ("nfs") - 1) == 0) 59820209230bSgjelinek return (B_FALSE); 59830209230bSgjelinek /* 59840209230bSgjelinek * The caller may do more detailed verification to make sure other 59850209230bSgjelinek * aspects of this filesystem type make sense. 59860209230bSgjelinek */ 59870209230bSgjelinek return (B_TRUE); 59880209230bSgjelinek } 59890209230bSgjelinek 59900209230bSgjelinek /* 59910209230bSgjelinek * Generally uninteresting rctl convenience functions. 59920209230bSgjelinek */ 59930209230bSgjelinek 59940209230bSgjelinek int 59950209230bSgjelinek zonecfg_construct_rctlblk(const struct zone_rctlvaltab *rctlval, 59960209230bSgjelinek rctlblk_t *rctlblk) 59970209230bSgjelinek { 59980209230bSgjelinek unsigned long long ull; 59990209230bSgjelinek char *endp; 60000209230bSgjelinek rctl_priv_t priv; 60010209230bSgjelinek rctl_qty_t limit; 60020209230bSgjelinek uint_t action; 60030209230bSgjelinek 60040209230bSgjelinek /* Get the privilege */ 60050209230bSgjelinek if (strcmp(rctlval->zone_rctlval_priv, "basic") == 0) { 60060209230bSgjelinek priv = RCPRIV_BASIC; 60070209230bSgjelinek } else if (strcmp(rctlval->zone_rctlval_priv, "privileged") == 0) { 60080209230bSgjelinek priv = RCPRIV_PRIVILEGED; 60090209230bSgjelinek } else { 60100209230bSgjelinek /* Invalid privilege */ 60110209230bSgjelinek return (Z_INVAL); 60120209230bSgjelinek } 60130209230bSgjelinek 60140209230bSgjelinek /* deal with negative input; strtoull(3c) doesn't do what we want */ 60150209230bSgjelinek if (rctlval->zone_rctlval_limit[0] == '-') 60160209230bSgjelinek return (Z_INVAL); 60170209230bSgjelinek /* Get the limit */ 60180209230bSgjelinek errno = 0; 60190209230bSgjelinek ull = strtoull(rctlval->zone_rctlval_limit, &endp, 0); 60200209230bSgjelinek if (errno != 0 || *endp != '\0') { 60210209230bSgjelinek /* parse failed */ 60220209230bSgjelinek return (Z_INVAL); 60230209230bSgjelinek } 60240209230bSgjelinek limit = (rctl_qty_t)ull; 60250209230bSgjelinek 60260209230bSgjelinek /* Get the action */ 60270209230bSgjelinek if (strcmp(rctlval->zone_rctlval_action, "none") == 0) { 60280209230bSgjelinek action = RCTL_LOCAL_NOACTION; 60290209230bSgjelinek } else if (strcmp(rctlval->zone_rctlval_action, "signal") == 0) { 60300209230bSgjelinek action = RCTL_LOCAL_SIGNAL; 60310209230bSgjelinek } else if (strcmp(rctlval->zone_rctlval_action, "deny") == 0) { 60320209230bSgjelinek action = RCTL_LOCAL_DENY; 60330209230bSgjelinek } else { 60340209230bSgjelinek /* Invalid Action */ 60350209230bSgjelinek return (Z_INVAL); 60360209230bSgjelinek } 60370209230bSgjelinek rctlblk_set_local_action(rctlblk, action, 0); 60380209230bSgjelinek rctlblk_set_privilege(rctlblk, priv); 60390209230bSgjelinek rctlblk_set_value(rctlblk, limit); 60400209230bSgjelinek return (Z_OK); 60410209230bSgjelinek } 60420209230bSgjelinek 60430209230bSgjelinek static int 60440209230bSgjelinek rctl_check(const char *rctlname, void *arg) 60450209230bSgjelinek { 60460209230bSgjelinek const char *attrname = arg; 60470209230bSgjelinek 60480209230bSgjelinek /* 60490209230bSgjelinek * Returning 1 here is our signal to zonecfg_is_rctl() that it is 60507c478bd9Sstevel@tonic-gate * indeed an rctl name recognized by the system. 60517c478bd9Sstevel@tonic-gate */ 60520209230bSgjelinek return (strcmp(rctlname, attrname) == 0 ? 1 : 0); 60530209230bSgjelinek } 60540209230bSgjelinek 60550209230bSgjelinek boolean_t 60560209230bSgjelinek zonecfg_is_rctl(const char *name) 60570209230bSgjelinek { 60580209230bSgjelinek return (rctl_walk(rctl_check, (void *)name) == 1); 60590209230bSgjelinek } 60600209230bSgjelinek 60610209230bSgjelinek boolean_t 60620209230bSgjelinek zonecfg_valid_rctlname(const char *name) 60630209230bSgjelinek { 60640209230bSgjelinek const char *c; 60650209230bSgjelinek 60660209230bSgjelinek if (strncmp(name, "zone.", sizeof ("zone.") - 1) != 0) 60670209230bSgjelinek return (B_FALSE); 60680209230bSgjelinek if (strlen(name) == sizeof ("zone.") - 1) 60690209230bSgjelinek return (B_FALSE); 60700209230bSgjelinek for (c = name + sizeof ("zone.") - 1; *c != '\0'; c++) { 60710209230bSgjelinek if (!isalpha(*c) && *c != '-') 60720209230bSgjelinek return (B_FALSE); 60730209230bSgjelinek } 60740209230bSgjelinek return (B_TRUE); 60750209230bSgjelinek } 60760209230bSgjelinek 60770209230bSgjelinek boolean_t 60780209230bSgjelinek zonecfg_valid_rctlblk(const rctlblk_t *rctlblk) 60790209230bSgjelinek { 60800209230bSgjelinek rctl_priv_t priv = rctlblk_get_privilege((rctlblk_t *)rctlblk); 60810209230bSgjelinek uint_t action = rctlblk_get_local_action((rctlblk_t *)rctlblk, NULL); 60820209230bSgjelinek 60830209230bSgjelinek if (priv != RCPRIV_PRIVILEGED) 60840209230bSgjelinek return (B_FALSE); 60850209230bSgjelinek if (action != RCTL_LOCAL_NOACTION && action != RCTL_LOCAL_DENY) 60860209230bSgjelinek return (B_FALSE); 60870209230bSgjelinek return (B_TRUE); 60880209230bSgjelinek } 60890209230bSgjelinek 60900209230bSgjelinek boolean_t 60910209230bSgjelinek zonecfg_valid_rctl(const char *name, const rctlblk_t *rctlblk) 60920209230bSgjelinek { 60930209230bSgjelinek rctlblk_t *current, *next; 60940209230bSgjelinek rctl_qty_t limit = rctlblk_get_value((rctlblk_t *)rctlblk); 60950209230bSgjelinek uint_t action = rctlblk_get_local_action((rctlblk_t *)rctlblk, NULL); 60960209230bSgjelinek uint_t global_flags; 60970209230bSgjelinek 60980209230bSgjelinek if (!zonecfg_valid_rctlblk(rctlblk)) 60990209230bSgjelinek return (B_FALSE); 61000209230bSgjelinek if (!zonecfg_valid_rctlname(name)) 61010209230bSgjelinek return (B_FALSE); 61020209230bSgjelinek 61030209230bSgjelinek current = alloca(rctlblk_size()); 61040209230bSgjelinek if (getrctl(name, NULL, current, RCTL_FIRST) != 0) 61050209230bSgjelinek return (B_TRUE); /* not an rctl on this system */ 61060209230bSgjelinek /* 61070209230bSgjelinek * Make sure the proposed value isn't greater than the current system 61080209230bSgjelinek * value. 61090209230bSgjelinek */ 61100209230bSgjelinek next = alloca(rctlblk_size()); 61110209230bSgjelinek while (rctlblk_get_privilege(current) != RCPRIV_SYSTEM) { 61120209230bSgjelinek rctlblk_t *tmp; 61130209230bSgjelinek 61140209230bSgjelinek if (getrctl(name, current, next, RCTL_NEXT) != 0) 61150209230bSgjelinek return (B_FALSE); /* shouldn't happen */ 61160209230bSgjelinek tmp = current; 61170209230bSgjelinek current = next; 61180209230bSgjelinek next = tmp; 61190209230bSgjelinek } 61200209230bSgjelinek if (limit > rctlblk_get_value(current)) 61210209230bSgjelinek return (B_FALSE); 61220209230bSgjelinek 61230209230bSgjelinek /* 61240209230bSgjelinek * Make sure the proposed action is allowed. 61250209230bSgjelinek */ 61260209230bSgjelinek global_flags = rctlblk_get_global_flags(current); 61270209230bSgjelinek if ((global_flags & RCTL_GLOBAL_DENY_NEVER) && 61280209230bSgjelinek action == RCTL_LOCAL_DENY) 61290209230bSgjelinek return (B_FALSE); 61300209230bSgjelinek if ((global_flags & RCTL_GLOBAL_DENY_ALWAYS) && 61310209230bSgjelinek action == RCTL_LOCAL_NOACTION) 61320209230bSgjelinek return (B_FALSE); 61330209230bSgjelinek 61340209230bSgjelinek return (B_TRUE); 61350209230bSgjelinek } 61360209230bSgjelinek 61370209230bSgjelinek /* 61380209230bSgjelinek * There is always a race condition between reading the initial copy of 61390209230bSgjelinek * a zones state and its state changing. We address this by providing 61400209230bSgjelinek * zonecfg_notify_critical_enter and zonecfg_noticy_critical_exit functions. 61410209230bSgjelinek * When zonecfg_critical_enter is called, sets the state field to LOCKED 61420209230bSgjelinek * and aquires biglock. Biglock protects against other threads executing 61430209230bSgjelinek * critical_enter and the state field protects against state changes during 61440209230bSgjelinek * the critical period. 61450209230bSgjelinek * 61460209230bSgjelinek * If any state changes occur, zn_cb will set the failed field of the znotify 61470209230bSgjelinek * structure. This will cause the critical_exit function to re-lock the 61480209230bSgjelinek * channel and return an error. Since evsnts may be delayed, the critical_exit 61490209230bSgjelinek * function "flushes" the queue by putting an event on the queue and waiting for 61500209230bSgjelinek * zn_cb to notify critical_exit that it received the ping event. 61510209230bSgjelinek */ 61520209230bSgjelinek static const char * 61530209230bSgjelinek string_get_tok(const char *in, char delim, int num) 61540209230bSgjelinek { 61550209230bSgjelinek int i = 0; 61560209230bSgjelinek 61570209230bSgjelinek for (; i < num; in++) { 61580209230bSgjelinek if (*in == delim) 61590209230bSgjelinek i++; 61600209230bSgjelinek if (*in == 0) 61610209230bSgjelinek return (NULL); 61620209230bSgjelinek } 61630209230bSgjelinek return (in); 61640209230bSgjelinek } 61650209230bSgjelinek 61660209230bSgjelinek static boolean_t 61670209230bSgjelinek is_ping(sysevent_t *ev) 61680209230bSgjelinek { 61690209230bSgjelinek if (strcmp(sysevent_get_subclass_name(ev), 61700209230bSgjelinek ZONE_EVENT_PING_SUBCLASS) == 0) { 61710209230bSgjelinek return (B_TRUE); 61720209230bSgjelinek } else { 61730209230bSgjelinek return (B_FALSE); 61740209230bSgjelinek } 61750209230bSgjelinek } 61760209230bSgjelinek 61770209230bSgjelinek static boolean_t 61780209230bSgjelinek is_my_ping(sysevent_t *ev) 61790209230bSgjelinek { 61800209230bSgjelinek const char *sender; 61810209230bSgjelinek char mypid[sizeof (pid_t) * 3 + 1]; 61820209230bSgjelinek 61830209230bSgjelinek (void) snprintf(mypid, sizeof (mypid), "%i", getpid()); 61840209230bSgjelinek sender = string_get_tok(sysevent_get_pub(ev), ':', 3); 61850209230bSgjelinek if (sender == NULL) 61860209230bSgjelinek return (B_FALSE); 61870209230bSgjelinek if (strcmp(sender, mypid) != 0) 61880209230bSgjelinek return (B_FALSE); 61890209230bSgjelinek return (B_TRUE); 61900209230bSgjelinek } 61910209230bSgjelinek 61920209230bSgjelinek static int 61930209230bSgjelinek do_callback(struct znotify *zevtchan, sysevent_t *ev) 61940209230bSgjelinek { 61950209230bSgjelinek nvlist_t *l; 61960209230bSgjelinek int zid; 61970209230bSgjelinek char *zonename; 61980209230bSgjelinek char *newstate; 61990209230bSgjelinek char *oldstate; 62000209230bSgjelinek int ret; 62010209230bSgjelinek hrtime_t when; 62020209230bSgjelinek 62030209230bSgjelinek if (strcmp(sysevent_get_subclass_name(ev), 62040209230bSgjelinek ZONE_EVENT_STATUS_SUBCLASS) == 0) { 62050209230bSgjelinek 62060209230bSgjelinek if (sysevent_get_attr_list(ev, &l) != 0) { 62070209230bSgjelinek if (errno == ENOMEM) { 62080209230bSgjelinek zevtchan->zn_failure_count++; 62090209230bSgjelinek return (EAGAIN); 62100209230bSgjelinek } 62110209230bSgjelinek return (0); 62120209230bSgjelinek } 62130209230bSgjelinek ret = 0; 62140209230bSgjelinek 62150209230bSgjelinek if ((nvlist_lookup_string(l, ZONE_CB_NAME, &zonename) == 0) && 62160209230bSgjelinek (nvlist_lookup_string(l, ZONE_CB_NEWSTATE, &newstate) 62170209230bSgjelinek == 0) && 62180209230bSgjelinek (nvlist_lookup_string(l, ZONE_CB_OLDSTATE, &oldstate) 62190209230bSgjelinek == 0) && 62200209230bSgjelinek (nvlist_lookup_uint64(l, ZONE_CB_TIMESTAMP, 62210209230bSgjelinek (uint64_t *)&when) == 0) && 62220209230bSgjelinek (nvlist_lookup_int32(l, ZONE_CB_ZONEID, &zid) == 0)) { 62230209230bSgjelinek ret = zevtchan->zn_callback(zonename, zid, newstate, 62240209230bSgjelinek oldstate, when, zevtchan->zn_private); 62250209230bSgjelinek } 62260209230bSgjelinek 62270209230bSgjelinek zevtchan->zn_failure_count = 0; 62280209230bSgjelinek nvlist_free(l); 62290209230bSgjelinek return (ret); 62300209230bSgjelinek } else { 62310209230bSgjelinek /* 62320209230bSgjelinek * We have received an event in an unknown subclass. Ignore. 62330209230bSgjelinek */ 62340209230bSgjelinek zevtchan->zn_failure_count = 0; 62350209230bSgjelinek return (0); 62360209230bSgjelinek } 62370209230bSgjelinek } 62380209230bSgjelinek 62390209230bSgjelinek static int 62400209230bSgjelinek zn_cb(sysevent_t *ev, void *p) 62410209230bSgjelinek { 62420209230bSgjelinek struct znotify *zevtchan = p; 62430209230bSgjelinek int error; 62440209230bSgjelinek 62450209230bSgjelinek (void) pthread_mutex_lock(&(zevtchan->zn_mutex)); 62460209230bSgjelinek 62470209230bSgjelinek if (is_ping(ev) && !is_my_ping(ev)) { 62480209230bSgjelinek (void) pthread_mutex_unlock((&zevtchan->zn_mutex)); 62490209230bSgjelinek return (0); 62500209230bSgjelinek } 62510209230bSgjelinek 62520209230bSgjelinek if (zevtchan->zn_state == ZN_LOCKED) { 62530209230bSgjelinek assert(!is_ping(ev)); 62540209230bSgjelinek zevtchan->zn_failed = B_TRUE; 62550209230bSgjelinek (void) pthread_mutex_unlock(&(zevtchan->zn_mutex)); 62560209230bSgjelinek return (0); 62570209230bSgjelinek } 62580209230bSgjelinek 62590209230bSgjelinek if (zevtchan->zn_state == ZN_PING_INFLIGHT) { 62600209230bSgjelinek if (is_ping(ev)) { 62610209230bSgjelinek zevtchan->zn_state = ZN_PING_RECEIVED; 62620209230bSgjelinek (void) pthread_cond_signal(&(zevtchan->zn_cond)); 62630209230bSgjelinek (void) pthread_mutex_unlock(&(zevtchan->zn_mutex)); 62640209230bSgjelinek return (0); 62650209230bSgjelinek } else { 62660209230bSgjelinek zevtchan->zn_failed = B_TRUE; 62670209230bSgjelinek (void) pthread_mutex_unlock(&(zevtchan->zn_mutex)); 62680209230bSgjelinek return (0); 62690209230bSgjelinek } 62700209230bSgjelinek } 62710209230bSgjelinek 62720209230bSgjelinek if (zevtchan->zn_state == ZN_UNLOCKED) { 62730209230bSgjelinek 62740209230bSgjelinek error = do_callback(zevtchan, ev); 62750209230bSgjelinek (void) pthread_mutex_unlock(&(zevtchan->zn_mutex)); 62760209230bSgjelinek /* 62770209230bSgjelinek * Every ENOMEM failure causes do_callback to increment 62780209230bSgjelinek * zn_failure_count and every success causes it to 62790209230bSgjelinek * set zn_failure_count to zero. If we got EAGAIN, 62800209230bSgjelinek * we will sleep for zn_failure_count seconds and return 62810209230bSgjelinek * EAGAIN to gpec to try again. 62820209230bSgjelinek * 62830209230bSgjelinek * After 55 seconds, or 10 try's we give up and drop the 62840209230bSgjelinek * event. 62850209230bSgjelinek */ 62860209230bSgjelinek if (error == EAGAIN) { 62870209230bSgjelinek if (zevtchan->zn_failure_count > ZONE_CB_RETRY_COUNT) { 62880209230bSgjelinek return (0); 62890209230bSgjelinek } 62900209230bSgjelinek (void) sleep(zevtchan->zn_failure_count); 62910209230bSgjelinek } 62920209230bSgjelinek return (error); 62930209230bSgjelinek } 62940209230bSgjelinek 62950209230bSgjelinek if (zevtchan->zn_state == ZN_PING_RECEIVED) { 62960209230bSgjelinek (void) pthread_mutex_unlock(&(zevtchan->zn_mutex)); 62970209230bSgjelinek return (0); 62980209230bSgjelinek } 62990209230bSgjelinek 63000209230bSgjelinek abort(); 63010209230bSgjelinek return (0); 63020209230bSgjelinek } 63030209230bSgjelinek 63040209230bSgjelinek void 63050209230bSgjelinek zonecfg_notify_critical_enter(void *h) 63060209230bSgjelinek { 63070209230bSgjelinek struct znotify *zevtchan = h; 63080209230bSgjelinek 63090209230bSgjelinek (void) pthread_mutex_lock(&(zevtchan->zn_bigmutex)); 63100209230bSgjelinek zevtchan->zn_state = ZN_LOCKED; 63110209230bSgjelinek } 63120209230bSgjelinek 63130209230bSgjelinek int 63140209230bSgjelinek zonecfg_notify_critical_exit(void * h) 63150209230bSgjelinek { 63160209230bSgjelinek 63170209230bSgjelinek struct znotify *zevtchan = h; 63180209230bSgjelinek 63190209230bSgjelinek if (zevtchan->zn_state == ZN_UNLOCKED) 63200209230bSgjelinek return (0); 63210209230bSgjelinek 63220209230bSgjelinek (void) pthread_mutex_lock(&(zevtchan->zn_mutex)); 63230209230bSgjelinek zevtchan->zn_state = ZN_PING_INFLIGHT; 63240209230bSgjelinek 63250209230bSgjelinek (void) sysevent_evc_publish(zevtchan->zn_eventchan, 63260209230bSgjelinek ZONE_EVENT_STATUS_CLASS, 63270209230bSgjelinek ZONE_EVENT_PING_SUBCLASS, ZONE_EVENT_PING_PUBLISHER, 63280209230bSgjelinek zevtchan->zn_subscriber_id, NULL, EVCH_SLEEP); 63290209230bSgjelinek 63300209230bSgjelinek while (zevtchan->zn_state != ZN_PING_RECEIVED) { 63310209230bSgjelinek (void) pthread_cond_wait(&(zevtchan->zn_cond), 63320209230bSgjelinek &(zevtchan->zn_mutex)); 63330209230bSgjelinek } 63340209230bSgjelinek 63350209230bSgjelinek if (zevtchan->zn_failed == B_TRUE) { 63360209230bSgjelinek zevtchan->zn_state = ZN_LOCKED; 63370209230bSgjelinek zevtchan->zn_failed = B_FALSE; 63380209230bSgjelinek (void) pthread_mutex_unlock(&(zevtchan->zn_mutex)); 63390209230bSgjelinek return (1); 63400209230bSgjelinek } 63410209230bSgjelinek 63420209230bSgjelinek zevtchan->zn_state = ZN_UNLOCKED; 63430209230bSgjelinek (void) pthread_mutex_unlock(&(zevtchan->zn_mutex)); 63440209230bSgjelinek (void) pthread_mutex_unlock(&(zevtchan->zn_bigmutex)); 63450209230bSgjelinek return (0); 63467c478bd9Sstevel@tonic-gate } 63477c478bd9Sstevel@tonic-gate 63480209230bSgjelinek void 63490209230bSgjelinek zonecfg_notify_critical_abort(void *h) 63507c478bd9Sstevel@tonic-gate { 63510209230bSgjelinek struct znotify *zevtchan = h; 63520209230bSgjelinek 63530209230bSgjelinek zevtchan->zn_state = ZN_UNLOCKED; 63540209230bSgjelinek zevtchan->zn_failed = B_FALSE; 63550209230bSgjelinek /* 63560209230bSgjelinek * Don't do anything about zn_lock. If it is held, it could only be 63570209230bSgjelinek * held by zn_cb and it will be unlocked soon. 63580209230bSgjelinek */ 63590209230bSgjelinek (void) pthread_mutex_unlock(&(zevtchan->zn_bigmutex)); 63607c478bd9Sstevel@tonic-gate } 63617c478bd9Sstevel@tonic-gate 63620209230bSgjelinek void * 63630209230bSgjelinek zonecfg_notify_bind(int(*func)(const char *zonename, zoneid_t zid, 63640209230bSgjelinek const char *newstate, const char *oldstate, hrtime_t when, void *p), 63650209230bSgjelinek void *p) 63667c478bd9Sstevel@tonic-gate { 63670209230bSgjelinek struct znotify *zevtchan; 63680209230bSgjelinek int i = 1; 63690209230bSgjelinek int r; 63707c478bd9Sstevel@tonic-gate 63710209230bSgjelinek zevtchan = malloc(sizeof (struct znotify)); 63720209230bSgjelinek 63730209230bSgjelinek if (zevtchan == NULL) 63740209230bSgjelinek return (NULL); 63750209230bSgjelinek 63760209230bSgjelinek zevtchan->zn_private = p; 63770209230bSgjelinek zevtchan->zn_callback = func; 63780209230bSgjelinek zevtchan->zn_state = ZN_UNLOCKED; 63790209230bSgjelinek zevtchan->zn_failed = B_FALSE; 63800209230bSgjelinek 63810209230bSgjelinek if (pthread_mutex_init(&(zevtchan->zn_mutex), NULL)) 63820209230bSgjelinek goto out3; 63830209230bSgjelinek if (pthread_cond_init(&(zevtchan->zn_cond), NULL)) { 63840209230bSgjelinek (void) pthread_mutex_destroy(&(zevtchan->zn_mutex)); 63850209230bSgjelinek goto out3; 63860209230bSgjelinek } 63870209230bSgjelinek if (pthread_mutex_init(&(zevtchan->zn_bigmutex), NULL)) { 63880209230bSgjelinek (void) pthread_mutex_destroy(&(zevtchan->zn_mutex)); 63890209230bSgjelinek (void) pthread_cond_destroy(&(zevtchan->zn_cond)); 63900209230bSgjelinek goto out3; 63917c478bd9Sstevel@tonic-gate } 63927c478bd9Sstevel@tonic-gate 63930209230bSgjelinek if (sysevent_evc_bind(ZONE_EVENT_CHANNEL, &(zevtchan->zn_eventchan), 63940209230bSgjelinek 0) != 0) 63950209230bSgjelinek goto out2; 63967c478bd9Sstevel@tonic-gate 63970209230bSgjelinek do { 63980209230bSgjelinek /* 63990209230bSgjelinek * At 4 digits the subscriber ID gets too long and we have 64000209230bSgjelinek * no chance of successfully registering. 64010209230bSgjelinek */ 64020209230bSgjelinek if (i > 999) 64030209230bSgjelinek goto out1; 64040209230bSgjelinek 64050209230bSgjelinek (void) sprintf(zevtchan->zn_subscriber_id, "zone_%li_%i", 64060209230bSgjelinek getpid() % 999999l, i); 64070209230bSgjelinek 64080209230bSgjelinek r = sysevent_evc_subscribe(zevtchan->zn_eventchan, 64090209230bSgjelinek zevtchan->zn_subscriber_id, ZONE_EVENT_STATUS_CLASS, zn_cb, 64100209230bSgjelinek zevtchan, 0); 64110209230bSgjelinek 64120209230bSgjelinek i++; 64130209230bSgjelinek 64140209230bSgjelinek } while (r); 64150209230bSgjelinek 64160209230bSgjelinek return (zevtchan); 64170209230bSgjelinek out1: 641849b225e1SGavin Maltby (void) sysevent_evc_unbind(zevtchan->zn_eventchan); 64190209230bSgjelinek out2: 64200209230bSgjelinek (void) pthread_mutex_destroy(&zevtchan->zn_mutex); 64210209230bSgjelinek (void) pthread_cond_destroy(&zevtchan->zn_cond); 64220209230bSgjelinek (void) pthread_mutex_destroy(&(zevtchan->zn_bigmutex)); 64230209230bSgjelinek out3: 64240209230bSgjelinek free(zevtchan); 64250209230bSgjelinek 64260209230bSgjelinek return (NULL); 64277c478bd9Sstevel@tonic-gate } 64287c478bd9Sstevel@tonic-gate 64290209230bSgjelinek void 64300209230bSgjelinek zonecfg_notify_unbind(void *handle) 64317c478bd9Sstevel@tonic-gate { 64327c478bd9Sstevel@tonic-gate 64330209230bSgjelinek int ret; 64347c478bd9Sstevel@tonic-gate 643549b225e1SGavin Maltby (void) sysevent_evc_unbind(((struct znotify *)handle)->zn_eventchan); 64367c478bd9Sstevel@tonic-gate /* 64370209230bSgjelinek * Check that all evc threads have gone away. This should be 64380209230bSgjelinek * enforced by sysevent_evc_unbind. 64397c478bd9Sstevel@tonic-gate */ 64400209230bSgjelinek ret = pthread_mutex_trylock(&((struct znotify *)handle)->zn_mutex); 64417c478bd9Sstevel@tonic-gate 64420209230bSgjelinek if (ret) 64430209230bSgjelinek abort(); 64447c478bd9Sstevel@tonic-gate 64450209230bSgjelinek (void) pthread_mutex_unlock(&((struct znotify *)handle)->zn_mutex); 64460209230bSgjelinek (void) pthread_mutex_destroy(&((struct znotify *)handle)->zn_mutex); 64470209230bSgjelinek (void) pthread_cond_destroy(&((struct znotify *)handle)->zn_cond); 64480209230bSgjelinek (void) pthread_mutex_destroy(&((struct znotify *)handle)->zn_bigmutex); 64497c478bd9Sstevel@tonic-gate 64500209230bSgjelinek free(handle); 64517c478bd9Sstevel@tonic-gate } 6452fa9e4066Sahrens 64530209230bSgjelinek static int 64540209230bSgjelinek zonecfg_add_ds_core(zone_dochandle_t handle, struct zone_dstab *tabptr) 6455cf8f45c7Sdstaff { 64560209230bSgjelinek xmlNodePtr newnode, cur = handle->zone_dh_cur; 64570209230bSgjelinek int err; 6458cf8f45c7Sdstaff 64590209230bSgjelinek newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_DATASET, NULL); 64600209230bSgjelinek if ((err = newprop(newnode, DTD_ATTR_NAME, 64610209230bSgjelinek tabptr->zone_dataset_name)) != Z_OK) 64620209230bSgjelinek return (err); 64630209230bSgjelinek return (Z_OK); 6464cf8f45c7Sdstaff } 6465cf8f45c7Sdstaff 64660209230bSgjelinek int 64670209230bSgjelinek zonecfg_add_ds(zone_dochandle_t handle, struct zone_dstab *tabptr) 6468cf8f45c7Sdstaff { 64690209230bSgjelinek int err; 64700209230bSgjelinek 64710209230bSgjelinek if (tabptr == NULL) 64720209230bSgjelinek return (Z_INVAL); 64730209230bSgjelinek 64740209230bSgjelinek if ((err = operation_prep(handle)) != Z_OK) 64750209230bSgjelinek return (err); 64760209230bSgjelinek 64770209230bSgjelinek if ((err = zonecfg_add_ds_core(handle, tabptr)) != Z_OK) 64780209230bSgjelinek return (err); 64790209230bSgjelinek 64800209230bSgjelinek return (Z_OK); 64810209230bSgjelinek } 64820209230bSgjelinek 64830209230bSgjelinek static int 64840209230bSgjelinek zonecfg_delete_ds_core(zone_dochandle_t handle, struct zone_dstab *tabptr) 64850209230bSgjelinek { 64860209230bSgjelinek xmlNodePtr cur = handle->zone_dh_cur; 64870209230bSgjelinek 64880209230bSgjelinek for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 64890209230bSgjelinek if (xmlStrcmp(cur->name, DTD_ELEM_DATASET)) 64900209230bSgjelinek continue; 64910209230bSgjelinek 64920209230bSgjelinek if (match_prop(cur, DTD_ATTR_NAME, 64930209230bSgjelinek tabptr->zone_dataset_name)) { 64940209230bSgjelinek xmlUnlinkNode(cur); 64950209230bSgjelinek xmlFreeNode(cur); 64960209230bSgjelinek return (Z_OK); 64970209230bSgjelinek } 6498cf8f45c7Sdstaff } 64990209230bSgjelinek return (Z_NO_RESOURCE_ID); 65000209230bSgjelinek } 65010209230bSgjelinek 65020209230bSgjelinek int 65030209230bSgjelinek zonecfg_delete_ds(zone_dochandle_t handle, struct zone_dstab *tabptr) 65040209230bSgjelinek { 65050209230bSgjelinek int err; 65060209230bSgjelinek 65070209230bSgjelinek if (tabptr == NULL) 65080209230bSgjelinek return (Z_INVAL); 65090209230bSgjelinek 65100209230bSgjelinek if ((err = operation_prep(handle)) != Z_OK) 65110209230bSgjelinek return (err); 65120209230bSgjelinek 65130209230bSgjelinek if ((err = zonecfg_delete_ds_core(handle, tabptr)) != Z_OK) 65140209230bSgjelinek return (err); 65150209230bSgjelinek 65160209230bSgjelinek return (Z_OK); 6517cf8f45c7Sdstaff } 6518cf8f45c7Sdstaff 65190209230bSgjelinek int 65200209230bSgjelinek zonecfg_modify_ds( 65210209230bSgjelinek zone_dochandle_t handle, 65220209230bSgjelinek struct zone_dstab *oldtabptr, 65230209230bSgjelinek struct zone_dstab *newtabptr) 65240209230bSgjelinek { 65250209230bSgjelinek int err; 65260209230bSgjelinek 65270209230bSgjelinek if (oldtabptr == NULL || newtabptr == NULL) 65280209230bSgjelinek return (Z_INVAL); 65290209230bSgjelinek 65300209230bSgjelinek if ((err = operation_prep(handle)) != Z_OK) 65310209230bSgjelinek return (err); 6532cf8f45c7Sdstaff 65330209230bSgjelinek if ((err = zonecfg_delete_ds_core(handle, oldtabptr)) != Z_OK) 65340209230bSgjelinek return (err); 65350209230bSgjelinek 65360209230bSgjelinek if ((err = zonecfg_add_ds_core(handle, newtabptr)) != Z_OK) 65370209230bSgjelinek return (err); 65380209230bSgjelinek 65390209230bSgjelinek return (Z_OK); 6540cf8f45c7Sdstaff } 6541cf8f45c7Sdstaff 65420209230bSgjelinek int 65430209230bSgjelinek zonecfg_lookup_ds(zone_dochandle_t handle, struct zone_dstab *tabptr) 6544cf8f45c7Sdstaff { 65450209230bSgjelinek xmlNodePtr cur, firstmatch; 65460209230bSgjelinek int err; 65470209230bSgjelinek char dataset[MAXNAMELEN]; 6548cf8f45c7Sdstaff 65490209230bSgjelinek if (tabptr == NULL) 65500209230bSgjelinek return (Z_INVAL); 6551cf8f45c7Sdstaff 65520209230bSgjelinek if ((err = operation_prep(handle)) != Z_OK) 65530209230bSgjelinek return (err); 65540209230bSgjelinek 65550209230bSgjelinek cur = handle->zone_dh_cur; 65560209230bSgjelinek firstmatch = NULL; 65570209230bSgjelinek for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 65580209230bSgjelinek if (xmlStrcmp(cur->name, DTD_ELEM_DATASET)) 65590209230bSgjelinek continue; 65600209230bSgjelinek if (strlen(tabptr->zone_dataset_name) > 0) { 65610209230bSgjelinek if ((fetchprop(cur, DTD_ATTR_NAME, dataset, 65620209230bSgjelinek sizeof (dataset)) == Z_OK) && 65630209230bSgjelinek (strcmp(tabptr->zone_dataset_name, 65640209230bSgjelinek dataset) == 0)) { 65650209230bSgjelinek if (firstmatch == NULL) 65660209230bSgjelinek firstmatch = cur; 65670209230bSgjelinek else 65680209230bSgjelinek return (Z_INSUFFICIENT_SPEC); 6569cf8f45c7Sdstaff } 6570cf8f45c7Sdstaff } 65710209230bSgjelinek } 65720209230bSgjelinek if (firstmatch == NULL) 65730209230bSgjelinek return (Z_NO_RESOURCE_ID); 6574cf8f45c7Sdstaff 65750209230bSgjelinek cur = firstmatch; 6576cf8f45c7Sdstaff 65770209230bSgjelinek if ((err = fetchprop(cur, DTD_ATTR_NAME, tabptr->zone_dataset_name, 65780209230bSgjelinek sizeof (tabptr->zone_dataset_name))) != Z_OK) 65790209230bSgjelinek return (err); 65800209230bSgjelinek 65810209230bSgjelinek return (Z_OK); 6582cf8f45c7Sdstaff } 6583cf8f45c7Sdstaff 65840209230bSgjelinek int 65850209230bSgjelinek zonecfg_setdsent(zone_dochandle_t handle) 6586cf8f45c7Sdstaff { 65870209230bSgjelinek return (zonecfg_setent(handle)); 65880209230bSgjelinek } 6589cf8f45c7Sdstaff 65900209230bSgjelinek int 65910209230bSgjelinek zonecfg_getdsent(zone_dochandle_t handle, struct zone_dstab *tabptr) 65920209230bSgjelinek { 65930209230bSgjelinek xmlNodePtr cur; 65940209230bSgjelinek int err; 6595cf8f45c7Sdstaff 65960209230bSgjelinek if (handle == NULL) 65970209230bSgjelinek return (Z_INVAL); 6598cf8f45c7Sdstaff 65990209230bSgjelinek if ((cur = handle->zone_dh_cur) == NULL) 66000209230bSgjelinek return (Z_NO_ENTRY); 6601cf8f45c7Sdstaff 66020209230bSgjelinek for (; cur != NULL; cur = cur->next) 66030209230bSgjelinek if (!xmlStrcmp(cur->name, DTD_ELEM_DATASET)) 66040209230bSgjelinek break; 66050209230bSgjelinek if (cur == NULL) { 66060209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 66070209230bSgjelinek return (Z_NO_ENTRY); 6608cf8f45c7Sdstaff } 6609cf8f45c7Sdstaff 66100209230bSgjelinek if ((err = fetchprop(cur, DTD_ATTR_NAME, tabptr->zone_dataset_name, 66110209230bSgjelinek sizeof (tabptr->zone_dataset_name))) != Z_OK) { 66120209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 66130209230bSgjelinek return (err); 6614cf8f45c7Sdstaff } 6615cf8f45c7Sdstaff 66160209230bSgjelinek handle->zone_dh_cur = cur->next; 66170209230bSgjelinek return (Z_OK); 6618cf8f45c7Sdstaff } 6619cf8f45c7Sdstaff 66200209230bSgjelinek int 66210209230bSgjelinek zonecfg_enddsent(zone_dochandle_t handle) 6622cf8f45c7Sdstaff { 66230209230bSgjelinek return (zonecfg_endent(handle)); 6624cf8f45c7Sdstaff } 6625cf8f45c7Sdstaff 66260209230bSgjelinek /* 66270209230bSgjelinek * Support for aliased rctls; that is, rctls that have simplified names in 66280209230bSgjelinek * zonecfg. For example, max-lwps is an alias for a well defined zone.max-lwps 66290209230bSgjelinek * rctl. If there are multiple existing values for one of these rctls or if 66300209230bSgjelinek * there is a single value that does not match the well defined template (i.e. 66310209230bSgjelinek * it has a different action) then we cannot treat the rctl as having an alias 66320209230bSgjelinek * so we return Z_ALIAS_DISALLOW. That means that the rctl cannot be 66330209230bSgjelinek * managed in zonecfg via an alias and that the standard rctl syntax must be 66340209230bSgjelinek * used. 66350209230bSgjelinek * 66360209230bSgjelinek * The possible return values are: 66370209230bSgjelinek * Z_NO_PROPERTY_ID - invalid alias name 66380209230bSgjelinek * Z_ALIAS_DISALLOW - pre-existing, incompatible rctl definition 66390209230bSgjelinek * Z_NO_ENTRY - no rctl is configured for this alias 66400209230bSgjelinek * Z_OK - we got a valid rctl for the specified alias 66410209230bSgjelinek */ 6642cf8f45c7Sdstaff int 66430209230bSgjelinek zonecfg_get_aliased_rctl(zone_dochandle_t handle, char *name, uint64_t *rval) 6644cf8f45c7Sdstaff { 66450209230bSgjelinek boolean_t found = B_FALSE; 66460209230bSgjelinek boolean_t found_val = B_FALSE; 66470209230bSgjelinek xmlNodePtr cur, val; 66480209230bSgjelinek char savedname[MAXNAMELEN]; 66490209230bSgjelinek struct zone_rctlvaltab rctl; 66500209230bSgjelinek int i; 66510209230bSgjelinek int err; 6652cf8f45c7Sdstaff 66530209230bSgjelinek for (i = 0; aliases[i].shortname != NULL; i++) 66540209230bSgjelinek if (strcmp(name, aliases[i].shortname) == 0) 66550209230bSgjelinek break; 6656cf8f45c7Sdstaff 66570209230bSgjelinek if (aliases[i].shortname == NULL) 66580209230bSgjelinek return (Z_NO_PROPERTY_ID); 6659cf8f45c7Sdstaff 66600209230bSgjelinek if ((err = operation_prep(handle)) != Z_OK) 66610209230bSgjelinek return (err); 6662cf8f45c7Sdstaff 66630209230bSgjelinek cur = handle->zone_dh_cur; 66640209230bSgjelinek for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 66650209230bSgjelinek if (xmlStrcmp(cur->name, DTD_ELEM_RCTL) != 0) 66660209230bSgjelinek continue; 66670209230bSgjelinek if ((fetchprop(cur, DTD_ATTR_NAME, savedname, 66680209230bSgjelinek sizeof (savedname)) == Z_OK) && 66690209230bSgjelinek (strcmp(savedname, aliases[i].realname) == 0)) { 6670cf8f45c7Sdstaff 66710209230bSgjelinek /* 66720209230bSgjelinek * If we already saw one of these, we can't have an 66730209230bSgjelinek * alias since we just found another. 66740209230bSgjelinek */ 66750209230bSgjelinek if (found) 66760209230bSgjelinek return (Z_ALIAS_DISALLOW); 66770209230bSgjelinek found = B_TRUE; 66780209230bSgjelinek 66790209230bSgjelinek for (val = cur->xmlChildrenNode; val != NULL; 66800209230bSgjelinek val = val->next) { 66810209230bSgjelinek /* 66820209230bSgjelinek * If we already have one value, we can't have 66830209230bSgjelinek * an alias since we just found another. 66840209230bSgjelinek */ 66850209230bSgjelinek if (found_val) 66860209230bSgjelinek return (Z_ALIAS_DISALLOW); 66870209230bSgjelinek found_val = B_TRUE; 66880209230bSgjelinek 66890209230bSgjelinek if ((fetchprop(val, DTD_ATTR_PRIV, 66900209230bSgjelinek rctl.zone_rctlval_priv, 66910209230bSgjelinek sizeof (rctl.zone_rctlval_priv)) != Z_OK)) 66920209230bSgjelinek break; 66930209230bSgjelinek if ((fetchprop(val, DTD_ATTR_LIMIT, 66940209230bSgjelinek rctl.zone_rctlval_limit, 66950209230bSgjelinek sizeof (rctl.zone_rctlval_limit)) != Z_OK)) 66960209230bSgjelinek break; 66970209230bSgjelinek if ((fetchprop(val, DTD_ATTR_ACTION, 66980209230bSgjelinek rctl.zone_rctlval_action, 66990209230bSgjelinek sizeof (rctl.zone_rctlval_action)) != Z_OK)) 67000209230bSgjelinek break; 67010209230bSgjelinek } 67020209230bSgjelinek 67030209230bSgjelinek /* check priv and action match the expected vals */ 67040209230bSgjelinek if (strcmp(rctl.zone_rctlval_priv, 67050209230bSgjelinek aliases[i].priv) != 0 || 67060209230bSgjelinek strcmp(rctl.zone_rctlval_action, 67070209230bSgjelinek aliases[i].action) != 0) 67080209230bSgjelinek return (Z_ALIAS_DISALLOW); 67090209230bSgjelinek } 6710cf8f45c7Sdstaff } 6711cf8f45c7Sdstaff 67120209230bSgjelinek if (found) { 67130209230bSgjelinek *rval = strtoull(rctl.zone_rctlval_limit, NULL, 10); 67140209230bSgjelinek return (Z_OK); 6715cf8f45c7Sdstaff } 6716cf8f45c7Sdstaff 67170209230bSgjelinek return (Z_NO_ENTRY); 6718cf8f45c7Sdstaff } 6719cf8f45c7Sdstaff 67200209230bSgjelinek int 67210209230bSgjelinek zonecfg_rm_aliased_rctl(zone_dochandle_t handle, char *name) 6722cf8f45c7Sdstaff { 67230209230bSgjelinek int i; 67240209230bSgjelinek uint64_t val; 67250209230bSgjelinek struct zone_rctltab rctltab; 6726cf8f45c7Sdstaff 6727cf8f45c7Sdstaff /* 67280209230bSgjelinek * First check that we have a valid aliased rctl to remove. 67290209230bSgjelinek * This will catch an rctl entry with non-standard values or 67300209230bSgjelinek * multiple rctl values for this name. We need to ignore those 67310209230bSgjelinek * rctl entries. 6732cf8f45c7Sdstaff */ 67330209230bSgjelinek if (zonecfg_get_aliased_rctl(handle, name, &val) != Z_OK) 67340209230bSgjelinek return (Z_OK); 67350209230bSgjelinek 67360209230bSgjelinek for (i = 0; aliases[i].shortname != NULL; i++) 67370209230bSgjelinek if (strcmp(name, aliases[i].shortname) == 0) 67380209230bSgjelinek break; 67390209230bSgjelinek 67400209230bSgjelinek if (aliases[i].shortname == NULL) 67410209230bSgjelinek return (Z_NO_RESOURCE_ID); 67420209230bSgjelinek 67430209230bSgjelinek (void) strlcpy(rctltab.zone_rctl_name, aliases[i].realname, 67440209230bSgjelinek sizeof (rctltab.zone_rctl_name)); 67450209230bSgjelinek 67460209230bSgjelinek return (zonecfg_delete_rctl(handle, &rctltab)); 67470209230bSgjelinek } 67480209230bSgjelinek 67490209230bSgjelinek boolean_t 67500209230bSgjelinek zonecfg_aliased_rctl_ok(zone_dochandle_t handle, char *name) 67510209230bSgjelinek { 67520209230bSgjelinek uint64_t tmp_val; 67530209230bSgjelinek 67540209230bSgjelinek switch (zonecfg_get_aliased_rctl(handle, name, &tmp_val)) { 67550209230bSgjelinek case Z_OK: 67560209230bSgjelinek /*FALLTHRU*/ 67570209230bSgjelinek case Z_NO_ENTRY: 67580209230bSgjelinek return (B_TRUE); 67590209230bSgjelinek default: 67600209230bSgjelinek return (B_FALSE); 67610209230bSgjelinek } 6762cf8f45c7Sdstaff } 6763cf8f45c7Sdstaff 67640209230bSgjelinek int 67650209230bSgjelinek zonecfg_set_aliased_rctl(zone_dochandle_t handle, char *name, uint64_t val) 6766cf8f45c7Sdstaff { 67670209230bSgjelinek int i; 67680209230bSgjelinek int err; 67690209230bSgjelinek struct zone_rctltab rctltab; 67700209230bSgjelinek struct zone_rctlvaltab *rctlvaltab; 67710209230bSgjelinek char buf[128]; 6772cf8f45c7Sdstaff 67730209230bSgjelinek if (!zonecfg_aliased_rctl_ok(handle, name)) 67740209230bSgjelinek return (Z_ALIAS_DISALLOW); 6775cf8f45c7Sdstaff 67760209230bSgjelinek for (i = 0; aliases[i].shortname != NULL; i++) 67770209230bSgjelinek if (strcmp(name, aliases[i].shortname) == 0) 67780209230bSgjelinek break; 6779cf8f45c7Sdstaff 67800209230bSgjelinek if (aliases[i].shortname == NULL) 67810209230bSgjelinek return (Z_NO_RESOURCE_ID); 6782cf8f45c7Sdstaff 67830209230bSgjelinek /* remove any pre-existing definition for this rctl */ 67840209230bSgjelinek (void) zonecfg_rm_aliased_rctl(handle, name); 6785cf8f45c7Sdstaff 67860209230bSgjelinek (void) strlcpy(rctltab.zone_rctl_name, aliases[i].realname, 67870209230bSgjelinek sizeof (rctltab.zone_rctl_name)); 6788cf8f45c7Sdstaff 67890209230bSgjelinek rctltab.zone_rctl_valptr = NULL; 6790cf8f45c7Sdstaff 67910209230bSgjelinek if ((rctlvaltab = calloc(1, sizeof (struct zone_rctlvaltab))) == NULL) 67920209230bSgjelinek return (Z_NOMEM); 6793cf8f45c7Sdstaff 67940209230bSgjelinek (void) snprintf(buf, sizeof (buf), "%llu", (long long)val); 6795cf8f45c7Sdstaff 67960209230bSgjelinek (void) strlcpy(rctlvaltab->zone_rctlval_priv, aliases[i].priv, 67970209230bSgjelinek sizeof (rctlvaltab->zone_rctlval_priv)); 67980209230bSgjelinek (void) strlcpy(rctlvaltab->zone_rctlval_limit, buf, 67990209230bSgjelinek sizeof (rctlvaltab->zone_rctlval_limit)); 68000209230bSgjelinek (void) strlcpy(rctlvaltab->zone_rctlval_action, aliases[i].action, 68010209230bSgjelinek sizeof (rctlvaltab->zone_rctlval_action)); 6802cf8f45c7Sdstaff 68030209230bSgjelinek rctlvaltab->zone_rctlval_next = NULL; 6804cf8f45c7Sdstaff 68050209230bSgjelinek if ((err = zonecfg_add_rctl_value(&rctltab, rctlvaltab)) != Z_OK) 68060209230bSgjelinek return (err); 6807cf8f45c7Sdstaff 68080209230bSgjelinek return (zonecfg_add_rctl(handle, &rctltab)); 6809cf8f45c7Sdstaff } 6810cf8f45c7Sdstaff 68110209230bSgjelinek static int 68120209230bSgjelinek delete_tmp_pool(zone_dochandle_t handle) 6813cf8f45c7Sdstaff { 68140209230bSgjelinek int err; 68150209230bSgjelinek xmlNodePtr cur = handle->zone_dh_cur; 6816cf8f45c7Sdstaff 68170209230bSgjelinek if ((err = operation_prep(handle)) != Z_OK) 68180209230bSgjelinek return (err); 6819cf8f45c7Sdstaff 68200209230bSgjelinek for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 68210209230bSgjelinek if (xmlStrcmp(cur->name, DTD_ELEM_TMPPOOL) == 0) { 68220209230bSgjelinek xmlUnlinkNode(cur); 68230209230bSgjelinek xmlFreeNode(cur); 68240209230bSgjelinek return (Z_OK); 68250209230bSgjelinek } 68260209230bSgjelinek } 6827cf8f45c7Sdstaff 68280209230bSgjelinek return (Z_NO_RESOURCE_ID); 68290209230bSgjelinek } 6830cf8f45c7Sdstaff 68310209230bSgjelinek static int 68320209230bSgjelinek modify_tmp_pool(zone_dochandle_t handle, char *pool_importance) 68330209230bSgjelinek { 68340209230bSgjelinek int err; 68350209230bSgjelinek xmlNodePtr cur = handle->zone_dh_cur; 68360209230bSgjelinek xmlNodePtr newnode; 6837cf8f45c7Sdstaff 68380209230bSgjelinek err = delete_tmp_pool(handle); 68390209230bSgjelinek if (err != Z_OK && err != Z_NO_RESOURCE_ID) 68400209230bSgjelinek return (err); 68410209230bSgjelinek 68420209230bSgjelinek if (*pool_importance != '\0') { 68430209230bSgjelinek if ((err = operation_prep(handle)) != Z_OK) 68440209230bSgjelinek return (err); 68450209230bSgjelinek 68460209230bSgjelinek newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_TMPPOOL, NULL); 68470209230bSgjelinek if ((err = newprop(newnode, DTD_ATTR_IMPORTANCE, 68480209230bSgjelinek pool_importance)) != Z_OK) 68490209230bSgjelinek return (err); 68500209230bSgjelinek } 68510209230bSgjelinek 68520209230bSgjelinek return (Z_OK); 6853cf8f45c7Sdstaff } 6854cf8f45c7Sdstaff 6855fa9e4066Sahrens static int 68560209230bSgjelinek add_pset_core(zone_dochandle_t handle, struct zone_psettab *tabptr) 6857fa9e4066Sahrens { 6858fa9e4066Sahrens xmlNodePtr newnode, cur = handle->zone_dh_cur; 6859fa9e4066Sahrens int err; 6860fa9e4066Sahrens 68610209230bSgjelinek newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_PSET, NULL); 68620209230bSgjelinek if ((err = newprop(newnode, DTD_ATTR_NCPU_MIN, 68630209230bSgjelinek tabptr->zone_ncpu_min)) != Z_OK) 68640209230bSgjelinek return (err); 68650209230bSgjelinek if ((err = newprop(newnode, DTD_ATTR_NCPU_MAX, 68660209230bSgjelinek tabptr->zone_ncpu_max)) != Z_OK) 68670209230bSgjelinek return (err); 68680209230bSgjelinek 68690209230bSgjelinek if ((err = modify_tmp_pool(handle, tabptr->zone_importance)) != Z_OK) 6870fa9e4066Sahrens return (err); 68710209230bSgjelinek 6872fa9e4066Sahrens return (Z_OK); 6873fa9e4066Sahrens } 6874fa9e4066Sahrens 6875fa9e4066Sahrens int 68760209230bSgjelinek zonecfg_add_pset(zone_dochandle_t handle, struct zone_psettab *tabptr) 6877fa9e4066Sahrens { 6878fa9e4066Sahrens int err; 6879fa9e4066Sahrens 6880fa9e4066Sahrens if (tabptr == NULL) 6881fa9e4066Sahrens return (Z_INVAL); 6882fa9e4066Sahrens 6883fa9e4066Sahrens if ((err = operation_prep(handle)) != Z_OK) 6884fa9e4066Sahrens return (err); 6885fa9e4066Sahrens 68860209230bSgjelinek if ((err = add_pset_core(handle, tabptr)) != Z_OK) 6887fa9e4066Sahrens return (err); 6888fa9e4066Sahrens 6889fa9e4066Sahrens return (Z_OK); 6890fa9e4066Sahrens } 6891fa9e4066Sahrens 68920209230bSgjelinek int 68930209230bSgjelinek zonecfg_delete_pset(zone_dochandle_t handle) 6894fa9e4066Sahrens { 68950209230bSgjelinek int err; 68960209230bSgjelinek int res = Z_NO_RESOURCE_ID; 6897fa9e4066Sahrens xmlNodePtr cur = handle->zone_dh_cur; 6898fa9e4066Sahrens 68990209230bSgjelinek if ((err = operation_prep(handle)) != Z_OK) 69000209230bSgjelinek return (err); 6901fa9e4066Sahrens 69020209230bSgjelinek for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 69030209230bSgjelinek if (xmlStrcmp(cur->name, DTD_ELEM_PSET) == 0) { 6904fa9e4066Sahrens xmlUnlinkNode(cur); 6905fa9e4066Sahrens xmlFreeNode(cur); 69060209230bSgjelinek res = Z_OK; 69070209230bSgjelinek break; 6908fa9e4066Sahrens } 6909fa9e4066Sahrens } 69100209230bSgjelinek 69110209230bSgjelinek /* 69120209230bSgjelinek * Once we have msets, we should check that a mset 69130209230bSgjelinek * do not exist before we delete the tmp_pool data. 69140209230bSgjelinek */ 69150209230bSgjelinek err = delete_tmp_pool(handle); 69160209230bSgjelinek if (err != Z_OK && err != Z_NO_RESOURCE_ID) 69170209230bSgjelinek return (err); 69180209230bSgjelinek 69190209230bSgjelinek return (res); 6920fa9e4066Sahrens } 6921fa9e4066Sahrens 6922fa9e4066Sahrens int 69230209230bSgjelinek zonecfg_modify_pset(zone_dochandle_t handle, struct zone_psettab *tabptr) 6924fa9e4066Sahrens { 6925fa9e4066Sahrens int err; 6926fa9e4066Sahrens 6927fa9e4066Sahrens if (tabptr == NULL) 6928fa9e4066Sahrens return (Z_INVAL); 6929fa9e4066Sahrens 69300209230bSgjelinek if ((err = zonecfg_delete_pset(handle)) != Z_OK) 6931fa9e4066Sahrens return (err); 6932fa9e4066Sahrens 69330209230bSgjelinek if ((err = add_pset_core(handle, tabptr)) != Z_OK) 6934fa9e4066Sahrens return (err); 6935fa9e4066Sahrens 6936fa9e4066Sahrens return (Z_OK); 6937fa9e4066Sahrens } 6938fa9e4066Sahrens 6939fa9e4066Sahrens int 69400209230bSgjelinek zonecfg_lookup_pset(zone_dochandle_t handle, struct zone_psettab *tabptr) 6941fa9e4066Sahrens { 69420209230bSgjelinek xmlNodePtr cur; 6943fa9e4066Sahrens int err; 69440209230bSgjelinek int res = Z_NO_ENTRY; 6945fa9e4066Sahrens 69460209230bSgjelinek if (tabptr == NULL) 6947fa9e4066Sahrens return (Z_INVAL); 6948fa9e4066Sahrens 6949fa9e4066Sahrens if ((err = operation_prep(handle)) != Z_OK) 6950fa9e4066Sahrens return (err); 6951fa9e4066Sahrens 69520209230bSgjelinek /* this is an optional component */ 69530209230bSgjelinek tabptr->zone_importance[0] = '\0'; 69540209230bSgjelinek 69550209230bSgjelinek cur = handle->zone_dh_cur; 69560209230bSgjelinek for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 69570209230bSgjelinek if (xmlStrcmp(cur->name, DTD_ELEM_PSET) == 0) { 69580209230bSgjelinek if ((err = fetchprop(cur, DTD_ATTR_NCPU_MIN, 69590209230bSgjelinek tabptr->zone_ncpu_min, 69600209230bSgjelinek sizeof (tabptr->zone_ncpu_min))) != Z_OK) { 69610209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 69620209230bSgjelinek return (err); 69630209230bSgjelinek } 69640209230bSgjelinek 69650209230bSgjelinek if ((err = fetchprop(cur, DTD_ATTR_NCPU_MAX, 69660209230bSgjelinek tabptr->zone_ncpu_max, 69670209230bSgjelinek sizeof (tabptr->zone_ncpu_max))) != Z_OK) { 69680209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 69690209230bSgjelinek return (err); 69700209230bSgjelinek } 69710209230bSgjelinek 69720209230bSgjelinek res = Z_OK; 69730209230bSgjelinek 69740209230bSgjelinek } else if (xmlStrcmp(cur->name, DTD_ELEM_TMPPOOL) == 0) { 69750209230bSgjelinek if ((err = fetchprop(cur, DTD_ATTR_IMPORTANCE, 69760209230bSgjelinek tabptr->zone_importance, 69770209230bSgjelinek sizeof (tabptr->zone_importance))) != Z_OK) { 69780209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 69790209230bSgjelinek return (err); 69800209230bSgjelinek } 69810209230bSgjelinek } 69820209230bSgjelinek } 69830209230bSgjelinek 69840209230bSgjelinek return (res); 69850209230bSgjelinek } 69860209230bSgjelinek 69870209230bSgjelinek int 69880209230bSgjelinek zonecfg_getpsetent(zone_dochandle_t handle, struct zone_psettab *tabptr) 69890209230bSgjelinek { 69900209230bSgjelinek int err; 69910209230bSgjelinek 69920209230bSgjelinek if ((err = zonecfg_setent(handle)) != Z_OK) 6993fa9e4066Sahrens return (err); 6994fa9e4066Sahrens 69950209230bSgjelinek err = zonecfg_lookup_pset(handle, tabptr); 69960209230bSgjelinek 69970209230bSgjelinek (void) zonecfg_endent(handle); 69980209230bSgjelinek 69990209230bSgjelinek return (err); 70000209230bSgjelinek } 70010209230bSgjelinek 70020209230bSgjelinek static int 70030209230bSgjelinek add_mcap(zone_dochandle_t handle, struct zone_mcaptab *tabptr) 70040209230bSgjelinek { 70050209230bSgjelinek xmlNodePtr newnode, cur = handle->zone_dh_cur; 70060209230bSgjelinek int err; 70070209230bSgjelinek 70080209230bSgjelinek newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_MCAP, NULL); 70090209230bSgjelinek if ((err = newprop(newnode, DTD_ATTR_PHYSCAP, tabptr->zone_physmem_cap)) 70100209230bSgjelinek != Z_OK) 7011fa9e4066Sahrens return (err); 7012fa9e4066Sahrens 7013fa9e4066Sahrens return (Z_OK); 7014fa9e4066Sahrens } 7015fa9e4066Sahrens 7016fa9e4066Sahrens int 70170209230bSgjelinek zonecfg_delete_mcap(zone_dochandle_t handle) 7018fa9e4066Sahrens { 7019fa9e4066Sahrens int err; 70200209230bSgjelinek xmlNodePtr cur = handle->zone_dh_cur; 7021fa9e4066Sahrens 7022fa9e4066Sahrens if ((err = operation_prep(handle)) != Z_OK) 7023fa9e4066Sahrens return (err); 7024fa9e4066Sahrens 7025fa9e4066Sahrens for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 70260209230bSgjelinek if (xmlStrcmp(cur->name, DTD_ELEM_MCAP) != 0) 7027fa9e4066Sahrens continue; 70280209230bSgjelinek 70290209230bSgjelinek xmlUnlinkNode(cur); 70300209230bSgjelinek xmlFreeNode(cur); 70310209230bSgjelinek return (Z_OK); 7032fa9e4066Sahrens } 70330209230bSgjelinek return (Z_NO_RESOURCE_ID); 70340209230bSgjelinek } 7035fa9e4066Sahrens 70360209230bSgjelinek int 70370209230bSgjelinek zonecfg_modify_mcap(zone_dochandle_t handle, struct zone_mcaptab *tabptr) 70380209230bSgjelinek { 70390209230bSgjelinek int err; 7040fa9e4066Sahrens 70410209230bSgjelinek if (tabptr == NULL) 70420209230bSgjelinek return (Z_INVAL); 70430209230bSgjelinek 70440209230bSgjelinek err = zonecfg_delete_mcap(handle); 70450209230bSgjelinek /* it is ok if there is no mcap entry */ 70460209230bSgjelinek if (err != Z_OK && err != Z_NO_RESOURCE_ID) 70470209230bSgjelinek return (err); 70480209230bSgjelinek 70490209230bSgjelinek if ((err = add_mcap(handle, tabptr)) != Z_OK) 7050fa9e4066Sahrens return (err); 7051fa9e4066Sahrens 7052fa9e4066Sahrens return (Z_OK); 7053fa9e4066Sahrens } 7054fa9e4066Sahrens 7055fa9e4066Sahrens int 70560209230bSgjelinek zonecfg_lookup_mcap(zone_dochandle_t handle, struct zone_mcaptab *tabptr) 7057fa9e4066Sahrens { 70580209230bSgjelinek xmlNodePtr cur; 70590209230bSgjelinek int err; 70600209230bSgjelinek 70610209230bSgjelinek if (tabptr == NULL) 70620209230bSgjelinek return (Z_INVAL); 70630209230bSgjelinek 70640209230bSgjelinek if ((err = operation_prep(handle)) != Z_OK) 70650209230bSgjelinek return (err); 70660209230bSgjelinek 70670209230bSgjelinek cur = handle->zone_dh_cur; 70680209230bSgjelinek for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 70690209230bSgjelinek if (xmlStrcmp(cur->name, DTD_ELEM_MCAP) != 0) 70700209230bSgjelinek continue; 70710209230bSgjelinek if ((err = fetchprop(cur, DTD_ATTR_PHYSCAP, 70720209230bSgjelinek tabptr->zone_physmem_cap, 70730209230bSgjelinek sizeof (tabptr->zone_physmem_cap))) != Z_OK) { 70740209230bSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 70750209230bSgjelinek return (err); 70760209230bSgjelinek } 70770209230bSgjelinek 70780209230bSgjelinek return (Z_OK); 70790209230bSgjelinek } 70800209230bSgjelinek 70810209230bSgjelinek return (Z_NO_ENTRY); 7082fa9e4066Sahrens } 7083fa9e4066Sahrens 7084*d2a70789SRichard Lowe int 7085*d2a70789SRichard Lowe zonecfg_getsecflagsent(zone_dochandle_t handle, 7086*d2a70789SRichard Lowe struct zone_secflagstab *tabptr) 7087*d2a70789SRichard Lowe { 7088*d2a70789SRichard Lowe int err; 7089*d2a70789SRichard Lowe xmlNodePtr cur; 7090*d2a70789SRichard Lowe 7091*d2a70789SRichard Lowe if (handle == NULL) 7092*d2a70789SRichard Lowe return (Z_INVAL); 7093*d2a70789SRichard Lowe 7094*d2a70789SRichard Lowe if ((err = zonecfg_setent(handle)) != Z_OK) 7095*d2a70789SRichard Lowe return (err); 7096*d2a70789SRichard Lowe 7097*d2a70789SRichard Lowe 7098*d2a70789SRichard Lowe if ((cur = handle->zone_dh_cur) == NULL) 7099*d2a70789SRichard Lowe return (Z_NO_ENTRY); 7100*d2a70789SRichard Lowe 7101*d2a70789SRichard Lowe for (; cur != NULL; cur = cur->next) { 7102*d2a70789SRichard Lowe if (xmlStrcmp(cur->name, DTD_ELEM_SECFLAGS) == 0) 7103*d2a70789SRichard Lowe break; 7104*d2a70789SRichard Lowe } 7105*d2a70789SRichard Lowe 7106*d2a70789SRichard Lowe if (cur == NULL) { 7107*d2a70789SRichard Lowe handle->zone_dh_cur = handle->zone_dh_top; 7108*d2a70789SRichard Lowe return (Z_NO_ENTRY); 7109*d2a70789SRichard Lowe } 7110*d2a70789SRichard Lowe 7111*d2a70789SRichard Lowe if ((err = fetchprop(cur, DTD_ATTR_DEFAULT, 7112*d2a70789SRichard Lowe tabptr->zone_secflags_default, 7113*d2a70789SRichard Lowe sizeof (tabptr->zone_secflags_default))) != Z_OK) { 7114*d2a70789SRichard Lowe handle->zone_dh_cur = handle->zone_dh_top; 7115*d2a70789SRichard Lowe return (err); 7116*d2a70789SRichard Lowe } 7117*d2a70789SRichard Lowe 7118*d2a70789SRichard Lowe if ((err = fetchprop(cur, DTD_ATTR_LOWER, 7119*d2a70789SRichard Lowe tabptr->zone_secflags_lower, 7120*d2a70789SRichard Lowe sizeof (tabptr->zone_secflags_lower))) != Z_OK) { 7121*d2a70789SRichard Lowe handle->zone_dh_cur = handle->zone_dh_top; 7122*d2a70789SRichard Lowe return (err); 7123*d2a70789SRichard Lowe } 7124*d2a70789SRichard Lowe 7125*d2a70789SRichard Lowe if ((err = fetchprop(cur, DTD_ATTR_UPPER, 7126*d2a70789SRichard Lowe tabptr->zone_secflags_upper, 7127*d2a70789SRichard Lowe sizeof (tabptr->zone_secflags_upper))) != Z_OK) { 7128*d2a70789SRichard Lowe handle->zone_dh_cur = handle->zone_dh_top; 7129*d2a70789SRichard Lowe return (err); 7130*d2a70789SRichard Lowe } 7131*d2a70789SRichard Lowe 7132*d2a70789SRichard Lowe handle->zone_dh_cur = cur->next; 7133*d2a70789SRichard Lowe 7134*d2a70789SRichard Lowe (void) zonecfg_endent(handle); 7135*d2a70789SRichard Lowe 7136*d2a70789SRichard Lowe return (err); 7137*d2a70789SRichard Lowe } 7138*d2a70789SRichard Lowe 71390209230bSgjelinek static int 71400209230bSgjelinek getmcapent_core(zone_dochandle_t handle, struct zone_mcaptab *tabptr) 7141fa9e4066Sahrens { 7142fa9e4066Sahrens xmlNodePtr cur; 7143fa9e4066Sahrens int err; 7144fa9e4066Sahrens 7145fa9e4066Sahrens if (handle == NULL) 7146fa9e4066Sahrens return (Z_INVAL); 7147fa9e4066Sahrens 7148fa9e4066Sahrens if ((cur = handle->zone_dh_cur) == NULL) 7149fa9e4066Sahrens return (Z_NO_ENTRY); 7150fa9e4066Sahrens 7151fa9e4066Sahrens for (; cur != NULL; cur = cur->next) 71520209230bSgjelinek if (xmlStrcmp(cur->name, DTD_ELEM_MCAP) == 0) 7153fa9e4066Sahrens break; 7154fa9e4066Sahrens if (cur == NULL) { 7155fa9e4066Sahrens handle->zone_dh_cur = handle->zone_dh_top; 7156fa9e4066Sahrens return (Z_NO_ENTRY); 7157fa9e4066Sahrens } 7158fa9e4066Sahrens 71590209230bSgjelinek if ((err = fetchprop(cur, DTD_ATTR_PHYSCAP, tabptr->zone_physmem_cap, 71600209230bSgjelinek sizeof (tabptr->zone_physmem_cap))) != Z_OK) { 7161fa9e4066Sahrens handle->zone_dh_cur = handle->zone_dh_top; 7162fa9e4066Sahrens return (err); 7163fa9e4066Sahrens } 7164fa9e4066Sahrens 7165fa9e4066Sahrens handle->zone_dh_cur = cur->next; 7166fa9e4066Sahrens return (Z_OK); 7167fa9e4066Sahrens } 7168fa9e4066Sahrens 7169fa9e4066Sahrens int 71700209230bSgjelinek zonecfg_getmcapent(zone_dochandle_t handle, struct zone_mcaptab *tabptr) 7171fa9e4066Sahrens { 71720209230bSgjelinek int err; 71730209230bSgjelinek 71740209230bSgjelinek if ((err = zonecfg_setent(handle)) != Z_OK) 71750209230bSgjelinek return (err); 71760209230bSgjelinek 71770209230bSgjelinek err = getmcapent_core(handle, tabptr); 71780209230bSgjelinek 71790209230bSgjelinek (void) zonecfg_endent(handle); 71800209230bSgjelinek 71810209230bSgjelinek return (err); 7182fa9e4066Sahrens } 7183ee519a1fSgjelinek 71846cfd72c6Sgjelinek /* 71854656d474SGarrett D'Amore * Get the full tree of pkg metadata in a set of nested AVL trees. 71864656d474SGarrett D'Amore * pkgs_avl is an AVL tree of pkgs. 71876cfd72c6Sgjelinek * 71884656d474SGarrett D'Amore * The zone xml data contains DTD_ELEM_PACKAGE elements. 71896cfd72c6Sgjelinek */ 7190ee519a1fSgjelinek int 71916cfd72c6Sgjelinek zonecfg_getpkgdata(zone_dochandle_t handle, uu_avl_pool_t *pkg_pool, 71926cfd72c6Sgjelinek uu_avl_t *pkgs_avl) 7193ee519a1fSgjelinek { 7194ee519a1fSgjelinek xmlNodePtr cur; 71956cfd72c6Sgjelinek int res; 71966cfd72c6Sgjelinek zone_pkg_entry_t *pkg; 71976cfd72c6Sgjelinek char name[MAXNAMELEN]; 71986cfd72c6Sgjelinek char version[ZONE_PKG_VERSMAX]; 7199ee519a1fSgjelinek 7200ee519a1fSgjelinek if (handle == NULL) 7201ee519a1fSgjelinek return (Z_INVAL); 7202ee519a1fSgjelinek 72036cfd72c6Sgjelinek if ((res = zonecfg_setent(handle)) != Z_OK) 72046cfd72c6Sgjelinek return (res); 7205ee519a1fSgjelinek 72066cfd72c6Sgjelinek if ((cur = handle->zone_dh_cur) == NULL) { 72076cfd72c6Sgjelinek res = Z_NO_ENTRY; 72086cfd72c6Sgjelinek goto done; 7209ee519a1fSgjelinek } 7210ee519a1fSgjelinek 72116cfd72c6Sgjelinek for (; cur != NULL; cur = cur->next) { 72126cfd72c6Sgjelinek if (xmlStrcmp(cur->name, DTD_ELEM_PACKAGE) == 0) { 72136cfd72c6Sgjelinek uu_avl_index_t where; 7214ee519a1fSgjelinek 72156cfd72c6Sgjelinek if ((res = fetchprop(cur, DTD_ATTR_NAME, name, 72166cfd72c6Sgjelinek sizeof (name))) != Z_OK) 72176cfd72c6Sgjelinek goto done; 7218ee519a1fSgjelinek 72196cfd72c6Sgjelinek if ((res = fetchprop(cur, DTD_ATTR_VERSION, version, 72206cfd72c6Sgjelinek sizeof (version))) != Z_OK) 72216cfd72c6Sgjelinek goto done; 7222ee519a1fSgjelinek 72236cfd72c6Sgjelinek if ((pkg = (zone_pkg_entry_t *) 72246cfd72c6Sgjelinek malloc(sizeof (zone_pkg_entry_t))) == NULL) { 72256cfd72c6Sgjelinek res = Z_NOMEM; 72266cfd72c6Sgjelinek goto done; 72276cfd72c6Sgjelinek } 7228ee519a1fSgjelinek 72296cfd72c6Sgjelinek if ((pkg->zpe_name = strdup(name)) == NULL) { 72306cfd72c6Sgjelinek free(pkg); 72316cfd72c6Sgjelinek res = Z_NOMEM; 72326cfd72c6Sgjelinek goto done; 72336cfd72c6Sgjelinek } 7234ee519a1fSgjelinek 72356cfd72c6Sgjelinek if ((pkg->zpe_vers = strdup(version)) == NULL) { 72366cfd72c6Sgjelinek free(pkg->zpe_name); 72376cfd72c6Sgjelinek free(pkg); 72386cfd72c6Sgjelinek res = Z_NOMEM; 72396cfd72c6Sgjelinek goto done; 72406cfd72c6Sgjelinek } 7241ee519a1fSgjelinek 72426cfd72c6Sgjelinek uu_avl_node_init(pkg, &pkg->zpe_entry, pkg_pool); 72436cfd72c6Sgjelinek if (uu_avl_find(pkgs_avl, pkg, NULL, &where) != NULL) { 72446cfd72c6Sgjelinek free(pkg->zpe_name); 72456cfd72c6Sgjelinek free(pkg->zpe_vers); 72466cfd72c6Sgjelinek free(pkg); 72476cfd72c6Sgjelinek } else { 72486cfd72c6Sgjelinek uu_avl_insert(pkgs_avl, pkg, where); 72496cfd72c6Sgjelinek } 72506cfd72c6Sgjelinek } 72516cfd72c6Sgjelinek } 72526cfd72c6Sgjelinek 72536cfd72c6Sgjelinek done: 72546cfd72c6Sgjelinek (void) zonecfg_endent(handle); 72556cfd72c6Sgjelinek return (res); 7256ee519a1fSgjelinek } 7257ee519a1fSgjelinek 7258ee519a1fSgjelinek int 7259ee519a1fSgjelinek zonecfg_setdevperment(zone_dochandle_t handle) 7260ee519a1fSgjelinek { 7261ee519a1fSgjelinek return (zonecfg_setent(handle)); 7262ee519a1fSgjelinek } 7263ee519a1fSgjelinek 7264ee519a1fSgjelinek int 7265ee519a1fSgjelinek zonecfg_getdevperment(zone_dochandle_t handle, struct zone_devpermtab *tabptr) 7266ee519a1fSgjelinek { 7267ee519a1fSgjelinek xmlNodePtr cur; 7268ee519a1fSgjelinek int err; 7269ee519a1fSgjelinek char buf[128]; 7270ee519a1fSgjelinek 7271ee519a1fSgjelinek tabptr->zone_devperm_acl = NULL; 7272ee519a1fSgjelinek 7273ee519a1fSgjelinek if (handle == NULL) 7274ee519a1fSgjelinek return (Z_INVAL); 7275ee519a1fSgjelinek 7276ee519a1fSgjelinek if ((cur = handle->zone_dh_cur) == NULL) 7277ee519a1fSgjelinek return (Z_NO_ENTRY); 7278ee519a1fSgjelinek 7279ee519a1fSgjelinek for (; cur != NULL; cur = cur->next) 7280ee519a1fSgjelinek if (!xmlStrcmp(cur->name, DTD_ELEM_DEV_PERM)) 7281ee519a1fSgjelinek break; 7282ee519a1fSgjelinek if (cur == NULL) { 7283ee519a1fSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 7284ee519a1fSgjelinek return (Z_NO_ENTRY); 7285ee519a1fSgjelinek } 7286ee519a1fSgjelinek 7287ee519a1fSgjelinek if ((err = fetchprop(cur, DTD_ATTR_NAME, tabptr->zone_devperm_name, 7288ee519a1fSgjelinek sizeof (tabptr->zone_devperm_name))) != Z_OK) { 7289ee519a1fSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 7290ee519a1fSgjelinek return (err); 7291ee519a1fSgjelinek } 7292ee519a1fSgjelinek 7293ee519a1fSgjelinek if ((err = fetchprop(cur, DTD_ATTR_UID, buf, sizeof (buf))) != Z_OK) { 7294ee519a1fSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 7295ee519a1fSgjelinek return (err); 7296ee519a1fSgjelinek } 7297ee519a1fSgjelinek tabptr->zone_devperm_uid = (uid_t)atol(buf); 7298ee519a1fSgjelinek 7299ee519a1fSgjelinek if ((err = fetchprop(cur, DTD_ATTR_GID, buf, sizeof (buf))) != Z_OK) { 7300ee519a1fSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 7301ee519a1fSgjelinek return (err); 7302ee519a1fSgjelinek } 7303ee519a1fSgjelinek tabptr->zone_devperm_gid = (gid_t)atol(buf); 7304ee519a1fSgjelinek 7305ee519a1fSgjelinek if ((err = fetchprop(cur, DTD_ATTR_MODE, buf, sizeof (buf))) != Z_OK) { 7306ee519a1fSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 7307ee519a1fSgjelinek return (err); 7308ee519a1fSgjelinek } 7309ee519a1fSgjelinek tabptr->zone_devperm_mode = (mode_t)strtol(buf, (char **)NULL, 8); 7310ee519a1fSgjelinek 7311ee519a1fSgjelinek if ((err = fetch_alloc_prop(cur, DTD_ATTR_ACL, 7312ee519a1fSgjelinek &(tabptr->zone_devperm_acl))) != Z_OK) { 7313ee519a1fSgjelinek handle->zone_dh_cur = handle->zone_dh_top; 7314ee519a1fSgjelinek return (err); 7315ee519a1fSgjelinek } 7316ee519a1fSgjelinek 7317ee519a1fSgjelinek handle->zone_dh_cur = cur->next; 7318ee519a1fSgjelinek return (Z_OK); 7319ee519a1fSgjelinek } 7320ee519a1fSgjelinek 7321ee519a1fSgjelinek int 7322ee519a1fSgjelinek zonecfg_enddevperment(zone_dochandle_t handle) 7323ee519a1fSgjelinek { 7324ee519a1fSgjelinek return (zonecfg_endent(handle)); 7325ee519a1fSgjelinek } 7326ee519a1fSgjelinek 7327ff17c8bfSgjelinek /* PRINTFLIKE1 */ 7328ff17c8bfSgjelinek static void 7329ff17c8bfSgjelinek zerror(const char *zone_name, const char *fmt, ...) 733039935be5Sgjelinek { 7331ff17c8bfSgjelinek va_list alist; 733239935be5Sgjelinek 7333ff17c8bfSgjelinek va_start(alist, fmt); 7334ff17c8bfSgjelinek (void) fprintf(stderr, "zone '%s': ", zone_name); 7335ff17c8bfSgjelinek (void) vfprintf(stderr, fmt, alist); 7336ff17c8bfSgjelinek (void) fprintf(stderr, "\n"); 7337ff17c8bfSgjelinek va_end(alist); 7338ff17c8bfSgjelinek } 733939935be5Sgjelinek 7340ff17c8bfSgjelinek static void 7341ff17c8bfSgjelinek zperror(const char *str) 7342ff17c8bfSgjelinek { 7343ff17c8bfSgjelinek (void) fprintf(stderr, "%s: %s\n", str, strerror(errno)); 734439935be5Sgjelinek } 734539935be5Sgjelinek 7346ee519a1fSgjelinek /* 7347ff17c8bfSgjelinek * The following three routines implement a simple locking mechanism to 7348ff17c8bfSgjelinek * ensure that only one instance of zoneadm at a time is able to manipulate 7349ff17c8bfSgjelinek * a given zone. The lock is built on top of an fcntl(2) lock of 7350ff17c8bfSgjelinek * [<altroot>]/var/run/zones/<zonename>.zoneadm.lock. If a zoneadm instance 7351ff17c8bfSgjelinek * can grab that lock, it is allowed to manipulate the zone. 7352ff17c8bfSgjelinek * 7353ff17c8bfSgjelinek * Since zoneadm may call external applications which in turn invoke 7354ff17c8bfSgjelinek * zoneadm again, we introduce the notion of "lock inheritance". Any 7355ff17c8bfSgjelinek * instance of zoneadm that has another instance in its ancestry is assumed 7356ff17c8bfSgjelinek * to be acting on behalf of the original zoneadm, and is thus allowed to 7357ff17c8bfSgjelinek * manipulate its zone. 7358ee519a1fSgjelinek * 7359ff17c8bfSgjelinek * This inheritance is implemented via the _ZONEADM_LOCK_HELD environment 7360ff17c8bfSgjelinek * variable. When zoneadm is granted a lock on its zone, this environment 7361ff17c8bfSgjelinek * variable is set to 1. When it releases the lock, the variable is set to 7362ff17c8bfSgjelinek * 0. Since a child process inherits its parent's environment, checking 7363ff17c8bfSgjelinek * the state of this variable indicates whether or not any ancestor owns 7364ff17c8bfSgjelinek * the lock. 7365ee519a1fSgjelinek */ 7366ff17c8bfSgjelinek void 7367ff17c8bfSgjelinek zonecfg_init_lock_file(const char *zone_name, char **lock_env) 7368ff17c8bfSgjelinek { 7369ff17c8bfSgjelinek *lock_env = getenv(LOCK_ENV_VAR); 7370ff17c8bfSgjelinek if (*lock_env == NULL) { 7371ff17c8bfSgjelinek if (putenv(zoneadm_lock_not_held) != 0) { 7372ff17c8bfSgjelinek zerror(zone_name, gettext("could not set env: %s"), 7373ff17c8bfSgjelinek strerror(errno)); 7374ff17c8bfSgjelinek exit(1); 7375ee519a1fSgjelinek } 7376ff17c8bfSgjelinek } else { 7377ff17c8bfSgjelinek if (atoi(*lock_env) == 1) 7378ff17c8bfSgjelinek zone_lock_cnt = 1; 7379ff17c8bfSgjelinek } 7380ff17c8bfSgjelinek } 7381ee519a1fSgjelinek 7382ff17c8bfSgjelinek void 7383ff17c8bfSgjelinek zonecfg_release_lock_file(const char *zone_name, int lockfd) 7384ff17c8bfSgjelinek { 7385ff17c8bfSgjelinek /* 7386ff17c8bfSgjelinek * If we are cleaning up from a failed attempt to lock the zone for 7387ff17c8bfSgjelinek * the first time, we might have a zone_lock_cnt of 0. In that 7388ff17c8bfSgjelinek * error case, we don't want to do anything but close the lock 7389ff17c8bfSgjelinek * file. 7390ff17c8bfSgjelinek */ 7391ff17c8bfSgjelinek assert(zone_lock_cnt >= 0); 7392ff17c8bfSgjelinek if (zone_lock_cnt > 0) { 7393ff17c8bfSgjelinek assert(getenv(LOCK_ENV_VAR) != NULL); 7394ff17c8bfSgjelinek assert(atoi(getenv(LOCK_ENV_VAR)) == 1); 7395ff17c8bfSgjelinek if (--zone_lock_cnt > 0) { 7396ff17c8bfSgjelinek assert(lockfd == -1); 7397ff17c8bfSgjelinek return; 7398ee519a1fSgjelinek } 7399ff17c8bfSgjelinek if (putenv(zoneadm_lock_not_held) != 0) { 7400ff17c8bfSgjelinek zerror(zone_name, gettext("could not set env: %s"), 7401ff17c8bfSgjelinek strerror(errno)); 7402ff17c8bfSgjelinek exit(1); 7403ee519a1fSgjelinek } 7404ee519a1fSgjelinek } 7405ff17c8bfSgjelinek assert(lockfd >= 0); 7406ff17c8bfSgjelinek (void) close(lockfd); 7407ee519a1fSgjelinek } 7408ee519a1fSgjelinek 7409ff17c8bfSgjelinek int 7410ff17c8bfSgjelinek zonecfg_grab_lock_file(const char *zone_name, int *lockfd) 7411ee519a1fSgjelinek { 7412ff17c8bfSgjelinek char pathbuf[PATH_MAX]; 7413ff17c8bfSgjelinek struct flock flock; 7414ee519a1fSgjelinek 7415ff17c8bfSgjelinek /* 7416ff17c8bfSgjelinek * If we already have the lock, we can skip this expensive song 7417ff17c8bfSgjelinek * and dance. 7418ff17c8bfSgjelinek */ 7419ff17c8bfSgjelinek assert(zone_lock_cnt >= 0); 7420ff17c8bfSgjelinek assert(getenv(LOCK_ENV_VAR) != NULL); 7421ff17c8bfSgjelinek if (zone_lock_cnt > 0) { 7422ff17c8bfSgjelinek assert(atoi(getenv(LOCK_ENV_VAR)) == 1); 7423ff17c8bfSgjelinek zone_lock_cnt++; 7424ff17c8bfSgjelinek *lockfd = -1; 7425ee519a1fSgjelinek return (Z_OK); 742639935be5Sgjelinek } 7427ff17c8bfSgjelinek assert(getenv(LOCK_ENV_VAR) != NULL); 7428ff17c8bfSgjelinek assert(atoi(getenv(LOCK_ENV_VAR)) == 0); 7429ee519a1fSgjelinek 7430ff17c8bfSgjelinek if (snprintf(pathbuf, sizeof (pathbuf), "%s%s", zonecfg_get_root(), 7431ff17c8bfSgjelinek ZONES_TMPDIR) >= sizeof (pathbuf)) { 7432ff17c8bfSgjelinek zerror(zone_name, gettext("alternate root path is too long")); 7433ff17c8bfSgjelinek return (-1); 7434ff17c8bfSgjelinek } 7435ff17c8bfSgjelinek if (mkdir(pathbuf, S_IRWXU) < 0 && errno != EEXIST) { 7436ff17c8bfSgjelinek zerror(zone_name, gettext("could not mkdir %s: %s"), pathbuf, 7437ff17c8bfSgjelinek strerror(errno)); 7438ff17c8bfSgjelinek return (-1); 7439ff17c8bfSgjelinek } 7440ff17c8bfSgjelinek (void) chmod(pathbuf, S_IRWXU); 744107b574eeSgjelinek 744239935be5Sgjelinek /* 7443ff17c8bfSgjelinek * One of these lock files is created for each zone (when needed). 7444ff17c8bfSgjelinek * The lock files are not cleaned up (except on system reboot), 7445ff17c8bfSgjelinek * but since there is only one per zone, there is no resource 7446ff17c8bfSgjelinek * starvation issue. 744739935be5Sgjelinek */ 7448ff17c8bfSgjelinek if (snprintf(pathbuf, sizeof (pathbuf), "%s%s/%s.zoneadm.lock", 7449ff17c8bfSgjelinek zonecfg_get_root(), ZONES_TMPDIR, zone_name) >= sizeof (pathbuf)) { 7450ff17c8bfSgjelinek zerror(zone_name, gettext("alternate root path is too long")); 7451ff17c8bfSgjelinek return (-1); 7452ff17c8bfSgjelinek } 7453ff17c8bfSgjelinek if ((*lockfd = open(pathbuf, O_RDWR|O_CREAT, S_IRUSR|S_IWUSR)) < 0) { 7454ff17c8bfSgjelinek zerror(zone_name, gettext("could not open %s: %s"), pathbuf, 7455ff17c8bfSgjelinek strerror(errno)); 7456ff17c8bfSgjelinek return (-1); 7457ee519a1fSgjelinek } 745839935be5Sgjelinek /* 7459ff17c8bfSgjelinek * Lock the file to synchronize with other zoneadmds 746039935be5Sgjelinek */ 7461ff17c8bfSgjelinek flock.l_type = F_WRLCK; 7462ff17c8bfSgjelinek flock.l_whence = SEEK_SET; 7463ff17c8bfSgjelinek flock.l_start = (off_t)0; 7464ff17c8bfSgjelinek flock.l_len = (off_t)0; 7465ff17c8bfSgjelinek if ((fcntl(*lockfd, F_SETLKW, &flock) < 0) || 7466ff17c8bfSgjelinek (putenv(zoneadm_lock_held) != 0)) { 7467ff17c8bfSgjelinek zerror(zone_name, gettext("unable to lock %s: %s"), pathbuf, 7468ff17c8bfSgjelinek strerror(errno)); 7469ff17c8bfSgjelinek zonecfg_release_lock_file(zone_name, *lockfd); 7470ff17c8bfSgjelinek return (-1); 7471ff17c8bfSgjelinek } 7472ff17c8bfSgjelinek zone_lock_cnt = 1; 7473ff17c8bfSgjelinek return (Z_OK); 7474ff17c8bfSgjelinek } 747539935be5Sgjelinek 7476edfa49ffS boolean_t 7477edfa49ffS zonecfg_lock_file_held(int *lockfd) 7478edfa49ffS { 7479edfa49ffS if (*lockfd >= 0 || zone_lock_cnt > 0) 7480edfa49ffS return (B_TRUE); 7481edfa49ffS return (B_FALSE); 7482edfa49ffS } 7483edfa49ffS 7484ff17c8bfSgjelinek static boolean_t 7485ff17c8bfSgjelinek get_doorname(const char *zone_name, char *buffer) 7486ff17c8bfSgjelinek { 7487ff17c8bfSgjelinek return (snprintf(buffer, PATH_MAX, "%s" ZONE_DOOR_PATH, 7488ff17c8bfSgjelinek zonecfg_get_root(), zone_name) < PATH_MAX); 7489ee519a1fSgjelinek } 7490ee519a1fSgjelinek 7491ee519a1fSgjelinek /* 7492ff17c8bfSgjelinek * system daemons are not audited. For the global zone, this occurs 7493ff17c8bfSgjelinek * "naturally" since init is started with the default audit 7494ff17c8bfSgjelinek * characteristics. Since zoneadmd is a system daemon and it starts 7495ff17c8bfSgjelinek * init for a zone, it is necessary to clear out the audit 7496ff17c8bfSgjelinek * characteristics inherited from whomever started zoneadmd. This is 7497ff17c8bfSgjelinek * indicated by the audit id, which is set from the ruid parameter of 7498ff17c8bfSgjelinek * adt_set_user(), below. 7499ee519a1fSgjelinek */ 7500ee519a1fSgjelinek 7501ff17c8bfSgjelinek static void 7502ff17c8bfSgjelinek prepare_audit_context(const char *zone_name) 7503ff17c8bfSgjelinek { 7504ff17c8bfSgjelinek adt_session_data_t *ah; 7505ff17c8bfSgjelinek char *failure = gettext("audit failure: %s"); 7506ee519a1fSgjelinek 7507ff17c8bfSgjelinek if (adt_start_session(&ah, NULL, 0)) { 7508ff17c8bfSgjelinek zerror(zone_name, failure, strerror(errno)); 7509ff17c8bfSgjelinek return; 7510ee519a1fSgjelinek } 7511ff17c8bfSgjelinek if (adt_set_user(ah, ADT_NO_AUDIT, ADT_NO_AUDIT, 7512ff17c8bfSgjelinek ADT_NO_AUDIT, ADT_NO_AUDIT, NULL, ADT_NEW)) { 7513ff17c8bfSgjelinek zerror(zone_name, failure, strerror(errno)); 7514ff17c8bfSgjelinek (void) adt_end_session(ah); 7515ff17c8bfSgjelinek return; 7516ee519a1fSgjelinek } 7517ff17c8bfSgjelinek if (adt_set_proc(ah)) 7518ff17c8bfSgjelinek zerror(zone_name, failure, strerror(errno)); 7519ee519a1fSgjelinek 7520ff17c8bfSgjelinek (void) adt_end_session(ah); 7521ee519a1fSgjelinek } 7522ee519a1fSgjelinek 7523ee519a1fSgjelinek static int 7524ff17c8bfSgjelinek start_zoneadmd(const char *zone_name, boolean_t lock) 7525ff17c8bfSgjelinek { 7526ff17c8bfSgjelinek char doorpath[PATH_MAX]; 7527ff17c8bfSgjelinek pid_t child_pid; 7528ff17c8bfSgjelinek int error = -1; 7529ff17c8bfSgjelinek int doorfd, lockfd; 7530ff17c8bfSgjelinek struct door_info info; 7531ee519a1fSgjelinek 7532ff17c8bfSgjelinek if (!get_doorname(zone_name, doorpath)) 7533ff17c8bfSgjelinek return (-1); 7534ee519a1fSgjelinek 7535ff17c8bfSgjelinek if (lock) 7536ff17c8bfSgjelinek if (zonecfg_grab_lock_file(zone_name, &lockfd) != Z_OK) 7537ff17c8bfSgjelinek return (-1); 7538ee519a1fSgjelinek 7539ff17c8bfSgjelinek /* 7540ff17c8bfSgjelinek * Now that we have the lock, re-confirm that the daemon is 7541ff17c8bfSgjelinek * *not* up and working fine. If it is still down, we have a green 7542ff17c8bfSgjelinek * light to start it. 7543ff17c8bfSgjelinek */ 7544ff17c8bfSgjelinek if ((doorfd = open(doorpath, O_RDONLY)) < 0) { 7545ff17c8bfSgjelinek if (errno != ENOENT) { 7546ff17c8bfSgjelinek zperror(doorpath); 7547ff17c8bfSgjelinek goto out; 7548ee519a1fSgjelinek } 7549ff17c8bfSgjelinek } else { 7550ff17c8bfSgjelinek if (door_info(doorfd, &info) == 0 && 7551ff17c8bfSgjelinek ((info.di_attributes & DOOR_REVOKED) == 0)) { 7552ff17c8bfSgjelinek error = Z_OK; 7553ff17c8bfSgjelinek (void) close(doorfd); 7554ff17c8bfSgjelinek goto out; 7555ee519a1fSgjelinek } 7556ff17c8bfSgjelinek (void) close(doorfd); 7557ff17c8bfSgjelinek } 7558ee519a1fSgjelinek 7559ff17c8bfSgjelinek if ((child_pid = fork()) == -1) { 7560ff17c8bfSgjelinek zperror(gettext("could not fork")); 7561ff17c8bfSgjelinek goto out; 756239935be5Sgjelinek } 756339935be5Sgjelinek 7564ff17c8bfSgjelinek if (child_pid == 0) { 7565ff17c8bfSgjelinek const char *argv[6], **ap; 756639935be5Sgjelinek 7567ff17c8bfSgjelinek /* child process */ 7568ff17c8bfSgjelinek prepare_audit_context(zone_name); 756939935be5Sgjelinek 7570ff17c8bfSgjelinek ap = argv; 7571ff17c8bfSgjelinek *ap++ = "zoneadmd"; 7572ff17c8bfSgjelinek *ap++ = "-z"; 7573ff17c8bfSgjelinek *ap++ = zone_name; 7574ff17c8bfSgjelinek if (zonecfg_in_alt_root()) { 7575ff17c8bfSgjelinek *ap++ = "-R"; 7576ff17c8bfSgjelinek *ap++ = zonecfg_get_root(); 7577ee519a1fSgjelinek } 7578ff17c8bfSgjelinek *ap = NULL; 7579ee519a1fSgjelinek 7580ff17c8bfSgjelinek (void) execv("/usr/lib/zones/zoneadmd", (char * const *)argv); 7581ff17c8bfSgjelinek /* 7582ff17c8bfSgjelinek * TRANSLATION_NOTE 7583ff17c8bfSgjelinek * zoneadmd is a literal that should not be translated. 7584ff17c8bfSgjelinek */ 7585ff17c8bfSgjelinek zperror(gettext("could not exec zoneadmd")); 7586ff17c8bfSgjelinek _exit(1); 7587ff17c8bfSgjelinek } else { 7588ff17c8bfSgjelinek /* parent process */ 7589ff17c8bfSgjelinek pid_t retval; 7590ff17c8bfSgjelinek int pstatus = 0; 7591ff17c8bfSgjelinek 7592ff17c8bfSgjelinek do { 7593ff17c8bfSgjelinek retval = waitpid(child_pid, &pstatus, 0); 7594ff17c8bfSgjelinek } while (retval != child_pid); 7595ff17c8bfSgjelinek if (WIFSIGNALED(pstatus) || (WIFEXITED(pstatus) && 7596ff17c8bfSgjelinek WEXITSTATUS(pstatus) != 0)) { 7597ff17c8bfSgjelinek zerror(zone_name, gettext("could not start %s"), 7598ff17c8bfSgjelinek "zoneadmd"); 7599ff17c8bfSgjelinek goto out; 760039935be5Sgjelinek } 7601ee519a1fSgjelinek } 7602ff17c8bfSgjelinek error = Z_OK; 7603ff17c8bfSgjelinek out: 7604ff17c8bfSgjelinek if (lock) 7605ff17c8bfSgjelinek zonecfg_release_lock_file(zone_name, lockfd); 7606ff17c8bfSgjelinek return (error); 760739935be5Sgjelinek } 7608ee519a1fSgjelinek 7609ff17c8bfSgjelinek int 7610ff17c8bfSgjelinek zonecfg_ping_zoneadmd(const char *zone_name) 761139935be5Sgjelinek { 7612ff17c8bfSgjelinek char doorpath[PATH_MAX]; 7613ff17c8bfSgjelinek int doorfd; 7614ff17c8bfSgjelinek struct door_info info; 761539935be5Sgjelinek 7616ff17c8bfSgjelinek if (!get_doorname(zone_name, doorpath)) 7617ff17c8bfSgjelinek return (-1); 761839935be5Sgjelinek 7619ff17c8bfSgjelinek if ((doorfd = open(doorpath, O_RDONLY)) < 0) { 7620ff17c8bfSgjelinek return (-1); 7621ff17c8bfSgjelinek } 7622ff17c8bfSgjelinek if (door_info(doorfd, &info) == 0 && 7623ff17c8bfSgjelinek ((info.di_attributes & DOOR_REVOKED) == 0)) { 7624ff17c8bfSgjelinek (void) close(doorfd); 7625ff17c8bfSgjelinek return (Z_OK); 7626ee519a1fSgjelinek } 7627ff17c8bfSgjelinek (void) close(doorfd); 7628ff17c8bfSgjelinek return (-1); 7629ff17c8bfSgjelinek } 7630ee519a1fSgjelinek 7631ff17c8bfSgjelinek int 7632ff17c8bfSgjelinek zonecfg_call_zoneadmd(const char *zone_name, zone_cmd_arg_t *arg, char *locale, 7633ff17c8bfSgjelinek boolean_t lock) 7634ff17c8bfSgjelinek { 7635ff17c8bfSgjelinek char doorpath[PATH_MAX]; 7636ff17c8bfSgjelinek int doorfd, result; 7637ff17c8bfSgjelinek door_arg_t darg; 7638ee519a1fSgjelinek 7639ff17c8bfSgjelinek zoneid_t zoneid; 7640ff17c8bfSgjelinek uint64_t uniqid = 0; 7641ee519a1fSgjelinek 7642ff17c8bfSgjelinek zone_cmd_rval_t *rvalp; 7643ff17c8bfSgjelinek size_t rlen; 7644ff17c8bfSgjelinek char *cp, *errbuf; 7645ee519a1fSgjelinek 7646ff17c8bfSgjelinek rlen = getpagesize(); 7647ff17c8bfSgjelinek if ((rvalp = malloc(rlen)) == NULL) { 7648ff17c8bfSgjelinek zerror(zone_name, gettext("failed to allocate %lu bytes: %s"), 7649ff17c8bfSgjelinek rlen, strerror(errno)); 7650ff17c8bfSgjelinek return (-1); 7651ff17c8bfSgjelinek } 765239935be5Sgjelinek 7653ff17c8bfSgjelinek if ((zoneid = getzoneidbyname(zone_name)) != ZONE_ID_UNDEFINED) { 7654ff17c8bfSgjelinek (void) zone_getattr(zoneid, ZONE_ATTR_UNIQID, &uniqid, 7655ff17c8bfSgjelinek sizeof (uniqid)); 7656ff17c8bfSgjelinek } 7657ff17c8bfSgjelinek arg->uniqid = uniqid; 7658ff17c8bfSgjelinek (void) strlcpy(arg->locale, locale, sizeof (arg->locale)); 7659ff17c8bfSgjelinek if (!get_doorname(zone_name, doorpath)) { 7660ff17c8bfSgjelinek zerror(zone_name, gettext("alternate root path is too long")); 7661ff17c8bfSgjelinek free(rvalp); 7662ff17c8bfSgjelinek return (-1); 7663ee519a1fSgjelinek } 7664ee519a1fSgjelinek 7665ff17c8bfSgjelinek /* 7666ff17c8bfSgjelinek * Loop trying to start zoneadmd; if something goes seriously 7667ff17c8bfSgjelinek * wrong we break out and fail. 7668ff17c8bfSgjelinek */ 7669ff17c8bfSgjelinek for (;;) { 7670ff17c8bfSgjelinek if (start_zoneadmd(zone_name, lock) != Z_OK) 7671ff17c8bfSgjelinek break; 7672ee519a1fSgjelinek 7673ff17c8bfSgjelinek if ((doorfd = open(doorpath, O_RDONLY)) < 0) { 7674ff17c8bfSgjelinek zperror(gettext("failed to open zone door")); 7675ff17c8bfSgjelinek break; 7676ff17c8bfSgjelinek } 767739935be5Sgjelinek 7678ff17c8bfSgjelinek darg.data_ptr = (char *)arg; 7679ff17c8bfSgjelinek darg.data_size = sizeof (*arg); 7680ff17c8bfSgjelinek darg.desc_ptr = NULL; 7681ff17c8bfSgjelinek darg.desc_num = 0; 7682ff17c8bfSgjelinek darg.rbuf = (char *)rvalp; 7683ff17c8bfSgjelinek darg.rsize = rlen; 7684ff17c8bfSgjelinek if (door_call(doorfd, &darg) != 0) { 7685ff17c8bfSgjelinek (void) close(doorfd); 7686ff17c8bfSgjelinek /* 7687ff17c8bfSgjelinek * We'll get EBADF if the door has been revoked. 7688ff17c8bfSgjelinek */ 7689ff17c8bfSgjelinek if (errno != EBADF) { 7690ff17c8bfSgjelinek zperror(gettext("door_call failed")); 7691ff17c8bfSgjelinek break; 7692ff17c8bfSgjelinek } 7693ff17c8bfSgjelinek continue; /* take another lap */ 7694ff17c8bfSgjelinek } 7695ff17c8bfSgjelinek (void) close(doorfd); 7696ee519a1fSgjelinek 7697ff17c8bfSgjelinek if (darg.data_size == 0) { 7698ff17c8bfSgjelinek /* Door server is going away; kick it again. */ 76996cfd72c6Sgjelinek continue; 77006cfd72c6Sgjelinek } 77016cfd72c6Sgjelinek 7702ff17c8bfSgjelinek errbuf = rvalp->errbuf; 7703ff17c8bfSgjelinek while (*errbuf != '\0') { 77046cfd72c6Sgjelinek /* 7705ff17c8bfSgjelinek * Remove any newlines since zerror() 7706ff17c8bfSgjelinek * will append one automatically. 77076cfd72c6Sgjelinek */ 7708ff17c8bfSgjelinek cp = strchr(errbuf, '\n'); 7709ff17c8bfSgjelinek if (cp != NULL) 7710ff17c8bfSgjelinek *cp = '\0'; 7711ff17c8bfSgjelinek zerror(zone_name, "%s", errbuf); 7712ff17c8bfSgjelinek if (cp == NULL) 7713ff17c8bfSgjelinek break; 7714ff17c8bfSgjelinek errbuf = cp + 1; 7715ee519a1fSgjelinek } 7716ff17c8bfSgjelinek result = rvalp->rval == 0 ? 0 : -1; 7717ff17c8bfSgjelinek free(rvalp); 7718ff17c8bfSgjelinek return (result); 7719ee519a1fSgjelinek } 7720ee519a1fSgjelinek 7721ff17c8bfSgjelinek free(rvalp); 7722ff17c8bfSgjelinek return (-1); 7723ee519a1fSgjelinek } 7724cb8a054bSGlenn Faden 7725cb8a054bSGlenn Faden boolean_t 7726cb8a054bSGlenn Faden zonecfg_valid_auths(const char *auths, const char *zonename) 7727cb8a054bSGlenn Faden { 7728cb8a054bSGlenn Faden char *right; 7729cb8a054bSGlenn Faden char *tmpauths; 7730cb8a054bSGlenn Faden char *lasts; 7731cb8a054bSGlenn Faden char authname[MAXAUTHS]; 7732cb8a054bSGlenn Faden boolean_t status = B_TRUE; 7733cb8a054bSGlenn Faden 7734cb8a054bSGlenn Faden tmpauths = strdup(auths); 7735cb8a054bSGlenn Faden if (tmpauths == NULL) { 7736cb8a054bSGlenn Faden zerror(zonename, gettext("Out of memory")); 7737cb8a054bSGlenn Faden return (B_FALSE); 7738cb8a054bSGlenn Faden } 7739cb8a054bSGlenn Faden right = strtok_r(tmpauths, ",", &lasts); 7740cb8a054bSGlenn Faden while (right != NULL) { 7741cb8a054bSGlenn Faden (void) snprintf(authname, MAXAUTHS, "%s%s", 7742cb8a054bSGlenn Faden ZONE_AUTH_PREFIX, right); 7743cb8a054bSGlenn Faden if (getauthnam(authname) == NULL) { 7744cb8a054bSGlenn Faden status = B_FALSE; 7745a20ee416SGlenn Faden zerror(zonename, 7746d77d83efSGlenn Faden gettext("'%s' is not a valid authorization"), 7747cb8a054bSGlenn Faden right); 7748cb8a054bSGlenn Faden } 7749cb8a054bSGlenn Faden right = strtok_r(NULL, ",", &lasts); 7750cb8a054bSGlenn Faden } 7751cb8a054bSGlenn Faden free(tmpauths); 7752cb8a054bSGlenn Faden return (status); 7753cb8a054bSGlenn Faden } 7754cb8a054bSGlenn Faden 7755cb8a054bSGlenn Faden int 7756cb8a054bSGlenn Faden zonecfg_delete_admins(zone_dochandle_t handle, char *zonename) 7757cb8a054bSGlenn Faden { 7758cb8a054bSGlenn Faden int err; 7759cb8a054bSGlenn Faden struct zone_admintab admintab; 7760cb8a054bSGlenn Faden boolean_t changed = B_FALSE; 7761cb8a054bSGlenn Faden 7762cb8a054bSGlenn Faden if ((err = zonecfg_setadminent(handle)) != Z_OK) { 7763cb8a054bSGlenn Faden return (err); 7764cb8a054bSGlenn Faden } 7765cb8a054bSGlenn Faden while (zonecfg_getadminent(handle, &admintab) == Z_OK) { 7766cb8a054bSGlenn Faden err = zonecfg_delete_admin(handle, &admintab, 7767cb8a054bSGlenn Faden zonename); 7768cb8a054bSGlenn Faden if (err != Z_OK) { 7769cb8a054bSGlenn Faden (void) zonecfg_endadminent(handle); 7770cb8a054bSGlenn Faden return (err); 7771cb8a054bSGlenn Faden } else { 7772cb8a054bSGlenn Faden changed = B_TRUE; 7773cb8a054bSGlenn Faden } 7774cb8a054bSGlenn Faden if ((err = zonecfg_setadminent(handle)) != Z_OK) { 7775cb8a054bSGlenn Faden return (err); 7776cb8a054bSGlenn Faden } 7777cb8a054bSGlenn Faden } 7778cb8a054bSGlenn Faden (void) zonecfg_endadminent(handle); 7779cb8a054bSGlenn Faden return (changed? Z_OK:Z_NO_ENTRY); 7780cb8a054bSGlenn Faden } 7781cb8a054bSGlenn Faden 7782cb8a054bSGlenn Faden /* 7783cb8a054bSGlenn Faden * Checks if a long authorization applies to this zone. 7784cb8a054bSGlenn Faden * If so, it returns true, after destructively stripping 7785cb8a054bSGlenn Faden * the authorization of its prefix and zone suffix. 7786cb8a054bSGlenn Faden */ 7787cb8a054bSGlenn Faden static boolean_t 7788cb8a054bSGlenn Faden is_zone_auth(char **auth, char *zonename, char *oldzonename) 7789cb8a054bSGlenn Faden { 7790cb8a054bSGlenn Faden char *suffix; 7791cb8a054bSGlenn Faden size_t offset; 7792cb8a054bSGlenn Faden 7793cb8a054bSGlenn Faden offset = strlen(ZONE_AUTH_PREFIX); 7794cb8a054bSGlenn Faden if ((strncmp(*auth, ZONE_AUTH_PREFIX, offset) == 0) && 7795cb8a054bSGlenn Faden ((suffix = strchr(*auth, '/')) != NULL)) { 7796d77d83efSGlenn Faden if (strcmp(suffix + 1, zonename) == 0) { 7797cb8a054bSGlenn Faden *auth += offset; 7798cb8a054bSGlenn Faden suffix[0] = '\0'; 7799cb8a054bSGlenn Faden return (B_TRUE); 7800cb8a054bSGlenn Faden } else if ((oldzonename != NULL) && 7801d77d83efSGlenn Faden (strcmp(suffix + 1, oldzonename) == 0)) { 7802cb8a054bSGlenn Faden *auth += offset; 7803cb8a054bSGlenn Faden suffix[0] = '\0'; 7804cb8a054bSGlenn Faden return (B_TRUE); 7805cb8a054bSGlenn Faden } 7806cb8a054bSGlenn Faden } 7807cb8a054bSGlenn Faden return (B_FALSE); 7808cb8a054bSGlenn Faden } 7809cb8a054bSGlenn Faden 7810cb8a054bSGlenn Faden /* 7811cb8a054bSGlenn Faden * This function determines whether the zone-specific authorization 7812cb8a054bSGlenn Faden * assignments in /etc/user_attr have been changed more recently 7813cb8a054bSGlenn Faden * than the equivalent data stored in the zone's configuration file. 7814cb8a054bSGlenn Faden * This should only happen if the zone-specific authorizations in 7815cb8a054bSGlenn Faden * the user_attr file were modified using a tool other than zonecfg. 7816cb8a054bSGlenn Faden * If the configuration file is out-of-date with respect to these 7817cb8a054bSGlenn Faden * authorization assignments, it is updated to match those specified 7818cb8a054bSGlenn Faden * in /etc/user_attr. 7819cb8a054bSGlenn Faden */ 7820cb8a054bSGlenn Faden 7821cb8a054bSGlenn Faden int 7822cb8a054bSGlenn Faden zonecfg_update_userauths(zone_dochandle_t handle, char *zonename) 7823cb8a054bSGlenn Faden { 7824cb8a054bSGlenn Faden userattr_t *ua_ptr; 7825cb8a054bSGlenn Faden char *authlist; 7826cb8a054bSGlenn Faden char *lasts; 7827cb8a054bSGlenn Faden FILE *uaf; 7828cb8a054bSGlenn Faden struct zone_admintab admintab; 7829cb8a054bSGlenn Faden struct stat config_st, ua_st; 7830cb8a054bSGlenn Faden char config_file[MAXPATHLEN]; 7831cb8a054bSGlenn Faden boolean_t changed = B_FALSE; 7832cb8a054bSGlenn Faden int err; 7833cb8a054bSGlenn Faden 7834cb8a054bSGlenn Faden if ((uaf = fopen(USERATTR_FILENAME, "r")) == NULL) { 7835cb8a054bSGlenn Faden zerror(zonename, gettext("could not open file %s: %s"), 7836cb8a054bSGlenn Faden USERATTR_FILENAME, strerror(errno)); 7837cb8a054bSGlenn Faden if (errno == EACCES) 7838cb8a054bSGlenn Faden return (Z_ACCES); 7839cb8a054bSGlenn Faden if (errno == ENOENT) 7840cb8a054bSGlenn Faden return (Z_NO_ZONE); 7841cb8a054bSGlenn Faden return (Z_MISC_FS); 7842cb8a054bSGlenn Faden } 7843cb8a054bSGlenn Faden if ((err = fstat(fileno(uaf), &ua_st)) != 0) { 7844cb8a054bSGlenn Faden zerror(zonename, gettext("could not stat file %s: %s"), 7845cb8a054bSGlenn Faden USERATTR_FILENAME, strerror(errno)); 7846cb8a054bSGlenn Faden (void) fclose(uaf); 7847cb8a054bSGlenn Faden return (Z_MISC_FS); 7848cb8a054bSGlenn Faden } 7849cb8a054bSGlenn Faden if (!config_file_path(zonename, config_file)) { 7850cb8a054bSGlenn Faden (void) fclose(uaf); 7851cb8a054bSGlenn Faden return (Z_MISC_FS); 7852cb8a054bSGlenn Faden } 7853cb8a054bSGlenn Faden 7854cb8a054bSGlenn Faden if ((err = stat(config_file, &config_st)) != 0) { 7855cb8a054bSGlenn Faden zerror(zonename, gettext("could not stat file %s: %s"), 7856cb8a054bSGlenn Faden config_file, strerror(errno)); 7857cb8a054bSGlenn Faden (void) fclose(uaf); 7858cb8a054bSGlenn Faden return (Z_MISC_FS); 7859cb8a054bSGlenn Faden } 7860cb8a054bSGlenn Faden if (config_st.st_mtime >= ua_st.st_mtime) { 7861cb8a054bSGlenn Faden (void) fclose(uaf); 7862cb8a054bSGlenn Faden return (Z_NO_ENTRY); 7863cb8a054bSGlenn Faden } 7864cb8a054bSGlenn Faden if ((err = zonecfg_delete_admins(handle, zonename)) == Z_OK) { 7865cb8a054bSGlenn Faden changed = B_TRUE; 7866cb8a054bSGlenn Faden } else if (err != Z_NO_ENTRY) { 7867cb8a054bSGlenn Faden (void) fclose(uaf); 7868cb8a054bSGlenn Faden return (err); 7869cb8a054bSGlenn Faden } 7870cb8a054bSGlenn Faden while ((ua_ptr = fgetuserattr(uaf)) != NULL) { 7871cb8a054bSGlenn Faden if (ua_ptr->name[0] == '#') { 7872cb8a054bSGlenn Faden continue; 7873cb8a054bSGlenn Faden } 7874cb8a054bSGlenn Faden authlist = kva_match(ua_ptr->attr, USERATTR_AUTHS_KW); 7875cb8a054bSGlenn Faden if (authlist != NULL) { 7876cb8a054bSGlenn Faden char *cur_auth; 7877cb8a054bSGlenn Faden boolean_t first; 7878cb8a054bSGlenn Faden 7879cb8a054bSGlenn Faden first = B_TRUE; 7880cb8a054bSGlenn Faden bzero(&admintab.zone_admin_auths, MAXAUTHS); 7881cb8a054bSGlenn Faden cur_auth = strtok_r(authlist, ",", &lasts); 7882cb8a054bSGlenn Faden while (cur_auth != NULL) { 7883cb8a054bSGlenn Faden if (is_zone_auth(&cur_auth, zonename, 7884cb8a054bSGlenn Faden NULL)) { 7885cb8a054bSGlenn Faden /* 7886cb8a054bSGlenn Faden * Add auths for this zone 7887cb8a054bSGlenn Faden */ 7888cb8a054bSGlenn Faden if (first) { 7889cb8a054bSGlenn Faden first = B_FALSE; 7890cb8a054bSGlenn Faden } else { 7891cb8a054bSGlenn Faden (void) strlcat( 7892cb8a054bSGlenn Faden admintab.zone_admin_auths, 7893cb8a054bSGlenn Faden ",", MAXAUTHS); 7894cb8a054bSGlenn Faden } 7895cb8a054bSGlenn Faden (void) strlcat( 7896cb8a054bSGlenn Faden admintab.zone_admin_auths, 7897cb8a054bSGlenn Faden cur_auth, MAXAUTHS); 7898cb8a054bSGlenn Faden } 7899cb8a054bSGlenn Faden cur_auth = strtok_r(NULL, ",", &lasts); 7900cb8a054bSGlenn Faden } 7901cb8a054bSGlenn Faden if (!first) { 7902cb8a054bSGlenn Faden /* 7903cb8a054bSGlenn Faden * Add this right to config file 7904cb8a054bSGlenn Faden */ 7905cb8a054bSGlenn Faden (void) strlcpy(admintab.zone_admin_user, 7906cb8a054bSGlenn Faden ua_ptr->name, 7907cb8a054bSGlenn Faden sizeof (admintab.zone_admin_user)); 7908cb8a054bSGlenn Faden err = zonecfg_add_admin(handle, 7909cb8a054bSGlenn Faden &admintab, zonename); 7910cb8a054bSGlenn Faden if (err != Z_OK) { 7911cb8a054bSGlenn Faden (void) fclose(uaf); 7912cb8a054bSGlenn Faden return (err); 7913cb8a054bSGlenn Faden } else { 7914cb8a054bSGlenn Faden changed = B_TRUE; 7915cb8a054bSGlenn Faden } 7916cb8a054bSGlenn Faden } 7917cb8a054bSGlenn Faden } 7918cb8a054bSGlenn Faden } /* end-of-while-loop */ 7919cb8a054bSGlenn Faden (void) fclose(uaf); 7920cb8a054bSGlenn Faden return (changed? Z_OK: Z_NO_ENTRY); 7921cb8a054bSGlenn Faden } 7922cb8a054bSGlenn Faden 7923cb8a054bSGlenn Faden static void 7924cb8a054bSGlenn Faden update_profiles(char *rbac_profs, boolean_t add) 7925cb8a054bSGlenn Faden { 7926cb8a054bSGlenn Faden char new_profs[MAXPROFS]; 7927cb8a054bSGlenn Faden char *cur_prof; 7928cb8a054bSGlenn Faden boolean_t first = B_TRUE; 7929cb8a054bSGlenn Faden boolean_t found = B_FALSE; 7930cb8a054bSGlenn Faden char *lasts; 7931cb8a054bSGlenn Faden 7932cb8a054bSGlenn Faden cur_prof = strtok_r(rbac_profs, ",", &lasts); 7933cb8a054bSGlenn Faden while (cur_prof != NULL) { 7934cb8a054bSGlenn Faden if (strcmp(cur_prof, ZONE_MGMT_PROF) == 0) { 7935cb8a054bSGlenn Faden found = B_TRUE; 7936cb8a054bSGlenn Faden if (!add) { 7937cb8a054bSGlenn Faden cur_prof = strtok_r(NULL, ",", &lasts); 7938cb8a054bSGlenn Faden continue; 7939cb8a054bSGlenn Faden } 7940cb8a054bSGlenn Faden } 7941cb8a054bSGlenn Faden if (first) { 7942cb8a054bSGlenn Faden first = B_FALSE; 7943cb8a054bSGlenn Faden } else { 7944cb8a054bSGlenn Faden (void) strlcat(new_profs, ",", 7945cb8a054bSGlenn Faden MAXPROFS); 7946cb8a054bSGlenn Faden } 7947cb8a054bSGlenn Faden (void) strlcat(new_profs, cur_prof, 7948cb8a054bSGlenn Faden MAXPROFS); 7949cb8a054bSGlenn Faden cur_prof = strtok_r(NULL, ",", &lasts); 7950cb8a054bSGlenn Faden } 7951cb8a054bSGlenn Faden /* 7952cb8a054bSGlenn Faden * Now prepend the Zone Management profile at the beginning 7953cb8a054bSGlenn Faden * of the list if it is needed, and append the rest. 7954cb8a054bSGlenn Faden * Return the updated list in the original buffer. 7955cb8a054bSGlenn Faden */ 7956cb8a054bSGlenn Faden if (add && !found) { 7957cb8a054bSGlenn Faden first = B_FALSE; 7958cb8a054bSGlenn Faden (void) strlcpy(rbac_profs, ZONE_MGMT_PROF, MAXPROFS); 7959cb8a054bSGlenn Faden } else { 7960cb8a054bSGlenn Faden first = B_TRUE; 7961cb8a054bSGlenn Faden rbac_profs[0] = '\0'; 7962cb8a054bSGlenn Faden } 7963cb8a054bSGlenn Faden if (strlen(new_profs) > 0) { 7964cb8a054bSGlenn Faden if (!first) 7965cb8a054bSGlenn Faden (void) strlcat(rbac_profs, ",", MAXPROFS); 7966cb8a054bSGlenn Faden (void) strlcat(rbac_profs, new_profs, MAXPROFS); 7967cb8a054bSGlenn Faden } 7968cb8a054bSGlenn Faden } 7969cb8a054bSGlenn Faden 7970cb8a054bSGlenn Faden #define MAX_CMD_LEN 1024 7971cb8a054bSGlenn Faden 7972cb8a054bSGlenn Faden static int 7973cb8a054bSGlenn Faden do_subproc(char *zonename, char *cmdbuf) 7974cb8a054bSGlenn Faden { 7975cb8a054bSGlenn Faden char inbuf[MAX_CMD_LEN]; 7976cb8a054bSGlenn Faden FILE *file; 7977cb8a054bSGlenn Faden int status; 7978cb8a054bSGlenn Faden 7979cb8a054bSGlenn Faden file = popen(cmdbuf, "r"); 7980cb8a054bSGlenn Faden if (file == NULL) { 7981cb8a054bSGlenn Faden zerror(zonename, gettext("Could not launch: %s"), cmdbuf); 7982cb8a054bSGlenn Faden return (-1); 7983cb8a054bSGlenn Faden } 7984cb8a054bSGlenn Faden 7985cb8a054bSGlenn Faden while (fgets(inbuf, sizeof (inbuf), file) != NULL) 7986cb8a054bSGlenn Faden (void) fprintf(stderr, "%s", inbuf); 7987cb8a054bSGlenn Faden status = pclose(file); 7988cb8a054bSGlenn Faden 7989cb8a054bSGlenn Faden if (WIFSIGNALED(status)) { 7990cb8a054bSGlenn Faden zerror(zonename, gettext("%s unexpectedly terminated " 7991cb8a054bSGlenn Faden "due to signal %d"), 7992cb8a054bSGlenn Faden cmdbuf, WTERMSIG(status)); 7993cb8a054bSGlenn Faden return (-1); 7994cb8a054bSGlenn Faden } 7995cb8a054bSGlenn Faden assert(WIFEXITED(status)); 7996cb8a054bSGlenn Faden return (WEXITSTATUS(status)); 7997cb8a054bSGlenn Faden } 7998cb8a054bSGlenn Faden 7999cb8a054bSGlenn Faden /* 8000cb8a054bSGlenn Faden * This function updates the local /etc/user_attr file to 8001cb8a054bSGlenn Faden * correspond to the admin settings that are currently being 8002cb8a054bSGlenn Faden * committed. The updates are done via usermod and/or rolemod 8003cb8a054bSGlenn Faden * depending on the type of the specified user. It is also 8004cb8a054bSGlenn Faden * invoked to remove entries from user_attr corresponding to 8005cb8a054bSGlenn Faden * removed admin assignments, using an empty auths string. 8006cb8a054bSGlenn Faden * 8007cb8a054bSGlenn Faden * Because the removed entries are no longer included in the 8008cb8a054bSGlenn Faden * cofiguration that is being committed, a linked list of 8009cb8a054bSGlenn Faden * removed admin entries is maintained to keep track of such 8010cb8a054bSGlenn Faden * transactions. The head of the list is stored in the zone_dh_userauths 8011cb8a054bSGlenn Faden * element of the handle strcture. 8012cb8a054bSGlenn Faden */ 8013cb8a054bSGlenn Faden static int 8014cb8a054bSGlenn Faden zonecfg_authorize_user_impl(zone_dochandle_t handle, char *user, 8015cb8a054bSGlenn Faden char *auths, char *zonename) 8016cb8a054bSGlenn Faden { 8017cb8a054bSGlenn Faden char *right; 8018cb8a054bSGlenn Faden char old_auths[MAXAUTHS]; 8019cb8a054bSGlenn Faden char new_auths[MAXAUTHS]; 8020cb8a054bSGlenn Faden char rbac_profs[MAXPROFS]; 8021cb8a054bSGlenn Faden char *lasts; 8022cb8a054bSGlenn Faden userattr_t *u; 8023cb8a054bSGlenn Faden boolean_t first = B_TRUE; 8024cb8a054bSGlenn Faden boolean_t is_zone_admin = B_FALSE; 8025cb8a054bSGlenn Faden char user_cmd[] = "/usr/sbin/usermod"; 8026cb8a054bSGlenn Faden char role_cmd[] = "/usr/sbin/rolemod"; 8027d77d83efSGlenn Faden char *auths_cmd = user_cmd; /* either usermod or rolemod */ 8028d77d83efSGlenn Faden char *new_auth_start; /* string containing the new auths */ 8029d77d83efSGlenn Faden int new_auth_cnt = 0; /* delta of changed authorizations */ 8030cb8a054bSGlenn Faden 8031cb8a054bSGlenn Faden /* 8032cb8a054bSGlenn Faden * First get the existing authorizations for this user 8033cb8a054bSGlenn Faden */ 8034cb8a054bSGlenn Faden 8035cb8a054bSGlenn Faden bzero(&old_auths, sizeof (old_auths)); 8036cb8a054bSGlenn Faden bzero(&new_auths, sizeof (new_auths)); 8037cb8a054bSGlenn Faden bzero(&rbac_profs, sizeof (rbac_profs)); 8038cb8a054bSGlenn Faden if ((u = getusernam(user)) != NULL) { 8039cb8a054bSGlenn Faden char *current_auths; 8040cb8a054bSGlenn Faden char *current_profs; 8041cb8a054bSGlenn Faden char *type; 8042cb8a054bSGlenn Faden 8043cb8a054bSGlenn Faden type = kva_match(u->attr, USERATTR_TYPE_KW); 8044cb8a054bSGlenn Faden if (type != NULL) { 8045cb8a054bSGlenn Faden if (strcmp(type, USERATTR_TYPE_NONADMIN_KW) == 0) 8046cb8a054bSGlenn Faden auths_cmd = role_cmd; 8047cb8a054bSGlenn Faden } 8048cb8a054bSGlenn Faden 8049cb8a054bSGlenn Faden current_auths = kva_match(u->attr, USERATTR_AUTHS_KW); 8050cb8a054bSGlenn Faden if (current_auths != NULL) { 8051cb8a054bSGlenn Faden char *cur_auth; 8052cb8a054bSGlenn Faden char *delete_name; 8053cb8a054bSGlenn Faden size_t offset; 8054cb8a054bSGlenn Faden 8055cb8a054bSGlenn Faden offset = strlen(ZONE_AUTH_PREFIX); 8056cb8a054bSGlenn Faden 8057cb8a054bSGlenn Faden (void) strlcpy(old_auths, current_auths, MAXAUTHS); 8058cb8a054bSGlenn Faden cur_auth = strtok_r(current_auths, ",", &lasts); 8059cb8a054bSGlenn Faden 8060cb8a054bSGlenn Faden /* 8061cb8a054bSGlenn Faden * Next, remove any existing authorizations 8062cb8a054bSGlenn Faden * for this zone, and determine if the 8063cb8a054bSGlenn Faden * user still needs the Zone Management Profile. 8064cb8a054bSGlenn Faden */ 8065cb8a054bSGlenn Faden if (is_renaming(handle)) 8066cb8a054bSGlenn Faden delete_name = handle->zone_dh_delete_name; 8067cb8a054bSGlenn Faden else 8068cb8a054bSGlenn Faden delete_name = NULL; 8069cb8a054bSGlenn Faden while (cur_auth != NULL) { 8070cb8a054bSGlenn Faden if (!is_zone_auth(&cur_auth, zonename, 8071cb8a054bSGlenn Faden delete_name)) { 8072cb8a054bSGlenn Faden if (first) { 8073cb8a054bSGlenn Faden first = B_FALSE; 8074cb8a054bSGlenn Faden } else { 8075cb8a054bSGlenn Faden (void) strlcat(new_auths, ",", 8076cb8a054bSGlenn Faden MAXAUTHS); 8077cb8a054bSGlenn Faden } 8078cb8a054bSGlenn Faden (void) strlcat(new_auths, cur_auth, 8079cb8a054bSGlenn Faden MAXAUTHS); 8080cb8a054bSGlenn Faden /* 8081cb8a054bSGlenn Faden * If the user has authorizations 8082cb8a054bSGlenn Faden * for other zones, then set a 8083cb8a054bSGlenn Faden * flag indicate that the Zone 8084cb8a054bSGlenn Faden * Management profile should be 8085cb8a054bSGlenn Faden * preserved in user_attr. 8086cb8a054bSGlenn Faden */ 8087cb8a054bSGlenn Faden if (strncmp(cur_auth, 8088cb8a054bSGlenn Faden ZONE_AUTH_PREFIX, offset) == 0) 8089cb8a054bSGlenn Faden is_zone_admin = B_TRUE; 8090d77d83efSGlenn Faden } else { 8091d77d83efSGlenn Faden new_auth_cnt++; 8092cb8a054bSGlenn Faden } 8093cb8a054bSGlenn Faden cur_auth = strtok_r(NULL, ",", &lasts); 8094cb8a054bSGlenn Faden } 8095cb8a054bSGlenn Faden } 8096cb8a054bSGlenn Faden current_profs = kva_match(u->attr, USERATTR_PROFILES_KW); 8097cb8a054bSGlenn Faden if (current_profs != NULL) { 8098cb8a054bSGlenn Faden (void) strlcpy(rbac_profs, current_profs, MAXPROFS); 8099cb8a054bSGlenn Faden } 8100cb8a054bSGlenn Faden free_userattr(u); 8101cb8a054bSGlenn Faden } 8102cb8a054bSGlenn Faden /* 8103cb8a054bSGlenn Faden * The following is done to avoid revisiting the 8104cb8a054bSGlenn Faden * user_attr entry for this user 8105cb8a054bSGlenn Faden */ 8106cb8a054bSGlenn Faden (void) zonecfg_remove_userauths(handle, user, "", B_FALSE); 8107cb8a054bSGlenn Faden 8108cb8a054bSGlenn Faden /* 8109cb8a054bSGlenn Faden * Convert each right into a properly formatted authorization 8110cb8a054bSGlenn Faden */ 8111d77d83efSGlenn Faden new_auth_start = new_auths + strlen(new_auths); 8112d77d83efSGlenn Faden if (!first) 8113d77d83efSGlenn Faden new_auth_start++; 8114cb8a054bSGlenn Faden right = strtok_r(auths, ",", &lasts); 8115cb8a054bSGlenn Faden while (right != NULL) { 8116cb8a054bSGlenn Faden char auth[MAXAUTHS]; 8117cb8a054bSGlenn Faden 8118cb8a054bSGlenn Faden (void) snprintf(auth, MAXAUTHS, "%s%s/%s", 8119cb8a054bSGlenn Faden ZONE_AUTH_PREFIX, right, zonename); 8120cb8a054bSGlenn Faden if (first) { 8121cb8a054bSGlenn Faden first = B_FALSE; 8122cb8a054bSGlenn Faden } else { 8123cb8a054bSGlenn Faden (void) strlcat(new_auths, ",", MAXAUTHS); 8124cb8a054bSGlenn Faden } 8125cb8a054bSGlenn Faden (void) strlcat(new_auths, auth, MAXAUTHS); 8126cb8a054bSGlenn Faden is_zone_admin = B_TRUE; 8127d77d83efSGlenn Faden new_auth_cnt--; 8128cb8a054bSGlenn Faden right = strtok_r(NULL, ",", &lasts); 8129cb8a054bSGlenn Faden } 8130cb8a054bSGlenn Faden 8131cb8a054bSGlenn Faden /* 8132d77d83efSGlenn Faden * Need to update the authorizations in user_attr unless 8133d77d83efSGlenn Faden * the number of old and new authorizations is unchanged 8134d77d83efSGlenn Faden * and the new auths are a substrings of the old auths. 8135d77d83efSGlenn Faden * 8136cb8a054bSGlenn Faden * If the user's previous authorizations have changed 8137d77d83efSGlenn Faden * execute the usermod progam to update them in user_attr. 8138cb8a054bSGlenn Faden */ 8139d77d83efSGlenn Faden if ((new_auth_cnt != 0) || 8140d77d83efSGlenn Faden (strstr(old_auths, new_auth_start) == NULL)) { 8141cb8a054bSGlenn Faden char *cmdbuf; 8142cb8a054bSGlenn Faden size_t cmd_len; 8143cb8a054bSGlenn Faden 8144cb8a054bSGlenn Faden update_profiles(rbac_profs, is_zone_admin); 8145cb8a054bSGlenn Faden cmd_len = snprintf(NULL, 0, "%s -A \"%s\" -P \"%s\" %s", 8146cb8a054bSGlenn Faden auths_cmd, new_auths, rbac_profs, user) + 1; 8147cb8a054bSGlenn Faden if ((cmdbuf = malloc(cmd_len)) == NULL) { 8148cb8a054bSGlenn Faden return (Z_NOMEM); 8149cb8a054bSGlenn Faden } 8150cb8a054bSGlenn Faden (void) snprintf(cmdbuf, cmd_len, "%s -A \"%s\" -P \"%s\" %s", 8151cb8a054bSGlenn Faden auths_cmd, new_auths, rbac_profs, user); 8152cb8a054bSGlenn Faden if (do_subproc(zonename, cmdbuf) != 0) { 8153cb8a054bSGlenn Faden free(cmdbuf); 8154cb8a054bSGlenn Faden return (Z_SYSTEM); 8155cb8a054bSGlenn Faden } 8156cb8a054bSGlenn Faden free(cmdbuf); 8157cb8a054bSGlenn Faden } 8158cb8a054bSGlenn Faden 8159cb8a054bSGlenn Faden return (Z_OK); 8160cb8a054bSGlenn Faden } 8161cb8a054bSGlenn Faden 8162cb8a054bSGlenn Faden int 8163cb8a054bSGlenn Faden zonecfg_authorize_users(zone_dochandle_t handle, char *zonename) 8164cb8a054bSGlenn Faden { 8165cb8a054bSGlenn Faden xmlNodePtr cur; 8166cb8a054bSGlenn Faden int err; 8167cb8a054bSGlenn Faden char user[MAXUSERNAME]; 8168cb8a054bSGlenn Faden char auths[MAXAUTHS]; 8169cb8a054bSGlenn Faden 8170cb8a054bSGlenn Faden if ((err = operation_prep(handle)) != Z_OK) 8171cb8a054bSGlenn Faden return (err); 8172cb8a054bSGlenn Faden 8173cb8a054bSGlenn Faden cur = handle->zone_dh_cur; 8174cb8a054bSGlenn Faden for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 8175cb8a054bSGlenn Faden if (xmlStrcmp(cur->name, DTD_ELEM_ADMIN)) 8176cb8a054bSGlenn Faden continue; 8177cb8a054bSGlenn Faden if (fetchprop(cur, DTD_ATTR_USER, user, 8178cb8a054bSGlenn Faden sizeof (user)) != Z_OK) 8179cb8a054bSGlenn Faden continue; 8180cb8a054bSGlenn Faden if (fetchprop(cur, DTD_ATTR_AUTHS, auths, 8181cb8a054bSGlenn Faden sizeof (auths)) != Z_OK) 8182cb8a054bSGlenn Faden continue; 8183cb8a054bSGlenn Faden if (zonecfg_authorize_user_impl(handle, user, auths, zonename) 8184cb8a054bSGlenn Faden != Z_OK) 8185cb8a054bSGlenn Faden return (Z_SYSTEM); 8186cb8a054bSGlenn Faden } 8187cb8a054bSGlenn Faden (void) zonecfg_remove_userauths(handle, "", "", B_TRUE); 8188cb8a054bSGlenn Faden 8189cb8a054bSGlenn Faden return (Z_OK); 8190cb8a054bSGlenn Faden } 8191cb8a054bSGlenn Faden 8192cb8a054bSGlenn Faden int 8193cb8a054bSGlenn Faden zonecfg_deauthorize_user(zone_dochandle_t handle, char *user, char *zonename) 8194cb8a054bSGlenn Faden { 8195cb8a054bSGlenn Faden return (zonecfg_authorize_user_impl(handle, user, "", zonename)); 8196cb8a054bSGlenn Faden } 8197cb8a054bSGlenn Faden 8198cb8a054bSGlenn Faden int 8199cb8a054bSGlenn Faden zonecfg_deauthorize_users(zone_dochandle_t handle, char *zonename) 8200cb8a054bSGlenn Faden { 8201cb8a054bSGlenn Faden xmlNodePtr cur; 8202cb8a054bSGlenn Faden int err; 8203cb8a054bSGlenn Faden char user[MAXUSERNAME]; 8204cb8a054bSGlenn Faden 8205cb8a054bSGlenn Faden if ((err = operation_prep(handle)) != Z_OK) 8206cb8a054bSGlenn Faden return (err); 8207cb8a054bSGlenn Faden 8208cb8a054bSGlenn Faden cur = handle->zone_dh_cur; 8209cb8a054bSGlenn Faden for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) { 8210cb8a054bSGlenn Faden if (xmlStrcmp(cur->name, DTD_ELEM_ADMIN)) 8211cb8a054bSGlenn Faden continue; 8212cb8a054bSGlenn Faden if (fetchprop(cur, DTD_ATTR_USER, user, 8213cb8a054bSGlenn Faden sizeof (user)) != Z_OK) 8214cb8a054bSGlenn Faden continue; 8215cb8a054bSGlenn Faden if ((err = zonecfg_deauthorize_user(handle, user, 8216cb8a054bSGlenn Faden zonename)) != Z_OK) 8217cb8a054bSGlenn Faden return (err); 8218cb8a054bSGlenn Faden } 8219cb8a054bSGlenn Faden return (Z_OK); 8220cb8a054bSGlenn Faden } 8221cb8a054bSGlenn Faden 8222cb8a054bSGlenn Faden int 8223cb8a054bSGlenn Faden zonecfg_insert_userauths(zone_dochandle_t handle, char *user, char *zonename) 8224cb8a054bSGlenn Faden { 8225cb8a054bSGlenn Faden zone_userauths_t *new, **prev, *next; 8226cb8a054bSGlenn Faden 8227cb8a054bSGlenn Faden prev = &handle->zone_dh_userauths; 8228cb8a054bSGlenn Faden next = *prev; 8229cb8a054bSGlenn Faden while (next) { 8230cb8a054bSGlenn Faden if ((strncmp(next->user, user, MAXUSERNAME) == 0) && 8231cb8a054bSGlenn Faden (strncmp(next->zonename, zonename, 8232cb8a054bSGlenn Faden ZONENAME_MAX) == 0)) { 8233cb8a054bSGlenn Faden /* 8234cb8a054bSGlenn Faden * user is already in list 8235cb8a054bSGlenn Faden * which isn't supposed to happen! 8236cb8a054bSGlenn Faden */ 8237cb8a054bSGlenn Faden return (Z_OK); 8238cb8a054bSGlenn Faden } 8239cb8a054bSGlenn Faden prev = &next->next; 8240cb8a054bSGlenn Faden next = *prev; 8241cb8a054bSGlenn Faden } 8242cb8a054bSGlenn Faden new = (zone_userauths_t *)malloc(sizeof (zone_userauths_t)); 8243cb8a054bSGlenn Faden if (new == NULL) 8244cb8a054bSGlenn Faden return (Z_NOMEM); 8245cb8a054bSGlenn Faden 8246cb8a054bSGlenn Faden (void) strlcpy(new->user, user, sizeof (new->user)); 8247cb8a054bSGlenn Faden (void) strlcpy(new->zonename, zonename, sizeof (new->zonename)); 8248cb8a054bSGlenn Faden new->next = NULL; 8249cb8a054bSGlenn Faden *prev = new; 8250cb8a054bSGlenn Faden return (Z_OK); 8251cb8a054bSGlenn Faden } 8252cb8a054bSGlenn Faden 8253cb8a054bSGlenn Faden int 8254cb8a054bSGlenn Faden zonecfg_remove_userauths(zone_dochandle_t handle, char *user, char *zonename, 8255*d2a70789SRichard Lowe boolean_t deauthorize) 8256cb8a054bSGlenn Faden { 8257cb8a054bSGlenn Faden zone_userauths_t *new, **prev, *next; 8258cb8a054bSGlenn Faden 8259cb8a054bSGlenn Faden prev = &handle->zone_dh_userauths; 8260cb8a054bSGlenn Faden next = *prev; 8261cb8a054bSGlenn Faden 8262cb8a054bSGlenn Faden while (next) { 8263cb8a054bSGlenn Faden if ((strlen(user) == 0 || 8264cb8a054bSGlenn Faden strncmp(next->user, user, MAXUSERNAME) == 0) && 8265cb8a054bSGlenn Faden (strlen(zonename) == 0 || 8266cb8a054bSGlenn Faden (strncmp(next->zonename, zonename, ZONENAME_MAX) == 0))) { 8267cb8a054bSGlenn Faden new = next; 8268cb8a054bSGlenn Faden *prev = next->next; 8269cb8a054bSGlenn Faden next = *prev; 8270cb8a054bSGlenn Faden if (deauthorize) 8271cb8a054bSGlenn Faden (void) zonecfg_deauthorize_user(handle, 8272cb8a054bSGlenn Faden new->user, new->zonename); 8273cb8a054bSGlenn Faden free(new); 8274cb8a054bSGlenn Faden continue; 8275cb8a054bSGlenn Faden } 8276cb8a054bSGlenn Faden prev = &next->next; 8277cb8a054bSGlenn Faden next = *prev; 8278cb8a054bSGlenn Faden } 8279cb8a054bSGlenn Faden return (Z_OK); 8280cb8a054bSGlenn Faden } 8281