1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
24  */
25 
26 #include <libsysevent.h>
27 #include <pthread.h>
28 #include <stdlib.h>
29 #include <errno.h>
30 #include <fnmatch.h>
31 #include <strings.h>
32 #include <unistd.h>
33 #include <assert.h>
34 #include <libgen.h>
35 #include <libintl.h>
36 #include <alloca.h>
37 #include <ctype.h>
38 #include <sys/acl.h>
39 #include <sys/stat.h>
40 #include <sys/brand.h>
41 #include <sys/mntio.h>
42 #include <sys/mnttab.h>
43 #include <sys/nvpair.h>
44 #include <sys/types.h>
45 #include <sys/sockio.h>
46 #include <sys/systeminfo.h>
47 #include <ftw.h>
48 #include <pool.h>
49 #include <libscf.h>
50 #include <libproc.h>
51 #include <sys/priocntl.h>
52 #include <libuutil.h>
53 #include <wait.h>
54 #include <bsm/adt.h>
55 #include <auth_attr.h>
56 #include <auth_list.h>
57 #include <secdb.h>
58 #include <user_attr.h>
59 #include <prof_attr.h>
60 
61 #include <arpa/inet.h>
62 #include <netdb.h>
63 
64 #include <libxml/xmlmemory.h>
65 #include <libxml/parser.h>
66 
67 #include <libdevinfo.h>
68 #include <uuid/uuid.h>
69 #include <dirent.h>
70 #include <libbrand.h>
71 
72 #include <libzonecfg.h>
73 #include "zonecfg_impl.h"
74 
75 #define	_PATH_TMPFILE	"/zonecfg.XXXXXX"
76 #define	ZONE_CB_RETRY_COUNT		10
77 #define	ZONE_EVENT_PING_SUBCLASS	"ping"
78 #define	ZONE_EVENT_PING_PUBLISHER	"solaris"
79 
80 /* Hard-code the DTD element/attribute/entity names just once, here. */
81 #define	DTD_ELEM_ATTR		(const xmlChar *) "attr"
82 #define	DTD_ELEM_COMMENT	(const xmlChar *) "comment"
83 #define	DTD_ELEM_DEVICE		(const xmlChar *) "device"
84 #define	DTD_ELEM_FS		(const xmlChar *) "filesystem"
85 #define	DTD_ELEM_FSOPTION	(const xmlChar *) "fsoption"
86 #define	DTD_ELEM_NET		(const xmlChar *) "network"
87 #define	DTD_ELEM_RCTL		(const xmlChar *) "rctl"
88 #define	DTD_ELEM_RCTLVALUE	(const xmlChar *) "rctl-value"
89 #define	DTD_ELEM_ZONE		(const xmlChar *) "zone"
90 #define	DTD_ELEM_DATASET	(const xmlChar *) "dataset"
91 #define	DTD_ELEM_TMPPOOL	(const xmlChar *) "tmp_pool"
92 #define	DTD_ELEM_PSET		(const xmlChar *) "pset"
93 #define	DTD_ELEM_MCAP		(const xmlChar *) "mcap"
94 #define	DTD_ELEM_PACKAGE	(const xmlChar *) "package"
95 #define	DTD_ELEM_PATCH		(const xmlChar *) "patch"
96 #define	DTD_ELEM_OBSOLETES	(const xmlChar *) "obsoletes"
97 #define	DTD_ELEM_DEV_PERM	(const xmlChar *) "dev-perm"
98 #define	DTD_ELEM_ADMIN		(const xmlChar *) "admin"
99 
100 #define	DTD_ATTR_ACTION		(const xmlChar *) "action"
101 #define	DTD_ATTR_ADDRESS	(const xmlChar *) "address"
102 #define	DTD_ATTR_ALLOWED_ADDRESS	(const xmlChar *) "allowed-address"
103 #define	DTD_ATTR_AUTOBOOT	(const xmlChar *) "autoboot"
104 #define	DTD_ATTR_IPTYPE		(const xmlChar *) "ip-type"
105 #define	DTD_ATTR_DEFROUTER	(const xmlChar *) "defrouter"
106 #define	DTD_ATTR_DIR		(const xmlChar *) "directory"
107 #define	DTD_ATTR_LIMIT		(const xmlChar *) "limit"
108 #define	DTD_ATTR_LIMITPRIV	(const xmlChar *) "limitpriv"
109 #define	DTD_ATTR_BOOTARGS	(const xmlChar *) "bootargs"
110 #define	DTD_ATTR_SCHED		(const xmlChar *) "scheduling-class"
111 #define	DTD_ATTR_MATCH		(const xmlChar *) "match"
112 #define	DTD_ATTR_NAME		(const xmlChar *) "name"
113 #define	DTD_ATTR_PHYSICAL	(const xmlChar *) "physical"
114 #define	DTD_ATTR_POOL		(const xmlChar *) "pool"
115 #define	DTD_ATTR_PRIV		(const xmlChar *) "priv"
116 #define	DTD_ATTR_RAW		(const xmlChar *) "raw"
117 #define	DTD_ATTR_SPECIAL	(const xmlChar *) "special"
118 #define	DTD_ATTR_TYPE		(const xmlChar *) "type"
119 #define	DTD_ATTR_VALUE		(const xmlChar *) "value"
120 #define	DTD_ATTR_ZONEPATH	(const xmlChar *) "zonepath"
121 #define	DTD_ATTR_NCPU_MIN	(const xmlChar *) "ncpu_min"
122 #define	DTD_ATTR_NCPU_MAX	(const xmlChar *) "ncpu_max"
123 #define	DTD_ATTR_IMPORTANCE	(const xmlChar *) "importance"
124 #define	DTD_ATTR_PHYSCAP	(const xmlChar *) "physcap"
125 #define	DTD_ATTR_VERSION	(const xmlChar *) "version"
126 #define	DTD_ATTR_ID		(const xmlChar *) "id"
127 #define	DTD_ATTR_UID		(const xmlChar *) "uid"
128 #define	DTD_ATTR_GID		(const xmlChar *) "gid"
129 #define	DTD_ATTR_MODE		(const xmlChar *) "mode"
130 #define	DTD_ATTR_ACL		(const xmlChar *) "acl"
131 #define	DTD_ATTR_BRAND		(const xmlChar *) "brand"
132 #define	DTD_ATTR_HOSTID		(const xmlChar *) "hostid"
133 #define	DTD_ATTR_USER		(const xmlChar *) "user"
134 #define	DTD_ATTR_AUTHS		(const xmlChar *) "auths"
135 #define	DTD_ATTR_FS_ALLOWED	(const xmlChar *) "fs-allowed"
136 
137 #define	DTD_ENTITY_BOOLEAN	"boolean"
138 #define	DTD_ENTITY_DEVPATH	"devpath"
139 #define	DTD_ENTITY_DRIVER	"driver"
140 #define	DTD_ENTITY_DRVMIN	"drv_min"
141 #define	DTD_ENTITY_FALSE	"false"
142 #define	DTD_ENTITY_INT		"int"
143 #define	DTD_ENTITY_STRING	"string"
144 #define	DTD_ENTITY_TRUE		"true"
145 #define	DTD_ENTITY_UINT		"uint"
146 
147 #define	DTD_ENTITY_BOOL_LEN	6	/* "false" */
148 
149 #define	ATTACH_FORCED	"SUNWattached.xml"
150 
151 #define	TMP_POOL_NAME	"SUNWtmp_%s"
152 #define	MAX_TMP_POOL_NAME	(ZONENAME_MAX + 9)
153 #define	RCAP_SERVICE	"system/rcap:default"
154 #define	POOLD_SERVICE	"system/pools/dynamic:default"
155 
156 /*
157  * rctl alias definitions
158  *
159  * This holds the alias, the full rctl name, the default priv value, action
160  * and lower limit.  The functions that handle rctl aliases step through
161  * this table, matching on the alias, and using the full values for setting
162  * the rctl entry as well the limit for validation.
163  */
164 static struct alias {
165 	char *shortname;
166 	char *realname;
167 	char *priv;
168 	char *action;
169 	uint64_t low_limit;
170 } aliases[] = {
171 	{ALIAS_MAXLWPS, "zone.max-lwps", "privileged", "deny", 100},
172 	{ALIAS_MAXSHMMEM, "zone.max-shm-memory", "privileged", "deny", 0},
173 	{ALIAS_MAXSHMIDS, "zone.max-shm-ids", "privileged", "deny", 0},
174 	{ALIAS_MAXMSGIDS, "zone.max-msg-ids", "privileged", "deny", 0},
175 	{ALIAS_MAXSEMIDS, "zone.max-sem-ids", "privileged", "deny", 0},
176 	{ALIAS_MAXLOCKEDMEM, "zone.max-locked-memory", "privileged", "deny", 0},
177 	{ALIAS_MAXSWAP, "zone.max-swap", "privileged", "deny", 0},
178 	{ALIAS_SHARES, "zone.cpu-shares", "privileged", "none", 0},
179 	{ALIAS_CPUCAP, "zone.cpu-cap", "privileged", "deny", 0},
180 	{ALIAS_MAXPROCS, "zone.max-processes", "privileged", "deny", 100},
181 	{NULL, NULL, NULL, NULL, 0}
182 };
183 
184 /*
185  * Structure for applying rctls to a running zone.  It allows important
186  * process values to be passed together easily.
187  */
188 typedef struct pr_info_handle {
189 	struct ps_prochandle *pr;
190 	pid_t pid;
191 } pr_info_handle_t;
192 
193 struct zone_dochandle {
194 	char		*zone_dh_rootdir;
195 	xmlDocPtr	zone_dh_doc;
196 	xmlNodePtr	zone_dh_cur;
197 	xmlNodePtr	zone_dh_top;
198 	boolean_t	zone_dh_newzone;
199 	boolean_t	zone_dh_snapshot;
200 	boolean_t	zone_dh_sw_inv;
201 	zone_userauths_t	*zone_dh_userauths;
202 	char		zone_dh_delete_name[ZONENAME_MAX];
203 };
204 
205 struct znotify {
206 	void * zn_private;
207 	evchan_t *zn_eventchan;
208 	int (*zn_callback)(const  char *zonename, zoneid_t zid,
209 	    const char *newstate, const char *oldstate, hrtime_t when, void *p);
210 	pthread_mutex_t zn_mutex;
211 	pthread_cond_t zn_cond;
212 	pthread_mutex_t zn_bigmutex;
213 	volatile enum {ZN_UNLOCKED, ZN_LOCKED, ZN_PING_INFLIGHT,
214 	    ZN_PING_RECEIVED} zn_state;
215 	char zn_subscriber_id[MAX_SUBID_LEN];
216 	volatile boolean_t zn_failed;
217 	int zn_failure_count;
218 };
219 
220 /* used to track nested zone-lock operations */
221 static int zone_lock_cnt = 0;
222 
223 /* used to communicate lock status to children */
224 #define	LOCK_ENV_VAR	"_ZONEADM_LOCK_HELD"
225 static char zoneadm_lock_held[] = LOCK_ENV_VAR"=1";
226 static char zoneadm_lock_not_held[] = LOCK_ENV_VAR"=0";
227 
228 char *zonecfg_root = "";
229 
230 /*
231  * For functions which return int, which is most of the functions herein,
232  * the return values should be from the Z_foo set defined in <libzonecfg.h>.
233  * In some instances, we take pains mapping some libc errno values to Z_foo
234  * values from this set.
235  */
236 
237 /*
238  * Set the root (/) path for all zonecfg configuration files.  This is a
239  * private interface used by Live Upgrade extensions to access zone
240  * configuration inside mounted alternate boot environments.
241  * This interface is also used by zoneadm mount and unmount subcommands.
242  */
243 void
244 zonecfg_set_root(const char *rootpath)
245 {
246 	if (*zonecfg_root != '\0')
247 		free(zonecfg_root);
248 	if (rootpath == NULL || rootpath[0] == '\0' || rootpath[1] == '\0' ||
249 	    (zonecfg_root = strdup(rootpath)) == NULL)
250 		zonecfg_root = "";
251 }
252 
253 const char *
254 zonecfg_get_root(void)
255 {
256 	return (zonecfg_root);
257 }
258 
259 boolean_t
260 zonecfg_in_alt_root(void)
261 {
262 	return (*zonecfg_root != '\0');
263 }
264 
265 /*
266  * Callers of the _file_path() functions are expected to have the second
267  * parameter be a (char foo[MAXPATHLEN]).
268  */
269 
270 static boolean_t
271 config_file_path(const char *zonename, char *answer)
272 {
273 	return (snprintf(answer, MAXPATHLEN, "%s%s/%s.xml", zonecfg_root,
274 	    ZONE_CONFIG_ROOT, zonename) < MAXPATHLEN);
275 }
276 
277 static boolean_t
278 snap_file_path(const char *zonename, char *answer)
279 {
280 	return (snprintf(answer, MAXPATHLEN, "%s%s/%s.snapshot.xml",
281 	    zonecfg_root, ZONE_SNAPSHOT_ROOT, zonename) < MAXPATHLEN);
282 }
283 
284 /*ARGSUSED*/
285 static void
286 zonecfg_error_func(void *ctx, const char *msg, ...)
287 {
288 	/*
289 	 * This function does nothing by design.  Its purpose is to prevent
290 	 * libxml from dumping unwanted messages to stdout/stderr.
291 	 */
292 }
293 
294 zone_dochandle_t
295 zonecfg_init_handle(void)
296 {
297 	zone_dochandle_t handle = calloc(1, sizeof (struct zone_dochandle));
298 	if (handle == NULL) {
299 		errno = Z_NOMEM;
300 		return (NULL);
301 	}
302 
303 	/* generic libxml initialization */
304 	(void) xmlLineNumbersDefault(1);
305 	xmlLoadExtDtdDefaultValue |= XML_DETECT_IDS;
306 	xmlDoValidityCheckingDefaultValue = 1;
307 	(void) xmlKeepBlanksDefault(0);
308 	xmlGetWarningsDefaultValue = 0;
309 	xmlSetGenericErrorFunc(NULL, zonecfg_error_func);
310 
311 	return (handle);
312 }
313 
314 int
315 zonecfg_check_handle(zone_dochandle_t handle)
316 {
317 	if (handle == NULL || handle->zone_dh_doc == NULL)
318 		return (Z_BAD_HANDLE);
319 	return (Z_OK);
320 }
321 
322 void
323 zonecfg_fini_handle(zone_dochandle_t handle)
324 {
325 	if (zonecfg_check_handle(handle) == Z_OK)
326 		xmlFreeDoc(handle->zone_dh_doc);
327 	if (handle != NULL)
328 		free(handle);
329 }
330 
331 static int
332 zonecfg_destroy_impl(char *filename)
333 {
334 	if (unlink(filename) == -1) {
335 		if (errno == EACCES)
336 			return (Z_ACCES);
337 		if (errno == ENOENT)
338 			return (Z_NO_ZONE);
339 		return (Z_MISC_FS);
340 	}
341 	return (Z_OK);
342 }
343 
344 int
345 zonecfg_destroy(const char *zonename, boolean_t force)
346 {
347 	char path[MAXPATHLEN];
348 	struct zoneent ze;
349 	int err, state_err;
350 	zone_state_t state;
351 
352 	if (!config_file_path(zonename, path))
353 		return (Z_MISC_FS);
354 
355 	state_err = zone_get_state((char *)zonename, &state);
356 	err = access(path, W_OK);
357 
358 	/*
359 	 * If there is no file, and no index entry, reliably indicate that no
360 	 * such zone exists.
361 	 */
362 	if ((state_err == Z_NO_ZONE) && (err == -1) && (errno == ENOENT))
363 		return (Z_NO_ZONE);
364 
365 	/*
366 	 * Handle any other filesystem related errors (except if the XML
367 	 * file is missing, which we treat silently), unless we're forcing,
368 	 * in which case we plow on.
369 	 */
370 	if (err == -1 && errno != ENOENT) {
371 		if (errno == EACCES)
372 			return (Z_ACCES);
373 		else if (!force)
374 			return (Z_MISC_FS);
375 	}
376 
377 	if (state > ZONE_STATE_INSTALLED)
378 		return (Z_BAD_ZONE_STATE);
379 
380 	if (!force && state > ZONE_STATE_CONFIGURED)
381 		return (Z_BAD_ZONE_STATE);
382 
383 	/*
384 	 * Index deletion succeeds even if the entry doesn't exist.  So this
385 	 * will fail only if we've had some more severe problem.
386 	 */
387 	bzero(&ze, sizeof (ze));
388 	(void) strlcpy(ze.zone_name, zonename, sizeof (ze.zone_name));
389 	if ((err = putzoneent(&ze, PZE_REMOVE)) != Z_OK)
390 		if (!force)
391 			return (err);
392 
393 	err = zonecfg_destroy_impl(path);
394 
395 	/*
396 	 * Treat failure to find the XML file silently, since, well, it's
397 	 * gone, and with the index file cleaned up, we're done.
398 	 */
399 	if (err == Z_OK || err == Z_NO_ZONE)
400 		return (Z_OK);
401 	return (err);
402 }
403 
404 int
405 zonecfg_destroy_snapshot(const char *zonename)
406 {
407 	char path[MAXPATHLEN];
408 
409 	if (!snap_file_path(zonename, path))
410 		return (Z_MISC_FS);
411 	return (zonecfg_destroy_impl(path));
412 }
413 
414 static int
415 getroot(zone_dochandle_t handle, xmlNodePtr *root)
416 {
417 	if (zonecfg_check_handle(handle) == Z_BAD_HANDLE)
418 		return (Z_BAD_HANDLE);
419 
420 	*root = xmlDocGetRootElement(handle->zone_dh_doc);
421 
422 	if (*root == NULL)
423 		return (Z_EMPTY_DOCUMENT);
424 
425 	if (xmlStrcmp((*root)->name, DTD_ELEM_ZONE))
426 		return (Z_WRONG_DOC_TYPE);
427 
428 	return (Z_OK);
429 }
430 
431 static int
432 operation_prep(zone_dochandle_t handle)
433 {
434 	xmlNodePtr root;
435 	int err;
436 
437 	if ((err = getroot(handle, &root)) != 0)
438 		return (err);
439 
440 	handle->zone_dh_cur = root;
441 	handle->zone_dh_top = root;
442 	return (Z_OK);
443 }
444 
445 static int
446 fetchprop(xmlNodePtr cur, const xmlChar *propname, char *dst, size_t dstsize)
447 {
448 	xmlChar *property;
449 	size_t srcsize;
450 
451 	if ((property = xmlGetProp(cur, propname)) == NULL)
452 		return (Z_BAD_PROPERTY);
453 	srcsize = strlcpy(dst, (char *)property, dstsize);
454 	xmlFree(property);
455 	if (srcsize >= dstsize)
456 		return (Z_TOO_BIG);
457 	return (Z_OK);
458 }
459 
460 static int
461 fetch_alloc_prop(xmlNodePtr cur, const xmlChar *propname, char **dst)
462 {
463 	xmlChar *property;
464 
465 	if ((property = xmlGetProp(cur, propname)) == NULL)
466 		return (Z_BAD_PROPERTY);
467 	if ((*dst = strdup((char *)property)) == NULL) {
468 		xmlFree(property);
469 		return (Z_NOMEM);
470 	}
471 	xmlFree(property);
472 	return (Z_OK);
473 }
474 
475 static int
476 getrootattr(zone_dochandle_t handle, const xmlChar *propname,
477     char *propval, size_t propsize)
478 {
479 	xmlNodePtr root;
480 	int err;
481 
482 	if ((err = getroot(handle, &root)) != 0)
483 		return (err);
484 
485 	return (fetchprop(root, propname, propval, propsize));
486 }
487 
488 static int
489 get_alloc_rootattr(zone_dochandle_t handle, const xmlChar *propname,
490     char **propval)
491 {
492 	xmlNodePtr root;
493 	int err;
494 
495 	if ((err = getroot(handle, &root)) != 0)
496 		return (err);
497 
498 	return (fetch_alloc_prop(root, propname, propval));
499 }
500 
501 static int
502 setrootattr(zone_dochandle_t handle, const xmlChar *propname,
503     const char *propval)
504 {
505 	int err;
506 	xmlNodePtr root;
507 
508 	if ((err = getroot(handle, &root)) != Z_OK)
509 		return (err);
510 
511 	/*
512 	 * If we get a null propval remove the property (ignore return since it
513 	 * may not be set to begin with).
514 	 */
515 	if (propval == NULL) {
516 		(void) xmlUnsetProp(root, propname);
517 	} else {
518 		if (xmlSetProp(root, propname, (const xmlChar *) propval)
519 		    == NULL)
520 			return (Z_INVAL);
521 	}
522 	return (Z_OK);
523 }
524 
525 static void
526 addcomment(zone_dochandle_t handle, const char *comment)
527 {
528 	xmlNodePtr node;
529 	node = xmlNewComment((xmlChar *) comment);
530 
531 	if (node != NULL)
532 		(void) xmlAddPrevSibling(handle->zone_dh_top, node);
533 }
534 
535 static void
536 stripcomments(zone_dochandle_t handle)
537 {
538 	xmlDocPtr top;
539 	xmlNodePtr child, next;
540 
541 	top = handle->zone_dh_doc;
542 	for (child = top->xmlChildrenNode; child != NULL; child = next) {
543 		next = child->next;
544 		if (child->name == NULL)
545 			continue;
546 		if (xmlStrcmp(child->name, DTD_ELEM_COMMENT) == 0) {
547 			next = child->next;
548 			xmlUnlinkNode(child);
549 			xmlFreeNode(child);
550 		}
551 	}
552 }
553 
554 static void
555 strip_sw_inv(zone_dochandle_t handle)
556 {
557 	xmlNodePtr root, child, next;
558 
559 	root = xmlDocGetRootElement(handle->zone_dh_doc);
560 	for (child = root->xmlChildrenNode; child != NULL; child = next) {
561 		next = child->next;
562 		if (child->name == NULL)
563 			continue;
564 		if (xmlStrcmp(child->name, DTD_ELEM_PACKAGE) == 0 ||
565 		    xmlStrcmp(child->name, DTD_ELEM_PATCH) == 0) {
566 			next = child->next;
567 			xmlUnlinkNode(child);
568 			xmlFreeNode(child);
569 		}
570 	}
571 }
572 
573 static int
574 zonecfg_get_handle_impl(const char *zonename, const char *filename,
575     zone_dochandle_t handle)
576 {
577 	xmlValidCtxtPtr cvp;
578 	struct stat statbuf;
579 	int valid;
580 
581 	if (zonename == NULL)
582 		return (Z_NO_ZONE);
583 
584 	if ((handle->zone_dh_doc = xmlParseFile(filename)) == NULL) {
585 		/* distinguish file not found vs. found but not parsed */
586 		if (stat(filename, &statbuf) == 0)
587 			return (Z_INVALID_DOCUMENT);
588 		return (Z_NO_ZONE);
589 	}
590 	if ((cvp = xmlNewValidCtxt()) == NULL)
591 		return (Z_NOMEM);
592 	cvp->error = zonecfg_error_func;
593 	cvp->warning = zonecfg_error_func;
594 	valid = xmlValidateDocument(cvp, handle->zone_dh_doc);
595 	xmlFreeValidCtxt(cvp);
596 	if (valid == 0)
597 		return (Z_INVALID_DOCUMENT);
598 
599 	/* delete any comments such as inherited Sun copyright / ident str */
600 	stripcomments(handle);
601 	return (Z_OK);
602 }
603 
604 int
605 zonecfg_get_handle(const char *zonename, zone_dochandle_t handle)
606 {
607 	char path[MAXPATHLEN];
608 
609 	if (!config_file_path(zonename, path))
610 		return (Z_MISC_FS);
611 	handle->zone_dh_newzone = B_FALSE;
612 
613 	return (zonecfg_get_handle_impl(zonename, path, handle));
614 }
615 
616 int
617 zonecfg_get_attach_handle(const char *path, const char *fname,
618     const char *zonename, boolean_t preserve_sw, zone_dochandle_t handle)
619 {
620 	char		migpath[MAXPATHLEN];
621 	int		err;
622 	struct stat	buf;
623 
624 	if (snprintf(migpath, sizeof (migpath), "%s/root", path) >=
625 	    sizeof (migpath))
626 		return (Z_NOMEM);
627 
628 	if (stat(migpath, &buf) == -1 || !S_ISDIR(buf.st_mode))
629 		return (Z_NO_ZONE);
630 
631 	if (snprintf(migpath, sizeof (migpath), "%s/%s", path, fname) >=
632 	    sizeof (migpath))
633 		return (Z_NOMEM);
634 
635 	if ((err = zonecfg_get_handle_impl(zonename, migpath, handle)) != Z_OK)
636 		return (err);
637 
638 	if (!preserve_sw)
639 		strip_sw_inv(handle);
640 
641 	handle->zone_dh_newzone = B_TRUE;
642 	if ((err = setrootattr(handle, DTD_ATTR_ZONEPATH, path)) != Z_OK)
643 		return (err);
644 
645 	return (setrootattr(handle, DTD_ATTR_NAME, zonename));
646 }
647 
648 int
649 zonecfg_get_snapshot_handle(const char *zonename, zone_dochandle_t handle)
650 {
651 	char path[MAXPATHLEN];
652 
653 	if (!snap_file_path(zonename, path))
654 		return (Z_MISC_FS);
655 	handle->zone_dh_newzone = B_FALSE;
656 	return (zonecfg_get_handle_impl(zonename, path, handle));
657 }
658 
659 int
660 zonecfg_get_template_handle(const char *template, const char *zonename,
661     zone_dochandle_t handle)
662 {
663 	char path[MAXPATHLEN];
664 	int err;
665 
666 	if (!config_file_path(template, path))
667 		return (Z_MISC_FS);
668 
669 	if ((err = zonecfg_get_handle_impl(template, path, handle)) != Z_OK)
670 		return (err);
671 	handle->zone_dh_newzone = B_TRUE;
672 	return (setrootattr(handle, DTD_ATTR_NAME, zonename));
673 }
674 
675 int
676 zonecfg_get_xml_handle(const char *path, zone_dochandle_t handle)
677 {
678 	struct stat buf;
679 	int err;
680 
681 	if (stat(path, &buf) == -1)
682 		return (Z_MISC_FS);
683 
684 	if ((err = zonecfg_get_handle_impl("xml", path, handle)) != Z_OK)
685 		return (err);
686 	handle->zone_dh_newzone = B_TRUE;
687 	return (Z_OK);
688 }
689 
690 /*
691  * Initialize two handles from the manifest read on fd.  The rem_handle
692  * is initialized from the input file, including the sw inventory.  The
693  * local_handle is initialized with the same zone configuration but with
694  * no sw inventory.
695  */
696 int
697 zonecfg_attach_manifest(int fd, zone_dochandle_t local_handle,
698     zone_dochandle_t rem_handle)
699 {
700 	xmlValidCtxtPtr cvp;
701 	int valid;
702 
703 	/* load the manifest into the handle for the remote system */
704 	if ((rem_handle->zone_dh_doc = xmlReadFd(fd, NULL, NULL, 0)) == NULL) {
705 		return (Z_INVALID_DOCUMENT);
706 	}
707 	if ((cvp = xmlNewValidCtxt()) == NULL)
708 		return (Z_NOMEM);
709 	cvp->error = zonecfg_error_func;
710 	cvp->warning = zonecfg_error_func;
711 	valid = xmlValidateDocument(cvp, rem_handle->zone_dh_doc);
712 	xmlFreeValidCtxt(cvp);
713 	if (valid == 0)
714 		return (Z_INVALID_DOCUMENT);
715 
716 	/* delete any comments such as inherited Sun copyright / ident str */
717 	stripcomments(rem_handle);
718 
719 	rem_handle->zone_dh_newzone = B_TRUE;
720 	rem_handle->zone_dh_sw_inv = B_TRUE;
721 
722 	/*
723 	 * Now use the remote system handle to generate a local system handle
724 	 * with an identical zones configuration but no sw inventory.
725 	 */
726 	if ((local_handle->zone_dh_doc = xmlCopyDoc(rem_handle->zone_dh_doc,
727 	    1)) == NULL) {
728 		return (Z_INVALID_DOCUMENT);
729 	}
730 
731 	/*
732 	 * We need to re-run xmlValidateDocument on local_handle to properly
733 	 * update the in-core representation of the configuration.
734 	 */
735 	if ((cvp = xmlNewValidCtxt()) == NULL)
736 		return (Z_NOMEM);
737 	cvp->error = zonecfg_error_func;
738 	cvp->warning = zonecfg_error_func;
739 	valid = xmlValidateDocument(cvp, local_handle->zone_dh_doc);
740 	xmlFreeValidCtxt(cvp);
741 	if (valid == 0)
742 		return (Z_INVALID_DOCUMENT);
743 
744 	strip_sw_inv(local_handle);
745 
746 	local_handle->zone_dh_newzone = B_TRUE;
747 	local_handle->zone_dh_sw_inv = B_FALSE;
748 
749 	return (Z_OK);
750 }
751 
752 static boolean_t
753 is_renaming(zone_dochandle_t handle)
754 {
755 	if (handle->zone_dh_newzone)
756 		return (B_FALSE);
757 	if (strlen(handle->zone_dh_delete_name) > 0)
758 		return (B_TRUE);
759 	return (B_FALSE);
760 }
761 
762 static boolean_t
763 is_new(zone_dochandle_t handle)
764 {
765 	return (handle->zone_dh_newzone || handle->zone_dh_snapshot);
766 }
767 
768 static boolean_t
769 is_snapshot(zone_dochandle_t handle)
770 {
771 	return (handle->zone_dh_snapshot);
772 }
773 
774 /*
775  * It would be great to be able to use libc's ctype(3c) macros, but we
776  * can't, as they are locale sensitive, and it would break our limited thread
777  * safety if this routine had to change the app locale on the fly.
778  */
779 int
780 zonecfg_validate_zonename(const char *zone)
781 {
782 	int i;
783 
784 	if (strcmp(zone, GLOBAL_ZONENAME) == 0)
785 		return (Z_BOGUS_ZONE_NAME);
786 
787 	if (strlen(zone) >= ZONENAME_MAX)
788 		return (Z_BOGUS_ZONE_NAME);
789 
790 	if (!((zone[0] >= 'a' && zone[0] <= 'z') ||
791 	    (zone[0] >= 'A' && zone[0] <= 'Z') ||
792 	    (zone[0] >= '0' && zone[0] <= '9')))
793 		return (Z_BOGUS_ZONE_NAME);
794 
795 	for (i = 1; zone[i] != '\0'; i++) {
796 		if (!((zone[i] >= 'a' && zone[i] <= 'z') ||
797 		    (zone[i] >= 'A' && zone[i] <= 'Z') ||
798 		    (zone[i] >= '0' && zone[i] <= '9') ||
799 		    (zone[i] == '-') || (zone[i] == '_') || (zone[i] == '.')))
800 			return (Z_BOGUS_ZONE_NAME);
801 	}
802 
803 	return (Z_OK);
804 }
805 
806 /*
807  * Changing the zone name requires us to track both the old and new
808  * name of the zone until commit time.
809  */
810 int
811 zonecfg_get_name(zone_dochandle_t handle, char *name, size_t namesize)
812 {
813 	return (getrootattr(handle, DTD_ATTR_NAME, name, namesize));
814 }
815 
816 static int
817 insert_admins(zone_dochandle_t handle, char *zonename)
818 {
819 	int err;
820 	struct zone_admintab admintab;
821 
822 	if ((err = zonecfg_setadminent(handle)) != Z_OK) {
823 		return (err);
824 	}
825 	while (zonecfg_getadminent(handle, &admintab) == Z_OK) {
826 		err = zonecfg_insert_userauths(handle,
827 		    admintab.zone_admin_user, zonename);
828 		if (err != Z_OK) {
829 			(void) zonecfg_endadminent(handle);
830 			return (err);
831 		}
832 	}
833 	(void) zonecfg_endadminent(handle);
834 	return (Z_OK);
835 }
836 
837 int
838 zonecfg_set_name(zone_dochandle_t handle, char *name)
839 {
840 	zone_state_t state;
841 	char curname[ZONENAME_MAX], old_delname[ZONENAME_MAX];
842 	int err;
843 
844 	if ((err = getrootattr(handle, DTD_ATTR_NAME, curname,
845 	    sizeof (curname))) != Z_OK)
846 		return (err);
847 
848 	if (strcmp(name, curname) == 0)
849 		return (Z_OK);
850 
851 	/*
852 	 * Switching zone names to one beginning with SUNW is not permitted.
853 	 */
854 	if (strncmp(name, "SUNW", 4) == 0)
855 		return (Z_BOGUS_ZONE_NAME);
856 
857 	if ((err = zonecfg_validate_zonename(name)) != Z_OK)
858 		return (err);
859 
860 	/*
861 	 * Setting the name back to the original name (effectively a revert of
862 	 * the name) is fine.  But if we carry on, we'll falsely identify the
863 	 * name as "in use," so special case here.
864 	 */
865 	if (strcmp(name, handle->zone_dh_delete_name) == 0) {
866 		err = setrootattr(handle, DTD_ATTR_NAME, name);
867 		handle->zone_dh_delete_name[0] = '\0';
868 		return (err);
869 	}
870 
871 	/* Check to see if new name chosen is already in use */
872 	if (zone_get_state(name, &state) != Z_NO_ZONE)
873 		return (Z_NAME_IN_USE);
874 
875 	/*
876 	 * If this isn't already "new" or in a renaming transition, then
877 	 * we're initiating a rename here; so stash the "delete name"
878 	 * (i.e. the name of the zone we'll be removing) for the rename.
879 	 */
880 	(void) strlcpy(old_delname, handle->zone_dh_delete_name,
881 	    sizeof (old_delname));
882 	if (!is_new(handle) && !is_renaming(handle)) {
883 		/*
884 		 * Name change is allowed only when the zone we're altering
885 		 * is not ready or running.
886 		 */
887 		err = zone_get_state(curname, &state);
888 		if (err == Z_OK) {
889 			if (state > ZONE_STATE_INSTALLED)
890 				return (Z_BAD_ZONE_STATE);
891 		} else if (err != Z_NO_ZONE) {
892 			return (err);
893 		}
894 
895 		(void) strlcpy(handle->zone_dh_delete_name, curname,
896 		    sizeof (handle->zone_dh_delete_name));
897 		assert(is_renaming(handle));
898 	} else if (is_renaming(handle)) {
899 		err = zone_get_state(handle->zone_dh_delete_name, &state);
900 		if (err == Z_OK) {
901 			if (state > ZONE_STATE_INSTALLED)
902 				return (Z_BAD_ZONE_STATE);
903 		} else if (err != Z_NO_ZONE) {
904 			return (err);
905 		}
906 	}
907 
908 	if ((err = setrootattr(handle, DTD_ATTR_NAME, name)) != Z_OK) {
909 		/*
910 		 * Restore the deletename to whatever it was at the
911 		 * top of the routine, since we've had a failure.
912 		 */
913 		(void) strlcpy(handle->zone_dh_delete_name, old_delname,
914 		    sizeof (handle->zone_dh_delete_name));
915 		return (err);
916 	}
917 
918 	/*
919 	 * Record the old admins from the old zonename
920 	 * so that they can be deleted when the operation is committed.
921 	 */
922 	if ((err = insert_admins(handle, curname)) != Z_OK)
923 		return (err);
924 	else
925 		return (Z_OK);
926 }
927 
928 int
929 zonecfg_get_zonepath(zone_dochandle_t handle, char *path, size_t pathsize)
930 {
931 	size_t len;
932 
933 	if ((len = strlcpy(path, zonecfg_root, pathsize)) >= pathsize)
934 		return (Z_TOO_BIG);
935 	return (getrootattr(handle, DTD_ATTR_ZONEPATH, path + len,
936 	    pathsize - len));
937 }
938 
939 int
940 zonecfg_set_zonepath(zone_dochandle_t handle, char *zonepath)
941 {
942 	size_t len;
943 	char *modpath, *copy_mp, *curr_mp;	/* modified path ptrs */
944 	char last_copied;
945 	int ret;
946 
947 	/*
948 	 * Collapse multiple contiguous slashes and remove trailing slash.
949 	 */
950 	modpath = strdup(zonepath);
951 	if (modpath == NULL)
952 		return (Z_NOMEM);
953 	last_copied = '\0';
954 	for (copy_mp = curr_mp = modpath; *curr_mp != '\0'; curr_mp++) {
955 		if (*curr_mp != '/' || last_copied != '/') {
956 			last_copied = *copy_mp = *curr_mp;
957 			copy_mp++;
958 		}
959 	}
960 	if (last_copied == '/')
961 		copy_mp--;
962 	*copy_mp = '\0';
963 
964 	/*
965 	 * The user deals in absolute paths in the running global zone, but the
966 	 * internal configuration files deal with boot environment relative
967 	 * paths.  Strip out the alternate root when specified.
968 	 */
969 	len = strlen(zonecfg_root);
970 	if (strncmp(modpath, zonecfg_root, len) != 0 || modpath[len] != '/') {
971 		free(modpath);
972 		return (Z_BAD_PROPERTY);
973 	}
974 	curr_mp = modpath + len;
975 	ret = setrootattr(handle, DTD_ATTR_ZONEPATH, curr_mp);
976 	free(modpath);
977 	return (ret);
978 }
979 
980 static int
981 i_zonecfg_get_brand(zone_dochandle_t handle, char *brand, size_t brandsize,
982     boolean_t default_query)
983 {
984 	int ret, sz;
985 
986 	ret = getrootattr(handle, DTD_ATTR_BRAND, brand, brandsize);
987 
988 	/*
989 	 * If the lookup failed, or succeeded in finding a non-null brand
990 	 * string then return.
991 	 */
992 	if (ret != Z_OK || brand[0] != '\0')
993 		return (ret);
994 
995 	if (!default_query) {
996 		/* If the zone has no brand, it is the default brand. */
997 		return (zonecfg_default_brand(brand, brandsize));
998 	}
999 
1000 	/* if SUNWdefault didn't specify a brand, fallback to "native" */
1001 	sz = strlcpy(brand, NATIVE_BRAND_NAME, brandsize);
1002 	if (sz >= brandsize)
1003 		return (Z_TOO_BIG);
1004 	return (Z_OK);
1005 }
1006 
1007 int
1008 zonecfg_get_brand(zone_dochandle_t handle, char *brand, size_t brandsize)
1009 {
1010 	return (i_zonecfg_get_brand(handle, brand, brandsize, B_FALSE));
1011 }
1012 
1013 int
1014 zonecfg_set_brand(zone_dochandle_t handle, char *brand)
1015 {
1016 	return (setrootattr(handle, DTD_ATTR_BRAND, brand));
1017 }
1018 
1019 int
1020 zonecfg_get_autoboot(zone_dochandle_t handle, boolean_t *autoboot)
1021 {
1022 	char autobootstr[DTD_ENTITY_BOOL_LEN];
1023 	int ret;
1024 
1025 	if ((ret = getrootattr(handle, DTD_ATTR_AUTOBOOT, autobootstr,
1026 	    sizeof (autobootstr))) != Z_OK)
1027 		return (ret);
1028 
1029 	if (strcmp(autobootstr, DTD_ENTITY_TRUE) == 0)
1030 		*autoboot = B_TRUE;
1031 	else if (strcmp(autobootstr, DTD_ENTITY_FALSE) == 0)
1032 		*autoboot = B_FALSE;
1033 	else
1034 		ret = Z_BAD_PROPERTY;
1035 	return (ret);
1036 }
1037 
1038 int
1039 zonecfg_set_autoboot(zone_dochandle_t handle, boolean_t autoboot)
1040 {
1041 	return (setrootattr(handle, DTD_ATTR_AUTOBOOT,
1042 	    autoboot ? DTD_ENTITY_TRUE : DTD_ENTITY_FALSE));
1043 }
1044 
1045 int
1046 zonecfg_get_pool(zone_dochandle_t handle, char *pool, size_t poolsize)
1047 {
1048 	return (getrootattr(handle, DTD_ATTR_POOL, pool, poolsize));
1049 }
1050 
1051 int
1052 zonecfg_set_pool(zone_dochandle_t handle, char *pool)
1053 {
1054 	return (setrootattr(handle, DTD_ATTR_POOL, pool));
1055 }
1056 
1057 int
1058 zonecfg_get_limitpriv(zone_dochandle_t handle, char **limitpriv)
1059 {
1060 	return (get_alloc_rootattr(handle, DTD_ATTR_LIMITPRIV, limitpriv));
1061 }
1062 
1063 int
1064 zonecfg_set_limitpriv(zone_dochandle_t handle, char *limitpriv)
1065 {
1066 	return (setrootattr(handle, DTD_ATTR_LIMITPRIV, limitpriv));
1067 }
1068 
1069 int
1070 zonecfg_get_bootargs(zone_dochandle_t handle, char *bargs, size_t bargssize)
1071 {
1072 	return (getrootattr(handle, DTD_ATTR_BOOTARGS, bargs, bargssize));
1073 }
1074 
1075 int
1076 zonecfg_set_bootargs(zone_dochandle_t handle, char *bargs)
1077 {
1078 	return (setrootattr(handle, DTD_ATTR_BOOTARGS, bargs));
1079 }
1080 
1081 int
1082 zonecfg_get_sched_class(zone_dochandle_t handle, char *sched, size_t schedsize)
1083 {
1084 	return (getrootattr(handle, DTD_ATTR_SCHED, sched, schedsize));
1085 }
1086 
1087 int
1088 zonecfg_set_sched(zone_dochandle_t handle, char *sched)
1089 {
1090 	return (setrootattr(handle, DTD_ATTR_SCHED, sched));
1091 }
1092 
1093 /*
1094  * /etc/zones/index caches a vital piece of information which is also
1095  * in the <zonename>.xml file: the path to the zone.  This is for performance,
1096  * since we need to walk all zonepath's in order to be able to detect conflicts
1097  * (see crosscheck_zonepaths() in the zoneadm command).
1098  *
1099  * An additional complexity is that when doing a rename, we'd like the entire
1100  * index update operation (rename, and potential state changes) to be atomic.
1101  * In general, the operation of this function should succeed or fail as
1102  * a unit.
1103  */
1104 int
1105 zonecfg_refresh_index_file(zone_dochandle_t handle)
1106 {
1107 	char name[ZONENAME_MAX], zonepath[MAXPATHLEN];
1108 	struct zoneent ze;
1109 	int err;
1110 	int opcode;
1111 	char *zn;
1112 
1113 	bzero(&ze, sizeof (ze));
1114 	ze.zone_state = -1;	/* Preserve existing state in index */
1115 
1116 	if ((err = zonecfg_get_name(handle, name, sizeof (name))) != Z_OK)
1117 		return (err);
1118 	(void) strlcpy(ze.zone_name, name, sizeof (ze.zone_name));
1119 
1120 	if ((err = zonecfg_get_zonepath(handle, zonepath,
1121 	    sizeof (zonepath))) != Z_OK)
1122 		return (err);
1123 	(void) strlcpy(ze.zone_path, zonepath + strlen(zonecfg_root),
1124 	    sizeof (ze.zone_path));
1125 
1126 	if (is_renaming(handle)) {
1127 		opcode = PZE_MODIFY;
1128 		(void) strlcpy(ze.zone_name, handle->zone_dh_delete_name,
1129 		    sizeof (ze.zone_name));
1130 		(void) strlcpy(ze.zone_newname, name, sizeof (ze.zone_newname));
1131 	} else if (is_new(handle)) {
1132 		FILE *cookie;
1133 		/*
1134 		 * Be tolerant of the zone already existing in the index file,
1135 		 * since we might be forcibly overwriting an existing
1136 		 * configuration with a new one (for example 'create -F'
1137 		 * in zonecfg).
1138 		 */
1139 		opcode = PZE_ADD;
1140 		cookie = setzoneent();
1141 		while ((zn = getzoneent(cookie)) != NULL) {
1142 			if (strcmp(zn, name) == 0) {
1143 				opcode = PZE_MODIFY;
1144 				free(zn);
1145 				break;
1146 			}
1147 			free(zn);
1148 		}
1149 		endzoneent(cookie);
1150 		ze.zone_state = ZONE_STATE_CONFIGURED;
1151 	} else {
1152 		opcode = PZE_MODIFY;
1153 	}
1154 
1155 	if ((err = putzoneent(&ze, opcode)) != Z_OK)
1156 		return (err);
1157 
1158 	return (Z_OK);
1159 }
1160 
1161 /*
1162  * The goal of this routine is to cause the index file update and the
1163  * document save to happen as an atomic operation.  We do the document
1164  * first, saving a backup copy using a hard link; if that succeeds, we go
1165  * on to the index.  If that fails, we roll the document back into place.
1166  *
1167  * Strategy:
1168  *
1169  * New zone 'foo' configuration:
1170  * 	Create tmpfile (zonecfg.xxxxxx)
1171  * 	Write XML to tmpfile
1172  * 	Rename tmpfile to xmlfile (zonecfg.xxxxxx -> foo.xml)
1173  * 	Add entry to index file
1174  * 	If it fails, delete foo.xml, leaving nothing behind.
1175  *
1176  * Save existing zone 'foo':
1177  * 	Make backup of foo.xml -> .backup
1178  * 	Create tmpfile (zonecfg.xxxxxx)
1179  * 	Write XML to tmpfile
1180  * 	Rename tmpfile to xmlfile (zonecfg.xxxxxx -> foo.xml)
1181  * 	Modify index file as needed
1182  * 	If it fails, recover from .backup -> foo.xml
1183  *
1184  * Rename 'foo' to 'bar':
1185  * 	Create tmpfile (zonecfg.xxxxxx)
1186  * 	Write XML to tmpfile
1187  * 	Rename tmpfile to xmlfile (zonecfg.xxxxxx -> bar.xml)
1188  * 	Add entry for 'bar' to index file, Remove entry for 'foo' (refresh)
1189  * 	If it fails, delete bar.xml; foo.xml is left behind.
1190  */
1191 static int
1192 zonecfg_save_impl(zone_dochandle_t handle, char *filename)
1193 {
1194 	char tmpfile[MAXPATHLEN];
1195 	char bakdir[MAXPATHLEN], bakbase[MAXPATHLEN], bakfile[MAXPATHLEN];
1196 	int tmpfd, err, valid;
1197 	xmlValidCtxt cvp = { NULL };
1198 	boolean_t backup;
1199 
1200 	(void) strlcpy(tmpfile, filename, sizeof (tmpfile));
1201 	(void) dirname(tmpfile);
1202 	(void) strlcat(tmpfile, _PATH_TMPFILE, sizeof (tmpfile));
1203 
1204 	tmpfd = mkstemp(tmpfile);
1205 	if (tmpfd == -1) {
1206 		(void) unlink(tmpfile);
1207 		return (Z_TEMP_FILE);
1208 	}
1209 	(void) close(tmpfd);
1210 
1211 	cvp.error = zonecfg_error_func;
1212 	cvp.warning = zonecfg_error_func;
1213 
1214 	/*
1215 	 * We do a final validation of the document.  Since the library has
1216 	 * malfunctioned if it fails to validate, we follow-up with an
1217 	 * assert() that the doc is valid.
1218 	 */
1219 	valid = xmlValidateDocument(&cvp, handle->zone_dh_doc);
1220 	assert(valid != 0);
1221 
1222 	if (xmlSaveFormatFile(tmpfile, handle->zone_dh_doc, 1) <= 0)
1223 		goto err;
1224 
1225 	(void) chmod(tmpfile, 0644);
1226 
1227 	/*
1228 	 * In the event we are doing a standard save, hard link a copy of the
1229 	 * original file in .backup.<pid>.filename so we can restore it if
1230 	 * something goes wrong.
1231 	 */
1232 	if (!is_new(handle) && !is_renaming(handle)) {
1233 		backup = B_TRUE;
1234 
1235 		(void) strlcpy(bakdir, filename, sizeof (bakdir));
1236 		(void) strlcpy(bakbase, filename, sizeof (bakbase));
1237 		(void) snprintf(bakfile, sizeof (bakfile), "%s/.backup.%d.%s",
1238 		    dirname(bakdir), getpid(), basename(bakbase));
1239 
1240 		if (link(filename, bakfile) == -1) {
1241 			err = errno;
1242 			(void) unlink(tmpfile);
1243 			if (errno == EACCES)
1244 				return (Z_ACCES);
1245 			return (Z_MISC_FS);
1246 		}
1247 	}
1248 
1249 	/*
1250 	 * Move the new document over top of the old.
1251 	 * i.e.:   zonecfg.XXXXXX  ->  myzone.xml
1252 	 */
1253 	if (rename(tmpfile, filename) == -1) {
1254 		err = errno;
1255 		(void) unlink(tmpfile);
1256 		if (backup)
1257 			(void) unlink(bakfile);
1258 		if (err == EACCES)
1259 			return (Z_ACCES);
1260 		return (Z_MISC_FS);
1261 	}
1262 
1263 	/*
1264 	 * If this is a snapshot, we're done-- don't add an index entry.
1265 	 */
1266 	if (is_snapshot(handle))
1267 		return (Z_OK);
1268 
1269 	/* now update the index file to reflect whatever we just did */
1270 	if ((err = zonecfg_refresh_index_file(handle)) != Z_OK) {
1271 		if (backup) {
1272 			/*
1273 			 * Try to restore from our backup.
1274 			 */
1275 			(void) unlink(filename);
1276 			(void) rename(bakfile, filename);
1277 		} else {
1278 			/*
1279 			 * Either the zone is new, in which case we can delete
1280 			 * new.xml, or we're doing a rename, so ditto.
1281 			 */
1282 			assert(is_new(handle) || is_renaming(handle));
1283 			(void) unlink(filename);
1284 		}
1285 		return (Z_UPDATING_INDEX);
1286 	}
1287 
1288 	if (backup)
1289 		(void) unlink(bakfile);
1290 
1291 	return (Z_OK);
1292 
1293 err:
1294 	(void) unlink(tmpfile);
1295 	return (Z_SAVING_FILE);
1296 }
1297 
1298 int
1299 zonecfg_save(zone_dochandle_t handle)
1300 {
1301 	char zname[ZONENAME_MAX], path[MAXPATHLEN];
1302 	char delpath[MAXPATHLEN];
1303 	int err = Z_SAVING_FILE;
1304 
1305 	if (zonecfg_check_handle(handle) != Z_OK)
1306 		return (Z_BAD_HANDLE);
1307 
1308 	/*
1309 	 * We don't support saving snapshots or a tree containing a sw
1310 	 * inventory at this time.
1311 	 */
1312 	if (handle->zone_dh_snapshot || handle->zone_dh_sw_inv)
1313 		return (Z_INVAL);
1314 
1315 	if ((err = zonecfg_get_name(handle, zname, sizeof (zname))) != Z_OK)
1316 		return (err);
1317 
1318 	if (!config_file_path(zname, path))
1319 		return (Z_MISC_FS);
1320 
1321 	addcomment(handle, "\n    DO NOT EDIT THIS "
1322 	    "FILE.  Use zonecfg(1M) instead.\n");
1323 
1324 	/*
1325 	 * Update user_attr first so that it will be older
1326 	 * than the config file.
1327 	 */
1328 	(void) zonecfg_authorize_users(handle, zname);
1329 	err = zonecfg_save_impl(handle, path);
1330 
1331 	stripcomments(handle);
1332 
1333 	if (err != Z_OK)
1334 		return (err);
1335 
1336 	handle->zone_dh_newzone = B_FALSE;
1337 
1338 	if (is_renaming(handle)) {
1339 		if (config_file_path(handle->zone_dh_delete_name, delpath))
1340 			(void) unlink(delpath);
1341 		handle->zone_dh_delete_name[0] = '\0';
1342 	}
1343 
1344 	return (Z_OK);
1345 }
1346 
1347 int
1348 zonecfg_verify_save(zone_dochandle_t handle, char *filename)
1349 {
1350 	int valid;
1351 
1352 	xmlValidCtxt cvp = { NULL };
1353 
1354 	if (zonecfg_check_handle(handle) != Z_OK)
1355 		return (Z_BAD_HANDLE);
1356 
1357 	cvp.error = zonecfg_error_func;
1358 	cvp.warning = zonecfg_error_func;
1359 
1360 	/*
1361 	 * We do a final validation of the document.  Since the library has
1362 	 * malfunctioned if it fails to validate, we follow-up with an
1363 	 * assert() that the doc is valid.
1364 	 */
1365 	valid = xmlValidateDocument(&cvp, handle->zone_dh_doc);
1366 	assert(valid != 0);
1367 
1368 	if (xmlSaveFormatFile(filename, handle->zone_dh_doc, 1) <= 0)
1369 		return (Z_SAVING_FILE);
1370 
1371 	return (Z_OK);
1372 }
1373 
1374 int
1375 zonecfg_detach_save(zone_dochandle_t handle, uint_t flags)
1376 {
1377 	char zname[ZONENAME_MAX];
1378 	char path[MAXPATHLEN];
1379 	char migpath[MAXPATHLEN];
1380 	xmlValidCtxt cvp = { NULL };
1381 	int err = Z_SAVING_FILE;
1382 	int valid;
1383 
1384 	if (zonecfg_check_handle(handle) != Z_OK)
1385 		return (Z_BAD_HANDLE);
1386 
1387 	if (flags & ZONE_DRY_RUN) {
1388 		(void) strlcpy(migpath, "-", sizeof (migpath));
1389 	} else {
1390 		if ((err = zonecfg_get_name(handle, zname, sizeof (zname)))
1391 		    != Z_OK)
1392 			return (err);
1393 
1394 		if ((err = zone_get_zonepath(zname, path, sizeof (path)))
1395 		    != Z_OK)
1396 			return (err);
1397 
1398 		if (snprintf(migpath, sizeof (migpath), "%s/%s", path,
1399 		    ZONE_DETACHED) >= sizeof (migpath))
1400 			return (Z_NOMEM);
1401 	}
1402 
1403 	if ((err = operation_prep(handle)) != Z_OK)
1404 		return (err);
1405 
1406 	addcomment(handle, "\n    DO NOT EDIT THIS FILE.  "
1407 	    "Use zonecfg(1M) and zoneadm(1M) attach.\n");
1408 
1409 	cvp.error = zonecfg_error_func;
1410 	cvp.warning = zonecfg_error_func;
1411 
1412 	/*
1413 	 * We do a final validation of the document.  Since the library has
1414 	 * malfunctioned if it fails to validate, we follow-up with an
1415 	 * assert() that the doc is valid.
1416 	 */
1417 	valid = xmlValidateDocument(&cvp, handle->zone_dh_doc);
1418 	assert(valid != 0);
1419 
1420 	if (xmlSaveFormatFile(migpath, handle->zone_dh_doc, 1) <= 0)
1421 		return (Z_SAVING_FILE);
1422 
1423 	if (!(flags & ZONE_DRY_RUN))
1424 		(void) chmod(migpath, 0644);
1425 
1426 	stripcomments(handle);
1427 
1428 	handle->zone_dh_newzone = B_FALSE;
1429 
1430 	return (Z_OK);
1431 }
1432 
1433 boolean_t
1434 zonecfg_detached(const char *path)
1435 {
1436 	char		migpath[MAXPATHLEN];
1437 	struct stat	buf;
1438 
1439 	if (snprintf(migpath, sizeof (migpath), "%s/%s", path, ZONE_DETACHED) >=
1440 	    sizeof (migpath))
1441 		return (B_FALSE);
1442 
1443 	if (stat(migpath, &buf) != -1)
1444 		return (B_TRUE);
1445 
1446 	return (B_FALSE);
1447 }
1448 
1449 void
1450 zonecfg_rm_detached(zone_dochandle_t handle, boolean_t forced)
1451 {
1452 	char zname[ZONENAME_MAX];
1453 	char path[MAXPATHLEN];
1454 	char detached[MAXPATHLEN];
1455 	char attached[MAXPATHLEN];
1456 
1457 	if (zonecfg_check_handle(handle) != Z_OK)
1458 		return;
1459 
1460 	if (zonecfg_get_name(handle, zname, sizeof (zname)) != Z_OK)
1461 		return;
1462 
1463 	if (zone_get_zonepath(zname, path, sizeof (path)) != Z_OK)
1464 		return;
1465 
1466 	(void) snprintf(detached, sizeof (detached), "%s/%s", path,
1467 	    ZONE_DETACHED);
1468 	(void) snprintf(attached, sizeof (attached), "%s/%s", path,
1469 	    ATTACH_FORCED);
1470 
1471 	if (forced) {
1472 		(void) rename(detached, attached);
1473 	} else {
1474 		(void) unlink(attached);
1475 		(void) unlink(detached);
1476 	}
1477 }
1478 
1479 /*
1480  * Special case: if access(2) fails with ENOENT, then try again using
1481  * ZONE_CONFIG_ROOT instead of config_file_path(zonename).  This is how we
1482  * work around the case of a config file which has not been created yet:
1483  * the user will need access to the directory so use that as a heuristic.
1484  */
1485 
1486 int
1487 zonecfg_access(const char *zonename, int amode)
1488 {
1489 	char path[MAXPATHLEN];
1490 
1491 	if (!config_file_path(zonename, path))
1492 		return (Z_INVAL);
1493 	if (access(path, amode) == 0)
1494 		return (Z_OK);
1495 	if (errno == ENOENT) {
1496 		if (snprintf(path, sizeof (path), "%s%s", zonecfg_root,
1497 		    ZONE_CONFIG_ROOT) >= sizeof (path))
1498 			return (Z_INVAL);
1499 		if (access(path, amode) == 0)
1500 			return (Z_OK);
1501 	}
1502 	if (errno == EACCES)
1503 		return (Z_ACCES);
1504 	if (errno == EINVAL)
1505 		return (Z_INVAL);
1506 	return (Z_MISC_FS);
1507 }
1508 
1509 int
1510 zonecfg_create_snapshot(const char *zonename)
1511 {
1512 	zone_dochandle_t handle;
1513 	char path[MAXPATHLEN], zonepath[MAXPATHLEN], rpath[MAXPATHLEN];
1514 	int error = Z_OK, res;
1515 
1516 	if ((handle = zonecfg_init_handle()) == NULL) {
1517 		return (Z_NOMEM);
1518 	}
1519 
1520 	handle->zone_dh_newzone = B_TRUE;
1521 	handle->zone_dh_snapshot = B_TRUE;
1522 
1523 	if ((error = zonecfg_get_handle(zonename, handle)) != Z_OK)
1524 		goto out;
1525 	if ((error = operation_prep(handle)) != Z_OK)
1526 		goto out;
1527 	error = zonecfg_get_zonepath(handle, zonepath, sizeof (zonepath));
1528 	if (error != Z_OK)
1529 		goto out;
1530 	if ((res = resolvepath(zonepath, rpath, sizeof (rpath))) == -1) {
1531 		error = Z_RESOLVED_PATH;
1532 		goto out;
1533 	}
1534 	/*
1535 	 * If the resolved path is not the same as the original path, then
1536 	 * save the resolved path in the snapshot, thus preventing any
1537 	 * potential problems down the line when zoneadmd goes to unmount
1538 	 * file systems and depends on initial string matches with resolved
1539 	 * paths.
1540 	 */
1541 	rpath[res] = '\0';
1542 	if (strcmp(zonepath, rpath) != 0) {
1543 		if ((error = zonecfg_set_zonepath(handle, rpath)) != Z_OK)
1544 			goto out;
1545 	}
1546 	if (snprintf(path, sizeof (path), "%s%s", zonecfg_root,
1547 	    ZONE_SNAPSHOT_ROOT) >= sizeof (path)) {
1548 		error = Z_MISC_FS;
1549 		goto out;
1550 	}
1551 	if ((mkdir(path, S_IRWXU) == -1) && (errno != EEXIST)) {
1552 		error = Z_MISC_FS;
1553 		goto out;
1554 	}
1555 
1556 	if (!snap_file_path(zonename, path)) {
1557 		error = Z_MISC_FS;
1558 		goto out;
1559 	}
1560 
1561 	addcomment(handle, "\n    DO NOT EDIT THIS FILE.  "
1562 	    "It is a snapshot of running zone state.\n");
1563 
1564 	error = zonecfg_save_impl(handle, path);
1565 
1566 	stripcomments(handle);
1567 
1568 out:
1569 	zonecfg_fini_handle(handle);
1570 	return (error);
1571 }
1572 
1573 int
1574 zonecfg_get_iptype(zone_dochandle_t handle, zone_iptype_t *iptypep)
1575 {
1576 	char property[10]; /* 10 is big enough for "shared"/"exclusive" */
1577 	int err;
1578 
1579 	err = getrootattr(handle, DTD_ATTR_IPTYPE, property, sizeof (property));
1580 	if (err == Z_BAD_PROPERTY) {
1581 		/* Return default value */
1582 		*iptypep = ZS_SHARED;
1583 		return (Z_OK);
1584 	} else if (err != Z_OK) {
1585 		return (err);
1586 	}
1587 
1588 	if (strlen(property) == 0 ||
1589 	    strcmp(property, "shared") == 0)
1590 		*iptypep = ZS_SHARED;
1591 	else if (strcmp(property, "exclusive") == 0)
1592 		*iptypep = ZS_EXCLUSIVE;
1593 	else
1594 		return (Z_INVAL);
1595 
1596 	return (Z_OK);
1597 }
1598 
1599 int
1600 zonecfg_set_iptype(zone_dochandle_t handle, zone_iptype_t iptype)
1601 {
1602 	xmlNodePtr cur;
1603 
1604 	if (handle == NULL)
1605 		return (Z_INVAL);
1606 
1607 	cur = xmlDocGetRootElement(handle->zone_dh_doc);
1608 	if (cur == NULL) {
1609 		return (Z_EMPTY_DOCUMENT);
1610 	}
1611 
1612 	if (xmlStrcmp(cur->name, DTD_ELEM_ZONE) != 0) {
1613 		return (Z_WRONG_DOC_TYPE);
1614 	}
1615 	switch (iptype) {
1616 	case ZS_SHARED:
1617 		/*
1618 		 * Since "shared" is the default, we don't write it to the
1619 		 * configuration file, so that it's easier to migrate those
1620 		 * zones elsewhere, eg., to systems which are not IP-Instances
1621 		 * aware.
1622 		 * xmlUnsetProp only fails when the attribute doesn't exist,
1623 		 * which we don't care.
1624 		 */
1625 		(void) xmlUnsetProp(cur, DTD_ATTR_IPTYPE);
1626 		break;
1627 	case ZS_EXCLUSIVE:
1628 		if (xmlSetProp(cur, DTD_ATTR_IPTYPE,
1629 		    (const xmlChar *) "exclusive") == NULL)
1630 			return (Z_INVAL);
1631 		break;
1632 	}
1633 	return (Z_OK);
1634 }
1635 
1636 static int
1637 newprop(xmlNodePtr node, const xmlChar *attrname, char *src)
1638 {
1639 	xmlAttrPtr newattr;
1640 
1641 	newattr = xmlNewProp(node, attrname, (xmlChar *)src);
1642 	if (newattr == NULL) {
1643 		xmlUnlinkNode(node);
1644 		xmlFreeNode(node);
1645 		return (Z_BAD_PROPERTY);
1646 	}
1647 	return (Z_OK);
1648 }
1649 
1650 static int
1651 zonecfg_add_filesystem_core(zone_dochandle_t handle, struct zone_fstab *tabptr)
1652 {
1653 	xmlNodePtr newnode, cur = handle->zone_dh_cur, options_node;
1654 	zone_fsopt_t *ptr;
1655 	int err;
1656 
1657 	newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_FS, NULL);
1658 	if ((err = newprop(newnode, DTD_ATTR_SPECIAL,
1659 	    tabptr->zone_fs_special)) != Z_OK)
1660 		return (err);
1661 	if (tabptr->zone_fs_raw[0] != '\0' &&
1662 	    (err = newprop(newnode, DTD_ATTR_RAW, tabptr->zone_fs_raw)) != Z_OK)
1663 		return (err);
1664 	if ((err = newprop(newnode, DTD_ATTR_DIR, tabptr->zone_fs_dir)) != Z_OK)
1665 		return (err);
1666 	if ((err = newprop(newnode, DTD_ATTR_TYPE,
1667 	    tabptr->zone_fs_type)) != Z_OK)
1668 		return (err);
1669 	if (tabptr->zone_fs_options != NULL) {
1670 		for (ptr = tabptr->zone_fs_options; ptr != NULL;
1671 		    ptr = ptr->zone_fsopt_next) {
1672 			options_node = xmlNewTextChild(newnode, NULL,
1673 			    DTD_ELEM_FSOPTION, NULL);
1674 			if ((err = newprop(options_node, DTD_ATTR_NAME,
1675 			    ptr->zone_fsopt_opt)) != Z_OK)
1676 				return (err);
1677 		}
1678 	}
1679 	return (Z_OK);
1680 }
1681 
1682 int
1683 zonecfg_add_filesystem(zone_dochandle_t handle, struct zone_fstab *tabptr)
1684 {
1685 	int err;
1686 
1687 	if (tabptr == NULL)
1688 		return (Z_INVAL);
1689 
1690 	if ((err = operation_prep(handle)) != Z_OK)
1691 		return (err);
1692 
1693 	if ((err = zonecfg_add_filesystem_core(handle, tabptr)) != Z_OK)
1694 		return (err);
1695 
1696 	return (Z_OK);
1697 }
1698 
1699 int
1700 zonecfg_add_fs_option(struct zone_fstab *tabptr, char *option)
1701 {
1702 	zone_fsopt_t *last, *old, *new;
1703 
1704 	last = tabptr->zone_fs_options;
1705 	for (old = last; old != NULL; old = old->zone_fsopt_next)
1706 		last = old;	/* walk to the end of the list */
1707 	new = (zone_fsopt_t *)malloc(sizeof (zone_fsopt_t));
1708 	if (new == NULL)
1709 		return (Z_NOMEM);
1710 	(void) strlcpy(new->zone_fsopt_opt, option,
1711 	    sizeof (new->zone_fsopt_opt));
1712 	new->zone_fsopt_next = NULL;
1713 	if (last == NULL)
1714 		tabptr->zone_fs_options = new;
1715 	else
1716 		last->zone_fsopt_next = new;
1717 	return (Z_OK);
1718 }
1719 
1720 int
1721 zonecfg_remove_fs_option(struct zone_fstab *tabptr, char *option)
1722 {
1723 	zone_fsopt_t *last, *this, *next;
1724 
1725 	last = tabptr->zone_fs_options;
1726 	for (this = last; this != NULL; this = this->zone_fsopt_next) {
1727 		if (strcmp(this->zone_fsopt_opt, option) == 0) {
1728 			next = this->zone_fsopt_next;
1729 			if (this == tabptr->zone_fs_options)
1730 				tabptr->zone_fs_options = next;
1731 			else
1732 				last->zone_fsopt_next = next;
1733 			free(this);
1734 			return (Z_OK);
1735 		} else
1736 			last = this;
1737 	}
1738 	return (Z_NO_PROPERTY_ID);
1739 }
1740 
1741 void
1742 zonecfg_free_fs_option_list(zone_fsopt_t *list)
1743 {
1744 	zone_fsopt_t *this, *next;
1745 
1746 	for (this = list; this != NULL; this = next) {
1747 		next = this->zone_fsopt_next;
1748 		free(this);
1749 	}
1750 }
1751 
1752 void
1753 zonecfg_free_rctl_value_list(struct zone_rctlvaltab *valtab)
1754 {
1755 	if (valtab == NULL)
1756 		return;
1757 	zonecfg_free_rctl_value_list(valtab->zone_rctlval_next);
1758 	free(valtab);
1759 }
1760 
1761 static boolean_t
1762 match_prop(xmlNodePtr cur, const xmlChar *attr, char *user_prop)
1763 {
1764 	xmlChar *gotten_prop;
1765 	int prop_result;
1766 
1767 	gotten_prop = xmlGetProp(cur, attr);
1768 	if (gotten_prop == NULL)	/* shouldn't happen */
1769 		return (B_FALSE);
1770 	prop_result = xmlStrcmp(gotten_prop, (const xmlChar *) user_prop);
1771 	xmlFree(gotten_prop);
1772 	return ((prop_result == 0));
1773 }
1774 
1775 static int
1776 zonecfg_delete_filesystem_core(zone_dochandle_t handle,
1777     struct zone_fstab *tabptr)
1778 {
1779 	xmlNodePtr cur = handle->zone_dh_cur;
1780 	boolean_t dir_match, spec_match, raw_match, type_match;
1781 
1782 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
1783 		if (xmlStrcmp(cur->name, DTD_ELEM_FS))
1784 			continue;
1785 		dir_match = match_prop(cur, DTD_ATTR_DIR, tabptr->zone_fs_dir);
1786 		spec_match = match_prop(cur, DTD_ATTR_SPECIAL,
1787 		    tabptr->zone_fs_special);
1788 		raw_match = match_prop(cur, DTD_ATTR_RAW,
1789 		    tabptr->zone_fs_raw);
1790 		type_match = match_prop(cur, DTD_ATTR_TYPE,
1791 		    tabptr->zone_fs_type);
1792 		if (dir_match && spec_match && raw_match && type_match) {
1793 			xmlUnlinkNode(cur);
1794 			xmlFreeNode(cur);
1795 			return (Z_OK);
1796 		}
1797 	}
1798 	return (Z_NO_RESOURCE_ID);
1799 }
1800 
1801 int
1802 zonecfg_delete_filesystem(zone_dochandle_t handle, struct zone_fstab *tabptr)
1803 {
1804 	int err;
1805 
1806 	if (tabptr == NULL)
1807 		return (Z_INVAL);
1808 
1809 	if ((err = operation_prep(handle)) != Z_OK)
1810 		return (err);
1811 
1812 	if ((err = zonecfg_delete_filesystem_core(handle, tabptr)) != Z_OK)
1813 		return (err);
1814 
1815 	return (Z_OK);
1816 }
1817 
1818 int
1819 zonecfg_modify_filesystem(
1820 	zone_dochandle_t handle,
1821 	struct zone_fstab *oldtabptr,
1822 	struct zone_fstab *newtabptr)
1823 {
1824 	int err;
1825 
1826 	if (oldtabptr == NULL || newtabptr == NULL)
1827 		return (Z_INVAL);
1828 
1829 	if ((err = operation_prep(handle)) != Z_OK)
1830 		return (err);
1831 
1832 	if ((err = zonecfg_delete_filesystem_core(handle, oldtabptr)) != Z_OK)
1833 		return (err);
1834 
1835 	if ((err = zonecfg_add_filesystem_core(handle, newtabptr)) != Z_OK)
1836 		return (err);
1837 
1838 	return (Z_OK);
1839 }
1840 
1841 int
1842 zonecfg_lookup_filesystem(
1843 	zone_dochandle_t handle,
1844 	struct zone_fstab *tabptr)
1845 {
1846 	xmlNodePtr cur, options, firstmatch;
1847 	int err;
1848 	char dirname[MAXPATHLEN], special[MAXPATHLEN], raw[MAXPATHLEN];
1849 	char type[FSTYPSZ];
1850 	char options_str[MAX_MNTOPT_STR];
1851 
1852 	if (tabptr == NULL)
1853 		return (Z_INVAL);
1854 
1855 	if ((err = operation_prep(handle)) != Z_OK)
1856 		return (err);
1857 
1858 	/*
1859 	 * Walk the list of children looking for matches on any properties
1860 	 * specified in the fstab parameter.  If more than one resource
1861 	 * matches, we return Z_INSUFFICIENT_SPEC; if none match, we return
1862 	 * Z_NO_RESOURCE_ID.
1863 	 */
1864 	cur = handle->zone_dh_cur;
1865 	firstmatch = NULL;
1866 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
1867 		if (xmlStrcmp(cur->name, DTD_ELEM_FS))
1868 			continue;
1869 		if (strlen(tabptr->zone_fs_dir) > 0) {
1870 			if ((fetchprop(cur, DTD_ATTR_DIR, dirname,
1871 			    sizeof (dirname)) == Z_OK) &&
1872 			    (strcmp(tabptr->zone_fs_dir, dirname) == 0)) {
1873 				if (firstmatch == NULL)
1874 					firstmatch = cur;
1875 				else
1876 					return (Z_INSUFFICIENT_SPEC);
1877 			}
1878 		}
1879 		if (strlen(tabptr->zone_fs_special) > 0) {
1880 			if ((fetchprop(cur, DTD_ATTR_SPECIAL, special,
1881 			    sizeof (special)) == Z_OK)) {
1882 				if (strcmp(tabptr->zone_fs_special,
1883 				    special) == 0) {
1884 					if (firstmatch == NULL)
1885 						firstmatch = cur;
1886 					else if (firstmatch != cur)
1887 						return (Z_INSUFFICIENT_SPEC);
1888 				} else {
1889 					/*
1890 					 * If another property matched but this
1891 					 * one doesn't then reset firstmatch.
1892 					 */
1893 					if (firstmatch == cur)
1894 						firstmatch = NULL;
1895 				}
1896 			}
1897 		}
1898 		if (strlen(tabptr->zone_fs_raw) > 0) {
1899 			if ((fetchprop(cur, DTD_ATTR_RAW, raw,
1900 			    sizeof (raw)) == Z_OK)) {
1901 				if (strcmp(tabptr->zone_fs_raw, raw) == 0) {
1902 					if (firstmatch == NULL)
1903 						firstmatch = cur;
1904 					else if (firstmatch != cur)
1905 						return (Z_INSUFFICIENT_SPEC);
1906 				} else {
1907 					/*
1908 					 * If another property matched but this
1909 					 * one doesn't then reset firstmatch.
1910 					 */
1911 					if (firstmatch == cur)
1912 						firstmatch = NULL;
1913 				}
1914 			}
1915 		}
1916 		if (strlen(tabptr->zone_fs_type) > 0) {
1917 			if ((fetchprop(cur, DTD_ATTR_TYPE, type,
1918 			    sizeof (type)) == Z_OK)) {
1919 				if (strcmp(tabptr->zone_fs_type, type) == 0) {
1920 					if (firstmatch == NULL)
1921 						firstmatch = cur;
1922 					else if (firstmatch != cur)
1923 						return (Z_INSUFFICIENT_SPEC);
1924 				} else {
1925 					/*
1926 					 * If another property matched but this
1927 					 * one doesn't then reset firstmatch.
1928 					 */
1929 					if (firstmatch == cur)
1930 						firstmatch = NULL;
1931 				}
1932 			}
1933 		}
1934 	}
1935 
1936 	if (firstmatch == NULL)
1937 		return (Z_NO_RESOURCE_ID);
1938 
1939 	cur = firstmatch;
1940 
1941 	if ((err = fetchprop(cur, DTD_ATTR_DIR, tabptr->zone_fs_dir,
1942 	    sizeof (tabptr->zone_fs_dir))) != Z_OK)
1943 		return (err);
1944 
1945 	if ((err = fetchprop(cur, DTD_ATTR_SPECIAL, tabptr->zone_fs_special,
1946 	    sizeof (tabptr->zone_fs_special))) != Z_OK)
1947 		return (err);
1948 
1949 	if ((err = fetchprop(cur, DTD_ATTR_RAW, tabptr->zone_fs_raw,
1950 	    sizeof (tabptr->zone_fs_raw))) != Z_OK)
1951 		return (err);
1952 
1953 	if ((err = fetchprop(cur, DTD_ATTR_TYPE, tabptr->zone_fs_type,
1954 	    sizeof (tabptr->zone_fs_type))) != Z_OK)
1955 		return (err);
1956 
1957 	/* options are optional */
1958 	tabptr->zone_fs_options = NULL;
1959 	for (options = cur->xmlChildrenNode; options != NULL;
1960 	    options = options->next) {
1961 		if ((fetchprop(options, DTD_ATTR_NAME, options_str,
1962 		    sizeof (options_str)) != Z_OK))
1963 			break;
1964 		if (zonecfg_add_fs_option(tabptr, options_str) != Z_OK)
1965 			break;
1966 	}
1967 	return (Z_OK);
1968 }
1969 
1970 /*
1971  * Compare two IP addresses in string form.  Allow for the possibility that
1972  * one might have "/<prefix-length>" at the end: allow a match on just the
1973  * IP address (or host name) part.
1974  */
1975 
1976 boolean_t
1977 zonecfg_same_net_address(char *a1, char *a2)
1978 {
1979 	char *slashp, *slashp1, *slashp2;
1980 	int result;
1981 
1982 	if (strcmp(a1, a2) == 0)
1983 		return (B_TRUE);
1984 
1985 	/*
1986 	 * If neither has a slash or both do, they need to match to be
1987 	 * considered the same, but they did not match above, so fail.
1988 	 */
1989 	slashp1 = strchr(a1, '/');
1990 	slashp2 = strchr(a2, '/');
1991 	if ((slashp1 == NULL && slashp2 == NULL) ||
1992 	    (slashp1 != NULL && slashp2 != NULL))
1993 		return (B_FALSE);
1994 
1995 	/*
1996 	 * Only one had a slash: pick that one, zero out the slash, compare
1997 	 * the "address only" strings, restore the slash, and return the
1998 	 * result of the comparison.
1999 	 */
2000 	slashp = (slashp1 == NULL) ? slashp2 : slashp1;
2001 	*slashp = '\0';
2002 	result = strcmp(a1, a2);
2003 	*slashp = '/';
2004 	return ((result == 0));
2005 }
2006 
2007 int
2008 zonecfg_valid_net_address(char *address, struct lifreq *lifr)
2009 {
2010 	struct sockaddr_in *sin4;
2011 	struct sockaddr_in6 *sin6;
2012 	struct addrinfo hints, *result;
2013 	char *slashp = strchr(address, '/');
2014 
2015 	bzero(lifr, sizeof (struct lifreq));
2016 	sin4 = (struct sockaddr_in *)&lifr->lifr_addr;
2017 	sin6 = (struct sockaddr_in6 *)&lifr->lifr_addr;
2018 	if (slashp != NULL)
2019 		*slashp = '\0';
2020 	if (inet_pton(AF_INET, address, &sin4->sin_addr) == 1) {
2021 		sin4->sin_family = AF_INET;
2022 	} else if (inet_pton(AF_INET6, address, &sin6->sin6_addr) == 1) {
2023 		if (slashp == NULL)
2024 			return (Z_IPV6_ADDR_PREFIX_LEN);
2025 		sin6->sin6_family = AF_INET6;
2026 	} else {
2027 		/* "address" may be a host name */
2028 		(void) memset(&hints, 0, sizeof (hints));
2029 		hints.ai_family = PF_INET;
2030 		if (getaddrinfo(address, NULL, &hints, &result) != 0)
2031 			return (Z_BOGUS_ADDRESS);
2032 		sin4->sin_family = result->ai_family;
2033 
2034 		(void) memcpy(&sin4->sin_addr,
2035 		    /* LINTED E_BAD_PTR_CAST_ALIGN */
2036 		    &((struct sockaddr_in *)result->ai_addr)->sin_addr,
2037 		    sizeof (struct in_addr));
2038 
2039 		freeaddrinfo(result);
2040 	}
2041 	return (Z_OK);
2042 }
2043 
2044 boolean_t
2045 zonecfg_ifname_exists(sa_family_t af, char *ifname)
2046 {
2047 	struct lifreq lifr;
2048 	int so;
2049 	int save_errno;
2050 
2051 	(void) memset(&lifr, 0, sizeof (lifr));
2052 	(void) strlcpy(lifr.lifr_name, ifname, sizeof (lifr.lifr_name));
2053 	lifr.lifr_addr.ss_family = af;
2054 	if ((so = socket(af, SOCK_DGRAM, 0)) < 0) {
2055 		/* Odd - can't tell if the ifname exists */
2056 		return (B_FALSE);
2057 	}
2058 	if (ioctl(so, SIOCGLIFFLAGS, (caddr_t)&lifr) < 0) {
2059 		save_errno = errno;
2060 		(void) close(so);
2061 		errno = save_errno;
2062 		return (B_FALSE);
2063 	}
2064 	(void) close(so);
2065 	return (B_TRUE);
2066 }
2067 
2068 /*
2069  * Determines whether there is a net resource with the physical interface, IP
2070  * address, and default router specified by 'tabptr' in the zone configuration
2071  * to which 'handle' refers.  'tabptr' must have an interface, an address, a
2072  * default router, or a combination of the three.  This function returns Z_OK
2073  * iff there is exactly one net resource matching the query specified by
2074  * 'tabptr'.  The function returns Z_INSUFFICIENT_SPEC if there are multiple
2075  * matches or 'tabptr' does not specify a physical interface, address, or
2076  * default router.  The function returns Z_NO_RESOURCE_ID if are no matches.
2077  *
2078  * Errors might also be returned if the entry that exactly matches the
2079  * query lacks critical network resource information.
2080  *
2081  * If there is a single match, then the matching entry's physical interface, IP
2082  * address, and default router information are stored in 'tabptr'.
2083  */
2084 int
2085 zonecfg_lookup_nwif(zone_dochandle_t handle, struct zone_nwiftab *tabptr)
2086 {
2087 	xmlNodePtr cur;
2088 	xmlNodePtr firstmatch;
2089 	int err;
2090 	char address[INET6_ADDRSTRLEN];
2091 	char physical[LIFNAMSIZ];
2092 	size_t addrspec;		/* nonzero if tabptr has IP addr */
2093 	size_t physspec;		/* nonzero if tabptr has interface */
2094 	size_t defrouterspec;		/* nonzero if tabptr has def. router */
2095 	size_t allowed_addrspec;
2096 	zone_iptype_t iptype;
2097 
2098 	if (tabptr == NULL)
2099 		return (Z_INVAL);
2100 
2101 	/*
2102 	 * Determine the fields that will be searched.  There must be at least
2103 	 * one.
2104 	 *
2105 	 * zone_nwif_address, zone_nwif_physical, and zone_nwif_defrouter are
2106 	 * arrays, so no NULL checks are necessary.
2107 	 */
2108 	addrspec = strlen(tabptr->zone_nwif_address);
2109 	physspec = strlen(tabptr->zone_nwif_physical);
2110 	defrouterspec = strlen(tabptr->zone_nwif_defrouter);
2111 	allowed_addrspec = strlen(tabptr->zone_nwif_allowed_address);
2112 	if (addrspec != 0 && allowed_addrspec != 0)
2113 		return (Z_INVAL); /* can't specify both */
2114 	if (addrspec == 0 && physspec == 0 && defrouterspec == 0 &&
2115 	    allowed_addrspec == 0)
2116 		return (Z_INSUFFICIENT_SPEC);
2117 
2118 	if ((err = operation_prep(handle)) != Z_OK)
2119 		return (err);
2120 
2121 	if ((err = zonecfg_get_iptype(handle, &iptype)) != Z_OK)
2122 		return (err);
2123 	/*
2124 	 * Iterate over the configuration's elements and look for net elements
2125 	 * that match the query.
2126 	 */
2127 	firstmatch = NULL;
2128 	cur = handle->zone_dh_cur;
2129 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
2130 		/* Skip non-net elements */
2131 		if (xmlStrcmp(cur->name, DTD_ELEM_NET))
2132 			continue;
2133 
2134 		/*
2135 		 * If any relevant fields don't match the query, then skip
2136 		 * the current net element.
2137 		 */
2138 		if (physspec != 0 && (fetchprop(cur, DTD_ATTR_PHYSICAL,
2139 		    physical, sizeof (physical)) != Z_OK ||
2140 		    strcmp(tabptr->zone_nwif_physical, physical) != 0))
2141 			continue;
2142 		if (iptype == ZS_SHARED && addrspec != 0 &&
2143 		    (fetchprop(cur, DTD_ATTR_ADDRESS, address,
2144 		    sizeof (address)) != Z_OK ||
2145 		    !zonecfg_same_net_address(tabptr->zone_nwif_address,
2146 		    address)))
2147 			continue;
2148 		if (iptype == ZS_EXCLUSIVE && allowed_addrspec != 0 &&
2149 		    (fetchprop(cur, DTD_ATTR_ALLOWED_ADDRESS, address,
2150 		    sizeof (address)) != Z_OK ||
2151 		    !zonecfg_same_net_address(tabptr->zone_nwif_allowed_address,
2152 		    address)))
2153 			continue;
2154 		if (defrouterspec != 0 && (fetchprop(cur, DTD_ATTR_DEFROUTER,
2155 		    address, sizeof (address)) != Z_OK ||
2156 		    !zonecfg_same_net_address(tabptr->zone_nwif_defrouter,
2157 		    address)))
2158 			continue;
2159 
2160 		/*
2161 		 * The current net element matches the query.  Select it if
2162 		 * it's the first match; otherwise, abort the search.
2163 		 */
2164 		if (firstmatch == NULL)
2165 			firstmatch = cur;
2166 		else
2167 			return (Z_INSUFFICIENT_SPEC);
2168 	}
2169 	if (firstmatch == NULL)
2170 		return (Z_NO_RESOURCE_ID);
2171 
2172 	cur = firstmatch;
2173 
2174 	if ((err = fetchprop(cur, DTD_ATTR_PHYSICAL, tabptr->zone_nwif_physical,
2175 	    sizeof (tabptr->zone_nwif_physical))) != Z_OK)
2176 		return (err);
2177 
2178 	if (iptype == ZS_SHARED &&
2179 	    (err = fetchprop(cur, DTD_ATTR_ADDRESS, tabptr->zone_nwif_address,
2180 	    sizeof (tabptr->zone_nwif_address))) != Z_OK)
2181 		return (err);
2182 
2183 	if (iptype == ZS_EXCLUSIVE &&
2184 	    (err = fetchprop(cur, DTD_ATTR_ALLOWED_ADDRESS,
2185 	    tabptr->zone_nwif_allowed_address,
2186 	    sizeof (tabptr->zone_nwif_allowed_address))) != Z_OK)
2187 		return (err);
2188 
2189 	if ((err = fetchprop(cur, DTD_ATTR_DEFROUTER,
2190 	    tabptr->zone_nwif_defrouter,
2191 	    sizeof (tabptr->zone_nwif_defrouter))) != Z_OK)
2192 		return (err);
2193 
2194 	return (Z_OK);
2195 }
2196 
2197 static int
2198 zonecfg_add_nwif_core(zone_dochandle_t handle, struct zone_nwiftab *tabptr)
2199 {
2200 	xmlNodePtr newnode, cur = handle->zone_dh_cur;
2201 	int err;
2202 
2203 	newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_NET, NULL);
2204 	if (strlen(tabptr->zone_nwif_address) > 0 &&
2205 	    (err = newprop(newnode, DTD_ATTR_ADDRESS,
2206 	    tabptr->zone_nwif_address)) != Z_OK)
2207 		return (err);
2208 	if (strlen(tabptr->zone_nwif_allowed_address) > 0 &&
2209 	    (err = newprop(newnode, DTD_ATTR_ALLOWED_ADDRESS,
2210 	    tabptr->zone_nwif_allowed_address)) != Z_OK)
2211 		return (err);
2212 	if ((err = newprop(newnode, DTD_ATTR_PHYSICAL,
2213 	    tabptr->zone_nwif_physical)) != Z_OK)
2214 		return (err);
2215 	/*
2216 	 * Do not add this property when it is not set, for backwards
2217 	 * compatibility and because it is optional.
2218 	 */
2219 	if ((strlen(tabptr->zone_nwif_defrouter) > 0) &&
2220 	    ((err = newprop(newnode, DTD_ATTR_DEFROUTER,
2221 	    tabptr->zone_nwif_defrouter)) != Z_OK))
2222 		return (err);
2223 	return (Z_OK);
2224 }
2225 
2226 int
2227 zonecfg_add_nwif(zone_dochandle_t handle, struct zone_nwiftab *tabptr)
2228 {
2229 	int err;
2230 
2231 	if (tabptr == NULL)
2232 		return (Z_INVAL);
2233 
2234 	if ((err = operation_prep(handle)) != Z_OK)
2235 		return (err);
2236 
2237 	if ((err = zonecfg_add_nwif_core(handle, tabptr)) != Z_OK)
2238 		return (err);
2239 
2240 	return (Z_OK);
2241 }
2242 
2243 static int
2244 zonecfg_delete_nwif_core(zone_dochandle_t handle, struct zone_nwiftab *tabptr)
2245 {
2246 	xmlNodePtr cur = handle->zone_dh_cur;
2247 	boolean_t addr_match, phys_match, allowed_addr_match;
2248 
2249 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
2250 		if (xmlStrcmp(cur->name, DTD_ELEM_NET))
2251 			continue;
2252 
2253 		addr_match = match_prop(cur, DTD_ATTR_ADDRESS,
2254 		    tabptr->zone_nwif_address);
2255 		allowed_addr_match = match_prop(cur, DTD_ATTR_ALLOWED_ADDRESS,
2256 		    tabptr->zone_nwif_allowed_address);
2257 		phys_match = match_prop(cur, DTD_ATTR_PHYSICAL,
2258 		    tabptr->zone_nwif_physical);
2259 
2260 		if ((addr_match || allowed_addr_match) && phys_match) {
2261 			xmlUnlinkNode(cur);
2262 			xmlFreeNode(cur);
2263 			return (Z_OK);
2264 		}
2265 	}
2266 	return (Z_NO_RESOURCE_ID);
2267 }
2268 
2269 int
2270 zonecfg_delete_nwif(zone_dochandle_t handle, struct zone_nwiftab *tabptr)
2271 {
2272 	int err;
2273 
2274 	if (tabptr == NULL)
2275 		return (Z_INVAL);
2276 
2277 	if ((err = operation_prep(handle)) != Z_OK)
2278 		return (err);
2279 
2280 	if ((err = zonecfg_delete_nwif_core(handle, tabptr)) != Z_OK)
2281 		return (err);
2282 
2283 	return (Z_OK);
2284 }
2285 
2286 int
2287 zonecfg_modify_nwif(
2288 	zone_dochandle_t handle,
2289 	struct zone_nwiftab *oldtabptr,
2290 	struct zone_nwiftab *newtabptr)
2291 {
2292 	int err;
2293 
2294 	if (oldtabptr == NULL || newtabptr == NULL)
2295 		return (Z_INVAL);
2296 
2297 	if ((err = operation_prep(handle)) != Z_OK)
2298 		return (err);
2299 
2300 	if ((err = zonecfg_delete_nwif_core(handle, oldtabptr)) != Z_OK)
2301 		return (err);
2302 
2303 	if ((err = zonecfg_add_nwif_core(handle, newtabptr)) != Z_OK)
2304 		return (err);
2305 
2306 	return (Z_OK);
2307 }
2308 
2309 /*
2310  * Must be a comma-separated list of alpha-numeric file system names.
2311  */
2312 static int
2313 zonecfg_valid_fs_allowed(const char *fsallowedp)
2314 {
2315 	char tmp[ZONE_FS_ALLOWED_MAX];
2316 	char *cp = tmp;
2317 	char *p;
2318 
2319 	if (strlen(fsallowedp) > ZONE_FS_ALLOWED_MAX)
2320 		return (Z_TOO_BIG);
2321 
2322 	(void) strlcpy(tmp, fsallowedp, sizeof (tmp));
2323 
2324 	while (*cp != '\0') {
2325 		p = cp;
2326 		while (*p != '\0' && *p != ',') {
2327 			if (!isalnum(*p))
2328 				return (Z_INVALID_PROPERTY);
2329 			p++;
2330 		}
2331 
2332 		if (*p == ',') {
2333 			if (p == cp)
2334 				return (Z_INVALID_PROPERTY);
2335 
2336 			p++;
2337 
2338 			if (*p == '\0')
2339 				return (Z_INVALID_PROPERTY);
2340 		}
2341 
2342 		cp = p;
2343 	}
2344 
2345 	return (Z_OK);
2346 }
2347 
2348 int
2349 zonecfg_get_fs_allowed(zone_dochandle_t handle, char *bufp, size_t buflen)
2350 {
2351 	int err;
2352 
2353 	if ((err = getrootattr(handle, DTD_ATTR_FS_ALLOWED,
2354 	    bufp, buflen)) != Z_OK)
2355 		return (err);
2356 	if (bufp[0] == '\0')
2357 		return (Z_BAD_PROPERTY);
2358 	return (zonecfg_valid_fs_allowed(bufp));
2359 }
2360 
2361 int
2362 zonecfg_set_fs_allowed(zone_dochandle_t handle, const char *bufp)
2363 {
2364 	int err;
2365 
2366 	if (bufp == NULL || (err = zonecfg_valid_fs_allowed(bufp)) == Z_OK)
2367 		return (setrootattr(handle, DTD_ATTR_FS_ALLOWED, bufp));
2368 	return (err);
2369 }
2370 
2371 /*
2372  * Determines if the specified string is a valid hostid string.  This function
2373  * returns Z_OK if the string is a valid hostid string.  It returns Z_INVAL if
2374  * 'hostidp' is NULL, Z_TOO_BIG if 'hostidp' refers to a string buffer
2375  * containing a hex string with more than 8 digits, and Z_INVALID_PROPERTY if
2376  * the string has an invalid format.
2377  */
2378 static int
2379 zonecfg_valid_hostid(const char *hostidp)
2380 {
2381 	char *currentp;
2382 	u_longlong_t hostidval;
2383 	size_t len;
2384 
2385 	if (hostidp == NULL)
2386 		return (Z_INVAL);
2387 
2388 	/* Empty strings and strings with whitespace are invalid. */
2389 	if (*hostidp == '\0')
2390 		return (Z_INVALID_PROPERTY);
2391 	for (currentp = (char *)hostidp; *currentp != '\0'; ++currentp) {
2392 		if (isspace(*currentp))
2393 			return (Z_INVALID_PROPERTY);
2394 	}
2395 	len = (size_t)(currentp - hostidp);
2396 
2397 	/*
2398 	 * The caller might pass a hostid that is larger than the maximum
2399 	 * unsigned 32-bit integral value.  Check for this!  Also, make sure
2400 	 * that the whole string is converted (this helps us find illegal
2401 	 * characters) and that the whole string fits within a buffer of size
2402 	 * HW_HOSTID_LEN.
2403 	 */
2404 	currentp = (char *)hostidp;
2405 	if (strncmp(hostidp, "0x", 2) == 0 || strncmp(hostidp, "0X", 2) == 0)
2406 		currentp += 2;
2407 	hostidval = strtoull(currentp, &currentp, 16);
2408 	if ((size_t)(currentp - hostidp) >= HW_HOSTID_LEN)
2409 		return (Z_TOO_BIG);
2410 	if (hostidval > UINT_MAX || hostidval == HW_INVALID_HOSTID ||
2411 	    currentp != hostidp + len)
2412 		return (Z_INVALID_PROPERTY);
2413 	return (Z_OK);
2414 }
2415 
2416 /*
2417  * Gets the zone hostid string stored in the specified zone configuration
2418  * document.  This function returns Z_OK on success.  Z_BAD_PROPERTY is returned
2419  * if the config file doesn't specify a hostid or if the hostid is blank.
2420  *
2421  * Note that buflen should be at least HW_HOSTID_LEN.
2422  */
2423 int
2424 zonecfg_get_hostid(zone_dochandle_t handle, char *bufp, size_t buflen)
2425 {
2426 	int err;
2427 
2428 	if ((err = getrootattr(handle, DTD_ATTR_HOSTID, bufp, buflen)) != Z_OK)
2429 		return (err);
2430 	if (bufp[0] == '\0')
2431 		return (Z_BAD_PROPERTY);
2432 	return (zonecfg_valid_hostid(bufp));
2433 }
2434 
2435 /*
2436  * Sets the hostid string in the specified zone config document to the given
2437  * string value.  If 'hostidp' is NULL, then the config document's hostid
2438  * attribute is cleared.  Non-NULL hostids are validated.  This function returns
2439  * Z_OK on success.  Any other return value indicates failure.
2440  */
2441 int
2442 zonecfg_set_hostid(zone_dochandle_t handle, const char *hostidp)
2443 {
2444 	int err;
2445 
2446 	/*
2447 	 * A NULL hostid string is interpreted as a request to clear the
2448 	 * hostid.
2449 	 */
2450 	if (hostidp == NULL || (err = zonecfg_valid_hostid(hostidp)) == Z_OK)
2451 		return (setrootattr(handle, DTD_ATTR_HOSTID, hostidp));
2452 	return (err);
2453 }
2454 
2455 int
2456 zonecfg_lookup_dev(zone_dochandle_t handle, struct zone_devtab *tabptr)
2457 {
2458 	xmlNodePtr cur, firstmatch;
2459 	int err;
2460 	char match[MAXPATHLEN];
2461 
2462 	if (tabptr == NULL)
2463 		return (Z_INVAL);
2464 
2465 	if ((err = operation_prep(handle)) != Z_OK)
2466 		return (err);
2467 
2468 	cur = handle->zone_dh_cur;
2469 	firstmatch = NULL;
2470 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
2471 		if (xmlStrcmp(cur->name, DTD_ELEM_DEVICE))
2472 			continue;
2473 		if (strlen(tabptr->zone_dev_match) == 0)
2474 			continue;
2475 
2476 		if ((fetchprop(cur, DTD_ATTR_MATCH, match,
2477 		    sizeof (match)) == Z_OK)) {
2478 			if (strcmp(tabptr->zone_dev_match,
2479 			    match) == 0) {
2480 				if (firstmatch == NULL)
2481 					firstmatch = cur;
2482 				else if (firstmatch != cur)
2483 					return (Z_INSUFFICIENT_SPEC);
2484 			} else {
2485 				/*
2486 				 * If another property matched but this
2487 				 * one doesn't then reset firstmatch.
2488 				 */
2489 				if (firstmatch == cur)
2490 					firstmatch = NULL;
2491 			}
2492 		}
2493 	}
2494 	if (firstmatch == NULL)
2495 		return (Z_NO_RESOURCE_ID);
2496 
2497 	cur = firstmatch;
2498 
2499 	if ((err = fetchprop(cur, DTD_ATTR_MATCH, tabptr->zone_dev_match,
2500 	    sizeof (tabptr->zone_dev_match))) != Z_OK)
2501 		return (err);
2502 
2503 	return (Z_OK);
2504 }
2505 
2506 static int
2507 zonecfg_add_dev_core(zone_dochandle_t handle, struct zone_devtab *tabptr)
2508 {
2509 	xmlNodePtr newnode, cur = handle->zone_dh_cur;
2510 	int err;
2511 
2512 	newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_DEVICE, NULL);
2513 
2514 	if ((err = newprop(newnode, DTD_ATTR_MATCH,
2515 	    tabptr->zone_dev_match)) != Z_OK)
2516 		return (err);
2517 
2518 	return (Z_OK);
2519 }
2520 
2521 int
2522 zonecfg_add_dev(zone_dochandle_t handle, struct zone_devtab *tabptr)
2523 {
2524 	int err;
2525 
2526 	if (tabptr == NULL)
2527 		return (Z_INVAL);
2528 
2529 	if ((err = operation_prep(handle)) != Z_OK)
2530 		return (err);
2531 
2532 	if ((err = zonecfg_add_dev_core(handle, tabptr)) != Z_OK)
2533 		return (err);
2534 
2535 	return (Z_OK);
2536 }
2537 
2538 static int
2539 zonecfg_delete_dev_core(zone_dochandle_t handle, struct zone_devtab *tabptr)
2540 {
2541 	xmlNodePtr cur = handle->zone_dh_cur;
2542 	int match_match;
2543 
2544 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
2545 		if (xmlStrcmp(cur->name, DTD_ELEM_DEVICE))
2546 			continue;
2547 
2548 		match_match = match_prop(cur, DTD_ATTR_MATCH,
2549 		    tabptr->zone_dev_match);
2550 
2551 		if (match_match) {
2552 			xmlUnlinkNode(cur);
2553 			xmlFreeNode(cur);
2554 			return (Z_OK);
2555 		}
2556 	}
2557 	return (Z_NO_RESOURCE_ID);
2558 }
2559 
2560 int
2561 zonecfg_delete_dev(zone_dochandle_t handle, struct zone_devtab *tabptr)
2562 {
2563 	int err;
2564 
2565 	if (tabptr == NULL)
2566 		return (Z_INVAL);
2567 
2568 	if ((err = operation_prep(handle)) != Z_OK)
2569 		return (err);
2570 
2571 	if ((err = zonecfg_delete_dev_core(handle, tabptr)) != Z_OK)
2572 		return (err);
2573 
2574 	return (Z_OK);
2575 }
2576 
2577 int
2578 zonecfg_modify_dev(
2579 	zone_dochandle_t handle,
2580 	struct zone_devtab *oldtabptr,
2581 	struct zone_devtab *newtabptr)
2582 {
2583 	int err;
2584 
2585 	if (oldtabptr == NULL || newtabptr == NULL)
2586 		return (Z_INVAL);
2587 
2588 	if ((err = operation_prep(handle)) != Z_OK)
2589 		return (err);
2590 
2591 	if ((err = zonecfg_delete_dev_core(handle, oldtabptr)) != Z_OK)
2592 		return (err);
2593 
2594 	if ((err = zonecfg_add_dev_core(handle, newtabptr)) != Z_OK)
2595 		return (err);
2596 
2597 	return (Z_OK);
2598 }
2599 
2600 static int
2601 zonecfg_add_auth_core(zone_dochandle_t handle, struct zone_admintab *tabptr,
2602     char *zonename)
2603 {
2604 	xmlNodePtr newnode, cur = handle->zone_dh_cur;
2605 	int err;
2606 
2607 	newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_ADMIN, NULL);
2608 	err = newprop(newnode, DTD_ATTR_USER, tabptr->zone_admin_user);
2609 	if (err != Z_OK)
2610 		return (err);
2611 	err = newprop(newnode, DTD_ATTR_AUTHS, tabptr->zone_admin_auths);
2612 	if (err != Z_OK)
2613 		return (err);
2614 	if ((err = zonecfg_remove_userauths(
2615 	    handle, tabptr->zone_admin_user, zonename, B_FALSE)) != Z_OK)
2616 		return (err);
2617 	return (Z_OK);
2618 }
2619 
2620 int
2621 zonecfg_add_admin(zone_dochandle_t handle, struct zone_admintab *tabptr,
2622     char *zonename)
2623 {
2624 	int err;
2625 
2626 	if (tabptr == NULL)
2627 		return (Z_INVAL);
2628 
2629 	if ((err = operation_prep(handle)) != Z_OK)
2630 		return (err);
2631 
2632 	if ((err = zonecfg_add_auth_core(handle, tabptr,
2633 	    zonename)) != Z_OK)
2634 		return (err);
2635 
2636 	return (Z_OK);
2637 }
2638 static int
2639 zonecfg_delete_auth_core(zone_dochandle_t handle, struct zone_admintab *tabptr,
2640     char *zonename)
2641 {
2642 	xmlNodePtr cur = handle->zone_dh_cur;
2643 	boolean_t auth_match;
2644 	int err;
2645 
2646 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
2647 		if (xmlStrcmp(cur->name, DTD_ELEM_ADMIN))
2648 			continue;
2649 		auth_match = match_prop(cur, DTD_ATTR_USER,
2650 		    tabptr->zone_admin_user);
2651 		if (auth_match) {
2652 			if ((err = zonecfg_insert_userauths(
2653 			    handle, tabptr->zone_admin_user,
2654 			    zonename)) != Z_OK)
2655 				return (err);
2656 			xmlUnlinkNode(cur);
2657 			xmlFreeNode(cur);
2658 			return (Z_OK);
2659 		}
2660 	}
2661 	return (Z_NO_RESOURCE_ID);
2662 }
2663 
2664 int
2665 zonecfg_delete_admin(zone_dochandle_t handle, struct zone_admintab *tabptr,
2666     char *zonename)
2667 {
2668 	int err;
2669 
2670 	if (tabptr == NULL)
2671 		return (Z_INVAL);
2672 
2673 	if ((err = operation_prep(handle)) != Z_OK)
2674 		return (err);
2675 
2676 	if ((err = zonecfg_delete_auth_core(handle, tabptr, zonename)) != Z_OK)
2677 		return (err);
2678 
2679 	return (Z_OK);
2680 }
2681 
2682 int
2683 zonecfg_modify_admin(zone_dochandle_t handle, struct zone_admintab *oldtabptr,
2684     struct zone_admintab *newtabptr, char *zonename)
2685 {
2686 	int err;
2687 
2688 	if (oldtabptr == NULL || newtabptr == NULL)
2689 		return (Z_INVAL);
2690 
2691 	if ((err = operation_prep(handle)) != Z_OK)
2692 		return (err);
2693 
2694 	if ((err = zonecfg_delete_auth_core(handle, oldtabptr, zonename))
2695 	    != Z_OK)
2696 		return (err);
2697 
2698 	if ((err = zonecfg_add_auth_core(handle, newtabptr,
2699 	    zonename)) != Z_OK)
2700 		return (err);
2701 
2702 	return (Z_OK);
2703 }
2704 
2705 int
2706 zonecfg_lookup_admin(zone_dochandle_t handle, struct zone_admintab *tabptr)
2707 {
2708 	xmlNodePtr cur, firstmatch;
2709 	int err;
2710 	char user[MAXUSERNAME];
2711 
2712 	if (tabptr == NULL)
2713 		return (Z_INVAL);
2714 
2715 	if ((err = operation_prep(handle)) != Z_OK)
2716 		return (err);
2717 
2718 	cur = handle->zone_dh_cur;
2719 	firstmatch = NULL;
2720 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
2721 		if (xmlStrcmp(cur->name, DTD_ELEM_ADMIN))
2722 			continue;
2723 		if (strlen(tabptr->zone_admin_user) > 0) {
2724 			if ((fetchprop(cur, DTD_ATTR_USER, user,
2725 			    sizeof (user)) == Z_OK) &&
2726 			    (strcmp(tabptr->zone_admin_user, user) == 0)) {
2727 				if (firstmatch == NULL)
2728 					firstmatch = cur;
2729 				else
2730 					return (Z_INSUFFICIENT_SPEC);
2731 			}
2732 		}
2733 	}
2734 	if (firstmatch == NULL)
2735 		return (Z_NO_RESOURCE_ID);
2736 
2737 	cur = firstmatch;
2738 
2739 	if ((err = fetchprop(cur, DTD_ATTR_USER, tabptr->zone_admin_user,
2740 	    sizeof (tabptr->zone_admin_user))) != Z_OK)
2741 		return (err);
2742 
2743 	if ((err = fetchprop(cur, DTD_ATTR_AUTHS, tabptr->zone_admin_auths,
2744 	    sizeof (tabptr->zone_admin_auths))) != Z_OK)
2745 		return (err);
2746 
2747 	return (Z_OK);
2748 }
2749 
2750 
2751 /* Lock to serialize all devwalks */
2752 static pthread_mutex_t zonecfg_devwalk_lock = PTHREAD_MUTEX_INITIALIZER;
2753 /*
2754  * Global variables used to pass data from zonecfg_dev_manifest to the nftw
2755  * call-back (zonecfg_devwalk_cb).  g_devwalk_data is really the void*
2756  * parameter and g_devwalk_cb is really the *cb parameter from
2757  * zonecfg_dev_manifest.
2758  */
2759 typedef struct __g_devwalk_data *g_devwalk_data_t;
2760 static g_devwalk_data_t g_devwalk_data;
2761 static int (*g_devwalk_cb)(const char *, uid_t, gid_t, mode_t, const char *,
2762     void *);
2763 static size_t g_devwalk_skip_prefix;
2764 
2765 /*
2766  * zonecfg_dev_manifest call-back function used during detach to generate the
2767  * dev info in the manifest.
2768  */
2769 static int
2770 get_detach_dev_entry(const char *name, uid_t uid, gid_t gid, mode_t mode,
2771     const char *acl, void *hdl)
2772 {
2773 	zone_dochandle_t handle = (zone_dochandle_t)hdl;
2774 	xmlNodePtr newnode;
2775 	xmlNodePtr cur;
2776 	int err;
2777 	char buf[128];
2778 
2779 	if ((err = operation_prep(handle)) != Z_OK)
2780 		return (err);
2781 
2782 	cur = handle->zone_dh_cur;
2783 	newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_DEV_PERM, NULL);
2784 	if ((err = newprop(newnode, DTD_ATTR_NAME, (char *)name)) != Z_OK)
2785 		return (err);
2786 	(void) snprintf(buf, sizeof (buf), "%lu", uid);
2787 	if ((err = newprop(newnode, DTD_ATTR_UID, buf)) != Z_OK)
2788 		return (err);
2789 	(void) snprintf(buf, sizeof (buf), "%lu", gid);
2790 	if ((err = newprop(newnode, DTD_ATTR_GID, buf)) != Z_OK)
2791 		return (err);
2792 	(void) snprintf(buf, sizeof (buf), "%o", mode);
2793 	if ((err = newprop(newnode, DTD_ATTR_MODE, buf)) != Z_OK)
2794 		return (err);
2795 	if ((err = newprop(newnode, DTD_ATTR_ACL, (char *)acl)) != Z_OK)
2796 		return (err);
2797 	return (Z_OK);
2798 }
2799 
2800 /*
2801  * This is the nftw call-back function used by zonecfg_dev_manifest.  It is
2802  * responsible for calling the actual call-back.
2803  */
2804 /* ARGSUSED2 */
2805 static int
2806 zonecfg_devwalk_cb(const char *path, const struct stat *st, int f,
2807     struct FTW *ftw)
2808 {
2809 	acl_t *acl;
2810 	char *acl_txt = NULL;
2811 
2812 	/* skip all but character and block devices */
2813 	if (!S_ISBLK(st->st_mode) && !S_ISCHR(st->st_mode))
2814 		return (0);
2815 
2816 	if ((acl_get(path, ACL_NO_TRIVIAL, &acl) == 0) &&
2817 	    acl != NULL) {
2818 		acl_txt = acl_totext(acl, ACL_NORESOLVE);
2819 		acl_free(acl);
2820 	}
2821 
2822 	if (strlen(path) <= g_devwalk_skip_prefix)
2823 		return (0);
2824 
2825 	g_devwalk_cb(path + g_devwalk_skip_prefix, st->st_uid, st->st_gid,
2826 	    st->st_mode & S_IAMB, acl_txt != NULL ? acl_txt : "",
2827 	    g_devwalk_data);
2828 	free(acl_txt);
2829 	return (0);
2830 }
2831 
2832 /*
2833  * Walk the dev tree for the zone specified by hdl and call the
2834  * get_detach_dev_entry call-back function for each entry in the tree.  The
2835  * call-back will be passed the name, uid, gid, mode, acl string and the
2836  * handle input parameter for each dev entry.
2837  *
2838  * Data is passed to get_detach_dev_entry through the global variables
2839  * g_devwalk_data, *g_devwalk_cb, and g_devwalk_skip_prefix.  The
2840  * zonecfg_devwalk_cb function will actually call get_detach_dev_entry.
2841  */
2842 int
2843 zonecfg_dev_manifest(zone_dochandle_t hdl)
2844 {
2845 	char path[MAXPATHLEN];
2846 	int ret;
2847 
2848 	if ((ret = zonecfg_get_zonepath(hdl, path, sizeof (path))) != Z_OK)
2849 		return (ret);
2850 
2851 	if (strlcat(path, "/dev", sizeof (path)) >= sizeof (path))
2852 		return (Z_TOO_BIG);
2853 
2854 	/*
2855 	 * We have to serialize all devwalks in the same process
2856 	 * (which should be fine), since nftw() is so badly designed.
2857 	 */
2858 	(void) pthread_mutex_lock(&zonecfg_devwalk_lock);
2859 
2860 	g_devwalk_skip_prefix = strlen(path) + 1;
2861 	g_devwalk_data = (g_devwalk_data_t)hdl;
2862 	g_devwalk_cb = get_detach_dev_entry;
2863 	(void) nftw(path, zonecfg_devwalk_cb, 0, FTW_PHYS);
2864 
2865 	(void) pthread_mutex_unlock(&zonecfg_devwalk_lock);
2866 	return (Z_OK);
2867 }
2868 
2869 /*
2870  * Update the owner, group, mode and acl on the specified dev (inpath) for
2871  * the zone (hdl).  This function can be used to fix up the dev tree after
2872  * attaching a migrated zone.
2873  */
2874 int
2875 zonecfg_devperms_apply(zone_dochandle_t hdl, const char *inpath, uid_t owner,
2876     gid_t group, mode_t mode, const char *acltxt)
2877 {
2878 	int ret;
2879 	char path[MAXPATHLEN];
2880 	struct stat st;
2881 	acl_t *aclp;
2882 
2883 	if ((ret = zonecfg_get_zonepath(hdl, path, sizeof (path))) != Z_OK)
2884 		return (ret);
2885 
2886 	if (strlcat(path, "/dev/", sizeof (path)) >= sizeof (path))
2887 		return (Z_TOO_BIG);
2888 	if (strlcat(path, inpath, sizeof (path)) >= sizeof (path))
2889 		return (Z_TOO_BIG);
2890 
2891 	if (stat(path, &st) == -1)
2892 		return (Z_INVAL);
2893 
2894 	/* make sure we're only touching device nodes */
2895 	if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode))
2896 		return (Z_INVAL);
2897 
2898 	if (chown(path, owner, group) == -1)
2899 		return (Z_SYSTEM);
2900 
2901 	if (chmod(path, mode) == -1)
2902 		return (Z_SYSTEM);
2903 
2904 	if ((acltxt == NULL) || (strcmp(acltxt, "") == 0))
2905 		return (Z_OK);
2906 
2907 	if (acl_fromtext(acltxt, &aclp) != 0) {
2908 		errno = EINVAL;
2909 		return (Z_SYSTEM);
2910 	}
2911 
2912 	errno = 0;
2913 	if (acl_set(path, aclp) == -1) {
2914 		free(aclp);
2915 		return (Z_SYSTEM);
2916 	}
2917 
2918 	free(aclp);
2919 	return (Z_OK);
2920 }
2921 
2922 /*
2923  * This function finds everything mounted under a zone's rootpath.
2924  * This returns the number of mounts under rootpath, or -1 on error.
2925  * callback is called once per mount found with the first argument
2926  * pointing to a mnttab structure containing the mount's information.
2927  *
2928  * If the callback function returns non-zero zonecfg_find_mounts
2929  * aborts with an error.
2930  */
2931 int
2932 zonecfg_find_mounts(char *rootpath, int (*callback)(const struct mnttab *,
2933     void *), void *priv) {
2934 	FILE *mnttab;
2935 	struct mnttab m;
2936 	size_t l;
2937 	int zfsl;
2938 	int rv = 0;
2939 	char zfs_path[MAXPATHLEN];
2940 
2941 	assert(rootpath != NULL);
2942 
2943 	if ((zfsl = snprintf(zfs_path, sizeof (zfs_path), "%s/.zfs/", rootpath))
2944 	    >= sizeof (zfs_path))
2945 		return (-1);
2946 
2947 	l = strlen(rootpath);
2948 
2949 	mnttab = fopen("/etc/mnttab", "r");
2950 
2951 	if (mnttab == NULL)
2952 		return (-1);
2953 
2954 	if (ioctl(fileno(mnttab), MNTIOC_SHOWHIDDEN, NULL) < 0)  {
2955 		rv = -1;
2956 		goto out;
2957 	}
2958 
2959 	while (!getmntent(mnttab, &m)) {
2960 		if ((strncmp(rootpath, m.mnt_mountp, l) == 0) &&
2961 		    (m.mnt_mountp[l] == '/') &&
2962 		    (strncmp(zfs_path, m.mnt_mountp, zfsl) != 0)) {
2963 			rv++;
2964 			if (callback == NULL)
2965 				continue;
2966 			if (callback(&m, priv)) {
2967 				rv = -1;
2968 				goto out;
2969 
2970 			}
2971 		}
2972 	}
2973 
2974 out:
2975 	(void) fclose(mnttab);
2976 	return (rv);
2977 }
2978 
2979 int
2980 zonecfg_lookup_attr(zone_dochandle_t handle, struct zone_attrtab *tabptr)
2981 {
2982 	xmlNodePtr cur, firstmatch;
2983 	int err;
2984 	char name[MAXNAMELEN], type[MAXNAMELEN], value[MAXNAMELEN];
2985 
2986 	if (tabptr == NULL)
2987 		return (Z_INVAL);
2988 
2989 	if ((err = operation_prep(handle)) != Z_OK)
2990 		return (err);
2991 
2992 	cur = handle->zone_dh_cur;
2993 	firstmatch = NULL;
2994 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
2995 		if (xmlStrcmp(cur->name, DTD_ELEM_ATTR))
2996 			continue;
2997 		if (strlen(tabptr->zone_attr_name) > 0) {
2998 			if ((fetchprop(cur, DTD_ATTR_NAME, name,
2999 			    sizeof (name)) == Z_OK) &&
3000 			    (strcmp(tabptr->zone_attr_name, name) == 0)) {
3001 				if (firstmatch == NULL)
3002 					firstmatch = cur;
3003 				else
3004 					return (Z_INSUFFICIENT_SPEC);
3005 			}
3006 		}
3007 		if (strlen(tabptr->zone_attr_type) > 0) {
3008 			if ((fetchprop(cur, DTD_ATTR_TYPE, type,
3009 			    sizeof (type)) == Z_OK)) {
3010 				if (strcmp(tabptr->zone_attr_type, type) == 0) {
3011 					if (firstmatch == NULL)
3012 						firstmatch = cur;
3013 					else if (firstmatch != cur)
3014 						return (Z_INSUFFICIENT_SPEC);
3015 				} else {
3016 					/*
3017 					 * If another property matched but this
3018 					 * one doesn't then reset firstmatch.
3019 					 */
3020 					if (firstmatch == cur)
3021 						firstmatch = NULL;
3022 				}
3023 			}
3024 		}
3025 		if (strlen(tabptr->zone_attr_value) > 0) {
3026 			if ((fetchprop(cur, DTD_ATTR_VALUE, value,
3027 			    sizeof (value)) == Z_OK)) {
3028 				if (strcmp(tabptr->zone_attr_value, value) ==
3029 				    0) {
3030 					if (firstmatch == NULL)
3031 						firstmatch = cur;
3032 					else if (firstmatch != cur)
3033 						return (Z_INSUFFICIENT_SPEC);
3034 				} else {
3035 					/*
3036 					 * If another property matched but this
3037 					 * one doesn't then reset firstmatch.
3038 					 */
3039 					if (firstmatch == cur)
3040 						firstmatch = NULL;
3041 				}
3042 			}
3043 		}
3044 	}
3045 	if (firstmatch == NULL)
3046 		return (Z_NO_RESOURCE_ID);
3047 
3048 	cur = firstmatch;
3049 
3050 	if ((err = fetchprop(cur, DTD_ATTR_NAME, tabptr->zone_attr_name,
3051 	    sizeof (tabptr->zone_attr_name))) != Z_OK)
3052 		return (err);
3053 
3054 	if ((err = fetchprop(cur, DTD_ATTR_TYPE, tabptr->zone_attr_type,
3055 	    sizeof (tabptr->zone_attr_type))) != Z_OK)
3056 		return (err);
3057 
3058 	if ((err = fetchprop(cur, DTD_ATTR_VALUE, tabptr->zone_attr_value,
3059 	    sizeof (tabptr->zone_attr_value))) != Z_OK)
3060 		return (err);
3061 
3062 	return (Z_OK);
3063 }
3064 
3065 static int
3066 zonecfg_add_attr_core(zone_dochandle_t handle, struct zone_attrtab *tabptr)
3067 {
3068 	xmlNodePtr newnode, cur = handle->zone_dh_cur;
3069 	int err;
3070 
3071 	newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_ATTR, NULL);
3072 	err = newprop(newnode, DTD_ATTR_NAME, tabptr->zone_attr_name);
3073 	if (err != Z_OK)
3074 		return (err);
3075 	err = newprop(newnode, DTD_ATTR_TYPE, tabptr->zone_attr_type);
3076 	if (err != Z_OK)
3077 		return (err);
3078 	err = newprop(newnode, DTD_ATTR_VALUE, tabptr->zone_attr_value);
3079 	if (err != Z_OK)
3080 		return (err);
3081 	return (Z_OK);
3082 }
3083 
3084 int
3085 zonecfg_add_attr(zone_dochandle_t handle, struct zone_attrtab *tabptr)
3086 {
3087 	int err;
3088 
3089 	if (tabptr == NULL)
3090 		return (Z_INVAL);
3091 
3092 	if ((err = operation_prep(handle)) != Z_OK)
3093 		return (err);
3094 
3095 	if ((err = zonecfg_add_attr_core(handle, tabptr)) != Z_OK)
3096 		return (err);
3097 
3098 	return (Z_OK);
3099 }
3100 
3101 static int
3102 zonecfg_delete_attr_core(zone_dochandle_t handle, struct zone_attrtab *tabptr)
3103 {
3104 	xmlNodePtr cur = handle->zone_dh_cur;
3105 	int name_match, type_match, value_match;
3106 
3107 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
3108 		if (xmlStrcmp(cur->name, DTD_ELEM_ATTR))
3109 			continue;
3110 
3111 		name_match = match_prop(cur, DTD_ATTR_NAME,
3112 		    tabptr->zone_attr_name);
3113 		type_match = match_prop(cur, DTD_ATTR_TYPE,
3114 		    tabptr->zone_attr_type);
3115 		value_match = match_prop(cur, DTD_ATTR_VALUE,
3116 		    tabptr->zone_attr_value);
3117 
3118 		if (name_match && type_match && value_match) {
3119 			xmlUnlinkNode(cur);
3120 			xmlFreeNode(cur);
3121 			return (Z_OK);
3122 		}
3123 	}
3124 	return (Z_NO_RESOURCE_ID);
3125 }
3126 
3127 int
3128 zonecfg_delete_attr(zone_dochandle_t handle, struct zone_attrtab *tabptr)
3129 {
3130 	int err;
3131 
3132 	if (tabptr == NULL)
3133 		return (Z_INVAL);
3134 
3135 	if ((err = operation_prep(handle)) != Z_OK)
3136 		return (err);
3137 
3138 	if ((err = zonecfg_delete_attr_core(handle, tabptr)) != Z_OK)
3139 		return (err);
3140 
3141 	return (Z_OK);
3142 }
3143 
3144 int
3145 zonecfg_modify_attr(
3146 	zone_dochandle_t handle,
3147 	struct zone_attrtab *oldtabptr,
3148 	struct zone_attrtab *newtabptr)
3149 {
3150 	int err;
3151 
3152 	if (oldtabptr == NULL || newtabptr == NULL)
3153 		return (Z_INVAL);
3154 
3155 	if ((err = operation_prep(handle)) != Z_OK)
3156 		return (err);
3157 
3158 	if ((err = zonecfg_delete_attr_core(handle, oldtabptr)) != Z_OK)
3159 		return (err);
3160 
3161 	if ((err = zonecfg_add_attr_core(handle, newtabptr)) != Z_OK)
3162 		return (err);
3163 
3164 	return (Z_OK);
3165 }
3166 
3167 int
3168 zonecfg_get_attr_boolean(const struct zone_attrtab *attr, boolean_t *value)
3169 {
3170 	if (attr == NULL)
3171 		return (Z_INVAL);
3172 
3173 	if (strcmp(attr->zone_attr_type, DTD_ENTITY_BOOLEAN) != 0)
3174 		return (Z_INVAL);
3175 
3176 	if (strcmp(attr->zone_attr_value, DTD_ENTITY_TRUE) == 0) {
3177 		*value = B_TRUE;
3178 		return (Z_OK);
3179 	}
3180 	if (strcmp(attr->zone_attr_value, DTD_ENTITY_FALSE) == 0) {
3181 		*value = B_FALSE;
3182 		return (Z_OK);
3183 	}
3184 	return (Z_INVAL);
3185 }
3186 
3187 int
3188 zonecfg_get_attr_int(const struct zone_attrtab *attr, int64_t *value)
3189 {
3190 	long long result;
3191 	char *endptr;
3192 
3193 	if (attr == NULL)
3194 		return (Z_INVAL);
3195 
3196 	if (strcmp(attr->zone_attr_type, DTD_ENTITY_INT) != 0)
3197 		return (Z_INVAL);
3198 
3199 	errno = 0;
3200 	result = strtoll(attr->zone_attr_value, &endptr, 10);
3201 	if (errno != 0 || *endptr != '\0')
3202 		return (Z_INVAL);
3203 	*value = result;
3204 	return (Z_OK);
3205 }
3206 
3207 int
3208 zonecfg_get_attr_string(const struct zone_attrtab *attr, char *value,
3209     size_t val_sz)
3210 {
3211 	if (attr == NULL)
3212 		return (Z_INVAL);
3213 
3214 	if (strcmp(attr->zone_attr_type, DTD_ENTITY_STRING) != 0)
3215 		return (Z_INVAL);
3216 
3217 	if (strlcpy(value, attr->zone_attr_value, val_sz) >= val_sz)
3218 		return (Z_TOO_BIG);
3219 	return (Z_OK);
3220 }
3221 
3222 int
3223 zonecfg_get_attr_uint(const struct zone_attrtab *attr, uint64_t *value)
3224 {
3225 	unsigned long long result;
3226 	long long neg_result;
3227 	char *endptr;
3228 
3229 	if (attr == NULL)
3230 		return (Z_INVAL);
3231 
3232 	if (strcmp(attr->zone_attr_type, DTD_ENTITY_UINT) != 0)
3233 		return (Z_INVAL);
3234 
3235 	errno = 0;
3236 	result = strtoull(attr->zone_attr_value, &endptr, 10);
3237 	if (errno != 0 || *endptr != '\0')
3238 		return (Z_INVAL);
3239 	errno = 0;
3240 	neg_result = strtoll(attr->zone_attr_value, &endptr, 10);
3241 	/*
3242 	 * Incredibly, strtoull("<negative number>", ...) will not fail but
3243 	 * return whatever (negative) number cast as a u_longlong_t, so we
3244 	 * need to look for this here.
3245 	 */
3246 	if (errno == 0 && neg_result < 0)
3247 		return (Z_INVAL);
3248 	*value = result;
3249 	return (Z_OK);
3250 }
3251 
3252 int
3253 zonecfg_lookup_rctl(zone_dochandle_t handle, struct zone_rctltab *tabptr)
3254 {
3255 	xmlNodePtr cur, val;
3256 	char savedname[MAXNAMELEN];
3257 	struct zone_rctlvaltab *valptr;
3258 	int err;
3259 
3260 	if (strlen(tabptr->zone_rctl_name) == 0)
3261 		return (Z_INVAL);
3262 
3263 	if ((err = operation_prep(handle)) != Z_OK)
3264 		return (err);
3265 
3266 	cur = handle->zone_dh_cur;
3267 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
3268 		if (xmlStrcmp(cur->name, DTD_ELEM_RCTL))
3269 			continue;
3270 		if ((fetchprop(cur, DTD_ATTR_NAME, savedname,
3271 		    sizeof (savedname)) == Z_OK) &&
3272 		    (strcmp(savedname, tabptr->zone_rctl_name) == 0)) {
3273 			tabptr->zone_rctl_valptr = NULL;
3274 			for (val = cur->xmlChildrenNode; val != NULL;
3275 			    val = val->next) {
3276 				valptr = (struct zone_rctlvaltab *)malloc(
3277 				    sizeof (struct zone_rctlvaltab));
3278 				if (valptr == NULL)
3279 					return (Z_NOMEM);
3280 				if ((fetchprop(val, DTD_ATTR_PRIV,
3281 				    valptr->zone_rctlval_priv,
3282 				    sizeof (valptr->zone_rctlval_priv)) !=
3283 				    Z_OK))
3284 					break;
3285 				if ((fetchprop(val, DTD_ATTR_LIMIT,
3286 				    valptr->zone_rctlval_limit,
3287 				    sizeof (valptr->zone_rctlval_limit)) !=
3288 				    Z_OK))
3289 					break;
3290 				if ((fetchprop(val, DTD_ATTR_ACTION,
3291 				    valptr->zone_rctlval_action,
3292 				    sizeof (valptr->zone_rctlval_action)) !=
3293 				    Z_OK))
3294 					break;
3295 				if (zonecfg_add_rctl_value(tabptr, valptr) !=
3296 				    Z_OK)
3297 					break;
3298 			}
3299 			return (Z_OK);
3300 		}
3301 	}
3302 	return (Z_NO_RESOURCE_ID);
3303 }
3304 
3305 static int
3306 zonecfg_add_rctl_core(zone_dochandle_t handle, struct zone_rctltab *tabptr)
3307 {
3308 	xmlNodePtr newnode, cur = handle->zone_dh_cur, valnode;
3309 	struct zone_rctlvaltab *valptr;
3310 	int err;
3311 
3312 	newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_RCTL, NULL);
3313 	err = newprop(newnode, DTD_ATTR_NAME, tabptr->zone_rctl_name);
3314 	if (err != Z_OK)
3315 		return (err);
3316 	for (valptr = tabptr->zone_rctl_valptr; valptr != NULL;
3317 	    valptr = valptr->zone_rctlval_next) {
3318 		valnode = xmlNewTextChild(newnode, NULL,
3319 		    DTD_ELEM_RCTLVALUE, NULL);
3320 		err = newprop(valnode, DTD_ATTR_PRIV,
3321 		    valptr->zone_rctlval_priv);
3322 		if (err != Z_OK)
3323 			return (err);
3324 		err = newprop(valnode, DTD_ATTR_LIMIT,
3325 		    valptr->zone_rctlval_limit);
3326 		if (err != Z_OK)
3327 			return (err);
3328 		err = newprop(valnode, DTD_ATTR_ACTION,
3329 		    valptr->zone_rctlval_action);
3330 		if (err != Z_OK)
3331 			return (err);
3332 	}
3333 	return (Z_OK);
3334 }
3335 
3336 int
3337 zonecfg_add_rctl(zone_dochandle_t handle, struct zone_rctltab *tabptr)
3338 {
3339 	int err;
3340 
3341 	if (tabptr == NULL)
3342 		return (Z_INVAL);
3343 
3344 	if ((err = operation_prep(handle)) != Z_OK)
3345 		return (err);
3346 
3347 	if ((err = zonecfg_add_rctl_core(handle, tabptr)) != Z_OK)
3348 		return (err);
3349 
3350 	return (Z_OK);
3351 }
3352 
3353 static int
3354 zonecfg_delete_rctl_core(zone_dochandle_t handle, struct zone_rctltab *tabptr)
3355 {
3356 	xmlNodePtr cur = handle->zone_dh_cur;
3357 	xmlChar *savedname;
3358 	int name_result;
3359 
3360 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
3361 		if (xmlStrcmp(cur->name, DTD_ELEM_RCTL))
3362 			continue;
3363 
3364 		savedname = xmlGetProp(cur, DTD_ATTR_NAME);
3365 		if (savedname == NULL)	/* shouldn't happen */
3366 			continue;
3367 		name_result = xmlStrcmp(savedname,
3368 		    (const xmlChar *) tabptr->zone_rctl_name);
3369 		xmlFree(savedname);
3370 
3371 		if (name_result == 0) {
3372 			xmlUnlinkNode(cur);
3373 			xmlFreeNode(cur);
3374 			return (Z_OK);
3375 		}
3376 	}
3377 	return (Z_NO_RESOURCE_ID);
3378 }
3379 
3380 int
3381 zonecfg_delete_rctl(zone_dochandle_t handle, struct zone_rctltab *tabptr)
3382 {
3383 	int err;
3384 
3385 	if (tabptr == NULL)
3386 		return (Z_INVAL);
3387 
3388 	if ((err = operation_prep(handle)) != Z_OK)
3389 		return (err);
3390 
3391 	if ((err = zonecfg_delete_rctl_core(handle, tabptr)) != Z_OK)
3392 		return (err);
3393 
3394 	return (Z_OK);
3395 }
3396 
3397 int
3398 zonecfg_modify_rctl(
3399 	zone_dochandle_t handle,
3400 	struct zone_rctltab *oldtabptr,
3401 	struct zone_rctltab *newtabptr)
3402 {
3403 	int err;
3404 
3405 	if (oldtabptr == NULL || newtabptr == NULL)
3406 		return (Z_INVAL);
3407 
3408 	if ((err = operation_prep(handle)) != Z_OK)
3409 		return (err);
3410 
3411 	if ((err = zonecfg_delete_rctl_core(handle, oldtabptr)) != Z_OK)
3412 		return (err);
3413 
3414 	if ((err = zonecfg_add_rctl_core(handle, newtabptr)) != Z_OK)
3415 		return (err);
3416 
3417 	return (Z_OK);
3418 }
3419 
3420 int
3421 zonecfg_add_rctl_value(
3422 	struct zone_rctltab *tabptr,
3423 	struct zone_rctlvaltab *valtabptr)
3424 {
3425 	struct zone_rctlvaltab *last, *old, *new;
3426 	rctlblk_t *rctlblk = alloca(rctlblk_size());
3427 
3428 	last = tabptr->zone_rctl_valptr;
3429 	for (old = last; old != NULL; old = old->zone_rctlval_next)
3430 		last = old;	/* walk to the end of the list */
3431 	new = valtabptr;	/* alloc'd by caller */
3432 	new->zone_rctlval_next = NULL;
3433 	if (zonecfg_construct_rctlblk(valtabptr, rctlblk) != Z_OK)
3434 		return (Z_INVAL);
3435 	if (!zonecfg_valid_rctlblk(rctlblk))
3436 		return (Z_INVAL);
3437 	if (last == NULL)
3438 		tabptr->zone_rctl_valptr = new;
3439 	else
3440 		last->zone_rctlval_next = new;
3441 	return (Z_OK);
3442 }
3443 
3444 int
3445 zonecfg_remove_rctl_value(
3446 	struct zone_rctltab *tabptr,
3447 	struct zone_rctlvaltab *valtabptr)
3448 {
3449 	struct zone_rctlvaltab *last, *this, *next;
3450 
3451 	last = tabptr->zone_rctl_valptr;
3452 	for (this = last; this != NULL; this = this->zone_rctlval_next) {
3453 		if (strcmp(this->zone_rctlval_priv,
3454 		    valtabptr->zone_rctlval_priv) == 0 &&
3455 		    strcmp(this->zone_rctlval_limit,
3456 		    valtabptr->zone_rctlval_limit) == 0 &&
3457 		    strcmp(this->zone_rctlval_action,
3458 		    valtabptr->zone_rctlval_action) == 0) {
3459 			next = this->zone_rctlval_next;
3460 			if (this == tabptr->zone_rctl_valptr)
3461 				tabptr->zone_rctl_valptr = next;
3462 			else
3463 				last->zone_rctlval_next = next;
3464 			free(this);
3465 			return (Z_OK);
3466 		} else
3467 			last = this;
3468 	}
3469 	return (Z_NO_PROPERTY_ID);
3470 }
3471 
3472 void
3473 zonecfg_set_swinv(zone_dochandle_t handle)
3474 {
3475 	handle->zone_dh_sw_inv = B_TRUE;
3476 }
3477 
3478 /*
3479  * Add the pkg to the sw inventory on the handle.
3480  */
3481 int
3482 zonecfg_add_pkg(zone_dochandle_t handle, char *name, char *version)
3483 {
3484 	xmlNodePtr newnode;
3485 	xmlNodePtr cur;
3486 	int err;
3487 
3488 	if ((err = operation_prep(handle)) != Z_OK)
3489 		return (err);
3490 
3491 	cur = handle->zone_dh_cur;
3492 	newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_PACKAGE, NULL);
3493 	if ((err = newprop(newnode, DTD_ATTR_NAME, name)) != Z_OK)
3494 		return (err);
3495 	if ((err = newprop(newnode, DTD_ATTR_VERSION, version)) != Z_OK)
3496 		return (err);
3497 	return (Z_OK);
3498 }
3499 
3500 int
3501 zonecfg_add_patch(zone_dochandle_t handle, char *id, void **pnode)
3502 {
3503 	xmlNodePtr node = (xmlNodePtr)*pnode;
3504 	xmlNodePtr cur;
3505 	int err;
3506 
3507 	if ((err = operation_prep(handle)) != Z_OK)
3508 		return (err);
3509 
3510 	cur = handle->zone_dh_cur;
3511 	node = xmlNewTextChild(cur, NULL, DTD_ELEM_PATCH, NULL);
3512 	if ((err = newprop(node, DTD_ATTR_ID, id)) != Z_OK)
3513 		return (err);
3514 	*pnode = (void *)node;
3515 	return (Z_OK);
3516 }
3517 
3518 int
3519 zonecfg_add_patch_obs(char *id, void *cur)
3520 {
3521 	xmlNodePtr	node;
3522 	int err;
3523 
3524 	node = xmlNewTextChild((xmlNodePtr)cur, NULL, DTD_ELEM_OBSOLETES, NULL);
3525 	if ((err = newprop(node, DTD_ATTR_ID, id)) != Z_OK)
3526 		return (err);
3527 	return (Z_OK);
3528 }
3529 
3530 char *
3531 zonecfg_strerror(int errnum)
3532 {
3533 	switch (errnum) {
3534 	case Z_OK:
3535 		return (dgettext(TEXT_DOMAIN, "OK"));
3536 	case Z_EMPTY_DOCUMENT:
3537 		return (dgettext(TEXT_DOMAIN, "Empty document"));
3538 	case Z_WRONG_DOC_TYPE:
3539 		return (dgettext(TEXT_DOMAIN, "Wrong document type"));
3540 	case Z_BAD_PROPERTY:
3541 		return (dgettext(TEXT_DOMAIN, "Bad document property"));
3542 	case Z_TEMP_FILE:
3543 		return (dgettext(TEXT_DOMAIN,
3544 		    "Problem creating temporary file"));
3545 	case Z_SAVING_FILE:
3546 		return (dgettext(TEXT_DOMAIN, "Problem saving file"));
3547 	case Z_NO_ENTRY:
3548 		return (dgettext(TEXT_DOMAIN, "No such entry"));
3549 	case Z_BOGUS_ZONE_NAME:
3550 		return (dgettext(TEXT_DOMAIN, "Bogus zone name"));
3551 	case Z_REQD_RESOURCE_MISSING:
3552 		return (dgettext(TEXT_DOMAIN, "Required resource missing"));
3553 	case Z_REQD_PROPERTY_MISSING:
3554 		return (dgettext(TEXT_DOMAIN, "Required property missing"));
3555 	case Z_BAD_HANDLE:
3556 		return (dgettext(TEXT_DOMAIN, "Bad handle"));
3557 	case Z_NOMEM:
3558 		return (dgettext(TEXT_DOMAIN, "Out of memory"));
3559 	case Z_INVAL:
3560 		return (dgettext(TEXT_DOMAIN, "Invalid argument"));
3561 	case Z_ACCES:
3562 		return (dgettext(TEXT_DOMAIN, "Permission denied"));
3563 	case Z_TOO_BIG:
3564 		return (dgettext(TEXT_DOMAIN, "Argument list too long"));
3565 	case Z_MISC_FS:
3566 		return (dgettext(TEXT_DOMAIN,
3567 		    "Miscellaneous file system error"));
3568 	case Z_NO_ZONE:
3569 		return (dgettext(TEXT_DOMAIN, "No such zone configured"));
3570 	case Z_NO_RESOURCE_TYPE:
3571 		return (dgettext(TEXT_DOMAIN, "No such resource type"));
3572 	case Z_NO_RESOURCE_ID:
3573 		return (dgettext(TEXT_DOMAIN, "No such resource with that id"));
3574 	case Z_NO_PROPERTY_TYPE:
3575 		return (dgettext(TEXT_DOMAIN, "No such property type"));
3576 	case Z_NO_PROPERTY_ID:
3577 		return (dgettext(TEXT_DOMAIN, "No such property with that id"));
3578 	case Z_BAD_ZONE_STATE:
3579 		return (dgettext(TEXT_DOMAIN,
3580 		    "Zone state is invalid for the requested operation"));
3581 	case Z_INVALID_DOCUMENT:
3582 		return (dgettext(TEXT_DOMAIN, "Invalid document"));
3583 	case Z_NAME_IN_USE:
3584 		return (dgettext(TEXT_DOMAIN, "Zone name already in use"));
3585 	case Z_NO_SUCH_ID:
3586 		return (dgettext(TEXT_DOMAIN, "No such zone ID"));
3587 	case Z_UPDATING_INDEX:
3588 		return (dgettext(TEXT_DOMAIN, "Problem updating index file"));
3589 	case Z_LOCKING_FILE:
3590 		return (dgettext(TEXT_DOMAIN, "Locking index file"));
3591 	case Z_UNLOCKING_FILE:
3592 		return (dgettext(TEXT_DOMAIN, "Unlocking index file"));
3593 	case Z_INSUFFICIENT_SPEC:
3594 		return (dgettext(TEXT_DOMAIN, "Insufficient specification"));
3595 	case Z_RESOLVED_PATH:
3596 		return (dgettext(TEXT_DOMAIN, "Resolved path mismatch"));
3597 	case Z_IPV6_ADDR_PREFIX_LEN:
3598 		return (dgettext(TEXT_DOMAIN,
3599 		    "IPv6 address missing required prefix length"));
3600 	case Z_BOGUS_ADDRESS:
3601 		return (dgettext(TEXT_DOMAIN,
3602 		    "Neither an IPv4 nor an IPv6 address nor a host name"));
3603 	case Z_PRIV_PROHIBITED:
3604 		return (dgettext(TEXT_DOMAIN,
3605 		    "Specified privilege is prohibited"));
3606 	case Z_PRIV_REQUIRED:
3607 		return (dgettext(TEXT_DOMAIN,
3608 		    "Required privilege is missing"));
3609 	case Z_PRIV_UNKNOWN:
3610 		return (dgettext(TEXT_DOMAIN,
3611 		    "Specified privilege is unknown"));
3612 	case Z_BRAND_ERROR:
3613 		return (dgettext(TEXT_DOMAIN,
3614 		    "Brand-specific error"));
3615 	case Z_INCOMPATIBLE:
3616 		return (dgettext(TEXT_DOMAIN, "Incompatible settings"));
3617 	case Z_ALIAS_DISALLOW:
3618 		return (dgettext(TEXT_DOMAIN,
3619 		    "An incompatible rctl already exists for this property"));
3620 	case Z_CLEAR_DISALLOW:
3621 		return (dgettext(TEXT_DOMAIN,
3622 		    "Clearing this property is not allowed"));
3623 	case Z_POOL:
3624 		return (dgettext(TEXT_DOMAIN, "libpool(3LIB) error"));
3625 	case Z_POOLS_NOT_ACTIVE:
3626 		return (dgettext(TEXT_DOMAIN, "Pools facility not active; "
3627 		    "zone will not be bound to pool"));
3628 	case Z_POOL_ENABLE:
3629 		return (dgettext(TEXT_DOMAIN,
3630 		    "Could not enable pools facility"));
3631 	case Z_NO_POOL:
3632 		return (dgettext(TEXT_DOMAIN,
3633 		    "Pool not found; using default pool"));
3634 	case Z_POOL_CREATE:
3635 		return (dgettext(TEXT_DOMAIN,
3636 		    "Could not create a temporary pool"));
3637 	case Z_POOL_BIND:
3638 		return (dgettext(TEXT_DOMAIN, "Could not bind zone to pool"));
3639 	case Z_INVALID_PROPERTY:
3640 		return (dgettext(TEXT_DOMAIN, "Specified property is invalid"));
3641 	case Z_SYSTEM:
3642 		return (strerror(errno));
3643 	default:
3644 		return (dgettext(TEXT_DOMAIN, "Unknown error"));
3645 	}
3646 }
3647 
3648 /*
3649  * Note that the zonecfg_setXent() and zonecfg_endXent() calls are all the
3650  * same, as they just turn around and call zonecfg_setent() / zonecfg_endent().
3651  */
3652 
3653 static int
3654 zonecfg_setent(zone_dochandle_t handle)
3655 {
3656 	xmlNodePtr cur;
3657 	int err;
3658 
3659 	if (handle == NULL)
3660 		return (Z_INVAL);
3661 
3662 	if ((err = operation_prep(handle)) != Z_OK) {
3663 		handle->zone_dh_cur = NULL;
3664 		return (err);
3665 	}
3666 	cur = handle->zone_dh_cur;
3667 	cur = cur->xmlChildrenNode;
3668 	handle->zone_dh_cur = cur;
3669 	return (Z_OK);
3670 }
3671 
3672 static int
3673 zonecfg_endent(zone_dochandle_t handle)
3674 {
3675 	if (handle == NULL)
3676 		return (Z_INVAL);
3677 
3678 	handle->zone_dh_cur = handle->zone_dh_top;
3679 	return (Z_OK);
3680 }
3681 
3682 /*
3683  * Do the work required to manipulate a process through libproc.
3684  * If grab_process() returns no errors (0), then release_process()
3685  * must eventually be called.
3686  *
3687  * Return values:
3688  *      0 Successful creation of agent thread
3689  *      1 Error grabbing
3690  *      2 Error creating agent
3691  */
3692 static int
3693 grab_process(pr_info_handle_t *p)
3694 {
3695 	int ret;
3696 
3697 	if ((p->pr = Pgrab(p->pid, 0, &ret)) != NULL) {
3698 
3699 		if (Psetflags(p->pr, PR_RLC) != 0) {
3700 			Prelease(p->pr, 0);
3701 			return (1);
3702 		}
3703 		if (Pcreate_agent(p->pr) == 0) {
3704 			return (0);
3705 
3706 		} else {
3707 			Prelease(p->pr, 0);
3708 			return (2);
3709 		}
3710 	} else {
3711 		return (1);
3712 	}
3713 }
3714 
3715 /*
3716  * Release the specified process. This destroys the agent
3717  * and releases the process. If the process is NULL, nothing
3718  * is done. This function should only be called if grab_process()
3719  * has previously been called and returned success.
3720  *
3721  * This function is Pgrab-safe.
3722  */
3723 static void
3724 release_process(struct ps_prochandle *Pr)
3725 {
3726 	if (Pr == NULL)
3727 		return;
3728 
3729 	Pdestroy_agent(Pr);
3730 	Prelease(Pr, 0);
3731 }
3732 
3733 static boolean_t
3734 grab_zone_proc(char *zonename, pr_info_handle_t *p)
3735 {
3736 	DIR *dirp;
3737 	struct dirent *dentp;
3738 	zoneid_t zoneid;
3739 	int pid_self;
3740 	psinfo_t psinfo;
3741 
3742 	if (zone_get_id(zonename, &zoneid) != 0)
3743 		return (B_FALSE);
3744 
3745 	pid_self = getpid();
3746 
3747 	if ((dirp = opendir("/proc")) == NULL)
3748 		return (B_FALSE);
3749 
3750 	while (dentp = readdir(dirp)) {
3751 		p->pid = atoi(dentp->d_name);
3752 
3753 		/* Skip self */
3754 		if (p->pid == pid_self)
3755 			continue;
3756 
3757 		if (proc_get_psinfo(p->pid, &psinfo) != 0)
3758 			continue;
3759 
3760 		if (psinfo.pr_zoneid != zoneid)
3761 			continue;
3762 
3763 		/* attempt to grab process */
3764 		if (grab_process(p) != 0)
3765 			continue;
3766 
3767 		if (pr_getzoneid(p->pr) != zoneid) {
3768 			release_process(p->pr);
3769 			continue;
3770 		}
3771 
3772 		(void) closedir(dirp);
3773 		return (B_TRUE);
3774 	}
3775 
3776 	(void) closedir(dirp);
3777 	return (B_FALSE);
3778 }
3779 
3780 static boolean_t
3781 get_priv_rctl(struct ps_prochandle *pr, char *name, rctlblk_t *rblk)
3782 {
3783 	if (pr_getrctl(pr, name, NULL, rblk, RCTL_FIRST))
3784 		return (B_FALSE);
3785 
3786 	if (rctlblk_get_privilege(rblk) == RCPRIV_PRIVILEGED)
3787 		return (B_TRUE);
3788 
3789 	while (pr_getrctl(pr, name, rblk, rblk, RCTL_NEXT) == 0) {
3790 		if (rctlblk_get_privilege(rblk) == RCPRIV_PRIVILEGED)
3791 			return (B_TRUE);
3792 	}
3793 
3794 	return (B_FALSE);
3795 }
3796 
3797 /*
3798  * Apply the current rctl settings to the specified, running zone.
3799  */
3800 int
3801 zonecfg_apply_rctls(char *zone_name, zone_dochandle_t handle)
3802 {
3803 	int err;
3804 	int res = Z_OK;
3805 	rctlblk_t *rblk;
3806 	pr_info_handle_t p;
3807 	struct zone_rctltab rctl;
3808 
3809 	if ((err = zonecfg_setrctlent(handle)) != Z_OK)
3810 		return (err);
3811 
3812 	if ((rblk = (rctlblk_t *)malloc(rctlblk_size())) == NULL) {
3813 		(void) zonecfg_endrctlent(handle);
3814 		return (Z_NOMEM);
3815 	}
3816 
3817 	if (!grab_zone_proc(zone_name, &p)) {
3818 		(void) zonecfg_endrctlent(handle);
3819 		free(rblk);
3820 		return (Z_SYSTEM);
3821 	}
3822 
3823 	while (zonecfg_getrctlent(handle, &rctl) == Z_OK) {
3824 		char *rname;
3825 		struct zone_rctlvaltab *valptr;
3826 
3827 		rname = rctl.zone_rctl_name;
3828 
3829 		/* first delete all current privileged settings for this rctl */
3830 		while (get_priv_rctl(p.pr, rname, rblk)) {
3831 			if (pr_setrctl(p.pr, rname, NULL, rblk, RCTL_DELETE) !=
3832 			    0) {
3833 				res = Z_SYSTEM;
3834 				goto done;
3835 			}
3836 		}
3837 
3838 		/* now set each new value for the rctl */
3839 		for (valptr = rctl.zone_rctl_valptr; valptr != NULL;
3840 		    valptr = valptr->zone_rctlval_next) {
3841 			if ((err = zonecfg_construct_rctlblk(valptr, rblk))
3842 			    != Z_OK) {
3843 				res = errno = err;
3844 				goto done;
3845 			}
3846 
3847 			if (pr_setrctl(p.pr, rname, NULL, rblk, RCTL_INSERT)) {
3848 				res = Z_SYSTEM;
3849 				goto done;
3850 			}
3851 		}
3852 	}
3853 
3854 done:
3855 	release_process(p.pr);
3856 	free(rblk);
3857 	(void) zonecfg_endrctlent(handle);
3858 
3859 	return (res);
3860 }
3861 
3862 static const xmlChar *
3863 nm_to_dtd(char *nm)
3864 {
3865 	if (strcmp(nm, "device") == 0)
3866 		return (DTD_ELEM_DEVICE);
3867 	if (strcmp(nm, "fs") == 0)
3868 		return (DTD_ELEM_FS);
3869 	if (strcmp(nm, "net") == 0)
3870 		return (DTD_ELEM_NET);
3871 	if (strcmp(nm, "attr") == 0)
3872 		return (DTD_ELEM_ATTR);
3873 	if (strcmp(nm, "rctl") == 0)
3874 		return (DTD_ELEM_RCTL);
3875 	if (strcmp(nm, "dataset") == 0)
3876 		return (DTD_ELEM_DATASET);
3877 	if (strcmp(nm, "admin") == 0)
3878 		return (DTD_ELEM_ADMIN);
3879 
3880 	return (NULL);
3881 }
3882 
3883 int
3884 zonecfg_num_resources(zone_dochandle_t handle, char *rsrc)
3885 {
3886 	int num = 0;
3887 	const xmlChar *dtd;
3888 	xmlNodePtr cur;
3889 
3890 	if ((dtd = nm_to_dtd(rsrc)) == NULL)
3891 		return (num);
3892 
3893 	if (zonecfg_setent(handle) != Z_OK)
3894 		return (num);
3895 
3896 	for (cur = handle->zone_dh_cur; cur != NULL; cur = cur->next)
3897 		if (xmlStrcmp(cur->name, dtd) == 0)
3898 			num++;
3899 
3900 	(void) zonecfg_endent(handle);
3901 
3902 	return (num);
3903 }
3904 
3905 int
3906 zonecfg_del_all_resources(zone_dochandle_t handle, char *rsrc)
3907 {
3908 	int err;
3909 	const xmlChar *dtd;
3910 	xmlNodePtr cur;
3911 
3912 	if ((dtd = nm_to_dtd(rsrc)) == NULL)
3913 		return (Z_NO_RESOURCE_TYPE);
3914 
3915 	if ((err = zonecfg_setent(handle)) != Z_OK)
3916 		return (err);
3917 
3918 	cur = handle->zone_dh_cur;
3919 	while (cur != NULL) {
3920 		xmlNodePtr tmp;
3921 
3922 		if (xmlStrcmp(cur->name, dtd)) {
3923 			cur = cur->next;
3924 			continue;
3925 		}
3926 
3927 		tmp = cur->next;
3928 		xmlUnlinkNode(cur);
3929 		xmlFreeNode(cur);
3930 		cur = tmp;
3931 	}
3932 
3933 	(void) zonecfg_endent(handle);
3934 	return (Z_OK);
3935 }
3936 
3937 static boolean_t
3938 valid_uint(char *s, uint64_t *n)
3939 {
3940 	char *endp;
3941 
3942 	/* strtoull accepts '-'?! so we want to flag that as an error */
3943 	if (strchr(s, '-') != NULL)
3944 		return (B_FALSE);
3945 
3946 	errno = 0;
3947 	*n = strtoull(s, &endp, 10);
3948 
3949 	if (errno != 0 || *endp != '\0')
3950 		return (B_FALSE);
3951 	return (B_TRUE);
3952 }
3953 
3954 /*
3955  * Convert a string representing a number (possibly a fraction) into an integer.
3956  * The string can have a modifier (K, M, G or T).   The modifiers are treated
3957  * as powers of two (not 10).
3958  */
3959 int
3960 zonecfg_str_to_bytes(char *str, uint64_t *bytes)
3961 {
3962 	long double val;
3963 	char *unitp;
3964 	uint64_t scale;
3965 
3966 	if ((val = strtold(str, &unitp)) < 0)
3967 		return (-1);
3968 
3969 	/* remove any leading white space from units string */
3970 	while (isspace(*unitp) != 0)
3971 		++unitp;
3972 
3973 	/* if no units explicitly set, error */
3974 	if (unitp == NULL || *unitp == '\0') {
3975 		scale = 1;
3976 	} else {
3977 		int i;
3978 		char *units[] = {"K", "M", "G", "T", NULL};
3979 
3980 		scale = 1024;
3981 
3982 		/* update scale based on units */
3983 		for (i = 0; units[i] != NULL; i++) {
3984 			if (strcasecmp(unitp, units[i]) == 0)
3985 				break;
3986 			scale <<= 10;
3987 		}
3988 
3989 		if (units[i] == NULL)
3990 			return (-1);
3991 	}
3992 
3993 	*bytes = (uint64_t)(val * scale);
3994 	return (0);
3995 }
3996 
3997 boolean_t
3998 zonecfg_valid_ncpus(char *lowstr, char *highstr)
3999 {
4000 	uint64_t low, high;
4001 
4002 	if (!valid_uint(lowstr, &low) || !valid_uint(highstr, &high) ||
4003 	    low < 1 || low > high)
4004 		return (B_FALSE);
4005 
4006 	return (B_TRUE);
4007 }
4008 
4009 boolean_t
4010 zonecfg_valid_importance(char *impstr)
4011 {
4012 	uint64_t num;
4013 
4014 	if (!valid_uint(impstr, &num))
4015 		return (B_FALSE);
4016 
4017 	return (B_TRUE);
4018 }
4019 
4020 boolean_t
4021 zonecfg_valid_alias_limit(char *name, char *limitstr, uint64_t *limit)
4022 {
4023 	int i;
4024 
4025 	for (i = 0; aliases[i].shortname != NULL; i++)
4026 		if (strcmp(name, aliases[i].shortname) == 0)
4027 			break;
4028 
4029 	if (aliases[i].shortname == NULL)
4030 		return (B_FALSE);
4031 
4032 	if (!valid_uint(limitstr, limit) || *limit < aliases[i].low_limit)
4033 		return (B_FALSE);
4034 
4035 	return (B_TRUE);
4036 }
4037 
4038 boolean_t
4039 zonecfg_valid_memlimit(char *memstr, uint64_t *mem_val)
4040 {
4041 	if (zonecfg_str_to_bytes(memstr, mem_val) != 0)
4042 		return (B_FALSE);
4043 
4044 	return (B_TRUE);
4045 }
4046 
4047 static int
4048 zerr_pool(char *pool_err, int err_size, int res)
4049 {
4050 	(void) strlcpy(pool_err, pool_strerror(pool_error()), err_size);
4051 	return (res);
4052 }
4053 
4054 static int
4055 create_tmp_pset(char *pool_err, int err_size, pool_conf_t *pconf, pool_t *pool,
4056     char *name, int min, int max)
4057 {
4058 	pool_resource_t *res;
4059 	pool_elem_t *elem;
4060 	pool_value_t *val;
4061 
4062 	if ((res = pool_resource_create(pconf, "pset", name)) == NULL)
4063 		return (zerr_pool(pool_err, err_size, Z_POOL));
4064 
4065 	if (pool_associate(pconf, pool, res) != PO_SUCCESS)
4066 		return (zerr_pool(pool_err, err_size, Z_POOL));
4067 
4068 	if ((elem = pool_resource_to_elem(pconf, res)) == NULL)
4069 		return (zerr_pool(pool_err, err_size, Z_POOL));
4070 
4071 	if ((val = pool_value_alloc()) == NULL)
4072 		return (zerr_pool(pool_err, err_size, Z_POOL));
4073 
4074 	/* set the maximum number of cpus for the pset */
4075 	pool_value_set_uint64(val, (uint64_t)max);
4076 
4077 	if (pool_put_property(pconf, elem, "pset.max", val) != PO_SUCCESS) {
4078 		pool_value_free(val);
4079 		return (zerr_pool(pool_err, err_size, Z_POOL));
4080 	}
4081 
4082 	/* set the minimum number of cpus for the pset */
4083 	pool_value_set_uint64(val, (uint64_t)min);
4084 
4085 	if (pool_put_property(pconf, elem, "pset.min", val) != PO_SUCCESS) {
4086 		pool_value_free(val);
4087 		return (zerr_pool(pool_err, err_size, Z_POOL));
4088 	}
4089 
4090 	pool_value_free(val);
4091 
4092 	return (Z_OK);
4093 }
4094 
4095 static int
4096 create_tmp_pool(char *pool_err, int err_size, pool_conf_t *pconf, char *name,
4097     struct zone_psettab *pset_tab)
4098 {
4099 	pool_t *pool;
4100 	int res = Z_OK;
4101 
4102 	/* create a temporary pool configuration */
4103 	if (pool_conf_open(pconf, NULL, PO_TEMP) != PO_SUCCESS) {
4104 		res = zerr_pool(pool_err, err_size, Z_POOL);
4105 		return (res);
4106 	}
4107 
4108 	if ((pool = pool_create(pconf, name)) == NULL) {
4109 		res = zerr_pool(pool_err, err_size, Z_POOL_CREATE);
4110 		goto done;
4111 	}
4112 
4113 	/* set pool importance */
4114 	if (pset_tab->zone_importance[0] != '\0') {
4115 		pool_elem_t *elem;
4116 		pool_value_t *val;
4117 
4118 		if ((elem = pool_to_elem(pconf, pool)) == NULL) {
4119 			res = zerr_pool(pool_err, err_size, Z_POOL);
4120 			goto done;
4121 		}
4122 
4123 		if ((val = pool_value_alloc()) == NULL) {
4124 			res = zerr_pool(pool_err, err_size, Z_POOL);
4125 			goto done;
4126 		}
4127 
4128 		pool_value_set_int64(val,
4129 		    (int64_t)atoi(pset_tab->zone_importance));
4130 
4131 		if (pool_put_property(pconf, elem, "pool.importance", val)
4132 		    != PO_SUCCESS) {
4133 			res = zerr_pool(pool_err, err_size, Z_POOL);
4134 			pool_value_free(val);
4135 			goto done;
4136 		}
4137 
4138 		pool_value_free(val);
4139 	}
4140 
4141 	if ((res = create_tmp_pset(pool_err, err_size, pconf, pool, name,
4142 	    atoi(pset_tab->zone_ncpu_min),
4143 	    atoi(pset_tab->zone_ncpu_max))) != Z_OK)
4144 		goto done;
4145 
4146 	/* validation */
4147 	if (pool_conf_status(pconf) == POF_INVALID) {
4148 		res = zerr_pool(pool_err, err_size, Z_POOL);
4149 		goto done;
4150 	}
4151 
4152 	/*
4153 	 * This validation is the one we expect to fail if the user specified
4154 	 * an invalid configuration (too many cpus) for this system.
4155 	 */
4156 	if (pool_conf_validate(pconf, POV_RUNTIME) != PO_SUCCESS) {
4157 		res = zerr_pool(pool_err, err_size, Z_POOL_CREATE);
4158 		goto done;
4159 	}
4160 
4161 	/*
4162 	 * Commit the dynamic configuration but not the pool configuration
4163 	 * file.
4164 	 */
4165 	if (pool_conf_commit(pconf, 1) != PO_SUCCESS)
4166 		res = zerr_pool(pool_err, err_size, Z_POOL);
4167 
4168 done:
4169 	(void) pool_conf_close(pconf);
4170 	return (res);
4171 }
4172 
4173 static int
4174 get_running_tmp_pset(pool_conf_t *pconf, pool_t *pool, pool_resource_t *pset,
4175     struct zone_psettab *pset_tab)
4176 {
4177 	int nfound = 0;
4178 	pool_elem_t *pe;
4179 	pool_value_t *pv = pool_value_alloc();
4180 	uint64_t val_uint;
4181 
4182 	if (pool != NULL) {
4183 		pe = pool_to_elem(pconf, pool);
4184 		if (pool_get_property(pconf, pe, "pool.importance", pv)
4185 		    != POC_INVAL) {
4186 			int64_t val_int;
4187 
4188 			(void) pool_value_get_int64(pv, &val_int);
4189 			(void) snprintf(pset_tab->zone_importance,
4190 			    sizeof (pset_tab->zone_importance), "%d", val_int);
4191 			nfound++;
4192 		}
4193 	}
4194 
4195 	if (pset != NULL) {
4196 		pe = pool_resource_to_elem(pconf, pset);
4197 		if (pool_get_property(pconf, pe, "pset.min", pv) != POC_INVAL) {
4198 			(void) pool_value_get_uint64(pv, &val_uint);
4199 			(void) snprintf(pset_tab->zone_ncpu_min,
4200 			    sizeof (pset_tab->zone_ncpu_min), "%u", val_uint);
4201 			nfound++;
4202 		}
4203 
4204 		if (pool_get_property(pconf, pe, "pset.max", pv) != POC_INVAL) {
4205 			(void) pool_value_get_uint64(pv, &val_uint);
4206 			(void) snprintf(pset_tab->zone_ncpu_max,
4207 			    sizeof (pset_tab->zone_ncpu_max), "%u", val_uint);
4208 			nfound++;
4209 		}
4210 	}
4211 
4212 	pool_value_free(pv);
4213 
4214 	if (nfound == 3)
4215 		return (PO_SUCCESS);
4216 
4217 	return (PO_FAIL);
4218 }
4219 
4220 /*
4221  * Determine if a tmp pool is configured and if so, if the configuration is
4222  * still valid or if it has been changed since the tmp pool was created.
4223  * If the tmp pool configuration is no longer valid, delete the tmp pool.
4224  *
4225  * Set *valid=B_TRUE if there is an existing, valid tmp pool configuration.
4226  */
4227 static int
4228 verify_del_tmp_pool(pool_conf_t *pconf, char *tmp_name, char *pool_err,
4229     int err_size, struct zone_psettab *pset_tab, boolean_t *exists)
4230 {
4231 	int res = Z_OK;
4232 	pool_t *pool;
4233 	pool_resource_t *pset;
4234 	struct zone_psettab pset_current;
4235 
4236 	*exists = B_FALSE;
4237 
4238 	if (pool_conf_open(pconf, pool_dynamic_location(), PO_RDWR)
4239 	    != PO_SUCCESS) {
4240 		res = zerr_pool(pool_err, err_size, Z_POOL);
4241 		return (res);
4242 	}
4243 
4244 	pool = pool_get_pool(pconf, tmp_name);
4245 	pset = pool_get_resource(pconf, "pset", tmp_name);
4246 
4247 	if (pool == NULL && pset == NULL) {
4248 		/* no tmp pool configured */
4249 		goto done;
4250 	}
4251 
4252 	/*
4253 	 * If an existing tmp pool for this zone is configured with the proper
4254 	 * settings, then the tmp pool is valid.
4255 	 */
4256 	if (get_running_tmp_pset(pconf, pool, pset, &pset_current)
4257 	    == PO_SUCCESS &&
4258 	    strcmp(pset_tab->zone_ncpu_min,
4259 	    pset_current.zone_ncpu_min) == 0 &&
4260 	    strcmp(pset_tab->zone_ncpu_max,
4261 	    pset_current.zone_ncpu_max) == 0 &&
4262 	    strcmp(pset_tab->zone_importance,
4263 	    pset_current.zone_importance) == 0) {
4264 		*exists = B_TRUE;
4265 
4266 	} else {
4267 		/*
4268 		 * An out-of-date tmp pool configuration exists.  Delete it
4269 		 * so that we can create the correct tmp pool config.
4270 		 */
4271 		if (pset != NULL &&
4272 		    pool_resource_destroy(pconf, pset) != PO_SUCCESS) {
4273 			res = zerr_pool(pool_err, err_size, Z_POOL);
4274 			goto done;
4275 		}
4276 
4277 		if (pool != NULL &&
4278 		    pool_destroy(pconf, pool) != PO_SUCCESS) {
4279 			res = zerr_pool(pool_err, err_size, Z_POOL);
4280 			goto done;
4281 		}
4282 
4283 		/* commit dynamic config */
4284 		if (pool_conf_commit(pconf, 0) != PO_SUCCESS)
4285 			res = zerr_pool(pool_err, err_size, Z_POOL);
4286 	}
4287 
4288 done:
4289 	(void) pool_conf_close(pconf);
4290 
4291 	return (res);
4292 }
4293 
4294 /*
4295  * Destroy any existing tmp pool.
4296  */
4297 int
4298 zonecfg_destroy_tmp_pool(char *zone_name, char *pool_err, int err_size)
4299 {
4300 	int status;
4301 	int res = Z_OK;
4302 	pool_conf_t *pconf;
4303 	pool_t *pool;
4304 	pool_resource_t *pset;
4305 	char tmp_name[MAX_TMP_POOL_NAME];
4306 
4307 	/* if pools not enabled then nothing to do */
4308 	if (pool_get_status(&status) != PO_SUCCESS || status != POOL_ENABLED)
4309 		return (Z_OK);
4310 
4311 	if ((pconf = pool_conf_alloc()) == NULL)
4312 		return (zerr_pool(pool_err, err_size, Z_POOL));
4313 
4314 	(void) snprintf(tmp_name, sizeof (tmp_name), TMP_POOL_NAME, zone_name);
4315 
4316 	if (pool_conf_open(pconf, pool_dynamic_location(), PO_RDWR)
4317 	    != PO_SUCCESS) {
4318 		res = zerr_pool(pool_err, err_size, Z_POOL);
4319 		pool_conf_free(pconf);
4320 		return (res);
4321 	}
4322 
4323 	pool = pool_get_pool(pconf, tmp_name);
4324 	pset = pool_get_resource(pconf, "pset", tmp_name);
4325 
4326 	if (pool == NULL && pset == NULL) {
4327 		/* nothing to destroy, we're done */
4328 		goto done;
4329 	}
4330 
4331 	if (pset != NULL && pool_resource_destroy(pconf, pset) != PO_SUCCESS) {
4332 		res = zerr_pool(pool_err, err_size, Z_POOL);
4333 		goto done;
4334 	}
4335 
4336 	if (pool != NULL && pool_destroy(pconf, pool) != PO_SUCCESS) {
4337 		res = zerr_pool(pool_err, err_size, Z_POOL);
4338 		goto done;
4339 	}
4340 
4341 	/* commit dynamic config */
4342 	if (pool_conf_commit(pconf, 0) != PO_SUCCESS)
4343 		res = zerr_pool(pool_err, err_size, Z_POOL);
4344 
4345 done:
4346 	(void) pool_conf_close(pconf);
4347 	pool_conf_free(pconf);
4348 
4349 	return (res);
4350 }
4351 
4352 /*
4353  * Attempt to bind to a tmp pool for this zone.  If there is no tmp pool
4354  * configured, we just return Z_OK.
4355  *
4356  * We either attempt to create the tmp pool for this zone or rebind to an
4357  * existing tmp pool for this zone.
4358  *
4359  * Rebinding is used when a zone with a tmp pool reboots so that we don't have
4360  * to recreate the tmp pool.  To do this we need to be sure we work correctly
4361  * for the following cases:
4362  *
4363  *	- there is an existing, properly configured tmp pool.
4364  *	- zonecfg added tmp pool after zone was booted, must now create.
4365  *	- zonecfg updated tmp pool config after zone was booted, in this case
4366  *	  we destroy the old tmp pool and create a new one.
4367  */
4368 int
4369 zonecfg_bind_tmp_pool(zone_dochandle_t handle, zoneid_t zoneid, char *pool_err,
4370     int err_size)
4371 {
4372 	struct zone_psettab pset_tab;
4373 	int err;
4374 	int status;
4375 	pool_conf_t *pconf;
4376 	boolean_t exists;
4377 	char zone_name[ZONENAME_MAX];
4378 	char tmp_name[MAX_TMP_POOL_NAME];
4379 
4380 	(void) getzonenamebyid(zoneid, zone_name, sizeof (zone_name));
4381 
4382 	err = zonecfg_lookup_pset(handle, &pset_tab);
4383 
4384 	/* if no temporary pool configured, we're done */
4385 	if (err == Z_NO_ENTRY)
4386 		return (Z_OK);
4387 
4388 	/*
4389 	 * importance might not have a value but we need to validate it here,
4390 	 * so set the default.
4391 	 */
4392 	if (pset_tab.zone_importance[0] == '\0')
4393 		(void) strlcpy(pset_tab.zone_importance, "1",
4394 		    sizeof (pset_tab.zone_importance));
4395 
4396 	/* if pools not enabled, enable them now */
4397 	if (pool_get_status(&status) != PO_SUCCESS || status != POOL_ENABLED) {
4398 		if (pool_set_status(POOL_ENABLED) != PO_SUCCESS)
4399 			return (Z_POOL_ENABLE);
4400 	}
4401 
4402 	if ((pconf = pool_conf_alloc()) == NULL)
4403 		return (zerr_pool(pool_err, err_size, Z_POOL));
4404 
4405 	(void) snprintf(tmp_name, sizeof (tmp_name), TMP_POOL_NAME, zone_name);
4406 
4407 	/*
4408 	 * Check if a valid tmp pool/pset already exists.  If so, we just
4409 	 * reuse it.
4410 	 */
4411 	if ((err = verify_del_tmp_pool(pconf, tmp_name, pool_err, err_size,
4412 	    &pset_tab, &exists)) != Z_OK) {
4413 		pool_conf_free(pconf);
4414 		return (err);
4415 	}
4416 
4417 	if (!exists)
4418 		err = create_tmp_pool(pool_err, err_size, pconf, tmp_name,
4419 		    &pset_tab);
4420 
4421 	pool_conf_free(pconf);
4422 
4423 	if (err != Z_OK)
4424 		return (err);
4425 
4426 	/* Bind the zone to the pool. */
4427 	if (pool_set_binding(tmp_name, P_ZONEID, zoneid) != PO_SUCCESS)
4428 		return (zerr_pool(pool_err, err_size, Z_POOL_BIND));
4429 
4430 	return (Z_OK);
4431 }
4432 
4433 /*
4434  * Attempt to bind to a permanent pool for this zone.  If there is no
4435  * permanent pool configured, we just return Z_OK.
4436  */
4437 int
4438 zonecfg_bind_pool(zone_dochandle_t handle, zoneid_t zoneid, char *pool_err,
4439     int err_size)
4440 {
4441 	pool_conf_t *poolconf;
4442 	pool_t *pool;
4443 	char poolname[MAXPATHLEN];
4444 	int status;
4445 	int error;
4446 
4447 	/*
4448 	 * Find the pool mentioned in the zone configuration, and bind to it.
4449 	 */
4450 	error = zonecfg_get_pool(handle, poolname, sizeof (poolname));
4451 	if (error == Z_NO_ENTRY || (error == Z_OK && strlen(poolname) == 0)) {
4452 		/*
4453 		 * The property is not set on the zone, so the pool
4454 		 * should be bound to the default pool.  But that's
4455 		 * already done by the kernel, so we can just return.
4456 		 */
4457 		return (Z_OK);
4458 	}
4459 	if (error != Z_OK) {
4460 		/*
4461 		 * Not an error, even though it shouldn't be happening.
4462 		 */
4463 		return (Z_OK);
4464 	}
4465 	/*
4466 	 * Don't do anything if pools aren't enabled.
4467 	 */
4468 	if (pool_get_status(&status) != PO_SUCCESS || status != POOL_ENABLED)
4469 		return (Z_POOLS_NOT_ACTIVE);
4470 
4471 	/*
4472 	 * Try to provide a sane error message if the requested pool doesn't
4473 	 * exist.
4474 	 */
4475 	if ((poolconf = pool_conf_alloc()) == NULL)
4476 		return (zerr_pool(pool_err, err_size, Z_POOL));
4477 
4478 	if (pool_conf_open(poolconf, pool_dynamic_location(), PO_RDONLY) !=
4479 	    PO_SUCCESS) {
4480 		pool_conf_free(poolconf);
4481 		return (zerr_pool(pool_err, err_size, Z_POOL));
4482 	}
4483 	pool = pool_get_pool(poolconf, poolname);
4484 	(void) pool_conf_close(poolconf);
4485 	pool_conf_free(poolconf);
4486 	if (pool == NULL)
4487 		return (Z_NO_POOL);
4488 
4489 	/*
4490 	 * Bind the zone to the pool.
4491 	 */
4492 	if (pool_set_binding(poolname, P_ZONEID, zoneid) != PO_SUCCESS) {
4493 		/* if bind fails, return poolname for the error msg */
4494 		(void) strlcpy(pool_err, poolname, err_size);
4495 		return (Z_POOL_BIND);
4496 	}
4497 
4498 	return (Z_OK);
4499 }
4500 
4501 int
4502 zonecfg_get_poolname(zone_dochandle_t handle, char *zone, char *pool,
4503     size_t poolsize)
4504 {
4505 	int err;
4506 	struct zone_psettab pset_tab;
4507 
4508 	err = zonecfg_lookup_pset(handle, &pset_tab);
4509 	if ((err != Z_NO_ENTRY) && (err != Z_OK))
4510 		return (err);
4511 
4512 	/* pset was found so a temporary pool was created */
4513 	if (err == Z_OK) {
4514 		(void) snprintf(pool, poolsize, TMP_POOL_NAME, zone);
4515 		return (Z_OK);
4516 	}
4517 
4518 	/* lookup the poolname in zonecfg */
4519 	return (zonecfg_get_pool(handle, pool, poolsize));
4520 }
4521 
4522 static boolean_t
4523 svc_enabled(char *svc_name)
4524 {
4525 	scf_simple_prop_t	*prop;
4526 	boolean_t		found = B_FALSE;
4527 
4528 	prop = scf_simple_prop_get(NULL, svc_name, SCF_PG_GENERAL,
4529 	    SCF_PROPERTY_ENABLED);
4530 
4531 	if (scf_simple_prop_numvalues(prop) == 1 &&
4532 	    *scf_simple_prop_next_boolean(prop) != 0)
4533 		found = B_TRUE;
4534 
4535 	scf_simple_prop_free(prop);
4536 
4537 	return (found);
4538 }
4539 
4540 /*
4541  * If the zone has capped-memory, make sure the rcap service is enabled.
4542  */
4543 int
4544 zonecfg_enable_rcapd(char *err, int size)
4545 {
4546 	if (!svc_enabled(RCAP_SERVICE) &&
4547 	    smf_enable_instance(RCAP_SERVICE, 0) == -1) {
4548 		(void) strlcpy(err, scf_strerror(scf_error()), size);
4549 		return (Z_SYSTEM);
4550 	}
4551 
4552 	return (Z_OK);
4553 }
4554 
4555 /*
4556  * Return true if pset has cpu range specified and poold is not enabled.
4557  */
4558 boolean_t
4559 zonecfg_warn_poold(zone_dochandle_t handle)
4560 {
4561 	struct zone_psettab pset_tab;
4562 	int min, max;
4563 	int err;
4564 
4565 	err = zonecfg_lookup_pset(handle, &pset_tab);
4566 
4567 	/* if no temporary pool configured, we're done */
4568 	if (err == Z_NO_ENTRY)
4569 		return (B_FALSE);
4570 
4571 	min = atoi(pset_tab.zone_ncpu_min);
4572 	max = atoi(pset_tab.zone_ncpu_max);
4573 
4574 	/* range not specified, no need for poold */
4575 	if (min == max)
4576 		return (B_FALSE);
4577 
4578 	/* we have a range, check if poold service is enabled */
4579 	if (svc_enabled(POOLD_SERVICE))
4580 		return (B_FALSE);
4581 
4582 	return (B_TRUE);
4583 }
4584 
4585 /*
4586  * Retrieve the specified pool's thread scheduling class.  'poolname' must
4587  * refer to the name of a configured resource pool.  The thread scheduling
4588  * class specified by the pool will be stored in the buffer to which 'class'
4589  * points.  'clsize' is the byte size of the buffer to which 'class' points.
4590  *
4591  * This function returns Z_OK if it successfully stored the specified pool's
4592  * thread scheduling class into the buffer to which 'class' points.  It returns
4593  * Z_NO_POOL if resource pools are not enabled, the function is unable to
4594  * access the system's resource pools configuration, or the specified pool
4595  * does not exist.  The function returns Z_TOO_BIG if the buffer to which
4596  * 'class' points is not large enough to contain the thread scheduling class'
4597  * name.  The function returns Z_NO_ENTRY if the pool does not specify a thread
4598  * scheduling class.
4599  */
4600 static int
4601 get_pool_sched_class(char *poolname, char *class, int clsize)
4602 {
4603 	int status;
4604 	pool_conf_t *poolconf;
4605 	pool_t *pool;
4606 	pool_elem_t *pe;
4607 	pool_value_t *pv = pool_value_alloc();
4608 	const char *sched_str;
4609 
4610 	if (pool_get_status(&status) != PO_SUCCESS || status != POOL_ENABLED)
4611 		return (Z_NO_POOL);
4612 
4613 	if ((poolconf = pool_conf_alloc()) == NULL)
4614 		return (Z_NO_POOL);
4615 
4616 	if (pool_conf_open(poolconf, pool_dynamic_location(), PO_RDONLY) !=
4617 	    PO_SUCCESS) {
4618 		pool_conf_free(poolconf);
4619 		return (Z_NO_POOL);
4620 	}
4621 
4622 	if ((pool = pool_get_pool(poolconf, poolname)) == NULL) {
4623 		(void) pool_conf_close(poolconf);
4624 		pool_conf_free(poolconf);
4625 		return (Z_NO_POOL);
4626 	}
4627 
4628 	pe = pool_to_elem(poolconf, pool);
4629 	if (pool_get_property(poolconf, pe, "pool.scheduler", pv) !=
4630 	    POC_STRING) {
4631 		(void) pool_conf_close(poolconf);
4632 		pool_conf_free(poolconf);
4633 		return (Z_NO_ENTRY);
4634 	}
4635 	(void) pool_value_get_string(pv, &sched_str);
4636 	(void) pool_conf_close(poolconf);
4637 	pool_conf_free(poolconf);
4638 	if (strlcpy(class, sched_str, clsize) >= clsize)
4639 		return (Z_TOO_BIG);
4640 	return (Z_OK);
4641 }
4642 
4643 /*
4644  * Get the default scheduling class for the zone.  This will either be the
4645  * class set on the zone's pool or the system default scheduling class.
4646  */
4647 int
4648 zonecfg_get_dflt_sched_class(zone_dochandle_t handle, char *class, int clsize)
4649 {
4650 	char poolname[MAXPATHLEN];
4651 
4652 	if (zonecfg_get_pool(handle, poolname, sizeof (poolname)) == Z_OK) {
4653 		/* check if the zone's pool specified a sched class */
4654 		if (get_pool_sched_class(poolname, class, clsize) == Z_OK)
4655 			return (Z_OK);
4656 	}
4657 
4658 	if (priocntl(0, 0, PC_GETDFLCL, class, (uint64_t)clsize) == -1)
4659 		return (Z_TOO_BIG);
4660 
4661 	return (Z_OK);
4662 }
4663 
4664 int
4665 zonecfg_setfsent(zone_dochandle_t handle)
4666 {
4667 	return (zonecfg_setent(handle));
4668 }
4669 
4670 int
4671 zonecfg_getfsent(zone_dochandle_t handle, struct zone_fstab *tabptr)
4672 {
4673 	xmlNodePtr cur, options;
4674 	char options_str[MAX_MNTOPT_STR];
4675 	int err;
4676 
4677 	if (handle == NULL)
4678 		return (Z_INVAL);
4679 
4680 	if ((cur = handle->zone_dh_cur) == NULL)
4681 		return (Z_NO_ENTRY);
4682 
4683 	for (; cur != NULL; cur = cur->next)
4684 		if (!xmlStrcmp(cur->name, DTD_ELEM_FS))
4685 			break;
4686 	if (cur == NULL) {
4687 		handle->zone_dh_cur = handle->zone_dh_top;
4688 		return (Z_NO_ENTRY);
4689 	}
4690 
4691 	if ((err = fetchprop(cur, DTD_ATTR_SPECIAL, tabptr->zone_fs_special,
4692 	    sizeof (tabptr->zone_fs_special))) != Z_OK) {
4693 		handle->zone_dh_cur = handle->zone_dh_top;
4694 		return (err);
4695 	}
4696 
4697 	if ((err = fetchprop(cur, DTD_ATTR_RAW, tabptr->zone_fs_raw,
4698 	    sizeof (tabptr->zone_fs_raw))) != Z_OK) {
4699 		handle->zone_dh_cur = handle->zone_dh_top;
4700 		return (err);
4701 	}
4702 
4703 	if ((err = fetchprop(cur, DTD_ATTR_DIR, tabptr->zone_fs_dir,
4704 	    sizeof (tabptr->zone_fs_dir))) != Z_OK) {
4705 		handle->zone_dh_cur = handle->zone_dh_top;
4706 		return (err);
4707 	}
4708 
4709 	if ((err = fetchprop(cur, DTD_ATTR_TYPE, tabptr->zone_fs_type,
4710 	    sizeof (tabptr->zone_fs_type))) != Z_OK) {
4711 		handle->zone_dh_cur = handle->zone_dh_top;
4712 		return (err);
4713 	}
4714 
4715 	/* OK for options to be NULL */
4716 	tabptr->zone_fs_options = NULL;
4717 	for (options = cur->xmlChildrenNode; options != NULL;
4718 	    options = options->next) {
4719 		if (fetchprop(options, DTD_ATTR_NAME, options_str,
4720 		    sizeof (options_str)) != Z_OK)
4721 			break;
4722 		if (zonecfg_add_fs_option(tabptr, options_str) != Z_OK)
4723 			break;
4724 	}
4725 
4726 	handle->zone_dh_cur = cur->next;
4727 	return (Z_OK);
4728 }
4729 
4730 int
4731 zonecfg_endfsent(zone_dochandle_t handle)
4732 {
4733 	return (zonecfg_endent(handle));
4734 }
4735 
4736 int
4737 zonecfg_setnwifent(zone_dochandle_t handle)
4738 {
4739 	return (zonecfg_setent(handle));
4740 }
4741 
4742 int
4743 zonecfg_getnwifent(zone_dochandle_t handle, struct zone_nwiftab *tabptr)
4744 {
4745 	xmlNodePtr cur;
4746 	int err;
4747 
4748 	if (handle == NULL)
4749 		return (Z_INVAL);
4750 
4751 	if ((cur = handle->zone_dh_cur) == NULL)
4752 		return (Z_NO_ENTRY);
4753 
4754 	for (; cur != NULL; cur = cur->next)
4755 		if (!xmlStrcmp(cur->name, DTD_ELEM_NET))
4756 			break;
4757 	if (cur == NULL) {
4758 		handle->zone_dh_cur = handle->zone_dh_top;
4759 		return (Z_NO_ENTRY);
4760 	}
4761 
4762 	if ((err = fetchprop(cur, DTD_ATTR_ADDRESS, tabptr->zone_nwif_address,
4763 	    sizeof (tabptr->zone_nwif_address))) != Z_OK) {
4764 		handle->zone_dh_cur = handle->zone_dh_top;
4765 		return (err);
4766 	}
4767 
4768 	if ((err = fetchprop(cur, DTD_ATTR_ALLOWED_ADDRESS,
4769 	    tabptr->zone_nwif_allowed_address,
4770 	    sizeof (tabptr->zone_nwif_allowed_address))) != Z_OK) {
4771 		handle->zone_dh_cur = handle->zone_dh_top;
4772 		return (err);
4773 	}
4774 
4775 	if ((err = fetchprop(cur, DTD_ATTR_PHYSICAL, tabptr->zone_nwif_physical,
4776 	    sizeof (tabptr->zone_nwif_physical))) != Z_OK) {
4777 		handle->zone_dh_cur = handle->zone_dh_top;
4778 		return (err);
4779 	}
4780 
4781 	if ((err = fetchprop(cur, DTD_ATTR_DEFROUTER,
4782 	    tabptr->zone_nwif_defrouter,
4783 	    sizeof (tabptr->zone_nwif_defrouter))) != Z_OK) {
4784 		handle->zone_dh_cur = handle->zone_dh_top;
4785 		return (err);
4786 	}
4787 
4788 	handle->zone_dh_cur = cur->next;
4789 	return (Z_OK);
4790 }
4791 
4792 int
4793 zonecfg_endnwifent(zone_dochandle_t handle)
4794 {
4795 	return (zonecfg_endent(handle));
4796 }
4797 
4798 int
4799 zonecfg_setdevent(zone_dochandle_t handle)
4800 {
4801 	return (zonecfg_setent(handle));
4802 }
4803 
4804 int
4805 zonecfg_getdevent(zone_dochandle_t handle, struct zone_devtab *tabptr)
4806 {
4807 	xmlNodePtr cur;
4808 	int err;
4809 
4810 	if (handle == NULL)
4811 		return (Z_INVAL);
4812 
4813 	if ((cur = handle->zone_dh_cur) == NULL)
4814 		return (Z_NO_ENTRY);
4815 
4816 	for (; cur != NULL; cur = cur->next)
4817 		if (!xmlStrcmp(cur->name, DTD_ELEM_DEVICE))
4818 			break;
4819 	if (cur == NULL) {
4820 		handle->zone_dh_cur = handle->zone_dh_top;
4821 		return (Z_NO_ENTRY);
4822 	}
4823 
4824 	if ((err = fetchprop(cur, DTD_ATTR_MATCH, tabptr->zone_dev_match,
4825 	    sizeof (tabptr->zone_dev_match))) != Z_OK) {
4826 		handle->zone_dh_cur = handle->zone_dh_top;
4827 		return (err);
4828 	}
4829 
4830 	handle->zone_dh_cur = cur->next;
4831 	return (Z_OK);
4832 }
4833 
4834 int
4835 zonecfg_enddevent(zone_dochandle_t handle)
4836 {
4837 	return (zonecfg_endent(handle));
4838 }
4839 
4840 int
4841 zonecfg_setrctlent(zone_dochandle_t handle)
4842 {
4843 	return (zonecfg_setent(handle));
4844 }
4845 
4846 int
4847 zonecfg_getrctlent(zone_dochandle_t handle, struct zone_rctltab *tabptr)
4848 {
4849 	xmlNodePtr cur, val;
4850 	struct zone_rctlvaltab *valptr;
4851 	int err;
4852 
4853 	if (handle == NULL)
4854 		return (Z_INVAL);
4855 
4856 	if ((cur = handle->zone_dh_cur) == NULL)
4857 		return (Z_NO_ENTRY);
4858 
4859 	for (; cur != NULL; cur = cur->next)
4860 		if (!xmlStrcmp(cur->name, DTD_ELEM_RCTL))
4861 			break;
4862 	if (cur == NULL) {
4863 		handle->zone_dh_cur = handle->zone_dh_top;
4864 		return (Z_NO_ENTRY);
4865 	}
4866 
4867 	if ((err = fetchprop(cur, DTD_ATTR_NAME, tabptr->zone_rctl_name,
4868 	    sizeof (tabptr->zone_rctl_name))) != Z_OK) {
4869 		handle->zone_dh_cur = handle->zone_dh_top;
4870 		return (err);
4871 	}
4872 
4873 	tabptr->zone_rctl_valptr = NULL;
4874 	for (val = cur->xmlChildrenNode; val != NULL; val = val->next) {
4875 		valptr = (struct zone_rctlvaltab *)malloc(
4876 		    sizeof (struct zone_rctlvaltab));
4877 		if (valptr == NULL)
4878 			return (Z_NOMEM);
4879 		if (fetchprop(val, DTD_ATTR_PRIV, valptr->zone_rctlval_priv,
4880 		    sizeof (valptr->zone_rctlval_priv)) != Z_OK)
4881 			break;
4882 		if (fetchprop(val, DTD_ATTR_LIMIT, valptr->zone_rctlval_limit,
4883 		    sizeof (valptr->zone_rctlval_limit)) != Z_OK)
4884 			break;
4885 		if (fetchprop(val, DTD_ATTR_ACTION, valptr->zone_rctlval_action,
4886 		    sizeof (valptr->zone_rctlval_action)) != Z_OK)
4887 			break;
4888 		if (zonecfg_add_rctl_value(tabptr, valptr) != Z_OK)
4889 			break;
4890 	}
4891 
4892 	handle->zone_dh_cur = cur->next;
4893 	return (Z_OK);
4894 }
4895 
4896 int
4897 zonecfg_endrctlent(zone_dochandle_t handle)
4898 {
4899 	return (zonecfg_endent(handle));
4900 }
4901 
4902 int
4903 zonecfg_setattrent(zone_dochandle_t handle)
4904 {
4905 	return (zonecfg_setent(handle));
4906 }
4907 
4908 int
4909 zonecfg_getattrent(zone_dochandle_t handle, struct zone_attrtab *tabptr)
4910 {
4911 	xmlNodePtr cur;
4912 	int err;
4913 
4914 	if (handle == NULL)
4915 		return (Z_INVAL);
4916 
4917 	if ((cur = handle->zone_dh_cur) == NULL)
4918 		return (Z_NO_ENTRY);
4919 
4920 	for (; cur != NULL; cur = cur->next)
4921 		if (!xmlStrcmp(cur->name, DTD_ELEM_ATTR))
4922 			break;
4923 	if (cur == NULL) {
4924 		handle->zone_dh_cur = handle->zone_dh_top;
4925 		return (Z_NO_ENTRY);
4926 	}
4927 
4928 	if ((err = fetchprop(cur, DTD_ATTR_NAME, tabptr->zone_attr_name,
4929 	    sizeof (tabptr->zone_attr_name))) != Z_OK) {
4930 		handle->zone_dh_cur = handle->zone_dh_top;
4931 		return (err);
4932 	}
4933 
4934 	if ((err = fetchprop(cur, DTD_ATTR_TYPE, tabptr->zone_attr_type,
4935 	    sizeof (tabptr->zone_attr_type))) != Z_OK) {
4936 		handle->zone_dh_cur = handle->zone_dh_top;
4937 		return (err);
4938 	}
4939 
4940 	if ((err = fetchprop(cur, DTD_ATTR_VALUE, tabptr->zone_attr_value,
4941 	    sizeof (tabptr->zone_attr_value))) != Z_OK) {
4942 		handle->zone_dh_cur = handle->zone_dh_top;
4943 		return (err);
4944 	}
4945 
4946 	handle->zone_dh_cur = cur->next;
4947 	return (Z_OK);
4948 }
4949 
4950 int
4951 zonecfg_endattrent(zone_dochandle_t handle)
4952 {
4953 	return (zonecfg_endent(handle));
4954 }
4955 
4956 int
4957 zonecfg_setadminent(zone_dochandle_t handle)
4958 {
4959 	return (zonecfg_setent(handle));
4960 }
4961 
4962 int
4963 zonecfg_getadminent(zone_dochandle_t handle, struct zone_admintab *tabptr)
4964 {
4965 	xmlNodePtr cur;
4966 	int err;
4967 
4968 	if (handle == NULL)
4969 		return (Z_INVAL);
4970 
4971 	if ((cur = handle->zone_dh_cur) == NULL)
4972 		return (Z_NO_ENTRY);
4973 
4974 	for (; cur != NULL; cur = cur->next)
4975 		if (!xmlStrcmp(cur->name, DTD_ELEM_ADMIN))
4976 			break;
4977 	if (cur == NULL) {
4978 		handle->zone_dh_cur = handle->zone_dh_top;
4979 		return (Z_NO_ENTRY);
4980 	}
4981 
4982 	if ((err = fetchprop(cur, DTD_ATTR_USER, tabptr->zone_admin_user,
4983 	    sizeof (tabptr->zone_admin_user))) != Z_OK) {
4984 		handle->zone_dh_cur = handle->zone_dh_top;
4985 		return (err);
4986 	}
4987 
4988 
4989 	if ((err = fetchprop(cur, DTD_ATTR_AUTHS, tabptr->zone_admin_auths,
4990 	    sizeof (tabptr->zone_admin_auths))) != Z_OK) {
4991 		handle->zone_dh_cur = handle->zone_dh_top;
4992 		return (err);
4993 	}
4994 
4995 	handle->zone_dh_cur = cur->next;
4996 	return (Z_OK);
4997 }
4998 
4999 int
5000 zonecfg_endadminent(zone_dochandle_t handle)
5001 {
5002 	return (zonecfg_endent(handle));
5003 }
5004 
5005 /*
5006  * The privileges available on the system and described in privileges(5)
5007  * fall into four categories with respect to non-global zones:
5008  *
5009  *      Default set of privileges considered safe for all non-global
5010  *      zones.  These privileges are "safe" in the sense that a
5011  *      privileged process in the zone cannot affect processes in any
5012  *      other zone on the system.
5013  *
5014  *      Set of privileges not currently permitted within a non-global
5015  *      zone.  These privileges are considered by default, "unsafe,"
5016  *      and include ones which affect global resources (such as the
5017  *      system clock or physical memory) or are overly broad and cover
5018  *      more than one mechanism in the system.  In other cases, there
5019  *      has not been sufficient virtualization in the parts of the
5020  *      system the privilege covers to allow its use within a
5021  *      non-global zone.
5022  *
5023  *      Set of privileges required in order to get a zone booted and
5024  *      init(1M) started.  These cannot be removed from the zone's
5025  *      privilege set.
5026  *
5027  * All other privileges are optional and are potentially useful for
5028  * processes executing inside a non-global zone.
5029  *
5030  * When privileges are added to the system, a determination needs to be
5031  * made as to which category the privilege belongs to.  Ideally,
5032  * privileges should be fine-grained enough and the mechanisms they cover
5033  * virtualized enough so that they can be made available to non-global
5034  * zones.
5035  */
5036 
5037 /*
5038  * Define some of the tokens that priv_str_to_set(3C) recognizes.  Since
5039  * the privilege string separator can be any character, although it is
5040  * usually a comma character, define these here as well in the event that
5041  * they change or are augmented in the future.
5042  */
5043 #define	BASIC_TOKEN		"basic"
5044 #define	DEFAULT_TOKEN		"default"
5045 #define	ZONE_TOKEN		"zone"
5046 #define	TOKEN_PRIV_CHAR		','
5047 #define	TOKEN_PRIV_STR		","
5048 
5049 typedef struct priv_node {
5050 	struct priv_node	*pn_next;	/* Next privilege */
5051 	char			*pn_priv;	/* Privileges name */
5052 } priv_node_t;
5053 
5054 /* Privileges lists can differ across brands */
5055 typedef struct priv_lists {
5056 	/* Privileges considered safe for all non-global zones of a brand */
5057 	struct priv_node	*pl_default;
5058 
5059 	/* Privileges not permitted for all non-global zones of a brand */
5060 	struct priv_node	*pl_prohibited;
5061 
5062 	/* Privileges required for all non-global zones of a brand */
5063 	struct priv_node	*pl_required;
5064 
5065 	/*
5066 	 * ip-type of the zone these privileges lists apply to.
5067 	 * It is used to pass ip-type to the callback function,
5068 	 * priv_lists_cb, which has no way of getting the ip-type.
5069 	 */
5070 	const char		*pl_iptype;
5071 } priv_lists_t;
5072 
5073 static int
5074 priv_lists_cb(void *data, priv_iter_t *priv_iter)
5075 {
5076 	priv_lists_t *plp = (priv_lists_t *)data;
5077 	priv_node_t *pnp;
5078 
5079 	/* Skip this privilege if ip-type does not match */
5080 	if ((strcmp(priv_iter->pi_iptype, "all") != 0) &&
5081 	    (strcmp(priv_iter->pi_iptype, plp->pl_iptype) != 0))
5082 		return (0);
5083 
5084 	/* Allocate a new priv list node. */
5085 	if ((pnp = malloc(sizeof (*pnp))) == NULL)
5086 		return (-1);
5087 	if ((pnp->pn_priv = strdup(priv_iter->pi_name)) == NULL) {
5088 		free(pnp);
5089 		return (-1);
5090 	}
5091 
5092 	/* Insert the new priv list node into the right list */
5093 	if (strcmp(priv_iter->pi_set, "default") == 0) {
5094 		pnp->pn_next = plp->pl_default;
5095 		plp->pl_default = pnp;
5096 	} else if (strcmp(priv_iter->pi_set, "prohibited") == 0) {
5097 		pnp->pn_next = plp->pl_prohibited;
5098 		plp->pl_prohibited = pnp;
5099 	} else if (strcmp(priv_iter->pi_set, "required") == 0) {
5100 		pnp->pn_next = plp->pl_required;
5101 		plp->pl_required = pnp;
5102 	} else {
5103 		free(pnp->pn_priv);
5104 		free(pnp);
5105 		return (-1);
5106 	}
5107 	return (0);
5108 }
5109 
5110 static void
5111 priv_lists_destroy(priv_lists_t *plp)
5112 {
5113 	priv_node_t *pnp;
5114 
5115 	assert(plp != NULL);
5116 
5117 	while ((pnp = plp->pl_default) != NULL) {
5118 		plp->pl_default = pnp->pn_next;
5119 		free(pnp->pn_priv);
5120 		free(pnp);
5121 	}
5122 	while ((pnp = plp->pl_prohibited) != NULL) {
5123 		plp->pl_prohibited = pnp->pn_next;
5124 		free(pnp->pn_priv);
5125 		free(pnp);
5126 	}
5127 	while ((pnp = plp->pl_required) != NULL) {
5128 		plp->pl_required = pnp->pn_next;
5129 		free(pnp->pn_priv);
5130 		free(pnp);
5131 	}
5132 	free(plp);
5133 }
5134 
5135 static int
5136 priv_lists_create(zone_dochandle_t handle, char *brand, priv_lists_t **plpp,
5137     const char *curr_iptype)
5138 {
5139 	priv_lists_t *plp;
5140 	brand_handle_t bh;
5141 	char brand_str[MAXNAMELEN];
5142 
5143 	/* handle or brand must be set, but never both */
5144 	assert((handle != NULL) || (brand != NULL));
5145 	assert((handle == NULL) || (brand == NULL));
5146 
5147 	if (handle != NULL) {
5148 		brand = brand_str;
5149 		if (zonecfg_get_brand(handle, brand, sizeof (brand_str)) != 0)
5150 			return (Z_BRAND_ERROR);
5151 	}
5152 
5153 	if ((bh = brand_open(brand)) == NULL)
5154 		return (Z_BRAND_ERROR);
5155 
5156 	if ((plp = calloc(1, sizeof (priv_lists_t))) == NULL) {
5157 		brand_close(bh);
5158 		return (Z_NOMEM);
5159 	}
5160 
5161 	plp->pl_iptype = curr_iptype;
5162 
5163 	/* construct the privilege lists */
5164 	if (brand_config_iter_privilege(bh, priv_lists_cb, plp) != 0) {
5165 		priv_lists_destroy(plp);
5166 		brand_close(bh);
5167 		return (Z_BRAND_ERROR);
5168 	}
5169 
5170 	brand_close(bh);
5171 	*plpp = plp;
5172 	return (Z_OK);
5173 }
5174 
5175 static int
5176 get_default_privset(priv_set_t *privs, priv_lists_t *plp)
5177 {
5178 	priv_node_t *pnp;
5179 	priv_set_t *basic;
5180 
5181 	basic = priv_str_to_set(BASIC_TOKEN, TOKEN_PRIV_STR, NULL);
5182 	if (basic == NULL)
5183 		return (errno == ENOMEM ? Z_NOMEM : Z_INVAL);
5184 
5185 	priv_union(basic, privs);
5186 	priv_freeset(basic);
5187 
5188 	for (pnp = plp->pl_default; pnp != NULL; pnp = pnp->pn_next) {
5189 		if (priv_addset(privs, pnp->pn_priv) != 0)
5190 			return (Z_INVAL);
5191 	}
5192 
5193 	return (Z_OK);
5194 }
5195 
5196 int
5197 zonecfg_default_brand(char *brand, size_t brandsize)
5198 {
5199 	zone_dochandle_t handle;
5200 	int myzoneid = getzoneid();
5201 	int ret;
5202 
5203 	/*
5204 	 * If we're running within a zone, then the default brand is the
5205 	 * current zone's brand.
5206 	 */
5207 	if (myzoneid != GLOBAL_ZONEID) {
5208 		ret = zone_getattr(myzoneid, ZONE_ATTR_BRAND, brand, brandsize);
5209 		if (ret < 0)
5210 			return ((errno == EFAULT) ? Z_TOO_BIG : Z_INVAL);
5211 		return (Z_OK);
5212 	}
5213 
5214 	if ((handle = zonecfg_init_handle()) == NULL)
5215 		return (Z_NOMEM);
5216 	if ((ret = zonecfg_get_handle("SUNWdefault", handle)) == Z_OK) {
5217 		ret = i_zonecfg_get_brand(handle, brand, brandsize, B_TRUE);
5218 		zonecfg_fini_handle(handle);
5219 		return (ret);
5220 	}
5221 	return (ret);
5222 }
5223 
5224 int
5225 zonecfg_default_privset(priv_set_t *privs, const char *curr_iptype)
5226 {
5227 	priv_lists_t *plp;
5228 	char buf[MAXNAMELEN];
5229 	int ret;
5230 
5231 	if ((ret = zonecfg_default_brand(buf, sizeof (buf))) != Z_OK)
5232 		return (ret);
5233 	if ((ret = priv_lists_create(NULL, buf, &plp, curr_iptype)) != Z_OK)
5234 		return (ret);
5235 	ret = get_default_privset(privs, plp);
5236 	priv_lists_destroy(plp);
5237 	return (ret);
5238 }
5239 
5240 void
5241 append_priv_token(char *priv, char *str, size_t strlen)
5242 {
5243 	if (*str != '\0')
5244 		(void) strlcat(str, TOKEN_PRIV_STR, strlen);
5245 	(void) strlcat(str, priv, strlen);
5246 }
5247 
5248 /*
5249  * Verify that the supplied string is a valid privilege limit set for a
5250  * non-global zone.  This string must not only be acceptable to
5251  * priv_str_to_set(3C) which parses it, but it also must resolve to a
5252  * privilege set that includes certain required privileges and lacks
5253  * certain prohibited privileges.
5254  */
5255 static int
5256 verify_privset(char *privbuf, priv_set_t *privs, char **privname,
5257     boolean_t add_default, priv_lists_t *plp)
5258 {
5259 	priv_node_t *pnp;
5260 	char *tmp, *cp, *lasts;
5261 	size_t len;
5262 	priv_set_t *mergeset;
5263 	const char *token;
5264 
5265 	/*
5266 	 * The verification of the privilege string occurs in several
5267 	 * phases.  In the first phase, the supplied string is scanned for
5268 	 * the ZONE_TOKEN token which is not support as part of the
5269 	 * "limitpriv" property.
5270 	 *
5271 	 * Duplicate the supplied privilege string since strtok_r(3C)
5272 	 * tokenizes its input by null-terminating the tokens.
5273 	 */
5274 	if ((tmp = strdup(privbuf)) == NULL)
5275 		return (Z_NOMEM);
5276 	for (cp = strtok_r(tmp, TOKEN_PRIV_STR, &lasts); cp != NULL;
5277 	    cp = strtok_r(NULL, TOKEN_PRIV_STR, &lasts)) {
5278 		if (strcmp(cp, ZONE_TOKEN) == 0) {
5279 			free(tmp);
5280 			if ((*privname = strdup(ZONE_TOKEN)) == NULL)
5281 				return (Z_NOMEM);
5282 			else
5283 				return (Z_PRIV_UNKNOWN);
5284 		}
5285 	}
5286 	free(tmp);
5287 
5288 	if (add_default) {
5289 		/*
5290 		 * If DEFAULT_TOKEN was specified, a string needs to be
5291 		 * built containing the privileges from the default, safe
5292 		 * set along with those of the "limitpriv" property.
5293 		 */
5294 		len = strlen(privbuf) + sizeof (BASIC_TOKEN) + 2;
5295 
5296 		for (pnp = plp->pl_default; pnp != NULL; pnp = pnp->pn_next)
5297 			len += strlen(pnp->pn_priv) + 1;
5298 		tmp = alloca(len);
5299 		*tmp = '\0';
5300 
5301 		append_priv_token(BASIC_TOKEN, tmp, len);
5302 		for (pnp = plp->pl_default; pnp != NULL; pnp = pnp->pn_next)
5303 			append_priv_token(pnp->pn_priv, tmp, len);
5304 		(void) strlcat(tmp, TOKEN_PRIV_STR, len);
5305 		(void) strlcat(tmp, privbuf, len);
5306 	} else {
5307 		tmp = privbuf;
5308 	}
5309 
5310 
5311 	/*
5312 	 * In the next phase, attempt to convert the merged privilege
5313 	 * string into a privilege set.  In the case of an error, either
5314 	 * there was a memory allocation failure or there was an invalid
5315 	 * privilege token in the string.  In either case, return an
5316 	 * appropriate error code but in the event of an invalid token,
5317 	 * allocate a string containing its name and return that back to
5318 	 * the caller.
5319 	 */
5320 	mergeset = priv_str_to_set(tmp, TOKEN_PRIV_STR, &token);
5321 	if (mergeset == NULL) {
5322 		if (token == NULL)
5323 			return (Z_NOMEM);
5324 		if ((cp = strchr(token, TOKEN_PRIV_CHAR)) != NULL)
5325 			*cp = '\0';
5326 		if ((*privname = strdup(token)) == NULL)
5327 			return (Z_NOMEM);
5328 		else
5329 			return (Z_PRIV_UNKNOWN);
5330 	}
5331 
5332 	/*
5333 	 * Next, verify that none of the prohibited zone privileges are
5334 	 * present in the merged privilege set.
5335 	 */
5336 	for (pnp = plp->pl_prohibited; pnp != NULL; pnp = pnp->pn_next) {
5337 		if (priv_ismember(mergeset, pnp->pn_priv)) {
5338 			priv_freeset(mergeset);
5339 			if ((*privname = strdup(pnp->pn_priv)) == NULL)
5340 				return (Z_NOMEM);
5341 			else
5342 				return (Z_PRIV_PROHIBITED);
5343 		}
5344 	}
5345 
5346 	/*
5347 	 * Finally, verify that all of the required zone privileges are
5348 	 * present in the merged privilege set.
5349 	 */
5350 	for (pnp = plp->pl_required; pnp != NULL; pnp = pnp->pn_next) {
5351 		if (!priv_ismember(mergeset, pnp->pn_priv)) {
5352 			priv_freeset(mergeset);
5353 			if ((*privname = strdup(pnp->pn_priv)) == NULL)
5354 				return (Z_NOMEM);
5355 			else
5356 				return (Z_PRIV_REQUIRED);
5357 		}
5358 	}
5359 
5360 	priv_copyset(mergeset, privs);
5361 	priv_freeset(mergeset);
5362 	return (Z_OK);
5363 }
5364 
5365 /*
5366  * Fill in the supplied privilege set with either the default, safe set of
5367  * privileges suitable for a non-global zone, or one based on the
5368  * "limitpriv" property in the zone's configuration.
5369  *
5370  * In the event of an invalid privilege specification in the
5371  * configuration, a string is allocated and returned containing the
5372  * "privilege" causing the issue.  It is the caller's responsibility to
5373  * free this memory when it is done with it.
5374  */
5375 int
5376 zonecfg_get_privset(zone_dochandle_t handle, priv_set_t *privs,
5377     char **privname)
5378 {
5379 	priv_lists_t *plp;
5380 	char *cp, *limitpriv = NULL;
5381 	int err, limitlen;
5382 	zone_iptype_t iptype;
5383 	const char *curr_iptype;
5384 
5385 	/*
5386 	 * Attempt to lookup the "limitpriv" property.  If it does not
5387 	 * exist or matches the string DEFAULT_TOKEN exactly, then the
5388 	 * default, safe privilege set is returned.
5389 	 */
5390 	if ((err = zonecfg_get_limitpriv(handle, &limitpriv)) != Z_OK)
5391 		return (err);
5392 
5393 	if ((err = zonecfg_get_iptype(handle, &iptype)) != Z_OK)
5394 		return (err);
5395 
5396 	switch (iptype) {
5397 	case ZS_SHARED:
5398 		curr_iptype = "shared";
5399 		break;
5400 	case ZS_EXCLUSIVE:
5401 		curr_iptype = "exclusive";
5402 		break;
5403 	}
5404 
5405 	if ((err = priv_lists_create(handle, NULL, &plp, curr_iptype)) != Z_OK)
5406 		return (err);
5407 
5408 	limitlen = strlen(limitpriv);
5409 	if (limitlen == 0 || strcmp(limitpriv, DEFAULT_TOKEN) == 0) {
5410 		free(limitpriv);
5411 		err = get_default_privset(privs, plp);
5412 		priv_lists_destroy(plp);
5413 		return (err);
5414 	}
5415 
5416 	/*
5417 	 * Check if the string DEFAULT_TOKEN is the first token in a list
5418 	 * of privileges.
5419 	 */
5420 	cp = strchr(limitpriv, TOKEN_PRIV_CHAR);
5421 	if (cp != NULL &&
5422 	    strncmp(limitpriv, DEFAULT_TOKEN, cp - limitpriv) == 0)
5423 		err = verify_privset(cp + 1, privs, privname, B_TRUE, plp);
5424 	else
5425 		err = verify_privset(limitpriv, privs, privname, B_FALSE, plp);
5426 
5427 	free(limitpriv);
5428 	priv_lists_destroy(plp);
5429 	return (err);
5430 }
5431 
5432 int
5433 zone_get_zonepath(char *zone_name, char *zonepath, size_t rp_sz)
5434 {
5435 	zone_dochandle_t handle;
5436 	boolean_t found = B_FALSE;
5437 	struct zoneent *ze;
5438 	FILE *cookie;
5439 	int err;
5440 	char *cp;
5441 
5442 	if (zone_name == NULL)
5443 		return (Z_INVAL);
5444 
5445 	(void) strlcpy(zonepath, zonecfg_root, rp_sz);
5446 	cp = zonepath + strlen(zonepath);
5447 	while (cp > zonepath && cp[-1] == '/')
5448 		*--cp = '\0';
5449 
5450 	if (strcmp(zone_name, GLOBAL_ZONENAME) == 0) {
5451 		if (zonepath[0] == '\0')
5452 			(void) strlcpy(zonepath, "/", rp_sz);
5453 		return (Z_OK);
5454 	}
5455 
5456 	/*
5457 	 * First check the index file.  Because older versions did not have
5458 	 * a copy of the zone path, allow for it to be zero length, in which
5459 	 * case we ignore this result and fall back to the XML files.
5460 	 */
5461 	cookie = setzoneent();
5462 	while ((ze = getzoneent_private(cookie)) != NULL) {
5463 		if (strcmp(ze->zone_name, zone_name) == 0) {
5464 			found = B_TRUE;
5465 			if (ze->zone_path[0] != '\0')
5466 				(void) strlcpy(cp, ze->zone_path,
5467 				    rp_sz - (cp - zonepath));
5468 		}
5469 		free(ze);
5470 		if (found)
5471 			break;
5472 	}
5473 	endzoneent(cookie);
5474 	if (found && *cp != '\0')
5475 		return (Z_OK);
5476 
5477 	/* Fall back to the XML files. */
5478 	if ((handle = zonecfg_init_handle()) == NULL)
5479 		return (Z_NOMEM);
5480 
5481 	/*
5482 	 * Check the snapshot first: if a zone is running, its zonepath
5483 	 * may have changed.
5484 	 */
5485 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
5486 		if ((err = zonecfg_get_handle(zone_name, handle)) != Z_OK) {
5487 			zonecfg_fini_handle(handle);
5488 			return (err);
5489 		}
5490 	}
5491 	err = zonecfg_get_zonepath(handle, zonepath, rp_sz);
5492 	zonecfg_fini_handle(handle);
5493 	return (err);
5494 }
5495 
5496 int
5497 zone_get_rootpath(char *zone_name, char *rootpath, size_t rp_sz)
5498 {
5499 	int err;
5500 
5501 	/* This function makes sense for non-global zones only. */
5502 	if (strcmp(zone_name, GLOBAL_ZONENAME) == 0)
5503 		return (Z_BOGUS_ZONE_NAME);
5504 	if ((err = zone_get_zonepath(zone_name, rootpath, rp_sz)) != Z_OK)
5505 		return (err);
5506 	if (strlcat(rootpath, "/root", rp_sz) >= rp_sz)
5507 		return (Z_TOO_BIG);
5508 	return (Z_OK);
5509 }
5510 
5511 int
5512 zone_get_brand(char *zone_name, char *brandname, size_t rp_sz)
5513 {
5514 	int err;
5515 	zone_dochandle_t handle;
5516 	char myzone[MAXNAMELEN];
5517 	int myzoneid = getzoneid();
5518 
5519 	/*
5520 	 * If we are not in the global zone, then we don't have the zone
5521 	 * .xml files with the brand name available.  Thus, we are going to
5522 	 * have to ask the kernel for the information.
5523 	 */
5524 	if (myzoneid != GLOBAL_ZONEID) {
5525 		if (is_system_labeled()) {
5526 			(void) strlcpy(brandname, NATIVE_BRAND_NAME, rp_sz);
5527 			return (Z_OK);
5528 		}
5529 		if (zone_getattr(myzoneid, ZONE_ATTR_NAME, myzone,
5530 		    sizeof (myzone)) < 0)
5531 			return (Z_NO_ZONE);
5532 		if (!zonecfg_is_scratch(myzone)) {
5533 			if (strncmp(zone_name, myzone, MAXNAMELEN) != 0)
5534 				return (Z_NO_ZONE);
5535 		}
5536 		err = zone_getattr(myzoneid, ZONE_ATTR_BRAND, brandname, rp_sz);
5537 		if (err < 0)
5538 			return ((errno == EFAULT) ? Z_TOO_BIG : Z_INVAL);
5539 
5540 		return (Z_OK);
5541 	}
5542 
5543 	if (strcmp(zone_name, "global") == 0)
5544 		return (zonecfg_default_brand(brandname, rp_sz));
5545 
5546 	if ((handle = zonecfg_init_handle()) == NULL)
5547 		return (Z_NOMEM);
5548 
5549 	err = zonecfg_get_handle((char *)zone_name, handle);
5550 	if (err == Z_OK)
5551 		err = zonecfg_get_brand(handle, brandname, rp_sz);
5552 
5553 	zonecfg_fini_handle(handle);
5554 	return (err);
5555 }
5556 
5557 /*
5558  * Return the appropriate root for the active /dev.
5559  * For normal zone, the path is $ZONEPATH/root;
5560  * for scratch zone, the dev path is $ZONEPATH/lu.
5561  */
5562 int
5563 zone_get_devroot(char *zone_name, char *devroot, size_t rp_sz)
5564 {
5565 	int err;
5566 	char *suffix;
5567 	zone_state_t state;
5568 
5569 	/* This function makes sense for non-global zones only. */
5570 	if (strcmp(zone_name, GLOBAL_ZONENAME) == 0)
5571 		return (Z_BOGUS_ZONE_NAME);
5572 	if ((err = zone_get_zonepath(zone_name, devroot, rp_sz)) != Z_OK)
5573 		return (err);
5574 
5575 	if (zone_get_state(zone_name, &state) == Z_OK &&
5576 	    state == ZONE_STATE_MOUNTED)
5577 		suffix = "/lu";
5578 	else
5579 		suffix = "/root";
5580 	if (strlcat(devroot, suffix, rp_sz) >= rp_sz)
5581 		return (Z_TOO_BIG);
5582 	return (Z_OK);
5583 }
5584 
5585 static zone_state_t
5586 kernel_state_to_user_state(zoneid_t zoneid, zone_status_t kernel_state)
5587 {
5588 	char zoneroot[MAXPATHLEN];
5589 	size_t zlen;
5590 
5591 	assert(kernel_state <= ZONE_MAX_STATE);
5592 	switch (kernel_state) {
5593 		case ZONE_IS_UNINITIALIZED:
5594 		case ZONE_IS_INITIALIZED:
5595 			/* The kernel will not return these two states */
5596 			return (ZONE_STATE_READY);
5597 		case ZONE_IS_READY:
5598 			/*
5599 			 * If the zone's root is mounted on $ZONEPATH/lu, then
5600 			 * it's a mounted scratch zone.
5601 			 */
5602 			if (zone_getattr(zoneid, ZONE_ATTR_ROOT, zoneroot,
5603 			    sizeof (zoneroot)) >= 0) {
5604 				zlen = strlen(zoneroot);
5605 				if (zlen > 3 &&
5606 				    strcmp(zoneroot + zlen - 3, "/lu") == 0)
5607 					return (ZONE_STATE_MOUNTED);
5608 			}
5609 			return (ZONE_STATE_READY);
5610 		case ZONE_IS_BOOTING:
5611 		case ZONE_IS_RUNNING:
5612 			return (ZONE_STATE_RUNNING);
5613 		case ZONE_IS_SHUTTING_DOWN:
5614 		case ZONE_IS_EMPTY:
5615 			return (ZONE_STATE_SHUTTING_DOWN);
5616 		case ZONE_IS_DOWN:
5617 		case ZONE_IS_DYING:
5618 		case ZONE_IS_DEAD:
5619 		default:
5620 			return (ZONE_STATE_DOWN);
5621 	}
5622 	/* NOTREACHED */
5623 }
5624 
5625 int
5626 zone_get_state(char *zone_name, zone_state_t *state_num)
5627 {
5628 	zone_status_t status;
5629 	zoneid_t zone_id;
5630 	struct zoneent *ze;
5631 	boolean_t found = B_FALSE;
5632 	FILE *cookie;
5633 	char kernzone[ZONENAME_MAX];
5634 	FILE *fp;
5635 
5636 	if (zone_name == NULL)
5637 		return (Z_INVAL);
5638 
5639 	/*
5640 	 * If we're looking at an alternate root, then we need to query the
5641 	 * kernel using the scratch zone name.
5642 	 */
5643 	zone_id = -1;
5644 	if (*zonecfg_root != '\0' && !zonecfg_is_scratch(zone_name)) {
5645 		if ((fp = zonecfg_open_scratch("", B_FALSE)) != NULL) {
5646 			if (zonecfg_find_scratch(fp, zone_name, zonecfg_root,
5647 			    kernzone, sizeof (kernzone)) == 0)
5648 				zone_id = getzoneidbyname(kernzone);
5649 			zonecfg_close_scratch(fp);
5650 		}
5651 	} else {
5652 		zone_id = getzoneidbyname(zone_name);
5653 	}
5654 
5655 	/* check to see if zone is running */
5656 	if (zone_id != -1 &&
5657 	    zone_getattr(zone_id, ZONE_ATTR_STATUS, &status,
5658 	    sizeof (status)) >= 0) {
5659 		*state_num = kernel_state_to_user_state(zone_id, status);
5660 		return (Z_OK);
5661 	}
5662 
5663 	cookie = setzoneent();
5664 	while ((ze = getzoneent_private(cookie)) != NULL) {
5665 		if (strcmp(ze->zone_name, zone_name) == 0) {
5666 			found = B_TRUE;
5667 			*state_num = ze->zone_state;
5668 		}
5669 		free(ze);
5670 		if (found)
5671 			break;
5672 	}
5673 	endzoneent(cookie);
5674 	return ((found) ? Z_OK : Z_NO_ZONE);
5675 }
5676 
5677 int
5678 zone_set_state(char *zone, zone_state_t state)
5679 {
5680 	struct zoneent ze;
5681 
5682 	if (state != ZONE_STATE_CONFIGURED && state != ZONE_STATE_INSTALLED &&
5683 	    state != ZONE_STATE_INCOMPLETE)
5684 		return (Z_INVAL);
5685 
5686 	bzero(&ze, sizeof (ze));
5687 	(void) strlcpy(ze.zone_name, zone, sizeof (ze.zone_name));
5688 	ze.zone_state = state;
5689 	(void) strlcpy(ze.zone_path, "", sizeof (ze.zone_path));
5690 	return (putzoneent(&ze, PZE_MODIFY));
5691 }
5692 
5693 /*
5694  * Get id (if any) for specified zone.  There are four possible outcomes:
5695  * - If the string corresponds to the numeric id of an active (booted)
5696  *   zone, sets *zip to the zone id and returns 0.
5697  * - If the string corresponds to the name of an active (booted) zone,
5698  *   sets *zip to the zone id and returns 0.
5699  * - If the string is a name in the configuration but is not booted,
5700  *   sets *zip to ZONE_ID_UNDEFINED and returns 0.
5701  * - Otherwise, leaves *zip unchanged and returns -1.
5702  *
5703  * This function acts as an auxiliary filter on the function of the same
5704  * name in libc; the linker binds to this version if libzonecfg exists,
5705  * and the libc version if it doesn't.  Any changes to this version of
5706  * the function should probably be reflected in the libc version as well.
5707  */
5708 int
5709 zone_get_id(const char *str, zoneid_t *zip)
5710 {
5711 	zone_dochandle_t hdl;
5712 	zoneid_t zoneid;
5713 	char *cp;
5714 	int err;
5715 
5716 	/* first try looking for active zone by id */
5717 	errno = 0;
5718 	zoneid = (zoneid_t)strtol(str, &cp, 0);
5719 	if (errno == 0 && cp != str && *cp == '\0' &&
5720 	    getzonenamebyid(zoneid, NULL, 0) != -1) {
5721 		*zip = zoneid;
5722 		return (0);
5723 	}
5724 
5725 	/* then look for active zone by name */
5726 	if ((zoneid = getzoneidbyname(str)) != -1) {
5727 		*zip = zoneid;
5728 		return (0);
5729 	}
5730 
5731 	/* if in global zone, try looking up name in configuration database */
5732 	if (getzoneid() != GLOBAL_ZONEID ||
5733 	    (hdl = zonecfg_init_handle()) == NULL)
5734 		return (-1);
5735 
5736 	if (zonecfg_get_handle(str, hdl) == Z_OK) {
5737 		/* zone exists but isn't active */
5738 		*zip = ZONE_ID_UNDEFINED;
5739 		err = 0;
5740 	} else {
5741 		err = -1;
5742 	}
5743 
5744 	zonecfg_fini_handle(hdl);
5745 	return (err);
5746 }
5747 
5748 char *
5749 zone_state_str(zone_state_t state_num)
5750 {
5751 	switch (state_num) {
5752 	case ZONE_STATE_CONFIGURED:
5753 		return (ZONE_STATE_STR_CONFIGURED);
5754 	case ZONE_STATE_INCOMPLETE:
5755 		return (ZONE_STATE_STR_INCOMPLETE);
5756 	case ZONE_STATE_INSTALLED:
5757 		return (ZONE_STATE_STR_INSTALLED);
5758 	case ZONE_STATE_READY:
5759 		return (ZONE_STATE_STR_READY);
5760 	case ZONE_STATE_MOUNTED:
5761 		return (ZONE_STATE_STR_MOUNTED);
5762 	case ZONE_STATE_RUNNING:
5763 		return (ZONE_STATE_STR_RUNNING);
5764 	case ZONE_STATE_SHUTTING_DOWN:
5765 		return (ZONE_STATE_STR_SHUTTING_DOWN);
5766 	case ZONE_STATE_DOWN:
5767 		return (ZONE_STATE_STR_DOWN);
5768 	default:
5769 		return ("unknown");
5770 	}
5771 }
5772 
5773 /*
5774  * Given a UUID value, find an associated zone name.  This is intended to be
5775  * used by callers who set up some 'default' name (corresponding to the
5776  * expected name for the zone) in the zonename buffer, and thus the function
5777  * doesn't touch this buffer on failure.
5778  */
5779 int
5780 zonecfg_get_name_by_uuid(const uuid_t uuidin, char *zonename, size_t namelen)
5781 {
5782 	FILE *fp;
5783 	struct zoneent *ze;
5784 	uchar_t *uuid;
5785 
5786 	/*
5787 	 * A small amount of subterfuge via casts is necessary here because
5788 	 * libuuid doesn't use const correctly, but we don't want to export
5789 	 * this brokenness to our clients.
5790 	 */
5791 	uuid = (uchar_t *)uuidin;
5792 	if (uuid_is_null(uuid))
5793 		return (Z_NO_ZONE);
5794 	if ((fp = setzoneent()) == NULL)
5795 		return (Z_NO_ZONE);
5796 	while ((ze = getzoneent_private(fp)) != NULL) {
5797 		if (uuid_compare(uuid, ze->zone_uuid) == 0)
5798 			break;
5799 		free(ze);
5800 	}
5801 	endzoneent(fp);
5802 	if (ze != NULL) {
5803 		(void) strlcpy(zonename, ze->zone_name, namelen);
5804 		free(ze);
5805 		return (Z_OK);
5806 	} else {
5807 		return (Z_NO_ZONE);
5808 	}
5809 }
5810 
5811 /*
5812  * Given a zone name, get its UUID.  Returns a "NULL" UUID value if the zone
5813  * exists but the file doesn't have a value set yet.  Returns an error if the
5814  * zone cannot be located.
5815  */
5816 int
5817 zonecfg_get_uuid(const char *zonename, uuid_t uuid)
5818 {
5819 	FILE *fp;
5820 	struct zoneent *ze;
5821 
5822 	if ((fp = setzoneent()) == NULL)
5823 		return (Z_NO_ZONE);
5824 	while ((ze = getzoneent_private(fp)) != NULL) {
5825 		if (strcmp(ze->zone_name, zonename) == 0)
5826 			break;
5827 		free(ze);
5828 	}
5829 	endzoneent(fp);
5830 	if (ze != NULL) {
5831 		uuid_copy(uuid, ze->zone_uuid);
5832 		free(ze);
5833 		return (Z_OK);
5834 	} else {
5835 		return (Z_NO_ZONE);
5836 	}
5837 }
5838 
5839 /*
5840  * File-system convenience functions.
5841  */
5842 boolean_t
5843 zonecfg_valid_fs_type(const char *type)
5844 {
5845 	/*
5846 	 * We already know which FS types don't work.
5847 	 */
5848 	if (strcmp(type, "proc") == 0 ||
5849 	    strcmp(type, "mntfs") == 0 ||
5850 	    strcmp(type, "autofs") == 0 ||
5851 	    strncmp(type, "nfs", sizeof ("nfs") - 1) == 0 ||
5852 	    strcmp(type, "cachefs") == 0)
5853 		return (B_FALSE);
5854 	/*
5855 	 * The caller may do more detailed verification to make sure other
5856 	 * aspects of this filesystem type make sense.
5857 	 */
5858 	return (B_TRUE);
5859 }
5860 
5861 /*
5862  * Generally uninteresting rctl convenience functions.
5863  */
5864 
5865 int
5866 zonecfg_construct_rctlblk(const struct zone_rctlvaltab *rctlval,
5867     rctlblk_t *rctlblk)
5868 {
5869 	unsigned long long ull;
5870 	char *endp;
5871 	rctl_priv_t priv;
5872 	rctl_qty_t limit;
5873 	uint_t action;
5874 
5875 	/* Get the privilege */
5876 	if (strcmp(rctlval->zone_rctlval_priv, "basic") == 0) {
5877 		priv = RCPRIV_BASIC;
5878 	} else if (strcmp(rctlval->zone_rctlval_priv, "privileged") == 0) {
5879 		priv = RCPRIV_PRIVILEGED;
5880 	} else {
5881 		/* Invalid privilege */
5882 		return (Z_INVAL);
5883 	}
5884 
5885 	/* deal with negative input; strtoull(3c) doesn't do what we want */
5886 	if (rctlval->zone_rctlval_limit[0] == '-')
5887 		return (Z_INVAL);
5888 	/* Get the limit */
5889 	errno = 0;
5890 	ull = strtoull(rctlval->zone_rctlval_limit, &endp, 0);
5891 	if (errno != 0 || *endp != '\0') {
5892 		/* parse failed */
5893 		return (Z_INVAL);
5894 	}
5895 	limit = (rctl_qty_t)ull;
5896 
5897 	/* Get the action */
5898 	if (strcmp(rctlval->zone_rctlval_action, "none") == 0) {
5899 		action = RCTL_LOCAL_NOACTION;
5900 	} else if (strcmp(rctlval->zone_rctlval_action, "signal") == 0) {
5901 		action = RCTL_LOCAL_SIGNAL;
5902 	} else if (strcmp(rctlval->zone_rctlval_action, "deny") == 0) {
5903 		action = RCTL_LOCAL_DENY;
5904 	} else {
5905 		/* Invalid Action */
5906 		return (Z_INVAL);
5907 	}
5908 	rctlblk_set_local_action(rctlblk, action, 0);
5909 	rctlblk_set_privilege(rctlblk, priv);
5910 	rctlblk_set_value(rctlblk, limit);
5911 	return (Z_OK);
5912 }
5913 
5914 static int
5915 rctl_check(const char *rctlname, void *arg)
5916 {
5917 	const char *attrname = arg;
5918 
5919 	/*
5920 	 * Returning 1 here is our signal to zonecfg_is_rctl() that it is
5921 	 * indeed an rctl name recognized by the system.
5922 	 */
5923 	return (strcmp(rctlname, attrname) == 0 ? 1 : 0);
5924 }
5925 
5926 boolean_t
5927 zonecfg_is_rctl(const char *name)
5928 {
5929 	return (rctl_walk(rctl_check, (void *)name) == 1);
5930 }
5931 
5932 boolean_t
5933 zonecfg_valid_rctlname(const char *name)
5934 {
5935 	const char *c;
5936 
5937 	if (strncmp(name, "zone.", sizeof ("zone.") - 1) != 0)
5938 		return (B_FALSE);
5939 	if (strlen(name) == sizeof ("zone.") - 1)
5940 		return (B_FALSE);
5941 	for (c = name + sizeof ("zone.") - 1; *c != '\0'; c++) {
5942 		if (!isalpha(*c) && *c != '-')
5943 			return (B_FALSE);
5944 	}
5945 	return (B_TRUE);
5946 }
5947 
5948 boolean_t
5949 zonecfg_valid_rctlblk(const rctlblk_t *rctlblk)
5950 {
5951 	rctl_priv_t priv = rctlblk_get_privilege((rctlblk_t *)rctlblk);
5952 	uint_t action = rctlblk_get_local_action((rctlblk_t *)rctlblk, NULL);
5953 
5954 	if (priv != RCPRIV_PRIVILEGED)
5955 		return (B_FALSE);
5956 	if (action != RCTL_LOCAL_NOACTION && action != RCTL_LOCAL_DENY)
5957 		return (B_FALSE);
5958 	return (B_TRUE);
5959 }
5960 
5961 boolean_t
5962 zonecfg_valid_rctl(const char *name, const rctlblk_t *rctlblk)
5963 {
5964 	rctlblk_t *current, *next;
5965 	rctl_qty_t limit = rctlblk_get_value((rctlblk_t *)rctlblk);
5966 	uint_t action = rctlblk_get_local_action((rctlblk_t *)rctlblk, NULL);
5967 	uint_t global_flags;
5968 
5969 	if (!zonecfg_valid_rctlblk(rctlblk))
5970 		return (B_FALSE);
5971 	if (!zonecfg_valid_rctlname(name))
5972 		return (B_FALSE);
5973 
5974 	current = alloca(rctlblk_size());
5975 	if (getrctl(name, NULL, current, RCTL_FIRST) != 0)
5976 		return (B_TRUE);	/* not an rctl on this system */
5977 	/*
5978 	 * Make sure the proposed value isn't greater than the current system
5979 	 * value.
5980 	 */
5981 	next = alloca(rctlblk_size());
5982 	while (rctlblk_get_privilege(current) != RCPRIV_SYSTEM) {
5983 		rctlblk_t *tmp;
5984 
5985 		if (getrctl(name, current, next, RCTL_NEXT) != 0)
5986 			return (B_FALSE);	/* shouldn't happen */
5987 		tmp = current;
5988 		current = next;
5989 		next = tmp;
5990 	}
5991 	if (limit > rctlblk_get_value(current))
5992 		return (B_FALSE);
5993 
5994 	/*
5995 	 * Make sure the proposed action is allowed.
5996 	 */
5997 	global_flags = rctlblk_get_global_flags(current);
5998 	if ((global_flags & RCTL_GLOBAL_DENY_NEVER) &&
5999 	    action == RCTL_LOCAL_DENY)
6000 		return (B_FALSE);
6001 	if ((global_flags & RCTL_GLOBAL_DENY_ALWAYS) &&
6002 	    action == RCTL_LOCAL_NOACTION)
6003 		return (B_FALSE);
6004 
6005 	return (B_TRUE);
6006 }
6007 
6008 /*
6009  * There is always a race condition between reading the initial copy of
6010  * a zones state and its state changing.  We address this by providing
6011  * zonecfg_notify_critical_enter and zonecfg_noticy_critical_exit functions.
6012  * When zonecfg_critical_enter is called, sets the state field to LOCKED
6013  * and aquires biglock. Biglock protects against other threads executing
6014  * critical_enter and the state field protects against state changes during
6015  * the critical period.
6016  *
6017  * If any state changes occur, zn_cb will set the failed field of the znotify
6018  * structure.  This will cause the critical_exit function to re-lock the
6019  * channel and return an error. Since evsnts may be delayed, the critical_exit
6020  * function "flushes" the queue by putting an event on the queue and waiting for
6021  * zn_cb to notify critical_exit that it received the ping event.
6022  */
6023 static const char *
6024 string_get_tok(const char *in, char delim, int num)
6025 {
6026 	int i = 0;
6027 
6028 	for (; i < num; in++) {
6029 		if (*in == delim)
6030 			i++;
6031 		if (*in == 0)
6032 			return (NULL);
6033 	}
6034 	return (in);
6035 }
6036 
6037 static boolean_t
6038 is_ping(sysevent_t *ev)
6039 {
6040 	if (strcmp(sysevent_get_subclass_name(ev),
6041 	    ZONE_EVENT_PING_SUBCLASS) == 0) {
6042 		return (B_TRUE);
6043 	} else {
6044 		return (B_FALSE);
6045 	}
6046 }
6047 
6048 static boolean_t
6049 is_my_ping(sysevent_t *ev)
6050 {
6051 	const char *sender;
6052 	char mypid[sizeof (pid_t) * 3 + 1];
6053 
6054 	(void) snprintf(mypid, sizeof (mypid), "%i", getpid());
6055 	sender = string_get_tok(sysevent_get_pub(ev), ':', 3);
6056 	if (sender == NULL)
6057 		return (B_FALSE);
6058 	if (strcmp(sender, mypid) != 0)
6059 		return (B_FALSE);
6060 	return (B_TRUE);
6061 }
6062 
6063 static int
6064 do_callback(struct znotify *zevtchan, sysevent_t *ev)
6065 {
6066 	nvlist_t *l;
6067 	int zid;
6068 	char *zonename;
6069 	char *newstate;
6070 	char *oldstate;
6071 	int ret;
6072 	hrtime_t when;
6073 
6074 	if (strcmp(sysevent_get_subclass_name(ev),
6075 	    ZONE_EVENT_STATUS_SUBCLASS) == 0) {
6076 
6077 		if (sysevent_get_attr_list(ev, &l) != 0) {
6078 			if (errno == ENOMEM) {
6079 				zevtchan->zn_failure_count++;
6080 				return (EAGAIN);
6081 			}
6082 			return (0);
6083 		}
6084 		ret = 0;
6085 
6086 		if ((nvlist_lookup_string(l, ZONE_CB_NAME, &zonename) == 0) &&
6087 		    (nvlist_lookup_string(l, ZONE_CB_NEWSTATE, &newstate)
6088 		    == 0) &&
6089 		    (nvlist_lookup_string(l, ZONE_CB_OLDSTATE, &oldstate)
6090 		    == 0) &&
6091 		    (nvlist_lookup_uint64(l, ZONE_CB_TIMESTAMP,
6092 		    (uint64_t *)&when) == 0) &&
6093 		    (nvlist_lookup_int32(l, ZONE_CB_ZONEID, &zid) == 0)) {
6094 			ret = zevtchan->zn_callback(zonename, zid, newstate,
6095 			    oldstate, when, zevtchan->zn_private);
6096 		}
6097 
6098 		zevtchan->zn_failure_count = 0;
6099 		nvlist_free(l);
6100 		return (ret);
6101 	} else {
6102 		/*
6103 		 * We have received an event in an unknown subclass. Ignore.
6104 		 */
6105 		zevtchan->zn_failure_count = 0;
6106 		return (0);
6107 	}
6108 }
6109 
6110 static int
6111 zn_cb(sysevent_t *ev, void *p)
6112 {
6113 	struct znotify *zevtchan = p;
6114 	int error;
6115 
6116 	(void) pthread_mutex_lock(&(zevtchan->zn_mutex));
6117 
6118 	if (is_ping(ev) && !is_my_ping(ev)) {
6119 		(void) pthread_mutex_unlock((&zevtchan->zn_mutex));
6120 		return (0);
6121 	}
6122 
6123 	if (zevtchan->zn_state == ZN_LOCKED) {
6124 		assert(!is_ping(ev));
6125 		zevtchan->zn_failed = B_TRUE;
6126 		(void) pthread_mutex_unlock(&(zevtchan->zn_mutex));
6127 		return (0);
6128 	}
6129 
6130 	if (zevtchan->zn_state == ZN_PING_INFLIGHT) {
6131 		if (is_ping(ev)) {
6132 			zevtchan->zn_state = ZN_PING_RECEIVED;
6133 			(void) pthread_cond_signal(&(zevtchan->zn_cond));
6134 			(void) pthread_mutex_unlock(&(zevtchan->zn_mutex));
6135 			return (0);
6136 		} else {
6137 			zevtchan->zn_failed = B_TRUE;
6138 			(void) pthread_mutex_unlock(&(zevtchan->zn_mutex));
6139 			return (0);
6140 		}
6141 	}
6142 
6143 	if (zevtchan->zn_state == ZN_UNLOCKED) {
6144 
6145 		error = do_callback(zevtchan, ev);
6146 		(void) pthread_mutex_unlock(&(zevtchan->zn_mutex));
6147 		/*
6148 		 * Every ENOMEM failure causes do_callback to increment
6149 		 * zn_failure_count and every success causes it to
6150 		 * set zn_failure_count to zero.  If we got EAGAIN,
6151 		 * we will sleep for zn_failure_count seconds and return
6152 		 * EAGAIN to gpec to try again.
6153 		 *
6154 		 * After 55 seconds, or 10 try's we give up and drop the
6155 		 * event.
6156 		 */
6157 		if (error == EAGAIN) {
6158 			if (zevtchan->zn_failure_count > ZONE_CB_RETRY_COUNT) {
6159 				return (0);
6160 			}
6161 			(void) sleep(zevtchan->zn_failure_count);
6162 		}
6163 		return (error);
6164 	}
6165 
6166 	if (zevtchan->zn_state == ZN_PING_RECEIVED) {
6167 		(void) pthread_mutex_unlock(&(zevtchan->zn_mutex));
6168 		return (0);
6169 	}
6170 
6171 	abort();
6172 	return (0);
6173 }
6174 
6175 void
6176 zonecfg_notify_critical_enter(void *h)
6177 {
6178 	struct znotify *zevtchan = h;
6179 
6180 	(void) pthread_mutex_lock(&(zevtchan->zn_bigmutex));
6181 	zevtchan->zn_state = ZN_LOCKED;
6182 }
6183 
6184 int
6185 zonecfg_notify_critical_exit(void * h)
6186 {
6187 
6188 	struct znotify *zevtchan = h;
6189 
6190 	if (zevtchan->zn_state == ZN_UNLOCKED)
6191 		return (0);
6192 
6193 	(void) pthread_mutex_lock(&(zevtchan->zn_mutex));
6194 	zevtchan->zn_state = ZN_PING_INFLIGHT;
6195 
6196 	(void) sysevent_evc_publish(zevtchan->zn_eventchan,
6197 	    ZONE_EVENT_STATUS_CLASS,
6198 	    ZONE_EVENT_PING_SUBCLASS, ZONE_EVENT_PING_PUBLISHER,
6199 	    zevtchan->zn_subscriber_id, NULL, EVCH_SLEEP);
6200 
6201 	while (zevtchan->zn_state != ZN_PING_RECEIVED) {
6202 		(void) pthread_cond_wait(&(zevtchan->zn_cond),
6203 		    &(zevtchan->zn_mutex));
6204 	}
6205 
6206 	if (zevtchan->zn_failed == B_TRUE) {
6207 		zevtchan->zn_state = ZN_LOCKED;
6208 		zevtchan->zn_failed = B_FALSE;
6209 		(void) pthread_mutex_unlock(&(zevtchan->zn_mutex));
6210 		return (1);
6211 	}
6212 
6213 	zevtchan->zn_state = ZN_UNLOCKED;
6214 	(void) pthread_mutex_unlock(&(zevtchan->zn_mutex));
6215 	(void) pthread_mutex_unlock(&(zevtchan->zn_bigmutex));
6216 	return (0);
6217 }
6218 
6219 void
6220 zonecfg_notify_critical_abort(void *h)
6221 {
6222 	struct znotify *zevtchan = h;
6223 
6224 	zevtchan->zn_state = ZN_UNLOCKED;
6225 	zevtchan->zn_failed = B_FALSE;
6226 	/*
6227 	 * Don't do anything about zn_lock. If it is held, it could only be
6228 	 * held by zn_cb and it will be unlocked soon.
6229 	 */
6230 	(void) pthread_mutex_unlock(&(zevtchan->zn_bigmutex));
6231 }
6232 
6233 void *
6234 zonecfg_notify_bind(int(*func)(const char *zonename, zoneid_t zid,
6235     const char *newstate, const char *oldstate, hrtime_t when, void *p),
6236     void *p)
6237 {
6238 	struct znotify *zevtchan;
6239 	int i = 1;
6240 	int r;
6241 
6242 	zevtchan = malloc(sizeof (struct znotify));
6243 
6244 	if (zevtchan == NULL)
6245 		return (NULL);
6246 
6247 	zevtchan->zn_private = p;
6248 	zevtchan->zn_callback = func;
6249 	zevtchan->zn_state = ZN_UNLOCKED;
6250 	zevtchan->zn_failed = B_FALSE;
6251 
6252 	if (pthread_mutex_init(&(zevtchan->zn_mutex), NULL))
6253 		goto out3;
6254 	if (pthread_cond_init(&(zevtchan->zn_cond), NULL)) {
6255 		(void) pthread_mutex_destroy(&(zevtchan->zn_mutex));
6256 		goto out3;
6257 	}
6258 	if (pthread_mutex_init(&(zevtchan->zn_bigmutex), NULL)) {
6259 		(void) pthread_mutex_destroy(&(zevtchan->zn_mutex));
6260 		(void) pthread_cond_destroy(&(zevtchan->zn_cond));
6261 		goto out3;
6262 	}
6263 
6264 	if (sysevent_evc_bind(ZONE_EVENT_CHANNEL, &(zevtchan->zn_eventchan),
6265 	    0) != 0)
6266 		goto out2;
6267 
6268 	do {
6269 		/*
6270 		 * At 4 digits the subscriber ID gets too long and we have
6271 		 * no chance of successfully registering.
6272 		 */
6273 		if (i > 999)
6274 			goto out1;
6275 
6276 		(void) sprintf(zevtchan->zn_subscriber_id, "zone_%li_%i",
6277 		    getpid() % 999999l, i);
6278 
6279 		r = sysevent_evc_subscribe(zevtchan->zn_eventchan,
6280 		    zevtchan->zn_subscriber_id, ZONE_EVENT_STATUS_CLASS, zn_cb,
6281 		    zevtchan, 0);
6282 
6283 		i++;
6284 
6285 	} while (r);
6286 
6287 	return (zevtchan);
6288 out1:
6289 	(void) sysevent_evc_unbind(zevtchan->zn_eventchan);
6290 out2:
6291 	(void) pthread_mutex_destroy(&zevtchan->zn_mutex);
6292 	(void) pthread_cond_destroy(&zevtchan->zn_cond);
6293 	(void) pthread_mutex_destroy(&(zevtchan->zn_bigmutex));
6294 out3:
6295 	free(zevtchan);
6296 
6297 	return (NULL);
6298 }
6299 
6300 void
6301 zonecfg_notify_unbind(void *handle)
6302 {
6303 
6304 	int ret;
6305 
6306 	(void) sysevent_evc_unbind(((struct znotify *)handle)->zn_eventchan);
6307 	/*
6308 	 * Check that all evc threads have gone away. This should be
6309 	 * enforced by sysevent_evc_unbind.
6310 	 */
6311 	ret = pthread_mutex_trylock(&((struct znotify *)handle)->zn_mutex);
6312 
6313 	if (ret)
6314 		abort();
6315 
6316 	(void) pthread_mutex_unlock(&((struct znotify *)handle)->zn_mutex);
6317 	(void) pthread_mutex_destroy(&((struct znotify *)handle)->zn_mutex);
6318 	(void) pthread_cond_destroy(&((struct znotify *)handle)->zn_cond);
6319 	(void) pthread_mutex_destroy(&((struct znotify *)handle)->zn_bigmutex);
6320 
6321 	free(handle);
6322 }
6323 
6324 static int
6325 zonecfg_add_ds_core(zone_dochandle_t handle, struct zone_dstab *tabptr)
6326 {
6327 	xmlNodePtr newnode, cur = handle->zone_dh_cur;
6328 	int err;
6329 
6330 	newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_DATASET, NULL);
6331 	if ((err = newprop(newnode, DTD_ATTR_NAME,
6332 	    tabptr->zone_dataset_name)) != Z_OK)
6333 		return (err);
6334 	return (Z_OK);
6335 }
6336 
6337 int
6338 zonecfg_add_ds(zone_dochandle_t handle, struct zone_dstab *tabptr)
6339 {
6340 	int err;
6341 
6342 	if (tabptr == NULL)
6343 		return (Z_INVAL);
6344 
6345 	if ((err = operation_prep(handle)) != Z_OK)
6346 		return (err);
6347 
6348 	if ((err = zonecfg_add_ds_core(handle, tabptr)) != Z_OK)
6349 		return (err);
6350 
6351 	return (Z_OK);
6352 }
6353 
6354 static int
6355 zonecfg_delete_ds_core(zone_dochandle_t handle, struct zone_dstab *tabptr)
6356 {
6357 	xmlNodePtr cur = handle->zone_dh_cur;
6358 
6359 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
6360 		if (xmlStrcmp(cur->name, DTD_ELEM_DATASET))
6361 			continue;
6362 
6363 		if (match_prop(cur, DTD_ATTR_NAME,
6364 		    tabptr->zone_dataset_name)) {
6365 			xmlUnlinkNode(cur);
6366 			xmlFreeNode(cur);
6367 			return (Z_OK);
6368 		}
6369 	}
6370 	return (Z_NO_RESOURCE_ID);
6371 }
6372 
6373 int
6374 zonecfg_delete_ds(zone_dochandle_t handle, struct zone_dstab *tabptr)
6375 {
6376 	int err;
6377 
6378 	if (tabptr == NULL)
6379 		return (Z_INVAL);
6380 
6381 	if ((err = operation_prep(handle)) != Z_OK)
6382 		return (err);
6383 
6384 	if ((err = zonecfg_delete_ds_core(handle, tabptr)) != Z_OK)
6385 		return (err);
6386 
6387 	return (Z_OK);
6388 }
6389 
6390 int
6391 zonecfg_modify_ds(
6392 	zone_dochandle_t handle,
6393 	struct zone_dstab *oldtabptr,
6394 	struct zone_dstab *newtabptr)
6395 {
6396 	int err;
6397 
6398 	if (oldtabptr == NULL || newtabptr == NULL)
6399 		return (Z_INVAL);
6400 
6401 	if ((err = operation_prep(handle)) != Z_OK)
6402 		return (err);
6403 
6404 	if ((err = zonecfg_delete_ds_core(handle, oldtabptr)) != Z_OK)
6405 		return (err);
6406 
6407 	if ((err = zonecfg_add_ds_core(handle, newtabptr)) != Z_OK)
6408 		return (err);
6409 
6410 	return (Z_OK);
6411 }
6412 
6413 int
6414 zonecfg_lookup_ds(zone_dochandle_t handle, struct zone_dstab *tabptr)
6415 {
6416 	xmlNodePtr cur, firstmatch;
6417 	int err;
6418 	char dataset[MAXNAMELEN];
6419 
6420 	if (tabptr == NULL)
6421 		return (Z_INVAL);
6422 
6423 	if ((err = operation_prep(handle)) != Z_OK)
6424 		return (err);
6425 
6426 	cur = handle->zone_dh_cur;
6427 	firstmatch = NULL;
6428 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
6429 		if (xmlStrcmp(cur->name, DTD_ELEM_DATASET))
6430 			continue;
6431 		if (strlen(tabptr->zone_dataset_name) > 0) {
6432 			if ((fetchprop(cur, DTD_ATTR_NAME, dataset,
6433 			    sizeof (dataset)) == Z_OK) &&
6434 			    (strcmp(tabptr->zone_dataset_name,
6435 			    dataset) == 0)) {
6436 				if (firstmatch == NULL)
6437 					firstmatch = cur;
6438 				else
6439 					return (Z_INSUFFICIENT_SPEC);
6440 			}
6441 		}
6442 	}
6443 	if (firstmatch == NULL)
6444 		return (Z_NO_RESOURCE_ID);
6445 
6446 	cur = firstmatch;
6447 
6448 	if ((err = fetchprop(cur, DTD_ATTR_NAME, tabptr->zone_dataset_name,
6449 	    sizeof (tabptr->zone_dataset_name))) != Z_OK)
6450 		return (err);
6451 
6452 	return (Z_OK);
6453 }
6454 
6455 int
6456 zonecfg_setdsent(zone_dochandle_t handle)
6457 {
6458 	return (zonecfg_setent(handle));
6459 }
6460 
6461 int
6462 zonecfg_getdsent(zone_dochandle_t handle, struct zone_dstab *tabptr)
6463 {
6464 	xmlNodePtr cur;
6465 	int err;
6466 
6467 	if (handle == NULL)
6468 		return (Z_INVAL);
6469 
6470 	if ((cur = handle->zone_dh_cur) == NULL)
6471 		return (Z_NO_ENTRY);
6472 
6473 	for (; cur != NULL; cur = cur->next)
6474 		if (!xmlStrcmp(cur->name, DTD_ELEM_DATASET))
6475 			break;
6476 	if (cur == NULL) {
6477 		handle->zone_dh_cur = handle->zone_dh_top;
6478 		return (Z_NO_ENTRY);
6479 	}
6480 
6481 	if ((err = fetchprop(cur, DTD_ATTR_NAME, tabptr->zone_dataset_name,
6482 	    sizeof (tabptr->zone_dataset_name))) != Z_OK) {
6483 		handle->zone_dh_cur = handle->zone_dh_top;
6484 		return (err);
6485 	}
6486 
6487 	handle->zone_dh_cur = cur->next;
6488 	return (Z_OK);
6489 }
6490 
6491 int
6492 zonecfg_enddsent(zone_dochandle_t handle)
6493 {
6494 	return (zonecfg_endent(handle));
6495 }
6496 
6497 /*
6498  * Support for aliased rctls; that is, rctls that have simplified names in
6499  * zonecfg.  For example, max-lwps is an alias for a well defined zone.max-lwps
6500  * rctl.  If there are multiple existing values for one of these rctls or if
6501  * there is a single value that does not match the well defined template (i.e.
6502  * it has a different action) then we cannot treat the rctl as having an alias
6503  * so we return Z_ALIAS_DISALLOW.  That means that the rctl cannot be
6504  * managed in zonecfg via an alias and that the standard rctl syntax must be
6505  * used.
6506  *
6507  * The possible return values are:
6508  *	Z_NO_PROPERTY_ID - invalid alias name
6509  *	Z_ALIAS_DISALLOW - pre-existing, incompatible rctl definition
6510  *	Z_NO_ENTRY - no rctl is configured for this alias
6511  *	Z_OK - we got a valid rctl for the specified alias
6512  */
6513 int
6514 zonecfg_get_aliased_rctl(zone_dochandle_t handle, char *name, uint64_t *rval)
6515 {
6516 	boolean_t found = B_FALSE;
6517 	boolean_t found_val = B_FALSE;
6518 	xmlNodePtr cur, val;
6519 	char savedname[MAXNAMELEN];
6520 	struct zone_rctlvaltab rctl;
6521 	int i;
6522 	int err;
6523 
6524 	for (i = 0; aliases[i].shortname != NULL; i++)
6525 		if (strcmp(name, aliases[i].shortname) == 0)
6526 			break;
6527 
6528 	if (aliases[i].shortname == NULL)
6529 		return (Z_NO_PROPERTY_ID);
6530 
6531 	if ((err = operation_prep(handle)) != Z_OK)
6532 		return (err);
6533 
6534 	cur = handle->zone_dh_cur;
6535 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
6536 		if (xmlStrcmp(cur->name, DTD_ELEM_RCTL) != 0)
6537 			continue;
6538 		if ((fetchprop(cur, DTD_ATTR_NAME, savedname,
6539 		    sizeof (savedname)) == Z_OK) &&
6540 		    (strcmp(savedname, aliases[i].realname) == 0)) {
6541 
6542 			/*
6543 			 * If we already saw one of these, we can't have an
6544 			 * alias since we just found another.
6545 			 */
6546 			if (found)
6547 				return (Z_ALIAS_DISALLOW);
6548 			found = B_TRUE;
6549 
6550 			for (val = cur->xmlChildrenNode; val != NULL;
6551 			    val = val->next) {
6552 				/*
6553 				 * If we already have one value, we can't have
6554 				 * an alias since we just found another.
6555 				 */
6556 				if (found_val)
6557 					return (Z_ALIAS_DISALLOW);
6558 				found_val = B_TRUE;
6559 
6560 				if ((fetchprop(val, DTD_ATTR_PRIV,
6561 				    rctl.zone_rctlval_priv,
6562 				    sizeof (rctl.zone_rctlval_priv)) != Z_OK))
6563 					break;
6564 				if ((fetchprop(val, DTD_ATTR_LIMIT,
6565 				    rctl.zone_rctlval_limit,
6566 				    sizeof (rctl.zone_rctlval_limit)) != Z_OK))
6567 					break;
6568 				if ((fetchprop(val, DTD_ATTR_ACTION,
6569 				    rctl.zone_rctlval_action,
6570 				    sizeof (rctl.zone_rctlval_action)) != Z_OK))
6571 					break;
6572 			}
6573 
6574 			/* check priv and action match the expected vals */
6575 			if (strcmp(rctl.zone_rctlval_priv,
6576 			    aliases[i].priv) != 0 ||
6577 			    strcmp(rctl.zone_rctlval_action,
6578 			    aliases[i].action) != 0)
6579 				return (Z_ALIAS_DISALLOW);
6580 		}
6581 	}
6582 
6583 	if (found) {
6584 		*rval = strtoull(rctl.zone_rctlval_limit, NULL, 10);
6585 		return (Z_OK);
6586 	}
6587 
6588 	return (Z_NO_ENTRY);
6589 }
6590 
6591 int
6592 zonecfg_rm_aliased_rctl(zone_dochandle_t handle, char *name)
6593 {
6594 	int i;
6595 	uint64_t val;
6596 	struct zone_rctltab rctltab;
6597 
6598 	/*
6599 	 * First check that we have a valid aliased rctl to remove.
6600 	 * This will catch an rctl entry with non-standard values or
6601 	 * multiple rctl values for this name.  We need to ignore those
6602 	 * rctl entries.
6603 	 */
6604 	if (zonecfg_get_aliased_rctl(handle, name, &val) != Z_OK)
6605 		return (Z_OK);
6606 
6607 	for (i = 0; aliases[i].shortname != NULL; i++)
6608 		if (strcmp(name, aliases[i].shortname) == 0)
6609 			break;
6610 
6611 	if (aliases[i].shortname == NULL)
6612 		return (Z_NO_RESOURCE_ID);
6613 
6614 	(void) strlcpy(rctltab.zone_rctl_name, aliases[i].realname,
6615 	    sizeof (rctltab.zone_rctl_name));
6616 
6617 	return (zonecfg_delete_rctl(handle, &rctltab));
6618 }
6619 
6620 boolean_t
6621 zonecfg_aliased_rctl_ok(zone_dochandle_t handle, char *name)
6622 {
6623 	uint64_t tmp_val;
6624 
6625 	switch (zonecfg_get_aliased_rctl(handle, name, &tmp_val)) {
6626 	case Z_OK:
6627 		/*FALLTHRU*/
6628 	case Z_NO_ENTRY:
6629 		return (B_TRUE);
6630 	default:
6631 		return (B_FALSE);
6632 	}
6633 }
6634 
6635 int
6636 zonecfg_set_aliased_rctl(zone_dochandle_t handle, char *name, uint64_t val)
6637 {
6638 	int i;
6639 	int err;
6640 	struct zone_rctltab rctltab;
6641 	struct zone_rctlvaltab *rctlvaltab;
6642 	char buf[128];
6643 
6644 	if (!zonecfg_aliased_rctl_ok(handle, name))
6645 		return (Z_ALIAS_DISALLOW);
6646 
6647 	for (i = 0; aliases[i].shortname != NULL; i++)
6648 		if (strcmp(name, aliases[i].shortname) == 0)
6649 			break;
6650 
6651 	if (aliases[i].shortname == NULL)
6652 		return (Z_NO_RESOURCE_ID);
6653 
6654 	/* remove any pre-existing definition for this rctl */
6655 	(void) zonecfg_rm_aliased_rctl(handle, name);
6656 
6657 	(void) strlcpy(rctltab.zone_rctl_name, aliases[i].realname,
6658 	    sizeof (rctltab.zone_rctl_name));
6659 
6660 	rctltab.zone_rctl_valptr = NULL;
6661 
6662 	if ((rctlvaltab = calloc(1, sizeof (struct zone_rctlvaltab))) == NULL)
6663 		return (Z_NOMEM);
6664 
6665 	(void) snprintf(buf, sizeof (buf), "%llu", (long long)val);
6666 
6667 	(void) strlcpy(rctlvaltab->zone_rctlval_priv, aliases[i].priv,
6668 	    sizeof (rctlvaltab->zone_rctlval_priv));
6669 	(void) strlcpy(rctlvaltab->zone_rctlval_limit, buf,
6670 	    sizeof (rctlvaltab->zone_rctlval_limit));
6671 	(void) strlcpy(rctlvaltab->zone_rctlval_action, aliases[i].action,
6672 	    sizeof (rctlvaltab->zone_rctlval_action));
6673 
6674 	rctlvaltab->zone_rctlval_next = NULL;
6675 
6676 	if ((err = zonecfg_add_rctl_value(&rctltab, rctlvaltab)) != Z_OK)
6677 		return (err);
6678 
6679 	return (zonecfg_add_rctl(handle, &rctltab));
6680 }
6681 
6682 static int
6683 delete_tmp_pool(zone_dochandle_t handle)
6684 {
6685 	int err;
6686 	xmlNodePtr cur = handle->zone_dh_cur;
6687 
6688 	if ((err = operation_prep(handle)) != Z_OK)
6689 		return (err);
6690 
6691 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
6692 		if (xmlStrcmp(cur->name, DTD_ELEM_TMPPOOL) == 0) {
6693 			xmlUnlinkNode(cur);
6694 			xmlFreeNode(cur);
6695 			return (Z_OK);
6696 		}
6697 	}
6698 
6699 	return (Z_NO_RESOURCE_ID);
6700 }
6701 
6702 static int
6703 modify_tmp_pool(zone_dochandle_t handle, char *pool_importance)
6704 {
6705 	int err;
6706 	xmlNodePtr cur = handle->zone_dh_cur;
6707 	xmlNodePtr newnode;
6708 
6709 	err = delete_tmp_pool(handle);
6710 	if (err != Z_OK && err != Z_NO_RESOURCE_ID)
6711 		return (err);
6712 
6713 	if (*pool_importance != '\0') {
6714 		if ((err = operation_prep(handle)) != Z_OK)
6715 			return (err);
6716 
6717 		newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_TMPPOOL, NULL);
6718 		if ((err = newprop(newnode, DTD_ATTR_IMPORTANCE,
6719 		    pool_importance)) != Z_OK)
6720 			return (err);
6721 	}
6722 
6723 	return (Z_OK);
6724 }
6725 
6726 static int
6727 add_pset_core(zone_dochandle_t handle, struct zone_psettab *tabptr)
6728 {
6729 	xmlNodePtr newnode, cur = handle->zone_dh_cur;
6730 	int err;
6731 
6732 	newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_PSET, NULL);
6733 	if ((err = newprop(newnode, DTD_ATTR_NCPU_MIN,
6734 	    tabptr->zone_ncpu_min)) != Z_OK)
6735 		return (err);
6736 	if ((err = newprop(newnode, DTD_ATTR_NCPU_MAX,
6737 	    tabptr->zone_ncpu_max)) != Z_OK)
6738 		return (err);
6739 
6740 	if ((err = modify_tmp_pool(handle, tabptr->zone_importance)) != Z_OK)
6741 		return (err);
6742 
6743 	return (Z_OK);
6744 }
6745 
6746 int
6747 zonecfg_add_pset(zone_dochandle_t handle, struct zone_psettab *tabptr)
6748 {
6749 	int err;
6750 
6751 	if (tabptr == NULL)
6752 		return (Z_INVAL);
6753 
6754 	if ((err = operation_prep(handle)) != Z_OK)
6755 		return (err);
6756 
6757 	if ((err = add_pset_core(handle, tabptr)) != Z_OK)
6758 		return (err);
6759 
6760 	return (Z_OK);
6761 }
6762 
6763 int
6764 zonecfg_delete_pset(zone_dochandle_t handle)
6765 {
6766 	int err;
6767 	int res = Z_NO_RESOURCE_ID;
6768 	xmlNodePtr cur = handle->zone_dh_cur;
6769 
6770 	if ((err = operation_prep(handle)) != Z_OK)
6771 		return (err);
6772 
6773 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
6774 		if (xmlStrcmp(cur->name, DTD_ELEM_PSET) == 0) {
6775 			xmlUnlinkNode(cur);
6776 			xmlFreeNode(cur);
6777 			res = Z_OK;
6778 			break;
6779 		}
6780 	}
6781 
6782 	/*
6783 	 * Once we have msets, we should check that a mset
6784 	 * do not exist before we delete the tmp_pool data.
6785 	 */
6786 	err = delete_tmp_pool(handle);
6787 	if (err != Z_OK && err != Z_NO_RESOURCE_ID)
6788 		return (err);
6789 
6790 	return (res);
6791 }
6792 
6793 int
6794 zonecfg_modify_pset(zone_dochandle_t handle, struct zone_psettab *tabptr)
6795 {
6796 	int err;
6797 
6798 	if (tabptr == NULL)
6799 		return (Z_INVAL);
6800 
6801 	if ((err = zonecfg_delete_pset(handle)) != Z_OK)
6802 		return (err);
6803 
6804 	if ((err = add_pset_core(handle, tabptr)) != Z_OK)
6805 		return (err);
6806 
6807 	return (Z_OK);
6808 }
6809 
6810 int
6811 zonecfg_lookup_pset(zone_dochandle_t handle, struct zone_psettab *tabptr)
6812 {
6813 	xmlNodePtr cur;
6814 	int err;
6815 	int res = Z_NO_ENTRY;
6816 
6817 	if (tabptr == NULL)
6818 		return (Z_INVAL);
6819 
6820 	if ((err = operation_prep(handle)) != Z_OK)
6821 		return (err);
6822 
6823 	/* this is an optional component */
6824 	tabptr->zone_importance[0] = '\0';
6825 
6826 	cur = handle->zone_dh_cur;
6827 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
6828 		if (xmlStrcmp(cur->name, DTD_ELEM_PSET) == 0) {
6829 			if ((err = fetchprop(cur, DTD_ATTR_NCPU_MIN,
6830 			    tabptr->zone_ncpu_min,
6831 			    sizeof (tabptr->zone_ncpu_min))) != Z_OK) {
6832 				handle->zone_dh_cur = handle->zone_dh_top;
6833 				return (err);
6834 			}
6835 
6836 			if ((err = fetchprop(cur, DTD_ATTR_NCPU_MAX,
6837 			    tabptr->zone_ncpu_max,
6838 			    sizeof (tabptr->zone_ncpu_max))) != Z_OK) {
6839 				handle->zone_dh_cur = handle->zone_dh_top;
6840 				return (err);
6841 			}
6842 
6843 			res = Z_OK;
6844 
6845 		} else if (xmlStrcmp(cur->name, DTD_ELEM_TMPPOOL) == 0) {
6846 			if ((err = fetchprop(cur, DTD_ATTR_IMPORTANCE,
6847 			    tabptr->zone_importance,
6848 			    sizeof (tabptr->zone_importance))) != Z_OK) {
6849 				handle->zone_dh_cur = handle->zone_dh_top;
6850 				return (err);
6851 			}
6852 		}
6853 	}
6854 
6855 	return (res);
6856 }
6857 
6858 int
6859 zonecfg_getpsetent(zone_dochandle_t handle, struct zone_psettab *tabptr)
6860 {
6861 	int err;
6862 
6863 	if ((err = zonecfg_setent(handle)) != Z_OK)
6864 		return (err);
6865 
6866 	err = zonecfg_lookup_pset(handle, tabptr);
6867 
6868 	(void) zonecfg_endent(handle);
6869 
6870 	return (err);
6871 }
6872 
6873 static int
6874 add_mcap(zone_dochandle_t handle, struct zone_mcaptab *tabptr)
6875 {
6876 	xmlNodePtr newnode, cur = handle->zone_dh_cur;
6877 	int err;
6878 
6879 	newnode = xmlNewTextChild(cur, NULL, DTD_ELEM_MCAP, NULL);
6880 	if ((err = newprop(newnode, DTD_ATTR_PHYSCAP, tabptr->zone_physmem_cap))
6881 	    != Z_OK)
6882 		return (err);
6883 
6884 	return (Z_OK);
6885 }
6886 
6887 int
6888 zonecfg_delete_mcap(zone_dochandle_t handle)
6889 {
6890 	int err;
6891 	xmlNodePtr cur = handle->zone_dh_cur;
6892 
6893 	if ((err = operation_prep(handle)) != Z_OK)
6894 		return (err);
6895 
6896 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
6897 		if (xmlStrcmp(cur->name, DTD_ELEM_MCAP) != 0)
6898 			continue;
6899 
6900 		xmlUnlinkNode(cur);
6901 		xmlFreeNode(cur);
6902 		return (Z_OK);
6903 	}
6904 	return (Z_NO_RESOURCE_ID);
6905 }
6906 
6907 int
6908 zonecfg_modify_mcap(zone_dochandle_t handle, struct zone_mcaptab *tabptr)
6909 {
6910 	int err;
6911 
6912 	if (tabptr == NULL)
6913 		return (Z_INVAL);
6914 
6915 	err = zonecfg_delete_mcap(handle);
6916 	/* it is ok if there is no mcap entry */
6917 	if (err != Z_OK && err != Z_NO_RESOURCE_ID)
6918 		return (err);
6919 
6920 	if ((err = add_mcap(handle, tabptr)) != Z_OK)
6921 		return (err);
6922 
6923 	return (Z_OK);
6924 }
6925 
6926 int
6927 zonecfg_lookup_mcap(zone_dochandle_t handle, struct zone_mcaptab *tabptr)
6928 {
6929 	xmlNodePtr cur;
6930 	int err;
6931 
6932 	if (tabptr == NULL)
6933 		return (Z_INVAL);
6934 
6935 	if ((err = operation_prep(handle)) != Z_OK)
6936 		return (err);
6937 
6938 	cur = handle->zone_dh_cur;
6939 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
6940 		if (xmlStrcmp(cur->name, DTD_ELEM_MCAP) != 0)
6941 			continue;
6942 		if ((err = fetchprop(cur, DTD_ATTR_PHYSCAP,
6943 		    tabptr->zone_physmem_cap,
6944 		    sizeof (tabptr->zone_physmem_cap))) != Z_OK) {
6945 			handle->zone_dh_cur = handle->zone_dh_top;
6946 			return (err);
6947 		}
6948 
6949 		return (Z_OK);
6950 	}
6951 
6952 	return (Z_NO_ENTRY);
6953 }
6954 
6955 static int
6956 getmcapent_core(zone_dochandle_t handle, struct zone_mcaptab *tabptr)
6957 {
6958 	xmlNodePtr cur;
6959 	int err;
6960 
6961 	if (handle == NULL)
6962 		return (Z_INVAL);
6963 
6964 	if ((cur = handle->zone_dh_cur) == NULL)
6965 		return (Z_NO_ENTRY);
6966 
6967 	for (; cur != NULL; cur = cur->next)
6968 		if (xmlStrcmp(cur->name, DTD_ELEM_MCAP) == 0)
6969 			break;
6970 	if (cur == NULL) {
6971 		handle->zone_dh_cur = handle->zone_dh_top;
6972 		return (Z_NO_ENTRY);
6973 	}
6974 
6975 	if ((err = fetchprop(cur, DTD_ATTR_PHYSCAP, tabptr->zone_physmem_cap,
6976 	    sizeof (tabptr->zone_physmem_cap))) != Z_OK) {
6977 		handle->zone_dh_cur = handle->zone_dh_top;
6978 		return (err);
6979 	}
6980 
6981 	handle->zone_dh_cur = cur->next;
6982 	return (Z_OK);
6983 }
6984 
6985 int
6986 zonecfg_getmcapent(zone_dochandle_t handle, struct zone_mcaptab *tabptr)
6987 {
6988 	int err;
6989 
6990 	if ((err = zonecfg_setent(handle)) != Z_OK)
6991 		return (err);
6992 
6993 	err = getmcapent_core(handle, tabptr);
6994 
6995 	(void) zonecfg_endent(handle);
6996 
6997 	return (err);
6998 }
6999 
7000 /*
7001  * Get the full tree of pkg/patch metadata in a set of nested AVL trees.
7002  * pkgs_avl is an AVL tree of pkgs.  Each pkg element contains a
7003  * zpe_patches_avl member which holds an AVL tree of patches for that pkg.
7004  * The patch elements have the same zpe_patches_avl member, each of which can
7005  * hold an AVL tree of patches that are obsoleted by the patch.
7006  *
7007  * The zone xml data contains DTD_ELEM_PACKAGE elements, followed by
7008  * DTD_ELEM_PATCH elements.  The DTD_ELEM_PATCH patch element applies to the
7009  * DTD_ELEM_PACKAGE that precedes it.  The DTD_ELEM_PATCH element may have
7010  * child DTD_ELEM_OBSOLETES nodes associated with it.  The DTD_ELEM_PACKAGE
7011  * really should have had the DTD_ELEM_PATCH elements as children but it
7012  * was not defined that way initially so we are stuck with the DTD definition
7013  * now.  However, we can safely assume the ordering for compatibility.
7014  */
7015 int
7016 zonecfg_getpkgdata(zone_dochandle_t handle, uu_avl_pool_t *pkg_pool,
7017     uu_avl_t *pkgs_avl)
7018 {
7019 	xmlNodePtr cur;
7020 	int res;
7021 	zone_pkg_entry_t *pkg;
7022 	char name[MAXNAMELEN];
7023 	char version[ZONE_PKG_VERSMAX];
7024 
7025 	if (handle == NULL)
7026 		return (Z_INVAL);
7027 
7028 	if ((res = zonecfg_setent(handle)) != Z_OK)
7029 		return (res);
7030 
7031 	if ((cur = handle->zone_dh_cur) == NULL) {
7032 		res = Z_NO_ENTRY;
7033 		goto done;
7034 	}
7035 
7036 	for (; cur != NULL; cur = cur->next) {
7037 		if (xmlStrcmp(cur->name, DTD_ELEM_PACKAGE) == 0) {
7038 			uu_avl_index_t where;
7039 
7040 			if ((res = fetchprop(cur, DTD_ATTR_NAME, name,
7041 			    sizeof (name))) != Z_OK)
7042 				goto done;
7043 
7044 			if ((res = fetchprop(cur, DTD_ATTR_VERSION, version,
7045 			    sizeof (version))) != Z_OK)
7046 				goto done;
7047 
7048 			if ((pkg = (zone_pkg_entry_t *)
7049 			    malloc(sizeof (zone_pkg_entry_t))) == NULL) {
7050 				res = Z_NOMEM;
7051 				goto done;
7052 			}
7053 
7054 			if ((pkg->zpe_name = strdup(name)) == NULL) {
7055 				free(pkg);
7056 				res = Z_NOMEM;
7057 				goto done;
7058 			}
7059 
7060 			if ((pkg->zpe_vers = strdup(version)) == NULL) {
7061 				free(pkg->zpe_name);
7062 				free(pkg);
7063 				res = Z_NOMEM;
7064 				goto done;
7065 			}
7066 
7067 			pkg->zpe_patches_avl = NULL;
7068 
7069 			uu_avl_node_init(pkg, &pkg->zpe_entry, pkg_pool);
7070 			if (uu_avl_find(pkgs_avl, pkg, NULL, &where) != NULL) {
7071 				free(pkg->zpe_name);
7072 				free(pkg->zpe_vers);
7073 				free(pkg);
7074 			} else {
7075 				uu_avl_insert(pkgs_avl, pkg, where);
7076 			}
7077 
7078 		} else if (xmlStrcmp(cur->name, DTD_ELEM_PATCH) == 0) {
7079 			zone_pkg_entry_t *patch;
7080 			uu_avl_index_t where;
7081 			char *p;
7082 			char *dashp = NULL;
7083 			xmlNodePtr child;
7084 
7085 			if ((res = fetchprop(cur, DTD_ATTR_ID, name,
7086 			    sizeof (name))) != Z_OK)
7087 				goto done;
7088 
7089 			if ((patch = (zone_pkg_entry_t *)
7090 			    malloc(sizeof (zone_pkg_entry_t))) == NULL) {
7091 				res = Z_NOMEM;
7092 				goto done;
7093 			}
7094 
7095 			if ((p = strchr(name, '-')) != NULL) {
7096 				dashp = p;
7097 				*p++ = '\0';
7098 			} else {
7099 				p = "";
7100 			}
7101 
7102 			if ((patch->zpe_name = strdup(name)) == NULL) {
7103 				free(patch);
7104 				res = Z_NOMEM;
7105 				goto done;
7106 			}
7107 
7108 			if ((patch->zpe_vers = strdup(p)) == NULL) {
7109 				free(patch->zpe_name);
7110 				free(patch);
7111 				res = Z_NOMEM;
7112 				goto done;
7113 			}
7114 
7115 			if (dashp != NULL)
7116 				*dashp = '-';
7117 
7118 			patch->zpe_patches_avl = NULL;
7119 
7120 			if (pkg->zpe_patches_avl == NULL) {
7121 				pkg->zpe_patches_avl = uu_avl_create(pkg_pool,
7122 				    NULL, UU_DEFAULT);
7123 				if (pkg->zpe_patches_avl == NULL) {
7124 					free(patch->zpe_name);
7125 					free(patch->zpe_vers);
7126 					free(patch);
7127 					res = Z_NOMEM;
7128 					goto done;
7129 				}
7130 			}
7131 
7132 			uu_avl_node_init(patch, &patch->zpe_entry, pkg_pool);
7133 			if (uu_avl_find(pkg->zpe_patches_avl, patch, NULL,
7134 			    &where) != NULL) {
7135 				free(patch->zpe_name);
7136 				free(patch->zpe_vers);
7137 				free(patch);
7138 			} else {
7139 				uu_avl_insert(pkg->zpe_patches_avl, patch,
7140 				    where);
7141 			}
7142 
7143 			/* Add any patches this patch obsoletes. */
7144 			for (child = cur->xmlChildrenNode; child != NULL;
7145 			    child = child->next) {
7146 				zone_pkg_entry_t *obs;
7147 
7148 				if (xmlStrcmp(child->name, DTD_ELEM_OBSOLETES)
7149 				    != 0)
7150 					continue;
7151 
7152 				if ((res = fetchprop(child, DTD_ATTR_ID,
7153 				    name, sizeof (name))) != Z_OK)
7154 					goto done;
7155 
7156 				if ((obs = (zone_pkg_entry_t *)malloc(
7157 				    sizeof (zone_pkg_entry_t))) == NULL) {
7158 					res = Z_NOMEM;
7159 					goto done;
7160 				}
7161 
7162 				if ((obs->zpe_name = strdup(name)) == NULL) {
7163 					free(obs);
7164 					res = Z_NOMEM;
7165 					goto done;
7166 				}
7167 				/*
7168 				 * The version doesn't matter for obsoleted
7169 				 * patches.
7170 				 */
7171 				obs->zpe_vers = NULL;
7172 				obs->zpe_patches_avl = NULL;
7173 
7174 				/*
7175 				 * If this is the first obsolete patch, add an
7176 				 * AVL tree to the parent patch element.
7177 				 */
7178 				if (patch->zpe_patches_avl == NULL) {
7179 					patch->zpe_patches_avl =
7180 					    uu_avl_create(pkg_pool, NULL,
7181 					    UU_DEFAULT);
7182 					if (patch->zpe_patches_avl == NULL) {
7183 						free(obs->zpe_name);
7184 						free(obs);
7185 						res = Z_NOMEM;
7186 						goto done;
7187 					}
7188 				}
7189 
7190 				/* Insert obsolete patch into the AVL tree. */
7191 				uu_avl_node_init(obs, &obs->zpe_entry,
7192 				    pkg_pool);
7193 				if (uu_avl_find(patch->zpe_patches_avl, obs,
7194 				    NULL, &where) != NULL) {
7195 					free(obs->zpe_name);
7196 					free(obs);
7197 				} else {
7198 					uu_avl_insert(patch->zpe_patches_avl,
7199 					    obs, where);
7200 				}
7201 			}
7202 		}
7203 	}
7204 
7205 done:
7206 	(void) zonecfg_endent(handle);
7207 	return (res);
7208 }
7209 
7210 int
7211 zonecfg_setdevperment(zone_dochandle_t handle)
7212 {
7213 	return (zonecfg_setent(handle));
7214 }
7215 
7216 int
7217 zonecfg_getdevperment(zone_dochandle_t handle, struct zone_devpermtab *tabptr)
7218 {
7219 	xmlNodePtr cur;
7220 	int err;
7221 	char buf[128];
7222 
7223 	tabptr->zone_devperm_acl = NULL;
7224 
7225 	if (handle == NULL)
7226 		return (Z_INVAL);
7227 
7228 	if ((cur = handle->zone_dh_cur) == NULL)
7229 		return (Z_NO_ENTRY);
7230 
7231 	for (; cur != NULL; cur = cur->next)
7232 		if (!xmlStrcmp(cur->name, DTD_ELEM_DEV_PERM))
7233 			break;
7234 	if (cur == NULL) {
7235 		handle->zone_dh_cur = handle->zone_dh_top;
7236 		return (Z_NO_ENTRY);
7237 	}
7238 
7239 	if ((err = fetchprop(cur, DTD_ATTR_NAME, tabptr->zone_devperm_name,
7240 	    sizeof (tabptr->zone_devperm_name))) != Z_OK) {
7241 		handle->zone_dh_cur = handle->zone_dh_top;
7242 		return (err);
7243 	}
7244 
7245 	if ((err = fetchprop(cur, DTD_ATTR_UID, buf, sizeof (buf))) != Z_OK) {
7246 		handle->zone_dh_cur = handle->zone_dh_top;
7247 		return (err);
7248 	}
7249 	tabptr->zone_devperm_uid = (uid_t)atol(buf);
7250 
7251 	if ((err = fetchprop(cur, DTD_ATTR_GID, buf, sizeof (buf))) != Z_OK) {
7252 		handle->zone_dh_cur = handle->zone_dh_top;
7253 		return (err);
7254 	}
7255 	tabptr->zone_devperm_gid = (gid_t)atol(buf);
7256 
7257 	if ((err = fetchprop(cur, DTD_ATTR_MODE, buf, sizeof (buf))) != Z_OK) {
7258 		handle->zone_dh_cur = handle->zone_dh_top;
7259 		return (err);
7260 	}
7261 	tabptr->zone_devperm_mode = (mode_t)strtol(buf, (char **)NULL, 8);
7262 
7263 	if ((err = fetch_alloc_prop(cur, DTD_ATTR_ACL,
7264 	    &(tabptr->zone_devperm_acl))) != Z_OK) {
7265 		handle->zone_dh_cur = handle->zone_dh_top;
7266 		return (err);
7267 	}
7268 
7269 	handle->zone_dh_cur = cur->next;
7270 	return (Z_OK);
7271 }
7272 
7273 int
7274 zonecfg_enddevperment(zone_dochandle_t handle)
7275 {
7276 	return (zonecfg_endent(handle));
7277 }
7278 
7279 /* PRINTFLIKE1 */
7280 static void
7281 zerror(const char *zone_name, const char *fmt, ...)
7282 {
7283 	va_list alist;
7284 
7285 	va_start(alist, fmt);
7286 	(void) fprintf(stderr, "zone '%s': ", zone_name);
7287 	(void) vfprintf(stderr, fmt, alist);
7288 	(void) fprintf(stderr, "\n");
7289 	va_end(alist);
7290 }
7291 
7292 static void
7293 zperror(const char *str)
7294 {
7295 	(void) fprintf(stderr, "%s: %s\n", str, strerror(errno));
7296 }
7297 
7298 /*
7299  * The following three routines implement a simple locking mechanism to
7300  * ensure that only one instance of zoneadm at a time is able to manipulate
7301  * a given zone.  The lock is built on top of an fcntl(2) lock of
7302  * [<altroot>]/var/run/zones/<zonename>.zoneadm.lock.  If a zoneadm instance
7303  * can grab that lock, it is allowed to manipulate the zone.
7304  *
7305  * Since zoneadm may call external applications which in turn invoke
7306  * zoneadm again, we introduce the notion of "lock inheritance".  Any
7307  * instance of zoneadm that has another instance in its ancestry is assumed
7308  * to be acting on behalf of the original zoneadm, and is thus allowed to
7309  * manipulate its zone.
7310  *
7311  * This inheritance is implemented via the _ZONEADM_LOCK_HELD environment
7312  * variable.  When zoneadm is granted a lock on its zone, this environment
7313  * variable is set to 1.  When it releases the lock, the variable is set to
7314  * 0.  Since a child process inherits its parent's environment, checking
7315  * the state of this variable indicates whether or not any ancestor owns
7316  * the lock.
7317  */
7318 void
7319 zonecfg_init_lock_file(const char *zone_name, char **lock_env)
7320 {
7321 	*lock_env = getenv(LOCK_ENV_VAR);
7322 	if (*lock_env == NULL) {
7323 		if (putenv(zoneadm_lock_not_held) != 0) {
7324 			zerror(zone_name, gettext("could not set env: %s"),
7325 			    strerror(errno));
7326 			exit(1);
7327 		}
7328 	} else {
7329 		if (atoi(*lock_env) == 1)
7330 			zone_lock_cnt = 1;
7331 	}
7332 }
7333 
7334 void
7335 zonecfg_release_lock_file(const char *zone_name, int lockfd)
7336 {
7337 	/*
7338 	 * If we are cleaning up from a failed attempt to lock the zone for
7339 	 * the first time, we might have a zone_lock_cnt of 0.  In that
7340 	 * error case, we don't want to do anything but close the lock
7341 	 * file.
7342 	 */
7343 	assert(zone_lock_cnt >= 0);
7344 	if (zone_lock_cnt > 0) {
7345 		assert(getenv(LOCK_ENV_VAR) != NULL);
7346 		assert(atoi(getenv(LOCK_ENV_VAR)) == 1);
7347 		if (--zone_lock_cnt > 0) {
7348 			assert(lockfd == -1);
7349 			return;
7350 		}
7351 		if (putenv(zoneadm_lock_not_held) != 0) {
7352 			zerror(zone_name, gettext("could not set env: %s"),
7353 			    strerror(errno));
7354 			exit(1);
7355 		}
7356 	}
7357 	assert(lockfd >= 0);
7358 	(void) close(lockfd);
7359 }
7360 
7361 int
7362 zonecfg_grab_lock_file(const char *zone_name, int *lockfd)
7363 {
7364 	char pathbuf[PATH_MAX];
7365 	struct flock flock;
7366 
7367 	/*
7368 	 * If we already have the lock, we can skip this expensive song
7369 	 * and dance.
7370 	 */
7371 	assert(zone_lock_cnt >= 0);
7372 	assert(getenv(LOCK_ENV_VAR) != NULL);
7373 	if (zone_lock_cnt > 0) {
7374 		assert(atoi(getenv(LOCK_ENV_VAR)) == 1);
7375 		zone_lock_cnt++;
7376 		*lockfd = -1;
7377 		return (Z_OK);
7378 	}
7379 	assert(getenv(LOCK_ENV_VAR) != NULL);
7380 	assert(atoi(getenv(LOCK_ENV_VAR)) == 0);
7381 
7382 	if (snprintf(pathbuf, sizeof (pathbuf), "%s%s", zonecfg_get_root(),
7383 	    ZONES_TMPDIR) >= sizeof (pathbuf)) {
7384 		zerror(zone_name, gettext("alternate root path is too long"));
7385 		return (-1);
7386 	}
7387 	if (mkdir(pathbuf, S_IRWXU) < 0 && errno != EEXIST) {
7388 		zerror(zone_name, gettext("could not mkdir %s: %s"), pathbuf,
7389 		    strerror(errno));
7390 		return (-1);
7391 	}
7392 	(void) chmod(pathbuf, S_IRWXU);
7393 
7394 	/*
7395 	 * One of these lock files is created for each zone (when needed).
7396 	 * The lock files are not cleaned up (except on system reboot),
7397 	 * but since there is only one per zone, there is no resource
7398 	 * starvation issue.
7399 	 */
7400 	if (snprintf(pathbuf, sizeof (pathbuf), "%s%s/%s.zoneadm.lock",
7401 	    zonecfg_get_root(), ZONES_TMPDIR, zone_name) >= sizeof (pathbuf)) {
7402 		zerror(zone_name, gettext("alternate root path is too long"));
7403 		return (-1);
7404 	}
7405 	if ((*lockfd = open(pathbuf, O_RDWR|O_CREAT, S_IRUSR|S_IWUSR)) < 0) {
7406 		zerror(zone_name, gettext("could not open %s: %s"), pathbuf,
7407 		    strerror(errno));
7408 		return (-1);
7409 	}
7410 	/*
7411 	 * Lock the file to synchronize with other zoneadmds
7412 	 */
7413 	flock.l_type = F_WRLCK;
7414 	flock.l_whence = SEEK_SET;
7415 	flock.l_start = (off_t)0;
7416 	flock.l_len = (off_t)0;
7417 	if ((fcntl(*lockfd, F_SETLKW, &flock) < 0) ||
7418 	    (putenv(zoneadm_lock_held) != 0)) {
7419 		zerror(zone_name, gettext("unable to lock %s: %s"), pathbuf,
7420 		    strerror(errno));
7421 		zonecfg_release_lock_file(zone_name, *lockfd);
7422 		return (-1);
7423 	}
7424 	zone_lock_cnt = 1;
7425 	return (Z_OK);
7426 }
7427 
7428 boolean_t
7429 zonecfg_lock_file_held(int *lockfd)
7430 {
7431 	if (*lockfd >= 0 || zone_lock_cnt > 0)
7432 		return (B_TRUE);
7433 	return (B_FALSE);
7434 }
7435 
7436 static boolean_t
7437 get_doorname(const char *zone_name, char *buffer)
7438 {
7439 	return (snprintf(buffer, PATH_MAX, "%s" ZONE_DOOR_PATH,
7440 	    zonecfg_get_root(), zone_name) < PATH_MAX);
7441 }
7442 
7443 /*
7444  * system daemons are not audited.  For the global zone, this occurs
7445  * "naturally" since init is started with the default audit
7446  * characteristics.  Since zoneadmd is a system daemon and it starts
7447  * init for a zone, it is necessary to clear out the audit
7448  * characteristics inherited from whomever started zoneadmd.  This is
7449  * indicated by the audit id, which is set from the ruid parameter of
7450  * adt_set_user(), below.
7451  */
7452 
7453 static void
7454 prepare_audit_context(const char *zone_name)
7455 {
7456 	adt_session_data_t	*ah;
7457 	char			*failure = gettext("audit failure: %s");
7458 
7459 	if (adt_start_session(&ah, NULL, 0)) {
7460 		zerror(zone_name, failure, strerror(errno));
7461 		return;
7462 	}
7463 	if (adt_set_user(ah, ADT_NO_AUDIT, ADT_NO_AUDIT,
7464 	    ADT_NO_AUDIT, ADT_NO_AUDIT, NULL, ADT_NEW)) {
7465 		zerror(zone_name, failure, strerror(errno));
7466 		(void) adt_end_session(ah);
7467 		return;
7468 	}
7469 	if (adt_set_proc(ah))
7470 		zerror(zone_name, failure, strerror(errno));
7471 
7472 	(void) adt_end_session(ah);
7473 }
7474 
7475 static int
7476 start_zoneadmd(const char *zone_name, boolean_t lock)
7477 {
7478 	char doorpath[PATH_MAX];
7479 	pid_t child_pid;
7480 	int error = -1;
7481 	int doorfd, lockfd;
7482 	struct door_info info;
7483 
7484 	if (!get_doorname(zone_name, doorpath))
7485 		return (-1);
7486 
7487 	if (lock)
7488 		if (zonecfg_grab_lock_file(zone_name, &lockfd) != Z_OK)
7489 			return (-1);
7490 
7491 	/*
7492 	 * Now that we have the lock, re-confirm that the daemon is
7493 	 * *not* up and working fine.  If it is still down, we have a green
7494 	 * light to start it.
7495 	 */
7496 	if ((doorfd = open(doorpath, O_RDONLY)) < 0) {
7497 		if (errno != ENOENT) {
7498 			zperror(doorpath);
7499 			goto out;
7500 		}
7501 	} else {
7502 		if (door_info(doorfd, &info) == 0 &&
7503 		    ((info.di_attributes & DOOR_REVOKED) == 0)) {
7504 			error = Z_OK;
7505 			(void) close(doorfd);
7506 			goto out;
7507 		}
7508 		(void) close(doorfd);
7509 	}
7510 
7511 	if ((child_pid = fork()) == -1) {
7512 		zperror(gettext("could not fork"));
7513 		goto out;
7514 	}
7515 
7516 	if (child_pid == 0) {
7517 		const char *argv[6], **ap;
7518 
7519 		/* child process */
7520 		prepare_audit_context(zone_name);
7521 
7522 		ap = argv;
7523 		*ap++ = "zoneadmd";
7524 		*ap++ = "-z";
7525 		*ap++ = zone_name;
7526 		if (zonecfg_in_alt_root()) {
7527 			*ap++ = "-R";
7528 			*ap++ = zonecfg_get_root();
7529 		}
7530 		*ap = NULL;
7531 
7532 		(void) execv("/usr/lib/zones/zoneadmd", (char * const *)argv);
7533 		/*
7534 		 * TRANSLATION_NOTE
7535 		 * zoneadmd is a literal that should not be translated.
7536 		 */
7537 		zperror(gettext("could not exec zoneadmd"));
7538 		_exit(1);
7539 	} else {
7540 		/* parent process */
7541 		pid_t retval;
7542 		int pstatus = 0;
7543 
7544 		do {
7545 			retval = waitpid(child_pid, &pstatus, 0);
7546 		} while (retval != child_pid);
7547 		if (WIFSIGNALED(pstatus) || (WIFEXITED(pstatus) &&
7548 		    WEXITSTATUS(pstatus) != 0)) {
7549 			zerror(zone_name, gettext("could not start %s"),
7550 			    "zoneadmd");
7551 			goto out;
7552 		}
7553 	}
7554 	error = Z_OK;
7555 out:
7556 	if (lock)
7557 		zonecfg_release_lock_file(zone_name, lockfd);
7558 	return (error);
7559 }
7560 
7561 int
7562 zonecfg_ping_zoneadmd(const char *zone_name)
7563 {
7564 	char doorpath[PATH_MAX];
7565 	int doorfd;
7566 	struct door_info info;
7567 
7568 	if (!get_doorname(zone_name, doorpath))
7569 		return (-1);
7570 
7571 	if ((doorfd = open(doorpath, O_RDONLY)) < 0) {
7572 		return (-1);
7573 	}
7574 	if (door_info(doorfd, &info) == 0 &&
7575 	    ((info.di_attributes & DOOR_REVOKED) == 0)) {
7576 		(void) close(doorfd);
7577 		return (Z_OK);
7578 	}
7579 	(void) close(doorfd);
7580 	return (-1);
7581 }
7582 
7583 int
7584 zonecfg_call_zoneadmd(const char *zone_name, zone_cmd_arg_t *arg, char *locale,
7585     boolean_t lock)
7586 {
7587 	char doorpath[PATH_MAX];
7588 	int doorfd, result;
7589 	door_arg_t darg;
7590 
7591 	zoneid_t zoneid;
7592 	uint64_t uniqid = 0;
7593 
7594 	zone_cmd_rval_t *rvalp;
7595 	size_t rlen;
7596 	char *cp, *errbuf;
7597 
7598 	rlen = getpagesize();
7599 	if ((rvalp = malloc(rlen)) == NULL) {
7600 		zerror(zone_name, gettext("failed to allocate %lu bytes: %s"),
7601 		    rlen, strerror(errno));
7602 		return (-1);
7603 	}
7604 
7605 	if ((zoneid = getzoneidbyname(zone_name)) != ZONE_ID_UNDEFINED) {
7606 		(void) zone_getattr(zoneid, ZONE_ATTR_UNIQID, &uniqid,
7607 		    sizeof (uniqid));
7608 	}
7609 	arg->uniqid = uniqid;
7610 	(void) strlcpy(arg->locale, locale, sizeof (arg->locale));
7611 	if (!get_doorname(zone_name, doorpath)) {
7612 		zerror(zone_name, gettext("alternate root path is too long"));
7613 		free(rvalp);
7614 		return (-1);
7615 	}
7616 
7617 	/*
7618 	 * Loop trying to start zoneadmd; if something goes seriously
7619 	 * wrong we break out and fail.
7620 	 */
7621 	for (;;) {
7622 		if (start_zoneadmd(zone_name, lock) != Z_OK)
7623 			break;
7624 
7625 		if ((doorfd = open(doorpath, O_RDONLY)) < 0) {
7626 			zperror(gettext("failed to open zone door"));
7627 			break;
7628 		}
7629 
7630 		darg.data_ptr = (char *)arg;
7631 		darg.data_size = sizeof (*arg);
7632 		darg.desc_ptr = NULL;
7633 		darg.desc_num = 0;
7634 		darg.rbuf = (char *)rvalp;
7635 		darg.rsize = rlen;
7636 		if (door_call(doorfd, &darg) != 0) {
7637 			(void) close(doorfd);
7638 			/*
7639 			 * We'll get EBADF if the door has been revoked.
7640 			 */
7641 			if (errno != EBADF) {
7642 				zperror(gettext("door_call failed"));
7643 				break;
7644 			}
7645 			continue;	/* take another lap */
7646 		}
7647 		(void) close(doorfd);
7648 
7649 		if (darg.data_size == 0) {
7650 			/* Door server is going away; kick it again. */
7651 			continue;
7652 		}
7653 
7654 		errbuf = rvalp->errbuf;
7655 		while (*errbuf != '\0') {
7656 			/*
7657 			 * Remove any newlines since zerror()
7658 			 * will append one automatically.
7659 			 */
7660 			cp = strchr(errbuf, '\n');
7661 			if (cp != NULL)
7662 				*cp = '\0';
7663 			zerror(zone_name, "%s", errbuf);
7664 			if (cp == NULL)
7665 				break;
7666 			errbuf = cp + 1;
7667 		}
7668 		result = rvalp->rval == 0 ? 0 : -1;
7669 		free(rvalp);
7670 		return (result);
7671 	}
7672 
7673 	free(rvalp);
7674 	return (-1);
7675 }
7676 
7677 boolean_t
7678 zonecfg_valid_auths(const char *auths, const char *zonename)
7679 {
7680 	char *right;
7681 	char *tmpauths;
7682 	char *lasts;
7683 	char authname[MAXAUTHS];
7684 	boolean_t status = B_TRUE;
7685 
7686 	tmpauths = strdup(auths);
7687 	if (tmpauths == NULL) {
7688 		zerror(zonename, gettext("Out of memory"));
7689 		return (B_FALSE);
7690 	}
7691 	right = strtok_r(tmpauths, ",", &lasts);
7692 	while (right != NULL) {
7693 		(void) snprintf(authname, MAXAUTHS, "%s%s",
7694 		    ZONE_AUTH_PREFIX, right);
7695 		if (getauthnam(authname) == NULL) {
7696 			status = B_FALSE;
7697 			zerror(zonename,
7698 			    gettext("'%s' is not a valid authorization"),
7699 			    right);
7700 		}
7701 		right = strtok_r(NULL, ",", &lasts);
7702 	}
7703 	free(tmpauths);
7704 	return (status);
7705 }
7706 
7707 int
7708 zonecfg_delete_admins(zone_dochandle_t handle, char *zonename)
7709 {
7710 	int err;
7711 	struct zone_admintab admintab;
7712 	boolean_t changed = B_FALSE;
7713 
7714 	if ((err = zonecfg_setadminent(handle)) != Z_OK) {
7715 		return (err);
7716 	}
7717 	while (zonecfg_getadminent(handle, &admintab) == Z_OK) {
7718 		err = zonecfg_delete_admin(handle, &admintab,
7719 		    zonename);
7720 		if (err != Z_OK) {
7721 			(void) zonecfg_endadminent(handle);
7722 			return (err);
7723 		} else {
7724 			changed = B_TRUE;
7725 		}
7726 		if ((err = zonecfg_setadminent(handle)) != Z_OK) {
7727 			return (err);
7728 		}
7729 	}
7730 	(void) zonecfg_endadminent(handle);
7731 	return (changed? Z_OK:Z_NO_ENTRY);
7732 }
7733 
7734 /*
7735  * Checks if a long authorization applies to this zone.
7736  * If so, it returns true, after destructively stripping
7737  * the authorization of its prefix and zone suffix.
7738  */
7739 static boolean_t
7740 is_zone_auth(char **auth, char *zonename, char *oldzonename)
7741 {
7742 	char *suffix;
7743 	size_t offset;
7744 
7745 	offset = strlen(ZONE_AUTH_PREFIX);
7746 	if ((strncmp(*auth, ZONE_AUTH_PREFIX, offset) == 0) &&
7747 	    ((suffix = strchr(*auth, '/')) != NULL)) {
7748 		if (strcmp(suffix + 1, zonename) == 0) {
7749 			*auth += offset;
7750 			suffix[0] = '\0';
7751 			return (B_TRUE);
7752 		} else if ((oldzonename != NULL) &&
7753 		    (strcmp(suffix + 1, oldzonename) == 0)) {
7754 			*auth += offset;
7755 			suffix[0] = '\0';
7756 			return (B_TRUE);
7757 		}
7758 	}
7759 	return (B_FALSE);
7760 }
7761 
7762 /*
7763  * This function determines whether the zone-specific authorization
7764  * assignments in /etc/user_attr have been changed more recently
7765  * than the equivalent data stored in the zone's configuration file.
7766  * This should only happen if the zone-specific authorizations in
7767  * the user_attr file were modified using a tool other than zonecfg.
7768  * If the configuration file is out-of-date with respect to these
7769  * authorization assignments, it is updated to match those specified
7770  * in /etc/user_attr.
7771  */
7772 
7773 int
7774 zonecfg_update_userauths(zone_dochandle_t handle, char *zonename)
7775 {
7776 	userattr_t *ua_ptr;
7777 	char *authlist;
7778 	char *lasts;
7779 	FILE  *uaf;
7780 	struct zone_admintab admintab;
7781 	struct stat config_st, ua_st;
7782 	char config_file[MAXPATHLEN];
7783 	boolean_t changed = B_FALSE;
7784 	int err;
7785 
7786 	if ((uaf = fopen(USERATTR_FILENAME, "r")) == NULL) {
7787 		zerror(zonename, gettext("could not open file %s: %s"),
7788 		    USERATTR_FILENAME, strerror(errno));
7789 		if (errno == EACCES)
7790 			return (Z_ACCES);
7791 		if (errno == ENOENT)
7792 			return (Z_NO_ZONE);
7793 		return (Z_MISC_FS);
7794 	}
7795 	if ((err = fstat(fileno(uaf), &ua_st)) != 0) {
7796 		zerror(zonename, gettext("could not stat file %s: %s"),
7797 		    USERATTR_FILENAME, strerror(errno));
7798 		(void) fclose(uaf);
7799 		return (Z_MISC_FS);
7800 	}
7801 	if (!config_file_path(zonename, config_file)) {
7802 		(void) fclose(uaf);
7803 		return (Z_MISC_FS);
7804 	}
7805 
7806 	if ((err = stat(config_file, &config_st)) != 0) {
7807 		zerror(zonename, gettext("could not stat file %s: %s"),
7808 		    config_file, strerror(errno));
7809 		(void) fclose(uaf);
7810 		return (Z_MISC_FS);
7811 	}
7812 	if (config_st.st_mtime >= ua_st.st_mtime) {
7813 		(void) fclose(uaf);
7814 		return (Z_NO_ENTRY);
7815 	}
7816 	if ((err = zonecfg_delete_admins(handle, zonename)) == Z_OK) {
7817 		changed = B_TRUE;
7818 	} else if (err != Z_NO_ENTRY) {
7819 		(void) fclose(uaf);
7820 		return (err);
7821 	}
7822 	while ((ua_ptr = fgetuserattr(uaf)) != NULL) {
7823 		if (ua_ptr->name[0] == '#') {
7824 			continue;
7825 		}
7826 		authlist = kva_match(ua_ptr->attr, USERATTR_AUTHS_KW);
7827 		if (authlist != NULL) {
7828 			char *cur_auth;
7829 			boolean_t first;
7830 
7831 			first = B_TRUE;
7832 			bzero(&admintab.zone_admin_auths, MAXAUTHS);
7833 			cur_auth = strtok_r(authlist, ",", &lasts);
7834 			while (cur_auth != NULL) {
7835 				if (is_zone_auth(&cur_auth, zonename,
7836 				    NULL)) {
7837 					/*
7838 					 * Add auths for this zone
7839 					 */
7840 					if (first) {
7841 						first = B_FALSE;
7842 					} else {
7843 						(void) strlcat(
7844 						    admintab.zone_admin_auths,
7845 						    ",", MAXAUTHS);
7846 					}
7847 					(void) strlcat(
7848 					    admintab.zone_admin_auths,
7849 					    cur_auth, MAXAUTHS);
7850 				}
7851 				cur_auth = strtok_r(NULL, ",", &lasts);
7852 			}
7853 			if (!first) {
7854 				/*
7855 				 * Add this right to config file
7856 				 */
7857 				(void) strlcpy(admintab.zone_admin_user,
7858 				    ua_ptr->name,
7859 				    sizeof (admintab.zone_admin_user));
7860 				err = zonecfg_add_admin(handle,
7861 				    &admintab, zonename);
7862 				if (err != Z_OK) {
7863 					(void) fclose(uaf);
7864 					return (err);
7865 				} else {
7866 					changed = B_TRUE;
7867 				}
7868 			}
7869 		}
7870 	} /* end-of-while-loop */
7871 	(void) fclose(uaf);
7872 	return (changed? Z_OK: Z_NO_ENTRY);
7873 }
7874 
7875 static void
7876 update_profiles(char *rbac_profs, boolean_t add)
7877 {
7878 	char new_profs[MAXPROFS];
7879 	char *cur_prof;
7880 	boolean_t first = B_TRUE;
7881 	boolean_t found = B_FALSE;
7882 	char *lasts;
7883 
7884 	cur_prof = strtok_r(rbac_profs, ",", &lasts);
7885 	while (cur_prof != NULL) {
7886 		if (strcmp(cur_prof, ZONE_MGMT_PROF) == 0) {
7887 			found = B_TRUE;
7888 			if (!add) {
7889 				cur_prof = strtok_r(NULL, ",", &lasts);
7890 				continue;
7891 			}
7892 		}
7893 		if (first) {
7894 			first = B_FALSE;
7895 		} else {
7896 			(void) strlcat(new_profs, ",",
7897 			    MAXPROFS);
7898 		}
7899 		(void) strlcat(new_profs, cur_prof,
7900 		    MAXPROFS);
7901 		cur_prof = strtok_r(NULL, ",", &lasts);
7902 	}
7903 	/*
7904 	 * Now prepend the Zone Management profile at the beginning
7905 	 * of the list if it is needed, and append the rest.
7906 	 * Return the updated list in the original buffer.
7907 	 */
7908 	if (add && !found) {
7909 		first = B_FALSE;
7910 		(void) strlcpy(rbac_profs, ZONE_MGMT_PROF, MAXPROFS);
7911 	} else {
7912 		first = B_TRUE;
7913 		rbac_profs[0] = '\0';
7914 	}
7915 	if (strlen(new_profs) > 0) {
7916 		if (!first)
7917 			(void) strlcat(rbac_profs, ",", MAXPROFS);
7918 		(void) strlcat(rbac_profs, new_profs, MAXPROFS);
7919 	}
7920 }
7921 
7922 #define	MAX_CMD_LEN	1024
7923 
7924 static int
7925 do_subproc(char *zonename, char *cmdbuf)
7926 {
7927 	char inbuf[MAX_CMD_LEN];
7928 	FILE *file;
7929 	int status;
7930 
7931 	file = popen(cmdbuf, "r");
7932 	if (file == NULL) {
7933 		zerror(zonename, gettext("Could not launch: %s"), cmdbuf);
7934 		return (-1);
7935 	}
7936 
7937 	while (fgets(inbuf, sizeof (inbuf), file) != NULL)
7938 		(void) fprintf(stderr, "%s", inbuf);
7939 	status = pclose(file);
7940 
7941 	if (WIFSIGNALED(status)) {
7942 		zerror(zonename, gettext("%s unexpectedly terminated "
7943 		    "due to signal %d"),
7944 		    cmdbuf, WTERMSIG(status));
7945 		return (-1);
7946 	}
7947 	assert(WIFEXITED(status));
7948 	return (WEXITSTATUS(status));
7949 }
7950 
7951 /*
7952  * This function updates the local /etc/user_attr file to
7953  * correspond to the admin settings that are currently being
7954  * committed. The updates are done via usermod and/or rolemod
7955  * depending on the type of the specified user. It is also
7956  * invoked to remove entries from user_attr corresponding to
7957  * removed admin assignments, using an empty auths string.
7958  *
7959  * Because the removed entries are no longer included in the
7960  * cofiguration that is being committed, a linked list of
7961  * removed admin entries is maintained to keep track of such
7962  * transactions. The head of the list is stored in the zone_dh_userauths
7963  * element of the handle strcture.
7964  */
7965 static int
7966 zonecfg_authorize_user_impl(zone_dochandle_t handle, char *user,
7967     char *auths, char *zonename)
7968 {
7969 	char *right;
7970 	char old_auths[MAXAUTHS];
7971 	char new_auths[MAXAUTHS];
7972 	char rbac_profs[MAXPROFS];
7973 	char *lasts;
7974 	userattr_t *u;
7975 	boolean_t first = B_TRUE;
7976 	boolean_t is_zone_admin = B_FALSE;
7977 	char user_cmd[] = "/usr/sbin/usermod";
7978 	char role_cmd[] = "/usr/sbin/rolemod";
7979 	char *auths_cmd = user_cmd;	/* either usermod or rolemod */
7980 	char *new_auth_start;		/* string containing the new auths */
7981 	int new_auth_cnt = 0;		/* delta of changed authorizations */
7982 
7983 	/*
7984 	 * First get the existing authorizations for this user
7985 	 */
7986 
7987 	bzero(&old_auths, sizeof (old_auths));
7988 	bzero(&new_auths, sizeof (new_auths));
7989 	bzero(&rbac_profs, sizeof (rbac_profs));
7990 	if ((u = getusernam(user)) != NULL) {
7991 		char *current_auths;
7992 		char *current_profs;
7993 		char *type;
7994 
7995 		type = kva_match(u->attr, USERATTR_TYPE_KW);
7996 		if (type != NULL) {
7997 			if (strcmp(type, USERATTR_TYPE_NONADMIN_KW) == 0)
7998 				auths_cmd = role_cmd;
7999 		}
8000 
8001 		current_auths = kva_match(u->attr, USERATTR_AUTHS_KW);
8002 		if (current_auths != NULL) {
8003 			char *cur_auth;
8004 			char *delete_name;
8005 			size_t offset;
8006 
8007 			offset = strlen(ZONE_AUTH_PREFIX);
8008 
8009 			(void) strlcpy(old_auths, current_auths, MAXAUTHS);
8010 			cur_auth = strtok_r(current_auths, ",", &lasts);
8011 
8012 			/*
8013 			 * Next, remove any existing authorizations
8014 			 * for this zone, and determine if the
8015 			 * user still needs the Zone Management Profile.
8016 			 */
8017 			if (is_renaming(handle))
8018 				delete_name = handle->zone_dh_delete_name;
8019 			else
8020 				delete_name = NULL;
8021 			while (cur_auth != NULL) {
8022 				if (!is_zone_auth(&cur_auth, zonename,
8023 				    delete_name)) {
8024 					if (first) {
8025 						first = B_FALSE;
8026 					} else {
8027 						(void) strlcat(new_auths, ",",
8028 						    MAXAUTHS);
8029 					}
8030 					(void) strlcat(new_auths, cur_auth,
8031 					    MAXAUTHS);
8032 					/*
8033 					 * If the user has authorizations
8034 					 * for other zones, then set a
8035 					 * flag indicate that the Zone
8036 					 * Management profile should be
8037 					 * preserved in user_attr.
8038 					 */
8039 					if (strncmp(cur_auth,
8040 					    ZONE_AUTH_PREFIX, offset) == 0)
8041 						is_zone_admin = B_TRUE;
8042 				} else {
8043 					new_auth_cnt++;
8044 				}
8045 				cur_auth = strtok_r(NULL, ",", &lasts);
8046 			}
8047 		}
8048 		current_profs = kva_match(u->attr, USERATTR_PROFILES_KW);
8049 		if (current_profs != NULL) {
8050 			(void) strlcpy(rbac_profs, current_profs, MAXPROFS);
8051 		}
8052 		free_userattr(u);
8053 	}
8054 	/*
8055 	 * The following is done to avoid revisiting the
8056 	 * user_attr entry for this user
8057 	 */
8058 	(void) zonecfg_remove_userauths(handle, user, "", B_FALSE);
8059 
8060 	/*
8061 	 * Convert each right into a properly formatted authorization
8062 	 */
8063 	new_auth_start = new_auths + strlen(new_auths);
8064 	if (!first)
8065 		new_auth_start++;
8066 	right = strtok_r(auths, ",", &lasts);
8067 	while (right != NULL) {
8068 		char auth[MAXAUTHS];
8069 
8070 		(void) snprintf(auth, MAXAUTHS, "%s%s/%s",
8071 		    ZONE_AUTH_PREFIX, right, zonename);
8072 		if (first) {
8073 			first = B_FALSE;
8074 		} else {
8075 			(void) strlcat(new_auths, ",", MAXAUTHS);
8076 		}
8077 		(void) strlcat(new_auths, auth, MAXAUTHS);
8078 		is_zone_admin = B_TRUE;
8079 		new_auth_cnt--;
8080 		right = strtok_r(NULL, ",", &lasts);
8081 	}
8082 
8083 	/*
8084 	 * Need to update the authorizations in user_attr unless
8085 	 * the number of old and new authorizations is unchanged
8086 	 * and the new auths are a substrings of the old auths.
8087 	 *
8088 	 * If the user's previous authorizations have changed
8089 	 * execute the usermod progam to update them in user_attr.
8090 	 */
8091 	if ((new_auth_cnt != 0) ||
8092 	    (strstr(old_auths, new_auth_start) == NULL)) {
8093 		char    *cmdbuf;
8094 		size_t  cmd_len;
8095 
8096 		update_profiles(rbac_profs, is_zone_admin);
8097 		cmd_len = snprintf(NULL, 0, "%s -A \"%s\" -P \"%s\" %s",
8098 		    auths_cmd, new_auths, rbac_profs, user) + 1;
8099 		if ((cmdbuf = malloc(cmd_len)) == NULL) {
8100 			return (Z_NOMEM);
8101 		}
8102 		(void) snprintf(cmdbuf, cmd_len, "%s -A \"%s\" -P \"%s\" %s",
8103 		    auths_cmd, new_auths, rbac_profs, user);
8104 		if (do_subproc(zonename, cmdbuf) != 0) {
8105 			free(cmdbuf);
8106 			return (Z_SYSTEM);
8107 		}
8108 		free(cmdbuf);
8109 	}
8110 
8111 	return (Z_OK);
8112 }
8113 
8114 int
8115 zonecfg_authorize_users(zone_dochandle_t handle, char *zonename)
8116 {
8117 	xmlNodePtr cur;
8118 	int err;
8119 	char user[MAXUSERNAME];
8120 	char auths[MAXAUTHS];
8121 
8122 	if ((err = operation_prep(handle)) != Z_OK)
8123 		return (err);
8124 
8125 	cur = handle->zone_dh_cur;
8126 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
8127 		if (xmlStrcmp(cur->name, DTD_ELEM_ADMIN))
8128 			continue;
8129 		if (fetchprop(cur, DTD_ATTR_USER, user,
8130 		    sizeof (user)) != Z_OK)
8131 			continue;
8132 		if (fetchprop(cur, DTD_ATTR_AUTHS, auths,
8133 		    sizeof (auths)) != Z_OK)
8134 			continue;
8135 		if (zonecfg_authorize_user_impl(handle, user, auths, zonename)
8136 		    != Z_OK)
8137 			return (Z_SYSTEM);
8138 	}
8139 	(void) zonecfg_remove_userauths(handle, "", "", B_TRUE);
8140 
8141 	return (Z_OK);
8142 }
8143 
8144 int
8145 zonecfg_deauthorize_user(zone_dochandle_t handle, char *user, char *zonename)
8146 {
8147 	return (zonecfg_authorize_user_impl(handle, user, "", zonename));
8148 }
8149 
8150 int
8151 zonecfg_deauthorize_users(zone_dochandle_t handle, char *zonename)
8152 {
8153 	xmlNodePtr cur;
8154 	int err;
8155 	char user[MAXUSERNAME];
8156 
8157 	if ((err = operation_prep(handle)) != Z_OK)
8158 		return (err);
8159 
8160 	cur = handle->zone_dh_cur;
8161 	for (cur = cur->xmlChildrenNode; cur != NULL; cur = cur->next) {
8162 		if (xmlStrcmp(cur->name, DTD_ELEM_ADMIN))
8163 			continue;
8164 		if (fetchprop(cur, DTD_ATTR_USER, user,
8165 		    sizeof (user)) != Z_OK)
8166 			continue;
8167 		if ((err = zonecfg_deauthorize_user(handle, user,
8168 		    zonename)) != Z_OK)
8169 			return (err);
8170 	}
8171 	return (Z_OK);
8172 }
8173 
8174 int
8175 zonecfg_insert_userauths(zone_dochandle_t handle, char *user, char *zonename)
8176 {
8177 	zone_userauths_t *new, **prev, *next;
8178 
8179 	prev = &handle->zone_dh_userauths;
8180 	next = *prev;
8181 	while (next) {
8182 		if ((strncmp(next->user, user, MAXUSERNAME) == 0) &&
8183 		    (strncmp(next->zonename, zonename,
8184 		    ZONENAME_MAX) == 0)) {
8185 			/*
8186 			 * user is already in list
8187 			 * which isn't supposed to happen!
8188 			 */
8189 			return (Z_OK);
8190 		}
8191 		prev = &next->next;
8192 		next = *prev;
8193 	}
8194 	new = (zone_userauths_t *)malloc(sizeof (zone_userauths_t));
8195 	if (new == NULL)
8196 		return (Z_NOMEM);
8197 
8198 	(void) strlcpy(new->user, user, sizeof (new->user));
8199 	(void) strlcpy(new->zonename, zonename, sizeof (new->zonename));
8200 	new->next = NULL;
8201 	*prev = new;
8202 	return (Z_OK);
8203 }
8204 
8205 int
8206 zonecfg_remove_userauths(zone_dochandle_t handle, char *user, char *zonename,
8207 	boolean_t deauthorize)
8208 {
8209 	zone_userauths_t *new, **prev, *next;
8210 
8211 	prev = &handle->zone_dh_userauths;
8212 	next = *prev;
8213 
8214 	while (next) {
8215 		if ((strlen(user) == 0 ||
8216 		    strncmp(next->user, user, MAXUSERNAME) == 0) &&
8217 		    (strlen(zonename) == 0 ||
8218 		    (strncmp(next->zonename, zonename, ZONENAME_MAX) == 0))) {
8219 			new = next;
8220 			*prev = next->next;
8221 			next =  *prev;
8222 			if (deauthorize)
8223 				(void) zonecfg_deauthorize_user(handle,
8224 				    new->user, new->zonename);
8225 			free(new);
8226 			continue;
8227 		}
8228 		prev = &next->next;
8229 		next = *prev;
8230 	}
8231 	return (Z_OK);
8232 }
8233