1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Copyright 2018, Joyent Inc.
  25  * Copyright (c) 2015, 2016 by Delphix. All rights reserved.
  26  * Copyright 2019 OmniOS Community Edition (OmniOSce) Association.
  27  * Copyright 2020 RackTop Systems Inc.
  28  */
  29 
  30 /*
  31  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  32  */
  33 
  34 /*
  35  * This module contains functions used to bring up and tear down the
  36  * Virtual Platform: [un]mounting file-systems, [un]plumbing network
  37  * interfaces, [un]configuring devices, establishing resource controls,
  38  * and creating/destroying the zone in the kernel.  These actions, on
  39  * the way up, ready the zone; on the way down, they halt the zone.
  40  * See the much longer block comment at the beginning of zoneadmd.c
  41  * for a bigger picture of how the whole program functions.
  42  *
  43  * This module also has primary responsibility for the layout of "scratch
  44  * zones."  These are mounted, but inactive, zones that are used during
  45  * operating system upgrade and potentially other administrative action.  The
  46  * scratch zone environment is similar to the miniroot environment.  The zone's
  47  * actual root is mounted read-write on /a, and the standard paths (/usr,
  48  * /sbin, /lib) all lead to read-only copies of the running system's binaries.
  49  * This allows the administrative tools to manipulate the zone using "-R /a"
  50  * without relying on any binaries in the zone itself.
  51  *
  52  * If the scratch zone is on an alternate root (Live Upgrade [LU] boot
  53  * environment), then we must resolve the lofs mounts used there to uncover
  54  * writable (unshared) resources.  Shared resources, though, are always
  55  * read-only.  In addition, if the "same" zone with a different root path is
  56  * currently running, then "/b" inside the zone points to the running zone's
  57  * root.  This allows LU to synchronize configuration files during the upgrade
  58  * process.
  59  *
  60  * To construct this environment, this module creates a tmpfs mount on
  61  * $ZONEPATH/lu.  Inside this scratch area, the miniroot-like environment as
  62  * described above is constructed on the fly.  The zone is then created using
  63  * $ZONEPATH/lu as the root.
  64  *
  65  * Note that scratch zones are inactive.  The zone's bits are not running and
  66  * likely cannot be run correctly until upgrade is done.  Init is not running
  67  * there, nor is SMF.  Because of this, the "mounted" state of a scratch zone
  68  * is not a part of the usual halt/ready/boot state machine.
  69  */
  70 
  71 #include <sys/param.h>
  72 #include <sys/mount.h>
  73 #include <sys/mntent.h>
  74 #include <sys/socket.h>
  75 #include <sys/utsname.h>
  76 #include <sys/types.h>
  77 #include <sys/stat.h>
  78 #include <sys/sockio.h>
  79 #include <sys/stropts.h>
  80 #include <sys/conf.h>
  81 #include <sys/systeminfo.h>
  82 #include <sys/secflags.h>
  83 #include <sys/vnic.h>
  84 
  85 #include <libdlpi.h>
  86 #include <libdllink.h>
  87 #include <libdlvlan.h>
  88 #include <libdlvnic.h>
  89 
  90 #include <inet/tcp.h>
  91 #include <arpa/inet.h>
  92 #include <netinet/in.h>
  93 #include <net/route.h>
  94 
  95 #include <stdio.h>
  96 #include <errno.h>
  97 #include <fcntl.h>
  98 #include <unistd.h>
  99 #include <rctl.h>
 100 #include <stdlib.h>
 101 #include <string.h>
 102 #include <strings.h>
 103 #include <wait.h>
 104 #include <limits.h>
 105 #include <libgen.h>
 106 #include <libzfs.h>
 107 #include <libdevinfo.h>
 108 #include <zone.h>
 109 #include <assert.h>
 110 #include <libcontract.h>
 111 #include <libcontract_priv.h>
 112 #include <uuid/uuid.h>
 113 
 114 #include <sys/mntio.h>
 115 #include <sys/mnttab.h>
 116 #include <sys/fs/autofs.h>        /* for _autofssys() */
 117 #include <sys/fs/lofs_info.h>
 118 #include <sys/fs/zfs.h>
 119 
 120 #include <pool.h>
 121 #include <sys/pool.h>
 122 #include <sys/priocntl.h>
 123 
 124 #include <libbrand.h>
 125 #include <sys/brand.h>
 126 #include <libzonecfg.h>
 127 #include <synch.h>
 128 
 129 #include "zoneadmd.h"
 130 #include <tsol/label.h>
 131 #include <libtsnet.h>
 132 #include <sys/priv.h>
 133 #include <libinetutil.h>
 134 
 135 #define V4_ADDR_LEN     32
 136 #define V6_ADDR_LEN     128
 137 
 138 #define RESOURCE_DEFAULT_OPTS \
 139         MNTOPT_RO "," MNTOPT_LOFS_NOSUB "," MNTOPT_NODEVICES
 140 
 141 #define DFSTYPES        "/etc/dfs/fstypes"
 142 #define MAXTNZLEN       2048
 143 
 144 /* Number of times to retry unmounting if it fails */
 145 #define UMOUNT_RETRIES  30
 146 
 147 #define ALT_MOUNT(mount_cmd)    ((mount_cmd) != Z_MNT_BOOT)
 148 
 149 /* a reasonable estimate for the number of lwps per process */
 150 #define LWPS_PER_PROCESS        10
 151 
 152 /* for routing socket */
 153 static int rts_seqno = 0;
 154 
 155 /* mangled zone name when mounting in an alternate root environment */
 156 static char kernzone[ZONENAME_MAX];
 157 
 158 /* array of cached mount entries for resolve_lofs */
 159 static struct mnttab *resolve_lofs_mnts, *resolve_lofs_mnt_max;
 160 
 161 /* for Trusted Extensions */
 162 static tsol_zcent_t *get_zone_label(zlog_t *, priv_set_t *);
 163 static int tsol_mounts(zlog_t *, char *, char *);
 164 static void tsol_unmounts(zlog_t *, char *);
 165 
 166 static m_label_t *zlabel = NULL;
 167 static m_label_t *zid_label = NULL;
 168 static priv_set_t *zprivs = NULL;
 169 
 170 static const char *DFLT_FS_ALLOWED = "hsfs,smbfs,nfs,nfs3,nfs4,nfsdyn";
 171 
 172 typedef struct zone_proj_rctl_map {
 173         char *zpr_zone_rctl;
 174         char *zpr_project_rctl;
 175 } zone_proj_rctl_map_t;
 176 
 177 static zone_proj_rctl_map_t zone_proj_rctl_map[] = {
 178         {"zone.max-msg-ids",    "project.max-msg-ids"},
 179         {"zone.max-sem-ids",    "project.max-sem-ids"},
 180         {"zone.max-shm-ids",    "project.max-shm-ids"},
 181         {"zone.max-shm-memory", "project.max-shm-memory"},
 182         {NULL,                  NULL}
 183 };
 184 
 185 /* from libsocket, not in any header file */
 186 extern int getnetmaskbyaddr(struct in_addr, struct in_addr *);
 187 
 188 /* from zoneadmd */
 189 extern char query_hook[];
 190 extern char post_statechg_hook[];
 191 
 192 /*
 193  * For each "net" resource configured in zonecfg, we track a zone_addr_list_t
 194  * node in a linked list that is sorted by linkid.  The list is constructed as
 195  * the xml configuration file is parsed, and the information
 196  * contained in each node is added to the kernel before the zone is
 197  * booted, to be retrieved and applied from within the exclusive-IP NGZ
 198  * on boot.
 199  */
 200 typedef struct zone_addr_list {
 201         struct zone_addr_list *za_next;
 202         datalink_id_t za_linkid;        /* datalink_id_t of interface */
 203         struct zone_nwiftab za_nwiftab; /* address, defrouter properties */
 204 } zone_addr_list_t;
 205 
 206 /*
 207  * An optimization for build_mnttable: reallocate (and potentially copy the
 208  * data) only once every N times through the loop.
 209  */
 210 #define MNTTAB_HUNK     32
 211 
 212 /* some handy macros */
 213 #define SIN(s)  ((struct sockaddr_in *)s)
 214 #define SIN6(s) ((struct sockaddr_in6 *)s)
 215 
 216 /*
 217  * Private autofs system call
 218  */
 219 extern int _autofssys(int, void *);
 220 
 221 static int
 222 autofs_cleanup(zoneid_t zoneid)
 223 {
 224         int r;
 225 
 226         /*
 227          * Ask autofs to unmount all trigger nodes in the given zone.
 228          * Handle ENOSYS in the case that the autofs kernel module is not
 229          * installed.
 230          */
 231         r = _autofssys(AUTOFS_UNMOUNTALL, (void *)((uintptr_t)zoneid));
 232         if (r != 0 && errno == ENOSYS) {
 233                 return (0);
 234         }
 235         return (r);
 236 }
 237 
 238 static void
 239 free_mnttable(struct mnttab *mnt_array, uint_t nelem)
 240 {
 241         uint_t i;
 242 
 243         if (mnt_array == NULL)
 244                 return;
 245         for (i = 0; i < nelem; i++) {
 246                 free(mnt_array[i].mnt_mountp);
 247                 free(mnt_array[i].mnt_fstype);
 248                 free(mnt_array[i].mnt_special);
 249                 free(mnt_array[i].mnt_mntopts);
 250                 assert(mnt_array[i].mnt_time == NULL);
 251         }
 252         free(mnt_array);
 253 }
 254 
 255 /*
 256  * Build the mount table for the zone rooted at "zroot", storing the resulting
 257  * array of struct mnttabs in "mnt_arrayp" and the number of elements in the
 258  * array in "nelemp".
 259  */
 260 static int
 261 build_mnttable(zlog_t *zlogp, const char *zroot, size_t zrootlen, FILE *mnttab,
 262     struct mnttab **mnt_arrayp, uint_t *nelemp)
 263 {
 264         struct mnttab mnt;
 265         struct mnttab *mnts;
 266         struct mnttab *mnp;
 267         uint_t nmnt;
 268 
 269         rewind(mnttab);
 270         resetmnttab(mnttab);
 271         nmnt = 0;
 272         mnts = NULL;
 273         while (getmntent(mnttab, &mnt) == 0) {
 274                 struct mnttab *tmp_array;
 275 
 276                 if (strncmp(mnt.mnt_mountp, zroot, zrootlen) != 0)
 277                         continue;
 278                 if (nmnt % MNTTAB_HUNK == 0) {
 279                         tmp_array = realloc(mnts,
 280                             (nmnt + MNTTAB_HUNK) * sizeof (*mnts));
 281                         if (tmp_array == NULL) {
 282                                 free_mnttable(mnts, nmnt);
 283                                 return (-1);
 284                         }
 285                         mnts = tmp_array;
 286                 }
 287                 mnp = &mnts[nmnt++];
 288 
 289                 /*
 290                  * Zero out any fields we're not using.
 291                  */
 292                 (void) memset(mnp, 0, sizeof (*mnp));
 293 
 294                 if (mnt.mnt_special != NULL)
 295                         mnp->mnt_special = strdup(mnt.mnt_special);
 296                 if (mnt.mnt_mntopts != NULL)
 297                         mnp->mnt_mntopts = strdup(mnt.mnt_mntopts);
 298                 mnp->mnt_mountp = strdup(mnt.mnt_mountp);
 299                 mnp->mnt_fstype = strdup(mnt.mnt_fstype);
 300                 if ((mnt.mnt_special != NULL && mnp->mnt_special == NULL) ||
 301                     (mnt.mnt_mntopts != NULL && mnp->mnt_mntopts == NULL) ||
 302                     mnp->mnt_mountp == NULL || mnp->mnt_fstype == NULL) {
 303                         zerror(zlogp, B_TRUE, "memory allocation failed");
 304                         free_mnttable(mnts, nmnt);
 305                         return (-1);
 306                 }
 307         }
 308         *mnt_arrayp = mnts;
 309         *nelemp = nmnt;
 310         return (0);
 311 }
 312 
 313 /*
 314  * This is an optimization.  The resolve_lofs function is used quite frequently
 315  * to manipulate file paths, and on a machine with a large number of zones,
 316  * there will be a huge number of mounted file systems.  Thus, we trigger a
 317  * reread of the list of mount points
 318  */
 319 static void
 320 lofs_discard_mnttab(void)
 321 {
 322         free_mnttable(resolve_lofs_mnts,
 323             resolve_lofs_mnt_max - resolve_lofs_mnts);
 324         resolve_lofs_mnts = resolve_lofs_mnt_max = NULL;
 325 }
 326 
 327 static int
 328 lofs_read_mnttab(zlog_t *zlogp)
 329 {
 330         FILE *mnttab;
 331         uint_t nmnts;
 332 
 333         if ((mnttab = fopen(MNTTAB, "r")) == NULL)
 334                 return (-1);
 335         if (build_mnttable(zlogp, "", 0, mnttab, &resolve_lofs_mnts,
 336             &nmnts) == -1) {
 337                 (void) fclose(mnttab);
 338                 return (-1);
 339         }
 340         (void) fclose(mnttab);
 341         resolve_lofs_mnt_max = resolve_lofs_mnts + nmnts;
 342         return (0);
 343 }
 344 
 345 /*
 346  * This function loops over potential loopback mounts and symlinks in a given
 347  * path and resolves them all down to an absolute path.
 348  */
 349 void
 350 resolve_lofs(zlog_t *zlogp, char *path, size_t pathlen)
 351 {
 352         int len, arlen;
 353         const char *altroot;
 354         char tmppath[MAXPATHLEN];
 355         boolean_t outside_altroot;
 356 
 357         if ((len = resolvepath(path, tmppath, sizeof (tmppath))) == -1)
 358                 return;
 359         tmppath[len] = '\0';
 360         (void) strlcpy(path, tmppath, sizeof (tmppath));
 361 
 362         /* This happens once per zoneadmd operation. */
 363         if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
 364                 return;
 365 
 366         altroot = zonecfg_get_root();
 367         arlen = strlen(altroot);
 368         outside_altroot = B_FALSE;
 369         for (;;) {
 370                 struct mnttab *mnp;
 371 
 372                 /* Search in reverse order to find longest match */
 373                 for (mnp = resolve_lofs_mnt_max - 1; mnp >= resolve_lofs_mnts;
 374                     mnp--) {
 375                         if (mnp->mnt_fstype == NULL ||
 376                             mnp->mnt_mountp == NULL ||
 377                             mnp->mnt_special == NULL)
 378                                 continue;
 379                         len = strlen(mnp->mnt_mountp);
 380                         if (strncmp(mnp->mnt_mountp, path, len) == 0 &&
 381                             (path[len] == '/' || path[len] == '\0'))
 382                                 break;
 383                 }
 384                 if (mnp < resolve_lofs_mnts)
 385                         break;
 386                 /* If it's not a lofs then we're done */
 387                 if (strcmp(mnp->mnt_fstype, MNTTYPE_LOFS) != 0)
 388                         break;
 389                 if (outside_altroot) {
 390                         char *cp;
 391                         int olen = sizeof (MNTOPT_RO) - 1;
 392 
 393                         /*
 394                          * If we run into a read-only mount outside of the
 395                          * alternate root environment, then the user doesn't
 396                          * want this path to be made read-write.
 397                          */
 398                         if (mnp->mnt_mntopts != NULL &&
 399                             (cp = strstr(mnp->mnt_mntopts, MNTOPT_RO)) !=
 400                             NULL &&
 401                             (cp == mnp->mnt_mntopts || cp[-1] == ',') &&
 402                             (cp[olen] == '\0' || cp[olen] == ',')) {
 403                                 break;
 404                         }
 405                 } else if (arlen > 0 &&
 406                     (strncmp(mnp->mnt_special, altroot, arlen) != 0 ||
 407                     (mnp->mnt_special[arlen] != '\0' &&
 408                     mnp->mnt_special[arlen] != '/'))) {
 409                         outside_altroot = B_TRUE;
 410                 }
 411                 /* use temporary buffer because new path might be longer */
 412                 (void) snprintf(tmppath, sizeof (tmppath), "%s%s",
 413                     mnp->mnt_special, path + len);
 414                 if ((len = resolvepath(tmppath, path, pathlen)) == -1)
 415                         break;
 416                 path[len] = '\0';
 417         }
 418 }
 419 
 420 /*
 421  * For a regular mount, check if a replacement lofs mount is needed because the
 422  * referenced device is already mounted somewhere.
 423  */
 424 static int
 425 check_lofs_needed(zlog_t *zlogp, struct zone_fstab *fsptr)
 426 {
 427         struct mnttab *mnp;
 428         zone_fsopt_t *optptr, *onext;
 429 
 430         /* This happens once per zoneadmd operation. */
 431         if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
 432                 return (-1);
 433 
 434         /*
 435          * If this special node isn't already in use, then it's ours alone;
 436          * no need to worry about conflicting mounts.
 437          */
 438         for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max;
 439             mnp++) {
 440                 if (strcmp(mnp->mnt_special, fsptr->zone_fs_special) == 0)
 441                         break;
 442         }
 443         if (mnp >= resolve_lofs_mnt_max)
 444                 return (0);
 445 
 446         /*
 447          * Convert this duplicate mount into a lofs mount.
 448          */
 449         (void) strlcpy(fsptr->zone_fs_special, mnp->mnt_mountp,
 450             sizeof (fsptr->zone_fs_special));
 451         (void) strlcpy(fsptr->zone_fs_type, MNTTYPE_LOFS,
 452             sizeof (fsptr->zone_fs_type));
 453         fsptr->zone_fs_raw[0] = '\0';
 454 
 455         /*
 456          * Discard all but one of the original options and set that to our
 457          * default set of options used for resources.
 458          */
 459         optptr = fsptr->zone_fs_options;
 460         if (optptr == NULL) {
 461                 optptr = malloc(sizeof (*optptr));
 462                 if (optptr == NULL) {
 463                         zerror(zlogp, B_TRUE, "cannot mount %s",
 464                             fsptr->zone_fs_dir);
 465                         return (-1);
 466                 }
 467         } else {
 468                 while ((onext = optptr->zone_fsopt_next) != NULL) {
 469                         optptr->zone_fsopt_next = onext->zone_fsopt_next;
 470                         free(onext);
 471                 }
 472         }
 473         (void) strcpy(optptr->zone_fsopt_opt, RESOURCE_DEFAULT_OPTS);
 474         optptr->zone_fsopt_next = NULL;
 475         fsptr->zone_fs_options = optptr;
 476         return (0);
 477 }
 478 
 479 int
 480 make_one_dir(zlog_t *zlogp, const char *prefix, const char *subdir, mode_t mode,
 481     uid_t userid, gid_t groupid)
 482 {
 483         char path[MAXPATHLEN];
 484         struct stat st;
 485 
 486         if (snprintf(path, sizeof (path), "%s%s", prefix, subdir) >
 487             sizeof (path)) {
 488                 zerror(zlogp, B_FALSE, "pathname %s%s is too long", prefix,
 489                     subdir);
 490                 return (-1);
 491         }
 492 
 493         if (lstat(path, &st) == 0) {
 494                 /*
 495                  * We don't check the file mode since presumably the zone
 496                  * administrator may have had good reason to change the mode,
 497                  * and we don't need to second guess them.
 498                  */
 499                 if (!S_ISDIR(st.st_mode)) {
 500                         if (S_ISREG(st.st_mode)) {
 501                                 /*
 502                                  * Allow readonly mounts of /etc/ files; this
 503                                  * is needed most by Trusted Extensions.
 504                                  */
 505                                 if (strncmp(subdir, "/etc/",
 506                                     strlen("/etc/")) != 0) {
 507                                         zerror(zlogp, B_FALSE,
 508                                             "%s is not in /etc", path);
 509                                         return (-1);
 510                                 }
 511                         } else {
 512                                 zerror(zlogp, B_FALSE,
 513                                     "%s is not a directory", path);
 514                                 return (-1);
 515                         }
 516                 }
 517                 return (0);
 518         }
 519 
 520         if (mkdirp(path, mode) != 0) {
 521                 if (errno == EROFS)
 522                         zerror(zlogp, B_FALSE, "Could not mkdir %s.\nIt is on "
 523                             "a read-only file system in this local zone.\nMake "
 524                             "sure %s exists in the global zone.", path, subdir);
 525                 else
 526                         zerror(zlogp, B_TRUE, "mkdirp of %s failed", path);
 527                 return (-1);
 528         }
 529 
 530         (void) chown(path, userid, groupid);
 531         return (0);
 532 }
 533 
 534 static void
 535 free_remote_fstypes(char **types)
 536 {
 537         uint_t i;
 538 
 539         if (types == NULL)
 540                 return;
 541         for (i = 0; types[i] != NULL; i++)
 542                 free(types[i]);
 543         free(types);
 544 }
 545 
 546 static char **
 547 get_remote_fstypes(zlog_t *zlogp)
 548 {
 549         char **types = NULL;
 550         FILE *fp;
 551         char buf[MAXPATHLEN];
 552         char fstype[MAXPATHLEN];
 553         uint_t lines = 0;
 554         uint_t i;
 555 
 556         if ((fp = fopen(DFSTYPES, "r")) == NULL) {
 557                 zerror(zlogp, B_TRUE, "failed to open %s", DFSTYPES);
 558                 return (NULL);
 559         }
 560         /*
 561          * Count the number of lines
 562          */
 563         while (fgets(buf, sizeof (buf), fp) != NULL)
 564                 lines++;
 565         if (lines == 0) /* didn't read anything; empty file */
 566                 goto out;
 567         rewind(fp);
 568         /*
 569          * Allocate enough space for a NULL-terminated array.
 570          */
 571         types = calloc(lines + 1, sizeof (char *));
 572         if (types == NULL) {
 573                 zerror(zlogp, B_TRUE, "memory allocation failed");
 574                 goto out;
 575         }
 576         i = 0;
 577         while (fgets(buf, sizeof (buf), fp) != NULL) {
 578                 /* LINTED - fstype is big enough to hold buf */
 579                 if (sscanf(buf, "%s", fstype) == 0) {
 580                         zerror(zlogp, B_FALSE, "unable to parse %s", DFSTYPES);
 581                         free_remote_fstypes(types);
 582                         types = NULL;
 583                         goto out;
 584                 }
 585                 types[i] = strdup(fstype);
 586                 if (types[i] == NULL) {
 587                         zerror(zlogp, B_TRUE, "memory allocation failed");
 588                         free_remote_fstypes(types);
 589                         types = NULL;
 590                         goto out;
 591                 }
 592                 i++;
 593         }
 594 out:
 595         (void) fclose(fp);
 596         return (types);
 597 }
 598 
 599 static boolean_t
 600 is_remote_fstype(const char *fstype, char *const *remote_fstypes)
 601 {
 602         uint_t i;
 603 
 604         if (remote_fstypes == NULL)
 605                 return (B_FALSE);
 606         for (i = 0; remote_fstypes[i] != NULL; i++) {
 607                 if (strcmp(remote_fstypes[i], fstype) == 0)
 608                         return (B_TRUE);
 609         }
 610         return (B_FALSE);
 611 }
 612 
 613 /*
 614  * This converts a zone root path (normally of the form .../root) to a Live
 615  * Upgrade scratch zone root (of the form .../lu).
 616  */
 617 static void
 618 root_to_lu(zlog_t *zlogp, char *zroot, size_t zrootlen, boolean_t isresolved)
 619 {
 620         if (!isresolved && zonecfg_in_alt_root())
 621                 resolve_lofs(zlogp, zroot, zrootlen);
 622         (void) strcpy(strrchr(zroot, '/') + 1, "lu");
 623 }
 624 
 625 /*
 626  * Perform brand-specific cleanup if we are unable to unmount a FS.
 627  */
 628 static void
 629 brand_umount_cleanup(zlog_t *zlogp, char *path)
 630 {
 631         char cmdbuf[2 * MAXPATHLEN];
 632 
 633         if (post_statechg_hook[0] == '\0')
 634                 return;
 635 
 636         if (snprintf(cmdbuf, sizeof (cmdbuf), "%s %d %d %s", post_statechg_hook,
 637             ZONE_STATE_DOWN, Z_UNMOUNT, path) > sizeof (cmdbuf))
 638                 return;
 639 
 640         (void) do_subproc(zlogp, cmdbuf, NULL, B_FALSE);
 641 }
 642 
 643 /*
 644  * The general strategy for unmounting filesystems is as follows:
 645  *
 646  * - Remote filesystems may be dead, and attempting to contact them as
 647  * part of a regular unmount may hang forever; we want to always try to
 648  * forcibly unmount such filesystems and only fall back to regular
 649  * unmounts if the filesystem doesn't support forced unmounts.
 650  *
 651  * - We don't want to unnecessarily corrupt metadata on local
 652  * filesystems (ie UFS), so we want to start off with graceful unmounts,
 653  * and only escalate to doing forced unmounts if we get stuck.
 654  *
 655  * We start off walking backwards through the mount table.  This doesn't
 656  * give us strict ordering but ensures that we try to unmount submounts
 657  * first.  We thus limit the number of failed umount2(2) calls.
 658  *
 659  * The mechanism for determining if we're stuck is to count the number
 660  * of failed unmounts each iteration through the mount table.  This
 661  * gives us an upper bound on the number of filesystems which remain
 662  * mounted (autofs trigger nodes are dealt with separately).  If at the
 663  * end of one unmount+autofs_cleanup cycle we still have the same number
 664  * of mounts that we started out with, we're stuck and try a forced
 665  * unmount.  If that fails (filesystem doesn't support forced unmounts)
 666  * then we bail and are unable to teardown the zone.  If it succeeds,
 667  * we're no longer stuck so we continue with our policy of trying
 668  * graceful mounts first.
 669  *
 670  * Zone must be down (ie, no processes or threads active).
 671  */
 672 static int
 673 unmount_filesystems(zlog_t *zlogp, zoneid_t zoneid, boolean_t unmount_cmd)
 674 {
 675         int error = 0;
 676         int fail = 0;
 677         FILE *mnttab;
 678         struct mnttab *mnts;
 679         uint_t nmnt;
 680         char zroot[MAXPATHLEN + 1];
 681         size_t zrootlen;
 682         uint_t oldcount = UINT_MAX;
 683         boolean_t stuck = B_FALSE;
 684         char **remote_fstypes = NULL;
 685 
 686         if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
 687                 zerror(zlogp, B_FALSE, "unable to determine zone root");
 688                 return (-1);
 689         }
 690         if (unmount_cmd)
 691                 root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
 692 
 693         (void) strcat(zroot, "/");
 694         zrootlen = strlen(zroot);
 695 
 696         /*
 697          * For Trusted Extensions unmount each higher level zone's mount
 698          * of our zone's /export/home
 699          */
 700         if (!unmount_cmd)
 701                 tsol_unmounts(zlogp, zone_name);
 702 
 703         if ((mnttab = fopen(MNTTAB, "r")) == NULL) {
 704                 zerror(zlogp, B_TRUE, "failed to open %s", MNTTAB);
 705                 return (-1);
 706         }
 707         /*
 708          * Use our hacky mntfs ioctl so we see everything, even mounts with
 709          * MS_NOMNTTAB.
 710          */
 711         if (ioctl(fileno(mnttab), MNTIOC_SHOWHIDDEN, NULL) < 0) {
 712                 zerror(zlogp, B_TRUE, "unable to configure %s", MNTTAB);
 713                 error++;
 714                 goto out;
 715         }
 716 
 717         /*
 718          * Build the list of remote fstypes so we know which ones we
 719          * should forcibly unmount.
 720          */
 721         remote_fstypes = get_remote_fstypes(zlogp);
 722         for (;;) {
 723                 uint_t newcount = 0;
 724                 boolean_t unmounted;
 725                 struct mnttab *mnp;
 726                 char *path;
 727                 uint_t i;
 728 
 729                 mnts = NULL;
 730                 nmnt = 0;
 731                 /*
 732                  * MNTTAB gives us a way to walk through mounted
 733                  * filesystems; we need to be able to walk them in
 734                  * reverse order, so we build a list of all mounted
 735                  * filesystems.
 736                  */
 737                 if (build_mnttable(zlogp, zroot, zrootlen, mnttab, &mnts,
 738                     &nmnt) != 0) {
 739                         error++;
 740                         goto out;
 741                 }
 742                 for (i = 0; i < nmnt; i++) {
 743                         mnp = &mnts[nmnt - i - 1]; /* access in reverse order */
 744                         path = mnp->mnt_mountp;
 745                         unmounted = B_FALSE;
 746                         /*
 747                          * Try forced unmount first for remote filesystems.
 748                          *
 749                          * Not all remote filesystems support forced unmounts,
 750                          * so if this fails (ENOTSUP) we'll continue on
 751                          * and try a regular unmount.
 752                          */
 753                         if (is_remote_fstype(mnp->mnt_fstype, remote_fstypes)) {
 754                                 if (umount2(path, MS_FORCE) == 0)
 755                                         unmounted = B_TRUE;
 756                         }
 757                         /*
 758                          * Try forced unmount if we're stuck.
 759                          */
 760                         if (stuck) {
 761                                 if (umount2(path, MS_FORCE) == 0) {
 762                                         unmounted = B_TRUE;
 763                                         stuck = B_FALSE;
 764                                         fail = 0;
 765                                 } else {
 766                                         /*
 767                                          * We may hit a failure here if there
 768                                          * is an app in the GZ with an open
 769                                          * pipe into the zone (commonly into
 770                                          * the zone's /var/run).  This type
 771                                          * of app will notice the closed
 772                                          * connection and cleanup, but it may
 773                                          * take a while and we have no easy
 774                                          * way to notice that.  To deal with
 775                                          * this case, we will wait and retry
 776                                          * a few times before we give up.
 777                                          */
 778                                         fail++;
 779                                         if (fail < (UMOUNT_RETRIES - 1)) {
 780                                                 zerror(zlogp, B_FALSE,
 781                                                     "unable to unmount '%s', "
 782                                                     "retrying in 2 seconds",
 783                                                     path);
 784                                                 (void) sleep(2);
 785                                         } else if (fail > UMOUNT_RETRIES) {
 786                                                 error++;
 787                                                 zerror(zlogp, B_FALSE,
 788                                                     "unmount of '%s' failed",
 789                                                     path);
 790                                                 free_mnttable(mnts, nmnt);
 791                                                 goto out;
 792                                         } else {
 793                                                 /* Try the hook 2 times */
 794                                                 brand_umount_cleanup(zlogp,
 795                                                     path);
 796                                         }
 797                                 }
 798                         }
 799                         /*
 800                          * Try regular unmounts for everything else.
 801                          */
 802                         if (!unmounted && umount2(path, 0) != 0)
 803                                 newcount++;
 804                 }
 805                 free_mnttable(mnts, nmnt);
 806 
 807                 if (newcount == 0)
 808                         break;
 809                 if (newcount >= oldcount) {
 810                         /*
 811                          * Last round didn't unmount anything; we're stuck and
 812                          * should start trying forced unmounts.
 813                          */
 814                         stuck = B_TRUE;
 815                 }
 816                 oldcount = newcount;
 817 
 818                 /*
 819                  * Autofs doesn't let you unmount its trigger nodes from
 820                  * userland so we have to tell the kernel to cleanup for us.
 821                  */
 822                 if (autofs_cleanup(zoneid) != 0) {
 823                         zerror(zlogp, B_TRUE, "unable to remove autofs nodes");
 824                         error++;
 825                         goto out;
 826                 }
 827         }
 828 
 829 out:
 830         free_remote_fstypes(remote_fstypes);
 831         (void) fclose(mnttab);
 832         return (error ? -1 : 0);
 833 }
 834 
 835 static int
 836 fs_compare(const void *m1, const void *m2)
 837 {
 838         struct zone_fstab *i = (struct zone_fstab *)m1;
 839         struct zone_fstab *j = (struct zone_fstab *)m2;
 840 
 841         return (strcmp(i->zone_fs_dir, j->zone_fs_dir));
 842 }
 843 
 844 /*
 845  * Fork and exec (and wait for) the mentioned binary with the provided
 846  * arguments.  Returns (-1) if something went wrong with fork(2) or exec(2),
 847  * returns the exit status otherwise.
 848  *
 849  * If we were unable to exec the provided pathname (for whatever
 850  * reason), we return the special token ZEXIT_EXEC.  The current value
 851  * of ZEXIT_EXEC doesn't conflict with legitimate exit codes of the
 852  * consumers of this function; any future consumers must make sure this
 853  * remains the case.
 854  */
 855 static int
 856 forkexec(zlog_t *zlogp, const char *path, char *const argv[])
 857 {
 858         pid_t child_pid;
 859         int child_status = 0;
 860 
 861         /*
 862          * Do not let another thread localize a message while we are forking.
 863          */
 864         (void) mutex_lock(&msglock);
 865         child_pid = fork();
 866         (void) mutex_unlock(&msglock);
 867         if (child_pid == -1) {
 868                 zerror(zlogp, B_TRUE, "could not fork for %s", argv[0]);
 869                 return (-1);
 870         } else if (child_pid == 0) {
 871                 closefrom(0);
 872                 /* redirect stdin, stdout & stderr to /dev/null */
 873                 (void) open("/dev/null", O_RDONLY);     /* stdin */
 874                 (void) open("/dev/null", O_WRONLY);     /* stdout */
 875                 (void) open("/dev/null", O_WRONLY);     /* stderr */
 876                 (void) execv(path, argv);
 877                 /*
 878                  * Since we are in the child, there is no point calling zerror()
 879                  * since there is nobody waiting to consume it.  So exit with a
 880                  * special code that the parent will recognize and call zerror()
 881                  * accordingly.
 882                  */
 883 
 884                 _exit(ZEXIT_EXEC);
 885         } else {
 886                 (void) waitpid(child_pid, &child_status, 0);
 887         }
 888 
 889         if (WIFSIGNALED(child_status)) {
 890                 zerror(zlogp, B_FALSE, "%s unexpectedly terminated due to "
 891                     "signal %d", path, WTERMSIG(child_status));
 892                 return (-1);
 893         }
 894         assert(WIFEXITED(child_status));
 895         if (WEXITSTATUS(child_status) == ZEXIT_EXEC) {
 896                 zerror(zlogp, B_FALSE, "failed to exec %s", path);
 897                 return (-1);
 898         }
 899         return (WEXITSTATUS(child_status));
 900 }
 901 
 902 static int
 903 isregfile(const char *path)
 904 {
 905         struct stat64 st;
 906 
 907         if (stat64(path, &st) == -1)
 908                 return (-1);
 909 
 910         return (S_ISREG(st.st_mode));
 911 }
 912 
 913 static int
 914 dofsck(zlog_t *zlogp, const char *fstype, const char *rawdev)
 915 {
 916         char cmdbuf[MAXPATHLEN];
 917         char *argv[5];
 918         int status;
 919 
 920         /*
 921          * We could alternatively have called /usr/sbin/fsck -F <fstype>, but
 922          * that would cost us an extra fork/exec without buying us anything.
 923          */
 924         if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/fsck", fstype)
 925             >= sizeof (cmdbuf)) {
 926                 zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
 927                 return (-1);
 928         }
 929 
 930         /*
 931          * If it doesn't exist, that's OK: we verified this previously
 932          * in zoneadm.
 933          */
 934         if (isregfile(cmdbuf) == -1)
 935                 return (0);
 936 
 937         argv[0] = "fsck";
 938         argv[1] = "-o";
 939         argv[2] = "p";
 940         argv[3] = (char *)rawdev;
 941         argv[4] = NULL;
 942 
 943         status = forkexec(zlogp, cmdbuf, argv);
 944         if (status == 0 || status == -1)
 945                 return (status);
 946         zerror(zlogp, B_FALSE, "fsck of '%s' failed with exit status %d; "
 947             "run fsck manually", rawdev, status);
 948         return (-1);
 949 }
 950 
 951 static int
 952 domount(zlog_t *zlogp, const char *fstype, const char *opts,
 953     const char *special, const char *directory)
 954 {
 955         char cmdbuf[MAXPATHLEN];
 956         char *argv[6];
 957         int status;
 958 
 959         /*
 960          * We could alternatively have called /usr/sbin/mount -F <fstype>, but
 961          * that would cost us an extra fork/exec without buying us anything.
 962          */
 963         if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/mount", fstype)
 964             >= sizeof (cmdbuf)) {
 965                 zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
 966                 return (-1);
 967         }
 968         argv[0] = "mount";
 969         if (opts[0] == '\0') {
 970                 argv[1] = (char *)special;
 971                 argv[2] = (char *)directory;
 972                 argv[3] = NULL;
 973         } else {
 974                 argv[1] = "-o";
 975                 argv[2] = (char *)opts;
 976                 argv[3] = (char *)special;
 977                 argv[4] = (char *)directory;
 978                 argv[5] = NULL;
 979         }
 980 
 981         status = forkexec(zlogp, cmdbuf, argv);
 982         if (status == 0 || status == -1)
 983                 return (status);
 984         if (opts[0] == '\0')
 985                 zerror(zlogp, B_FALSE, "\"%s %s %s\" "
 986                     "failed with exit code %d",
 987                     cmdbuf, special, directory, status);
 988         else
 989                 zerror(zlogp, B_FALSE, "\"%s -o %s %s %s\" "
 990                     "failed with exit code %d",
 991                     cmdbuf, opts, special, directory, status);
 992         return (-1);
 993 }
 994 
 995 /*
 996  * Check if a given mount point path exists.
 997  * If it does, make sure it doesn't contain any symlinks.
 998  * Note that if "leaf" is false we're checking an intermediate
 999  * component of the mount point path, so it must be a directory.
1000  * If "leaf" is true, then we're checking the entire mount point
1001  * path, so the mount point itself can be anything aside from a
1002  * symbolic link.
1003  *
1004  * If the path is invalid then a negative value is returned.  If the
1005  * path exists and is a valid mount point path then 0 is returned.
1006  * If the path doesn't exist return a positive value.
1007  */
1008 static int
1009 valid_mount_point(zlog_t *zlogp, const char *path, const boolean_t leaf)
1010 {
1011         struct stat statbuf;
1012         char respath[MAXPATHLEN];
1013         int res;
1014 
1015         if (lstat(path, &statbuf) != 0) {
1016                 if (errno == ENOENT)
1017                         return (1);
1018                 zerror(zlogp, B_TRUE, "can't stat %s", path);
1019                 return (-1);
1020         }
1021         if (S_ISLNK(statbuf.st_mode)) {
1022                 zerror(zlogp, B_FALSE, "%s is a symlink", path);
1023                 return (-1);
1024         }
1025         if (!leaf && !S_ISDIR(statbuf.st_mode)) {
1026                 zerror(zlogp, B_FALSE, "%s is not a directory", path);
1027                 return (-1);
1028         }
1029         if ((res = resolvepath(path, respath, sizeof (respath))) == -1) {
1030                 zerror(zlogp, B_TRUE, "unable to resolve path %s", path);
1031                 return (-1);
1032         }
1033         respath[res] = '\0';
1034         if (strcmp(path, respath) != 0) {
1035                 /*
1036                  * We don't like ".."s, "."s, or "//"s throwing us off
1037                  */
1038                 zerror(zlogp, B_FALSE, "%s is not a canonical path", path);
1039                 return (-1);
1040         }
1041         return (0);
1042 }
1043 
1044 /*
1045  * Validate a mount point path.  A valid mount point path is an
1046  * absolute path that either doesn't exist, or, if it does exists it
1047  * must be an absolute canonical path that doesn't have any symbolic
1048  * links in it.  The target of a mount point path can be any filesystem
1049  * object.  (Different filesystems can support different mount points,
1050  * for example "lofs" and "mntfs" both support files and directories
1051  * while "ufs" just supports directories.)
1052  *
1053  * If the path is invalid then a negative value is returned.  If the
1054  * path exists and is a valid mount point path then 0 is returned.
1055  * If the path doesn't exist return a positive value.
1056  */
1057 int
1058 valid_mount_path(zlog_t *zlogp, const char *rootpath, const char *spec,
1059     const char *dir, const char *fstype)
1060 {
1061         char abspath[MAXPATHLEN], *slashp, *slashp_next;
1062         int rv;
1063 
1064         /*
1065          * Sanity check the target mount point path.
1066          * It must be a non-null string that starts with a '/'.
1067          */
1068         if (dir[0] != '/') {
1069                 /* Something went wrong. */
1070                 zerror(zlogp, B_FALSE, "invalid mount directory, "
1071                     "type: \"%s\", special: \"%s\", dir: \"%s\"",
1072                     fstype, spec, dir);
1073                 return (-1);
1074         }
1075 
1076         /*
1077          * Join rootpath and dir.  Make sure abspath ends with '/', this
1078          * is added to all paths (even non-directory paths) to allow us
1079          * to detect the end of paths below.  If the path already ends
1080          * in a '/', then that's ok too (although we'll fail the
1081          * cannonical path check in valid_mount_point()).
1082          */
1083         if (snprintf(abspath, sizeof (abspath),
1084             "%s%s/", rootpath, dir) >= sizeof (abspath)) {
1085                 zerror(zlogp, B_FALSE, "pathname %s%s is too long",
1086                     rootpath, dir);
1087                 return (-1);
1088         }
1089 
1090         /*
1091          * Starting with rootpath, verify the mount path one component
1092          * at a time.  Continue until we've evaluated all of abspath.
1093          */
1094         slashp = &abspath[strlen(rootpath)];
1095         assert(*slashp == '/');
1096         do {
1097                 slashp_next = strchr(slashp + 1, '/');
1098                 *slashp = '\0';
1099                 if (slashp_next != NULL) {
1100                         /* This is an intermediary mount path component. */
1101                         rv = valid_mount_point(zlogp, abspath, B_FALSE);
1102                 } else {
1103                         /* This is the last component of the mount path. */
1104                         rv = valid_mount_point(zlogp, abspath, B_TRUE);
1105                 }
1106                 if (rv < 0)
1107                         return (rv);
1108                 *slashp = '/';
1109         } while ((slashp = slashp_next) != NULL);
1110         return (rv);
1111 }
1112 
1113 static int
1114 mount_one_dev_device_cb(void *arg, const char *match, const char *name)
1115 {
1116         di_prof_t prof = arg;
1117 
1118         if (name == NULL)
1119                 return (di_prof_add_dev(prof, match));
1120         return (di_prof_add_map(prof, match, name));
1121 }
1122 
1123 static int
1124 mount_one_dev_symlink_cb(void *arg, const char *source, const char *target)
1125 {
1126         di_prof_t prof = arg;
1127 
1128         return (di_prof_add_symlink(prof, source, target));
1129 }
1130 
1131 int
1132 vplat_get_iptype(zlog_t *zlogp, zone_iptype_t *iptypep)
1133 {
1134         if (zonecfg_get_iptype(snap_hndl, iptypep) != Z_OK) {
1135                 zerror(zlogp, B_FALSE, "invalid ip-type configuration");
1136                 return (-1);
1137         }
1138         return (0);
1139 }
1140 
1141 /*
1142  * Apply the standard lists of devices/symlinks/mappings and the user-specified
1143  * list of devices (via zonecfg) to the /dev filesystem.  The filesystem will
1144  * use these as a profile/filter to determine what exists in /dev.
1145  */
1146 static int
1147 mount_one_dev(zlog_t *zlogp, char *devpath, zone_mnt_t mount_cmd)
1148 {
1149         char                    brand[MAXNAMELEN];
1150         brand_handle_t          bh = NULL;
1151         struct zone_devtab      ztab;
1152         di_prof_t               prof = NULL;
1153         int                     err;
1154         int                     retval = -1;
1155         zone_iptype_t           iptype;
1156         const char              *curr_iptype = NULL;
1157 
1158         if (di_prof_init(devpath, &prof)) {
1159                 zerror(zlogp, B_TRUE, "failed to initialize profile");
1160                 goto cleanup;
1161         }
1162 
1163         /*
1164          * Get a handle to the brand info for this zone.
1165          * If we are mounting the zone, then we must always use the default
1166          * brand device mounts.
1167          */
1168         if (ALT_MOUNT(mount_cmd)) {
1169                 (void) strlcpy(brand, default_brand, sizeof (brand));
1170         } else {
1171                 (void) strlcpy(brand, brand_name, sizeof (brand));
1172         }
1173 
1174         if ((bh = brand_open(brand)) == NULL) {
1175                 zerror(zlogp, B_FALSE, "unable to determine zone brand");
1176                 goto cleanup;
1177         }
1178 
1179         if (vplat_get_iptype(zlogp, &iptype) < 0) {
1180                 zerror(zlogp, B_TRUE, "unable to determine ip-type");
1181                 goto cleanup;
1182         }
1183         switch (iptype) {
1184         case ZS_SHARED:
1185                 curr_iptype = "shared";
1186                 break;
1187         case ZS_EXCLUSIVE:
1188                 curr_iptype = "exclusive";
1189                 break;
1190         default:
1191                 zerror(zlogp, B_FALSE, "bad ip-type");
1192                 goto cleanup;
1193         }
1194         if (curr_iptype == NULL)
1195                 abort();
1196 
1197         if (brand_platform_iter_devices(bh, zone_name,
1198             mount_one_dev_device_cb, prof, curr_iptype) != 0) {
1199                 zerror(zlogp, B_TRUE, "failed to add standard device");
1200                 goto cleanup;
1201         }
1202 
1203         if (brand_platform_iter_link(bh,
1204             mount_one_dev_symlink_cb, prof) != 0) {
1205                 zerror(zlogp, B_TRUE, "failed to add standard symlink");
1206                 goto cleanup;
1207         }
1208 
1209         /* Add user-specified devices and directories */
1210         if ((err = zonecfg_setdevent(snap_hndl)) != 0) {
1211                 zerror(zlogp, B_FALSE, "%s: %s", zone_name,
1212                     zonecfg_strerror(err));
1213                 goto cleanup;
1214         }
1215         while (zonecfg_getdevent(snap_hndl, &ztab) == Z_OK) {
1216                 char path[MAXPATHLEN];
1217 
1218                 if ((err = resolve_device_match(zlogp, &ztab,
1219                     path, sizeof (path))) != Z_OK)
1220                         goto cleanup;
1221 
1222                 if (di_prof_add_dev(prof, path)) {
1223                         zerror(zlogp, B_TRUE, "failed to add "
1224                             "user-specified device '%s'", path);
1225                         goto cleanup;
1226                 }
1227         }
1228         (void) zonecfg_enddevent(snap_hndl);
1229 
1230         /* Send profile to kernel */
1231         if (di_prof_commit(prof)) {
1232                 zerror(zlogp, B_TRUE, "failed to commit profile");
1233                 goto cleanup;
1234         }
1235 
1236         retval = 0;
1237 
1238 cleanup:
1239         if (bh != NULL)
1240                 brand_close(bh);
1241         if (prof)
1242                 di_prof_fini(prof);
1243         return (retval);
1244 }
1245 
1246 static int
1247 mount_one(zlog_t *zlogp, struct zone_fstab *fsptr, const char *rootpath,
1248     zone_mnt_t mount_cmd)
1249 {
1250         char path[MAXPATHLEN];
1251         char optstr[MAX_MNTOPT_STR];
1252         zone_fsopt_t *optptr;
1253         int rv;
1254 
1255         if ((rv = valid_mount_path(zlogp, rootpath, fsptr->zone_fs_special,
1256             fsptr->zone_fs_dir, fsptr->zone_fs_type)) < 0) {
1257                 zerror(zlogp, B_FALSE, "%s%s is not a valid mount point",
1258                     rootpath, fsptr->zone_fs_dir);
1259                 return (-1);
1260         } else if (rv > 0) {
1261                 /* The mount point path doesn't exist, create it now. */
1262                 if (make_one_dir(zlogp, rootpath, fsptr->zone_fs_dir,
1263                     DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
1264                     DEFAULT_DIR_GROUP) != 0) {
1265                         zerror(zlogp, B_FALSE, "failed to create mount point");
1266                         return (-1);
1267                 }
1268 
1269                 /*
1270                  * Now this might seem weird, but we need to invoke
1271                  * valid_mount_path() again.  Why?  Because it checks
1272                  * to make sure that the mount point path is canonical,
1273                  * which it can only do if the path exists, so now that
1274                  * we've created the path we have to verify it again.
1275                  */
1276                 if ((rv = valid_mount_path(zlogp, rootpath,
1277                     fsptr->zone_fs_special, fsptr->zone_fs_dir,
1278                     fsptr->zone_fs_type)) < 0) {
1279                         zerror(zlogp, B_FALSE,
1280                             "%s%s is not a valid mount point",
1281                             rootpath, fsptr->zone_fs_dir);
1282                         return (-1);
1283                 }
1284         }
1285 
1286         (void) snprintf(path, sizeof (path), "%s%s", rootpath,
1287             fsptr->zone_fs_dir);
1288 
1289         /*
1290          * In general the strategy here is to do just as much verification as
1291          * necessary to avoid crashing or otherwise doing something bad; if the
1292          * administrator initiated the operation via zoneadm(8), they'll get
1293          * auto-verification which will let them know what's wrong.  If they
1294          * modify the zone configuration of a running zone, and don't attempt
1295          * to verify that it's OK, then we won't crash but won't bother trying
1296          * to be too helpful either. zoneadm verify is only a couple keystrokes
1297          * away.
1298          */
1299         if (!zonecfg_valid_fs_type(fsptr->zone_fs_type)) {
1300                 zerror(zlogp, B_FALSE, "cannot mount %s on %s: "
1301                     "invalid file-system type %s", fsptr->zone_fs_special,
1302                     fsptr->zone_fs_dir, fsptr->zone_fs_type);
1303                 return (-1);
1304         }
1305 
1306         /*
1307          * If we're looking at an alternate root environment, then construct
1308          * read-only loopback mounts as necessary.  Note that any special
1309          * paths for lofs zone mounts in an alternate root must have
1310          * already been pre-pended with any alternate root path by the
1311          * time we get here.
1312          */
1313         if (zonecfg_in_alt_root()) {
1314                 struct stat64 st;
1315 
1316                 if (stat64(fsptr->zone_fs_special, &st) != -1 &&
1317                     S_ISBLK(st.st_mode)) {
1318                         /*
1319                          * If we're going to mount a block device we need
1320                          * to check if that device is already mounted
1321                          * somewhere else, and if so, do a lofs mount
1322                          * of the device instead of a direct mount
1323                          */
1324                         if (check_lofs_needed(zlogp, fsptr) == -1)
1325                                 return (-1);
1326                 } else if (strcmp(fsptr->zone_fs_type, MNTTYPE_LOFS) == 0) {
1327                         /*
1328                          * For lofs mounts, the special node is inside the
1329                          * alternate root.  We need lofs resolution for
1330                          * this case in order to get at the underlying
1331                          * read-write path.
1332                          */
1333                         resolve_lofs(zlogp, fsptr->zone_fs_special,
1334                             sizeof (fsptr->zone_fs_special));
1335                 }
1336         }
1337 
1338         /*
1339          * Run 'fsck -m' if there's a device to fsck.
1340          */
1341         if (fsptr->zone_fs_raw[0] != '\0' &&
1342             dofsck(zlogp, fsptr->zone_fs_type, fsptr->zone_fs_raw) != 0) {
1343                 return (-1);
1344         } else if (isregfile(fsptr->zone_fs_special) == 1 &&
1345             dofsck(zlogp, fsptr->zone_fs_type, fsptr->zone_fs_special) != 0) {
1346                 return (-1);
1347         }
1348 
1349         /*
1350          * Build up mount option string.
1351          */
1352         optstr[0] = '\0';
1353         if (fsptr->zone_fs_options != NULL) {
1354                 (void) strlcpy(optstr, fsptr->zone_fs_options->zone_fsopt_opt,
1355                     sizeof (optstr));
1356                 for (optptr = fsptr->zone_fs_options->zone_fsopt_next;
1357                     optptr != NULL; optptr = optptr->zone_fsopt_next) {
1358                         (void) strlcat(optstr, ",", sizeof (optstr));
1359                         (void) strlcat(optstr, optptr->zone_fsopt_opt,
1360                             sizeof (optstr));
1361                 }
1362         }
1363 
1364         if ((rv = domount(zlogp, fsptr->zone_fs_type, optstr,
1365             fsptr->zone_fs_special, path)) != 0)
1366                 return (rv);
1367 
1368         /*
1369          * The mount succeeded.  If this was not a mount of /dev then
1370          * we're done.
1371          */
1372         if (strcmp(fsptr->zone_fs_type, MNTTYPE_DEV) != 0)
1373                 return (0);
1374 
1375         /*
1376          * We just mounted an instance of a /dev filesystem, so now we
1377          * need to configure it.
1378          */
1379         return (mount_one_dev(zlogp, path, mount_cmd));
1380 }
1381 
1382 static void
1383 free_fs_data(struct zone_fstab *fsarray, uint_t nelem)
1384 {
1385         uint_t i;
1386 
1387         if (fsarray == NULL)
1388                 return;
1389         for (i = 0; i < nelem; i++)
1390                 zonecfg_free_fs_option_list(fsarray[i].zone_fs_options);
1391         free(fsarray);
1392 }
1393 
1394 /*
1395  * This function initiates the creation of a small Solaris Environment for
1396  * scratch zone. The Environment creation process is split up into two
1397  * functions(build_mounted_pre_var() and build_mounted_post_var()). It
1398  * is done this way because:
1399  *      We need to have both /etc and /var in the root of the scratchzone.
1400  *      We loopback mount zone's own /etc and /var into the root of the
1401  *      scratch zone. Unlike /etc, /var can be a seperate filesystem. So we
1402  *      need to delay the mount of /var till the zone's root gets populated.
1403  *      So mounting of localdirs[](/etc and /var) have been moved to the
1404  *      build_mounted_post_var() which gets called only after the zone
1405  *      specific filesystems are mounted.
1406  *
1407  * Note that the scratch zone we set up for updating the zone (Z_MNT_UPDATE)
1408  * does not loopback mount the zone's own /etc and /var into the root of the
1409  * scratch zone.
1410  */
1411 static boolean_t
1412 build_mounted_pre_var(zlog_t *zlogp, char *rootpath,
1413     size_t rootlen, const char *zonepath, char *luroot, size_t lurootlen)
1414 {
1415         char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1416         const char **cpp;
1417         static const char *mkdirs[] = {
1418                 "/system", "/system/contract", "/system/object", "/proc",
1419                 "/dev", "/tmp", "/a", NULL
1420         };
1421         char *altstr;
1422         FILE *fp;
1423         uuid_t uuid;
1424 
1425         resolve_lofs(zlogp, rootpath, rootlen);
1426         (void) snprintf(luroot, lurootlen, "%s/lu", zonepath);
1427         resolve_lofs(zlogp, luroot, lurootlen);
1428         (void) snprintf(tmp, sizeof (tmp), "%s/bin", luroot);
1429         (void) symlink("./usr/bin", tmp);
1430 
1431         /*
1432          * These are mostly special mount points; not handled here.  (See
1433          * zone_mount_early.)
1434          */
1435         for (cpp = mkdirs; *cpp != NULL; cpp++) {
1436                 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1437                 if (mkdir(tmp, 0755) != 0) {
1438                         zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1439                         return (B_FALSE);
1440                 }
1441         }
1442         /*
1443          * This is here to support lucopy.  If there's an instance of this same
1444          * zone on the current running system, then we mount its root up as
1445          * read-only inside the scratch zone.
1446          */
1447         (void) zonecfg_get_uuid(zone_name, uuid);
1448         altstr = strdup(zonecfg_get_root());
1449         if (altstr == NULL) {
1450                 zerror(zlogp, B_TRUE, "memory allocation failed");
1451                 return (B_FALSE);
1452         }
1453         zonecfg_set_root("");
1454         (void) strlcpy(tmp, zone_name, sizeof (tmp));
1455         (void) zonecfg_get_name_by_uuid(uuid, tmp, sizeof (tmp));
1456         if (zone_get_rootpath(tmp, fromdir, sizeof (fromdir)) == Z_OK &&
1457             strcmp(fromdir, rootpath) != 0) {
1458                 (void) snprintf(tmp, sizeof (tmp), "%s/b", luroot);
1459                 if (mkdir(tmp, 0755) != 0) {
1460                         zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1461                         return (B_FALSE);
1462                 }
1463                 if (domount(zlogp, MNTTYPE_LOFS, RESOURCE_DEFAULT_OPTS, fromdir,
1464                     tmp) != 0) {
1465                         zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1466                             fromdir);
1467                         return (B_FALSE);
1468                 }
1469         }
1470         zonecfg_set_root(altstr);
1471         free(altstr);
1472 
1473         if ((fp = zonecfg_open_scratch(luroot, B_TRUE)) == NULL) {
1474                 zerror(zlogp, B_TRUE, "cannot open zone mapfile");
1475                 return (B_FALSE);
1476         }
1477         (void) ftruncate(fileno(fp), 0);
1478         if (zonecfg_add_scratch(fp, zone_name, kernzone, "/") == -1) {
1479                 zerror(zlogp, B_TRUE, "cannot add zone mapfile entry");
1480         }
1481         zonecfg_close_scratch(fp);
1482         (void) snprintf(tmp, sizeof (tmp), "%s/a", luroot);
1483         if (domount(zlogp, MNTTYPE_LOFS, "", rootpath, tmp) != 0)
1484                 return (B_FALSE);
1485         (void) strlcpy(rootpath, tmp, rootlen);
1486         return (B_TRUE);
1487 }
1488 
1489 
1490 static boolean_t
1491 build_mounted_post_var(zlog_t *zlogp, zone_mnt_t mount_cmd, char *rootpath,
1492     const char *luroot)
1493 {
1494         char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1495         const char **cpp;
1496         const char **loopdirs;
1497         const char **tmpdirs;
1498         static const char *localdirs[] = {
1499                 "/etc", "/var", NULL
1500         };
1501         static const char *scr_loopdirs[] = {
1502                 "/etc/lib", "/etc/fs", "/lib", "/sbin", "/platform",
1503                 "/usr", NULL
1504         };
1505         static const char *upd_loopdirs[] = {
1506                 "/etc", "/kernel", "/lib", "/opt", "/platform", "/sbin",
1507                 "/usr", "/var", NULL
1508         };
1509         static const char *scr_tmpdirs[] = {
1510                 "/tmp", "/var/run", NULL
1511         };
1512         static const char *upd_tmpdirs[] = {
1513                 "/tmp", "/var/run", "/var/tmp", NULL
1514         };
1515         struct stat st;
1516 
1517         if (mount_cmd == Z_MNT_SCRATCH) {
1518                 /*
1519                  * These are mounted read-write from the zone undergoing
1520                  * upgrade.  We must be careful not to 'leak' things from the
1521                  * main system into the zone, and this accomplishes that goal.
1522                  */
1523                 for (cpp = localdirs; *cpp != NULL; cpp++) {
1524                         (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot,
1525                             *cpp);
1526                         (void) snprintf(fromdir, sizeof (fromdir), "%s%s",
1527                             rootpath, *cpp);
1528                         if (mkdir(tmp, 0755) != 0) {
1529                                 zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1530                                 return (B_FALSE);
1531                         }
1532                         if (domount(zlogp, MNTTYPE_LOFS, "", fromdir, tmp)
1533                             != 0) {
1534                                 zerror(zlogp, B_TRUE, "cannot mount %s on %s",
1535                                     tmp, *cpp);
1536                                 return (B_FALSE);
1537                         }
1538                 }
1539         }
1540 
1541         if (mount_cmd == Z_MNT_UPDATE)
1542                 loopdirs = upd_loopdirs;
1543         else
1544                 loopdirs = scr_loopdirs;
1545 
1546         /*
1547          * These are things mounted read-only from the running system because
1548          * they contain binaries that must match system.
1549          */
1550         for (cpp = loopdirs; *cpp != NULL; cpp++) {
1551                 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1552                 if (mkdir(tmp, 0755) != 0) {
1553                         if (errno != EEXIST) {
1554                                 zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1555                                 return (B_FALSE);
1556                         }
1557                         if (lstat(tmp, &st) != 0) {
1558                                 zerror(zlogp, B_TRUE, "cannot stat %s", tmp);
1559                                 return (B_FALSE);
1560                         }
1561                         /*
1562                          * Ignore any non-directories encountered.  These are
1563                          * things that have been converted into symlinks
1564                          * (/etc/fs and /etc/lib) and no longer need a lofs
1565                          * fixup.
1566                          */
1567                         if (!S_ISDIR(st.st_mode))
1568                                 continue;
1569                 }
1570                 if (domount(zlogp, MNTTYPE_LOFS, RESOURCE_DEFAULT_OPTS, *cpp,
1571                     tmp) != 0) {
1572                         zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1573                             *cpp);
1574                         return (B_FALSE);
1575                 }
1576         }
1577 
1578         if (mount_cmd == Z_MNT_UPDATE)
1579                 tmpdirs = upd_tmpdirs;
1580         else
1581                 tmpdirs = scr_tmpdirs;
1582 
1583         /*
1584          * These are things with tmpfs mounted inside.
1585          */
1586         for (cpp = tmpdirs; *cpp != NULL; cpp++) {
1587                 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1588                 if (mount_cmd == Z_MNT_SCRATCH && mkdir(tmp, 0755) != 0 &&
1589                     errno != EEXIST) {
1590                         zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1591                         return (B_FALSE);
1592                 }
1593 
1594                 /*
1595                  * We could set the mode for /tmp when we do the mkdir but
1596                  * since that can be modified by the umask we will just set
1597                  * the correct mode for /tmp now.
1598                  */
1599                 if (strcmp(*cpp, "/tmp") == 0 && chmod(tmp, 01777) != 0) {
1600                         zerror(zlogp, B_TRUE, "cannot chmod %s", tmp);
1601                         return (B_FALSE);
1602                 }
1603 
1604                 if (domount(zlogp, MNTTYPE_TMPFS, "", "swap", tmp) != 0) {
1605                         zerror(zlogp, B_TRUE, "cannot mount swap on %s", *cpp);
1606                         return (B_FALSE);
1607                 }
1608         }
1609         return (B_TRUE);
1610 }
1611 
1612 typedef struct plat_gmount_cb_data {
1613         zlog_t                  *pgcd_zlogp;
1614         struct zone_fstab       **pgcd_fs_tab;
1615         int                     *pgcd_num_fs;
1616 } plat_gmount_cb_data_t;
1617 
1618 /*
1619  * plat_gmount_cb() is a callback function invoked by libbrand to iterate
1620  * through all global brand platform mounts.
1621  */
1622 int
1623 plat_gmount_cb(void *data, const char *spec, const char *dir,
1624     const char *fstype, const char *opt)
1625 {
1626         plat_gmount_cb_data_t   *cp = data;
1627         zlog_t                  *zlogp = cp->pgcd_zlogp;
1628         struct zone_fstab       *fs_ptr = *cp->pgcd_fs_tab;
1629         int                     num_fs = *cp->pgcd_num_fs;
1630         struct zone_fstab       *fsp, *tmp_ptr;
1631 
1632         num_fs++;
1633         if ((tmp_ptr = realloc(fs_ptr, num_fs * sizeof (*tmp_ptr))) == NULL) {
1634                 zerror(zlogp, B_TRUE, "memory allocation failed");
1635                 return (-1);
1636         }
1637 
1638         fs_ptr = tmp_ptr;
1639         fsp = &fs_ptr[num_fs - 1];
1640 
1641         /* update the callback struct passed in */
1642         *cp->pgcd_fs_tab = fs_ptr;
1643         *cp->pgcd_num_fs = num_fs;
1644 
1645         fsp->zone_fs_raw[0] = '\0';
1646         (void) strlcpy(fsp->zone_fs_special, spec,
1647             sizeof (fsp->zone_fs_special));
1648         (void) strlcpy(fsp->zone_fs_dir, dir, sizeof (fsp->zone_fs_dir));
1649         (void) strlcpy(fsp->zone_fs_type, fstype, sizeof (fsp->zone_fs_type));
1650         fsp->zone_fs_options = NULL;
1651         if ((opt != NULL) &&
1652             (zonecfg_add_fs_option(fsp, (char *)opt) != Z_OK)) {
1653                 zerror(zlogp, B_FALSE, "error adding property");
1654                 return (-1);
1655         }
1656 
1657         return (0);
1658 }
1659 
1660 static int
1661 mount_filesystems_fsent(zone_dochandle_t handle, zlog_t *zlogp,
1662     struct zone_fstab **fs_tabp, int *num_fsp, zone_mnt_t mount_cmd)
1663 {
1664         struct zone_fstab *tmp_ptr, *fs_ptr, *fsp, fstab;
1665         int num_fs;
1666 
1667         num_fs = *num_fsp;
1668         fs_ptr = *fs_tabp;
1669 
1670         if (zonecfg_setfsent(handle) != Z_OK) {
1671                 zerror(zlogp, B_FALSE, "invalid configuration");
1672                 return (-1);
1673         }
1674         while (zonecfg_getfsent(handle, &fstab) == Z_OK) {
1675                 /*
1676                  * ZFS filesystems will not be accessible under an alternate
1677                  * root, since the pool will not be known.  Ignore them in this
1678                  * case.
1679                  */
1680                 if (ALT_MOUNT(mount_cmd) &&
1681                     strcmp(fstab.zone_fs_type, MNTTYPE_ZFS) == 0)
1682                         continue;
1683 
1684                 num_fs++;
1685                 if ((tmp_ptr = realloc(fs_ptr,
1686                     num_fs * sizeof (*tmp_ptr))) == NULL) {
1687                         zerror(zlogp, B_TRUE, "memory allocation failed");
1688                         (void) zonecfg_endfsent(handle);
1689                         return (-1);
1690                 }
1691                 /* update the pointers passed in */
1692                 *fs_tabp = tmp_ptr;
1693                 *num_fsp = num_fs;
1694 
1695                 fs_ptr = tmp_ptr;
1696                 fsp = &fs_ptr[num_fs - 1];
1697                 (void) strlcpy(fsp->zone_fs_dir,
1698                     fstab.zone_fs_dir, sizeof (fsp->zone_fs_dir));
1699                 (void) strlcpy(fsp->zone_fs_raw, fstab.zone_fs_raw,
1700                     sizeof (fsp->zone_fs_raw));
1701                 (void) strlcpy(fsp->zone_fs_type, fstab.zone_fs_type,
1702                     sizeof (fsp->zone_fs_type));
1703                 fsp->zone_fs_options = fstab.zone_fs_options;
1704 
1705                 /*
1706                  * For all lofs mounts, make sure that the 'special'
1707                  * entry points inside the alternate root.  The
1708                  * source path for a lofs mount in a given zone needs
1709                  * to be relative to the root of the boot environment
1710                  * that contains the zone.  Note that we don't do this
1711                  * for non-lofs mounts since they will have a device
1712                  * as a backing store and device paths must always be
1713                  * specified relative to the current boot environment.
1714                  */
1715                 fsp->zone_fs_special[0] = '\0';
1716                 if (strcmp(fsp->zone_fs_type, MNTTYPE_LOFS) == 0) {
1717                         (void) strlcat(fsp->zone_fs_special, zonecfg_get_root(),
1718                             sizeof (fsp->zone_fs_special));
1719                 }
1720                 (void) strlcat(fsp->zone_fs_special, fstab.zone_fs_special,
1721                     sizeof (fsp->zone_fs_special));
1722         }
1723         (void) zonecfg_endfsent(handle);
1724         return (0);
1725 }
1726 
1727 static int
1728 mount_filesystems(zlog_t *zlogp, zone_mnt_t mount_cmd)
1729 {
1730         char rootpath[MAXPATHLEN];
1731         char brand[MAXNAMELEN];
1732         char luroot[MAXPATHLEN];
1733         int i, num_fs = 0;
1734         struct zone_fstab *fs_ptr = NULL;
1735         zone_state_t zstate;
1736         brand_handle_t bh;
1737         plat_gmount_cb_data_t cb;
1738 
1739         if (zone_get_state(zone_name, &zstate) != Z_OK ||
1740             (zstate != ZONE_STATE_READY && zstate != ZONE_STATE_MOUNTED)) {
1741                 zerror(zlogp, B_FALSE,
1742                     "zone must be in '%s' or '%s' state to mount file-systems",
1743                     zone_state_str(ZONE_STATE_READY),
1744                     zone_state_str(ZONE_STATE_MOUNTED));
1745                 goto bad;
1746         }
1747 
1748         if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
1749                 zerror(zlogp, B_TRUE, "unable to determine zone root");
1750                 goto bad;
1751         }
1752 
1753         if (zonecfg_setfsent(snap_hndl) != Z_OK) {
1754                 zerror(zlogp, B_FALSE, "invalid configuration");
1755                 goto bad;
1756         }
1757 
1758         /*
1759          * If we are mounting the zone, then we must always use the default
1760          * brand global mounts.
1761          */
1762         if (ALT_MOUNT(mount_cmd)) {
1763                 (void) strlcpy(brand, default_brand, sizeof (brand));
1764         } else {
1765                 (void) strlcpy(brand, brand_name, sizeof (brand));
1766         }
1767 
1768         /* Get a handle to the brand info for this zone */
1769         if ((bh = brand_open(brand)) == NULL) {
1770                 zerror(zlogp, B_FALSE, "unable to determine zone brand");
1771                 return (-1);
1772         }
1773 
1774         /*
1775          * Get the list of global filesystems to mount from the brand
1776          * configuration.
1777          */
1778         cb.pgcd_zlogp = zlogp;
1779         cb.pgcd_fs_tab = &fs_ptr;
1780         cb.pgcd_num_fs = &num_fs;
1781         if (brand_platform_iter_gmounts(bh, zone_name, zonepath,
1782             plat_gmount_cb, &cb) != 0) {
1783                 zerror(zlogp, B_FALSE, "unable to mount filesystems");
1784                 brand_close(bh);
1785                 return (-1);
1786         }
1787         brand_close(bh);
1788 
1789         /*
1790          * Iterate through the rest of the filesystems. Sort them all,
1791          * then mount them in sorted order. This is to make sure the
1792          * higher level directories (e.g., /usr) get mounted before
1793          * any beneath them (e.g., /usr/local).
1794          */
1795         if (mount_filesystems_fsent(snap_hndl, zlogp, &fs_ptr, &num_fs,
1796             mount_cmd) != 0)
1797                 goto bad;
1798 
1799         /*
1800          * Normally when we mount a zone all the zone filesystems
1801          * get mounted relative to rootpath, which is usually
1802          * <zonepath>/root.  But when mounting a zone for administration
1803          * purposes via the zone "mount" state, build_mounted_pre_var()
1804          * updates rootpath to be <zonepath>/lu/a so we'll mount all
1805          * the zones filesystems there instead.
1806          *
1807          * build_mounted_pre_var() and build_mounted_post_var() will
1808          * also do some extra work to create directories and lofs mount
1809          * a bunch of global zone file system paths into <zonepath>/lu.
1810          *
1811          * This allows us to be able to enter the zone (now rooted at
1812          * <zonepath>/lu) and run the upgrade/patch tools that are in the
1813          * global zone and have them upgrade the to-be-modified zone's
1814          * files mounted on /a.  (Which mirrors the existing standard
1815          * upgrade environment.)
1816          *
1817          * There is of course one catch.  When doing the upgrade
1818          * we need <zoneroot>/lu/dev to be the /dev filesystem
1819          * for the zone and we don't want to have any /dev filesystem
1820          * mounted at <zoneroot>/lu/a/dev.  Since /dev is specified
1821          * as a normal zone filesystem by default we'll try to mount
1822          * it at <zoneroot>/lu/a/dev, so we have to detect this
1823          * case and instead mount it at <zoneroot>/lu/dev.
1824          *
1825          * All this work is done in three phases:
1826          *   1) Create and populate lu directory (build_mounted_pre_var()).
1827          *   2) Mount the required filesystems as per the zone configuration.
1828          *   3) Set up the rest of the scratch zone environment
1829          *      (build_mounted_post_var()).
1830          */
1831         if (ALT_MOUNT(mount_cmd) && !build_mounted_pre_var(zlogp,
1832             rootpath, sizeof (rootpath), zonepath, luroot, sizeof (luroot)))
1833                 goto bad;
1834 
1835         qsort(fs_ptr, num_fs, sizeof (*fs_ptr), fs_compare);
1836 
1837         for (i = 0; i < num_fs; i++) {
1838                 if (ALT_MOUNT(mount_cmd)) {
1839                         if (strcmp(fs_ptr[i].zone_fs_dir, "/dev") == 0) {
1840                                 size_t slen = strlen(rootpath) - 2;
1841 
1842                                 /*
1843                                  * By default we'll try to mount /dev
1844                                  * as /a/dev but /dev is special and
1845                                  * always goes at the top so strip the
1846                                  * trailing '/a' from the rootpath.
1847                                  */
1848                                 assert(strcmp(&rootpath[slen], "/a") == 0);
1849                                 rootpath[slen] = '\0';
1850                                 if (mount_one(zlogp, &fs_ptr[i], rootpath,
1851                                     mount_cmd) != 0)
1852                                         goto bad;
1853                                 rootpath[slen] = '/';
1854                                 continue;
1855                         } else if (strcmp(brand_name, default_brand) != 0) {
1856                                 /*
1857                                  * If mounting non-native brand, skip
1858                                  * mounting global mounts and
1859                                  * filesystem entries since they are
1860                                  * only needed for native pkg upgrade
1861                                  * tools.
1862                                  *
1863                                  * The only exception right now is
1864                                  * /dev (handled above), which is
1865                                  * needed in the luroot in order to
1866                                  * zlogin -S into the zone.
1867                                  */
1868                                 continue;
1869                         }
1870                 }
1871 
1872                 if (mount_one(zlogp, &fs_ptr[i], rootpath, mount_cmd) != 0)
1873                         goto bad;
1874         }
1875         if (ALT_MOUNT(mount_cmd) &&
1876             !build_mounted_post_var(zlogp, mount_cmd, rootpath, luroot))
1877                 goto bad;
1878 
1879         /*
1880          * For Trusted Extensions cross-mount each lower level /export/home
1881          */
1882         if (mount_cmd == Z_MNT_BOOT &&
1883             tsol_mounts(zlogp, zone_name, rootpath) != 0)
1884                 goto bad;
1885 
1886         free_fs_data(fs_ptr, num_fs);
1887 
1888         /*
1889          * Everything looks fine.
1890          */
1891         return (0);
1892 
1893 bad:
1894         free_fs_data(fs_ptr, num_fs);
1895         return (-1);
1896 }
1897 
1898 /* caller makes sure neither parameter is NULL */
1899 static int
1900 addr2netmask(char *prefixstr, int maxprefixlen, uchar_t *maskstr)
1901 {
1902         int prefixlen;
1903 
1904         prefixlen = atoi(prefixstr);
1905         if (prefixlen < 0 || prefixlen > maxprefixlen)
1906                 return (1);
1907         while (prefixlen > 0) {
1908                 if (prefixlen >= 8) {
1909                         *maskstr++ = 0xFF;
1910                         prefixlen -= 8;
1911                         continue;
1912                 }
1913                 *maskstr |= 1 << (8 - prefixlen);
1914                 prefixlen--;
1915         }
1916         return (0);
1917 }
1918 
1919 /*
1920  * Tear down all interfaces belonging to the given zone.  This should
1921  * be called with the zone in a state other than "running", so that
1922  * interfaces can't be assigned to the zone after this returns.
1923  *
1924  * If anything goes wrong, log an error message and return an error.
1925  */
1926 static int
1927 unconfigure_shared_network_interfaces(zlog_t *zlogp, zoneid_t zone_id)
1928 {
1929         struct lifnum lifn;
1930         struct lifconf lifc;
1931         struct lifreq *lifrp, lifrl;
1932         int64_t lifc_flags = LIFC_NOXMIT | LIFC_ALLZONES;
1933         int num_ifs, s, i, ret_code = 0;
1934         uint_t bufsize;
1935         char *buf = NULL;
1936 
1937         if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
1938                 zerror(zlogp, B_TRUE, "could not get socket");
1939                 ret_code = -1;
1940                 goto bad;
1941         }
1942         lifn.lifn_family = AF_UNSPEC;
1943         lifn.lifn_flags = (int)lifc_flags;
1944         if (ioctl(s, SIOCGLIFNUM, (char *)&lifn) < 0) {
1945                 zerror(zlogp, B_TRUE,
1946                     "could not determine number of network interfaces");
1947                 ret_code = -1;
1948                 goto bad;
1949         }
1950         num_ifs = lifn.lifn_count;
1951         bufsize = num_ifs * sizeof (struct lifreq);
1952         if ((buf = malloc(bufsize)) == NULL) {
1953                 zerror(zlogp, B_TRUE, "memory allocation failed");
1954                 ret_code = -1;
1955                 goto bad;
1956         }
1957         lifc.lifc_family = AF_UNSPEC;
1958         lifc.lifc_flags = (int)lifc_flags;
1959         lifc.lifc_len = bufsize;
1960         lifc.lifc_buf = buf;
1961         if (ioctl(s, SIOCGLIFCONF, (char *)&lifc) < 0) {
1962                 zerror(zlogp, B_TRUE, "could not get configured network "
1963                     "interfaces");
1964                 ret_code = -1;
1965                 goto bad;
1966         }
1967         lifrp = lifc.lifc_req;
1968         for (i = lifc.lifc_len / sizeof (struct lifreq); i > 0; i--, lifrp++) {
1969                 (void) close(s);
1970                 if ((s = socket(lifrp->lifr_addr.ss_family, SOCK_DGRAM, 0)) <
1971                     0) {
1972                         zerror(zlogp, B_TRUE, "%s: could not get socket",
1973                             lifrl.lifr_name);
1974                         ret_code = -1;
1975                         continue;
1976                 }
1977                 (void) memset(&lifrl, 0, sizeof (lifrl));
1978                 (void) strncpy(lifrl.lifr_name, lifrp->lifr_name,
1979                     sizeof (lifrl.lifr_name));
1980                 if (ioctl(s, SIOCGLIFZONE, (caddr_t)&lifrl) < 0) {
1981                         if (errno == ENXIO)
1982                                 /*
1983                                  * Interface may have been removed by admin or
1984                                  * another zone halting.
1985                                  */
1986                                 continue;
1987                         zerror(zlogp, B_TRUE,
1988                             "%s: could not determine the zone to which this "
1989                             "network interface is bound", lifrl.lifr_name);
1990                         ret_code = -1;
1991                         continue;
1992                 }
1993                 if (lifrl.lifr_zoneid == zone_id) {
1994                         if (ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifrl) < 0) {
1995                                 zerror(zlogp, B_TRUE,
1996                                     "%s: could not remove network interface",
1997                                     lifrl.lifr_name);
1998                                 ret_code = -1;
1999                                 continue;
2000                         }
2001                 }
2002         }
2003 bad:
2004         if (s > 0)
2005                 (void) close(s);
2006         if (buf)
2007                 free(buf);
2008         return (ret_code);
2009 }
2010 
2011 static union    sockunion {
2012         struct  sockaddr sa;
2013         struct  sockaddr_in sin;
2014         struct  sockaddr_dl sdl;
2015         struct  sockaddr_in6 sin6;
2016 } so_dst, so_ifp;
2017 
2018 static struct {
2019         struct  rt_msghdr hdr;
2020         char    space[512];
2021 } rtmsg;
2022 
2023 static int
2024 salen(struct sockaddr *sa)
2025 {
2026         switch (sa->sa_family) {
2027         case AF_INET:
2028                 return (sizeof (struct sockaddr_in));
2029         case AF_LINK:
2030                 return (sizeof (struct sockaddr_dl));
2031         case AF_INET6:
2032                 return (sizeof (struct sockaddr_in6));
2033         default:
2034                 return (sizeof (struct sockaddr));
2035         }
2036 }
2037 
2038 #define ROUNDUP_LONG(a) \
2039         ((a) > 0 ? (1 + (((a) - 1) | (sizeof (long) - 1))) : sizeof (long))
2040 
2041 /*
2042  * Look up which zone is using a given IP address.  The address in question
2043  * is expected to have been stuffed into the structure to which lifr points
2044  * via a previous SIOCGLIFADDR ioctl().
2045  *
2046  * This is done using black router socket magic.
2047  *
2048  * Return the name of the zone on success or NULL on failure.
2049  *
2050  * This is a lot of code for a simple task; a new ioctl request to take care
2051  * of this might be a useful RFE.
2052  */
2053 
2054 static char *
2055 who_is_using(zlog_t *zlogp, struct lifreq *lifr)
2056 {
2057         static char answer[ZONENAME_MAX];
2058         pid_t pid;
2059         int s, rlen, l, i;
2060         char *cp = rtmsg.space;
2061         struct sockaddr_dl *ifp = NULL;
2062         struct sockaddr *sa;
2063         char save_if_name[LIFNAMSIZ];
2064 
2065         answer[0] = '\0';
2066 
2067         pid = getpid();
2068         if ((s = socket(PF_ROUTE, SOCK_RAW, 0)) < 0) {
2069                 zerror(zlogp, B_TRUE, "could not get routing socket");
2070                 return (NULL);
2071         }
2072 
2073         if (lifr->lifr_addr.ss_family == AF_INET) {
2074                 struct sockaddr_in *sin4;
2075 
2076                 so_dst.sa.sa_family = AF_INET;
2077                 sin4 = (struct sockaddr_in *)&lifr->lifr_addr;
2078                 so_dst.sin.sin_addr = sin4->sin_addr;
2079         } else {
2080                 struct sockaddr_in6 *sin6;
2081 
2082                 so_dst.sa.sa_family = AF_INET6;
2083                 sin6 = (struct sockaddr_in6 *)&lifr->lifr_addr;
2084                 so_dst.sin6.sin6_addr = sin6->sin6_addr;
2085         }
2086 
2087         so_ifp.sa.sa_family = AF_LINK;
2088 
2089         (void) memset(&rtmsg, 0, sizeof (rtmsg));
2090         rtmsg.hdr.rtm_type = RTM_GET;
2091         rtmsg.hdr.rtm_flags = RTF_UP | RTF_HOST;
2092         rtmsg.hdr.rtm_version = RTM_VERSION;
2093         rtmsg.hdr.rtm_seq = ++rts_seqno;
2094         rtmsg.hdr.rtm_addrs = RTA_IFP | RTA_DST;
2095 
2096         l = ROUNDUP_LONG(salen(&so_dst.sa));
2097         (void) memmove(cp, &(so_dst), l);
2098         cp += l;
2099         l = ROUNDUP_LONG(salen(&so_ifp.sa));
2100         (void) memmove(cp, &(so_ifp), l);
2101         cp += l;
2102 
2103         rtmsg.hdr.rtm_msglen = l = cp - (char *)&rtmsg;
2104 
2105         if ((rlen = write(s, &rtmsg, l)) < 0) {
2106                 zerror(zlogp, B_TRUE, "writing to routing socket");
2107                 return (NULL);
2108         } else if (rlen < (int)rtmsg.hdr.rtm_msglen) {
2109                 zerror(zlogp, B_TRUE,
2110                     "write to routing socket got only %d for len\n", rlen);
2111                 return (NULL);
2112         }
2113         do {
2114                 l = read(s, &rtmsg, sizeof (rtmsg));
2115         } while (l > 0 && (rtmsg.hdr.rtm_seq != rts_seqno ||
2116             rtmsg.hdr.rtm_pid != pid));
2117         if (l < 0) {
2118                 zerror(zlogp, B_TRUE, "reading from routing socket");
2119                 return (NULL);
2120         }
2121 
2122         if (rtmsg.hdr.rtm_version != RTM_VERSION) {
2123                 zerror(zlogp, B_FALSE,
2124                     "routing message version %d not understood",
2125                     rtmsg.hdr.rtm_version);
2126                 return (NULL);
2127         }
2128         if (rtmsg.hdr.rtm_msglen != (ushort_t)l) {
2129                 zerror(zlogp, B_FALSE, "message length mismatch, "
2130                     "expected %d bytes, returned %d bytes",
2131                     rtmsg.hdr.rtm_msglen, l);
2132                 return (NULL);
2133         }
2134         if (rtmsg.hdr.rtm_errno != 0)  {
2135                 errno = rtmsg.hdr.rtm_errno;
2136                 zerror(zlogp, B_TRUE, "RTM_GET routing socket message");
2137                 return (NULL);
2138         }
2139         if ((rtmsg.hdr.rtm_addrs & RTA_IFP) == 0) {
2140                 zerror(zlogp, B_FALSE, "network interface not found");
2141                 return (NULL);
2142         }
2143         cp = ((char *)(&rtmsg.hdr + 1));
2144         for (i = 1; i != 0; i <<= 1) {
2145                 /* LINTED E_BAD_PTR_CAST_ALIGN */
2146                 sa = (struct sockaddr *)cp;
2147                 if (i != RTA_IFP) {
2148                         if ((i & rtmsg.hdr.rtm_addrs) != 0)
2149                                 cp += ROUNDUP_LONG(salen(sa));
2150                         continue;
2151                 }
2152                 if (sa->sa_family == AF_LINK &&
2153                     ((struct sockaddr_dl *)sa)->sdl_nlen != 0)
2154                         ifp = (struct sockaddr_dl *)sa;
2155                 break;
2156         }
2157         if (ifp == NULL) {
2158                 zerror(zlogp, B_FALSE, "network interface could not be "
2159                     "determined");
2160                 return (NULL);
2161         }
2162 
2163         /*
2164          * We need to set the I/F name to what we got above, then do the
2165          * appropriate ioctl to get its zone name.  But lifr->lifr_name is
2166          * used by the calling function to do a REMOVEIF, so if we leave the
2167          * "good" zone's I/F name in place, *that* I/F will be removed instead
2168          * of the bad one.  So we save the old (bad) I/F name before over-
2169          * writing it and doing the ioctl, then restore it after the ioctl.
2170          */
2171         (void) strlcpy(save_if_name, lifr->lifr_name, sizeof (save_if_name));
2172         (void) strncpy(lifr->lifr_name, ifp->sdl_data, ifp->sdl_nlen);
2173         lifr->lifr_name[ifp->sdl_nlen] = '\0';
2174         i = ioctl(s, SIOCGLIFZONE, lifr);
2175         (void) strlcpy(lifr->lifr_name, save_if_name, sizeof (save_if_name));
2176         if (i < 0) {
2177                 zerror(zlogp, B_TRUE,
2178                     "%s: could not determine the zone network interface "
2179                     "belongs to", lifr->lifr_name);
2180                 return (NULL);
2181         }
2182         if (getzonenamebyid(lifr->lifr_zoneid, answer, sizeof (answer)) < 0)
2183                 (void) snprintf(answer, sizeof (answer), "%d",
2184                     lifr->lifr_zoneid);
2185 
2186         if (strlen(answer) > 0)
2187                 return (answer);
2188         return (NULL);
2189 }
2190 
2191 /*
2192  * Configures a single interface: a new virtual interface is added, based on
2193  * the physical interface nwiftabptr->zone_nwif_physical, with the address
2194  * specified in nwiftabptr->zone_nwif_address, for zone zone_id.  Note that
2195  * the "address" can be an IPv6 address (with a /prefixlength required), an
2196  * IPv4 address (with a /prefixlength optional), or a name; for the latter,
2197  * an IPv4 name-to-address resolution will be attempted.
2198  *
2199  * If anything goes wrong, we log an detailed error message, attempt to tear
2200  * down whatever we set up and return an error.
2201  */
2202 static int
2203 configure_one_interface(zlog_t *zlogp, zoneid_t zone_id,
2204     struct zone_nwiftab *nwiftabptr)
2205 {
2206         struct lifreq lifr;
2207         struct sockaddr_in netmask4;
2208         struct sockaddr_in6 netmask6;
2209         struct sockaddr_storage laddr;
2210         struct in_addr in4;
2211         sa_family_t af;
2212         char *slashp = strchr(nwiftabptr->zone_nwif_address, '/');
2213         int s;
2214         boolean_t got_netmask = B_FALSE;
2215         boolean_t is_loopback = B_FALSE;
2216         char addrstr4[INET_ADDRSTRLEN];
2217         int res;
2218 
2219         res = zonecfg_valid_net_address(nwiftabptr->zone_nwif_address, &lifr);
2220         if (res != Z_OK) {
2221                 zerror(zlogp, B_FALSE, "%s: %s", zonecfg_strerror(res),
2222                     nwiftabptr->zone_nwif_address);
2223                 return (-1);
2224         }
2225         af = lifr.lifr_addr.ss_family;
2226         if (af == AF_INET)
2227                 in4 = ((struct sockaddr_in *)(&lifr.lifr_addr))->sin_addr;
2228         if ((s = socket(af, SOCK_DGRAM, 0)) < 0) {
2229                 zerror(zlogp, B_TRUE, "could not get socket");
2230                 return (-1);
2231         }
2232 
2233         /*
2234          * This is a similar kind of "hack" like in addif() to get around
2235          * the problem of SIOCLIFADDIF.  The problem is that this ioctl
2236          * does not include the netmask when adding a logical interface.
2237          * To get around this problem, we first add the logical interface
2238          * with a 0 address.  After that, we set the netmask if provided.
2239          * Finally we set the interface address.
2240          */
2241         laddr = lifr.lifr_addr;
2242         (void) strlcpy(lifr.lifr_name, nwiftabptr->zone_nwif_physical,
2243             sizeof (lifr.lifr_name));
2244         (void) memset(&lifr.lifr_addr, 0, sizeof (lifr.lifr_addr));
2245 
2246         if (ioctl(s, SIOCLIFADDIF, (caddr_t)&lifr) < 0) {
2247                 /*
2248                  * Here, we know that the interface can't be brought up.
2249                  * A similar warning message was already printed out to
2250                  * the console by zoneadm(8) so instead we log the
2251                  * message to syslog and continue.
2252                  */
2253                 (void) close(s);
2254                 return (Z_OK);
2255         }
2256 
2257         /* Preserve literal IPv4 address for later potential printing. */
2258         if (af == AF_INET)
2259                 (void) inet_ntop(AF_INET, &in4, addrstr4, INET_ADDRSTRLEN);
2260 
2261         lifr.lifr_zoneid = zone_id;
2262         if (ioctl(s, SIOCSLIFZONE, (caddr_t)&lifr) < 0) {
2263                 zerror(zlogp, B_TRUE, "%s: could not place network interface "
2264                     "into zone", lifr.lifr_name);
2265                 goto bad;
2266         }
2267 
2268         /*
2269          * Loopback interface will use the default netmask assigned, if no
2270          * netmask is found.
2271          */
2272         if (strcmp(nwiftabptr->zone_nwif_physical, "lo0") == 0) {
2273                 is_loopback = B_TRUE;
2274         }
2275         if (af == AF_INET) {
2276                 /*
2277                  * The IPv4 netmask can be determined either
2278                  * directly if a prefix length was supplied with
2279                  * the address or via the netmasks database.  Not
2280                  * being able to determine it is a common failure,
2281                  * but it often is not fatal to operation of the
2282                  * interface.  In that case, a warning will be
2283                  * printed after the rest of the interface's
2284                  * parameters have been configured.
2285                  */
2286                 (void) memset(&netmask4, 0, sizeof (netmask4));
2287                 if (slashp != NULL) {
2288                         if (addr2netmask(slashp + 1, V4_ADDR_LEN,
2289                             (uchar_t *)&netmask4.sin_addr) != 0) {
2290                                 *slashp = '/';
2291                                 zerror(zlogp, B_FALSE,
2292                                     "%s: invalid prefix length in %s",
2293                                     lifr.lifr_name,
2294                                     nwiftabptr->zone_nwif_address);
2295                                 goto bad;
2296                         }
2297                         got_netmask = B_TRUE;
2298                 } else if (getnetmaskbyaddr(in4,
2299                     &netmask4.sin_addr) == 0) {
2300                         got_netmask = B_TRUE;
2301                 }
2302                 if (got_netmask) {
2303                         netmask4.sin_family = af;
2304                         (void) memcpy(&lifr.lifr_addr, &netmask4,
2305                             sizeof (netmask4));
2306                 }
2307         } else {
2308                 (void) memset(&netmask6, 0, sizeof (netmask6));
2309                 if (addr2netmask(slashp + 1, V6_ADDR_LEN,
2310                     (uchar_t *)&netmask6.sin6_addr) != 0) {
2311                         *slashp = '/';
2312                         zerror(zlogp, B_FALSE,
2313                             "%s: invalid prefix length in %s",
2314                             lifr.lifr_name,
2315                             nwiftabptr->zone_nwif_address);
2316                         goto bad;
2317                 }
2318                 got_netmask = B_TRUE;
2319                 netmask6.sin6_family = af;
2320                 (void) memcpy(&lifr.lifr_addr, &netmask6,
2321                     sizeof (netmask6));
2322         }
2323         if (got_netmask &&
2324             ioctl(s, SIOCSLIFNETMASK, (caddr_t)&lifr) < 0) {
2325                 zerror(zlogp, B_TRUE, "%s: could not set netmask",
2326                     lifr.lifr_name);
2327                 goto bad;
2328         }
2329 
2330         /* Set the interface address */
2331         lifr.lifr_addr = laddr;
2332         if (ioctl(s, SIOCSLIFADDR, (caddr_t)&lifr) < 0) {
2333                 zerror(zlogp, B_TRUE,
2334                     "%s: could not set IP address to %s",
2335                     lifr.lifr_name, nwiftabptr->zone_nwif_address);
2336                 goto bad;
2337         }
2338 
2339         if (ioctl(s, SIOCGLIFFLAGS, (caddr_t)&lifr) < 0) {
2340                 zerror(zlogp, B_TRUE, "%s: could not get flags",
2341                     lifr.lifr_name);
2342                 goto bad;
2343         }
2344         lifr.lifr_flags |= IFF_UP;
2345         if (ioctl(s, SIOCSLIFFLAGS, (caddr_t)&lifr) < 0) {
2346                 int save_errno = errno;
2347                 char *zone_using;
2348 
2349                 /*
2350                  * If we failed with something other than EADDRNOTAVAIL,
2351                  * then skip to the end.  Otherwise, look up our address,
2352                  * then call a function to determine which zone is already
2353                  * using that address.
2354                  */
2355                 if (errno != EADDRNOTAVAIL) {
2356                         zerror(zlogp, B_TRUE,
2357                             "%s: could not bring network interface up",
2358                             lifr.lifr_name);
2359                         goto bad;
2360                 }
2361                 if (ioctl(s, SIOCGLIFADDR, (caddr_t)&lifr) < 0) {
2362                         zerror(zlogp, B_TRUE, "%s: could not get address",
2363                             lifr.lifr_name);
2364                         goto bad;
2365                 }
2366                 zone_using = who_is_using(zlogp, &lifr);
2367                 errno = save_errno;
2368                 if (zone_using == NULL)
2369                         zerror(zlogp, B_TRUE,
2370                             "%s: could not bring network interface up",
2371                             lifr.lifr_name);
2372                 else
2373                         zerror(zlogp, B_TRUE, "%s: could not bring network "
2374                             "interface up: address in use by zone '%s'",
2375                             lifr.lifr_name, zone_using);
2376                 goto bad;
2377         }
2378 
2379         if (!got_netmask && !is_loopback) {
2380                 /*
2381                  * A common, but often non-fatal problem, is that the system
2382                  * cannot find the netmask for an interface address. This is
2383                  * often caused by it being only in /etc/inet/netmasks, but
2384                  * /etc/nsswitch.conf says to use NIS or NIS+ and it's not
2385                  * in that. This doesn't show up at boot because the netmask
2386                  * is obtained from /etc/inet/netmasks when no network
2387                  * interfaces are up, but isn't consulted when NIS/NIS+ is
2388                  * available. We warn the user here that something like this
2389                  * has happened and we're just running with a default and
2390                  * possible incorrect netmask.
2391                  */
2392                 char buffer[INET6_ADDRSTRLEN];
2393                 void  *addr;
2394                 const char *nomatch = "no matching subnet found in netmasks(5)";
2395 
2396                 if (af == AF_INET)
2397                         addr = &((struct sockaddr_in *)
2398                             (&lifr.lifr_addr))->sin_addr;
2399                 else
2400                         addr = &((struct sockaddr_in6 *)
2401                             (&lifr.lifr_addr))->sin6_addr;
2402 
2403                 /*
2404                  * Find out what netmask the interface is going to be using.
2405                  * If we just brought up an IPMP data address on an underlying
2406                  * interface above, the address will have already migrated, so
2407                  * the SIOCGLIFNETMASK won't be able to find it (but we need
2408                  * to bring the address up to get the actual netmask).  Just
2409                  * omit printing the actual netmask in this corner-case.
2410                  */
2411                 if (ioctl(s, SIOCGLIFNETMASK, (caddr_t)&lifr) < 0 ||
2412                     inet_ntop(af, addr, buffer, sizeof (buffer)) == NULL) {
2413                         zerror(zlogp, B_FALSE, "WARNING: %s; using default.",
2414                             nomatch);
2415                 } else {
2416                         zerror(zlogp, B_FALSE,
2417                             "WARNING: %s: %s: %s; using default of %s.",
2418                             lifr.lifr_name, nomatch, addrstr4, buffer);
2419                 }
2420         }
2421 
2422         /*
2423          * If a default router was specified for this interface
2424          * set the route now. Ignore if already set.
2425          */
2426         if (strlen(nwiftabptr->zone_nwif_defrouter) > 0) {
2427                 int status;
2428                 char *argv[7];
2429 
2430                 argv[0] = "route";
2431                 argv[1] = "add";
2432                 argv[2] = "-ifp";
2433                 argv[3] = nwiftabptr->zone_nwif_physical;
2434                 argv[4] = "default";
2435                 argv[5] = nwiftabptr->zone_nwif_defrouter;
2436                 argv[6] = NULL;
2437 
2438                 status = forkexec(zlogp, "/usr/sbin/route", argv);
2439                 if (status != 0 && status != EEXIST)
2440                         zerror(zlogp, B_FALSE, "Unable to set route for "
2441                             "interface %s to %s\n",
2442                             nwiftabptr->zone_nwif_physical,
2443                             nwiftabptr->zone_nwif_defrouter);
2444         }
2445 
2446         (void) close(s);
2447         return (Z_OK);
2448 bad:
2449         (void) ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifr);
2450         (void) close(s);
2451         return (-1);
2452 }
2453 
2454 /*
2455  * Sets up network interfaces based on information from the zone configuration.
2456  * IPv4 and IPv6 loopback interfaces are set up "for free", modeling the global
2457  * system.
2458  *
2459  * If anything goes wrong, we log a general error message, attempt to tear down
2460  * whatever we set up, and return an error.
2461  */
2462 static int
2463 configure_shared_network_interfaces(zlog_t *zlogp)
2464 {
2465         struct zone_nwiftab nwiftab, loopback_iftab;
2466         zoneid_t zoneid;
2467 
2468         if ((zoneid = getzoneidbyname(zone_name)) == ZONE_ID_UNDEFINED) {
2469                 zerror(zlogp, B_TRUE, "unable to get zoneid");
2470                 return (-1);
2471         }
2472 
2473         if (zonecfg_setnwifent(snap_hndl) == Z_OK) {
2474                 for (;;) {
2475                         if (zonecfg_getnwifent(snap_hndl, &nwiftab) != Z_OK)
2476                                 break;
2477                         nwifent_free_attrs(&nwiftab);
2478                         if (configure_one_interface(zlogp, zoneid, &nwiftab) !=
2479                             Z_OK) {
2480                                 (void) zonecfg_endnwifent(snap_hndl);
2481                                 return (-1);
2482                         }
2483                 }
2484                 (void) zonecfg_endnwifent(snap_hndl);
2485         }
2486         if (is_system_labeled()) {
2487                 /*
2488                  * Labeled zones share the loopback interface
2489                  * so it is not plumbed for shared stack instances.
2490                  */
2491                 return (0);
2492         }
2493         (void) strlcpy(loopback_iftab.zone_nwif_physical, "lo0",
2494             sizeof (loopback_iftab.zone_nwif_physical));
2495         (void) strlcpy(loopback_iftab.zone_nwif_address, "127.0.0.1",
2496             sizeof (loopback_iftab.zone_nwif_address));
2497         loopback_iftab.zone_nwif_defrouter[0] = '\0';
2498         if (configure_one_interface(zlogp, zoneid, &loopback_iftab) != Z_OK)
2499                 return (-1);
2500 
2501         /* Always plumb up the IPv6 loopback interface. */
2502         (void) strlcpy(loopback_iftab.zone_nwif_address, "::1/128",
2503             sizeof (loopback_iftab.zone_nwif_address));
2504         if (configure_one_interface(zlogp, zoneid, &loopback_iftab) != Z_OK)
2505                 return (-1);
2506         return (0);
2507 }
2508 
2509 static void
2510 zdlerror(zlog_t *zlogp, dladm_status_t err, const char *dlname, const char *str)
2511 {
2512         char errmsg[DLADM_STRSIZE];
2513 
2514         (void) dladm_status2str(err, errmsg);
2515         zerror(zlogp, B_FALSE, "%s '%s': %s", str, dlname, errmsg);
2516 }
2517 
2518 static int
2519 add_datalink(zlog_t *zlogp, char *zone_name, datalink_id_t linkid, char *dlname)
2520 {
2521         dladm_status_t err;
2522         boolean_t cpuset, poolset;
2523         char *poolp;
2524 
2525         /* First check if it's in use by global zone. */
2526         if (zonecfg_ifname_exists(AF_INET, dlname) ||
2527             zonecfg_ifname_exists(AF_INET6, dlname)) {
2528                 zerror(zlogp, B_FALSE, "WARNING: skipping network interface "
2529                     "'%s' which is used in the global zone", dlname);
2530                 return (-1);
2531         }
2532 
2533         /* Set zoneid of this link. */
2534         err = dladm_set_linkprop(dld_handle, linkid, "zone", &zone_name, 1,
2535             DLADM_OPT_ACTIVE);
2536         if (err != DLADM_STATUS_OK) {
2537                 zdlerror(zlogp, err, dlname,
2538                     "WARNING: unable to add network interface");
2539                 return (-1);
2540         }
2541 
2542         /*
2543          * Set the pool of this link if the zone has a pool and
2544          * neither the cpus nor the pool datalink property is
2545          * already set.
2546          */
2547         err = dladm_linkprop_is_set(dld_handle, linkid, DLADM_PROP_VAL_CURRENT,
2548             "cpus", &cpuset);
2549         if (err != DLADM_STATUS_OK) {
2550                 zdlerror(zlogp, err, dlname,
2551                     "WARNING: unable to check if cpus link property is set");
2552         }
2553         err = dladm_linkprop_is_set(dld_handle, linkid, DLADM_PROP_VAL_CURRENT,
2554             "pool", &poolset);
2555         if (err != DLADM_STATUS_OK) {
2556                 zdlerror(zlogp, err, dlname,
2557                     "WARNING: unable to check if pool link property is set");
2558         }
2559 
2560         if ((strlen(pool_name) != 0) && !cpuset && !poolset) {
2561                 poolp = pool_name;
2562                 err = dladm_set_linkprop(dld_handle, linkid, "pool",
2563                     &poolp, 1, DLADM_OPT_ACTIVE);
2564                 if (err != DLADM_STATUS_OK) {
2565                         zerror(zlogp, B_FALSE, "WARNING: unable to set "
2566                             "pool %s to datalink %s", pool_name, dlname);
2567                         bzero(pool_name, sizeof (pool_name));
2568                 }
2569         } else {
2570                 bzero(pool_name, sizeof (pool_name));
2571         }
2572         return (0);
2573 }
2574 
2575 static boolean_t
2576 sockaddr_to_str(sa_family_t af, const struct sockaddr *sockaddr,
2577     char *straddr, size_t len)
2578 {
2579         struct sockaddr_in *sin;
2580         struct sockaddr_in6 *sin6;
2581         const char *str = NULL;
2582 
2583         if (af == AF_INET) {
2584                 /* LINTED E_BAD_PTR_CAST_ALIGN */
2585                 sin = SIN(sockaddr);
2586                 str = inet_ntop(AF_INET, (void *)&sin->sin_addr, straddr, len);
2587         } else if (af == AF_INET6) {
2588                 /* LINTED E_BAD_PTR_CAST_ALIGN */
2589                 sin6 = SIN6(sockaddr);
2590                 str = inet_ntop(AF_INET6, (void *)&sin6->sin6_addr, straddr,
2591                     len);
2592         }
2593 
2594         return (str != NULL);
2595 }
2596 
2597 static int
2598 ipv4_prefixlen(struct sockaddr_in *sin)
2599 {
2600         struct sockaddr_in *m;
2601         struct sockaddr_storage mask;
2602 
2603         m = SIN(&mask);
2604         m->sin_family = AF_INET;
2605         if (getnetmaskbyaddr(sin->sin_addr, &m->sin_addr) == 0) {
2606                 return (mask2plen((struct sockaddr *)&mask));
2607         } else if (IN_CLASSA(htonl(sin->sin_addr.s_addr))) {
2608                 return (8);
2609         } else if (IN_CLASSB(ntohl(sin->sin_addr.s_addr))) {
2610                 return (16);
2611         } else if (IN_CLASSC(ntohl(sin->sin_addr.s_addr))) {
2612                 return (24);
2613         }
2614         return (0);
2615 }
2616 
2617 static int
2618 zone_setattr_network(int type, zoneid_t zoneid, datalink_id_t linkid,
2619     void *buf, size_t bufsize)
2620 {
2621         zone_net_data_t *zndata;
2622         size_t znsize;
2623         int err;
2624 
2625         znsize = sizeof (*zndata) + bufsize;
2626         zndata = calloc(1, znsize);
2627         if (zndata == NULL)
2628                 return (ENOMEM);
2629         zndata->zn_type = type;
2630         zndata->zn_len = bufsize;
2631         zndata->zn_linkid = linkid;
2632         bcopy(buf, zndata->zn_val, zndata->zn_len);
2633         err = zone_setattr(zoneid, ZONE_ATTR_NETWORK, zndata, znsize);
2634         free(zndata);
2635         return (err);
2636 }
2637 
2638 static int
2639 add_net_for_linkid(zlog_t *zlogp, zoneid_t zoneid, zone_addr_list_t *start)
2640 {
2641         struct lifreq lifr;
2642         char **astr, *address;
2643         dladm_status_t dlstatus;
2644         char *ip_nospoof = "ip-nospoof";
2645         int nnet, naddr, err = 0, j;
2646         size_t zlen, cpleft;
2647         zone_addr_list_t *ptr, *end;
2648         char  tmp[INET6_ADDRSTRLEN], *maskstr;
2649         char *zaddr, *cp;
2650         struct in6_addr *routes = NULL;
2651         boolean_t is_set;
2652         datalink_id_t linkid;
2653 
2654         assert(start != NULL);
2655         naddr = 0; /* number of addresses */
2656         nnet = 0; /* number of net resources */
2657         linkid = start->za_linkid;
2658         for (ptr = start; ptr != NULL && ptr->za_linkid == linkid;
2659             ptr = ptr->za_next) {
2660                 nnet++;
2661         }
2662         end = ptr;
2663         zlen = nnet * (INET6_ADDRSTRLEN + 1);
2664         astr = calloc(1, nnet * sizeof (uintptr_t));
2665         zaddr = calloc(1, zlen);
2666         if (astr == NULL || zaddr == NULL) {
2667                 err = ENOMEM;
2668                 goto done;
2669         }
2670         cp = zaddr;
2671         cpleft = zlen;
2672         j = 0;
2673         for (ptr = start; ptr != end; ptr = ptr->za_next) {
2674                 address = ptr->za_nwiftab.zone_nwif_allowed_address;
2675                 if (address[0] == '\0')
2676                         continue;
2677                 (void) snprintf(tmp, sizeof (tmp), "%s", address);
2678                 /*
2679                  * Validate the data. zonecfg_valid_net_address() clobbers
2680                  * the /<mask> in the address string.
2681                  */
2682                 if (zonecfg_valid_net_address(address, &lifr) != Z_OK) {
2683                         zerror(zlogp, B_FALSE, "invalid address [%s]\n",
2684                             address);
2685                         err = EINVAL;
2686                         goto done;
2687                 }
2688                 /*
2689                  * convert any hostnames to numeric address strings.
2690                  */
2691                 if (!sockaddr_to_str(lifr.lifr_addr.ss_family,
2692                     (const struct sockaddr *)&lifr.lifr_addr, cp, cpleft)) {
2693                         err = EINVAL;
2694                         goto done;
2695                 }
2696                 /*
2697                  * make a copy of the numeric string for the data needed
2698                  * by the "allowed-ips" datalink property.
2699                  */
2700                 astr[j] = strdup(cp);
2701                 if (astr[j] == NULL) {
2702                         err = ENOMEM;
2703                         goto done;
2704                 }
2705                 j++;
2706                 /*
2707                  * compute the default netmask from the address, if necessary
2708                  */
2709                 if ((maskstr = strchr(tmp, '/')) == NULL) {
2710                         int prefixlen;
2711 
2712                         if (lifr.lifr_addr.ss_family == AF_INET) {
2713                                 prefixlen = ipv4_prefixlen(
2714                                     SIN(&lifr.lifr_addr));
2715                         } else {
2716                                 struct sockaddr_in6 *sin6;
2717 
2718                                 sin6 = SIN6(&lifr.lifr_addr);
2719                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2720                                         prefixlen = 10;
2721                                 else
2722                                         prefixlen = 64;
2723                         }
2724                         (void) snprintf(tmp, sizeof (tmp), "%d", prefixlen);
2725                         maskstr = tmp;
2726                 } else {
2727                         maskstr++;
2728                 }
2729                 /* append the "/<netmask>" */
2730                 (void) strlcat(cp, "/", cpleft);
2731                 (void) strlcat(cp, maskstr, cpleft);
2732                 (void) strlcat(cp, ",", cpleft);
2733                 cp += strnlen(cp, zlen);
2734                 cpleft = &zaddr[INET6_ADDRSTRLEN] - cp;
2735         }
2736         naddr = j; /* the actual number of addresses in the net resource */
2737         assert(naddr <= nnet);
2738 
2739         /*
2740          * zonecfg has already verified that the defrouter property can only
2741          * be set if there is at least one address defined for the net resource.
2742          * If j is 0, there are no addresses defined, and therefore no routers
2743          * to configure, and we are done at that point.
2744          */
2745         if (j == 0)
2746                 goto done;
2747 
2748         /* over-write last ',' with '\0' */
2749         zaddr[strnlen(zaddr, zlen) - 1] = '\0';
2750 
2751         /*
2752          * First make sure L3 protection is not already set on the link.
2753          */
2754         dlstatus = dladm_linkprop_is_set(dld_handle, linkid, DLADM_OPT_ACTIVE,
2755             "protection", &is_set);
2756         if (dlstatus != DLADM_STATUS_OK) {
2757                 err = EINVAL;
2758                 zerror(zlogp, B_FALSE, "unable to check if protection is set");
2759                 goto done;
2760         }
2761         if (is_set) {
2762                 err = EINVAL;
2763                 zerror(zlogp, B_FALSE, "Protection is already set");
2764                 goto done;
2765         }
2766         dlstatus = dladm_linkprop_is_set(dld_handle, linkid, DLADM_OPT_ACTIVE,
2767             "allowed-ips", &is_set);
2768         if (dlstatus != DLADM_STATUS_OK) {
2769                 err = EINVAL;
2770                 zerror(zlogp, B_FALSE, "unable to check if allowed-ips is set");
2771                 goto done;
2772         }
2773         if (is_set) {
2774                 zerror(zlogp, B_FALSE, "allowed-ips is already set");
2775                 err = EINVAL;
2776                 goto done;
2777         }
2778 
2779         /*
2780          * Enable ip-nospoof for the link, and add address to the allowed-ips
2781          * list.
2782          */
2783         dlstatus = dladm_set_linkprop(dld_handle, linkid, "protection",
2784             &ip_nospoof, 1, DLADM_OPT_ACTIVE);
2785         if (dlstatus != DLADM_STATUS_OK) {
2786                 zerror(zlogp, B_FALSE, "could not set protection\n");
2787                 err = EINVAL;
2788                 goto done;
2789         }
2790         dlstatus = dladm_set_linkprop(dld_handle, linkid, "allowed-ips",
2791             astr, naddr, DLADM_OPT_ACTIVE);
2792         if (dlstatus != DLADM_STATUS_OK) {
2793                 zerror(zlogp, B_FALSE, "could not set allowed-ips\n");
2794                 err = EINVAL;
2795                 goto done;
2796         }
2797 
2798         /* now set the address in the data-store */
2799         err = zone_setattr_network(ZONE_NETWORK_ADDRESS, zoneid, linkid,
2800             zaddr, strnlen(zaddr, zlen) + 1);
2801         if (err != 0)
2802                 goto done;
2803 
2804         /*
2805          * add the defaultrouters
2806          */
2807         routes = calloc(1, nnet * sizeof (*routes));
2808         j = 0;
2809         for (ptr = start; ptr != end; ptr = ptr->za_next) {
2810                 address = ptr->za_nwiftab.zone_nwif_defrouter;
2811                 if (address[0] == '\0')
2812                         continue;
2813                 if (strchr(address, '/') == NULL && strchr(address, ':') != 0) {
2814                         /*
2815                          * zonecfg_valid_net_address() expects numeric IPv6
2816                          * addresses to have a CIDR format netmask.
2817                          */
2818                         (void) snprintf(tmp, sizeof (tmp), "/%d", V6_ADDR_LEN);
2819                         (void) strlcat(address, tmp, INET6_ADDRSTRLEN);
2820                 }
2821                 if (zonecfg_valid_net_address(address, &lifr) != Z_OK) {
2822                         zerror(zlogp, B_FALSE,
2823                             "invalid router [%s]\n", address);
2824                         err = EINVAL;
2825                         goto done;
2826                 }
2827                 if (lifr.lifr_addr.ss_family == AF_INET6) {
2828                         routes[j] = SIN6(&lifr.lifr_addr)->sin6_addr;
2829                 } else {
2830                         IN6_INADDR_TO_V4MAPPED(&SIN(&lifr.lifr_addr)->sin_addr,
2831                             &routes[j]);
2832                 }
2833                 j++;
2834         }
2835         assert(j <= nnet);
2836         if (j > 0) {
2837                 err = zone_setattr_network(ZONE_NETWORK_DEFROUTER, zoneid,
2838                     linkid, routes, j * sizeof (*routes));
2839         }
2840 done:
2841         free(routes);
2842         for (j = 0; j < naddr; j++)
2843                 free(astr[j]);
2844         free(astr);
2845         free(zaddr);
2846         return (err);
2847 
2848 }
2849 
2850 static int
2851 add_net(zlog_t *zlogp, zoneid_t zoneid, zone_addr_list_t *zalist)
2852 {
2853         zone_addr_list_t *ptr;
2854         datalink_id_t linkid;
2855         int err;
2856 
2857         if (zalist == NULL)
2858                 return (0);
2859 
2860         linkid = zalist->za_linkid;
2861 
2862         err = add_net_for_linkid(zlogp, zoneid, zalist);
2863         if (err != 0)
2864                 return (err);
2865 
2866         for (ptr = zalist; ptr != NULL; ptr = ptr->za_next) {
2867                 if (ptr->za_linkid == linkid)
2868                         continue;
2869                 linkid = ptr->za_linkid;
2870                 err = add_net_for_linkid(zlogp, zoneid, ptr);
2871                 if (err != 0)
2872                         return (err);
2873         }
2874         return (0);
2875 }
2876 
2877 /*
2878  * Add "new" to the list of network interfaces to be configured  by
2879  * add_net on zone boot in "old". The list of interfaces in "old" is
2880  * sorted by datalink_id_t, with interfaces sorted FIFO for a given
2881  * datalink_id_t.
2882  *
2883  * Returns the merged list of IP interfaces containing "old" and "new"
2884  */
2885 static zone_addr_list_t *
2886 add_ip_interface(zone_addr_list_t *old, zone_addr_list_t *new)
2887 {
2888         zone_addr_list_t *ptr, *next;
2889         datalink_id_t linkid = new->za_linkid;
2890 
2891         assert(old != new);
2892 
2893         if (old == NULL)
2894                 return (new);
2895         for (ptr = old; ptr != NULL; ptr = ptr->za_next) {
2896                 if (ptr->za_linkid == linkid)
2897                         break;
2898         }
2899         if (ptr == NULL) {
2900                 /* linkid does not already exist, add to the beginning */
2901                 new->za_next = old;
2902                 return (new);
2903         }
2904         /*
2905          * adding to the middle of the list; ptr points at the first
2906          * occurrence of linkid. Find the last occurrence.
2907          */
2908         while ((next = ptr->za_next) != NULL) {
2909                 if (next->za_linkid != linkid)
2910                         break;
2911                 ptr = next;
2912         }
2913         /* insert new after ptr */
2914         new->za_next = next;
2915         ptr->za_next = new;
2916         return (old);
2917 }
2918 
2919 void
2920 free_ip_interface(zone_addr_list_t *zalist)
2921 {
2922         zone_addr_list_t *ptr, *new;
2923 
2924         for (ptr = zalist; ptr != NULL;) {
2925                 new = ptr;
2926                 ptr = ptr->za_next;
2927                 free(new);
2928         }
2929 }
2930 
2931 /*
2932  * Add the kernel access control information for the interface names.
2933  * If anything goes wrong, we log a general error message, attempt to tear down
2934  * whatever we set up, and return an error.
2935  */
2936 static int
2937 configure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
2938 {
2939         struct zone_nwiftab nwiftab;
2940         char rootpath[MAXPATHLEN];
2941         char path[MAXPATHLEN];
2942         datalink_id_t linkid;
2943         di_prof_t prof = NULL;
2944         boolean_t added = B_FALSE;
2945         zone_addr_list_t *zalist = NULL, *new;
2946 
2947         if (zonecfg_setnwifent(snap_hndl) != Z_OK)
2948                 return (0);
2949 
2950         for (;;) {
2951                 if (zonecfg_getnwifent(snap_hndl, &nwiftab) != Z_OK)
2952                         break;
2953 
2954                 nwifent_free_attrs(&nwiftab);
2955                 if (prof == NULL) {
2956                         if (zone_get_devroot(zone_name, rootpath,
2957                             sizeof (rootpath)) != Z_OK) {
2958                                 (void) zonecfg_endnwifent(snap_hndl);
2959                                 zerror(zlogp, B_TRUE,
2960                                     "unable to determine dev root");
2961                                 return (-1);
2962                         }
2963                         (void) snprintf(path, sizeof (path), "%s%s", rootpath,
2964                             "/dev");
2965                         if (di_prof_init(path, &prof) != 0) {
2966                                 (void) zonecfg_endnwifent(snap_hndl);
2967                                 zerror(zlogp, B_TRUE,
2968                                     "failed to initialize profile");
2969                                 return (-1);
2970                         }
2971                 }
2972 
2973                 /*
2974                  * Create the /dev entry for backward compatibility.
2975                  * Only create the /dev entry if it's not in use.
2976                  * Note that the zone still boots when the assigned
2977                  * interface is inaccessible, used by others, etc.
2978                  * Also, when vanity naming is used, some interface do
2979                  * do not have corresponding /dev node names (for example,
2980                  * vanity named aggregations).  The /dev entry is not
2981                  * created in that case.  The /dev/net entry is always
2982                  * accessible.
2983                  */
2984                 if (dladm_name2info(dld_handle, nwiftab.zone_nwif_physical,
2985                     &linkid, NULL, NULL, NULL) == DLADM_STATUS_OK &&
2986                     add_datalink(zlogp, zone_name, linkid,
2987                     nwiftab.zone_nwif_physical) == 0) {
2988                         added = B_TRUE;
2989                 } else {
2990                         /*
2991                          * Failed to add network device, but the brand hook
2992                          * might be doing this for us, so keep silent.
2993                          */
2994                         continue;
2995                 }
2996                 /* set up the new IP interface, and add them all later */
2997                 new = malloc(sizeof (*new));
2998                 if (new == NULL) {
2999                         zerror(zlogp, B_TRUE, "no memory for %s",
3000                             nwiftab.zone_nwif_physical);
3001                         free_ip_interface(zalist);
3002                 }
3003                 bzero(new, sizeof (*new));
3004                 new->za_nwiftab = nwiftab;
3005                 new->za_linkid = linkid;
3006                 zalist = add_ip_interface(zalist, new);
3007         }
3008         if (zalist != NULL) {
3009                 if ((errno = add_net(zlogp, zoneid, zalist)) != 0) {
3010                         (void) zonecfg_endnwifent(snap_hndl);
3011                         zerror(zlogp, B_TRUE, "failed to add address");
3012                         free_ip_interface(zalist);
3013                         return (-1);
3014                 }
3015                 free_ip_interface(zalist);
3016         }
3017         (void) zonecfg_endnwifent(snap_hndl);
3018 
3019         if (prof != NULL && added) {
3020                 if (di_prof_commit(prof) != 0) {
3021                         zerror(zlogp, B_TRUE, "failed to commit profile");
3022                         return (-1);
3023                 }
3024         }
3025         if (prof != NULL)
3026                 di_prof_fini(prof);
3027 
3028         return (0);
3029 }
3030 
3031 static int
3032 remove_datalink_pool(zlog_t *zlogp, zoneid_t zoneid)
3033 {
3034         ushort_t flags;
3035         zone_iptype_t iptype;
3036         int i, dlnum = 0;
3037         datalink_id_t *dllink, *dllinks = NULL;
3038         dladm_status_t err;
3039 
3040         if (strlen(pool_name) == 0)
3041                 return (0);
3042 
3043         if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
3044             sizeof (flags)) < 0) {
3045                 if (vplat_get_iptype(zlogp, &iptype) < 0) {
3046                         zerror(zlogp, B_FALSE, "unable to determine ip-type");
3047                         return (-1);
3048                 }
3049         } else {
3050                 if (flags & ZF_NET_EXCL)
3051                         iptype = ZS_EXCLUSIVE;
3052                 else
3053                         iptype = ZS_SHARED;
3054         }
3055 
3056         if (iptype == ZS_EXCLUSIVE) {
3057                 /*
3058                  * Get the datalink count and for each datalink,
3059                  * attempt to clear the pool property and clear
3060                  * the pool_name.
3061                  */
3062                 if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
3063                         zerror(zlogp, B_TRUE, "unable to count network "
3064                             "interfaces");
3065                         return (-1);
3066                 }
3067 
3068                 if (dlnum == 0)
3069                         return (0);
3070 
3071                 if ((dllinks = malloc(dlnum * sizeof (datalink_id_t)))
3072                     == NULL) {
3073                         zerror(zlogp, B_TRUE, "memory allocation failed");
3074                         return (-1);
3075                 }
3076                 if (zone_list_datalink(zoneid, &dlnum, dllinks) != 0) {
3077                         zerror(zlogp, B_TRUE, "unable to list network "
3078                             "interfaces");
3079                         return (-1);
3080                 }
3081 
3082                 bzero(pool_name, sizeof (pool_name));
3083                 for (i = 0, dllink = dllinks; i < dlnum; i++, dllink++) {
3084                         err = dladm_set_linkprop(dld_handle, *dllink, "pool",
3085                             NULL, 0, DLADM_OPT_ACTIVE);
3086                         if (err != DLADM_STATUS_OK) {
3087                                 zerror(zlogp, B_TRUE,
3088                                     "WARNING: unable to clear pool");
3089                         }
3090                 }
3091                 free(dllinks);
3092         }
3093         return (0);
3094 }
3095 
3096 static int
3097 remove_datalink_protect(zlog_t *zlogp, zoneid_t zoneid)
3098 {
3099         ushort_t flags;
3100         zone_iptype_t iptype;
3101         int i, dlnum = 0;
3102         dladm_status_t dlstatus;
3103         datalink_id_t *dllink, *dllinks = NULL;
3104 
3105         if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
3106             sizeof (flags)) < 0) {
3107                 if (vplat_get_iptype(zlogp, &iptype) < 0) {
3108                         zerror(zlogp, B_FALSE, "unable to determine ip-type");
3109                         return (-1);
3110                 }
3111         } else {
3112                 if (flags & ZF_NET_EXCL)
3113                         iptype = ZS_EXCLUSIVE;
3114                 else
3115                         iptype = ZS_SHARED;
3116         }
3117 
3118         if (iptype != ZS_EXCLUSIVE)
3119                 return (0);
3120 
3121         /*
3122          * Get the datalink count and for each datalink,
3123          * attempt to clear the pool property and clear
3124          * the pool_name.
3125          */
3126         if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
3127                 zerror(zlogp, B_TRUE, "unable to count network interfaces");
3128                 return (-1);
3129         }
3130 
3131         if (dlnum == 0)
3132                 return (0);
3133 
3134         if ((dllinks = malloc(dlnum * sizeof (datalink_id_t))) == NULL) {
3135                 zerror(zlogp, B_TRUE, "memory allocation failed");
3136                 return (-1);
3137         }
3138         if (zone_list_datalink(zoneid, &dlnum, dllinks) != 0) {
3139                 zerror(zlogp, B_TRUE, "unable to list network interfaces");
3140                 free(dllinks);
3141                 return (-1);
3142         }
3143 
3144         for (i = 0, dllink = dllinks; i < dlnum; i++, dllink++) {
3145                 char dlerr[DLADM_STRSIZE];
3146 
3147                 dlstatus = dladm_set_linkprop(dld_handle, *dllink,
3148                     "protection", NULL, 0, DLADM_OPT_ACTIVE);
3149                 if (dlstatus == DLADM_STATUS_NOTFOUND) {
3150                         /* datalink does not belong to the GZ */
3151                         continue;
3152                 }
3153                 if (dlstatus != DLADM_STATUS_OK)
3154                         zerror(zlogp, B_FALSE,
3155                             "clear 'protection' link property: %s",
3156                             dladm_status2str(dlstatus, dlerr));
3157 
3158                 dlstatus = dladm_set_linkprop(dld_handle, *dllink,
3159                     "allowed-ips", NULL, 0, DLADM_OPT_ACTIVE);
3160                 if (dlstatus != DLADM_STATUS_OK)
3161                         zerror(zlogp, B_FALSE,
3162                             "clear 'allowed-ips' link property: %s",
3163                             dladm_status2str(dlstatus, dlerr));
3164         }
3165         free(dllinks);
3166         return (0);
3167 }
3168 
3169 static int
3170 tcp_abort_conn(zlog_t *zlogp, zoneid_t zoneid,
3171     const struct sockaddr_storage *local, const struct sockaddr_storage *remote)
3172 {
3173         int fd;
3174         struct strioctl ioc;
3175         tcp_ioc_abort_conn_t conn;
3176         int error;
3177 
3178         conn.ac_local = *local;
3179         conn.ac_remote = *remote;
3180         conn.ac_start = TCPS_SYN_SENT;
3181         conn.ac_end = TCPS_TIME_WAIT;
3182         conn.ac_zoneid = zoneid;
3183 
3184         ioc.ic_cmd = TCP_IOC_ABORT_CONN;
3185         ioc.ic_timout = -1; /* infinite timeout */
3186         ioc.ic_len = sizeof (conn);
3187         ioc.ic_dp = (char *)&conn;
3188 
3189         if ((fd = open("/dev/tcp", O_RDONLY)) < 0) {
3190                 zerror(zlogp, B_TRUE, "unable to open %s", "/dev/tcp");
3191                 return (-1);
3192         }
3193 
3194         error = ioctl(fd, I_STR, &ioc);
3195         (void) close(fd);
3196         if (error == 0 || errno == ENOENT)      /* ENOENT is not an error */
3197                 return (0);
3198         return (-1);
3199 }
3200 
3201 static int
3202 tcp_abort_connections(zlog_t *zlogp, zoneid_t zoneid)
3203 {
3204         struct sockaddr_storage l, r;
3205         struct sockaddr_in *local, *remote;
3206         struct sockaddr_in6 *local6, *remote6;
3207         int error;
3208 
3209         /*
3210          * Abort IPv4 connections.
3211          */
3212         bzero(&l, sizeof (*local));
3213         local = (struct sockaddr_in *)&l;
3214         local->sin_family = AF_INET;
3215         local->sin_addr.s_addr = INADDR_ANY;
3216         local->sin_port = 0;
3217 
3218         bzero(&r, sizeof (*remote));
3219         remote = (struct sockaddr_in *)&r;
3220         remote->sin_family = AF_INET;
3221         remote->sin_addr.s_addr = INADDR_ANY;
3222         remote->sin_port = 0;
3223 
3224         if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
3225                 return (error);
3226 
3227         /*
3228          * Abort IPv6 connections.
3229          */
3230         bzero(&l, sizeof (*local6));
3231         local6 = (struct sockaddr_in6 *)&l;
3232         local6->sin6_family = AF_INET6;
3233         local6->sin6_port = 0;
3234         local6->sin6_addr = in6addr_any;
3235 
3236         bzero(&r, sizeof (*remote6));
3237         remote6 = (struct sockaddr_in6 *)&r;
3238         remote6->sin6_family = AF_INET6;
3239         remote6->sin6_port = 0;
3240         remote6->sin6_addr = in6addr_any;
3241 
3242         if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
3243                 return (error);
3244         return (0);
3245 }
3246 
3247 static int
3248 get_privset(zlog_t *zlogp, priv_set_t *privs, zone_mnt_t mount_cmd)
3249 {
3250         int error = -1;
3251         char *privname = NULL;
3252 
3253         if (ALT_MOUNT(mount_cmd)) {
3254                 zone_iptype_t   iptype;
3255                 const char      *curr_iptype = NULL;
3256 
3257                 if (zonecfg_get_iptype(snap_hndl, &iptype) != Z_OK) {
3258                         zerror(zlogp, B_TRUE, "unable to determine ip-type");
3259                         return (-1);
3260                 }
3261 
3262                 switch (iptype) {
3263                 case ZS_SHARED:
3264                         curr_iptype = "shared";
3265                         break;
3266                 case ZS_EXCLUSIVE:
3267                         curr_iptype = "exclusive";
3268                         break;
3269                 default:
3270                         zerror(zlogp, B_FALSE, "bad ip-type");
3271                         return (-1);
3272                 }
3273 
3274                 if (zonecfg_default_privset(privs, curr_iptype) == Z_OK)
3275                         return (0);
3276 
3277                 zerror(zlogp, B_FALSE,
3278                     "failed to determine the zone's default privilege set");
3279                 return (-1);
3280         }
3281 
3282         switch (zonecfg_get_privset(snap_hndl, privs, &privname)) {
3283         case Z_OK:
3284                 error = 0;
3285                 break;
3286         case Z_PRIV_PROHIBITED:
3287                 zerror(zlogp, B_FALSE, "privilege \"%s\" is not permitted "
3288                     "within the zone's privilege set", privname);
3289                 break;
3290         case Z_PRIV_REQUIRED:
3291                 zerror(zlogp, B_FALSE, "required privilege \"%s\" is missing "
3292                     "from the zone's privilege set", privname);
3293                 break;
3294         case Z_PRIV_UNKNOWN:
3295                 zerror(zlogp, B_FALSE, "unknown privilege \"%s\" specified "
3296                     "in the zone's privilege set", privname);
3297                 break;
3298         default:
3299                 zerror(zlogp, B_FALSE, "failed to determine the zone's "
3300                     "privilege set");
3301                 break;
3302         }
3303 
3304         free(privname);
3305         return (error);
3306 }
3307 
3308 static char *
3309 zone_proj_rctl(const char *name)
3310 {
3311         int i;
3312 
3313         for (i = 0; zone_proj_rctl_map[i].zpr_zone_rctl != NULL; i++) {
3314                 if (strcmp(name, zone_proj_rctl_map[i].zpr_zone_rctl) == 0) {
3315                         return (zone_proj_rctl_map[i].zpr_project_rctl);
3316                 }
3317         }
3318         return (NULL);
3319 }
3320 
3321 static int
3322 get_rctls(zlog_t *zlogp, char **bufp, size_t *bufsizep)
3323 {
3324         nvlist_t *nvl = NULL;
3325         char *nvl_packed = NULL;
3326         size_t nvl_size = 0;
3327         nvlist_t **nvlv = NULL;
3328         int rctlcount = 0;
3329         int error = -1;
3330         struct zone_rctltab rctltab;
3331         rctlblk_t *rctlblk = NULL;
3332         uint64_t maxlwps;
3333         uint64_t maxprocs;
3334         int rproc, rlwp;
3335 
3336         *bufp = NULL;
3337         *bufsizep = 0;
3338 
3339         rctltab.zone_rctl_valptr = NULL;
3340         if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0) {
3341                 zerror(zlogp, B_TRUE, "%s failed", "nvlist_alloc");
3342                 goto out;
3343         }
3344 
3345         /*
3346          * Allow the administrator to control both the maximum number of
3347          * process table slots, and the maximum number of lwps, with a single
3348          * max-processes or max-lwps property. If only the max-processes
3349          * property is set, we add a max-lwps property with a limit derived
3350          * from max-processes. If only the max-lwps property is set, we add a
3351          * max-processes property with the same limit as max-lwps.
3352          */
3353         rproc = zonecfg_get_aliased_rctl(snap_hndl, ALIAS_MAXPROCS, &maxprocs);
3354         rlwp = zonecfg_get_aliased_rctl(snap_hndl, ALIAS_MAXLWPS, &maxlwps);
3355         if (rproc == Z_OK && rlwp == Z_NO_ENTRY) {
3356                 if (zonecfg_set_aliased_rctl(snap_hndl, ALIAS_MAXLWPS,
3357                     maxprocs * LWPS_PER_PROCESS) != Z_OK) {
3358                         zerror(zlogp, B_FALSE, "unable to set max-lwps alias");
3359                         goto out;
3360                 }
3361         } else if (rlwp == Z_OK && rproc == Z_NO_ENTRY) {
3362                 /* no scaling for max-proc value */
3363                 if (zonecfg_set_aliased_rctl(snap_hndl, ALIAS_MAXPROCS,
3364                     maxlwps) != Z_OK) {
3365                         zerror(zlogp, B_FALSE,
3366                             "unable to set max-processes alias");
3367                         goto out;
3368                 }
3369         }
3370 
3371         if (zonecfg_setrctlent(snap_hndl) != Z_OK) {
3372                 zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setrctlent");
3373                 goto out;
3374         }
3375 
3376         if ((rctlblk = malloc(rctlblk_size())) == NULL) {
3377                 zerror(zlogp, B_TRUE, "memory allocation failed");
3378                 goto out;
3379         }
3380         while (zonecfg_getrctlent(snap_hndl, &rctltab) == Z_OK) {
3381                 struct zone_rctlvaltab *rctlval;
3382                 uint_t i, count;
3383                 const char *name = rctltab.zone_rctl_name;
3384                 char *proj_nm;
3385 
3386                 /* zoneadm should have already warned about unknown rctls. */
3387                 if (!zonecfg_is_rctl(name)) {
3388                         zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3389                         rctltab.zone_rctl_valptr = NULL;
3390                         continue;
3391                 }
3392                 count = 0;
3393                 for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
3394                     rctlval = rctlval->zone_rctlval_next) {
3395                         count++;
3396                 }
3397                 if (count == 0) {       /* ignore */
3398                         continue;       /* Nothing to free */
3399                 }
3400                 if ((nvlv = malloc(sizeof (*nvlv) * count)) == NULL)
3401                         goto out;
3402                 i = 0;
3403                 for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
3404                     rctlval = rctlval->zone_rctlval_next, i++) {
3405                         if (nvlist_alloc(&nvlv[i], NV_UNIQUE_NAME, 0) != 0) {
3406                                 zerror(zlogp, B_TRUE, "%s failed",
3407                                     "nvlist_alloc");
3408                                 goto out;
3409                         }
3410                         if (zonecfg_construct_rctlblk(rctlval, rctlblk)
3411                             != Z_OK) {
3412                                 zerror(zlogp, B_FALSE, "invalid rctl value: "
3413                                     "(priv=%s,limit=%s,action=%s)",
3414                                     rctlval->zone_rctlval_priv,
3415                                     rctlval->zone_rctlval_limit,
3416                                     rctlval->zone_rctlval_action);
3417                                 goto out;
3418                         }
3419                         if (!zonecfg_valid_rctl(name, rctlblk)) {
3420                                 zerror(zlogp, B_FALSE,
3421                                     "(priv=%s,limit=%s,action=%s) is not a "
3422                                     "valid value for rctl '%s'",
3423                                     rctlval->zone_rctlval_priv,
3424                                     rctlval->zone_rctlval_limit,
3425                                     rctlval->zone_rctlval_action,
3426                                     name);
3427                                 goto out;
3428                         }
3429                         if (nvlist_add_uint64(nvlv[i], "privilege",
3430                             rctlblk_get_privilege(rctlblk)) != 0) {
3431                                 zerror(zlogp, B_FALSE, "%s failed",
3432                                     "nvlist_add_uint64");
3433                                 goto out;
3434                         }
3435                         if (nvlist_add_uint64(nvlv[i], "limit",
3436                             rctlblk_get_value(rctlblk)) != 0) {
3437                                 zerror(zlogp, B_FALSE, "%s failed",
3438                                     "nvlist_add_uint64");
3439                                 goto out;
3440                         }
3441                         if (nvlist_add_uint64(nvlv[i], "action",
3442                             (uint_t)rctlblk_get_local_action(rctlblk, NULL))
3443                             != 0) {
3444                                 zerror(zlogp, B_FALSE, "%s failed",
3445                                     "nvlist_add_uint64");
3446                                 goto out;
3447                         }
3448                 }
3449                 zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3450                 rctltab.zone_rctl_valptr = NULL;
3451 
3452                 /*
3453                  * With no action on our part we will start zsched with the
3454                  * project rctl values for our (zoneadmd) current project. For
3455                  * brands running a variant of Illumos, that's not a problem
3456                  * since they will setup their own projects, but for a
3457                  * non-native brand like lx, where there are no projects, we
3458                  * want to start things up with the same project rctls as the
3459                  * corresponding zone rctls, since nothing within the zone will
3460                  * ever change the project rctls.
3461                  */
3462                 if ((proj_nm = zone_proj_rctl(name)) != NULL) {
3463                         if (nvlist_add_nvlist_array(nvl, proj_nm, nvlv, count)
3464                             != 0) {
3465                                 zerror(zlogp, B_FALSE,
3466                                     "nvlist_add_nvlist_arrays failed");
3467                                 goto out;
3468                         }
3469                 }
3470 
3471                 if (nvlist_add_nvlist_array(nvl, (char *)name, nvlv, count)
3472                     != 0) {
3473                         zerror(zlogp, B_FALSE, "%s failed",
3474                             "nvlist_add_nvlist_array");
3475                         goto out;
3476                 }
3477                 for (i = 0; i < count; i++)
3478                         nvlist_free(nvlv[i]);
3479                 free(nvlv);
3480                 nvlv = NULL;
3481                 rctlcount++;
3482         }
3483         (void) zonecfg_endrctlent(snap_hndl);
3484 
3485         if (rctlcount == 0) {
3486                 error = 0;
3487                 goto out;
3488         }
3489         if (nvlist_pack(nvl, &nvl_packed, &nvl_size, NV_ENCODE_NATIVE, 0)
3490             != 0) {
3491                 zerror(zlogp, B_FALSE, "%s failed", "nvlist_pack");
3492                 goto out;
3493         }
3494 
3495         error = 0;
3496         *bufp = nvl_packed;
3497         *bufsizep = nvl_size;
3498 
3499 out:
3500         free(rctlblk);
3501         zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3502         if (error && nvl_packed != NULL)
3503                 free(nvl_packed);
3504         nvlist_free(nvl);
3505         if (nvlv != NULL)
3506                 free(nvlv);
3507         return (error);
3508 }
3509 
3510 static int
3511 get_implicit_datasets(zlog_t *zlogp, char **retstr)
3512 {
3513         char cmdbuf[2 * MAXPATHLEN];
3514 
3515         if (query_hook[0] == '\0')
3516                 return (0);
3517 
3518         if (snprintf(cmdbuf, sizeof (cmdbuf), "%s datasets", query_hook)
3519             > sizeof (cmdbuf))
3520                 return (-1);
3521 
3522         if (do_subproc(zlogp, cmdbuf, retstr, B_FALSE) != 0)
3523                 return (-1);
3524 
3525         return (0);
3526 }
3527 
3528 static int
3529 get_datasets(zlog_t *zlogp, char **bufp, size_t *bufsizep)
3530 {
3531         struct zone_dstab dstab;
3532         size_t total, offset, len;
3533         int error = -1;
3534         char *str = NULL;
3535         char *implicit_datasets = NULL;
3536         int implicit_len = 0;
3537 
3538         *bufp = NULL;
3539         *bufsizep = 0;
3540 
3541         if (get_implicit_datasets(zlogp, &implicit_datasets) != 0) {
3542                 zerror(zlogp, B_FALSE, "getting implicit datasets failed");
3543                 goto out;
3544         }
3545 
3546         if (zonecfg_setdsent(snap_hndl) != Z_OK) {
3547                 zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
3548                 goto out;
3549         }
3550 
3551         total = 0;
3552         while (zonecfg_getdsent(snap_hndl, &dstab) == Z_OK)
3553                 total += strlen(dstab.zone_dataset_name) + 1;
3554         (void) zonecfg_enddsent(snap_hndl);
3555 
3556         if (implicit_datasets != NULL)
3557                 implicit_len = strlen(implicit_datasets);
3558         if (implicit_len > 0)
3559                 total += implicit_len + 1;
3560 
3561         if (total == 0) {
3562                 error = 0;
3563                 goto out;
3564         }
3565 
3566         if ((str = malloc(total)) == NULL) {
3567                 zerror(zlogp, B_TRUE, "memory allocation failed");
3568                 goto out;
3569         }
3570 
3571         if (zonecfg_setdsent(snap_hndl) != Z_OK) {
3572                 zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
3573                 goto out;
3574         }
3575         offset = 0;
3576         while (zonecfg_getdsent(snap_hndl, &dstab) == Z_OK) {
3577                 len = strlen(dstab.zone_dataset_name);
3578                 (void) strlcpy(str + offset, dstab.zone_dataset_name,
3579                     total - offset);
3580                 offset += len;
3581                 if (offset < total - 1)
3582                         str[offset++] = ',';
3583         }
3584         (void) zonecfg_enddsent(snap_hndl);
3585 
3586         if (implicit_len > 0)
3587                 (void) strlcpy(str + offset, implicit_datasets, total - offset);
3588 
3589         error = 0;
3590         *bufp = str;
3591         *bufsizep = total;
3592 
3593 out:
3594         if (error != 0 && str != NULL)
3595                 free(str);
3596         if (implicit_datasets != NULL)
3597                 free(implicit_datasets);
3598 
3599         return (error);
3600 }
3601 
3602 static int
3603 validate_datasets(zlog_t *zlogp)
3604 {
3605         struct zone_dstab dstab;
3606         zfs_handle_t *zhp;
3607         libzfs_handle_t *hdl;
3608 
3609         if (zonecfg_setdsent(snap_hndl) != Z_OK) {
3610                 zerror(zlogp, B_FALSE, "invalid configuration");
3611                 return (-1);
3612         }
3613 
3614         if ((hdl = libzfs_init()) == NULL) {
3615                 zerror(zlogp, B_FALSE, "opening ZFS library");
3616                 return (-1);
3617         }
3618 
3619         while (zonecfg_getdsent(snap_hndl, &dstab) == Z_OK) {
3620 
3621                 if ((zhp = zfs_open(hdl, dstab.zone_dataset_name,
3622                     ZFS_TYPE_FILESYSTEM)) == NULL) {
3623                         zerror(zlogp, B_FALSE, "cannot open ZFS dataset '%s'",
3624                             dstab.zone_dataset_name);
3625                         libzfs_fini(hdl);
3626                         return (-1);
3627                 }
3628 
3629                 /*
3630                  * Automatically set the 'zoned' property.  We check the value
3631                  * first because we'll get EPERM if it is already set.
3632                  */
3633                 if (!zfs_prop_get_int(zhp, ZFS_PROP_ZONED) &&
3634                     zfs_prop_set(zhp, zfs_prop_to_name(ZFS_PROP_ZONED),
3635                     "on") != 0) {
3636                         zerror(zlogp, B_FALSE, "cannot set 'zoned' "
3637                             "property for ZFS dataset '%s'\n",
3638                             dstab.zone_dataset_name);
3639                         zfs_close(zhp);
3640                         libzfs_fini(hdl);
3641                         return (-1);
3642                 }
3643 
3644                 zfs_close(zhp);
3645         }
3646         (void) zonecfg_enddsent(snap_hndl);
3647 
3648         libzfs_fini(hdl);
3649 
3650         return (0);
3651 }
3652 
3653 /*
3654  * Return true if the path is its own zfs file system.  We determine this
3655  * by stat-ing the path to see if it is zfs and stat-ing the parent to see
3656  * if it is a different fs.
3657  */
3658 boolean_t
3659 is_zonepath_zfs(char *zonepath)
3660 {
3661         int res;
3662         char *path;
3663         char *parent;
3664         struct statvfs64 buf1, buf2;
3665 
3666         if (statvfs64(zonepath, &buf1) != 0)
3667                 return (B_FALSE);
3668 
3669         if (strcmp(buf1.f_basetype, "zfs") != 0)
3670                 return (B_FALSE);
3671 
3672         if ((path = strdup(zonepath)) == NULL)
3673                 return (B_FALSE);
3674 
3675         parent = dirname(path);
3676         res = statvfs64(parent, &buf2);
3677         free(path);
3678 
3679         if (res != 0)
3680                 return (B_FALSE);
3681 
3682         if (buf1.f_fsid == buf2.f_fsid)
3683                 return (B_FALSE);
3684 
3685         return (B_TRUE);
3686 }
3687 
3688 /*
3689  * Verify the MAC label in the root dataset for the zone.
3690  * If the label exists, it must match the label configured for the zone.
3691  * Otherwise if there's no label on the dataset, create one here.
3692  */
3693 
3694 static int
3695 validate_rootds_label(zlog_t *zlogp, char *rootpath, m_label_t *zone_sl)
3696 {
3697         int             error = -1;
3698         zfs_handle_t    *zhp;
3699         libzfs_handle_t *hdl;
3700         m_label_t       ds_sl;
3701         char            ds_hexsl[MAXNAMELEN];
3702 
3703         if (!is_system_labeled())
3704                 return (0);
3705 
3706         if (!is_zonepath_zfs(zonepath))
3707                 return (0);
3708 
3709         if ((hdl = libzfs_init()) == NULL) {
3710                 zerror(zlogp, B_FALSE, "opening ZFS library");
3711                 return (-1);
3712         }
3713 
3714         if ((zhp = zfs_path_to_zhandle(hdl, rootpath,
3715             ZFS_TYPE_FILESYSTEM)) == NULL) {
3716                 zerror(zlogp, B_FALSE, "cannot open ZFS dataset for path '%s'",
3717                     rootpath);
3718                 libzfs_fini(hdl);
3719                 return (-1);
3720         }
3721 
3722         /* Get the mlslabel property if it exists. */
3723         if ((zfs_prop_get(zhp, ZFS_PROP_MLSLABEL, ds_hexsl, MAXNAMELEN,
3724             NULL, NULL, 0, B_TRUE) != 0) ||
3725             (strcmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) == 0)) {
3726                 char            *str2 = NULL;
3727 
3728                 /*
3729                  * No label on the dataset (or default only); create one.
3730                  * (Only do this automatic labeling for the labeled brand.)
3731                  */
3732                 if (strcmp(brand_name, LABELED_BRAND_NAME) != 0) {
3733                         error = 0;
3734                         goto out;
3735                 }
3736 
3737                 error = l_to_str_internal(zone_sl, &str2);
3738                 if (error)
3739                         goto out;
3740                 if (str2 == NULL) {
3741                         error = -1;
3742                         goto out;
3743                 }
3744                 if ((error = zfs_prop_set(zhp,
3745                     zfs_prop_to_name(ZFS_PROP_MLSLABEL), str2)) != 0) {
3746                         zerror(zlogp, B_FALSE, "cannot set 'mlslabel' "
3747                             "property for root dataset at '%s'\n", rootpath);
3748                 }
3749                 free(str2);
3750                 goto out;
3751         }
3752 
3753         /* Convert the retrieved dataset label to binary form. */
3754         error = hexstr_to_label(ds_hexsl, &ds_sl);
3755         if (error) {
3756                 zerror(zlogp, B_FALSE, "invalid 'mlslabel' "
3757                     "property on root dataset at '%s'\n", rootpath);
3758                 goto out;                       /* exit with error */
3759         }
3760 
3761         /*
3762          * Perform a MAC check by comparing the zone label with the
3763          * dataset label.
3764          */
3765         error = (!blequal(zone_sl, &ds_sl));
3766         if (error)
3767                 zerror(zlogp, B_FALSE, "Rootpath dataset has mismatched label");
3768 out:
3769         zfs_close(zhp);
3770         libzfs_fini(hdl);
3771 
3772         return (error);
3773 }
3774 
3775 /*
3776  * Mount lower level home directories into/from current zone
3777  * Share exported directories specified in dfstab for zone
3778  */
3779 static int
3780 tsol_mounts(zlog_t *zlogp, char *zone_name, char *rootpath)
3781 {
3782         zoneid_t *zids = NULL;
3783         priv_set_t *zid_privs;
3784         const priv_impl_info_t *ip = NULL;
3785         uint_t nzents_saved;
3786         uint_t nzents;
3787         int i;
3788         char readonly[] = "ro";
3789         struct zone_fstab lower_fstab;
3790         char *argv[4];
3791 
3792         if (!is_system_labeled())
3793                 return (0);
3794 
3795         if (zid_label == NULL) {
3796                 zid_label = m_label_alloc(MAC_LABEL);
3797                 if (zid_label == NULL)
3798                         return (-1);
3799         }
3800 
3801         /* Make sure our zone has an /export/home dir */
3802         (void) make_one_dir(zlogp, rootpath, "/export/home",
3803             DEFAULT_DIR_MODE, DEFAULT_DIR_USER, DEFAULT_DIR_GROUP);
3804 
3805         lower_fstab.zone_fs_raw[0] = '\0';
3806         (void) strlcpy(lower_fstab.zone_fs_type, MNTTYPE_LOFS,
3807             sizeof (lower_fstab.zone_fs_type));
3808         lower_fstab.zone_fs_options = NULL;
3809         (void) zonecfg_add_fs_option(&lower_fstab, readonly);
3810 
3811         /*
3812          * Get the list of zones from the kernel
3813          */
3814         if (zone_list(NULL, &nzents) != 0) {
3815                 zerror(zlogp, B_TRUE, "unable to list zones");
3816                 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3817                 return (-1);
3818         }
3819 again:
3820         if (nzents == 0) {
3821                 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3822                 return (-1);
3823         }
3824 
3825         zids = malloc(nzents * sizeof (zoneid_t));
3826         if (zids == NULL) {
3827                 zerror(zlogp, B_TRUE, "memory allocation failed");
3828                 return (-1);
3829         }
3830         nzents_saved = nzents;
3831 
3832         if (zone_list(zids, &nzents) != 0) {
3833                 zerror(zlogp, B_TRUE, "unable to list zones");
3834                 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3835                 free(zids);
3836                 return (-1);
3837         }
3838         if (nzents != nzents_saved) {
3839                 /* list changed, try again */
3840                 free(zids);
3841                 goto again;
3842         }
3843 
3844         ip = getprivimplinfo();
3845         if ((zid_privs = priv_allocset()) == NULL) {
3846                 zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
3847                 zonecfg_free_fs_option_list(
3848                     lower_fstab.zone_fs_options);
3849                 free(zids);
3850                 return (-1);
3851         }
3852 
3853         for (i = 0; i < nzents; i++) {
3854                 char zid_name[ZONENAME_MAX];
3855                 zone_state_t zid_state;
3856                 char zid_rpath[MAXPATHLEN];
3857                 struct stat stat_buf;
3858 
3859                 if (zids[i] == GLOBAL_ZONEID)
3860                         continue;
3861 
3862                 if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
3863                         continue;
3864 
3865                 /*
3866                  * Do special setup for the zone we are booting
3867                  */
3868                 if (strcmp(zid_name, zone_name) == 0) {
3869                         struct zone_fstab autofs_fstab;
3870                         char map_path[MAXPATHLEN];
3871                         int fd;
3872 
3873                         /*
3874                          * Create auto_home_<zone> map for this zone
3875                          * in the global zone. The non-global zone entry
3876                          * will be created by automount when the zone
3877                          * is booted.
3878                          */
3879 
3880                         (void) snprintf(autofs_fstab.zone_fs_special,
3881                             MAXPATHLEN, "auto_home_%s", zid_name);
3882 
3883                         (void) snprintf(autofs_fstab.zone_fs_dir, MAXPATHLEN,
3884                             "/zone/%s/home", zid_name);
3885 
3886                         (void) snprintf(map_path, sizeof (map_path),
3887                             "/etc/%s", autofs_fstab.zone_fs_special);
3888                         /*
3889                          * If the map file doesn't exist create a template
3890                          */
3891                         if ((fd = open(map_path, O_RDWR | O_CREAT | O_EXCL,
3892                             S_IRUSR | S_IWUSR | S_IRGRP| S_IROTH)) != -1) {
3893                                 int len;
3894                                 char map_rec[MAXPATHLEN];
3895 
3896                                 len = snprintf(map_rec, sizeof (map_rec),
3897                                     "+%s\n*\t-fstype=lofs\t:%s/export/home/&\n",
3898                                     autofs_fstab.zone_fs_special, rootpath);
3899                                 (void) write(fd, map_rec, len);
3900                                 (void) close(fd);
3901                         }
3902 
3903                         /*
3904                          * Mount auto_home_<zone> in the global zone if absent.
3905                          * If it's already of type autofs, then
3906                          * don't mount it again.
3907                          */
3908                         if ((stat(autofs_fstab.zone_fs_dir, &stat_buf) == -1) ||
3909                             strcmp(stat_buf.st_fstype, MNTTYPE_AUTOFS) != 0) {
3910                                 char optstr[] = "indirect,ignore,nobrowse";
3911 
3912                                 (void) make_one_dir(zlogp, "",
3913                                     autofs_fstab.zone_fs_dir, DEFAULT_DIR_MODE,
3914                                     DEFAULT_DIR_USER, DEFAULT_DIR_GROUP);
3915 
3916                                 /*
3917                                  * Mount will fail if automounter has already
3918                                  * processed the auto_home_<zonename> map
3919                                  */
3920                                 (void) domount(zlogp, MNTTYPE_AUTOFS, optstr,
3921                                     autofs_fstab.zone_fs_special,
3922                                     autofs_fstab.zone_fs_dir);
3923                         }
3924                         continue;
3925                 }
3926 
3927 
3928                 if (zone_get_state(zid_name, &zid_state) != Z_OK ||
3929                     (zid_state != ZONE_STATE_READY &&
3930                     zid_state != ZONE_STATE_RUNNING))
3931                         /* Skip over zones without mounted filesystems */
3932                         continue;
3933 
3934                 if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
3935                     sizeof (m_label_t)) < 0)
3936                         /* Skip over zones with unspecified label */
3937                         continue;
3938 
3939                 if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
3940                     sizeof (zid_rpath)) == -1)
3941                         /* Skip over zones with bad path */
3942                         continue;
3943 
3944                 if (zone_getattr(zids[i], ZONE_ATTR_PRIVSET, zid_privs,
3945                     sizeof (priv_chunk_t) * ip->priv_setsize) == -1)
3946                         /* Skip over zones with bad privs */
3947                         continue;
3948 
3949                 /*
3950                  * Reading down is valid according to our label model
3951                  * but some customers want to disable it because it
3952                  * allows execute down and other possible attacks.
3953                  * Therefore, we restrict this feature to zones that
3954                  * have the NET_MAC_AWARE privilege which is required
3955                  * for NFS read-down semantics.
3956                  */
3957                 if ((bldominates(zlabel, zid_label)) &&
3958                     (priv_ismember(zprivs, PRIV_NET_MAC_AWARE))) {
3959                         /*
3960                          * Our zone dominates this one.
3961                          * Create a lofs mount from lower zone's /export/home
3962                          */
3963                         (void) snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
3964                             "%s/zone/%s/export/home", rootpath, zid_name);
3965 
3966                         /*
3967                          * If the target is already an LOFS mount
3968                          * then don't do it again.
3969                          */
3970                         if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
3971                             strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
3972 
3973                                 if (snprintf(lower_fstab.zone_fs_special,
3974                                     MAXPATHLEN, "%s/export",
3975                                     zid_rpath) > MAXPATHLEN)
3976                                         continue;
3977 
3978                                 /*
3979                                  * Make sure the lower-level home exists
3980                                  */
3981                                 if (make_one_dir(zlogp,
3982                                     lower_fstab.zone_fs_special, "/home",
3983                                     DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
3984                                     DEFAULT_DIR_GROUP) != 0)
3985                                         continue;
3986 
3987                                 (void) strlcat(lower_fstab.zone_fs_special,
3988                                     "/home", MAXPATHLEN);
3989 
3990                                 /*
3991                                  * Mount can fail because the lower-level
3992                                  * zone may have already done a mount up.
3993                                  */
3994                                 (void) mount_one(zlogp, &lower_fstab, "",
3995                                     Z_MNT_BOOT);
3996                         }
3997                 } else if ((bldominates(zid_label, zlabel)) &&
3998                     (priv_ismember(zid_privs, PRIV_NET_MAC_AWARE))) {
3999                         /*
4000                          * This zone dominates our zone.
4001                          * Create a lofs mount from our zone's /export/home
4002                          */
4003                         if (snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
4004                             "%s/zone/%s/export/home", zid_rpath,
4005                             zone_name) > MAXPATHLEN)
4006                                 continue;
4007 
4008                         /*
4009                          * If the target is already an LOFS mount
4010                          * then don't do it again.
4011                          */
4012                         if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
4013                             strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
4014 
4015                                 (void) snprintf(lower_fstab.zone_fs_special,
4016                                     MAXPATHLEN, "%s/export/home", rootpath);
4017 
4018                                 /*
4019                                  * Mount can fail because the higher-level
4020                                  * zone may have already done a mount down.
4021                                  */
4022                                 (void) mount_one(zlogp, &lower_fstab, "",
4023                                     Z_MNT_BOOT);
4024                         }
4025                 }
4026         }
4027         zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
4028         priv_freeset(zid_privs);
4029         free(zids);
4030 
4031         /*
4032          * Now share any exported directories from this zone.
4033          * Each zone can have its own dfstab.
4034          */
4035 
4036         argv[0] = "zoneshare";
4037         argv[1] = "-z";
4038         argv[2] = zone_name;
4039         argv[3] = NULL;
4040 
4041         (void) forkexec(zlogp, "/usr/lib/zones/zoneshare", argv);
4042         /* Don't check for errors since they don't affect the zone */
4043 
4044         return (0);
4045 }
4046 
4047 /*
4048  * Unmount lofs mounts from higher level zones
4049  * Unshare nfs exported directories
4050  */
4051 static void
4052 tsol_unmounts(zlog_t *zlogp, char *zone_name)
4053 {
4054         zoneid_t *zids = NULL;
4055         uint_t nzents_saved;
4056         uint_t nzents;
4057         int i;
4058         char *argv[4];
4059         char path[MAXPATHLEN];
4060 
4061         if (!is_system_labeled())
4062                 return;
4063 
4064         /*
4065          * Get the list of zones from the kernel
4066          */
4067         if (zone_list(NULL, &nzents) != 0) {
4068                 return;
4069         }
4070 
4071         if (zid_label == NULL) {
4072                 zid_label = m_label_alloc(MAC_LABEL);
4073                 if (zid_label == NULL)
4074                         return;
4075         }
4076 
4077 again:
4078         if (nzents == 0)
4079                 return;
4080 
4081         zids = malloc(nzents * sizeof (zoneid_t));
4082         if (zids == NULL) {
4083                 zerror(zlogp, B_TRUE, "memory allocation failed");
4084                 return;
4085         }
4086         nzents_saved = nzents;
4087 
4088         if (zone_list(zids, &nzents) != 0) {
4089                 free(zids);
4090                 return;
4091         }
4092         if (nzents != nzents_saved) {
4093                 /* list changed, try again */
4094                 free(zids);
4095                 goto again;
4096         }
4097 
4098         for (i = 0; i < nzents; i++) {
4099                 char zid_name[ZONENAME_MAX];
4100                 zone_state_t zid_state;
4101                 char zid_rpath[MAXPATHLEN];
4102 
4103                 if (zids[i] == GLOBAL_ZONEID)
4104                         continue;
4105 
4106                 if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
4107                         continue;
4108 
4109                 /*
4110                  * Skip the zone we are halting
4111                  */
4112                 if (strcmp(zid_name, zone_name) == 0)
4113                         continue;
4114 
4115                 if ((zone_getattr(zids[i], ZONE_ATTR_STATUS, &zid_state,
4116                     sizeof (zid_state)) < 0) ||
4117                     (zid_state < ZONE_IS_READY))
4118                         /* Skip over zones without mounted filesystems */
4119                         continue;
4120 
4121                 if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
4122                     sizeof (m_label_t)) < 0)
4123                         /* Skip over zones with unspecified label */
4124                         continue;
4125 
4126                 if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
4127                     sizeof (zid_rpath)) == -1)
4128                         /* Skip over zones with bad path */
4129                         continue;
4130 
4131                 if (zlabel != NULL && bldominates(zid_label, zlabel)) {
4132                         /*
4133                          * This zone dominates our zone.
4134                          * Unmount the lofs mount of our zone's /export/home
4135                          */
4136 
4137                         if (snprintf(path, MAXPATHLEN,
4138                             "%s/zone/%s/export/home", zid_rpath,
4139                             zone_name) > MAXPATHLEN)
4140                                 continue;
4141 
4142                         /* Skip over mount failures */
4143                         (void) umount(path);
4144                 }
4145         }
4146         free(zids);
4147 
4148         /*
4149          * Unmount global zone autofs trigger for this zone
4150          */
4151         (void) snprintf(path, MAXPATHLEN, "/zone/%s/home", zone_name);
4152         /* Skip over mount failures */
4153         (void) umount(path);
4154 
4155         /*
4156          * Next unshare any exported directories from this zone.
4157          */
4158 
4159         argv[0] = "zoneunshare";
4160         argv[1] = "-z";
4161         argv[2] = zone_name;
4162         argv[3] = NULL;
4163 
4164         (void) forkexec(zlogp, "/usr/lib/zones/zoneunshare", argv);
4165         /* Don't check for errors since they don't affect the zone */
4166 
4167         /*
4168          * Finally, deallocate any devices in the zone.
4169          */
4170 
4171         argv[0] = "deallocate";
4172         argv[1] = "-Isz";
4173         argv[2] = zone_name;
4174         argv[3] = NULL;
4175 
4176         (void) forkexec(zlogp, "/usr/sbin/deallocate", argv);
4177         /* Don't check for errors since they don't affect the zone */
4178 }
4179 
4180 /*
4181  * Fetch the Trusted Extensions label and multi-level ports (MLPs) for
4182  * this zone.
4183  */
4184 static tsol_zcent_t *
4185 get_zone_label(zlog_t *zlogp, priv_set_t *privs)
4186 {
4187         FILE *fp;
4188         tsol_zcent_t *zcent = NULL;
4189         char line[MAXTNZLEN];
4190 
4191         if ((fp = fopen(TNZONECFG_PATH, "r")) == NULL) {
4192                 zerror(zlogp, B_TRUE, "%s", TNZONECFG_PATH);
4193                 return (NULL);
4194         }
4195 
4196         while (fgets(line, sizeof (line), fp) != NULL) {
4197                 /*
4198                  * Check for malformed database
4199                  */
4200                 if (strlen(line) == MAXTNZLEN - 1)
4201                         break;
4202                 if ((zcent = tsol_sgetzcent(line, NULL, NULL)) == NULL)
4203                         continue;
4204                 if (strcmp(zcent->zc_name, zone_name) == 0)
4205                         break;
4206                 tsol_freezcent(zcent);
4207                 zcent = NULL;
4208         }
4209         (void) fclose(fp);
4210 
4211         if (zcent == NULL) {
4212                 zerror(zlogp, B_FALSE, "zone requires a label assignment. "
4213                     "See tnzonecfg(5)");
4214         } else {
4215                 if (zlabel == NULL)
4216                         zlabel = m_label_alloc(MAC_LABEL);
4217                 /*
4218                  * Save this zone's privileges for later read-down processing
4219                  */
4220                 if ((zprivs = priv_allocset()) == NULL) {
4221                         zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
4222                         return (NULL);
4223                 } else {
4224                         priv_copyset(privs, zprivs);
4225                 }
4226         }
4227         return (zcent);
4228 }
4229 
4230 /*
4231  * Add the Trusted Extensions multi-level ports for this zone.
4232  */
4233 static void
4234 set_mlps(zlog_t *zlogp, zoneid_t zoneid, tsol_zcent_t *zcent)
4235 {
4236         tsol_mlp_t *mlp;
4237         tsol_mlpent_t tsme;
4238 
4239         if (!is_system_labeled())
4240                 return;
4241 
4242         tsme.tsme_zoneid = zoneid;
4243         tsme.tsme_flags = 0;
4244         for (mlp = zcent->zc_private_mlp; !TSOL_MLP_END(mlp); mlp++) {
4245                 tsme.tsme_mlp = *mlp;
4246                 if (tnmlp(TNDB_LOAD, &tsme) != 0) {
4247                         zerror(zlogp, B_TRUE, "cannot set zone-specific MLP "
4248                             "on %d-%d/%d", mlp->mlp_port,
4249                             mlp->mlp_port_upper, mlp->mlp_ipp);
4250                 }
4251         }
4252 
4253         tsme.tsme_flags = TSOL_MEF_SHARED;
4254         for (mlp = zcent->zc_shared_mlp; !TSOL_MLP_END(mlp); mlp++) {
4255                 tsme.tsme_mlp = *mlp;
4256                 if (tnmlp(TNDB_LOAD, &tsme) != 0) {
4257                         zerror(zlogp, B_TRUE, "cannot set shared MLP "
4258                             "on %d-%d/%d", mlp->mlp_port,
4259                             mlp->mlp_port_upper, mlp->mlp_ipp);
4260                 }
4261         }
4262 }
4263 
4264 static void
4265 remove_mlps(zlog_t *zlogp, zoneid_t zoneid)
4266 {
4267         tsol_mlpent_t tsme;
4268 
4269         if (!is_system_labeled())
4270                 return;
4271 
4272         (void) memset(&tsme, 0, sizeof (tsme));
4273         tsme.tsme_zoneid = zoneid;
4274         if (tnmlp(TNDB_FLUSH, &tsme) != 0)
4275                 zerror(zlogp, B_TRUE, "cannot flush MLPs");
4276 }
4277 
4278 int
4279 prtmount(const struct mnttab *fs, void *x)
4280 {
4281         zerror((zlog_t *)x, B_FALSE, "  %s", fs->mnt_mountp);
4282         return (0);
4283 }
4284 
4285 /*
4286  * Look for zones running on the main system that are using this root (or any
4287  * subdirectory of it).  Return B_TRUE and print an error if a conflicting zone
4288  * is found or if we can't tell.
4289  */
4290 static boolean_t
4291 duplicate_zone_root(zlog_t *zlogp, const char *rootpath)
4292 {
4293         zoneid_t *zids = NULL;
4294         uint_t nzids = 0;
4295         boolean_t retv;
4296         int rlen, zlen;
4297         char zroot[MAXPATHLEN];
4298         char zonename[ZONENAME_MAX];
4299 
4300         for (;;) {
4301                 nzids += 10;
4302                 zids = malloc(nzids * sizeof (*zids));
4303                 if (zids == NULL) {
4304                         zerror(zlogp, B_TRUE, "memory allocation failed");
4305                         return (B_TRUE);
4306                 }
4307                 if (zone_list(zids, &nzids) == 0)
4308                         break;
4309                 free(zids);
4310         }
4311         retv = B_FALSE;
4312         rlen = strlen(rootpath);
4313         while (nzids > 0) {
4314                 /*
4315                  * Ignore errors; they just mean that the zone has disappeared
4316                  * while we were busy.
4317                  */
4318                 if (zone_getattr(zids[--nzids], ZONE_ATTR_ROOT, zroot,
4319                     sizeof (zroot)) == -1)
4320                         continue;
4321                 zlen = strlen(zroot);
4322                 if (zlen > rlen)
4323                         zlen = rlen;
4324                 if (strncmp(rootpath, zroot, zlen) == 0 &&
4325                     (zroot[zlen] == '\0' || zroot[zlen] == '/') &&
4326                     (rootpath[zlen] == '\0' || rootpath[zlen] == '/')) {
4327                         if (getzonenamebyid(zids[nzids], zonename,
4328                             sizeof (zonename)) == -1)
4329                                 (void) snprintf(zonename, sizeof (zonename),
4330                                     "id %d", (int)zids[nzids]);
4331                         zerror(zlogp, B_FALSE,
4332                             "zone root %s already in use by zone %s",
4333                             rootpath, zonename);
4334                         retv = B_TRUE;
4335                         break;
4336                 }
4337         }
4338         free(zids);
4339         return (retv);
4340 }
4341 
4342 /*
4343  * Search for loopback mounts that use this same source node (same device and
4344  * inode).  Return B_TRUE if there is one or if we can't tell.
4345  */
4346 static boolean_t
4347 duplicate_reachable_path(zlog_t *zlogp, const char *rootpath)
4348 {
4349         struct stat64 rst, zst;
4350         struct mnttab *mnp;
4351 
4352         if (stat64(rootpath, &rst) == -1) {
4353                 zerror(zlogp, B_TRUE, "can't stat %s", rootpath);
4354                 return (B_TRUE);
4355         }
4356         if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
4357                 return (B_TRUE);
4358         for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max; mnp++) {
4359                 if (mnp->mnt_fstype == NULL ||
4360                     strcmp(MNTTYPE_LOFS, mnp->mnt_fstype) != 0)
4361                         continue;
4362                 /* We're looking at a loopback mount.  Stat it. */
4363                 if (mnp->mnt_special != NULL &&
4364                     stat64(mnp->mnt_special, &zst) != -1 &&
4365                     rst.st_dev == zst.st_dev && rst.st_ino == zst.st_ino) {
4366                         zerror(zlogp, B_FALSE,
4367                             "zone root %s is reachable through %s",
4368                             rootpath, mnp->mnt_mountp);
4369                         return (B_TRUE);
4370                 }
4371         }
4372         return (B_FALSE);
4373 }
4374 
4375 /*
4376  * Set pool info for the zone's resource management configuration.
4377  */
4378 static int
4379 setup_zone_rm(zlog_t *zlogp, char *zone_name, zoneid_t zoneid)
4380 {
4381         int res;
4382         uint64_t tmp;
4383         char sched[MAXNAMELEN];
4384         char pool_err[128];
4385 
4386         /* Get the scheduling class set in the zone configuration. */
4387         if (zonecfg_get_sched_class(snap_hndl, sched, sizeof (sched)) == Z_OK &&
4388             strlen(sched) > 0) {
4389                 if (zone_setattr(zoneid, ZONE_ATTR_SCHED_CLASS, sched,
4390                     strlen(sched)) == -1)
4391                         zerror(zlogp, B_TRUE, "WARNING: unable to set the "
4392                             "default scheduling class");
4393 
4394                 if (strcmp(sched, "FX") == 0) {
4395                         /*
4396                          * When FX is specified then by default all processes
4397                          * will start at the lowest priority level (0) and
4398                          * stay there. We support an optional attr which
4399                          * indicates that all the processes should be "high
4400                          * priority". We set this on the zone so that starting
4401                          * init will set the priority high.
4402                          */
4403                         struct zone_attrtab a;
4404 
4405                         bzero(&a, sizeof (a));
4406                         (void) strlcpy(a.zone_attr_name, "fixed-hi-prio",
4407                             sizeof (a.zone_attr_name));
4408 
4409                         if (zonecfg_lookup_attr(snap_hndl, &a) == Z_OK &&
4410                             strcmp(a.zone_attr_value, "true") == 0) {
4411                                 boolean_t hi = B_TRUE;
4412 
4413                                 if (zone_setattr(zoneid,
4414                                     ZONE_ATTR_SCHED_FIXEDHI, (void *)hi,
4415                                     sizeof (hi)) == -1)
4416                                         zerror(zlogp, B_TRUE, "WARNING: unable "
4417                                             "to set high priority");
4418                         }
4419                 }
4420 
4421         } else if (zonecfg_get_aliased_rctl(snap_hndl, ALIAS_SHARES, &tmp)
4422             == Z_OK) {
4423                 /*
4424                  * If the zone has the zone.cpu-shares rctl set then we want to
4425                  * use the Fair Share Scheduler (FSS) for processes in the
4426                  * zone.  Check what scheduling class the zone would be running
4427                  * in by default so we can print a warning and modify the class
4428                  * if we wouldn't be using FSS.
4429                  */
4430                 char class_name[PC_CLNMSZ];
4431 
4432                 if (zonecfg_get_dflt_sched_class(snap_hndl, class_name,
4433                     sizeof (class_name)) != Z_OK) {
4434                         zerror(zlogp, B_FALSE, "WARNING: unable to determine "
4435                             "the zone's scheduling class");
4436 
4437                 } else if (strcmp("FSS", class_name) != 0) {
4438                         zerror(zlogp, B_FALSE, "WARNING: The zone.cpu-shares "
4439                             "rctl is set but\nFSS is not the default "
4440                             "scheduling class for\nthis zone.  FSS will be "
4441                             "used for processes\nin the zone but to get the "
4442                             "full benefit of FSS,\nit should be the default "
4443                             "scheduling class.\nSee dispadmin(8) for more "
4444                             "details.");
4445 
4446                         if (zone_setattr(zoneid, ZONE_ATTR_SCHED_CLASS, "FSS",
4447                             strlen("FSS")) == -1)
4448                                 zerror(zlogp, B_TRUE, "WARNING: unable to set "
4449                                     "zone scheduling class to FSS");
4450                 }
4451         }
4452 
4453         /*
4454          * The next few blocks of code attempt to set up temporary pools as
4455          * well as persistent pools.  In all cases we call the functions
4456          * unconditionally.  Within each funtion the code will check if the
4457          * zone is actually configured for a temporary pool or persistent pool
4458          * and just return if there is nothing to do.
4459          *
4460          * If we are rebooting we want to attempt to reuse any temporary pool
4461          * that was previously set up.  zonecfg_bind_tmp_pool() will do the
4462          * right thing in all cases (reuse or create) based on the current
4463          * zonecfg.
4464          */
4465         if ((res = zonecfg_bind_tmp_pool(snap_hndl, zoneid, pool_err,
4466             sizeof (pool_err))) != Z_OK) {
4467                 if (res == Z_POOL || res == Z_POOL_CREATE || res == Z_POOL_BIND)
4468                         zerror(zlogp, B_FALSE, "%s: %s\ndedicated-cpu setting "
4469                             "cannot be instantiated", zonecfg_strerror(res),
4470                             pool_err);
4471                 else
4472                         zerror(zlogp, B_FALSE, "could not bind zone to "
4473                             "temporary pool: %s", zonecfg_strerror(res));
4474                 return (Z_POOL_BIND);
4475         }
4476 
4477         /*
4478          * Check if we need to warn about poold not being enabled.
4479          */
4480         if (zonecfg_warn_poold(snap_hndl)) {
4481                 zerror(zlogp, B_FALSE, "WARNING: A range of dedicated-cpus has "
4482                     "been specified\nbut the dynamic pool service is not "
4483                     "enabled.\nThe system will not dynamically adjust the\n"
4484                     "processor allocation within the specified range\n"
4485                     "until svc:/system/pools/dynamic is enabled.\n"
4486                     "See poold(8).");
4487         }
4488 
4489         /* The following is a warning, not an error. */
4490         if ((res = zonecfg_bind_pool(snap_hndl, zoneid, pool_err,
4491             sizeof (pool_err))) != Z_OK) {
4492                 if (res == Z_POOL_BIND)
4493                         zerror(zlogp, B_FALSE, "WARNING: unable to bind to "
4494                             "pool '%s'; using default pool.", pool_err);
4495                 else if (res == Z_POOL)
4496                         zerror(zlogp, B_FALSE, "WARNING: %s: %s",
4497                             zonecfg_strerror(res), pool_err);
4498                 else
4499                         zerror(zlogp, B_FALSE, "WARNING: %s",
4500                             zonecfg_strerror(res));
4501         }
4502 
4503         /* Update saved pool name in case it has changed */
4504         (void) zonecfg_get_poolname(snap_hndl, zone_name, pool_name,
4505             sizeof (pool_name));
4506 
4507         return (Z_OK);
4508 }
4509 
4510 static void
4511 report_prop_err(zlog_t *zlogp, const char *name, const char *value, int res)
4512 {
4513         switch (res) {
4514         case Z_TOO_BIG:
4515                 zerror(zlogp, B_FALSE, "%s property value is too large.", name);
4516                 break;
4517 
4518         case Z_INVALID_PROPERTY:
4519                 zerror(zlogp, B_FALSE, "%s property value \"%s\" is not valid",
4520                     name, value);
4521                 break;
4522 
4523         default:
4524                 zerror(zlogp, B_TRUE, "fetching property %s: %d", name, res);
4525                 break;
4526         }
4527 }
4528 
4529 /*
4530  * Sets the hostid of the new zone based on its configured value.  The zone's
4531  * zone_t structure must already exist in kernel memory.  'zlogp' refers to the
4532  * log used to report errors and warnings and must be non-NULL.  'zone_namep'
4533  * is the name of the new zone and must be non-NULL.  'zoneid' is the numeric
4534  * ID of the new zone.
4535  *
4536  * This function returns zero on success and a nonzero error code on failure.
4537  */
4538 static int
4539 setup_zone_hostid(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4540 {
4541         int res;
4542         char hostidp[HW_HOSTID_LEN];
4543         unsigned int hostid;
4544 
4545         res = zonecfg_get_hostid(handle, hostidp, sizeof (hostidp));
4546 
4547         if (res == Z_BAD_PROPERTY) {
4548                 return (Z_OK);
4549         } else if (res != Z_OK) {
4550                 report_prop_err(zlogp, "hostid", hostidp, res);
4551                 return (res);
4552         }
4553 
4554         hostid = (unsigned int)strtoul(hostidp, NULL, 16);
4555         if ((res = zone_setattr(zoneid, ZONE_ATTR_HOSTID, &hostid,
4556             sizeof (hostid))) != 0) {
4557                 zerror(zlogp, B_TRUE,
4558                     "zone hostid is not valid: %s: %d", hostidp, res);
4559                 return (Z_SYSTEM);
4560         }
4561 
4562         return (res);
4563 }
4564 
4565 static int
4566 secflags_parse_check(secflagset_t *flagset, const char *flagstr, char *descr,
4567     zlog_t *zlogp)
4568 {
4569         secflagdelta_t delt;
4570 
4571         if (secflags_parse(NULL, flagstr, &delt) == -1) {
4572                 zerror(zlogp, B_FALSE,
4573                     "failed to parse %s security-flags '%s': %s",
4574                     descr, flagstr, strerror(errno));
4575                 return (Z_BAD_PROPERTY);
4576         }
4577 
4578         if (delt.psd_ass_active != B_TRUE) {
4579                 zerror(zlogp, B_FALSE,
4580                     "relative security-flags are not allowed "
4581                     "(%s security-flags: '%s')", descr, flagstr);
4582                 return (Z_BAD_PROPERTY);
4583         }
4584 
4585         secflags_copy(flagset, &delt.psd_assign);
4586 
4587         return (Z_OK);
4588 }
4589 
4590 static int
4591 setup_zone_secflags(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4592 {
4593         psecflags_t secflags;
4594         struct zone_secflagstab tab = {0};
4595         secflagset_t flagset;
4596         int res;
4597 
4598         res = zonecfg_lookup_secflags(handle, &tab);
4599 
4600         /*
4601          * If the zone configuration does not define any security flag sets,
4602          * then check to see if there are any default flags configured for
4603          * the brand. If so, set these as the default set for this zone and
4604          * the lower/upper sets will become none/all as per the defaults.
4605          *
4606          * If there is no brand default either, then the flags will be
4607          * defaulted below.
4608          */
4609         if (res == Z_NO_ENTRY) {
4610                 char flagstr[ZONECFG_SECFLAGS_MAX];
4611                 brand_handle_t bh = NULL;
4612 
4613                 if ((bh = brand_open(brand_name)) == NULL) {
4614                         zerror(zlogp, B_FALSE,
4615                             "unable to find brand named %s", brand_name);
4616                         return (Z_BAD_PROPERTY);
4617                 }
4618                 if (brand_get_secflags(bh, flagstr, sizeof (flagstr)) != 0) {
4619                         brand_close(bh);
4620                         zerror(zlogp, B_FALSE,
4621                             "unable to retrieve brand default security flags");
4622                         return (Z_BAD_PROPERTY);
4623                 }
4624                 brand_close(bh);
4625 
4626                 if (*flagstr != '\0' &&
4627                     strlcpy(tab.zone_secflags_default, flagstr,
4628                     sizeof (tab.zone_secflags_default)) >=
4629                     sizeof (tab.zone_secflags_default)) {
4630                         zerror(zlogp, B_FALSE,
4631                             "brand default security-flags is too long");
4632                         return (Z_BAD_PROPERTY);
4633                 }
4634         } else if (res != Z_OK) {
4635                 zerror(zlogp, B_FALSE,
4636                     "security-flags property is invalid: %d", res);
4637                 return (res);
4638         }
4639 
4640         if (strlen(tab.zone_secflags_lower) == 0) {
4641                 (void) strlcpy(tab.zone_secflags_lower, "none",
4642                     sizeof (tab.zone_secflags_lower));
4643         }
4644         if (strlen(tab.zone_secflags_default) == 0) {
4645                 (void) strlcpy(tab.zone_secflags_default,
4646                     tab.zone_secflags_lower,
4647                     sizeof (tab.zone_secflags_default));
4648         }
4649         if (strlen(tab.zone_secflags_upper) == 0) {
4650                 (void) strlcpy(tab.zone_secflags_upper, "all",
4651                     sizeof (tab.zone_secflags_upper));
4652         }
4653 
4654         if ((res = secflags_parse_check(&flagset, tab.zone_secflags_default,
4655             "default", zlogp)) != Z_OK) {
4656                 return (res);
4657         } else {
4658                 secflags_copy(&secflags.psf_inherit, &flagset);
4659                 secflags_copy(&secflags.psf_effective, &flagset);
4660         }
4661 
4662         if ((res = secflags_parse_check(&flagset, tab.zone_secflags_lower,
4663             "lower", zlogp)) != Z_OK) {
4664                 return (res);
4665         } else {
4666                 secflags_copy(&secflags.psf_lower, &flagset);
4667         }
4668 
4669         if ((res = secflags_parse_check(&flagset, tab.zone_secflags_upper,
4670             "upper", zlogp)) != Z_OK) {
4671                 return (res);
4672         } else {
4673                 secflags_copy(&secflags.psf_upper, &flagset);
4674         }
4675 
4676         if (!psecflags_validate(&secflags)) {
4677                 zerror(zlogp, B_TRUE, "security-flags violate invariants");
4678                 return (Z_BAD_PROPERTY);
4679         }
4680 
4681         if ((res = zone_setattr(zoneid, ZONE_ATTR_SECFLAGS, &secflags,
4682             sizeof (secflags))) != 0) {
4683                 zerror(zlogp, B_TRUE,
4684                     "security-flags couldn't be set: %d", res);
4685                 return (Z_SYSTEM);
4686         }
4687 
4688         return (Z_OK);
4689 }
4690 
4691 static int
4692 setup_zone_fs_allowed(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4693 {
4694         char fsallowed[ZONE_FS_ALLOWED_MAX];
4695         char *fsallowedp = fsallowed;
4696         int len = sizeof (fsallowed);
4697         int res;
4698 
4699         res = zonecfg_get_fs_allowed(handle, fsallowed, len);
4700 
4701         if (res == Z_BAD_PROPERTY) {
4702                 /* No value, set the defaults */
4703                 (void) strlcpy(fsallowed, DFLT_FS_ALLOWED, len);
4704         } else if (res != Z_OK) {
4705                 report_prop_err(zlogp, "fs-allowed", fsallowed, res);
4706                 return (res);
4707         } else if (fsallowed[0] == '-') {
4708                 /* dropping default filesystems - use remaining list */
4709                 if (fsallowed[1] != ',')
4710                         return (Z_OK);
4711                 fsallowedp += 2;
4712                 len -= 2;
4713         } else {
4714                 /* Has a value, append the defaults */
4715                 if (strlcat(fsallowed, ",", len) >= len ||
4716                     strlcat(fsallowed, DFLT_FS_ALLOWED, len) >= len) {
4717                         report_prop_err(zlogp, "fs-allowed", fsallowed,
4718                             Z_TOO_BIG);
4719                         return (Z_TOO_BIG);
4720                 }
4721         }
4722 
4723         if (zone_setattr(zoneid, ZONE_ATTR_FS_ALLOWED, fsallowedp, len) != 0) {
4724                 zerror(zlogp, B_TRUE,
4725                     "fs-allowed couldn't be set: %s: %d", fsallowedp, res);
4726                 return (Z_SYSTEM);
4727         }
4728 
4729         return (Z_OK);
4730 }
4731 
4732 static int
4733 setup_zone_attrs(zlog_t *zlogp, zoneid_t zoneid)
4734 {
4735         int res = Z_OK;
4736 
4737         if ((res = setup_zone_hostid(snap_hndl, zlogp, zoneid)) != Z_OK)
4738                 goto out;
4739 
4740         if ((res = setup_zone_fs_allowed(snap_hndl, zlogp, zoneid)) != Z_OK)
4741                 goto out;
4742 
4743         if ((res = setup_zone_secflags(snap_hndl, zlogp, zoneid)) != Z_OK)
4744                 goto out;
4745 
4746 out:
4747         return (res);
4748 }
4749 
4750 /*
4751  * The zone_did is a persistent debug ID.  Each zone should have a unique ID
4752  * in the kernel.  This is used for things like DTrace which want to monitor
4753  * zones across reboots.  They can't use the zoneid since that changes on
4754  * each boot.
4755  */
4756 zoneid_t
4757 vplat_create(zlog_t *zlogp, zone_mnt_t mount_cmd, zoneid_t zone_did)
4758 {
4759         zoneid_t rval = -1;
4760         priv_set_t *privs;
4761         char rootpath[MAXPATHLEN];
4762         char *rctlbuf = NULL;
4763         size_t rctlbufsz = 0;
4764         char *zfsbuf = NULL;
4765         size_t zfsbufsz = 0;
4766         zoneid_t zoneid = -1;
4767         int xerr;
4768         char *kzone;
4769         FILE *fp = NULL;
4770         tsol_zcent_t *zcent = NULL;
4771         int match = 0;
4772         int doi = 0;
4773         int flags = -1;
4774         zone_iptype_t iptype;
4775 
4776         if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
4777                 zerror(zlogp, B_TRUE, "unable to determine zone root");
4778                 return (-1);
4779         }
4780         if (zonecfg_in_alt_root())
4781                 resolve_lofs(zlogp, rootpath, sizeof (rootpath));
4782 
4783         if (vplat_get_iptype(zlogp, &iptype) < 0) {
4784                 zerror(zlogp, B_TRUE, "unable to determine ip-type");
4785                 return (-1);
4786         }
4787         if (iptype == ZS_EXCLUSIVE) {
4788                 flags = ZCF_NET_EXCL;
4789         } else {
4790                 flags = 0;
4791         }
4792         if (flags == -1)
4793                 abort();
4794 
4795         if ((privs = priv_allocset()) == NULL) {
4796                 zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
4797                 return (-1);
4798         }
4799         priv_emptyset(privs);
4800         if (get_privset(zlogp, privs, mount_cmd) != 0)
4801                 goto error;
4802 
4803         if (mount_cmd == Z_MNT_BOOT &&
4804             get_rctls(zlogp, &rctlbuf, &rctlbufsz) != 0) {
4805                 zerror(zlogp, B_FALSE, "Unable to get list of rctls");
4806                 goto error;
4807         }
4808 
4809         if (get_datasets(zlogp, &zfsbuf, &zfsbufsz) != 0) {
4810                 zerror(zlogp, B_FALSE, "Unable to get list of ZFS datasets");
4811                 goto error;
4812         }
4813 
4814         if (mount_cmd == Z_MNT_BOOT && is_system_labeled()) {
4815                 zcent = get_zone_label(zlogp, privs);
4816                 if (zcent != NULL) {
4817                         match = zcent->zc_match;
4818                         doi = zcent->zc_doi;
4819                         *zlabel = zcent->zc_label;
4820                 } else {
4821                         goto error;
4822                 }
4823                 if (validate_rootds_label(zlogp, rootpath, zlabel) != 0)
4824                         goto error;
4825         }
4826 
4827         kzone = zone_name;
4828 
4829         /*
4830          * We must do this scan twice.  First, we look for zones running on the
4831          * main system that are using this root (or any subdirectory of it).
4832          * Next, we reduce to the shortest path and search for loopback mounts
4833          * that use this same source node (same device and inode).
4834          */
4835         if (duplicate_zone_root(zlogp, rootpath))
4836                 goto error;
4837         if (duplicate_reachable_path(zlogp, rootpath))
4838                 goto error;
4839 
4840         if (ALT_MOUNT(mount_cmd)) {
4841                 root_to_lu(zlogp, rootpath, sizeof (rootpath), B_TRUE);
4842 
4843                 /*
4844                  * Forge up a special root for this zone.  When a zone is
4845                  * mounted, we can't let the zone have its own root because the
4846                  * tools that will be used in this "scratch zone" need access
4847                  * to both the zone's resources and the running machine's
4848                  * executables.
4849                  *
4850                  * Note that the mkdir here also catches read-only filesystems.
4851                  */
4852                 if (mkdir(rootpath, 0755) != 0 && errno != EEXIST) {
4853                         zerror(zlogp, B_TRUE, "cannot create %s", rootpath);
4854                         goto error;
4855                 }
4856                 if (domount(zlogp, "tmpfs", "", "swap", rootpath) != 0)
4857                         goto error;
4858         }
4859 
4860         if (zonecfg_in_alt_root()) {
4861                 /*
4862                  * If we are mounting up a zone in an alternate root partition,
4863                  * then we have some additional work to do before starting the
4864                  * zone.  First, resolve the root path down so that we're not
4865                  * fooled by duplicates.  Then forge up an internal name for
4866                  * the zone.
4867                  */
4868                 if ((fp = zonecfg_open_scratch("", B_TRUE)) == NULL) {
4869                         zerror(zlogp, B_TRUE, "cannot open mapfile");
4870                         goto error;
4871                 }
4872                 if (zonecfg_lock_scratch(fp) != 0) {
4873                         zerror(zlogp, B_TRUE, "cannot lock mapfile");
4874                         goto error;
4875                 }
4876                 if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
4877                     NULL, 0) == 0) {
4878                         zerror(zlogp, B_FALSE, "scratch zone already running");
4879                         goto error;
4880                 }
4881                 /* This is the preferred name */
4882                 (void) snprintf(kernzone, sizeof (kernzone), "SUNWlu-%s",
4883                     zone_name);
4884                 srandom(getpid());
4885                 while (zonecfg_reverse_scratch(fp, kernzone, NULL, 0, NULL,
4886                     0) == 0) {
4887                         /* This is just an arbitrary name; note "." usage */
4888                         (void) snprintf(kernzone, sizeof (kernzone),
4889                             "SUNWlu.%08lX%08lX", random(), random());
4890                 }
4891                 kzone = kernzone;
4892         }
4893 
4894         xerr = 0;
4895         if ((zoneid = zone_create(kzone, rootpath, privs, rctlbuf,
4896             rctlbufsz, zfsbuf, zfsbufsz, &xerr, match, doi, zlabel,
4897             flags, zone_did)) == -1) {
4898                 if (xerr == ZE_AREMOUNTS) {
4899                         if (zonecfg_find_mounts(rootpath, NULL, NULL) < 1) {
4900                                 zerror(zlogp, B_FALSE,
4901                                     "An unknown file-system is mounted on "
4902                                     "a subdirectory of %s", rootpath);
4903                         } else {
4904 
4905                                 zerror(zlogp, B_FALSE,
4906                                     "These file-systems are mounted on "
4907                                     "subdirectories of %s:", rootpath);
4908                                 (void) zonecfg_find_mounts(rootpath,
4909                                     prtmount, zlogp);
4910                         }
4911                 } else if (xerr == ZE_CHROOTED) {
4912                         zerror(zlogp, B_FALSE, "%s: "
4913                             "cannot create a zone from a chrooted "
4914                             "environment", "zone_create");
4915                 } else if (xerr == ZE_LABELINUSE) {
4916                         char zonename[ZONENAME_MAX];
4917                         (void) getzonenamebyid(getzoneidbylabel(zlabel),
4918                             zonename, ZONENAME_MAX);
4919                         zerror(zlogp, B_FALSE, "The zone label is already "
4920                             "used by the zone '%s'.", zonename);
4921                 } else {
4922                         zerror(zlogp, B_TRUE, "%s failed", "zone_create");
4923                 }
4924                 goto error;
4925         }
4926 
4927         if (zonecfg_in_alt_root() &&
4928             zonecfg_add_scratch(fp, zone_name, kernzone,
4929             zonecfg_get_root()) == -1) {
4930                 zerror(zlogp, B_TRUE, "cannot add mapfile entry");
4931                 goto error;
4932         }
4933 
4934         /*
4935          * The following actions are not performed when merely mounting a zone
4936          * for administrative use.
4937          */
4938         if (mount_cmd == Z_MNT_BOOT) {
4939                 brand_handle_t bh;
4940                 struct brand_attr attr;
4941                 char modname[MAXPATHLEN];
4942 
4943                 if (setup_zone_attrs(zlogp, zoneid) != Z_OK)
4944                         goto error;
4945 
4946                 if ((bh = brand_open(brand_name)) == NULL) {
4947                         zerror(zlogp, B_FALSE,
4948                             "unable to determine brand name");
4949                         goto error;
4950                 }
4951 
4952                 if (!is_system_labeled() &&
4953                     (strcmp(brand_name, LABELED_BRAND_NAME) == 0)) {
4954                         brand_close(bh);
4955                         zerror(zlogp, B_FALSE,
4956                             "cannot boot labeled zone on unlabeled system");
4957                         goto error;
4958                 }
4959 
4960                 /*
4961                  * If this brand requires any kernel support, now is the time to
4962                  * get it loaded and initialized.
4963                  */
4964                 if (brand_get_modname(bh, modname, MAXPATHLEN) < 0) {
4965                         brand_close(bh);
4966                         zerror(zlogp, B_FALSE,
4967                             "unable to determine brand kernel module");
4968                         goto error;
4969                 }
4970                 brand_close(bh);
4971 
4972                 if (strlen(modname) > 0) {
4973                         (void) strlcpy(attr.ba_brandname, brand_name,
4974                             sizeof (attr.ba_brandname));
4975                         (void) strlcpy(attr.ba_modname, modname,
4976                             sizeof (attr.ba_modname));
4977                         if (zone_setattr(zoneid, ZONE_ATTR_BRAND, &attr,
4978                             sizeof (attr) != 0)) {
4979                                 zerror(zlogp, B_TRUE,
4980                                     "could not set zone brand attribute.");
4981                                 goto error;
4982                         }
4983                 }
4984 
4985                 if (setup_zone_rm(zlogp, zone_name, zoneid) != Z_OK)
4986                         goto error;
4987 
4988                 set_mlps(zlogp, zoneid, zcent);
4989         }
4990 
4991         rval = zoneid;
4992         zoneid = -1;
4993 
4994 error:
4995         if (zoneid != -1) {
4996                 (void) zone_shutdown(zoneid);
4997                 (void) zone_destroy(zoneid);
4998         }
4999         if (rctlbuf != NULL)
5000                 free(rctlbuf);
5001         if (zfsbuf != NULL)
5002                 free(zfsbuf);
5003         priv_freeset(privs);
5004         if (fp != NULL)
5005                 zonecfg_close_scratch(fp);
5006         lofs_discard_mnttab();
5007         if (zcent != NULL)
5008                 tsol_freezcent(zcent);
5009         return (rval);
5010 }
5011 
5012 /*
5013  * Enter the zone and write a /etc/zones/index file there.  This allows
5014  * libzonecfg (and thus zoneadm) to report the UUID and potentially other zone
5015  * details from inside the zone.
5016  */
5017 static void
5018 write_index_file(zoneid_t zoneid)
5019 {
5020         FILE *zef;
5021         FILE *zet;
5022         struct zoneent *zep;
5023         pid_t child;
5024         int tmpl_fd;
5025         ctid_t ct;
5026         int fd;
5027         char uuidstr[UUID_PRINTABLE_STRING_LENGTH];
5028 
5029         /* Locate the zone entry in the global zone's index file */
5030         if ((zef = setzoneent()) == NULL)
5031                 return;
5032         while ((zep = getzoneent_private(zef)) != NULL) {
5033                 if (strcmp(zep->zone_name, zone_name) == 0)
5034                         break;
5035                 free(zep);
5036         }
5037         endzoneent(zef);
5038         if (zep == NULL)
5039                 return;
5040 
5041         if ((tmpl_fd = init_template()) == -1) {
5042                 free(zep);
5043                 return;
5044         }
5045 
5046         if ((child = fork()) == -1) {
5047                 (void) ct_tmpl_clear(tmpl_fd);
5048                 (void) close(tmpl_fd);
5049                 free(zep);
5050                 return;
5051         }
5052 
5053         /* parent waits for child to finish */
5054         if (child != 0) {
5055                 free(zep);
5056                 if (contract_latest(&ct) == -1)
5057                         ct = -1;
5058                 (void) ct_tmpl_clear(tmpl_fd);
5059                 (void) close(tmpl_fd);
5060                 (void) waitpid(child, NULL, 0);
5061                 (void) contract_abandon_id(ct);
5062                 return;
5063         }
5064 
5065         /* child enters zone and sets up index file */
5066         (void) ct_tmpl_clear(tmpl_fd);
5067         if (zone_enter(zoneid) != -1) {
5068                 (void) mkdir(ZONE_CONFIG_ROOT, ZONE_CONFIG_MODE);
5069                 (void) chown(ZONE_CONFIG_ROOT, ZONE_CONFIG_UID,
5070                     ZONE_CONFIG_GID);
5071                 fd = open(ZONE_INDEX_FILE, O_WRONLY|O_CREAT|O_TRUNC,
5072                     ZONE_INDEX_MODE);
5073                 if (fd != -1 && (zet = fdopen(fd, "w")) != NULL) {
5074                         (void) fchown(fd, ZONE_INDEX_UID, ZONE_INDEX_GID);
5075                         if (uuid_is_null(zep->zone_uuid))
5076                                 uuidstr[0] = '\0';
5077                         else
5078                                 uuid_unparse(zep->zone_uuid, uuidstr);
5079                         (void) fprintf(zet, "%s:%s:/:%s\n", zep->zone_name,
5080                             zone_state_str(zep->zone_state),
5081                             uuidstr);
5082                         (void) fclose(zet);
5083                 }
5084         }
5085         _exit(0);
5086 }
5087 
5088 int
5089 vplat_bringup(zlog_t *zlogp, zone_mnt_t mount_cmd, zoneid_t zoneid)
5090 {
5091         char zpath[MAXPATHLEN];
5092 
5093         if (mount_cmd == Z_MNT_BOOT && validate_datasets(zlogp) != 0) {
5094                 lofs_discard_mnttab();
5095                 return (-1);
5096         }
5097 
5098         /*
5099          * Before we try to mount filesystems we need to create the
5100          * attribute backing store for /dev
5101          */
5102         (void) strlcpy(zpath, zonepath, sizeof (zpath));
5103         resolve_lofs(zlogp, zpath, sizeof (zpath));
5104 
5105         /* Make /dev directory owned by root, grouped sys */
5106         if (make_one_dir(zlogp, zpath, "/dev", DEFAULT_DIR_MODE, 0, 3) != 0) {
5107                 lofs_discard_mnttab();
5108                 return (-1);
5109         }
5110 
5111         if (mount_filesystems(zlogp, mount_cmd) != 0) {
5112                 lofs_discard_mnttab();
5113                 return (-1);
5114         }
5115 
5116         if (mount_cmd == Z_MNT_BOOT) {
5117                 zone_iptype_t iptype;
5118 
5119                 if (vplat_get_iptype(zlogp, &iptype) < 0) {
5120                         zerror(zlogp, B_TRUE, "unable to determine ip-type");
5121                         lofs_discard_mnttab();
5122                         return (-1);
5123                 }
5124 
5125                 switch (iptype) {
5126                 case ZS_SHARED:
5127                         /* Always do this to make lo0 get configured */
5128                         if (configure_shared_network_interfaces(zlogp) != 0) {
5129                                 lofs_discard_mnttab();
5130                                 return (-1);
5131                         }
5132                         break;
5133                 case ZS_EXCLUSIVE:
5134                         if (configure_exclusive_network_interfaces(zlogp,
5135                             zoneid) !=
5136                             0) {
5137                                 lofs_discard_mnttab();
5138                                 return (-1);
5139                         }
5140                         break;
5141                 default:
5142                         abort();
5143                 }
5144         }
5145 
5146         write_index_file(zoneid);
5147 
5148         lofs_discard_mnttab();
5149         return (0);
5150 }
5151 
5152 static int
5153 lu_root_teardown(zlog_t *zlogp)
5154 {
5155         char zroot[MAXPATHLEN];
5156 
5157         if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
5158                 zerror(zlogp, B_FALSE, "unable to determine zone root");
5159                 return (-1);
5160         }
5161         root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
5162 
5163         /*
5164          * At this point, the processes are gone, the filesystems (save the
5165          * root) are unmounted, and the zone is on death row.  But there may
5166          * still be creds floating about in the system that reference the
5167          * zone_t, and which pin down zone_rootvp causing this call to fail
5168          * with EBUSY.  Thus, we try for a little while before just giving up.
5169          * (How I wish this were not true, and umount2 just did the right
5170          * thing, or tmpfs supported MS_FORCE This is a gross hack.)
5171          */
5172         if (umount2(zroot, MS_FORCE) != 0) {
5173                 if (errno == ENOTSUP && umount2(zroot, 0) == 0)
5174                         goto unmounted;
5175                 if (errno == EBUSY) {
5176                         int tries = 10;
5177 
5178                         while (--tries >= 0) {
5179                                 (void) sleep(1);
5180                                 if (umount2(zroot, 0) == 0)
5181                                         goto unmounted;
5182                                 if (errno != EBUSY)
5183                                         break;
5184                         }
5185                 }
5186                 zerror(zlogp, B_TRUE, "unable to unmount '%s'", zroot);
5187                 return (-1);
5188         }
5189 unmounted:
5190 
5191         /*
5192          * Only zones in an alternate root environment have scratch zone
5193          * entries.
5194          */
5195         if (zonecfg_in_alt_root()) {
5196                 FILE *fp;
5197                 int retv;
5198 
5199                 if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
5200                         zerror(zlogp, B_TRUE, "cannot open mapfile");
5201                         return (-1);
5202                 }
5203                 retv = -1;
5204                 if (zonecfg_lock_scratch(fp) != 0)
5205                         zerror(zlogp, B_TRUE, "cannot lock mapfile");
5206                 else if (zonecfg_delete_scratch(fp, kernzone) != 0)
5207                         zerror(zlogp, B_TRUE, "cannot delete map entry");
5208                 else
5209                         retv = 0;
5210                 zonecfg_close_scratch(fp);
5211                 return (retv);
5212         } else {
5213                 return (0);
5214         }
5215 }
5216 
5217 /*
5218  * Delete all transient VNICs belonging to this zone. A transient VNIC
5219  * is one that is created and destroyed along with the lifetime of the
5220  * zone. Non-transient VNICs, ones that are assigned from the GZ to a
5221  * NGZ, are reassigned to the GZ in zone_shutdown() via the
5222  * zone-specific data (zsd) callbacks.
5223  */
5224 static int
5225 delete_transient_vnics(zlog_t *zlogp, zoneid_t zoneid)
5226 {
5227         dladm_status_t status;
5228         int num_links = 0;
5229         datalink_id_t *links, link;
5230         uint32_t link_flags;
5231         datalink_class_t link_class;
5232         char link_name[MAXLINKNAMELEN];
5233 
5234         if (zone_list_datalink(zoneid, &num_links, NULL) != 0) {
5235                 zerror(zlogp, B_TRUE, "unable to determine "
5236                     "number of network interfaces");
5237                 return (-1);
5238         }
5239 
5240         if (num_links == 0)
5241                 return (0);
5242 
5243         links = malloc(num_links * sizeof (datalink_id_t));
5244 
5245         if (links == NULL) {
5246                 zerror(zlogp, B_TRUE, "failed to delete "
5247                     "network interfaces because of alloc fail");
5248                 return (-1);
5249         }
5250 
5251         if (zone_list_datalink(zoneid, &num_links, links) != 0) {
5252                 zerror(zlogp, B_TRUE, "failed to delete "
5253                     "network interfaces because of failure "
5254                     "to list them");
5255                 return (-1);
5256         }
5257 
5258         for (int i = 0; i < num_links; i++) {
5259                 char dlerr[DLADM_STRSIZE];
5260                 link = links[i];
5261 
5262                 status = dladm_datalink_id2info(dld_handle, link, &link_flags,
5263                     &link_class, NULL, link_name, sizeof (link_name));
5264 
5265                 if (status != DLADM_STATUS_OK) {
5266                         zerror(zlogp, B_FALSE, "failed to "
5267                             "delete network interface (%u)"
5268                             "due to failure to get link info: %s",
5269                             link,
5270                             dladm_status2str(status, dlerr));
5271                         return (-1);
5272                 }
5273 
5274                 if (link_flags & DLADM_OPT_TRANSIENT) {
5275                         assert(link_class & DATALINK_CLASS_VNIC);
5276                         status = dladm_vnic_delete(dld_handle, link,
5277                             DLADM_OPT_ACTIVE);
5278 
5279                         if (status != DLADM_STATUS_OK) {
5280                                 zerror(zlogp, B_TRUE, "failed to delete link "
5281                                     "with id %d: %s", link,
5282                                     dladm_status2str(status, dlerr));
5283                                 return (-1);
5284                         }
5285                 }
5286         }
5287 
5288         return (0);
5289 }
5290 
5291 int
5292 vplat_teardown(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting,
5293     boolean_t debug)
5294 {
5295         char *kzone;
5296         zoneid_t zoneid;
5297         int res;
5298         char pool_err[128];
5299         char cmdbuf[MAXPATHLEN];
5300         brand_handle_t bh = NULL;
5301         dladm_status_t status;
5302         char errmsg[DLADM_STRSIZE];
5303         ushort_t flags;
5304 
5305         kzone = zone_name;
5306         if (zonecfg_in_alt_root()) {
5307                 FILE *fp;
5308 
5309                 if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
5310                         zerror(zlogp, B_TRUE, "unable to open map file");
5311                         goto error;
5312                 }
5313                 if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
5314                     kernzone, sizeof (kernzone)) != 0) {
5315                         zerror(zlogp, B_FALSE, "unable to find scratch zone");
5316                         zonecfg_close_scratch(fp);
5317                         goto error;
5318                 }
5319                 zonecfg_close_scratch(fp);
5320                 kzone = kernzone;
5321         }
5322 
5323         if ((zoneid = getzoneidbyname(kzone)) == ZONE_ID_UNDEFINED) {
5324                 if (!bringup_failure_recovery)
5325                         zerror(zlogp, B_TRUE, "unable to get zoneid");
5326                 if (unmount_cmd)
5327                         (void) lu_root_teardown(zlogp);
5328                 goto error;
5329         }
5330 
5331         if (remove_datalink_pool(zlogp, zoneid) != 0)
5332                 zerror(zlogp, B_FALSE, "unable clear datalink pool property");
5333 
5334         if (remove_datalink_protect(zlogp, zoneid) != 0)
5335                 zerror(zlogp, B_FALSE,
5336                     "unable clear datalink protect property");
5337 
5338         /*
5339          * The datalinks assigned to the zone will be removed from the NGZ as
5340          * part of zone_shutdown() so that we need to remove protect/pool etc.
5341          * before zone_shutdown(). Even if the shutdown itself fails, the zone
5342          * will not be able to violate any constraints applied because the
5343          * datalinks are no longer available to the zone.
5344          */
5345         if (zone_shutdown(zoneid) != 0) {
5346                 zerror(zlogp, B_TRUE, "unable to shutdown zone");
5347                 goto error;
5348         }
5349 
5350         /* Get a handle to the brand info for this zone */
5351         if ((bh = brand_open(brand_name)) == NULL) {
5352                 zerror(zlogp, B_FALSE, "unable to determine zone brand");
5353                 return (-1);
5354         }
5355         /*
5356          * If there is a brand 'halt' callback, execute it now to give the
5357          * brand a chance to cleanup any custom configuration.
5358          */
5359         (void) strcpy(cmdbuf, EXEC_PREFIX);
5360         if (brand_get_halt(bh, zone_name, zonepath, cmdbuf + EXEC_LEN,
5361             sizeof (cmdbuf) - EXEC_LEN) < 0) {
5362                 brand_close(bh);
5363                 zerror(zlogp, B_FALSE, "unable to determine branded zone's "
5364                     "halt callback.");
5365                 goto error;
5366         }
5367         brand_close(bh);
5368 
5369         if ((strlen(cmdbuf) > EXEC_LEN) &&
5370             (do_subproc(zlogp, cmdbuf, NULL, debug) != Z_OK)) {
5371                 zerror(zlogp, B_FALSE, "%s failed", cmdbuf);
5372                 goto error;
5373         }
5374 
5375         if (!unmount_cmd) {
5376                 zone_iptype_t iptype;
5377 
5378                 if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
5379                     sizeof (flags)) < 0) {
5380                         if (vplat_get_iptype(zlogp, &iptype) < 0) {
5381                                 zerror(zlogp, B_TRUE, "unable to determine "
5382                                     "ip-type");
5383                                 goto error;
5384                         }
5385                 } else {
5386                         if (flags & ZF_NET_EXCL)
5387                                 iptype = ZS_EXCLUSIVE;
5388                         else
5389                                 iptype = ZS_SHARED;
5390                 }
5391 
5392                 switch (iptype) {
5393                 case ZS_SHARED:
5394                         if (unconfigure_shared_network_interfaces(zlogp,
5395                             zoneid) != 0) {
5396                                 zerror(zlogp, B_FALSE, "unable to unconfigure "
5397                                     "network interfaces in zone");
5398                                 goto error;
5399                         }
5400                         break;
5401                 case ZS_EXCLUSIVE:
5402                         if (delete_transient_vnics(zlogp, zoneid) != 0) {
5403                                 zerror(zlogp, B_FALSE, "unable to delete "
5404                                     "transient vnics in zone");
5405                                 goto error;
5406                         }
5407 
5408                         status = dladm_zone_halt(dld_handle, zoneid);
5409                         if (status != DLADM_STATUS_OK) {
5410                                 zerror(zlogp, B_FALSE, "unable to notify "
5411                                     "dlmgmtd of zone halt: %s",
5412                                     dladm_status2str(status, errmsg));
5413                                 goto error;
5414                         }
5415                         break;
5416                 }
5417         }
5418 
5419         if (!unmount_cmd && tcp_abort_connections(zlogp, zoneid) != 0) {
5420                 zerror(zlogp, B_TRUE, "unable to abort TCP connections");
5421                 goto error;
5422         }
5423 
5424         if (unmount_filesystems(zlogp, zoneid, unmount_cmd) != 0) {
5425                 zerror(zlogp, B_FALSE,
5426                     "unable to unmount file systems in zone");
5427                 goto error;
5428         }
5429 
5430         /*
5431          * If we are rebooting then we normally don't want to destroy an
5432          * existing temporary pool at this point so that we can just reuse it
5433          * when the zone boots back up.  However, it is also possible we were
5434          * running with a temporary pool and the zone configuration has been
5435          * modified to no longer use a temporary pool.  In that case we need
5436          * to destroy the temporary pool now.  This case looks like the case
5437          * where we never had a temporary pool configured but
5438          * zonecfg_destroy_tmp_pool will do the right thing either way.
5439          */
5440         if (!unmount_cmd) {
5441                 boolean_t destroy_tmp_pool = B_TRUE;
5442 
5443                 if (rebooting) {
5444                         struct zone_psettab pset_tab;
5445 
5446                         if (zonecfg_lookup_pset(snap_hndl, &pset_tab) == Z_OK)
5447                                 destroy_tmp_pool = B_FALSE;
5448                 }
5449 
5450                 if (destroy_tmp_pool) {
5451                         if ((res = zonecfg_destroy_tmp_pool(zone_name, pool_err,
5452                             sizeof (pool_err))) != Z_OK) {
5453                                 if (res == Z_POOL)
5454                                         zerror(zlogp, B_FALSE, pool_err);
5455                         }
5456                 }
5457         }
5458 
5459         remove_mlps(zlogp, zoneid);
5460 
5461         if (zone_destroy(zoneid) != 0) {
5462                 zerror(zlogp, B_TRUE, "unable to destroy zone");
5463                 goto error;
5464         }
5465 
5466         /*
5467          * Special teardown for alternate boot environments: remove the tmpfs
5468          * root for the zone and then remove it from the map file.
5469          */
5470         if (unmount_cmd && lu_root_teardown(zlogp) != 0)
5471                 goto error;
5472 
5473         lofs_discard_mnttab();
5474         return (0);
5475 
5476 error:
5477         lofs_discard_mnttab();
5478         return (-1);
5479 }