1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright 2018, Joyent Inc.
25 * Copyright (c) 2015, 2016 by Delphix. All rights reserved.
26 * Copyright 2019 OmniOS Community Edition (OmniOSce) Association.
27 * Copyright 2020 RackTop Systems Inc.
28 * Copyright 2023 Oxide Computer Company
29 */
30
31 /*
32 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
33 */
34
35 /*
36 * This module contains functions used to bring up and tear down the
37 * Virtual Platform: [un]mounting file-systems, [un]plumbing network
38 * interfaces, [un]configuring devices, establishing resource controls,
39 * and creating/destroying the zone in the kernel. These actions, on
40 * the way up, ready the zone; on the way down, they halt the zone.
41 * See the much longer block comment at the beginning of zoneadmd.c
42 * for a bigger picture of how the whole program functions.
43 *
44 * This module also has primary responsibility for the layout of "scratch
45 * zones." These are mounted, but inactive, zones that are used during
46 * operating system upgrade and potentially other administrative action. The
47 * scratch zone environment is similar to the miniroot environment. The zone's
48 * actual root is mounted read-write on /a, and the standard paths (/usr,
49 * /sbin, /lib) all lead to read-only copies of the running system's binaries.
50 * This allows the administrative tools to manipulate the zone using "-R /a"
51 * without relying on any binaries in the zone itself.
52 *
53 * If the scratch zone is on an alternate root (Live Upgrade [LU] boot
54 * environment), then we must resolve the lofs mounts used there to uncover
55 * writable (unshared) resources. Shared resources, though, are always
56 * read-only. In addition, if the "same" zone with a different root path is
57 * currently running, then "/b" inside the zone points to the running zone's
58 * root. This allows LU to synchronize configuration files during the upgrade
59 * process.
60 *
61 * To construct this environment, this module creates a tmpfs mount on
62 * $ZONEPATH/lu. Inside this scratch area, the miniroot-like environment as
63 * described above is constructed on the fly. The zone is then created using
64 * $ZONEPATH/lu as the root.
65 *
66 * Note that scratch zones are inactive. The zone's bits are not running and
67 * likely cannot be run correctly until upgrade is done. Init is not running
68 * there, nor is SMF. Because of this, the "mounted" state of a scratch zone
69 * is not a part of the usual halt/ready/boot state machine.
70 */
71
72 #include <sys/param.h>
73 #include <sys/mount.h>
74 #include <sys/mntent.h>
75 #include <sys/socket.h>
76 #include <sys/utsname.h>
77 #include <sys/types.h>
78 #include <sys/stat.h>
79 #include <sys/sockio.h>
80 #include <sys/stropts.h>
81 #include <sys/conf.h>
82 #include <sys/systeminfo.h>
83 #include <sys/secflags.h>
84 #include <sys/vnic.h>
85
86 #include <libdlpi.h>
87 #include <libdllink.h>
88 #include <libdlvlan.h>
89 #include <libdlvnic.h>
90 #include <libdlaggr.h>
91
92 #include <inet/tcp.h>
93 #include <arpa/inet.h>
94 #include <netinet/in.h>
95 #include <net/route.h>
96
97 #include <stdio.h>
98 #include <errno.h>
99 #include <fcntl.h>
100 #include <unistd.h>
101 #include <rctl.h>
102 #include <stdlib.h>
103 #include <string.h>
104 #include <strings.h>
105 #include <wait.h>
106 #include <limits.h>
107 #include <libgen.h>
108 #include <libzfs.h>
109 #include <libdevinfo.h>
110 #include <zone.h>
111 #include <assert.h>
112 #include <libcontract.h>
113 #include <libcontract_priv.h>
114 #include <uuid/uuid.h>
115
116 #include <sys/mntio.h>
117 #include <sys/mnttab.h>
118 #include <sys/fs/autofs.h> /* for _autofssys() */
119 #include <sys/fs/lofs_info.h>
120 #include <sys/fs/zfs.h>
121
122 #include <pool.h>
123 #include <sys/pool.h>
124 #include <sys/priocntl.h>
125
126 #include <libbrand.h>
127 #include <sys/brand.h>
128 #include <libzonecfg.h>
129 #include <synch.h>
130
131 #include "zoneadmd.h"
132 #include <tsol/label.h>
133 #include <libtsnet.h>
134 #include <sys/priv.h>
135 #include <libinetutil.h>
136
137 #define V4_ADDR_LEN 32
138 #define V6_ADDR_LEN 128
139
140 #define RESOURCE_DEFAULT_OPTS \
141 MNTOPT_RO "," MNTOPT_LOFS_NOSUB "," MNTOPT_NODEVICES
142
143 #define DFSTYPES "/etc/dfs/fstypes"
144 #define MAXTNZLEN 2048
145
146 /* Number of times to retry unmounting if it fails */
147 #define UMOUNT_RETRIES 30
148
149 #define ALT_MOUNT(mount_cmd) ((mount_cmd) != Z_MNT_BOOT)
150
151 /* a reasonable estimate for the number of lwps per process */
152 #define LWPS_PER_PROCESS 10
153
154 /* for routing socket */
155 static int rts_seqno = 0;
156
157 /* mangled zone name when mounting in an alternate root environment */
158 static char kernzone[ZONENAME_MAX];
159
160 /* array of cached mount entries for resolve_lofs */
161 static struct mnttab *resolve_lofs_mnts, *resolve_lofs_mnt_max;
162
163 /* for Trusted Extensions */
164 static tsol_zcent_t *get_zone_label(zlog_t *, priv_set_t *);
165 static int tsol_mounts(zlog_t *, char *, char *);
166 static void tsol_unmounts(zlog_t *, char *);
167
168 static m_label_t *zlabel = NULL;
169 static m_label_t *zid_label = NULL;
170 static priv_set_t *zprivs = NULL;
171
172 static const char *DFLT_FS_ALLOWED = "hsfs,smbfs,nfs,nfs3,nfs4,nfsdyn";
173
174 typedef struct zone_proj_rctl_map {
175 char *zpr_zone_rctl;
176 char *zpr_project_rctl;
177 } zone_proj_rctl_map_t;
178
179 static zone_proj_rctl_map_t zone_proj_rctl_map[] = {
180 {"zone.max-msg-ids", "project.max-msg-ids"},
181 {"zone.max-sem-ids", "project.max-sem-ids"},
182 {"zone.max-shm-ids", "project.max-shm-ids"},
183 {"zone.max-shm-memory", "project.max-shm-memory"},
184 {NULL, NULL}
185 };
186
187 /* from libsocket, not in any header file */
188 extern int getnetmaskbyaddr(struct in_addr, struct in_addr *);
189
190 /* from zoneadmd */
191 extern char query_hook[];
192 extern char post_statechg_hook[];
193
194 /*
195 * For each "net" resource configured in zonecfg, we track a zone_addr_list_t
196 * node in a linked list that is sorted by linkid. The list is constructed as
197 * the xml configuration file is parsed, and the information
198 * contained in each node is added to the kernel before the zone is
199 * booted, to be retrieved and applied from within the exclusive-IP NGZ
200 * on boot.
201 */
202 typedef struct zone_addr_list {
203 struct zone_addr_list *za_next;
204 datalink_id_t za_linkid; /* datalink_id_t of interface */
205 struct zone_nwiftab za_nwiftab; /* address, defrouter properties */
206 } zone_addr_list_t;
207
208 /*
209 * An optimization for build_mnttable: reallocate (and potentially copy the
210 * data) only once every N times through the loop.
211 */
212 #define MNTTAB_HUNK 32
213
214 /* some handy macros */
215 #define SIN(s) ((struct sockaddr_in *)s)
216 #define SIN6(s) ((struct sockaddr_in6 *)s)
217
218 /*
219 * Private autofs system call
220 */
221 extern int _autofssys(int, void *);
222
223 static int
224 autofs_cleanup(zoneid_t zoneid)
225 {
226 int r;
227
228 /*
229 * Ask autofs to unmount all trigger nodes in the given zone.
230 * Handle ENOSYS in the case that the autofs kernel module is not
231 * installed.
232 */
233 r = _autofssys(AUTOFS_UNMOUNTALL, (void *)((uintptr_t)zoneid));
234 if (r != 0 && errno == ENOSYS) {
235 return (0);
236 }
237 return (r);
238 }
239
240 static void
241 free_mnttable(struct mnttab *mnt_array, uint_t nelem)
242 {
243 uint_t i;
244
245 if (mnt_array == NULL)
246 return;
247 for (i = 0; i < nelem; i++) {
248 free(mnt_array[i].mnt_mountp);
249 free(mnt_array[i].mnt_fstype);
250 free(mnt_array[i].mnt_special);
251 free(mnt_array[i].mnt_mntopts);
252 assert(mnt_array[i].mnt_time == NULL);
253 }
254 free(mnt_array);
255 }
256
257 /*
258 * Build the mount table for the zone rooted at "zroot", storing the resulting
259 * array of struct mnttabs in "mnt_arrayp" and the number of elements in the
260 * array in "nelemp".
261 */
262 static int
263 build_mnttable(zlog_t *zlogp, const char *zroot, size_t zrootlen, FILE *mnttab,
264 struct mnttab **mnt_arrayp, uint_t *nelemp)
265 {
266 struct mnttab mnt;
267 struct mnttab *mnts;
268 struct mnttab *mnp;
269 uint_t nmnt;
270
271 rewind(mnttab);
272 resetmnttab(mnttab);
273 nmnt = 0;
274 mnts = NULL;
275 while (getmntent(mnttab, &mnt) == 0) {
276 struct mnttab *tmp_array;
277
278 if (strncmp(mnt.mnt_mountp, zroot, zrootlen) != 0)
279 continue;
280 if (nmnt % MNTTAB_HUNK == 0) {
281 tmp_array = realloc(mnts,
282 (nmnt + MNTTAB_HUNK) * sizeof (*mnts));
283 if (tmp_array == NULL) {
284 free_mnttable(mnts, nmnt);
285 return (-1);
286 }
287 mnts = tmp_array;
288 }
289 mnp = &mnts[nmnt++];
290
291 /*
292 * Zero out any fields we're not using.
293 */
294 (void) memset(mnp, 0, sizeof (*mnp));
295
296 if (mnt.mnt_special != NULL)
297 mnp->mnt_special = strdup(mnt.mnt_special);
298 if (mnt.mnt_mntopts != NULL)
299 mnp->mnt_mntopts = strdup(mnt.mnt_mntopts);
300 mnp->mnt_mountp = strdup(mnt.mnt_mountp);
301 mnp->mnt_fstype = strdup(mnt.mnt_fstype);
302 if ((mnt.mnt_special != NULL && mnp->mnt_special == NULL) ||
303 (mnt.mnt_mntopts != NULL && mnp->mnt_mntopts == NULL) ||
304 mnp->mnt_mountp == NULL || mnp->mnt_fstype == NULL) {
305 zerror(zlogp, B_TRUE, "memory allocation failed");
306 free_mnttable(mnts, nmnt);
307 return (-1);
308 }
309 }
310 *mnt_arrayp = mnts;
311 *nelemp = nmnt;
312 return (0);
313 }
314
315 /*
316 * This is an optimization. The resolve_lofs function is used quite frequently
317 * to manipulate file paths, and on a machine with a large number of zones,
318 * there will be a huge number of mounted file systems. Thus, we trigger a
319 * reread of the list of mount points
320 */
321 static void
322 lofs_discard_mnttab(void)
323 {
324 free_mnttable(resolve_lofs_mnts,
325 resolve_lofs_mnt_max - resolve_lofs_mnts);
326 resolve_lofs_mnts = resolve_lofs_mnt_max = NULL;
327 }
328
329 static int
330 lofs_read_mnttab(zlog_t *zlogp)
331 {
332 FILE *mnttab;
333 uint_t nmnts;
334
335 if ((mnttab = fopen(MNTTAB, "r")) == NULL)
336 return (-1);
337 if (build_mnttable(zlogp, "", 0, mnttab, &resolve_lofs_mnts,
338 &nmnts) == -1) {
339 (void) fclose(mnttab);
340 return (-1);
341 }
342 (void) fclose(mnttab);
343 resolve_lofs_mnt_max = resolve_lofs_mnts + nmnts;
344 return (0);
345 }
346
347 /*
348 * This function loops over potential loopback mounts and symlinks in a given
349 * path and resolves them all down to an absolute path.
350 */
351 void
352 resolve_lofs(zlog_t *zlogp, char *path, size_t pathlen)
353 {
354 int len, arlen;
355 const char *altroot;
356 char tmppath[MAXPATHLEN];
357 boolean_t outside_altroot;
358
359 if ((len = resolvepath(path, tmppath, sizeof (tmppath))) == -1)
360 return;
361 tmppath[len] = '\0';
362 (void) strlcpy(path, tmppath, sizeof (tmppath));
363
364 /* This happens once per zoneadmd operation. */
365 if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
366 return;
367
368 altroot = zonecfg_get_root();
369 arlen = strlen(altroot);
370 outside_altroot = B_FALSE;
371 for (;;) {
372 struct mnttab *mnp;
373
374 /* Search in reverse order to find longest match */
375 for (mnp = resolve_lofs_mnt_max - 1; mnp >= resolve_lofs_mnts;
376 mnp--) {
377 if (mnp->mnt_fstype == NULL ||
378 mnp->mnt_mountp == NULL ||
379 mnp->mnt_special == NULL)
380 continue;
381 len = strlen(mnp->mnt_mountp);
382 if (strncmp(mnp->mnt_mountp, path, len) == 0 &&
383 (path[len] == '/' || path[len] == '\0'))
384 break;
385 }
386 if (mnp < resolve_lofs_mnts)
387 break;
388 /* If it's not a lofs then we're done */
389 if (strcmp(mnp->mnt_fstype, MNTTYPE_LOFS) != 0)
390 break;
391 if (outside_altroot) {
392 char *cp;
393 int olen = sizeof (MNTOPT_RO) - 1;
394
395 /*
396 * If we run into a read-only mount outside of the
397 * alternate root environment, then the user doesn't
398 * want this path to be made read-write.
399 */
400 if (mnp->mnt_mntopts != NULL &&
401 (cp = strstr(mnp->mnt_mntopts, MNTOPT_RO)) !=
402 NULL &&
403 (cp == mnp->mnt_mntopts || cp[-1] == ',') &&
404 (cp[olen] == '\0' || cp[olen] == ',')) {
405 break;
406 }
407 } else if (arlen > 0 &&
408 (strncmp(mnp->mnt_special, altroot, arlen) != 0 ||
409 (mnp->mnt_special[arlen] != '\0' &&
410 mnp->mnt_special[arlen] != '/'))) {
411 outside_altroot = B_TRUE;
412 }
413 /* use temporary buffer because new path might be longer */
414 (void) snprintf(tmppath, sizeof (tmppath), "%s%s",
415 mnp->mnt_special, path + len);
416 if ((len = resolvepath(tmppath, path, pathlen)) == -1)
417 break;
418 path[len] = '\0';
419 }
420 }
421
422 /*
423 * For a regular mount, check if a replacement lofs mount is needed because the
424 * referenced device is already mounted somewhere.
425 */
426 static int
427 check_lofs_needed(zlog_t *zlogp, struct zone_fstab *fsptr)
428 {
429 struct mnttab *mnp;
430 zone_fsopt_t *optptr, *onext;
431
432 /* This happens once per zoneadmd operation. */
433 if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
434 return (-1);
435
436 /*
437 * If this special node isn't already in use, then it's ours alone;
438 * no need to worry about conflicting mounts.
439 */
440 for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max;
441 mnp++) {
442 if (strcmp(mnp->mnt_special, fsptr->zone_fs_special) == 0)
443 break;
444 }
445 if (mnp >= resolve_lofs_mnt_max)
446 return (0);
447
448 /*
449 * Convert this duplicate mount into a lofs mount.
450 */
451 (void) strlcpy(fsptr->zone_fs_special, mnp->mnt_mountp,
452 sizeof (fsptr->zone_fs_special));
453 (void) strlcpy(fsptr->zone_fs_type, MNTTYPE_LOFS,
454 sizeof (fsptr->zone_fs_type));
455 fsptr->zone_fs_raw[0] = '\0';
456
457 /*
458 * Discard all but one of the original options and set that to our
459 * default set of options used for resources.
460 */
461 optptr = fsptr->zone_fs_options;
462 if (optptr == NULL) {
463 optptr = malloc(sizeof (*optptr));
464 if (optptr == NULL) {
465 zerror(zlogp, B_TRUE, "cannot mount %s",
466 fsptr->zone_fs_dir);
467 return (-1);
468 }
469 } else {
470 while ((onext = optptr->zone_fsopt_next) != NULL) {
471 optptr->zone_fsopt_next = onext->zone_fsopt_next;
472 free(onext);
473 }
474 }
475 (void) strcpy(optptr->zone_fsopt_opt, RESOURCE_DEFAULT_OPTS);
476 optptr->zone_fsopt_next = NULL;
477 fsptr->zone_fs_options = optptr;
478 return (0);
479 }
480
481 int
482 make_one_dir(zlog_t *zlogp, const char *prefix, const char *subdir, mode_t mode,
483 uid_t userid, gid_t groupid)
484 {
485 char path[MAXPATHLEN];
486 struct stat st;
487
488 if (snprintf(path, sizeof (path), "%s%s", prefix, subdir) >
489 sizeof (path)) {
490 zerror(zlogp, B_FALSE, "pathname %s%s is too long", prefix,
491 subdir);
492 return (-1);
493 }
494
495 if (lstat(path, &st) == 0) {
496 /*
497 * We don't check the file mode since presumably the zone
498 * administrator may have had good reason to change the mode,
499 * and we don't need to second guess them.
500 */
501 if (!S_ISDIR(st.st_mode)) {
502 if (S_ISREG(st.st_mode)) {
503 /*
504 * Allow readonly mounts of /etc/ files; this
505 * is needed most by Trusted Extensions.
506 */
507 if (strncmp(subdir, "/etc/",
508 strlen("/etc/")) != 0) {
509 zerror(zlogp, B_FALSE,
510 "%s is not in /etc", path);
511 return (-1);
512 }
513 } else {
514 zerror(zlogp, B_FALSE,
515 "%s is not a directory", path);
516 return (-1);
517 }
518 }
519 return (0);
520 }
521
522 if (mkdirp(path, mode) != 0) {
523 if (errno == EROFS)
524 zerror(zlogp, B_FALSE, "Could not mkdir %s.\nIt is on "
525 "a read-only file system in this local zone.\nMake "
526 "sure %s exists in the global zone.", path, subdir);
527 else
528 zerror(zlogp, B_TRUE, "mkdirp of %s failed", path);
529 return (-1);
530 }
531
532 (void) chown(path, userid, groupid);
533 return (0);
534 }
535
536 static void
537 free_remote_fstypes(char **types)
538 {
539 uint_t i;
540
541 if (types == NULL)
542 return;
543 for (i = 0; types[i] != NULL; i++)
544 free(types[i]);
545 free(types);
546 }
547
548 static char **
549 get_remote_fstypes(zlog_t *zlogp)
550 {
551 char **types = NULL;
552 FILE *fp;
553 char buf[MAXPATHLEN];
554 char fstype[MAXPATHLEN];
555 uint_t lines = 0;
556 uint_t i;
557
558 if ((fp = fopen(DFSTYPES, "r")) == NULL) {
559 zerror(zlogp, B_TRUE, "failed to open %s", DFSTYPES);
560 return (NULL);
561 }
562 /*
563 * Count the number of lines
564 */
565 while (fgets(buf, sizeof (buf), fp) != NULL)
566 lines++;
567 if (lines == 0) /* didn't read anything; empty file */
568 goto out;
569 rewind(fp);
570 /*
571 * Allocate enough space for a NULL-terminated array.
572 */
573 types = calloc(lines + 1, sizeof (char *));
574 if (types == NULL) {
575 zerror(zlogp, B_TRUE, "memory allocation failed");
576 goto out;
577 }
578 i = 0;
579 while (fgets(buf, sizeof (buf), fp) != NULL) {
580 /* LINTED - fstype is big enough to hold buf */
581 if (sscanf(buf, "%s", fstype) == 0) {
582 zerror(zlogp, B_FALSE, "unable to parse %s", DFSTYPES);
583 free_remote_fstypes(types);
584 types = NULL;
585 goto out;
586 }
587 types[i] = strdup(fstype);
588 if (types[i] == NULL) {
589 zerror(zlogp, B_TRUE, "memory allocation failed");
590 free_remote_fstypes(types);
591 types = NULL;
592 goto out;
593 }
594 i++;
595 }
596 out:
597 (void) fclose(fp);
598 return (types);
599 }
600
601 static boolean_t
602 is_remote_fstype(const char *fstype, char *const *remote_fstypes)
603 {
604 uint_t i;
605
606 if (remote_fstypes == NULL)
607 return (B_FALSE);
608 for (i = 0; remote_fstypes[i] != NULL; i++) {
609 if (strcmp(remote_fstypes[i], fstype) == 0)
610 return (B_TRUE);
611 }
612 return (B_FALSE);
613 }
614
615 /*
616 * This converts a zone root path (normally of the form .../root) to a Live
617 * Upgrade scratch zone root (of the form .../lu).
618 */
619 static void
620 root_to_lu(zlog_t *zlogp, char *zroot, size_t zrootlen, boolean_t isresolved)
621 {
622 if (!isresolved && zonecfg_in_alt_root())
623 resolve_lofs(zlogp, zroot, zrootlen);
624 (void) strcpy(strrchr(zroot, '/') + 1, "lu");
625 }
626
627 /*
628 * Perform brand-specific cleanup if we are unable to unmount a FS.
629 */
630 static void
631 brand_umount_cleanup(zlog_t *zlogp, char *path)
632 {
633 char cmdbuf[2 * MAXPATHLEN];
634
635 if (post_statechg_hook[0] == '\0')
636 return;
637
638 if (snprintf(cmdbuf, sizeof (cmdbuf), "%s %d %d %s", post_statechg_hook,
639 ZONE_STATE_DOWN, Z_UNMOUNT, path) > sizeof (cmdbuf))
640 return;
641
642 (void) do_subproc(zlogp, cmdbuf, NULL, B_FALSE);
643 }
644
645 /*
646 * The general strategy for unmounting filesystems is as follows:
647 *
648 * - Remote filesystems may be dead, and attempting to contact them as
649 * part of a regular unmount may hang forever; we want to always try to
650 * forcibly unmount such filesystems and only fall back to regular
651 * unmounts if the filesystem doesn't support forced unmounts.
652 *
653 * - We don't want to unnecessarily corrupt metadata on local
654 * filesystems (ie UFS), so we want to start off with graceful unmounts,
655 * and only escalate to doing forced unmounts if we get stuck.
656 *
657 * We start off walking backwards through the mount table. This doesn't
658 * give us strict ordering but ensures that we try to unmount submounts
659 * first. We thus limit the number of failed umount2(2) calls.
660 *
661 * The mechanism for determining if we're stuck is to count the number
662 * of failed unmounts each iteration through the mount table. This
663 * gives us an upper bound on the number of filesystems which remain
664 * mounted (autofs trigger nodes are dealt with separately). If at the
665 * end of one unmount+autofs_cleanup cycle we still have the same number
666 * of mounts that we started out with, we're stuck and try a forced
667 * unmount. If that fails (filesystem doesn't support forced unmounts)
668 * then we bail and are unable to teardown the zone. If it succeeds,
669 * we're no longer stuck so we continue with our policy of trying
670 * graceful mounts first.
671 *
672 * Zone must be down (ie, no processes or threads active).
673 */
674 static int
675 unmount_filesystems(zlog_t *zlogp, zoneid_t zoneid, boolean_t unmount_cmd)
676 {
677 int error = 0;
678 int fail = 0;
679 FILE *mnttab;
680 struct mnttab *mnts;
681 uint_t nmnt;
682 char zroot[MAXPATHLEN + 1];
683 size_t zrootlen;
684 uint_t oldcount = UINT_MAX;
685 boolean_t stuck = B_FALSE;
686 char **remote_fstypes = NULL;
687
688 if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
689 zerror(zlogp, B_FALSE, "unable to determine zone root");
690 return (-1);
691 }
692 if (unmount_cmd)
693 root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
694
695 (void) strcat(zroot, "/");
696 zrootlen = strlen(zroot);
697
698 /*
699 * For Trusted Extensions unmount each higher level zone's mount
700 * of our zone's /export/home
701 */
702 if (!unmount_cmd)
703 tsol_unmounts(zlogp, zone_name);
704
705 if ((mnttab = fopen(MNTTAB, "r")) == NULL) {
706 zerror(zlogp, B_TRUE, "failed to open %s", MNTTAB);
707 return (-1);
708 }
709 /*
710 * Use our hacky mntfs ioctl so we see everything, even mounts with
711 * MS_NOMNTTAB.
712 */
713 if (ioctl(fileno(mnttab), MNTIOC_SHOWHIDDEN, NULL) < 0) {
714 zerror(zlogp, B_TRUE, "unable to configure %s", MNTTAB);
715 error++;
716 goto out;
717 }
718
719 /*
720 * Build the list of remote fstypes so we know which ones we
721 * should forcibly unmount.
722 */
723 remote_fstypes = get_remote_fstypes(zlogp);
724 for (;;) {
725 uint_t newcount = 0;
726 boolean_t unmounted;
727 struct mnttab *mnp;
728 char *path;
729 uint_t i;
730
731 mnts = NULL;
732 nmnt = 0;
733 /*
734 * MNTTAB gives us a way to walk through mounted
735 * filesystems; we need to be able to walk them in
736 * reverse order, so we build a list of all mounted
737 * filesystems.
738 */
739 if (build_mnttable(zlogp, zroot, zrootlen, mnttab, &mnts,
740 &nmnt) != 0) {
741 error++;
742 goto out;
743 }
744 for (i = 0; i < nmnt; i++) {
745 mnp = &mnts[nmnt - i - 1]; /* access in reverse order */
746 path = mnp->mnt_mountp;
747 unmounted = B_FALSE;
748 /*
749 * Try forced unmount first for remote filesystems.
750 *
751 * Not all remote filesystems support forced unmounts,
752 * so if this fails (ENOTSUP) we'll continue on
753 * and try a regular unmount.
754 */
755 if (is_remote_fstype(mnp->mnt_fstype, remote_fstypes)) {
756 if (umount2(path, MS_FORCE) == 0)
757 unmounted = B_TRUE;
758 }
759 /*
760 * Try forced unmount if we're stuck.
761 */
762 if (stuck) {
763 if (umount2(path, MS_FORCE) == 0) {
764 unmounted = B_TRUE;
765 stuck = B_FALSE;
766 fail = 0;
767 } else {
768 /*
769 * We may hit a failure here if there
770 * is an app in the GZ with an open
771 * pipe into the zone (commonly into
772 * the zone's /var/run). This type
773 * of app will notice the closed
774 * connection and cleanup, but it may
775 * take a while and we have no easy
776 * way to notice that. To deal with
777 * this case, we will wait and retry
778 * a few times before we give up.
779 */
780 fail++;
781 if (fail < (UMOUNT_RETRIES - 1)) {
782 zerror(zlogp, B_FALSE,
783 "unable to unmount '%s', "
784 "retrying in 2 seconds",
785 path);
786 (void) sleep(2);
787 } else if (fail > UMOUNT_RETRIES) {
788 error++;
789 zerror(zlogp, B_FALSE,
790 "unmount of '%s' failed",
791 path);
792 free_mnttable(mnts, nmnt);
793 goto out;
794 } else {
795 /* Try the hook 2 times */
796 brand_umount_cleanup(zlogp,
797 path);
798 }
799 }
800 }
801 /*
802 * Try regular unmounts for everything else.
803 */
804 if (!unmounted && umount2(path, 0) != 0)
805 newcount++;
806 }
807 free_mnttable(mnts, nmnt);
808
809 if (newcount == 0)
810 break;
811 if (newcount >= oldcount) {
812 /*
813 * Last round didn't unmount anything; we're stuck and
814 * should start trying forced unmounts.
815 */
816 stuck = B_TRUE;
817 }
818 oldcount = newcount;
819
820 /*
821 * Autofs doesn't let you unmount its trigger nodes from
822 * userland so we have to tell the kernel to cleanup for us.
823 */
824 if (autofs_cleanup(zoneid) != 0) {
825 zerror(zlogp, B_TRUE, "unable to remove autofs nodes");
826 error++;
827 goto out;
828 }
829 }
830
831 out:
832 free_remote_fstypes(remote_fstypes);
833 (void) fclose(mnttab);
834 return (error ? -1 : 0);
835 }
836
837 static int
838 fs_compare(const void *m1, const void *m2)
839 {
840 struct zone_fstab *i = (struct zone_fstab *)m1;
841 struct zone_fstab *j = (struct zone_fstab *)m2;
842
843 return (strcmp(i->zone_fs_dir, j->zone_fs_dir));
844 }
845
846 /*
847 * Fork and exec (and wait for) the mentioned binary with the provided
848 * arguments. Returns (-1) if something went wrong with fork(2) or exec(2),
849 * returns the exit status otherwise.
850 *
851 * If we were unable to exec the provided pathname (for whatever
852 * reason), we return the special token ZEXIT_EXEC. The current value
853 * of ZEXIT_EXEC doesn't conflict with legitimate exit codes of the
854 * consumers of this function; any future consumers must make sure this
855 * remains the case.
856 */
857 static int
858 forkexec(zlog_t *zlogp, const char *path, char *const argv[])
859 {
860 pid_t child_pid;
861 int child_status = 0;
862
863 /*
864 * Do not let another thread localize a message while we are forking.
865 */
866 (void) mutex_lock(&msglock);
867 child_pid = fork();
868 (void) mutex_unlock(&msglock);
869 if (child_pid == -1) {
870 zerror(zlogp, B_TRUE, "could not fork for %s", argv[0]);
871 return (-1);
872 } else if (child_pid == 0) {
873 closefrom(0);
874 /* redirect stdin, stdout & stderr to /dev/null */
875 (void) open("/dev/null", O_RDONLY); /* stdin */
876 (void) open("/dev/null", O_WRONLY); /* stdout */
877 (void) open("/dev/null", O_WRONLY); /* stderr */
878 (void) execv(path, argv);
879 /*
880 * Since we are in the child, there is no point calling zerror()
881 * since there is nobody waiting to consume it. So exit with a
882 * special code that the parent will recognize and call zerror()
883 * accordingly.
884 */
885
886 _exit(ZEXIT_EXEC);
887 } else {
888 (void) waitpid(child_pid, &child_status, 0);
889 }
890
891 if (WIFSIGNALED(child_status)) {
892 zerror(zlogp, B_FALSE, "%s unexpectedly terminated due to "
893 "signal %d", path, WTERMSIG(child_status));
894 return (-1);
895 }
896 assert(WIFEXITED(child_status));
897 if (WEXITSTATUS(child_status) == ZEXIT_EXEC) {
898 zerror(zlogp, B_FALSE, "failed to exec %s", path);
899 return (-1);
900 }
901 return (WEXITSTATUS(child_status));
902 }
903
904 static int
905 isregfile(const char *path)
906 {
907 struct stat64 st;
908
909 if (stat64(path, &st) == -1)
910 return (-1);
911
912 return (S_ISREG(st.st_mode));
913 }
914
915 static int
916 dofsck(zlog_t *zlogp, const char *fstype, const char *rawdev)
917 {
918 char cmdbuf[MAXPATHLEN];
919 char *argv[5];
920 int status;
921
922 /*
923 * We could alternatively have called /usr/sbin/fsck -F <fstype>, but
924 * that would cost us an extra fork/exec without buying us anything.
925 */
926 if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/fsck", fstype)
927 >= sizeof (cmdbuf)) {
928 zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
929 return (-1);
930 }
931
932 /*
933 * If it doesn't exist, that's OK: we verified this previously
934 * in zoneadm.
935 */
936 if (isregfile(cmdbuf) == -1)
937 return (0);
938
939 argv[0] = "fsck";
940 argv[1] = "-o";
941 argv[2] = "p";
942 argv[3] = (char *)rawdev;
943 argv[4] = NULL;
944
945 status = forkexec(zlogp, cmdbuf, argv);
946 if (status == 0 || status == -1)
947 return (status);
948 zerror(zlogp, B_FALSE, "fsck of '%s' failed with exit status %d; "
949 "run fsck manually", rawdev, status);
950 return (-1);
951 }
952
953 static int
954 domount(zlog_t *zlogp, const char *fstype, const char *opts,
955 const char *special, const char *directory)
956 {
957 char cmdbuf[MAXPATHLEN];
958 char *argv[6];
959 int status;
960
961 /*
962 * We could alternatively have called /usr/sbin/mount -F <fstype>, but
963 * that would cost us an extra fork/exec without buying us anything.
964 */
965 if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/mount", fstype)
966 >= sizeof (cmdbuf)) {
967 zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
968 return (-1);
969 }
970 argv[0] = "mount";
971 if (opts[0] == '\0') {
972 argv[1] = (char *)special;
973 argv[2] = (char *)directory;
974 argv[3] = NULL;
975 } else {
976 argv[1] = "-o";
977 argv[2] = (char *)opts;
978 argv[3] = (char *)special;
979 argv[4] = (char *)directory;
980 argv[5] = NULL;
981 }
982
983 status = forkexec(zlogp, cmdbuf, argv);
984 if (status == 0 || status == -1)
985 return (status);
986 if (opts[0] == '\0')
987 zerror(zlogp, B_FALSE, "\"%s %s %s\" "
988 "failed with exit code %d",
989 cmdbuf, special, directory, status);
990 else
991 zerror(zlogp, B_FALSE, "\"%s -o %s %s %s\" "
992 "failed with exit code %d",
993 cmdbuf, opts, special, directory, status);
994 return (-1);
995 }
996
997 /*
998 * Check if a given mount point path exists.
999 * If it does, make sure it doesn't contain any symlinks.
1000 * Note that if "leaf" is false we're checking an intermediate
1001 * component of the mount point path, so it must be a directory.
1002 * If "leaf" is true, then we're checking the entire mount point
1003 * path, so the mount point itself can be anything aside from a
1004 * symbolic link.
1005 *
1006 * If the path is invalid then a negative value is returned. If the
1007 * path exists and is a valid mount point path then 0 is returned.
1008 * If the path doesn't exist return a positive value.
1009 */
1010 static int
1011 valid_mount_point(zlog_t *zlogp, const char *path, const boolean_t leaf)
1012 {
1013 struct stat statbuf;
1014 char respath[MAXPATHLEN];
1015 int res;
1016
1017 if (lstat(path, &statbuf) != 0) {
1018 if (errno == ENOENT)
1019 return (1);
1020 zerror(zlogp, B_TRUE, "can't stat %s", path);
1021 return (-1);
1022 }
1023 if (S_ISLNK(statbuf.st_mode)) {
1024 zerror(zlogp, B_FALSE, "%s is a symlink", path);
1025 return (-1);
1026 }
1027 if (!leaf && !S_ISDIR(statbuf.st_mode)) {
1028 zerror(zlogp, B_FALSE, "%s is not a directory", path);
1029 return (-1);
1030 }
1031 if ((res = resolvepath(path, respath, sizeof (respath))) == -1) {
1032 zerror(zlogp, B_TRUE, "unable to resolve path %s", path);
1033 return (-1);
1034 }
1035 respath[res] = '\0';
1036 if (strcmp(path, respath) != 0) {
1037 /*
1038 * We don't like ".."s, "."s, or "//"s throwing us off
1039 */
1040 zerror(zlogp, B_FALSE, "%s is not a canonical path", path);
1041 return (-1);
1042 }
1043 return (0);
1044 }
1045
1046 /*
1047 * Validate a mount point path. A valid mount point path is an
1048 * absolute path that either doesn't exist, or, if it does exists it
1049 * must be an absolute canonical path that doesn't have any symbolic
1050 * links in it. The target of a mount point path can be any filesystem
1051 * object. (Different filesystems can support different mount points,
1052 * for example "lofs" and "mntfs" both support files and directories
1053 * while "ufs" just supports directories.)
1054 *
1055 * If the path is invalid then a negative value is returned. If the
1056 * path exists and is a valid mount point path then 0 is returned.
1057 * If the path doesn't exist return a positive value.
1058 */
1059 int
1060 valid_mount_path(zlog_t *zlogp, const char *rootpath, const char *spec,
1061 const char *dir, const char *fstype)
1062 {
1063 char abspath[MAXPATHLEN], *slashp, *slashp_next;
1064 int rv;
1065
1066 /*
1067 * Sanity check the target mount point path.
1068 * It must be a non-null string that starts with a '/'.
1069 */
1070 if (dir[0] != '/') {
1071 /* Something went wrong. */
1072 zerror(zlogp, B_FALSE, "invalid mount directory, "
1073 "type: \"%s\", special: \"%s\", dir: \"%s\"",
1074 fstype, spec, dir);
1075 return (-1);
1076 }
1077
1078 /*
1079 * Join rootpath and dir. Make sure abspath ends with '/', this
1080 * is added to all paths (even non-directory paths) to allow us
1081 * to detect the end of paths below. If the path already ends
1082 * in a '/', then that's ok too (although we'll fail the
1083 * cannonical path check in valid_mount_point()).
1084 */
1085 if (snprintf(abspath, sizeof (abspath),
1086 "%s%s/", rootpath, dir) >= sizeof (abspath)) {
1087 zerror(zlogp, B_FALSE, "pathname %s%s is too long",
1088 rootpath, dir);
1089 return (-1);
1090 }
1091
1092 /*
1093 * Starting with rootpath, verify the mount path one component
1094 * at a time. Continue until we've evaluated all of abspath.
1095 */
1096 slashp = &abspath[strlen(rootpath)];
1097 assert(*slashp == '/');
1098 do {
1099 slashp_next = strchr(slashp + 1, '/');
1100 *slashp = '\0';
1101 if (slashp_next != NULL) {
1102 /* This is an intermediary mount path component. */
1103 rv = valid_mount_point(zlogp, abspath, B_FALSE);
1104 } else {
1105 /* This is the last component of the mount path. */
1106 rv = valid_mount_point(zlogp, abspath, B_TRUE);
1107 }
1108 if (rv < 0)
1109 return (rv);
1110 *slashp = '/';
1111 } while ((slashp = slashp_next) != NULL);
1112 return (rv);
1113 }
1114
1115 static int
1116 mount_one_dev_device_cb(void *arg, const char *match, const char *name)
1117 {
1118 di_prof_t prof = arg;
1119
1120 if (name == NULL)
1121 return (di_prof_add_dev(prof, match));
1122 return (di_prof_add_map(prof, match, name));
1123 }
1124
1125 static int
1126 mount_one_dev_symlink_cb(void *arg, const char *source, const char *target)
1127 {
1128 di_prof_t prof = arg;
1129
1130 return (di_prof_add_symlink(prof, source, target));
1131 }
1132
1133 int
1134 vplat_get_iptype(zlog_t *zlogp, zone_iptype_t *iptypep)
1135 {
1136 if (zonecfg_get_iptype(snap_hndl, iptypep) != Z_OK) {
1137 zerror(zlogp, B_FALSE, "invalid ip-type configuration");
1138 return (-1);
1139 }
1140 return (0);
1141 }
1142
1143 /*
1144 * Apply the standard lists of devices/symlinks/mappings and the user-specified
1145 * list of devices (via zonecfg) to the /dev filesystem. The filesystem will
1146 * use these as a profile/filter to determine what exists in /dev.
1147 */
1148 static int
1149 mount_one_dev(zlog_t *zlogp, char *devpath, zone_mnt_t mount_cmd)
1150 {
1151 char brand[MAXNAMELEN];
1152 brand_handle_t bh = NULL;
1153 struct zone_devtab ztab;
1154 di_prof_t prof = NULL;
1155 int err;
1156 int retval = -1;
1157 zone_iptype_t iptype;
1158 const char *curr_iptype = NULL;
1159
1160 if (di_prof_init(devpath, &prof)) {
1161 zerror(zlogp, B_TRUE, "failed to initialize profile");
1162 goto cleanup;
1163 }
1164
1165 /*
1166 * Get a handle to the brand info for this zone.
1167 * If we are mounting the zone, then we must always use the default
1168 * brand device mounts.
1169 */
1170 if (ALT_MOUNT(mount_cmd)) {
1171 (void) strlcpy(brand, default_brand, sizeof (brand));
1172 } else {
1173 (void) strlcpy(brand, brand_name, sizeof (brand));
1174 }
1175
1176 if ((bh = brand_open(brand)) == NULL) {
1177 zerror(zlogp, B_FALSE, "unable to determine zone brand");
1178 goto cleanup;
1179 }
1180
1181 if (vplat_get_iptype(zlogp, &iptype) < 0) {
1182 zerror(zlogp, B_TRUE, "unable to determine ip-type");
1183 goto cleanup;
1184 }
1185 switch (iptype) {
1186 case ZS_SHARED:
1187 curr_iptype = "shared";
1188 break;
1189 case ZS_EXCLUSIVE:
1190 curr_iptype = "exclusive";
1191 break;
1192 default:
1193 zerror(zlogp, B_FALSE, "bad ip-type");
1194 goto cleanup;
1195 }
1196 if (curr_iptype == NULL)
1197 abort();
1198
1199 if (brand_platform_iter_devices(bh, zone_name,
1200 mount_one_dev_device_cb, prof, curr_iptype) != 0) {
1201 zerror(zlogp, B_TRUE, "failed to add standard device");
1202 goto cleanup;
1203 }
1204
1205 if (brand_platform_iter_link(bh,
1206 mount_one_dev_symlink_cb, prof) != 0) {
1207 zerror(zlogp, B_TRUE, "failed to add standard symlink");
1208 goto cleanup;
1209 }
1210
1211 /* Add user-specified devices and directories */
1212 if ((err = zonecfg_setdevent(snap_hndl)) != 0) {
1213 zerror(zlogp, B_FALSE, "%s: %s", zone_name,
1214 zonecfg_strerror(err));
1215 goto cleanup;
1216 }
1217 while (zonecfg_getdevent(snap_hndl, &ztab) == Z_OK) {
1218 char path[MAXPATHLEN];
1219
1220 if ((err = resolve_device_match(zlogp, &ztab,
1221 path, sizeof (path))) != Z_OK)
1222 goto cleanup;
1223
1224 if (di_prof_add_dev(prof, path)) {
1225 zerror(zlogp, B_TRUE, "failed to add "
1226 "user-specified device '%s'", path);
1227 goto cleanup;
1228 }
1229 }
1230 (void) zonecfg_enddevent(snap_hndl);
1231
1232 /* Send profile to kernel */
1233 if (di_prof_commit(prof)) {
1234 zerror(zlogp, B_TRUE, "failed to commit profile");
1235 goto cleanup;
1236 }
1237
1238 retval = 0;
1239
1240 cleanup:
1241 if (bh != NULL)
1242 brand_close(bh);
1243 if (prof)
1244 di_prof_fini(prof);
1245 return (retval);
1246 }
1247
1248 static int
1249 mount_one(zlog_t *zlogp, struct zone_fstab *fsptr, const char *rootpath,
1250 zone_mnt_t mount_cmd)
1251 {
1252 char path[MAXPATHLEN];
1253 char optstr[MAX_MNTOPT_STR];
1254 zone_fsopt_t *optptr;
1255 int rv;
1256
1257 if ((rv = valid_mount_path(zlogp, rootpath, fsptr->zone_fs_special,
1258 fsptr->zone_fs_dir, fsptr->zone_fs_type)) < 0) {
1259 zerror(zlogp, B_FALSE, "%s%s is not a valid mount point",
1260 rootpath, fsptr->zone_fs_dir);
1261 return (-1);
1262 } else if (rv > 0) {
1263 /* The mount point path doesn't exist, create it now. */
1264 if (make_one_dir(zlogp, rootpath, fsptr->zone_fs_dir,
1265 DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
1266 DEFAULT_DIR_GROUP) != 0) {
1267 zerror(zlogp, B_FALSE, "failed to create mount point");
1268 return (-1);
1269 }
1270
1271 /*
1272 * Now this might seem weird, but we need to invoke
1273 * valid_mount_path() again. Why? Because it checks
1274 * to make sure that the mount point path is canonical,
1275 * which it can only do if the path exists, so now that
1276 * we've created the path we have to verify it again.
1277 */
1278 if ((rv = valid_mount_path(zlogp, rootpath,
1279 fsptr->zone_fs_special, fsptr->zone_fs_dir,
1280 fsptr->zone_fs_type)) < 0) {
1281 zerror(zlogp, B_FALSE,
1282 "%s%s is not a valid mount point",
1283 rootpath, fsptr->zone_fs_dir);
1284 return (-1);
1285 }
1286 }
1287
1288 (void) snprintf(path, sizeof (path), "%s%s", rootpath,
1289 fsptr->zone_fs_dir);
1290
1291 /*
1292 * In general the strategy here is to do just as much verification as
1293 * necessary to avoid crashing or otherwise doing something bad; if the
1294 * administrator initiated the operation via zoneadm(8), they'll get
1295 * auto-verification which will let them know what's wrong. If they
1296 * modify the zone configuration of a running zone, and don't attempt
1297 * to verify that it's OK, then we won't crash but won't bother trying
1298 * to be too helpful either. zoneadm verify is only a couple keystrokes
1299 * away.
1300 */
1301 if (!zonecfg_valid_fs_type(fsptr->zone_fs_type)) {
1302 zerror(zlogp, B_FALSE, "cannot mount %s on %s: "
1303 "invalid file-system type %s", fsptr->zone_fs_special,
1304 fsptr->zone_fs_dir, fsptr->zone_fs_type);
1305 return (-1);
1306 }
1307
1308 /*
1309 * If we're looking at an alternate root environment, then construct
1310 * read-only loopback mounts as necessary. Note that any special
1311 * paths for lofs zone mounts in an alternate root must have
1312 * already been pre-pended with any alternate root path by the
1313 * time we get here.
1314 */
1315 if (zonecfg_in_alt_root()) {
1316 struct stat64 st;
1317
1318 if (stat64(fsptr->zone_fs_special, &st) != -1 &&
1319 S_ISBLK(st.st_mode)) {
1320 /*
1321 * If we're going to mount a block device we need
1322 * to check if that device is already mounted
1323 * somewhere else, and if so, do a lofs mount
1324 * of the device instead of a direct mount
1325 */
1326 if (check_lofs_needed(zlogp, fsptr) == -1)
1327 return (-1);
1328 } else if (strcmp(fsptr->zone_fs_type, MNTTYPE_LOFS) == 0) {
1329 /*
1330 * For lofs mounts, the special node is inside the
1331 * alternate root. We need lofs resolution for
1332 * this case in order to get at the underlying
1333 * read-write path.
1334 */
1335 resolve_lofs(zlogp, fsptr->zone_fs_special,
1336 sizeof (fsptr->zone_fs_special));
1337 }
1338 }
1339
1340 /*
1341 * Run 'fsck -m' if there's a device to fsck.
1342 */
1343 if (fsptr->zone_fs_raw[0] != '\0' &&
1344 dofsck(zlogp, fsptr->zone_fs_type, fsptr->zone_fs_raw) != 0) {
1345 return (-1);
1346 } else if (isregfile(fsptr->zone_fs_special) == 1 &&
1347 dofsck(zlogp, fsptr->zone_fs_type, fsptr->zone_fs_special) != 0) {
1348 return (-1);
1349 }
1350
1351 /*
1352 * Build up mount option string.
1353 */
1354 optstr[0] = '\0';
1355 if (fsptr->zone_fs_options != NULL) {
1356 (void) strlcpy(optstr, fsptr->zone_fs_options->zone_fsopt_opt,
1357 sizeof (optstr));
1358 for (optptr = fsptr->zone_fs_options->zone_fsopt_next;
1359 optptr != NULL; optptr = optptr->zone_fsopt_next) {
1360 (void) strlcat(optstr, ",", sizeof (optstr));
1361 (void) strlcat(optstr, optptr->zone_fsopt_opt,
1362 sizeof (optstr));
1363 }
1364 }
1365
1366 if ((rv = domount(zlogp, fsptr->zone_fs_type, optstr,
1367 fsptr->zone_fs_special, path)) != 0)
1368 return (rv);
1369
1370 /*
1371 * The mount succeeded. If this was not a mount of /dev then
1372 * we're done.
1373 */
1374 if (strcmp(fsptr->zone_fs_type, MNTTYPE_DEV) != 0)
1375 return (0);
1376
1377 /*
1378 * We just mounted an instance of a /dev filesystem, so now we
1379 * need to configure it.
1380 */
1381 return (mount_one_dev(zlogp, path, mount_cmd));
1382 }
1383
1384 static void
1385 free_fs_data(struct zone_fstab *fsarray, uint_t nelem)
1386 {
1387 uint_t i;
1388
1389 if (fsarray == NULL)
1390 return;
1391 for (i = 0; i < nelem; i++)
1392 zonecfg_free_fs_option_list(fsarray[i].zone_fs_options);
1393 free(fsarray);
1394 }
1395
1396 /*
1397 * This function initiates the creation of a small Solaris Environment for
1398 * scratch zone. The Environment creation process is split up into two
1399 * functions(build_mounted_pre_var() and build_mounted_post_var()). It
1400 * is done this way because:
1401 * We need to have both /etc and /var in the root of the scratchzone.
1402 * We loopback mount zone's own /etc and /var into the root of the
1403 * scratch zone. Unlike /etc, /var can be a seperate filesystem. So we
1404 * need to delay the mount of /var till the zone's root gets populated.
1405 * So mounting of localdirs[](/etc and /var) have been moved to the
1406 * build_mounted_post_var() which gets called only after the zone
1407 * specific filesystems are mounted.
1408 *
1409 * Note that the scratch zone we set up for updating the zone (Z_MNT_UPDATE)
1410 * does not loopback mount the zone's own /etc and /var into the root of the
1411 * scratch zone.
1412 */
1413 static boolean_t
1414 build_mounted_pre_var(zlog_t *zlogp, char *rootpath,
1415 size_t rootlen, const char *zonepath, char *luroot, size_t lurootlen)
1416 {
1417 char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1418 const char **cpp;
1419 static const char *mkdirs[] = {
1420 "/system", "/system/contract", "/system/object", "/proc",
1421 "/dev", "/tmp", "/a", NULL
1422 };
1423 char *altstr;
1424 FILE *fp;
1425 uuid_t uuid;
1426
1427 resolve_lofs(zlogp, rootpath, rootlen);
1428 (void) snprintf(luroot, lurootlen, "%s/lu", zonepath);
1429 resolve_lofs(zlogp, luroot, lurootlen);
1430 (void) snprintf(tmp, sizeof (tmp), "%s/bin", luroot);
1431 (void) symlink("./usr/bin", tmp);
1432
1433 /*
1434 * These are mostly special mount points; not handled here. (See
1435 * zone_mount_early.)
1436 */
1437 for (cpp = mkdirs; *cpp != NULL; cpp++) {
1438 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1439 if (mkdir(tmp, 0755) != 0) {
1440 zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1441 return (B_FALSE);
1442 }
1443 }
1444 /*
1445 * This is here to support lucopy. If there's an instance of this same
1446 * zone on the current running system, then we mount its root up as
1447 * read-only inside the scratch zone.
1448 */
1449 (void) zonecfg_get_uuid(zone_name, uuid);
1450 altstr = strdup(zonecfg_get_root());
1451 if (altstr == NULL) {
1452 zerror(zlogp, B_TRUE, "memory allocation failed");
1453 return (B_FALSE);
1454 }
1455 zonecfg_set_root("");
1456 (void) strlcpy(tmp, zone_name, sizeof (tmp));
1457 (void) zonecfg_get_name_by_uuid(uuid, tmp, sizeof (tmp));
1458 if (zone_get_rootpath(tmp, fromdir, sizeof (fromdir)) == Z_OK &&
1459 strcmp(fromdir, rootpath) != 0) {
1460 (void) snprintf(tmp, sizeof (tmp), "%s/b", luroot);
1461 if (mkdir(tmp, 0755) != 0) {
1462 zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1463 return (B_FALSE);
1464 }
1465 if (domount(zlogp, MNTTYPE_LOFS, RESOURCE_DEFAULT_OPTS, fromdir,
1466 tmp) != 0) {
1467 zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1468 fromdir);
1469 return (B_FALSE);
1470 }
1471 }
1472 zonecfg_set_root(altstr);
1473 free(altstr);
1474
1475 if ((fp = zonecfg_open_scratch(luroot, B_TRUE)) == NULL) {
1476 zerror(zlogp, B_TRUE, "cannot open zone mapfile");
1477 return (B_FALSE);
1478 }
1479 (void) ftruncate(fileno(fp), 0);
1480 if (zonecfg_add_scratch(fp, zone_name, kernzone, "/") == -1) {
1481 zerror(zlogp, B_TRUE, "cannot add zone mapfile entry");
1482 }
1483 zonecfg_close_scratch(fp);
1484 (void) snprintf(tmp, sizeof (tmp), "%s/a", luroot);
1485 if (domount(zlogp, MNTTYPE_LOFS, "", rootpath, tmp) != 0)
1486 return (B_FALSE);
1487 (void) strlcpy(rootpath, tmp, rootlen);
1488 return (B_TRUE);
1489 }
1490
1491
1492 static boolean_t
1493 build_mounted_post_var(zlog_t *zlogp, zone_mnt_t mount_cmd, char *rootpath,
1494 const char *luroot)
1495 {
1496 char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1497 const char **cpp;
1498 const char **loopdirs;
1499 const char **tmpdirs;
1500 static const char *localdirs[] = {
1501 "/etc", "/var", NULL
1502 };
1503 static const char *scr_loopdirs[] = {
1504 "/etc/lib", "/etc/fs", "/lib", "/sbin", "/platform",
1505 "/usr", NULL
1506 };
1507 static const char *upd_loopdirs[] = {
1508 "/etc", "/kernel", "/lib", "/opt", "/platform", "/sbin",
1509 "/usr", "/var", NULL
1510 };
1511 static const char *scr_tmpdirs[] = {
1512 "/tmp", "/var/run", NULL
1513 };
1514 static const char *upd_tmpdirs[] = {
1515 "/tmp", "/var/run", "/var/tmp", NULL
1516 };
1517 struct stat st;
1518
1519 if (mount_cmd == Z_MNT_SCRATCH) {
1520 /*
1521 * These are mounted read-write from the zone undergoing
1522 * upgrade. We must be careful not to 'leak' things from the
1523 * main system into the zone, and this accomplishes that goal.
1524 */
1525 for (cpp = localdirs; *cpp != NULL; cpp++) {
1526 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot,
1527 *cpp);
1528 (void) snprintf(fromdir, sizeof (fromdir), "%s%s",
1529 rootpath, *cpp);
1530 if (mkdir(tmp, 0755) != 0) {
1531 zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1532 return (B_FALSE);
1533 }
1534 if (domount(zlogp, MNTTYPE_LOFS, "", fromdir, tmp)
1535 != 0) {
1536 zerror(zlogp, B_TRUE, "cannot mount %s on %s",
1537 tmp, *cpp);
1538 return (B_FALSE);
1539 }
1540 }
1541 }
1542
1543 if (mount_cmd == Z_MNT_UPDATE)
1544 loopdirs = upd_loopdirs;
1545 else
1546 loopdirs = scr_loopdirs;
1547
1548 /*
1549 * These are things mounted read-only from the running system because
1550 * they contain binaries that must match system.
1551 */
1552 for (cpp = loopdirs; *cpp != NULL; cpp++) {
1553 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1554 if (mkdir(tmp, 0755) != 0) {
1555 if (errno != EEXIST) {
1556 zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1557 return (B_FALSE);
1558 }
1559 if (lstat(tmp, &st) != 0) {
1560 zerror(zlogp, B_TRUE, "cannot stat %s", tmp);
1561 return (B_FALSE);
1562 }
1563 /*
1564 * Ignore any non-directories encountered. These are
1565 * things that have been converted into symlinks
1566 * (/etc/fs and /etc/lib) and no longer need a lofs
1567 * fixup.
1568 */
1569 if (!S_ISDIR(st.st_mode))
1570 continue;
1571 }
1572 if (domount(zlogp, MNTTYPE_LOFS, RESOURCE_DEFAULT_OPTS, *cpp,
1573 tmp) != 0) {
1574 zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1575 *cpp);
1576 return (B_FALSE);
1577 }
1578 }
1579
1580 if (mount_cmd == Z_MNT_UPDATE)
1581 tmpdirs = upd_tmpdirs;
1582 else
1583 tmpdirs = scr_tmpdirs;
1584
1585 /*
1586 * These are things with tmpfs mounted inside.
1587 */
1588 for (cpp = tmpdirs; *cpp != NULL; cpp++) {
1589 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1590 if (mount_cmd == Z_MNT_SCRATCH && mkdir(tmp, 0755) != 0 &&
1591 errno != EEXIST) {
1592 zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1593 return (B_FALSE);
1594 }
1595
1596 /*
1597 * We could set the mode for /tmp when we do the mkdir but
1598 * since that can be modified by the umask we will just set
1599 * the correct mode for /tmp now.
1600 */
1601 if (strcmp(*cpp, "/tmp") == 0 && chmod(tmp, 01777) != 0) {
1602 zerror(zlogp, B_TRUE, "cannot chmod %s", tmp);
1603 return (B_FALSE);
1604 }
1605
1606 if (domount(zlogp, MNTTYPE_TMPFS, "", "swap", tmp) != 0) {
1607 zerror(zlogp, B_TRUE, "cannot mount swap on %s", *cpp);
1608 return (B_FALSE);
1609 }
1610 }
1611 return (B_TRUE);
1612 }
1613
1614 typedef struct plat_gmount_cb_data {
1615 zlog_t *pgcd_zlogp;
1616 struct zone_fstab **pgcd_fs_tab;
1617 int *pgcd_num_fs;
1618 } plat_gmount_cb_data_t;
1619
1620 /*
1621 * plat_gmount_cb() is a callback function invoked by libbrand to iterate
1622 * through all global brand platform mounts.
1623 */
1624 int
1625 plat_gmount_cb(void *data, const char *spec, const char *dir,
1626 const char *fstype, const char *opt)
1627 {
1628 plat_gmount_cb_data_t *cp = data;
1629 zlog_t *zlogp = cp->pgcd_zlogp;
1630 struct zone_fstab *fs_ptr = *cp->pgcd_fs_tab;
1631 int num_fs = *cp->pgcd_num_fs;
1632 struct zone_fstab *fsp, *tmp_ptr;
1633
1634 num_fs++;
1635 if ((tmp_ptr = realloc(fs_ptr, num_fs * sizeof (*tmp_ptr))) == NULL) {
1636 zerror(zlogp, B_TRUE, "memory allocation failed");
1637 return (-1);
1638 }
1639
1640 fs_ptr = tmp_ptr;
1641 fsp = &fs_ptr[num_fs - 1];
1642
1643 /* update the callback struct passed in */
1644 *cp->pgcd_fs_tab = fs_ptr;
1645 *cp->pgcd_num_fs = num_fs;
1646
1647 fsp->zone_fs_raw[0] = '\0';
1648 (void) strlcpy(fsp->zone_fs_special, spec,
1649 sizeof (fsp->zone_fs_special));
1650 (void) strlcpy(fsp->zone_fs_dir, dir, sizeof (fsp->zone_fs_dir));
1651 (void) strlcpy(fsp->zone_fs_type, fstype, sizeof (fsp->zone_fs_type));
1652 fsp->zone_fs_options = NULL;
1653 if ((opt != NULL) &&
1654 (zonecfg_add_fs_option(fsp, (char *)opt) != Z_OK)) {
1655 zerror(zlogp, B_FALSE, "error adding property");
1656 return (-1);
1657 }
1658
1659 return (0);
1660 }
1661
1662 static int
1663 mount_filesystems_fsent(zone_dochandle_t handle, zlog_t *zlogp,
1664 struct zone_fstab **fs_tabp, int *num_fsp, zone_mnt_t mount_cmd)
1665 {
1666 struct zone_fstab *tmp_ptr, *fs_ptr, *fsp, fstab;
1667 int num_fs;
1668
1669 num_fs = *num_fsp;
1670 fs_ptr = *fs_tabp;
1671
1672 if (zonecfg_setfsent(handle) != Z_OK) {
1673 zerror(zlogp, B_FALSE, "invalid configuration");
1674 return (-1);
1675 }
1676 while (zonecfg_getfsent(handle, &fstab) == Z_OK) {
1677 /*
1678 * ZFS filesystems will not be accessible under an alternate
1679 * root, since the pool will not be known. Ignore them in this
1680 * case.
1681 */
1682 if (ALT_MOUNT(mount_cmd) &&
1683 strcmp(fstab.zone_fs_type, MNTTYPE_ZFS) == 0)
1684 continue;
1685
1686 num_fs++;
1687 if ((tmp_ptr = realloc(fs_ptr,
1688 num_fs * sizeof (*tmp_ptr))) == NULL) {
1689 zerror(zlogp, B_TRUE, "memory allocation failed");
1690 (void) zonecfg_endfsent(handle);
1691 return (-1);
1692 }
1693 /* update the pointers passed in */
1694 *fs_tabp = tmp_ptr;
1695 *num_fsp = num_fs;
1696
1697 fs_ptr = tmp_ptr;
1698 fsp = &fs_ptr[num_fs - 1];
1699 (void) strlcpy(fsp->zone_fs_dir,
1700 fstab.zone_fs_dir, sizeof (fsp->zone_fs_dir));
1701 (void) strlcpy(fsp->zone_fs_raw, fstab.zone_fs_raw,
1702 sizeof (fsp->zone_fs_raw));
1703 (void) strlcpy(fsp->zone_fs_type, fstab.zone_fs_type,
1704 sizeof (fsp->zone_fs_type));
1705 fsp->zone_fs_options = fstab.zone_fs_options;
1706
1707 /*
1708 * For all lofs mounts, make sure that the 'special'
1709 * entry points inside the alternate root. The
1710 * source path for a lofs mount in a given zone needs
1711 * to be relative to the root of the boot environment
1712 * that contains the zone. Note that we don't do this
1713 * for non-lofs mounts since they will have a device
1714 * as a backing store and device paths must always be
1715 * specified relative to the current boot environment.
1716 */
1717 fsp->zone_fs_special[0] = '\0';
1718 if (strcmp(fsp->zone_fs_type, MNTTYPE_LOFS) == 0) {
1719 (void) strlcat(fsp->zone_fs_special, zonecfg_get_root(),
1720 sizeof (fsp->zone_fs_special));
1721 }
1722 (void) strlcat(fsp->zone_fs_special, fstab.zone_fs_special,
1723 sizeof (fsp->zone_fs_special));
1724 }
1725 (void) zonecfg_endfsent(handle);
1726 return (0);
1727 }
1728
1729 static int
1730 mount_filesystems(zlog_t *zlogp, zone_mnt_t mount_cmd)
1731 {
1732 char rootpath[MAXPATHLEN];
1733 char brand[MAXNAMELEN];
1734 char luroot[MAXPATHLEN];
1735 int i, num_fs = 0;
1736 struct zone_fstab *fs_ptr = NULL;
1737 zone_state_t zstate;
1738 brand_handle_t bh;
1739 plat_gmount_cb_data_t cb;
1740
1741 if (zone_get_state(zone_name, &zstate) != Z_OK ||
1742 (zstate != ZONE_STATE_READY && zstate != ZONE_STATE_MOUNTED)) {
1743 zerror(zlogp, B_FALSE,
1744 "zone must be in '%s' or '%s' state to mount file-systems",
1745 zone_state_str(ZONE_STATE_READY),
1746 zone_state_str(ZONE_STATE_MOUNTED));
1747 goto bad;
1748 }
1749
1750 if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
1751 zerror(zlogp, B_TRUE, "unable to determine zone root");
1752 goto bad;
1753 }
1754
1755 if (zonecfg_setfsent(snap_hndl) != Z_OK) {
1756 zerror(zlogp, B_FALSE, "invalid configuration");
1757 goto bad;
1758 }
1759
1760 /*
1761 * If we are mounting the zone, then we must always use the default
1762 * brand global mounts.
1763 */
1764 if (ALT_MOUNT(mount_cmd)) {
1765 (void) strlcpy(brand, default_brand, sizeof (brand));
1766 } else {
1767 (void) strlcpy(brand, brand_name, sizeof (brand));
1768 }
1769
1770 /* Get a handle to the brand info for this zone */
1771 if ((bh = brand_open(brand)) == NULL) {
1772 zerror(zlogp, B_FALSE, "unable to determine zone brand");
1773 return (-1);
1774 }
1775
1776 /*
1777 * Get the list of global filesystems to mount from the brand
1778 * configuration.
1779 */
1780 cb.pgcd_zlogp = zlogp;
1781 cb.pgcd_fs_tab = &fs_ptr;
1782 cb.pgcd_num_fs = &num_fs;
1783 if (brand_platform_iter_gmounts(bh, zone_name, zonepath,
1784 plat_gmount_cb, &cb) != 0) {
1785 zerror(zlogp, B_FALSE, "unable to mount filesystems");
1786 brand_close(bh);
1787 return (-1);
1788 }
1789 brand_close(bh);
1790
1791 /*
1792 * Iterate through the rest of the filesystems. Sort them all,
1793 * then mount them in sorted order. This is to make sure the
1794 * higher level directories (e.g., /usr) get mounted before
1795 * any beneath them (e.g., /usr/local).
1796 */
1797 if (mount_filesystems_fsent(snap_hndl, zlogp, &fs_ptr, &num_fs,
1798 mount_cmd) != 0)
1799 goto bad;
1800
1801 /*
1802 * Normally when we mount a zone all the zone filesystems
1803 * get mounted relative to rootpath, which is usually
1804 * <zonepath>/root. But when mounting a zone for administration
1805 * purposes via the zone "mount" state, build_mounted_pre_var()
1806 * updates rootpath to be <zonepath>/lu/a so we'll mount all
1807 * the zones filesystems there instead.
1808 *
1809 * build_mounted_pre_var() and build_mounted_post_var() will
1810 * also do some extra work to create directories and lofs mount
1811 * a bunch of global zone file system paths into <zonepath>/lu.
1812 *
1813 * This allows us to be able to enter the zone (now rooted at
1814 * <zonepath>/lu) and run the upgrade/patch tools that are in the
1815 * global zone and have them upgrade the to-be-modified zone's
1816 * files mounted on /a. (Which mirrors the existing standard
1817 * upgrade environment.)
1818 *
1819 * There is of course one catch. When doing the upgrade
1820 * we need <zoneroot>/lu/dev to be the /dev filesystem
1821 * for the zone and we don't want to have any /dev filesystem
1822 * mounted at <zoneroot>/lu/a/dev. Since /dev is specified
1823 * as a normal zone filesystem by default we'll try to mount
1824 * it at <zoneroot>/lu/a/dev, so we have to detect this
1825 * case and instead mount it at <zoneroot>/lu/dev.
1826 *
1827 * All this work is done in three phases:
1828 * 1) Create and populate lu directory (build_mounted_pre_var()).
1829 * 2) Mount the required filesystems as per the zone configuration.
1830 * 3) Set up the rest of the scratch zone environment
1831 * (build_mounted_post_var()).
1832 */
1833 if (ALT_MOUNT(mount_cmd) && !build_mounted_pre_var(zlogp,
1834 rootpath, sizeof (rootpath), zonepath, luroot, sizeof (luroot)))
1835 goto bad;
1836
1837 qsort(fs_ptr, num_fs, sizeof (*fs_ptr), fs_compare);
1838
1839 for (i = 0; i < num_fs; i++) {
1840 if (ALT_MOUNT(mount_cmd)) {
1841 if (strcmp(fs_ptr[i].zone_fs_dir, "/dev") == 0) {
1842 size_t slen = strlen(rootpath) - 2;
1843
1844 /*
1845 * By default we'll try to mount /dev
1846 * as /a/dev but /dev is special and
1847 * always goes at the top so strip the
1848 * trailing '/a' from the rootpath.
1849 */
1850 assert(strcmp(&rootpath[slen], "/a") == 0);
1851 rootpath[slen] = '\0';
1852 if (mount_one(zlogp, &fs_ptr[i], rootpath,
1853 mount_cmd) != 0)
1854 goto bad;
1855 rootpath[slen] = '/';
1856 continue;
1857 } else if (strcmp(brand_name, default_brand) != 0) {
1858 /*
1859 * If mounting non-native brand, skip
1860 * mounting global mounts and
1861 * filesystem entries since they are
1862 * only needed for native pkg upgrade
1863 * tools.
1864 *
1865 * The only exception right now is
1866 * /dev (handled above), which is
1867 * needed in the luroot in order to
1868 * zlogin -S into the zone.
1869 */
1870 continue;
1871 }
1872 }
1873
1874 if (mount_one(zlogp, &fs_ptr[i], rootpath, mount_cmd) != 0)
1875 goto bad;
1876 }
1877 if (ALT_MOUNT(mount_cmd) &&
1878 !build_mounted_post_var(zlogp, mount_cmd, rootpath, luroot))
1879 goto bad;
1880
1881 /*
1882 * For Trusted Extensions cross-mount each lower level /export/home
1883 */
1884 if (mount_cmd == Z_MNT_BOOT &&
1885 tsol_mounts(zlogp, zone_name, rootpath) != 0)
1886 goto bad;
1887
1888 free_fs_data(fs_ptr, num_fs);
1889
1890 /*
1891 * Everything looks fine.
1892 */
1893 return (0);
1894
1895 bad:
1896 free_fs_data(fs_ptr, num_fs);
1897 return (-1);
1898 }
1899
1900 /* caller makes sure neither parameter is NULL */
1901 static int
1902 addr2netmask(char *prefixstr, int maxprefixlen, uchar_t *maskstr)
1903 {
1904 int prefixlen;
1905
1906 prefixlen = atoi(prefixstr);
1907 if (prefixlen < 0 || prefixlen > maxprefixlen)
1908 return (1);
1909 while (prefixlen > 0) {
1910 if (prefixlen >= 8) {
1911 *maskstr++ = 0xFF;
1912 prefixlen -= 8;
1913 continue;
1914 }
1915 *maskstr |= 1 << (8 - prefixlen);
1916 prefixlen--;
1917 }
1918 return (0);
1919 }
1920
1921 /*
1922 * Tear down all interfaces belonging to the given zone. This should
1923 * be called with the zone in a state other than "running", so that
1924 * interfaces can't be assigned to the zone after this returns.
1925 *
1926 * If anything goes wrong, log an error message and return an error.
1927 */
1928 static int
1929 unconfigure_shared_network_interfaces(zlog_t *zlogp, zoneid_t zone_id)
1930 {
1931 struct lifnum lifn;
1932 struct lifconf lifc;
1933 struct lifreq *lifrp, lifrl;
1934 int64_t lifc_flags = LIFC_NOXMIT | LIFC_ALLZONES;
1935 int num_ifs, s, i, ret_code = 0;
1936 uint_t bufsize;
1937 char *buf = NULL;
1938
1939 if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
1940 zerror(zlogp, B_TRUE, "could not get socket");
1941 ret_code = -1;
1942 goto bad;
1943 }
1944 lifn.lifn_family = AF_UNSPEC;
1945 lifn.lifn_flags = (int)lifc_flags;
1946 if (ioctl(s, SIOCGLIFNUM, (char *)&lifn) < 0) {
1947 zerror(zlogp, B_TRUE,
1948 "could not determine number of network interfaces");
1949 ret_code = -1;
1950 goto bad;
1951 }
1952 num_ifs = lifn.lifn_count;
1953 bufsize = num_ifs * sizeof (struct lifreq);
1954 if ((buf = malloc(bufsize)) == NULL) {
1955 zerror(zlogp, B_TRUE, "memory allocation failed");
1956 ret_code = -1;
1957 goto bad;
1958 }
1959 lifc.lifc_family = AF_UNSPEC;
1960 lifc.lifc_flags = (int)lifc_flags;
1961 lifc.lifc_len = bufsize;
1962 lifc.lifc_buf = buf;
1963 if (ioctl(s, SIOCGLIFCONF, (char *)&lifc) < 0) {
1964 zerror(zlogp, B_TRUE, "could not get configured network "
1965 "interfaces");
1966 ret_code = -1;
1967 goto bad;
1968 }
1969 lifrp = lifc.lifc_req;
1970 for (i = lifc.lifc_len / sizeof (struct lifreq); i > 0; i--, lifrp++) {
1971 (void) close(s);
1972 if ((s = socket(lifrp->lifr_addr.ss_family, SOCK_DGRAM, 0)) <
1973 0) {
1974 zerror(zlogp, B_TRUE, "%s: could not get socket",
1975 lifrl.lifr_name);
1976 ret_code = -1;
1977 continue;
1978 }
1979 (void) memset(&lifrl, 0, sizeof (lifrl));
1980 (void) strncpy(lifrl.lifr_name, lifrp->lifr_name,
1981 sizeof (lifrl.lifr_name));
1982 if (ioctl(s, SIOCGLIFZONE, (caddr_t)&lifrl) < 0) {
1983 if (errno == ENXIO)
1984 /*
1985 * Interface may have been removed by admin or
1986 * another zone halting.
1987 */
1988 continue;
1989 zerror(zlogp, B_TRUE,
1990 "%s: could not determine the zone to which this "
1991 "network interface is bound", lifrl.lifr_name);
1992 ret_code = -1;
1993 continue;
1994 }
1995 if (lifrl.lifr_zoneid == zone_id) {
1996 if (ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifrl) < 0) {
1997 zerror(zlogp, B_TRUE,
1998 "%s: could not remove network interface",
1999 lifrl.lifr_name);
2000 ret_code = -1;
2001 continue;
2002 }
2003 }
2004 }
2005 bad:
2006 if (s > 0)
2007 (void) close(s);
2008 if (buf)
2009 free(buf);
2010 return (ret_code);
2011 }
2012
2013 static union sockunion {
2014 struct sockaddr sa;
2015 struct sockaddr_in sin;
2016 struct sockaddr_dl sdl;
2017 struct sockaddr_in6 sin6;
2018 } so_dst, so_ifp;
2019
2020 static struct {
2021 struct rt_msghdr hdr;
2022 char space[512];
2023 } rtmsg;
2024
2025 static int
2026 salen(struct sockaddr *sa)
2027 {
2028 switch (sa->sa_family) {
2029 case AF_INET:
2030 return (sizeof (struct sockaddr_in));
2031 case AF_LINK:
2032 return (sizeof (struct sockaddr_dl));
2033 case AF_INET6:
2034 return (sizeof (struct sockaddr_in6));
2035 default:
2036 return (sizeof (struct sockaddr));
2037 }
2038 }
2039
2040 #define ROUNDUP_LONG(a) \
2041 ((a) > 0 ? (1 + (((a) - 1) | (sizeof (long) - 1))) : sizeof (long))
2042
2043 /*
2044 * Look up which zone is using a given IP address. The address in question
2045 * is expected to have been stuffed into the structure to which lifr points
2046 * via a previous SIOCGLIFADDR ioctl().
2047 *
2048 * This is done using black router socket magic.
2049 *
2050 * Return the name of the zone on success or NULL on failure.
2051 *
2052 * This is a lot of code for a simple task; a new ioctl request to take care
2053 * of this might be a useful RFE.
2054 */
2055
2056 static char *
2057 who_is_using(zlog_t *zlogp, struct lifreq *lifr)
2058 {
2059 static char answer[ZONENAME_MAX];
2060 pid_t pid;
2061 int s, rlen, l, i;
2062 char *cp = rtmsg.space;
2063 struct sockaddr_dl *ifp = NULL;
2064 struct sockaddr *sa;
2065 char save_if_name[LIFNAMSIZ];
2066
2067 answer[0] = '\0';
2068
2069 pid = getpid();
2070 if ((s = socket(PF_ROUTE, SOCK_RAW, 0)) < 0) {
2071 zerror(zlogp, B_TRUE, "could not get routing socket");
2072 return (NULL);
2073 }
2074
2075 if (lifr->lifr_addr.ss_family == AF_INET) {
2076 struct sockaddr_in *sin4;
2077
2078 so_dst.sa.sa_family = AF_INET;
2079 sin4 = (struct sockaddr_in *)&lifr->lifr_addr;
2080 so_dst.sin.sin_addr = sin4->sin_addr;
2081 } else {
2082 struct sockaddr_in6 *sin6;
2083
2084 so_dst.sa.sa_family = AF_INET6;
2085 sin6 = (struct sockaddr_in6 *)&lifr->lifr_addr;
2086 so_dst.sin6.sin6_addr = sin6->sin6_addr;
2087 }
2088
2089 so_ifp.sa.sa_family = AF_LINK;
2090
2091 (void) memset(&rtmsg, 0, sizeof (rtmsg));
2092 rtmsg.hdr.rtm_type = RTM_GET;
2093 rtmsg.hdr.rtm_flags = RTF_UP | RTF_HOST;
2094 rtmsg.hdr.rtm_version = RTM_VERSION;
2095 rtmsg.hdr.rtm_seq = ++rts_seqno;
2096 rtmsg.hdr.rtm_addrs = RTA_IFP | RTA_DST;
2097
2098 l = ROUNDUP_LONG(salen(&so_dst.sa));
2099 (void) memmove(cp, &(so_dst), l);
2100 cp += l;
2101 l = ROUNDUP_LONG(salen(&so_ifp.sa));
2102 (void) memmove(cp, &(so_ifp), l);
2103 cp += l;
2104
2105 rtmsg.hdr.rtm_msglen = l = cp - (char *)&rtmsg;
2106
2107 if ((rlen = write(s, &rtmsg, l)) < 0) {
2108 zerror(zlogp, B_TRUE, "writing to routing socket");
2109 return (NULL);
2110 } else if (rlen < (int)rtmsg.hdr.rtm_msglen) {
2111 zerror(zlogp, B_TRUE,
2112 "write to routing socket got only %d for len\n", rlen);
2113 return (NULL);
2114 }
2115 do {
2116 l = read(s, &rtmsg, sizeof (rtmsg));
2117 } while (l > 0 && (rtmsg.hdr.rtm_seq != rts_seqno ||
2118 rtmsg.hdr.rtm_pid != pid));
2119 if (l < 0) {
2120 zerror(zlogp, B_TRUE, "reading from routing socket");
2121 return (NULL);
2122 }
2123
2124 if (rtmsg.hdr.rtm_version != RTM_VERSION) {
2125 zerror(zlogp, B_FALSE,
2126 "routing message version %d not understood",
2127 rtmsg.hdr.rtm_version);
2128 return (NULL);
2129 }
2130 if (rtmsg.hdr.rtm_msglen != (ushort_t)l) {
2131 zerror(zlogp, B_FALSE, "message length mismatch, "
2132 "expected %d bytes, returned %d bytes",
2133 rtmsg.hdr.rtm_msglen, l);
2134 return (NULL);
2135 }
2136 if (rtmsg.hdr.rtm_errno != 0) {
2137 errno = rtmsg.hdr.rtm_errno;
2138 zerror(zlogp, B_TRUE, "RTM_GET routing socket message");
2139 return (NULL);
2140 }
2141 if ((rtmsg.hdr.rtm_addrs & RTA_IFP) == 0) {
2142 zerror(zlogp, B_FALSE, "network interface not found");
2143 return (NULL);
2144 }
2145 cp = ((char *)(&rtmsg.hdr + 1));
2146 for (i = 1; i != 0; i <<= 1) {
2147 /* LINTED E_BAD_PTR_CAST_ALIGN */
2148 sa = (struct sockaddr *)cp;
2149 if (i != RTA_IFP) {
2150 if ((i & rtmsg.hdr.rtm_addrs) != 0)
2151 cp += ROUNDUP_LONG(salen(sa));
2152 continue;
2153 }
2154 if (sa->sa_family == AF_LINK &&
2155 ((struct sockaddr_dl *)sa)->sdl_nlen != 0)
2156 ifp = (struct sockaddr_dl *)sa;
2157 break;
2158 }
2159 if (ifp == NULL) {
2160 zerror(zlogp, B_FALSE, "network interface could not be "
2161 "determined");
2162 return (NULL);
2163 }
2164
2165 /*
2166 * We need to set the I/F name to what we got above, then do the
2167 * appropriate ioctl to get its zone name. But lifr->lifr_name is
2168 * used by the calling function to do a REMOVEIF, so if we leave the
2169 * "good" zone's I/F name in place, *that* I/F will be removed instead
2170 * of the bad one. So we save the old (bad) I/F name before over-
2171 * writing it and doing the ioctl, then restore it after the ioctl.
2172 */
2173 (void) strlcpy(save_if_name, lifr->lifr_name, sizeof (save_if_name));
2174 (void) strncpy(lifr->lifr_name, ifp->sdl_data, ifp->sdl_nlen);
2175 lifr->lifr_name[ifp->sdl_nlen] = '\0';
2176 i = ioctl(s, SIOCGLIFZONE, lifr);
2177 (void) strlcpy(lifr->lifr_name, save_if_name, sizeof (save_if_name));
2178 if (i < 0) {
2179 zerror(zlogp, B_TRUE,
2180 "%s: could not determine the zone network interface "
2181 "belongs to", lifr->lifr_name);
2182 return (NULL);
2183 }
2184 if (getzonenamebyid(lifr->lifr_zoneid, answer, sizeof (answer)) < 0)
2185 (void) snprintf(answer, sizeof (answer), "%d",
2186 lifr->lifr_zoneid);
2187
2188 if (strlen(answer) > 0)
2189 return (answer);
2190 return (NULL);
2191 }
2192
2193 /*
2194 * Configures a single interface: a new virtual interface is added, based on
2195 * the physical interface nwiftabptr->zone_nwif_physical, with the address
2196 * specified in nwiftabptr->zone_nwif_address, for zone zone_id. Note that
2197 * the "address" can be an IPv6 address (with a /prefixlength required), an
2198 * IPv4 address (with a /prefixlength optional), or a name; for the latter,
2199 * an IPv4 name-to-address resolution will be attempted.
2200 *
2201 * If anything goes wrong, we log an detailed error message, attempt to tear
2202 * down whatever we set up and return an error.
2203 */
2204 static int
2205 configure_one_interface(zlog_t *zlogp, zoneid_t zone_id,
2206 struct zone_nwiftab *nwiftabptr)
2207 {
2208 struct lifreq lifr;
2209 struct sockaddr_in netmask4;
2210 struct sockaddr_in6 netmask6;
2211 struct sockaddr_storage laddr;
2212 struct in_addr in4;
2213 sa_family_t af;
2214 char *slashp = strchr(nwiftabptr->zone_nwif_address, '/');
2215 int s;
2216 boolean_t got_netmask = B_FALSE;
2217 boolean_t is_loopback = B_FALSE;
2218 char addrstr4[INET_ADDRSTRLEN];
2219 int res;
2220
2221 res = zonecfg_valid_net_address(nwiftabptr->zone_nwif_address, &lifr);
2222 if (res != Z_OK) {
2223 zerror(zlogp, B_FALSE, "%s: %s", zonecfg_strerror(res),
2224 nwiftabptr->zone_nwif_address);
2225 return (-1);
2226 }
2227 af = lifr.lifr_addr.ss_family;
2228 if (af == AF_INET)
2229 in4 = ((struct sockaddr_in *)(&lifr.lifr_addr))->sin_addr;
2230 if ((s = socket(af, SOCK_DGRAM, 0)) < 0) {
2231 zerror(zlogp, B_TRUE, "could not get socket");
2232 return (-1);
2233 }
2234
2235 /*
2236 * This is a similar kind of "hack" like in addif() to get around
2237 * the problem of SIOCLIFADDIF. The problem is that this ioctl
2238 * does not include the netmask when adding a logical interface.
2239 * To get around this problem, we first add the logical interface
2240 * with a 0 address. After that, we set the netmask if provided.
2241 * Finally we set the interface address.
2242 */
2243 laddr = lifr.lifr_addr;
2244 (void) strlcpy(lifr.lifr_name, nwiftabptr->zone_nwif_physical,
2245 sizeof (lifr.lifr_name));
2246 (void) memset(&lifr.lifr_addr, 0, sizeof (lifr.lifr_addr));
2247
2248 if (ioctl(s, SIOCLIFADDIF, (caddr_t)&lifr) < 0) {
2249 /*
2250 * Here, we know that the interface can't be brought up.
2251 * A similar warning message was already printed out to
2252 * the console by zoneadm(8) so instead we log the
2253 * message to syslog and continue.
2254 */
2255 (void) close(s);
2256 return (Z_OK);
2257 }
2258
2259 /* Preserve literal IPv4 address for later potential printing. */
2260 if (af == AF_INET)
2261 (void) inet_ntop(AF_INET, &in4, addrstr4, INET_ADDRSTRLEN);
2262
2263 lifr.lifr_zoneid = zone_id;
2264 if (ioctl(s, SIOCSLIFZONE, (caddr_t)&lifr) < 0) {
2265 zerror(zlogp, B_TRUE, "%s: could not place network interface "
2266 "into zone", lifr.lifr_name);
2267 goto bad;
2268 }
2269
2270 /*
2271 * Loopback interface will use the default netmask assigned, if no
2272 * netmask is found.
2273 */
2274 if (strcmp(nwiftabptr->zone_nwif_physical, "lo0") == 0) {
2275 is_loopback = B_TRUE;
2276 }
2277 if (af == AF_INET) {
2278 /*
2279 * The IPv4 netmask can be determined either
2280 * directly if a prefix length was supplied with
2281 * the address or via the netmasks database. Not
2282 * being able to determine it is a common failure,
2283 * but it often is not fatal to operation of the
2284 * interface. In that case, a warning will be
2285 * printed after the rest of the interface's
2286 * parameters have been configured.
2287 */
2288 (void) memset(&netmask4, 0, sizeof (netmask4));
2289 if (slashp != NULL) {
2290 if (addr2netmask(slashp + 1, V4_ADDR_LEN,
2291 (uchar_t *)&netmask4.sin_addr) != 0) {
2292 *slashp = '/';
2293 zerror(zlogp, B_FALSE,
2294 "%s: invalid prefix length in %s",
2295 lifr.lifr_name,
2296 nwiftabptr->zone_nwif_address);
2297 goto bad;
2298 }
2299 got_netmask = B_TRUE;
2300 } else if (getnetmaskbyaddr(in4,
2301 &netmask4.sin_addr) == 0) {
2302 got_netmask = B_TRUE;
2303 }
2304 if (got_netmask) {
2305 netmask4.sin_family = af;
2306 (void) memcpy(&lifr.lifr_addr, &netmask4,
2307 sizeof (netmask4));
2308 }
2309 } else {
2310 (void) memset(&netmask6, 0, sizeof (netmask6));
2311 if (addr2netmask(slashp + 1, V6_ADDR_LEN,
2312 (uchar_t *)&netmask6.sin6_addr) != 0) {
2313 *slashp = '/';
2314 zerror(zlogp, B_FALSE,
2315 "%s: invalid prefix length in %s",
2316 lifr.lifr_name,
2317 nwiftabptr->zone_nwif_address);
2318 goto bad;
2319 }
2320 got_netmask = B_TRUE;
2321 netmask6.sin6_family = af;
2322 (void) memcpy(&lifr.lifr_addr, &netmask6,
2323 sizeof (netmask6));
2324 }
2325 if (got_netmask &&
2326 ioctl(s, SIOCSLIFNETMASK, (caddr_t)&lifr) < 0) {
2327 zerror(zlogp, B_TRUE, "%s: could not set netmask",
2328 lifr.lifr_name);
2329 goto bad;
2330 }
2331
2332 /* Set the interface address */
2333 lifr.lifr_addr = laddr;
2334 if (ioctl(s, SIOCSLIFADDR, (caddr_t)&lifr) < 0) {
2335 zerror(zlogp, B_TRUE,
2336 "%s: could not set IP address to %s",
2337 lifr.lifr_name, nwiftabptr->zone_nwif_address);
2338 goto bad;
2339 }
2340
2341 if (ioctl(s, SIOCGLIFFLAGS, (caddr_t)&lifr) < 0) {
2342 zerror(zlogp, B_TRUE, "%s: could not get flags",
2343 lifr.lifr_name);
2344 goto bad;
2345 }
2346 lifr.lifr_flags |= IFF_UP;
2347 if (ioctl(s, SIOCSLIFFLAGS, (caddr_t)&lifr) < 0) {
2348 int save_errno = errno;
2349 char *zone_using;
2350
2351 /*
2352 * If we failed with something other than EADDRNOTAVAIL,
2353 * then skip to the end. Otherwise, look up our address,
2354 * then call a function to determine which zone is already
2355 * using that address.
2356 */
2357 if (errno != EADDRNOTAVAIL) {
2358 zerror(zlogp, B_TRUE,
2359 "%s: could not bring network interface up",
2360 lifr.lifr_name);
2361 goto bad;
2362 }
2363 if (ioctl(s, SIOCGLIFADDR, (caddr_t)&lifr) < 0) {
2364 zerror(zlogp, B_TRUE, "%s: could not get address",
2365 lifr.lifr_name);
2366 goto bad;
2367 }
2368 zone_using = who_is_using(zlogp, &lifr);
2369 errno = save_errno;
2370 if (zone_using == NULL)
2371 zerror(zlogp, B_TRUE,
2372 "%s: could not bring network interface up",
2373 lifr.lifr_name);
2374 else
2375 zerror(zlogp, B_TRUE, "%s: could not bring network "
2376 "interface up: address in use by zone '%s'",
2377 lifr.lifr_name, zone_using);
2378 goto bad;
2379 }
2380
2381 if (!got_netmask && !is_loopback) {
2382 /*
2383 * A common, but often non-fatal problem, is that the system
2384 * cannot find the netmask for an interface address. This is
2385 * often caused by it being only in /etc/inet/netmasks, but
2386 * /etc/nsswitch.conf says to use NIS or NIS+ and it's not
2387 * in that. This doesn't show up at boot because the netmask
2388 * is obtained from /etc/inet/netmasks when no network
2389 * interfaces are up, but isn't consulted when NIS/NIS+ is
2390 * available. We warn the user here that something like this
2391 * has happened and we're just running with a default and
2392 * possible incorrect netmask.
2393 */
2394 char buffer[INET6_ADDRSTRLEN];
2395 void *addr;
2396 const char *nomatch = "no matching subnet found in netmasks(5)";
2397
2398 if (af == AF_INET)
2399 addr = &((struct sockaddr_in *)
2400 (&lifr.lifr_addr))->sin_addr;
2401 else
2402 addr = &((struct sockaddr_in6 *)
2403 (&lifr.lifr_addr))->sin6_addr;
2404
2405 /*
2406 * Find out what netmask the interface is going to be using.
2407 * If we just brought up an IPMP data address on an underlying
2408 * interface above, the address will have already migrated, so
2409 * the SIOCGLIFNETMASK won't be able to find it (but we need
2410 * to bring the address up to get the actual netmask). Just
2411 * omit printing the actual netmask in this corner-case.
2412 */
2413 if (ioctl(s, SIOCGLIFNETMASK, (caddr_t)&lifr) < 0 ||
2414 inet_ntop(af, addr, buffer, sizeof (buffer)) == NULL) {
2415 zerror(zlogp, B_FALSE, "WARNING: %s; using default.",
2416 nomatch);
2417 } else {
2418 zerror(zlogp, B_FALSE,
2419 "WARNING: %s: %s: %s; using default of %s.",
2420 lifr.lifr_name, nomatch, addrstr4, buffer);
2421 }
2422 }
2423
2424 /*
2425 * If a default router was specified for this interface
2426 * set the route now. Ignore if already set.
2427 */
2428 if (strlen(nwiftabptr->zone_nwif_defrouter) > 0) {
2429 int status;
2430 char *argv[7];
2431
2432 argv[0] = "route";
2433 argv[1] = "add";
2434 argv[2] = "-ifp";
2435 argv[3] = nwiftabptr->zone_nwif_physical;
2436 argv[4] = "default";
2437 argv[5] = nwiftabptr->zone_nwif_defrouter;
2438 argv[6] = NULL;
2439
2440 status = forkexec(zlogp, "/usr/sbin/route", argv);
2441 if (status != 0 && status != EEXIST)
2442 zerror(zlogp, B_FALSE, "Unable to set route for "
2443 "interface %s to %s\n",
2444 nwiftabptr->zone_nwif_physical,
2445 nwiftabptr->zone_nwif_defrouter);
2446 }
2447
2448 (void) close(s);
2449 return (Z_OK);
2450 bad:
2451 (void) ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifr);
2452 (void) close(s);
2453 return (-1);
2454 }
2455
2456 /*
2457 * Sets up network interfaces based on information from the zone configuration.
2458 * IPv4 and IPv6 loopback interfaces are set up "for free", modeling the global
2459 * system.
2460 *
2461 * If anything goes wrong, we log a general error message, attempt to tear down
2462 * whatever we set up, and return an error.
2463 */
2464 static int
2465 configure_shared_network_interfaces(zlog_t *zlogp)
2466 {
2467 struct zone_nwiftab nwiftab, loopback_iftab;
2468 zoneid_t zoneid;
2469
2470 if ((zoneid = getzoneidbyname(zone_name)) == ZONE_ID_UNDEFINED) {
2471 zerror(zlogp, B_TRUE, "unable to get zoneid");
2472 return (-1);
2473 }
2474
2475 if (zonecfg_setnwifent(snap_hndl) == Z_OK) {
2476 for (;;) {
2477 if (zonecfg_getnwifent(snap_hndl, &nwiftab) != Z_OK)
2478 break;
2479 nwifent_free_attrs(&nwiftab);
2480 if (configure_one_interface(zlogp, zoneid, &nwiftab) !=
2481 Z_OK) {
2482 (void) zonecfg_endnwifent(snap_hndl);
2483 return (-1);
2484 }
2485 }
2486 (void) zonecfg_endnwifent(snap_hndl);
2487 }
2488 if (is_system_labeled()) {
2489 /*
2490 * Labeled zones share the loopback interface
2491 * so it is not plumbed for shared stack instances.
2492 */
2493 return (0);
2494 }
2495 (void) strlcpy(loopback_iftab.zone_nwif_physical, "lo0",
2496 sizeof (loopback_iftab.zone_nwif_physical));
2497 (void) strlcpy(loopback_iftab.zone_nwif_address, "127.0.0.1",
2498 sizeof (loopback_iftab.zone_nwif_address));
2499 loopback_iftab.zone_nwif_defrouter[0] = '\0';
2500 if (configure_one_interface(zlogp, zoneid, &loopback_iftab) != Z_OK)
2501 return (-1);
2502
2503 /* Always plumb up the IPv6 loopback interface. */
2504 (void) strlcpy(loopback_iftab.zone_nwif_address, "::1/128",
2505 sizeof (loopback_iftab.zone_nwif_address));
2506 if (configure_one_interface(zlogp, zoneid, &loopback_iftab) != Z_OK)
2507 return (-1);
2508 return (0);
2509 }
2510
2511 static void
2512 zdlerror(zlog_t *zlogp, dladm_status_t err, const char *dlname, const char *str)
2513 {
2514 char errmsg[DLADM_STRSIZE];
2515
2516 (void) dladm_status2str(err, errmsg);
2517 zerror(zlogp, B_FALSE, "%s '%s': %s", str, dlname, errmsg);
2518 }
2519
2520 static int
2521 add_datalink(zlog_t *zlogp, char *zone_name, datalink_id_t linkid, char *dlname)
2522 {
2523 dladm_status_t err;
2524 boolean_t cpuset, poolset;
2525 char *poolp;
2526
2527 /* First check if it's in use by global zone. */
2528 if (zonecfg_ifname_exists(AF_INET, dlname) ||
2529 zonecfg_ifname_exists(AF_INET6, dlname)) {
2530 zerror(zlogp, B_FALSE, "WARNING: skipping network interface "
2531 "'%s' which is used in the global zone", dlname);
2532 return (-1);
2533 }
2534
2535 /* Set zoneid of this link. */
2536 err = dladm_set_linkprop(dld_handle, linkid, "zone", &zone_name, 1,
2537 DLADM_OPT_ACTIVE);
2538 if (err != DLADM_STATUS_OK) {
2539 zdlerror(zlogp, err, dlname,
2540 "WARNING: unable to add network interface");
2541 return (-1);
2542 }
2543
2544 /*
2545 * Set the pool of this link if the zone has a pool and
2546 * neither the cpus nor the pool datalink property is
2547 * already set.
2548 */
2549 err = dladm_linkprop_is_set(dld_handle, linkid, DLADM_PROP_VAL_CURRENT,
2550 "cpus", &cpuset);
2551 if (err != DLADM_STATUS_OK) {
2552 zdlerror(zlogp, err, dlname,
2553 "WARNING: unable to check if cpus link property is set");
2554 }
2555 err = dladm_linkprop_is_set(dld_handle, linkid, DLADM_PROP_VAL_CURRENT,
2556 "pool", &poolset);
2557 if (err != DLADM_STATUS_OK) {
2558 zdlerror(zlogp, err, dlname,
2559 "WARNING: unable to check if pool link property is set");
2560 }
2561
2562 if ((strlen(pool_name) != 0) && !cpuset && !poolset) {
2563 poolp = pool_name;
2564 err = dladm_set_linkprop(dld_handle, linkid, "pool",
2565 &poolp, 1, DLADM_OPT_ACTIVE);
2566 if (err != DLADM_STATUS_OK) {
2567 zerror(zlogp, B_FALSE, "WARNING: unable to set "
2568 "pool %s to datalink %s", pool_name, dlname);
2569 bzero(pool_name, sizeof (pool_name));
2570 }
2571 } else {
2572 bzero(pool_name, sizeof (pool_name));
2573 }
2574 return (0);
2575 }
2576
2577 static boolean_t
2578 sockaddr_to_str(sa_family_t af, const struct sockaddr *sockaddr,
2579 char *straddr, size_t len)
2580 {
2581 struct sockaddr_in *sin;
2582 struct sockaddr_in6 *sin6;
2583 const char *str = NULL;
2584
2585 if (af == AF_INET) {
2586 /* LINTED E_BAD_PTR_CAST_ALIGN */
2587 sin = SIN(sockaddr);
2588 str = inet_ntop(AF_INET, (void *)&sin->sin_addr, straddr, len);
2589 } else if (af == AF_INET6) {
2590 /* LINTED E_BAD_PTR_CAST_ALIGN */
2591 sin6 = SIN6(sockaddr);
2592 str = inet_ntop(AF_INET6, (void *)&sin6->sin6_addr, straddr,
2593 len);
2594 }
2595
2596 return (str != NULL);
2597 }
2598
2599 static int
2600 ipv4_prefixlen(struct sockaddr_in *sin)
2601 {
2602 struct sockaddr_in *m;
2603 struct sockaddr_storage mask;
2604
2605 m = SIN(&mask);
2606 m->sin_family = AF_INET;
2607 if (getnetmaskbyaddr(sin->sin_addr, &m->sin_addr) == 0) {
2608 return (mask2plen((struct sockaddr *)&mask));
2609 } else if (IN_CLASSA(htonl(sin->sin_addr.s_addr))) {
2610 return (8);
2611 } else if (IN_CLASSB(ntohl(sin->sin_addr.s_addr))) {
2612 return (16);
2613 } else if (IN_CLASSC(ntohl(sin->sin_addr.s_addr))) {
2614 return (24);
2615 }
2616 return (0);
2617 }
2618
2619 static int
2620 zone_setattr_network(int type, zoneid_t zoneid, datalink_id_t linkid,
2621 void *buf, size_t bufsize)
2622 {
2623 zone_net_data_t *zndata;
2624 size_t znsize;
2625 int err;
2626
2627 znsize = sizeof (*zndata) + bufsize;
2628 zndata = calloc(1, znsize);
2629 if (zndata == NULL)
2630 return (ENOMEM);
2631 zndata->zn_type = type;
2632 zndata->zn_len = bufsize;
2633 zndata->zn_linkid = linkid;
2634 bcopy(buf, zndata->zn_val, zndata->zn_len);
2635 err = zone_setattr(zoneid, ZONE_ATTR_NETWORK, zndata, znsize);
2636 free(zndata);
2637 return (err);
2638 }
2639
2640 static int
2641 add_net_for_linkid(zlog_t *zlogp, zoneid_t zoneid, zone_addr_list_t *start)
2642 {
2643 struct lifreq lifr;
2644 char **astr, *address;
2645 dladm_status_t dlstatus;
2646 char *ip_nospoof = "ip-nospoof";
2647 int nnet, naddr, err = 0, j;
2648 size_t zlen, cpleft;
2649 zone_addr_list_t *ptr, *end;
2650 char tmp[INET6_ADDRSTRLEN], *maskstr;
2651 char *zaddr, *cp;
2652 struct in6_addr *routes = NULL;
2653 boolean_t is_set;
2654 datalink_id_t linkid;
2655
2656 assert(start != NULL);
2657 naddr = 0; /* number of addresses */
2658 nnet = 0; /* number of net resources */
2659 linkid = start->za_linkid;
2660 for (ptr = start; ptr != NULL && ptr->za_linkid == linkid;
2661 ptr = ptr->za_next) {
2662 nnet++;
2663 }
2664 end = ptr;
2665 zlen = nnet * (INET6_ADDRSTRLEN + 1);
2666 astr = calloc(1, nnet * sizeof (uintptr_t));
2667 zaddr = calloc(1, zlen);
2668 if (astr == NULL || zaddr == NULL) {
2669 err = ENOMEM;
2670 goto done;
2671 }
2672 cp = zaddr;
2673 cpleft = zlen;
2674 j = 0;
2675 for (ptr = start; ptr != end; ptr = ptr->za_next) {
2676 address = ptr->za_nwiftab.zone_nwif_allowed_address;
2677 if (address[0] == '\0')
2678 continue;
2679 (void) snprintf(tmp, sizeof (tmp), "%s", address);
2680 /*
2681 * Validate the data. zonecfg_valid_net_address() clobbers
2682 * the /<mask> in the address string.
2683 */
2684 if (zonecfg_valid_net_address(address, &lifr) != Z_OK) {
2685 zerror(zlogp, B_FALSE, "invalid address [%s]\n",
2686 address);
2687 err = EINVAL;
2688 goto done;
2689 }
2690 /*
2691 * convert any hostnames to numeric address strings.
2692 */
2693 if (!sockaddr_to_str(lifr.lifr_addr.ss_family,
2694 (const struct sockaddr *)&lifr.lifr_addr, cp, cpleft)) {
2695 err = EINVAL;
2696 goto done;
2697 }
2698 /*
2699 * make a copy of the numeric string for the data needed
2700 * by the "allowed-ips" datalink property.
2701 */
2702 astr[j] = strdup(cp);
2703 if (astr[j] == NULL) {
2704 err = ENOMEM;
2705 goto done;
2706 }
2707 j++;
2708 /*
2709 * compute the default netmask from the address, if necessary
2710 */
2711 if ((maskstr = strchr(tmp, '/')) == NULL) {
2712 int prefixlen;
2713
2714 if (lifr.lifr_addr.ss_family == AF_INET) {
2715 prefixlen = ipv4_prefixlen(
2716 SIN(&lifr.lifr_addr));
2717 } else {
2718 struct sockaddr_in6 *sin6;
2719
2720 sin6 = SIN6(&lifr.lifr_addr);
2721 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2722 prefixlen = 10;
2723 else
2724 prefixlen = 64;
2725 }
2726 (void) snprintf(tmp, sizeof (tmp), "%d", prefixlen);
2727 maskstr = tmp;
2728 } else {
2729 maskstr++;
2730 }
2731 /* append the "/<netmask>" */
2732 (void) strlcat(cp, "/", cpleft);
2733 (void) strlcat(cp, maskstr, cpleft);
2734 (void) strlcat(cp, ",", cpleft);
2735 cp += strnlen(cp, zlen);
2736 cpleft = &zaddr[INET6_ADDRSTRLEN] - cp;
2737 }
2738 naddr = j; /* the actual number of addresses in the net resource */
2739 assert(naddr <= nnet);
2740
2741 /*
2742 * zonecfg has already verified that the defrouter property can only
2743 * be set if there is at least one address defined for the net resource.
2744 * If j is 0, there are no addresses defined, and therefore no routers
2745 * to configure, and we are done at that point.
2746 */
2747 if (j == 0)
2748 goto done;
2749
2750 /* over-write last ',' with '\0' */
2751 zaddr[strnlen(zaddr, zlen) - 1] = '\0';
2752
2753 /*
2754 * First make sure L3 protection is not already set on the link.
2755 */
2756 dlstatus = dladm_linkprop_is_set(dld_handle, linkid, DLADM_OPT_ACTIVE,
2757 "protection", &is_set);
2758 if (dlstatus != DLADM_STATUS_OK) {
2759 err = EINVAL;
2760 zerror(zlogp, B_FALSE, "unable to check if protection is set");
2761 goto done;
2762 }
2763 if (is_set) {
2764 err = EINVAL;
2765 zerror(zlogp, B_FALSE, "Protection is already set");
2766 goto done;
2767 }
2768 dlstatus = dladm_linkprop_is_set(dld_handle, linkid, DLADM_OPT_ACTIVE,
2769 "allowed-ips", &is_set);
2770 if (dlstatus != DLADM_STATUS_OK) {
2771 err = EINVAL;
2772 zerror(zlogp, B_FALSE, "unable to check if allowed-ips is set");
2773 goto done;
2774 }
2775 if (is_set) {
2776 zerror(zlogp, B_FALSE, "allowed-ips is already set");
2777 err = EINVAL;
2778 goto done;
2779 }
2780
2781 /*
2782 * Enable ip-nospoof for the link, and add address to the allowed-ips
2783 * list.
2784 */
2785 dlstatus = dladm_set_linkprop(dld_handle, linkid, "protection",
2786 &ip_nospoof, 1, DLADM_OPT_ACTIVE);
2787 if (dlstatus != DLADM_STATUS_OK) {
2788 zerror(zlogp, B_FALSE, "could not set protection\n");
2789 err = EINVAL;
2790 goto done;
2791 }
2792 dlstatus = dladm_set_linkprop(dld_handle, linkid, "allowed-ips",
2793 astr, naddr, DLADM_OPT_ACTIVE);
2794 if (dlstatus != DLADM_STATUS_OK) {
2795 zerror(zlogp, B_FALSE, "could not set allowed-ips\n");
2796 err = EINVAL;
2797 goto done;
2798 }
2799
2800 /* now set the address in the data-store */
2801 err = zone_setattr_network(ZONE_NETWORK_ADDRESS, zoneid, linkid,
2802 zaddr, strnlen(zaddr, zlen) + 1);
2803 if (err != 0)
2804 goto done;
2805
2806 /*
2807 * add the defaultrouters
2808 */
2809 routes = calloc(1, nnet * sizeof (*routes));
2810 j = 0;
2811 for (ptr = start; ptr != end; ptr = ptr->za_next) {
2812 address = ptr->za_nwiftab.zone_nwif_defrouter;
2813 if (address[0] == '\0')
2814 continue;
2815 if (strchr(address, '/') == NULL && strchr(address, ':') != 0) {
2816 /*
2817 * zonecfg_valid_net_address() expects numeric IPv6
2818 * addresses to have a CIDR format netmask.
2819 */
2820 (void) snprintf(tmp, sizeof (tmp), "/%d", V6_ADDR_LEN);
2821 (void) strlcat(address, tmp, INET6_ADDRSTRLEN);
2822 }
2823 if (zonecfg_valid_net_address(address, &lifr) != Z_OK) {
2824 zerror(zlogp, B_FALSE,
2825 "invalid router [%s]\n", address);
2826 err = EINVAL;
2827 goto done;
2828 }
2829 if (lifr.lifr_addr.ss_family == AF_INET6) {
2830 routes[j] = SIN6(&lifr.lifr_addr)->sin6_addr;
2831 } else {
2832 IN6_INADDR_TO_V4MAPPED(&SIN(&lifr.lifr_addr)->sin_addr,
2833 &routes[j]);
2834 }
2835 j++;
2836 }
2837 assert(j <= nnet);
2838 if (j > 0) {
2839 err = zone_setattr_network(ZONE_NETWORK_DEFROUTER, zoneid,
2840 linkid, routes, j * sizeof (*routes));
2841 }
2842 done:
2843 free(routes);
2844 for (j = 0; j < naddr; j++)
2845 free(astr[j]);
2846 free(astr);
2847 free(zaddr);
2848 return (err);
2849
2850 }
2851
2852 static int
2853 add_net(zlog_t *zlogp, zoneid_t zoneid, zone_addr_list_t *zalist)
2854 {
2855 zone_addr_list_t *ptr;
2856 datalink_id_t linkid;
2857 int err;
2858
2859 if (zalist == NULL)
2860 return (0);
2861
2862 linkid = zalist->za_linkid;
2863
2864 err = add_net_for_linkid(zlogp, zoneid, zalist);
2865 if (err != 0)
2866 return (err);
2867
2868 for (ptr = zalist; ptr != NULL; ptr = ptr->za_next) {
2869 if (ptr->za_linkid == linkid)
2870 continue;
2871 linkid = ptr->za_linkid;
2872 err = add_net_for_linkid(zlogp, zoneid, ptr);
2873 if (err != 0)
2874 return (err);
2875 }
2876 return (0);
2877 }
2878
2879 /*
2880 * Add "new" to the list of network interfaces to be configured by
2881 * add_net on zone boot in "old". The list of interfaces in "old" is
2882 * sorted by datalink_id_t, with interfaces sorted FIFO for a given
2883 * datalink_id_t.
2884 *
2885 * Returns the merged list of IP interfaces containing "old" and "new"
2886 */
2887 static zone_addr_list_t *
2888 add_ip_interface(zone_addr_list_t *old, zone_addr_list_t *new)
2889 {
2890 zone_addr_list_t *ptr, *next;
2891 datalink_id_t linkid = new->za_linkid;
2892
2893 assert(old != new);
2894
2895 if (old == NULL)
2896 return (new);
2897 for (ptr = old; ptr != NULL; ptr = ptr->za_next) {
2898 if (ptr->za_linkid == linkid)
2899 break;
2900 }
2901 if (ptr == NULL) {
2902 /* linkid does not already exist, add to the beginning */
2903 new->za_next = old;
2904 return (new);
2905 }
2906 /*
2907 * adding to the middle of the list; ptr points at the first
2908 * occurrence of linkid. Find the last occurrence.
2909 */
2910 while ((next = ptr->za_next) != NULL) {
2911 if (next->za_linkid != linkid)
2912 break;
2913 ptr = next;
2914 }
2915 /* insert new after ptr */
2916 new->za_next = next;
2917 ptr->za_next = new;
2918 return (old);
2919 }
2920
2921 void
2922 free_ip_interface(zone_addr_list_t *zalist)
2923 {
2924 zone_addr_list_t *ptr, *new;
2925
2926 for (ptr = zalist; ptr != NULL;) {
2927 new = ptr;
2928 ptr = ptr->za_next;
2929 free(new);
2930 }
2931 }
2932
2933 /*
2934 * Add the kernel access control information for the interface names.
2935 * If anything goes wrong, we log a general error message, attempt to tear down
2936 * whatever we set up, and return an error.
2937 */
2938 static int
2939 configure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
2940 {
2941 struct zone_nwiftab nwiftab;
2942 char rootpath[MAXPATHLEN];
2943 char path[MAXPATHLEN];
2944 datalink_id_t linkid;
2945 di_prof_t prof = NULL;
2946 boolean_t added = B_FALSE;
2947 zone_addr_list_t *zalist = NULL, *new;
2948
2949 if (zonecfg_setnwifent(snap_hndl) != Z_OK)
2950 return (0);
2951
2952 for (;;) {
2953 if (zonecfg_getnwifent(snap_hndl, &nwiftab) != Z_OK)
2954 break;
2955
2956 nwifent_free_attrs(&nwiftab);
2957 if (prof == NULL) {
2958 if (zone_get_devroot(zone_name, rootpath,
2959 sizeof (rootpath)) != Z_OK) {
2960 (void) zonecfg_endnwifent(snap_hndl);
2961 zerror(zlogp, B_TRUE,
2962 "unable to determine dev root");
2963 return (-1);
2964 }
2965 (void) snprintf(path, sizeof (path), "%s%s", rootpath,
2966 "/dev");
2967 if (di_prof_init(path, &prof) != 0) {
2968 (void) zonecfg_endnwifent(snap_hndl);
2969 zerror(zlogp, B_TRUE,
2970 "failed to initialize profile");
2971 return (-1);
2972 }
2973 }
2974
2975 /*
2976 * Create the /dev entry for backward compatibility.
2977 * Only create the /dev entry if it's not in use.
2978 * Note that the zone still boots when the assigned
2979 * interface is inaccessible, used by others, etc.
2980 * Also, when vanity naming is used, some interface do
2981 * do not have corresponding /dev node names (for example,
2982 * vanity named aggregations). The /dev entry is not
2983 * created in that case. The /dev/net entry is always
2984 * accessible.
2985 */
2986 if (dladm_name2info(dld_handle, nwiftab.zone_nwif_physical,
2987 &linkid, NULL, NULL, NULL) == DLADM_STATUS_OK &&
2988 add_datalink(zlogp, zone_name, linkid,
2989 nwiftab.zone_nwif_physical) == 0) {
2990 added = B_TRUE;
2991 } else {
2992 /*
2993 * Failed to add network device, but the brand hook
2994 * might be doing this for us, so keep silent.
2995 */
2996 continue;
2997 }
2998 /* set up the new IP interface, and add them all later */
2999 new = malloc(sizeof (*new));
3000 if (new == NULL) {
3001 zerror(zlogp, B_TRUE, "no memory for %s",
3002 nwiftab.zone_nwif_physical);
3003 free_ip_interface(zalist);
3004 }
3005 bzero(new, sizeof (*new));
3006 new->za_nwiftab = nwiftab;
3007 new->za_linkid = linkid;
3008 zalist = add_ip_interface(zalist, new);
3009 }
3010 if (zalist != NULL) {
3011 if ((errno = add_net(zlogp, zoneid, zalist)) != 0) {
3012 (void) zonecfg_endnwifent(snap_hndl);
3013 zerror(zlogp, B_TRUE, "failed to add address");
3014 free_ip_interface(zalist);
3015 return (-1);
3016 }
3017 free_ip_interface(zalist);
3018 }
3019 (void) zonecfg_endnwifent(snap_hndl);
3020
3021 if (prof != NULL && added) {
3022 if (di_prof_commit(prof) != 0) {
3023 zerror(zlogp, B_TRUE, "failed to commit profile");
3024 return (-1);
3025 }
3026 }
3027 if (prof != NULL)
3028 di_prof_fini(prof);
3029
3030 return (0);
3031 }
3032
3033 /*
3034 * Retrieve the list of datalink IDs assigned to a zone.
3035 *
3036 * On return, *count will be updated with the total number of links and, if it
3037 * is not NULL, **linksp will be updated to point to allocated memory
3038 * containing the link IDs. This should be passed to free() when the caller is
3039 * finished with it.
3040 */
3041 static int
3042 fetch_zone_datalinks(zlog_t *zlogp, zoneid_t zoneid, int *countp,
3043 datalink_id_t **linksp)
3044 {
3045 datalink_id_t *links = NULL;
3046 int links_size = 0;
3047 int num_links;
3048
3049 if (linksp != NULL)
3050 *linksp = NULL;
3051 *countp = 0;
3052
3053 num_links = 0;
3054 if (zone_list_datalink(zoneid, &num_links, NULL) != 0) {
3055 zerror(zlogp, B_TRUE,
3056 "unable to determine number of network interfaces");
3057 return (-1);
3058 }
3059
3060 if (num_links == 0)
3061 return (0);
3062
3063 /* If linkp is NULL, the caller only wants the count. */
3064 if (linksp == NULL) {
3065 *countp = num_links;
3066 return (0);
3067 }
3068
3069 do {
3070 datalink_id_t *p;
3071
3072 links_size = num_links;
3073 p = reallocarray(links, links_size, sizeof (datalink_id_t));
3074
3075 if (p == NULL) {
3076 zerror(zlogp, B_TRUE,
3077 "failed to allocate memory for zone links");
3078 free(links);
3079 return (-1);
3080 }
3081 links = p;
3082
3083 if (zone_list_datalink(zoneid, &num_links, links) != 0) {
3084 zerror(zlogp, B_TRUE, "failed to list zone links");
3085 free(links);
3086 return (-1);
3087 }
3088 } while (links_size < num_links);
3089
3090 *countp = num_links;
3091 *linksp = links;
3092
3093 return (0);
3094 }
3095
3096 static int
3097 remove_datalink_pool(zlog_t *zlogp, zoneid_t zoneid)
3098 {
3099 ushort_t flags;
3100 zone_iptype_t iptype;
3101 int i;
3102 dladm_status_t err;
3103
3104 if (strlen(pool_name) == 0)
3105 return (0);
3106
3107 if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
3108 sizeof (flags)) < 0) {
3109 if (vplat_get_iptype(zlogp, &iptype) < 0) {
3110 zerror(zlogp, B_FALSE, "unable to determine ip-type");
3111 return (-1);
3112 }
3113 } else {
3114 if (flags & ZF_NET_EXCL)
3115 iptype = ZS_EXCLUSIVE;
3116 else
3117 iptype = ZS_SHARED;
3118 }
3119
3120 if (iptype == ZS_EXCLUSIVE) {
3121 datalink_id_t *dllinks = NULL;
3122 int dlnum = 0;
3123
3124 if (fetch_zone_datalinks(zlogp, zoneid, &dlnum, &dllinks) != 0)
3125 return (-1);
3126
3127 bzero(pool_name, sizeof (pool_name));
3128 for (i = 0; i < dlnum; i++) {
3129 err = dladm_set_linkprop(dld_handle, dllinks[i], "pool",
3130 NULL, 0, DLADM_OPT_ACTIVE);
3131 if (err != DLADM_STATUS_OK) {
3132 zerror(zlogp, B_TRUE,
3133 "WARNING: unable to clear pool");
3134 }
3135 }
3136 free(dllinks);
3137 }
3138 return (0);
3139 }
3140
3141 static int
3142 remove_datalink_protect(zlog_t *zlogp, zoneid_t zoneid)
3143 {
3144 ushort_t flags;
3145 zone_iptype_t iptype;
3146 int i, dlnum = 0;
3147 dladm_status_t dlstatus;
3148 datalink_id_t *dllinks = NULL;
3149
3150 if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
3151 sizeof (flags)) < 0) {
3152 if (vplat_get_iptype(zlogp, &iptype) < 0) {
3153 zerror(zlogp, B_FALSE, "unable to determine ip-type");
3154 return (-1);
3155 }
3156 } else {
3157 if (flags & ZF_NET_EXCL)
3158 iptype = ZS_EXCLUSIVE;
3159 else
3160 iptype = ZS_SHARED;
3161 }
3162
3163 if (iptype != ZS_EXCLUSIVE)
3164 return (0);
3165
3166 /*
3167 * Get the datalink count and for each datalink, attempt to clear the
3168 * protection and allowed_ips properties.
3169 */
3170
3171 if (fetch_zone_datalinks(zlogp, zoneid, &dlnum, &dllinks) != 0)
3172 return (-1);
3173
3174 for (i = 0; i < dlnum; i++) {
3175 char dlerr[DLADM_STRSIZE];
3176
3177 dlstatus = dladm_set_linkprop(dld_handle, dllinks[i],
3178 "protection", NULL, 0, DLADM_OPT_ACTIVE);
3179 if (dlstatus == DLADM_STATUS_NOTFOUND) {
3180 /* datalink does not belong to the GZ */
3181 continue;
3182 }
3183 if (dlstatus != DLADM_STATUS_OK) {
3184 zerror(zlogp, B_FALSE,
3185 "clear link %d 'protection' link property: %s",
3186 dllinks[i], dladm_status2str(dlstatus, dlerr));
3187 }
3188
3189 dlstatus = dladm_set_linkprop(dld_handle, dllinks[i],
3190 "allowed-ips", NULL, 0, DLADM_OPT_ACTIVE);
3191 if (dlstatus != DLADM_STATUS_OK) {
3192 zerror(zlogp, B_FALSE,
3193 "clear link %d 'allowed-ips' link property: %s",
3194 dllinks[i], dladm_status2str(dlstatus, dlerr));
3195 }
3196 }
3197 free(dllinks);
3198 return (0);
3199 }
3200
3201 static int
3202 unconfigure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
3203 {
3204 datalink_id_t *dllinks;
3205 int dlnum = 0;
3206 uint_t i;
3207
3208 /*
3209 * The kernel shutdown callback for the dls module should have removed
3210 * all datalinks from this zone. If any remain, then there's a
3211 * problem.
3212 */
3213
3214 if (fetch_zone_datalinks(zlogp, zoneid, &dlnum, &dllinks) != 0)
3215 return (-1);
3216
3217 if (dlnum == 0)
3218 return (0);
3219
3220 /*
3221 * There are some datalinks left in the zone. The most likely cause of
3222 * this is that the datalink-management daemon (dlmgmtd) was not
3223 * running when the zone was shut down. That prevented the kernel from
3224 * doing the required upcall to move the links back to the GZ. To
3225 * attempt recovery, do that now.
3226 */
3227
3228 for (i = 0; i < dlnum; i++) {
3229 char dlerr[DLADM_STRSIZE];
3230 dladm_status_t status;
3231 uint32_t link_flags;
3232 datalink_id_t link = dllinks[i];
3233 char *prop_vals[] = { GLOBAL_ZONENAME };
3234
3235 status = dladm_datalink_id2info(dld_handle, link,
3236 &link_flags, NULL, NULL, NULL, 0);
3237
3238 if (status != DLADM_STATUS_OK) {
3239 zerror(zlogp, B_FALSE,
3240 "failed to get link info for %u: %s",
3241 link, dladm_status2str(status, dlerr));
3242 continue;
3243 }
3244
3245 if (link_flags & DLADM_OPT_TRANSIENT)
3246 continue;
3247
3248 status = dladm_set_linkprop(dld_handle, link, "zone",
3249 prop_vals, 1, DLADM_OPT_ACTIVE);
3250
3251 if (status != DLADM_STATUS_OK) {
3252 zerror(zlogp, B_FALSE,
3253 "failed to move link %u to GZ: %s",
3254 link, dladm_status2str(status, dlerr));
3255 }
3256 }
3257
3258 free(dllinks);
3259
3260 /* Check again and log a message if links remain */
3261
3262 if (fetch_zone_datalinks(zlogp, zoneid, &dlnum, NULL) != 0)
3263 return (-1);
3264
3265 if (dlnum == 0)
3266 return (0);
3267
3268 zerror(zlogp, B_FALSE, "%d datalink(s) remain in zone after shutdown",
3269 dlnum);
3270
3271 return (-1);
3272 }
3273
3274 static int
3275 tcp_abort_conn(zlog_t *zlogp, zoneid_t zoneid,
3276 const struct sockaddr_storage *local, const struct sockaddr_storage *remote)
3277 {
3278 int fd;
3279 struct strioctl ioc;
3280 tcp_ioc_abort_conn_t conn;
3281 int error;
3282
3283 conn.ac_local = *local;
3284 conn.ac_remote = *remote;
3285 conn.ac_start = TCPS_SYN_SENT;
3286 conn.ac_end = TCPS_TIME_WAIT;
3287 conn.ac_zoneid = zoneid;
3288
3289 ioc.ic_cmd = TCP_IOC_ABORT_CONN;
3290 ioc.ic_timout = -1; /* infinite timeout */
3291 ioc.ic_len = sizeof (conn);
3292 ioc.ic_dp = (char *)&conn;
3293
3294 if ((fd = open("/dev/tcp", O_RDONLY)) < 0) {
3295 zerror(zlogp, B_TRUE, "unable to open %s", "/dev/tcp");
3296 return (-1);
3297 }
3298
3299 error = ioctl(fd, I_STR, &ioc);
3300 (void) close(fd);
3301 if (error == 0 || errno == ENOENT) /* ENOENT is not an error */
3302 return (0);
3303 return (-1);
3304 }
3305
3306 static int
3307 tcp_abort_connections(zlog_t *zlogp, zoneid_t zoneid)
3308 {
3309 struct sockaddr_storage l, r;
3310 struct sockaddr_in *local, *remote;
3311 struct sockaddr_in6 *local6, *remote6;
3312 int error;
3313
3314 /*
3315 * Abort IPv4 connections.
3316 */
3317 bzero(&l, sizeof (*local));
3318 local = (struct sockaddr_in *)&l;
3319 local->sin_family = AF_INET;
3320 local->sin_addr.s_addr = INADDR_ANY;
3321 local->sin_port = 0;
3322
3323 bzero(&r, sizeof (*remote));
3324 remote = (struct sockaddr_in *)&r;
3325 remote->sin_family = AF_INET;
3326 remote->sin_addr.s_addr = INADDR_ANY;
3327 remote->sin_port = 0;
3328
3329 if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
3330 return (error);
3331
3332 /*
3333 * Abort IPv6 connections.
3334 */
3335 bzero(&l, sizeof (*local6));
3336 local6 = (struct sockaddr_in6 *)&l;
3337 local6->sin6_family = AF_INET6;
3338 local6->sin6_port = 0;
3339 local6->sin6_addr = in6addr_any;
3340
3341 bzero(&r, sizeof (*remote6));
3342 remote6 = (struct sockaddr_in6 *)&r;
3343 remote6->sin6_family = AF_INET6;
3344 remote6->sin6_port = 0;
3345 remote6->sin6_addr = in6addr_any;
3346
3347 if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
3348 return (error);
3349 return (0);
3350 }
3351
3352 static int
3353 get_privset(zlog_t *zlogp, priv_set_t *privs, zone_mnt_t mount_cmd)
3354 {
3355 int error = -1;
3356 char *privname = NULL;
3357
3358 if (ALT_MOUNT(mount_cmd)) {
3359 zone_iptype_t iptype;
3360 const char *curr_iptype = NULL;
3361
3362 if (zonecfg_get_iptype(snap_hndl, &iptype) != Z_OK) {
3363 zerror(zlogp, B_TRUE, "unable to determine ip-type");
3364 return (-1);
3365 }
3366
3367 switch (iptype) {
3368 case ZS_SHARED:
3369 curr_iptype = "shared";
3370 break;
3371 case ZS_EXCLUSIVE:
3372 curr_iptype = "exclusive";
3373 break;
3374 default:
3375 zerror(zlogp, B_FALSE, "bad ip-type");
3376 return (-1);
3377 }
3378
3379 if (zonecfg_default_privset(privs, curr_iptype) == Z_OK)
3380 return (0);
3381
3382 zerror(zlogp, B_FALSE,
3383 "failed to determine the zone's default privilege set");
3384 return (-1);
3385 }
3386
3387 switch (zonecfg_get_privset(snap_hndl, privs, &privname)) {
3388 case Z_OK:
3389 error = 0;
3390 break;
3391 case Z_PRIV_PROHIBITED:
3392 zerror(zlogp, B_FALSE, "privilege \"%s\" is not permitted "
3393 "within the zone's privilege set", privname);
3394 break;
3395 case Z_PRIV_REQUIRED:
3396 zerror(zlogp, B_FALSE, "required privilege \"%s\" is missing "
3397 "from the zone's privilege set", privname);
3398 break;
3399 case Z_PRIV_UNKNOWN:
3400 zerror(zlogp, B_FALSE, "unknown privilege \"%s\" specified "
3401 "in the zone's privilege set", privname);
3402 break;
3403 default:
3404 zerror(zlogp, B_FALSE, "failed to determine the zone's "
3405 "privilege set");
3406 break;
3407 }
3408
3409 free(privname);
3410 return (error);
3411 }
3412
3413 static char *
3414 zone_proj_rctl(const char *name)
3415 {
3416 int i;
3417
3418 for (i = 0; zone_proj_rctl_map[i].zpr_zone_rctl != NULL; i++) {
3419 if (strcmp(name, zone_proj_rctl_map[i].zpr_zone_rctl) == 0) {
3420 return (zone_proj_rctl_map[i].zpr_project_rctl);
3421 }
3422 }
3423 return (NULL);
3424 }
3425
3426 static int
3427 get_rctls(zlog_t *zlogp, char **bufp, size_t *bufsizep)
3428 {
3429 nvlist_t *nvl = NULL;
3430 char *nvl_packed = NULL;
3431 size_t nvl_size = 0;
3432 nvlist_t **nvlv = NULL;
3433 int rctlcount = 0;
3434 int error = -1;
3435 struct zone_rctltab rctltab;
3436 rctlblk_t *rctlblk = NULL;
3437 uint64_t maxlwps;
3438 uint64_t maxprocs;
3439 int rproc, rlwp;
3440
3441 *bufp = NULL;
3442 *bufsizep = 0;
3443
3444 rctltab.zone_rctl_valptr = NULL;
3445 if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0) {
3446 zerror(zlogp, B_TRUE, "%s failed", "nvlist_alloc");
3447 goto out;
3448 }
3449
3450 /*
3451 * Allow the administrator to control both the maximum number of
3452 * process table slots, and the maximum number of lwps, with a single
3453 * max-processes or max-lwps property. If only the max-processes
3454 * property is set, we add a max-lwps property with a limit derived
3455 * from max-processes. If only the max-lwps property is set, we add a
3456 * max-processes property with the same limit as max-lwps.
3457 */
3458 rproc = zonecfg_get_aliased_rctl(snap_hndl, ALIAS_MAXPROCS, &maxprocs);
3459 rlwp = zonecfg_get_aliased_rctl(snap_hndl, ALIAS_MAXLWPS, &maxlwps);
3460 if (rproc == Z_OK && rlwp == Z_NO_ENTRY) {
3461 if (zonecfg_set_aliased_rctl(snap_hndl, ALIAS_MAXLWPS,
3462 maxprocs * LWPS_PER_PROCESS) != Z_OK) {
3463 zerror(zlogp, B_FALSE, "unable to set max-lwps alias");
3464 goto out;
3465 }
3466 } else if (rlwp == Z_OK && rproc == Z_NO_ENTRY) {
3467 /* no scaling for max-proc value */
3468 if (zonecfg_set_aliased_rctl(snap_hndl, ALIAS_MAXPROCS,
3469 maxlwps) != Z_OK) {
3470 zerror(zlogp, B_FALSE,
3471 "unable to set max-processes alias");
3472 goto out;
3473 }
3474 }
3475
3476 if (zonecfg_setrctlent(snap_hndl) != Z_OK) {
3477 zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setrctlent");
3478 goto out;
3479 }
3480
3481 if ((rctlblk = malloc(rctlblk_size())) == NULL) {
3482 zerror(zlogp, B_TRUE, "memory allocation failed");
3483 goto out;
3484 }
3485 while (zonecfg_getrctlent(snap_hndl, &rctltab) == Z_OK) {
3486 struct zone_rctlvaltab *rctlval;
3487 uint_t i, count;
3488 const char *name = rctltab.zone_rctl_name;
3489 char *proj_nm;
3490
3491 /* zoneadm should have already warned about unknown rctls. */
3492 if (!zonecfg_is_rctl(name)) {
3493 zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3494 rctltab.zone_rctl_valptr = NULL;
3495 continue;
3496 }
3497 count = 0;
3498 for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
3499 rctlval = rctlval->zone_rctlval_next) {
3500 count++;
3501 }
3502 if (count == 0) { /* ignore */
3503 continue; /* Nothing to free */
3504 }
3505 if ((nvlv = malloc(sizeof (*nvlv) * count)) == NULL)
3506 goto out;
3507 i = 0;
3508 for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
3509 rctlval = rctlval->zone_rctlval_next, i++) {
3510 if (nvlist_alloc(&nvlv[i], NV_UNIQUE_NAME, 0) != 0) {
3511 zerror(zlogp, B_TRUE, "%s failed",
3512 "nvlist_alloc");
3513 goto out;
3514 }
3515 if (zonecfg_construct_rctlblk(rctlval, rctlblk)
3516 != Z_OK) {
3517 zerror(zlogp, B_FALSE, "invalid rctl value: "
3518 "(priv=%s,limit=%s,action=%s)",
3519 rctlval->zone_rctlval_priv,
3520 rctlval->zone_rctlval_limit,
3521 rctlval->zone_rctlval_action);
3522 goto out;
3523 }
3524 if (!zonecfg_valid_rctl(name, rctlblk)) {
3525 zerror(zlogp, B_FALSE,
3526 "(priv=%s,limit=%s,action=%s) is not a "
3527 "valid value for rctl '%s'",
3528 rctlval->zone_rctlval_priv,
3529 rctlval->zone_rctlval_limit,
3530 rctlval->zone_rctlval_action,
3531 name);
3532 goto out;
3533 }
3534 if (nvlist_add_uint64(nvlv[i], "privilege",
3535 rctlblk_get_privilege(rctlblk)) != 0) {
3536 zerror(zlogp, B_FALSE, "%s failed",
3537 "nvlist_add_uint64");
3538 goto out;
3539 }
3540 if (nvlist_add_uint64(nvlv[i], "limit",
3541 rctlblk_get_value(rctlblk)) != 0) {
3542 zerror(zlogp, B_FALSE, "%s failed",
3543 "nvlist_add_uint64");
3544 goto out;
3545 }
3546 if (nvlist_add_uint64(nvlv[i], "action",
3547 (uint_t)rctlblk_get_local_action(rctlblk, NULL))
3548 != 0) {
3549 zerror(zlogp, B_FALSE, "%s failed",
3550 "nvlist_add_uint64");
3551 goto out;
3552 }
3553 }
3554 zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3555 rctltab.zone_rctl_valptr = NULL;
3556
3557 /*
3558 * With no action on our part we will start zsched with the
3559 * project rctl values for our (zoneadmd) current project. For
3560 * brands running a variant of Illumos, that's not a problem
3561 * since they will setup their own projects, but for a
3562 * non-native brand like lx, where there are no projects, we
3563 * want to start things up with the same project rctls as the
3564 * corresponding zone rctls, since nothing within the zone will
3565 * ever change the project rctls.
3566 */
3567 if ((proj_nm = zone_proj_rctl(name)) != NULL) {
3568 if (nvlist_add_nvlist_array(nvl, proj_nm, nvlv, count)
3569 != 0) {
3570 zerror(zlogp, B_FALSE,
3571 "nvlist_add_nvlist_arrays failed");
3572 goto out;
3573 }
3574 }
3575
3576 if (nvlist_add_nvlist_array(nvl, (char *)name, nvlv, count)
3577 != 0) {
3578 zerror(zlogp, B_FALSE, "%s failed",
3579 "nvlist_add_nvlist_array");
3580 goto out;
3581 }
3582 for (i = 0; i < count; i++)
3583 nvlist_free(nvlv[i]);
3584 free(nvlv);
3585 nvlv = NULL;
3586 rctlcount++;
3587 }
3588 (void) zonecfg_endrctlent(snap_hndl);
3589
3590 if (rctlcount == 0) {
3591 error = 0;
3592 goto out;
3593 }
3594 if (nvlist_pack(nvl, &nvl_packed, &nvl_size, NV_ENCODE_NATIVE, 0)
3595 != 0) {
3596 zerror(zlogp, B_FALSE, "%s failed", "nvlist_pack");
3597 goto out;
3598 }
3599
3600 error = 0;
3601 *bufp = nvl_packed;
3602 *bufsizep = nvl_size;
3603
3604 out:
3605 free(rctlblk);
3606 zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3607 if (error && nvl_packed != NULL)
3608 free(nvl_packed);
3609 nvlist_free(nvl);
3610 if (nvlv != NULL)
3611 free(nvlv);
3612 return (error);
3613 }
3614
3615 static int
3616 get_implicit_datasets(zlog_t *zlogp, char **retstr)
3617 {
3618 char cmdbuf[2 * MAXPATHLEN];
3619
3620 if (query_hook[0] == '\0')
3621 return (0);
3622
3623 if (snprintf(cmdbuf, sizeof (cmdbuf), "%s datasets", query_hook)
3624 > sizeof (cmdbuf))
3625 return (-1);
3626
3627 if (do_subproc(zlogp, cmdbuf, retstr, B_FALSE) != 0)
3628 return (-1);
3629
3630 return (0);
3631 }
3632
3633 static int
3634 get_datasets(zlog_t *zlogp, char **bufp, size_t *bufsizep)
3635 {
3636 struct zone_dstab dstab;
3637 size_t total, offset, len;
3638 int error = -1;
3639 char *str = NULL;
3640 char *implicit_datasets = NULL;
3641 int implicit_len = 0;
3642
3643 *bufp = NULL;
3644 *bufsizep = 0;
3645
3646 if (get_implicit_datasets(zlogp, &implicit_datasets) != 0) {
3647 zerror(zlogp, B_FALSE, "getting implicit datasets failed");
3648 goto out;
3649 }
3650
3651 if (zonecfg_setdsent(snap_hndl) != Z_OK) {
3652 zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
3653 goto out;
3654 }
3655
3656 total = 0;
3657 while (zonecfg_getdsent(snap_hndl, &dstab) == Z_OK)
3658 total += strlen(dstab.zone_dataset_name) + 1;
3659 (void) zonecfg_enddsent(snap_hndl);
3660
3661 if (implicit_datasets != NULL)
3662 implicit_len = strlen(implicit_datasets);
3663 if (implicit_len > 0)
3664 total += implicit_len + 1;
3665
3666 if (total == 0) {
3667 error = 0;
3668 goto out;
3669 }
3670
3671 if ((str = malloc(total)) == NULL) {
3672 zerror(zlogp, B_TRUE, "memory allocation failed");
3673 goto out;
3674 }
3675
3676 if (zonecfg_setdsent(snap_hndl) != Z_OK) {
3677 zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
3678 goto out;
3679 }
3680 offset = 0;
3681 while (zonecfg_getdsent(snap_hndl, &dstab) == Z_OK) {
3682 len = strlen(dstab.zone_dataset_name);
3683 (void) strlcpy(str + offset, dstab.zone_dataset_name,
3684 total - offset);
3685 offset += len;
3686 if (offset < total - 1)
3687 str[offset++] = ',';
3688 }
3689 (void) zonecfg_enddsent(snap_hndl);
3690
3691 if (implicit_len > 0)
3692 (void) strlcpy(str + offset, implicit_datasets, total - offset);
3693
3694 error = 0;
3695 *bufp = str;
3696 *bufsizep = total;
3697
3698 out:
3699 if (error != 0 && str != NULL)
3700 free(str);
3701 if (implicit_datasets != NULL)
3702 free(implicit_datasets);
3703
3704 return (error);
3705 }
3706
3707 static int
3708 validate_datasets(zlog_t *zlogp)
3709 {
3710 struct zone_dstab dstab;
3711 zfs_handle_t *zhp;
3712 libzfs_handle_t *hdl;
3713
3714 if (zonecfg_setdsent(snap_hndl) != Z_OK) {
3715 zerror(zlogp, B_FALSE, "invalid configuration");
3716 return (-1);
3717 }
3718
3719 if ((hdl = libzfs_init()) == NULL) {
3720 zerror(zlogp, B_FALSE, "opening ZFS library");
3721 return (-1);
3722 }
3723
3724 while (zonecfg_getdsent(snap_hndl, &dstab) == Z_OK) {
3725
3726 if ((zhp = zfs_open(hdl, dstab.zone_dataset_name,
3727 ZFS_TYPE_FILESYSTEM)) == NULL) {
3728 zerror(zlogp, B_FALSE, "cannot open ZFS dataset '%s'",
3729 dstab.zone_dataset_name);
3730 libzfs_fini(hdl);
3731 return (-1);
3732 }
3733
3734 /*
3735 * Automatically set the 'zoned' property. We check the value
3736 * first because we'll get EPERM if it is already set.
3737 */
3738 if (!zfs_prop_get_int(zhp, ZFS_PROP_ZONED) &&
3739 zfs_prop_set(zhp, zfs_prop_to_name(ZFS_PROP_ZONED),
3740 "on") != 0) {
3741 zerror(zlogp, B_FALSE, "cannot set 'zoned' "
3742 "property for ZFS dataset '%s'\n",
3743 dstab.zone_dataset_name);
3744 zfs_close(zhp);
3745 libzfs_fini(hdl);
3746 return (-1);
3747 }
3748
3749 zfs_close(zhp);
3750 }
3751 (void) zonecfg_enddsent(snap_hndl);
3752
3753 libzfs_fini(hdl);
3754
3755 return (0);
3756 }
3757
3758 /*
3759 * Return true if the path is its own zfs file system. We determine this
3760 * by stat-ing the path to see if it is zfs and stat-ing the parent to see
3761 * if it is a different fs.
3762 */
3763 boolean_t
3764 is_zonepath_zfs(char *zonepath)
3765 {
3766 int res;
3767 char *path;
3768 char *parent;
3769 struct statvfs64 buf1, buf2;
3770
3771 if (statvfs64(zonepath, &buf1) != 0)
3772 return (B_FALSE);
3773
3774 if (strcmp(buf1.f_basetype, "zfs") != 0)
3775 return (B_FALSE);
3776
3777 if ((path = strdup(zonepath)) == NULL)
3778 return (B_FALSE);
3779
3780 parent = dirname(path);
3781 res = statvfs64(parent, &buf2);
3782 free(path);
3783
3784 if (res != 0)
3785 return (B_FALSE);
3786
3787 if (buf1.f_fsid == buf2.f_fsid)
3788 return (B_FALSE);
3789
3790 return (B_TRUE);
3791 }
3792
3793 /*
3794 * Verify the MAC label in the root dataset for the zone.
3795 * If the label exists, it must match the label configured for the zone.
3796 * Otherwise if there's no label on the dataset, create one here.
3797 */
3798
3799 static int
3800 validate_rootds_label(zlog_t *zlogp, char *rootpath, m_label_t *zone_sl)
3801 {
3802 int error = -1;
3803 zfs_handle_t *zhp;
3804 libzfs_handle_t *hdl;
3805 m_label_t ds_sl;
3806 char ds_hexsl[MAXNAMELEN];
3807
3808 if (!is_system_labeled())
3809 return (0);
3810
3811 if (!is_zonepath_zfs(zonepath))
3812 return (0);
3813
3814 if ((hdl = libzfs_init()) == NULL) {
3815 zerror(zlogp, B_FALSE, "opening ZFS library");
3816 return (-1);
3817 }
3818
3819 if ((zhp = zfs_path_to_zhandle(hdl, rootpath,
3820 ZFS_TYPE_FILESYSTEM)) == NULL) {
3821 zerror(zlogp, B_FALSE, "cannot open ZFS dataset for path '%s'",
3822 rootpath);
3823 libzfs_fini(hdl);
3824 return (-1);
3825 }
3826
3827 /* Get the mlslabel property if it exists. */
3828 if ((zfs_prop_get(zhp, ZFS_PROP_MLSLABEL, ds_hexsl, MAXNAMELEN,
3829 NULL, NULL, 0, B_TRUE) != 0) ||
3830 (strcmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) == 0)) {
3831 char *str2 = NULL;
3832
3833 /*
3834 * No label on the dataset (or default only); create one.
3835 * (Only do this automatic labeling for the labeled brand.)
3836 */
3837 if (strcmp(brand_name, LABELED_BRAND_NAME) != 0) {
3838 error = 0;
3839 goto out;
3840 }
3841
3842 error = l_to_str_internal(zone_sl, &str2);
3843 if (error)
3844 goto out;
3845 if (str2 == NULL) {
3846 error = -1;
3847 goto out;
3848 }
3849 if ((error = zfs_prop_set(zhp,
3850 zfs_prop_to_name(ZFS_PROP_MLSLABEL), str2)) != 0) {
3851 zerror(zlogp, B_FALSE, "cannot set 'mlslabel' "
3852 "property for root dataset at '%s'\n", rootpath);
3853 }
3854 free(str2);
3855 goto out;
3856 }
3857
3858 /* Convert the retrieved dataset label to binary form. */
3859 error = hexstr_to_label(ds_hexsl, &ds_sl);
3860 if (error) {
3861 zerror(zlogp, B_FALSE, "invalid 'mlslabel' "
3862 "property on root dataset at '%s'\n", rootpath);
3863 goto out; /* exit with error */
3864 }
3865
3866 /*
3867 * Perform a MAC check by comparing the zone label with the
3868 * dataset label.
3869 */
3870 error = (!blequal(zone_sl, &ds_sl));
3871 if (error)
3872 zerror(zlogp, B_FALSE, "Rootpath dataset has mismatched label");
3873 out:
3874 zfs_close(zhp);
3875 libzfs_fini(hdl);
3876
3877 return (error);
3878 }
3879
3880 /*
3881 * Mount lower level home directories into/from current zone
3882 * Share exported directories specified in dfstab for zone
3883 */
3884 static int
3885 tsol_mounts(zlog_t *zlogp, char *zone_name, char *rootpath)
3886 {
3887 zoneid_t *zids = NULL;
3888 priv_set_t *zid_privs;
3889 const priv_impl_info_t *ip = NULL;
3890 uint_t nzents_saved;
3891 uint_t nzents;
3892 int i;
3893 char readonly[] = "ro";
3894 struct zone_fstab lower_fstab;
3895 char *argv[4];
3896
3897 if (!is_system_labeled())
3898 return (0);
3899
3900 if (zid_label == NULL) {
3901 zid_label = m_label_alloc(MAC_LABEL);
3902 if (zid_label == NULL)
3903 return (-1);
3904 }
3905
3906 /* Make sure our zone has an /export/home dir */
3907 (void) make_one_dir(zlogp, rootpath, "/export/home",
3908 DEFAULT_DIR_MODE, DEFAULT_DIR_USER, DEFAULT_DIR_GROUP);
3909
3910 lower_fstab.zone_fs_raw[0] = '\0';
3911 (void) strlcpy(lower_fstab.zone_fs_type, MNTTYPE_LOFS,
3912 sizeof (lower_fstab.zone_fs_type));
3913 lower_fstab.zone_fs_options = NULL;
3914 (void) zonecfg_add_fs_option(&lower_fstab, readonly);
3915
3916 /*
3917 * Get the list of zones from the kernel
3918 */
3919 if (zone_list(NULL, &nzents) != 0) {
3920 zerror(zlogp, B_TRUE, "unable to list zones");
3921 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3922 return (-1);
3923 }
3924 again:
3925 if (nzents == 0) {
3926 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3927 return (-1);
3928 }
3929
3930 zids = malloc(nzents * sizeof (zoneid_t));
3931 if (zids == NULL) {
3932 zerror(zlogp, B_TRUE, "memory allocation failed");
3933 return (-1);
3934 }
3935 nzents_saved = nzents;
3936
3937 if (zone_list(zids, &nzents) != 0) {
3938 zerror(zlogp, B_TRUE, "unable to list zones");
3939 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3940 free(zids);
3941 return (-1);
3942 }
3943 if (nzents != nzents_saved) {
3944 /* list changed, try again */
3945 free(zids);
3946 goto again;
3947 }
3948
3949 ip = getprivimplinfo();
3950 if ((zid_privs = priv_allocset()) == NULL) {
3951 zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
3952 zonecfg_free_fs_option_list(
3953 lower_fstab.zone_fs_options);
3954 free(zids);
3955 return (-1);
3956 }
3957
3958 for (i = 0; i < nzents; i++) {
3959 char zid_name[ZONENAME_MAX];
3960 zone_state_t zid_state;
3961 char zid_rpath[MAXPATHLEN];
3962 struct stat stat_buf;
3963
3964 if (zids[i] == GLOBAL_ZONEID)
3965 continue;
3966
3967 if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
3968 continue;
3969
3970 /*
3971 * Do special setup for the zone we are booting
3972 */
3973 if (strcmp(zid_name, zone_name) == 0) {
3974 struct zone_fstab autofs_fstab;
3975 char map_path[MAXPATHLEN];
3976 int fd;
3977
3978 /*
3979 * Create auto_home_<zone> map for this zone
3980 * in the global zone. The non-global zone entry
3981 * will be created by automount when the zone
3982 * is booted.
3983 */
3984
3985 (void) snprintf(autofs_fstab.zone_fs_special,
3986 MAXPATHLEN, "auto_home_%s", zid_name);
3987
3988 (void) snprintf(autofs_fstab.zone_fs_dir, MAXPATHLEN,
3989 "/zone/%s/home", zid_name);
3990
3991 (void) snprintf(map_path, sizeof (map_path),
3992 "/etc/%s", autofs_fstab.zone_fs_special);
3993 /*
3994 * If the map file doesn't exist create a template
3995 */
3996 if ((fd = open(map_path, O_RDWR | O_CREAT | O_EXCL,
3997 S_IRUSR | S_IWUSR | S_IRGRP| S_IROTH)) != -1) {
3998 int len;
3999 char map_rec[MAXPATHLEN];
4000
4001 len = snprintf(map_rec, sizeof (map_rec),
4002 "+%s\n*\t-fstype=lofs\t:%s/export/home/&\n",
4003 autofs_fstab.zone_fs_special, rootpath);
4004 (void) write(fd, map_rec, len);
4005 (void) close(fd);
4006 }
4007
4008 /*
4009 * Mount auto_home_<zone> in the global zone if absent.
4010 * If it's already of type autofs, then
4011 * don't mount it again.
4012 */
4013 if ((stat(autofs_fstab.zone_fs_dir, &stat_buf) == -1) ||
4014 strcmp(stat_buf.st_fstype, MNTTYPE_AUTOFS) != 0) {
4015 char optstr[] = "indirect,ignore,nobrowse";
4016
4017 (void) make_one_dir(zlogp, "",
4018 autofs_fstab.zone_fs_dir, DEFAULT_DIR_MODE,
4019 DEFAULT_DIR_USER, DEFAULT_DIR_GROUP);
4020
4021 /*
4022 * Mount will fail if automounter has already
4023 * processed the auto_home_<zonename> map
4024 */
4025 (void) domount(zlogp, MNTTYPE_AUTOFS, optstr,
4026 autofs_fstab.zone_fs_special,
4027 autofs_fstab.zone_fs_dir);
4028 }
4029 continue;
4030 }
4031
4032
4033 if (zone_get_state(zid_name, &zid_state) != Z_OK ||
4034 (zid_state != ZONE_STATE_READY &&
4035 zid_state != ZONE_STATE_RUNNING))
4036 /* Skip over zones without mounted filesystems */
4037 continue;
4038
4039 if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
4040 sizeof (m_label_t)) < 0)
4041 /* Skip over zones with unspecified label */
4042 continue;
4043
4044 if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
4045 sizeof (zid_rpath)) == -1)
4046 /* Skip over zones with bad path */
4047 continue;
4048
4049 if (zone_getattr(zids[i], ZONE_ATTR_PRIVSET, zid_privs,
4050 sizeof (priv_chunk_t) * ip->priv_setsize) == -1)
4051 /* Skip over zones with bad privs */
4052 continue;
4053
4054 /*
4055 * Reading down is valid according to our label model
4056 * but some customers want to disable it because it
4057 * allows execute down and other possible attacks.
4058 * Therefore, we restrict this feature to zones that
4059 * have the NET_MAC_AWARE privilege which is required
4060 * for NFS read-down semantics.
4061 */
4062 if ((bldominates(zlabel, zid_label)) &&
4063 (priv_ismember(zprivs, PRIV_NET_MAC_AWARE))) {
4064 /*
4065 * Our zone dominates this one.
4066 * Create a lofs mount from lower zone's /export/home
4067 */
4068 (void) snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
4069 "%s/zone/%s/export/home", rootpath, zid_name);
4070
4071 /*
4072 * If the target is already an LOFS mount
4073 * then don't do it again.
4074 */
4075 if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
4076 strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
4077
4078 if (snprintf(lower_fstab.zone_fs_special,
4079 MAXPATHLEN, "%s/export",
4080 zid_rpath) > MAXPATHLEN)
4081 continue;
4082
4083 /*
4084 * Make sure the lower-level home exists
4085 */
4086 if (make_one_dir(zlogp,
4087 lower_fstab.zone_fs_special, "/home",
4088 DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
4089 DEFAULT_DIR_GROUP) != 0)
4090 continue;
4091
4092 (void) strlcat(lower_fstab.zone_fs_special,
4093 "/home", MAXPATHLEN);
4094
4095 /*
4096 * Mount can fail because the lower-level
4097 * zone may have already done a mount up.
4098 */
4099 (void) mount_one(zlogp, &lower_fstab, "",
4100 Z_MNT_BOOT);
4101 }
4102 } else if ((bldominates(zid_label, zlabel)) &&
4103 (priv_ismember(zid_privs, PRIV_NET_MAC_AWARE))) {
4104 /*
4105 * This zone dominates our zone.
4106 * Create a lofs mount from our zone's /export/home
4107 */
4108 if (snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
4109 "%s/zone/%s/export/home", zid_rpath,
4110 zone_name) > MAXPATHLEN)
4111 continue;
4112
4113 /*
4114 * If the target is already an LOFS mount
4115 * then don't do it again.
4116 */
4117 if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
4118 strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
4119
4120 (void) snprintf(lower_fstab.zone_fs_special,
4121 MAXPATHLEN, "%s/export/home", rootpath);
4122
4123 /*
4124 * Mount can fail because the higher-level
4125 * zone may have already done a mount down.
4126 */
4127 (void) mount_one(zlogp, &lower_fstab, "",
4128 Z_MNT_BOOT);
4129 }
4130 }
4131 }
4132 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
4133 priv_freeset(zid_privs);
4134 free(zids);
4135
4136 /*
4137 * Now share any exported directories from this zone.
4138 * Each zone can have its own dfstab.
4139 */
4140
4141 argv[0] = "zoneshare";
4142 argv[1] = "-z";
4143 argv[2] = zone_name;
4144 argv[3] = NULL;
4145
4146 (void) forkexec(zlogp, "/usr/lib/zones/zoneshare", argv);
4147 /* Don't check for errors since they don't affect the zone */
4148
4149 return (0);
4150 }
4151
4152 /*
4153 * Unmount lofs mounts from higher level zones
4154 * Unshare nfs exported directories
4155 */
4156 static void
4157 tsol_unmounts(zlog_t *zlogp, char *zone_name)
4158 {
4159 zoneid_t *zids = NULL;
4160 uint_t nzents_saved;
4161 uint_t nzents;
4162 int i;
4163 char *argv[4];
4164 char path[MAXPATHLEN];
4165
4166 if (!is_system_labeled())
4167 return;
4168
4169 /*
4170 * Get the list of zones from the kernel
4171 */
4172 if (zone_list(NULL, &nzents) != 0) {
4173 return;
4174 }
4175
4176 if (zid_label == NULL) {
4177 zid_label = m_label_alloc(MAC_LABEL);
4178 if (zid_label == NULL)
4179 return;
4180 }
4181
4182 again:
4183 if (nzents == 0)
4184 return;
4185
4186 zids = malloc(nzents * sizeof (zoneid_t));
4187 if (zids == NULL) {
4188 zerror(zlogp, B_TRUE, "memory allocation failed");
4189 return;
4190 }
4191 nzents_saved = nzents;
4192
4193 if (zone_list(zids, &nzents) != 0) {
4194 free(zids);
4195 return;
4196 }
4197 if (nzents != nzents_saved) {
4198 /* list changed, try again */
4199 free(zids);
4200 goto again;
4201 }
4202
4203 for (i = 0; i < nzents; i++) {
4204 char zid_name[ZONENAME_MAX];
4205 zone_state_t zid_state;
4206 char zid_rpath[MAXPATHLEN];
4207
4208 if (zids[i] == GLOBAL_ZONEID)
4209 continue;
4210
4211 if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
4212 continue;
4213
4214 /*
4215 * Skip the zone we are halting
4216 */
4217 if (strcmp(zid_name, zone_name) == 0)
4218 continue;
4219
4220 if ((zone_getattr(zids[i], ZONE_ATTR_STATUS, &zid_state,
4221 sizeof (zid_state)) < 0) ||
4222 (zid_state < ZONE_IS_READY))
4223 /* Skip over zones without mounted filesystems */
4224 continue;
4225
4226 if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
4227 sizeof (m_label_t)) < 0)
4228 /* Skip over zones with unspecified label */
4229 continue;
4230
4231 if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
4232 sizeof (zid_rpath)) == -1)
4233 /* Skip over zones with bad path */
4234 continue;
4235
4236 if (zlabel != NULL && bldominates(zid_label, zlabel)) {
4237 /*
4238 * This zone dominates our zone.
4239 * Unmount the lofs mount of our zone's /export/home
4240 */
4241
4242 if (snprintf(path, MAXPATHLEN,
4243 "%s/zone/%s/export/home", zid_rpath,
4244 zone_name) > MAXPATHLEN)
4245 continue;
4246
4247 /* Skip over mount failures */
4248 (void) umount(path);
4249 }
4250 }
4251 free(zids);
4252
4253 /*
4254 * Unmount global zone autofs trigger for this zone
4255 */
4256 (void) snprintf(path, MAXPATHLEN, "/zone/%s/home", zone_name);
4257 /* Skip over mount failures */
4258 (void) umount(path);
4259
4260 /*
4261 * Next unshare any exported directories from this zone.
4262 */
4263
4264 argv[0] = "zoneunshare";
4265 argv[1] = "-z";
4266 argv[2] = zone_name;
4267 argv[3] = NULL;
4268
4269 (void) forkexec(zlogp, "/usr/lib/zones/zoneunshare", argv);
4270 /* Don't check for errors since they don't affect the zone */
4271
4272 /*
4273 * Finally, deallocate any devices in the zone.
4274 */
4275
4276 argv[0] = "deallocate";
4277 argv[1] = "-Isz";
4278 argv[2] = zone_name;
4279 argv[3] = NULL;
4280
4281 (void) forkexec(zlogp, "/usr/sbin/deallocate", argv);
4282 /* Don't check for errors since they don't affect the zone */
4283 }
4284
4285 /*
4286 * Fetch the Trusted Extensions label and multi-level ports (MLPs) for
4287 * this zone.
4288 */
4289 static tsol_zcent_t *
4290 get_zone_label(zlog_t *zlogp, priv_set_t *privs)
4291 {
4292 FILE *fp;
4293 tsol_zcent_t *zcent = NULL;
4294 char line[MAXTNZLEN];
4295
4296 if ((fp = fopen(TNZONECFG_PATH, "r")) == NULL) {
4297 zerror(zlogp, B_TRUE, "%s", TNZONECFG_PATH);
4298 return (NULL);
4299 }
4300
4301 while (fgets(line, sizeof (line), fp) != NULL) {
4302 /*
4303 * Check for malformed database
4304 */
4305 if (strlen(line) == MAXTNZLEN - 1)
4306 break;
4307 if ((zcent = tsol_sgetzcent(line, NULL, NULL)) == NULL)
4308 continue;
4309 if (strcmp(zcent->zc_name, zone_name) == 0)
4310 break;
4311 tsol_freezcent(zcent);
4312 zcent = NULL;
4313 }
4314 (void) fclose(fp);
4315
4316 if (zcent == NULL) {
4317 zerror(zlogp, B_FALSE, "zone requires a label assignment. "
4318 "See tnzonecfg(5)");
4319 } else {
4320 if (zlabel == NULL)
4321 zlabel = m_label_alloc(MAC_LABEL);
4322 /*
4323 * Save this zone's privileges for later read-down processing
4324 */
4325 if ((zprivs = priv_allocset()) == NULL) {
4326 zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
4327 return (NULL);
4328 } else {
4329 priv_copyset(privs, zprivs);
4330 }
4331 }
4332 return (zcent);
4333 }
4334
4335 /*
4336 * Add the Trusted Extensions multi-level ports for this zone.
4337 */
4338 static void
4339 set_mlps(zlog_t *zlogp, zoneid_t zoneid, tsol_zcent_t *zcent)
4340 {
4341 tsol_mlp_t *mlp;
4342 tsol_mlpent_t tsme;
4343
4344 if (!is_system_labeled())
4345 return;
4346
4347 tsme.tsme_zoneid = zoneid;
4348 tsme.tsme_flags = 0;
4349 for (mlp = zcent->zc_private_mlp; !TSOL_MLP_END(mlp); mlp++) {
4350 tsme.tsme_mlp = *mlp;
4351 if (tnmlp(TNDB_LOAD, &tsme) != 0) {
4352 zerror(zlogp, B_TRUE, "cannot set zone-specific MLP "
4353 "on %d-%d/%d", mlp->mlp_port,
4354 mlp->mlp_port_upper, mlp->mlp_ipp);
4355 }
4356 }
4357
4358 tsme.tsme_flags = TSOL_MEF_SHARED;
4359 for (mlp = zcent->zc_shared_mlp; !TSOL_MLP_END(mlp); mlp++) {
4360 tsme.tsme_mlp = *mlp;
4361 if (tnmlp(TNDB_LOAD, &tsme) != 0) {
4362 zerror(zlogp, B_TRUE, "cannot set shared MLP "
4363 "on %d-%d/%d", mlp->mlp_port,
4364 mlp->mlp_port_upper, mlp->mlp_ipp);
4365 }
4366 }
4367 }
4368
4369 static void
4370 remove_mlps(zlog_t *zlogp, zoneid_t zoneid)
4371 {
4372 tsol_mlpent_t tsme;
4373
4374 if (!is_system_labeled())
4375 return;
4376
4377 (void) memset(&tsme, 0, sizeof (tsme));
4378 tsme.tsme_zoneid = zoneid;
4379 if (tnmlp(TNDB_FLUSH, &tsme) != 0)
4380 zerror(zlogp, B_TRUE, "cannot flush MLPs");
4381 }
4382
4383 int
4384 prtmount(const struct mnttab *fs, void *x)
4385 {
4386 zerror((zlog_t *)x, B_FALSE, " %s", fs->mnt_mountp);
4387 return (0);
4388 }
4389
4390 /*
4391 * Look for zones running on the main system that are using this root (or any
4392 * subdirectory of it). Return B_TRUE and print an error if a conflicting zone
4393 * is found or if we can't tell.
4394 */
4395 static boolean_t
4396 duplicate_zone_root(zlog_t *zlogp, const char *rootpath)
4397 {
4398 zoneid_t *zids = NULL;
4399 uint_t nzids = 0;
4400 boolean_t retv;
4401 int rlen, zlen;
4402 char zroot[MAXPATHLEN];
4403 char zonename[ZONENAME_MAX];
4404
4405 for (;;) {
4406 nzids += 10;
4407 zids = malloc(nzids * sizeof (*zids));
4408 if (zids == NULL) {
4409 zerror(zlogp, B_TRUE, "memory allocation failed");
4410 return (B_TRUE);
4411 }
4412 if (zone_list(zids, &nzids) == 0)
4413 break;
4414 free(zids);
4415 }
4416 retv = B_FALSE;
4417 rlen = strlen(rootpath);
4418 while (nzids > 0) {
4419 /*
4420 * Ignore errors; they just mean that the zone has disappeared
4421 * while we were busy.
4422 */
4423 if (zone_getattr(zids[--nzids], ZONE_ATTR_ROOT, zroot,
4424 sizeof (zroot)) == -1)
4425 continue;
4426 zlen = strlen(zroot);
4427 if (zlen > rlen)
4428 zlen = rlen;
4429 if (strncmp(rootpath, zroot, zlen) == 0 &&
4430 (zroot[zlen] == '\0' || zroot[zlen] == '/') &&
4431 (rootpath[zlen] == '\0' || rootpath[zlen] == '/')) {
4432 if (getzonenamebyid(zids[nzids], zonename,
4433 sizeof (zonename)) == -1)
4434 (void) snprintf(zonename, sizeof (zonename),
4435 "id %d", (int)zids[nzids]);
4436 zerror(zlogp, B_FALSE,
4437 "zone root %s already in use by zone %s",
4438 rootpath, zonename);
4439 retv = B_TRUE;
4440 break;
4441 }
4442 }
4443 free(zids);
4444 return (retv);
4445 }
4446
4447 /*
4448 * Search for loopback mounts that use this same source node (same device and
4449 * inode). Return B_TRUE if there is one or if we can't tell.
4450 */
4451 static boolean_t
4452 duplicate_reachable_path(zlog_t *zlogp, const char *rootpath)
4453 {
4454 struct stat64 rst, zst;
4455 struct mnttab *mnp;
4456
4457 if (stat64(rootpath, &rst) == -1) {
4458 zerror(zlogp, B_TRUE, "can't stat %s", rootpath);
4459 return (B_TRUE);
4460 }
4461 if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
4462 return (B_TRUE);
4463 for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max; mnp++) {
4464 if (mnp->mnt_fstype == NULL ||
4465 strcmp(MNTTYPE_LOFS, mnp->mnt_fstype) != 0)
4466 continue;
4467 /* We're looking at a loopback mount. Stat it. */
4468 if (mnp->mnt_special != NULL &&
4469 stat64(mnp->mnt_special, &zst) != -1 &&
4470 rst.st_dev == zst.st_dev && rst.st_ino == zst.st_ino) {
4471 zerror(zlogp, B_FALSE,
4472 "zone root %s is reachable through %s",
4473 rootpath, mnp->mnt_mountp);
4474 return (B_TRUE);
4475 }
4476 }
4477 return (B_FALSE);
4478 }
4479
4480 /*
4481 * Set pool info for the zone's resource management configuration.
4482 */
4483 static int
4484 setup_zone_rm(zlog_t *zlogp, char *zone_name, zoneid_t zoneid)
4485 {
4486 int res;
4487 uint64_t tmp;
4488 char sched[MAXNAMELEN];
4489 char pool_err[128];
4490
4491 /* Get the scheduling class set in the zone configuration. */
4492 if (zonecfg_get_sched_class(snap_hndl, sched, sizeof (sched)) == Z_OK &&
4493 strlen(sched) > 0) {
4494 if (zone_setattr(zoneid, ZONE_ATTR_SCHED_CLASS, sched,
4495 strlen(sched)) == -1)
4496 zerror(zlogp, B_TRUE, "WARNING: unable to set the "
4497 "default scheduling class");
4498
4499 if (strcmp(sched, "FX") == 0) {
4500 /*
4501 * When FX is specified then by default all processes
4502 * will start at the lowest priority level (0) and
4503 * stay there. We support an optional attr which
4504 * indicates that all the processes should be "high
4505 * priority". We set this on the zone so that starting
4506 * init will set the priority high.
4507 */
4508 struct zone_attrtab a;
4509
4510 bzero(&a, sizeof (a));
4511 (void) strlcpy(a.zone_attr_name, "fixed-hi-prio",
4512 sizeof (a.zone_attr_name));
4513
4514 if (zonecfg_lookup_attr(snap_hndl, &a) == Z_OK &&
4515 strcmp(a.zone_attr_value, "true") == 0) {
4516 boolean_t hi = B_TRUE;
4517
4518 if (zone_setattr(zoneid,
4519 ZONE_ATTR_SCHED_FIXEDHI, (void *)hi,
4520 sizeof (hi)) == -1)
4521 zerror(zlogp, B_TRUE, "WARNING: unable "
4522 "to set high priority");
4523 }
4524 }
4525
4526 } else if (zonecfg_get_aliased_rctl(snap_hndl, ALIAS_SHARES, &tmp)
4527 == Z_OK) {
4528 /*
4529 * If the zone has the zone.cpu-shares rctl set then we want to
4530 * use the Fair Share Scheduler (FSS) for processes in the
4531 * zone. Check what scheduling class the zone would be running
4532 * in by default so we can print a warning and modify the class
4533 * if we wouldn't be using FSS.
4534 */
4535 char class_name[PC_CLNMSZ];
4536
4537 if (zonecfg_get_dflt_sched_class(snap_hndl, class_name,
4538 sizeof (class_name)) != Z_OK) {
4539 zerror(zlogp, B_FALSE, "WARNING: unable to determine "
4540 "the zone's scheduling class");
4541
4542 } else if (strcmp("FSS", class_name) != 0) {
4543 zerror(zlogp, B_FALSE, "WARNING: The zone.cpu-shares "
4544 "rctl is set but\nFSS is not the default "
4545 "scheduling class for\nthis zone. FSS will be "
4546 "used for processes\nin the zone but to get the "
4547 "full benefit of FSS,\nit should be the default "
4548 "scheduling class.\nSee dispadmin(8) for more "
4549 "details.");
4550
4551 if (zone_setattr(zoneid, ZONE_ATTR_SCHED_CLASS, "FSS",
4552 strlen("FSS")) == -1)
4553 zerror(zlogp, B_TRUE, "WARNING: unable to set "
4554 "zone scheduling class to FSS");
4555 }
4556 }
4557
4558 /*
4559 * The next few blocks of code attempt to set up temporary pools as
4560 * well as persistent pools. In all cases we call the functions
4561 * unconditionally. Within each funtion the code will check if the
4562 * zone is actually configured for a temporary pool or persistent pool
4563 * and just return if there is nothing to do.
4564 *
4565 * If we are rebooting we want to attempt to reuse any temporary pool
4566 * that was previously set up. zonecfg_bind_tmp_pool() will do the
4567 * right thing in all cases (reuse or create) based on the current
4568 * zonecfg.
4569 */
4570 if ((res = zonecfg_bind_tmp_pool(snap_hndl, zoneid, pool_err,
4571 sizeof (pool_err))) != Z_OK) {
4572 if (res == Z_POOL || res == Z_POOL_CREATE || res == Z_POOL_BIND)
4573 zerror(zlogp, B_FALSE, "%s: %s\ndedicated-cpu setting "
4574 "cannot be instantiated", zonecfg_strerror(res),
4575 pool_err);
4576 else
4577 zerror(zlogp, B_FALSE, "could not bind zone to "
4578 "temporary pool: %s", zonecfg_strerror(res));
4579 return (Z_POOL_BIND);
4580 }
4581
4582 /*
4583 * Check if we need to warn about poold not being enabled.
4584 */
4585 if (zonecfg_warn_poold(snap_hndl)) {
4586 zerror(zlogp, B_FALSE, "WARNING: A range of dedicated-cpus has "
4587 "been specified\nbut the dynamic pool service is not "
4588 "enabled.\nThe system will not dynamically adjust the\n"
4589 "processor allocation within the specified range\n"
4590 "until svc:/system/pools/dynamic is enabled.\n"
4591 "See poold(8).");
4592 }
4593
4594 /* The following is a warning, not an error. */
4595 if ((res = zonecfg_bind_pool(snap_hndl, zoneid, pool_err,
4596 sizeof (pool_err))) != Z_OK) {
4597 if (res == Z_POOL_BIND)
4598 zerror(zlogp, B_FALSE, "WARNING: unable to bind to "
4599 "pool '%s'; using default pool.", pool_err);
4600 else if (res == Z_POOL)
4601 zerror(zlogp, B_FALSE, "WARNING: %s: %s",
4602 zonecfg_strerror(res), pool_err);
4603 else
4604 zerror(zlogp, B_FALSE, "WARNING: %s",
4605 zonecfg_strerror(res));
4606 }
4607
4608 /* Update saved pool name in case it has changed */
4609 (void) zonecfg_get_poolname(snap_hndl, zone_name, pool_name,
4610 sizeof (pool_name));
4611
4612 return (Z_OK);
4613 }
4614
4615 static void
4616 report_prop_err(zlog_t *zlogp, const char *name, const char *value, int res)
4617 {
4618 switch (res) {
4619 case Z_TOO_BIG:
4620 zerror(zlogp, B_FALSE, "%s property value is too large.", name);
4621 break;
4622
4623 case Z_INVALID_PROPERTY:
4624 zerror(zlogp, B_FALSE, "%s property value \"%s\" is not valid",
4625 name, value);
4626 break;
4627
4628 default:
4629 zerror(zlogp, B_TRUE, "fetching property %s: %d", name, res);
4630 break;
4631 }
4632 }
4633
4634 /*
4635 * Sets the hostid of the new zone based on its configured value. The zone's
4636 * zone_t structure must already exist in kernel memory. 'zlogp' refers to the
4637 * log used to report errors and warnings and must be non-NULL. 'zone_namep'
4638 * is the name of the new zone and must be non-NULL. 'zoneid' is the numeric
4639 * ID of the new zone.
4640 *
4641 * This function returns zero on success and a nonzero error code on failure.
4642 */
4643 static int
4644 setup_zone_hostid(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4645 {
4646 int res;
4647 char hostidp[HW_HOSTID_LEN];
4648 unsigned int hostid;
4649
4650 res = zonecfg_get_hostid(handle, hostidp, sizeof (hostidp));
4651
4652 if (res == Z_BAD_PROPERTY) {
4653 return (Z_OK);
4654 } else if (res != Z_OK) {
4655 report_prop_err(zlogp, "hostid", hostidp, res);
4656 return (res);
4657 }
4658
4659 hostid = (unsigned int)strtoul(hostidp, NULL, 16);
4660 if ((res = zone_setattr(zoneid, ZONE_ATTR_HOSTID, &hostid,
4661 sizeof (hostid))) != 0) {
4662 zerror(zlogp, B_TRUE,
4663 "zone hostid is not valid: %s: %d", hostidp, res);
4664 return (Z_SYSTEM);
4665 }
4666
4667 return (res);
4668 }
4669
4670 static int
4671 secflags_parse_check(secflagset_t *flagset, const char *flagstr, char *descr,
4672 zlog_t *zlogp)
4673 {
4674 secflagdelta_t delt;
4675
4676 if (secflags_parse(NULL, flagstr, &delt) == -1) {
4677 zerror(zlogp, B_FALSE,
4678 "failed to parse %s security-flags '%s': %s",
4679 descr, flagstr, strerror(errno));
4680 return (Z_BAD_PROPERTY);
4681 }
4682
4683 if (delt.psd_ass_active != B_TRUE) {
4684 zerror(zlogp, B_FALSE,
4685 "relative security-flags are not allowed "
4686 "(%s security-flags: '%s')", descr, flagstr);
4687 return (Z_BAD_PROPERTY);
4688 }
4689
4690 secflags_copy(flagset, &delt.psd_assign);
4691
4692 return (Z_OK);
4693 }
4694
4695 static int
4696 setup_zone_secflags(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4697 {
4698 psecflags_t secflags;
4699 struct zone_secflagstab tab = {0};
4700 secflagset_t flagset;
4701 int res;
4702
4703 res = zonecfg_lookup_secflags(handle, &tab);
4704
4705 /*
4706 * If the zone configuration does not define any security flag sets,
4707 * then check to see if there are any default flags configured for
4708 * the brand. If so, set these as the default set for this zone and
4709 * the lower/upper sets will become none/all as per the defaults.
4710 *
4711 * If there is no brand default either, then the flags will be
4712 * defaulted below.
4713 */
4714 if (res == Z_NO_ENTRY) {
4715 char flagstr[ZONECFG_SECFLAGS_MAX];
4716 brand_handle_t bh = NULL;
4717
4718 if ((bh = brand_open(brand_name)) == NULL) {
4719 zerror(zlogp, B_FALSE,
4720 "unable to find brand named %s", brand_name);
4721 return (Z_BAD_PROPERTY);
4722 }
4723 if (brand_get_secflags(bh, flagstr, sizeof (flagstr)) != 0) {
4724 brand_close(bh);
4725 zerror(zlogp, B_FALSE,
4726 "unable to retrieve brand default security flags");
4727 return (Z_BAD_PROPERTY);
4728 }
4729 brand_close(bh);
4730
4731 if (*flagstr != '\0' &&
4732 strlcpy(tab.zone_secflags_default, flagstr,
4733 sizeof (tab.zone_secflags_default)) >=
4734 sizeof (tab.zone_secflags_default)) {
4735 zerror(zlogp, B_FALSE,
4736 "brand default security-flags is too long");
4737 return (Z_BAD_PROPERTY);
4738 }
4739 } else if (res != Z_OK) {
4740 zerror(zlogp, B_FALSE,
4741 "security-flags property is invalid: %d", res);
4742 return (res);
4743 }
4744
4745 if (strlen(tab.zone_secflags_lower) == 0) {
4746 (void) strlcpy(tab.zone_secflags_lower, "none",
4747 sizeof (tab.zone_secflags_lower));
4748 }
4749 if (strlen(tab.zone_secflags_default) == 0) {
4750 (void) strlcpy(tab.zone_secflags_default,
4751 tab.zone_secflags_lower,
4752 sizeof (tab.zone_secflags_default));
4753 }
4754 if (strlen(tab.zone_secflags_upper) == 0) {
4755 (void) strlcpy(tab.zone_secflags_upper, "all",
4756 sizeof (tab.zone_secflags_upper));
4757 }
4758
4759 if ((res = secflags_parse_check(&flagset, tab.zone_secflags_default,
4760 "default", zlogp)) != Z_OK) {
4761 return (res);
4762 } else {
4763 secflags_copy(&secflags.psf_inherit, &flagset);
4764 secflags_copy(&secflags.psf_effective, &flagset);
4765 }
4766
4767 if ((res = secflags_parse_check(&flagset, tab.zone_secflags_lower,
4768 "lower", zlogp)) != Z_OK) {
4769 return (res);
4770 } else {
4771 secflags_copy(&secflags.psf_lower, &flagset);
4772 }
4773
4774 if ((res = secflags_parse_check(&flagset, tab.zone_secflags_upper,
4775 "upper", zlogp)) != Z_OK) {
4776 return (res);
4777 } else {
4778 secflags_copy(&secflags.psf_upper, &flagset);
4779 }
4780
4781 if (!psecflags_validate(&secflags)) {
4782 zerror(zlogp, B_TRUE, "security-flags violate invariants");
4783 return (Z_BAD_PROPERTY);
4784 }
4785
4786 if ((res = zone_setattr(zoneid, ZONE_ATTR_SECFLAGS, &secflags,
4787 sizeof (secflags))) != 0) {
4788 zerror(zlogp, B_TRUE,
4789 "security-flags couldn't be set: %d", res);
4790 return (Z_SYSTEM);
4791 }
4792
4793 return (Z_OK);
4794 }
4795
4796 static int
4797 setup_zone_fs_allowed(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4798 {
4799 char fsallowed[ZONE_FS_ALLOWED_MAX];
4800 char *fsallowedp = fsallowed;
4801 int len = sizeof (fsallowed);
4802 int res;
4803
4804 res = zonecfg_get_fs_allowed(handle, fsallowed, len);
4805
4806 if (res == Z_BAD_PROPERTY) {
4807 /* No value, set the defaults */
4808 (void) strlcpy(fsallowed, DFLT_FS_ALLOWED, len);
4809 } else if (res != Z_OK) {
4810 report_prop_err(zlogp, "fs-allowed", fsallowed, res);
4811 return (res);
4812 } else if (fsallowed[0] == '-') {
4813 /* dropping default filesystems - use remaining list */
4814 if (fsallowed[1] != ',')
4815 return (Z_OK);
4816 fsallowedp += 2;
4817 len -= 2;
4818 } else {
4819 /* Has a value, append the defaults */
4820 if (strlcat(fsallowed, ",", len) >= len ||
4821 strlcat(fsallowed, DFLT_FS_ALLOWED, len) >= len) {
4822 report_prop_err(zlogp, "fs-allowed", fsallowed,
4823 Z_TOO_BIG);
4824 return (Z_TOO_BIG);
4825 }
4826 }
4827
4828 if (zone_setattr(zoneid, ZONE_ATTR_FS_ALLOWED, fsallowedp, len) != 0) {
4829 zerror(zlogp, B_TRUE,
4830 "fs-allowed couldn't be set: %s: %d", fsallowedp, res);
4831 return (Z_SYSTEM);
4832 }
4833
4834 return (Z_OK);
4835 }
4836
4837 static int
4838 setup_zone_attrs(zlog_t *zlogp, zoneid_t zoneid)
4839 {
4840 int res = Z_OK;
4841
4842 if ((res = setup_zone_hostid(snap_hndl, zlogp, zoneid)) != Z_OK)
4843 goto out;
4844
4845 if ((res = setup_zone_fs_allowed(snap_hndl, zlogp, zoneid)) != Z_OK)
4846 goto out;
4847
4848 if ((res = setup_zone_secflags(snap_hndl, zlogp, zoneid)) != Z_OK)
4849 goto out;
4850
4851 out:
4852 return (res);
4853 }
4854
4855 /*
4856 * The zone_did is a persistent debug ID. Each zone should have a unique ID
4857 * in the kernel. This is used for things like DTrace which want to monitor
4858 * zones across reboots. They can't use the zoneid since that changes on
4859 * each boot.
4860 */
4861 zoneid_t
4862 vplat_create(zlog_t *zlogp, zone_mnt_t mount_cmd, zoneid_t zone_did)
4863 {
4864 zoneid_t rval = -1;
4865 priv_set_t *privs;
4866 char rootpath[MAXPATHLEN];
4867 char *rctlbuf = NULL;
4868 size_t rctlbufsz = 0;
4869 char *zfsbuf = NULL;
4870 size_t zfsbufsz = 0;
4871 zoneid_t zoneid = -1;
4872 int xerr;
4873 char *kzone;
4874 FILE *fp = NULL;
4875 tsol_zcent_t *zcent = NULL;
4876 int match = 0;
4877 int doi = 0;
4878 int flags = -1;
4879 zone_iptype_t iptype;
4880
4881 if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
4882 zerror(zlogp, B_TRUE, "unable to determine zone root");
4883 return (-1);
4884 }
4885 if (zonecfg_in_alt_root())
4886 resolve_lofs(zlogp, rootpath, sizeof (rootpath));
4887
4888 if (vplat_get_iptype(zlogp, &iptype) < 0) {
4889 zerror(zlogp, B_TRUE, "unable to determine ip-type");
4890 return (-1);
4891 }
4892 if (iptype == ZS_EXCLUSIVE) {
4893 flags = ZCF_NET_EXCL;
4894 } else {
4895 flags = 0;
4896 }
4897 if (flags == -1)
4898 abort();
4899
4900 if ((privs = priv_allocset()) == NULL) {
4901 zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
4902 return (-1);
4903 }
4904 priv_emptyset(privs);
4905 if (get_privset(zlogp, privs, mount_cmd) != 0)
4906 goto error;
4907
4908 if (mount_cmd == Z_MNT_BOOT &&
4909 get_rctls(zlogp, &rctlbuf, &rctlbufsz) != 0) {
4910 zerror(zlogp, B_FALSE, "Unable to get list of rctls");
4911 goto error;
4912 }
4913
4914 if (get_datasets(zlogp, &zfsbuf, &zfsbufsz) != 0) {
4915 zerror(zlogp, B_FALSE, "Unable to get list of ZFS datasets");
4916 goto error;
4917 }
4918
4919 if (mount_cmd == Z_MNT_BOOT && is_system_labeled()) {
4920 zcent = get_zone_label(zlogp, privs);
4921 if (zcent != NULL) {
4922 match = zcent->zc_match;
4923 doi = zcent->zc_doi;
4924 *zlabel = zcent->zc_label;
4925 } else {
4926 goto error;
4927 }
4928 if (validate_rootds_label(zlogp, rootpath, zlabel) != 0)
4929 goto error;
4930 }
4931
4932 kzone = zone_name;
4933
4934 /*
4935 * We must do this scan twice. First, we look for zones running on the
4936 * main system that are using this root (or any subdirectory of it).
4937 * Next, we reduce to the shortest path and search for loopback mounts
4938 * that use this same source node (same device and inode).
4939 */
4940 if (duplicate_zone_root(zlogp, rootpath))
4941 goto error;
4942 if (duplicate_reachable_path(zlogp, rootpath))
4943 goto error;
4944
4945 if (ALT_MOUNT(mount_cmd)) {
4946 root_to_lu(zlogp, rootpath, sizeof (rootpath), B_TRUE);
4947
4948 /*
4949 * Forge up a special root for this zone. When a zone is
4950 * mounted, we can't let the zone have its own root because the
4951 * tools that will be used in this "scratch zone" need access
4952 * to both the zone's resources and the running machine's
4953 * executables.
4954 *
4955 * Note that the mkdir here also catches read-only filesystems.
4956 */
4957 if (mkdir(rootpath, 0755) != 0 && errno != EEXIST) {
4958 zerror(zlogp, B_TRUE, "cannot create %s", rootpath);
4959 goto error;
4960 }
4961 if (domount(zlogp, "tmpfs", "", "swap", rootpath) != 0)
4962 goto error;
4963 }
4964
4965 if (zonecfg_in_alt_root()) {
4966 /*
4967 * If we are mounting up a zone in an alternate root partition,
4968 * then we have some additional work to do before starting the
4969 * zone. First, resolve the root path down so that we're not
4970 * fooled by duplicates. Then forge up an internal name for
4971 * the zone.
4972 */
4973 if ((fp = zonecfg_open_scratch("", B_TRUE)) == NULL) {
4974 zerror(zlogp, B_TRUE, "cannot open mapfile");
4975 goto error;
4976 }
4977 if (zonecfg_lock_scratch(fp) != 0) {
4978 zerror(zlogp, B_TRUE, "cannot lock mapfile");
4979 goto error;
4980 }
4981 if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
4982 NULL, 0) == 0) {
4983 zerror(zlogp, B_FALSE, "scratch zone already running");
4984 goto error;
4985 }
4986 /* This is the preferred name */
4987 (void) snprintf(kernzone, sizeof (kernzone), "SUNWlu-%s",
4988 zone_name);
4989 srandom(getpid());
4990 while (zonecfg_reverse_scratch(fp, kernzone, NULL, 0, NULL,
4991 0) == 0) {
4992 /* This is just an arbitrary name; note "." usage */
4993 (void) snprintf(kernzone, sizeof (kernzone),
4994 "SUNWlu.%08lX%08lX", random(), random());
4995 }
4996 kzone = kernzone;
4997 }
4998
4999 xerr = 0;
5000 if ((zoneid = zone_create(kzone, rootpath, privs, rctlbuf,
5001 rctlbufsz, zfsbuf, zfsbufsz, &xerr, match, doi, zlabel,
5002 flags, zone_did)) == -1) {
5003 if (xerr == ZE_AREMOUNTS) {
5004 if (zonecfg_find_mounts(rootpath, NULL, NULL) < 1) {
5005 zerror(zlogp, B_FALSE,
5006 "An unknown file-system is mounted on "
5007 "a subdirectory of %s", rootpath);
5008 } else {
5009
5010 zerror(zlogp, B_FALSE,
5011 "These file-systems are mounted on "
5012 "subdirectories of %s:", rootpath);
5013 (void) zonecfg_find_mounts(rootpath,
5014 prtmount, zlogp);
5015 }
5016 } else if (xerr == ZE_CHROOTED) {
5017 zerror(zlogp, B_FALSE, "%s: "
5018 "cannot create a zone from a chrooted "
5019 "environment", "zone_create");
5020 } else if (xerr == ZE_LABELINUSE) {
5021 char zonename[ZONENAME_MAX];
5022 (void) getzonenamebyid(getzoneidbylabel(zlabel),
5023 zonename, ZONENAME_MAX);
5024 zerror(zlogp, B_FALSE, "The zone label is already "
5025 "used by the zone '%s'.", zonename);
5026 } else {
5027 zerror(zlogp, B_TRUE, "%s failed", "zone_create");
5028 }
5029 goto error;
5030 }
5031
5032 if (zonecfg_in_alt_root() &&
5033 zonecfg_add_scratch(fp, zone_name, kernzone,
5034 zonecfg_get_root()) == -1) {
5035 zerror(zlogp, B_TRUE, "cannot add mapfile entry");
5036 goto error;
5037 }
5038
5039 /*
5040 * The following actions are not performed when merely mounting a zone
5041 * for administrative use.
5042 */
5043 if (mount_cmd == Z_MNT_BOOT) {
5044 brand_handle_t bh;
5045 struct brand_attr attr;
5046 char modname[MAXPATHLEN];
5047
5048 if (setup_zone_attrs(zlogp, zoneid) != Z_OK)
5049 goto error;
5050
5051 if ((bh = brand_open(brand_name)) == NULL) {
5052 zerror(zlogp, B_FALSE,
5053 "unable to determine brand name");
5054 goto error;
5055 }
5056
5057 if (!is_system_labeled() &&
5058 (strcmp(brand_name, LABELED_BRAND_NAME) == 0)) {
5059 brand_close(bh);
5060 zerror(zlogp, B_FALSE,
5061 "cannot boot labeled zone on unlabeled system");
5062 goto error;
5063 }
5064
5065 /*
5066 * If this brand requires any kernel support, now is the time to
5067 * get it loaded and initialized.
5068 */
5069 if (brand_get_modname(bh, modname, MAXPATHLEN) < 0) {
5070 brand_close(bh);
5071 zerror(zlogp, B_FALSE,
5072 "unable to determine brand kernel module");
5073 goto error;
5074 }
5075 brand_close(bh);
5076
5077 if (strlen(modname) > 0) {
5078 (void) strlcpy(attr.ba_brandname, brand_name,
5079 sizeof (attr.ba_brandname));
5080 (void) strlcpy(attr.ba_modname, modname,
5081 sizeof (attr.ba_modname));
5082 if (zone_setattr(zoneid, ZONE_ATTR_BRAND, &attr,
5083 sizeof (attr) != 0)) {
5084 zerror(zlogp, B_TRUE,
5085 "could not set zone brand attribute.");
5086 goto error;
5087 }
5088 }
5089
5090 if (setup_zone_rm(zlogp, zone_name, zoneid) != Z_OK)
5091 goto error;
5092
5093 set_mlps(zlogp, zoneid, zcent);
5094 }
5095
5096 rval = zoneid;
5097 zoneid = -1;
5098
5099 error:
5100 if (zoneid != -1) {
5101 (void) zone_shutdown(zoneid);
5102 (void) zone_destroy(zoneid);
5103 }
5104 if (rctlbuf != NULL)
5105 free(rctlbuf);
5106 if (zfsbuf != NULL)
5107 free(zfsbuf);
5108 priv_freeset(privs);
5109 if (fp != NULL)
5110 zonecfg_close_scratch(fp);
5111 lofs_discard_mnttab();
5112 if (zcent != NULL)
5113 tsol_freezcent(zcent);
5114 return (rval);
5115 }
5116
5117 /*
5118 * Enter the zone and write a /etc/zones/index file there. This allows
5119 * libzonecfg (and thus zoneadm) to report the UUID and potentially other zone
5120 * details from inside the zone.
5121 */
5122 static void
5123 write_index_file(zoneid_t zoneid)
5124 {
5125 FILE *zef;
5126 FILE *zet;
5127 struct zoneent *zep;
5128 pid_t child;
5129 int tmpl_fd;
5130 ctid_t ct;
5131 int fd;
5132 char uuidstr[UUID_PRINTABLE_STRING_LENGTH];
5133
5134 /* Locate the zone entry in the global zone's index file */
5135 if ((zef = setzoneent()) == NULL)
5136 return;
5137 while ((zep = getzoneent_private(zef)) != NULL) {
5138 if (strcmp(zep->zone_name, zone_name) == 0)
5139 break;
5140 free(zep);
5141 }
5142 endzoneent(zef);
5143 if (zep == NULL)
5144 return;
5145
5146 if ((tmpl_fd = init_template()) == -1) {
5147 free(zep);
5148 return;
5149 }
5150
5151 if ((child = fork()) == -1) {
5152 (void) ct_tmpl_clear(tmpl_fd);
5153 (void) close(tmpl_fd);
5154 free(zep);
5155 return;
5156 }
5157
5158 /* parent waits for child to finish */
5159 if (child != 0) {
5160 free(zep);
5161 if (contract_latest(&ct) == -1)
5162 ct = -1;
5163 (void) ct_tmpl_clear(tmpl_fd);
5164 (void) close(tmpl_fd);
5165 (void) waitpid(child, NULL, 0);
5166 (void) contract_abandon_id(ct);
5167 return;
5168 }
5169
5170 /* child enters zone and sets up index file */
5171 (void) ct_tmpl_clear(tmpl_fd);
5172 if (zone_enter(zoneid) != -1) {
5173 (void) mkdir(ZONE_CONFIG_ROOT, ZONE_CONFIG_MODE);
5174 (void) chown(ZONE_CONFIG_ROOT, ZONE_CONFIG_UID,
5175 ZONE_CONFIG_GID);
5176 fd = open(ZONE_INDEX_FILE, O_WRONLY|O_CREAT|O_TRUNC,
5177 ZONE_INDEX_MODE);
5178 if (fd != -1 && (zet = fdopen(fd, "w")) != NULL) {
5179 (void) fchown(fd, ZONE_INDEX_UID, ZONE_INDEX_GID);
5180 if (uuid_is_null(zep->zone_uuid))
5181 uuidstr[0] = '\0';
5182 else
5183 uuid_unparse(zep->zone_uuid, uuidstr);
5184 (void) fprintf(zet, "%s:%s:/:%s\n", zep->zone_name,
5185 zone_state_str(zep->zone_state),
5186 uuidstr);
5187 (void) fclose(zet);
5188 }
5189 }
5190 _exit(0);
5191 }
5192
5193 int
5194 vplat_bringup(zlog_t *zlogp, zone_mnt_t mount_cmd, zoneid_t zoneid)
5195 {
5196 char zpath[MAXPATHLEN];
5197
5198 if (mount_cmd == Z_MNT_BOOT && validate_datasets(zlogp) != 0) {
5199 lofs_discard_mnttab();
5200 return (-1);
5201 }
5202
5203 /*
5204 * Before we try to mount filesystems we need to create the
5205 * attribute backing store for /dev
5206 */
5207 (void) strlcpy(zpath, zonepath, sizeof (zpath));
5208 resolve_lofs(zlogp, zpath, sizeof (zpath));
5209
5210 /* Make /dev directory owned by root, grouped sys */
5211 if (make_one_dir(zlogp, zpath, "/dev", DEFAULT_DIR_MODE, 0, 3) != 0) {
5212 lofs_discard_mnttab();
5213 return (-1);
5214 }
5215
5216 if (mount_filesystems(zlogp, mount_cmd) != 0) {
5217 lofs_discard_mnttab();
5218 return (-1);
5219 }
5220
5221 if (mount_cmd == Z_MNT_BOOT) {
5222 zone_iptype_t iptype;
5223
5224 if (vplat_get_iptype(zlogp, &iptype) < 0) {
5225 zerror(zlogp, B_TRUE, "unable to determine ip-type");
5226 lofs_discard_mnttab();
5227 return (-1);
5228 }
5229
5230 switch (iptype) {
5231 case ZS_SHARED:
5232 /* Always do this to make lo0 get configured */
5233 if (configure_shared_network_interfaces(zlogp) != 0) {
5234 lofs_discard_mnttab();
5235 return (-1);
5236 }
5237 break;
5238 case ZS_EXCLUSIVE:
5239 if (configure_exclusive_network_interfaces(zlogp,
5240 zoneid) !=
5241 0) {
5242 lofs_discard_mnttab();
5243 return (-1);
5244 }
5245 break;
5246 default:
5247 abort();
5248 }
5249 }
5250
5251 write_index_file(zoneid);
5252
5253 lofs_discard_mnttab();
5254 return (0);
5255 }
5256
5257 static int
5258 lu_root_teardown(zlog_t *zlogp)
5259 {
5260 char zroot[MAXPATHLEN];
5261
5262 if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
5263 zerror(zlogp, B_FALSE, "unable to determine zone root");
5264 return (-1);
5265 }
5266 root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
5267
5268 /*
5269 * At this point, the processes are gone, the filesystems (save the
5270 * root) are unmounted, and the zone is on death row. But there may
5271 * still be creds floating about in the system that reference the
5272 * zone_t, and which pin down zone_rootvp causing this call to fail
5273 * with EBUSY. Thus, we try for a little while before just giving up.
5274 * (How I wish this were not true, and umount2 just did the right
5275 * thing, or tmpfs supported MS_FORCE This is a gross hack.)
5276 */
5277 if (umount2(zroot, MS_FORCE) != 0) {
5278 if (errno == ENOTSUP && umount2(zroot, 0) == 0)
5279 goto unmounted;
5280 if (errno == EBUSY) {
5281 int tries = 10;
5282
5283 while (--tries >= 0) {
5284 (void) sleep(1);
5285 if (umount2(zroot, 0) == 0)
5286 goto unmounted;
5287 if (errno != EBUSY)
5288 break;
5289 }
5290 }
5291 zerror(zlogp, B_TRUE, "unable to unmount '%s'", zroot);
5292 return (-1);
5293 }
5294 unmounted:
5295
5296 /*
5297 * Only zones in an alternate root environment have scratch zone
5298 * entries.
5299 */
5300 if (zonecfg_in_alt_root()) {
5301 FILE *fp;
5302 int retv;
5303
5304 if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
5305 zerror(zlogp, B_TRUE, "cannot open mapfile");
5306 return (-1);
5307 }
5308 retv = -1;
5309 if (zonecfg_lock_scratch(fp) != 0)
5310 zerror(zlogp, B_TRUE, "cannot lock mapfile");
5311 else if (zonecfg_delete_scratch(fp, kernzone) != 0)
5312 zerror(zlogp, B_TRUE, "cannot delete map entry");
5313 else
5314 retv = 0;
5315 zonecfg_close_scratch(fp);
5316 return (retv);
5317 } else {
5318 return (0);
5319 }
5320 }
5321
5322 /*
5323 * Delete all transient links belonging to this zone. A transient link
5324 * is one that is created and destroyed along with the lifetime of the
5325 * zone. Non-transient links, ones that are assigned from the GZ to a
5326 * NGZ, are reassigned to the GZ in zone_shutdown() via the
5327 * zone-specific data (zsd) callbacks.
5328 */
5329 static int
5330 delete_transient_links(zlog_t *zlogp, zoneid_t zoneid)
5331 {
5332 datalink_id_t *dllinks = NULL;
5333 int dlnum = 0;
5334 uint_t i;
5335
5336 if (fetch_zone_datalinks(zlogp, zoneid, &dlnum, &dllinks) != 0)
5337 return (-1);
5338
5339 if (dlnum == 0)
5340 return (0);
5341
5342 for (i = 0; i < dlnum; i++) {
5343 char link_name[MAXLINKNAMELEN];
5344 char dlerr[DLADM_STRSIZE];
5345 datalink_id_t link = dllinks[i];
5346 datalink_class_t link_class;
5347 dladm_status_t status;
5348 uint32_t link_flags;
5349
5350 status = dladm_datalink_id2info(dld_handle, link, &link_flags,
5351 &link_class, NULL, link_name, sizeof (link_name));
5352
5353 if (status != DLADM_STATUS_OK) {
5354 zerror(zlogp, B_FALSE,
5355 "failed to get link info for %u: %s",
5356 link, dladm_status2str(status, dlerr));
5357 continue;
5358 }
5359
5360 if (!(link_flags & DLADM_OPT_TRANSIENT))
5361 continue;
5362
5363 switch (link_class) {
5364 case DATALINK_CLASS_VNIC:
5365 case DATALINK_CLASS_ETHERSTUB:
5366 status = dladm_vnic_delete(dld_handle, link,
5367 DLADM_OPT_ACTIVE);
5368 break;
5369 case DATALINK_CLASS_VLAN:
5370 status = dladm_vlan_delete(dld_handle, link,
5371 DLADM_OPT_ACTIVE);
5372 break;
5373 case DATALINK_CLASS_AGGR:
5374 status = dladm_aggr_delete(dld_handle, link,
5375 DLADM_OPT_ACTIVE);
5376 break;
5377 default:
5378 zerror(zlogp, B_FALSE,
5379 "unhandled class for transient link %s (%u)",
5380 link_name, link);
5381 continue;
5382 }
5383
5384 if (status != DLADM_STATUS_OK) {
5385 zerror(zlogp, B_TRUE,
5386 "failed to delete transient link %s (%u): %s",
5387 link_name, link, dladm_status2str(status, dlerr));
5388 }
5389 }
5390
5391 free(dllinks);
5392 return (0);
5393 }
5394
5395 int
5396 vplat_teardown(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting,
5397 boolean_t debug)
5398 {
5399 char *kzone;
5400 zoneid_t zoneid;
5401 int res;
5402 char pool_err[128];
5403 char cmdbuf[MAXPATHLEN];
5404 brand_handle_t bh = NULL;
5405 dladm_status_t status;
5406 char errmsg[DLADM_STRSIZE];
5407 ushort_t flags;
5408
5409 kzone = zone_name;
5410 if (zonecfg_in_alt_root()) {
5411 FILE *fp;
5412
5413 if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
5414 zerror(zlogp, B_TRUE, "unable to open map file");
5415 goto error;
5416 }
5417 if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
5418 kernzone, sizeof (kernzone)) != 0) {
5419 zerror(zlogp, B_FALSE, "unable to find scratch zone");
5420 zonecfg_close_scratch(fp);
5421 goto error;
5422 }
5423 zonecfg_close_scratch(fp);
5424 kzone = kernzone;
5425 }
5426
5427 if ((zoneid = getzoneidbyname(kzone)) == ZONE_ID_UNDEFINED) {
5428 if (!bringup_failure_recovery)
5429 zerror(zlogp, B_TRUE, "unable to get zoneid");
5430 if (unmount_cmd)
5431 (void) lu_root_teardown(zlogp);
5432 goto error;
5433 }
5434
5435 if (remove_datalink_pool(zlogp, zoneid) != 0) {
5436 zerror(zlogp, B_FALSE,
5437 "unable to clear datalink pool property");
5438 }
5439
5440 if (remove_datalink_protect(zlogp, zoneid) != 0) {
5441 zerror(zlogp, B_FALSE,
5442 "unable to clear datalink protect property");
5443 }
5444
5445 /*
5446 * The datalinks assigned to the zone will be removed from the NGZ as
5447 * part of zone_shutdown() so that we need to remove protect/pool etc.
5448 * before zone_shutdown(). Even if the shutdown itself fails, the zone
5449 * will not be able to violate any constraints applied because the
5450 * datalinks are no longer available to the zone.
5451 */
5452 if (zone_shutdown(zoneid) != 0) {
5453 zerror(zlogp, B_TRUE, "unable to shutdown zone");
5454 goto error;
5455 }
5456
5457 /* Get a handle to the brand info for this zone */
5458 if ((bh = brand_open(brand_name)) == NULL) {
5459 zerror(zlogp, B_FALSE, "unable to determine zone brand");
5460 return (-1);
5461 }
5462 /*
5463 * If there is a brand 'halt' callback, execute it now to give the
5464 * brand a chance to cleanup any custom configuration.
5465 */
5466 (void) strcpy(cmdbuf, EXEC_PREFIX);
5467 if (brand_get_halt(bh, zone_name, zonepath, cmdbuf + EXEC_LEN,
5468 sizeof (cmdbuf) - EXEC_LEN) < 0) {
5469 brand_close(bh);
5470 zerror(zlogp, B_FALSE, "unable to determine branded zone's "
5471 "halt callback.");
5472 goto error;
5473 }
5474 brand_close(bh);
5475
5476 if ((strlen(cmdbuf) > EXEC_LEN) &&
5477 (do_subproc(zlogp, cmdbuf, NULL, debug) != Z_OK)) {
5478 zerror(zlogp, B_FALSE, "%s failed", cmdbuf);
5479 goto error;
5480 }
5481
5482 if (!unmount_cmd) {
5483 zone_iptype_t iptype;
5484
5485 if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
5486 sizeof (flags)) < 0) {
5487 if (vplat_get_iptype(zlogp, &iptype) < 0) {
5488 zerror(zlogp, B_TRUE, "unable to determine "
5489 "ip-type");
5490 goto error;
5491 }
5492 } else {
5493 if (flags & ZF_NET_EXCL)
5494 iptype = ZS_EXCLUSIVE;
5495 else
5496 iptype = ZS_SHARED;
5497 }
5498
5499 switch (iptype) {
5500 case ZS_SHARED:
5501 if (unconfigure_shared_network_interfaces(zlogp,
5502 zoneid) != 0) {
5503 zerror(zlogp, B_FALSE, "unable to unconfigure "
5504 "network interfaces in zone");
5505 goto error;
5506 }
5507 break;
5508 case ZS_EXCLUSIVE:
5509 if (delete_transient_links(zlogp, zoneid) != 0) {
5510 zerror(zlogp, B_FALSE, "unable to delete "
5511 "transient links in zone");
5512 goto error;
5513 }
5514 if (unconfigure_exclusive_network_interfaces(zlogp,
5515 zoneid) != 0) {
5516 zerror(zlogp, B_FALSE, "unable to unconfigure "
5517 "network interfaces in zone");
5518 goto error;
5519 }
5520
5521 status = dladm_zone_halt(dld_handle, zoneid);
5522 if (status != DLADM_STATUS_OK) {
5523 zerror(zlogp, B_FALSE, "unable to notify "
5524 "dlmgmtd of zone halt: %s",
5525 dladm_status2str(status, errmsg));
5526 goto error;
5527 }
5528 break;
5529 }
5530 }
5531
5532 if (!unmount_cmd && tcp_abort_connections(zlogp, zoneid) != 0) {
5533 zerror(zlogp, B_TRUE, "unable to abort TCP connections");
5534 goto error;
5535 }
5536
5537 if (unmount_filesystems(zlogp, zoneid, unmount_cmd) != 0) {
5538 zerror(zlogp, B_FALSE,
5539 "unable to unmount file systems in zone");
5540 goto error;
5541 }
5542
5543 /*
5544 * If we are rebooting then we normally don't want to destroy an
5545 * existing temporary pool at this point so that we can just reuse it
5546 * when the zone boots back up. However, it is also possible we were
5547 * running with a temporary pool and the zone configuration has been
5548 * modified to no longer use a temporary pool. In that case we need
5549 * to destroy the temporary pool now. This case looks like the case
5550 * where we never had a temporary pool configured but
5551 * zonecfg_destroy_tmp_pool will do the right thing either way.
5552 */
5553 if (!unmount_cmd) {
5554 boolean_t destroy_tmp_pool = B_TRUE;
5555
5556 if (rebooting) {
5557 struct zone_psettab pset_tab;
5558
5559 if (zonecfg_lookup_pset(snap_hndl, &pset_tab) == Z_OK)
5560 destroy_tmp_pool = B_FALSE;
5561 }
5562
5563 if (destroy_tmp_pool) {
5564 if ((res = zonecfg_destroy_tmp_pool(zone_name, pool_err,
5565 sizeof (pool_err))) != Z_OK) {
5566 if (res == Z_POOL)
5567 zerror(zlogp, B_FALSE, pool_err);
5568 }
5569 }
5570 }
5571
5572 remove_mlps(zlogp, zoneid);
5573
5574 if (zone_destroy(zoneid) != 0) {
5575 zerror(zlogp, B_TRUE, "unable to destroy zone");
5576 goto error;
5577 }
5578
5579 /*
5580 * Special teardown for alternate boot environments: remove the tmpfs
5581 * root for the zone and then remove it from the map file.
5582 */
5583 if (unmount_cmd && lu_root_teardown(zlogp) != 0)
5584 goto error;
5585
5586 lofs_discard_mnttab();
5587 return (0);
5588
5589 error:
5590 lofs_discard_mnttab();
5591 return (-1);
5592 }