1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright 2014 Nexenta Systems, Inc. All rights reserved.
25 */
26
27 /*
28 * zoneadmd manages zones; one zoneadmd process is launched for each
29 * non-global zone on the system. This daemon juggles four jobs:
30 *
31 * - Implement setup and teardown of the zone "virtual platform": mount and
32 * unmount filesystems; create and destroy network interfaces; communicate
33 * with devfsadmd to lay out devices for the zone; instantiate the zone
34 * console device; configure process runtime attributes such as resource
35 * controls, pool bindings, fine-grained privileges.
36 *
37 * - Launch the zone's init(1M) process.
38 *
39 * - Implement a door server; clients (like zoneadm) connect to the door
40 * server and request zone state changes. The kernel is also a client of
41 * this door server. A request to halt or reboot the zone which originates
42 * *inside* the zone results in a door upcall from the kernel into zoneadmd.
43 *
44 * One minor problem is that messages emitted by zoneadmd need to be passed
45 * back to the zoneadm process making the request. These messages need to
46 * be rendered in the client's locale; so, this is passed in as part of the
47 * request. The exception is the kernel upcall to zoneadmd, in which case
48 * messages are syslog'd.
49 *
50 * To make all of this work, the Makefile adds -a to xgettext to extract *all*
51 * strings, and an exclusion file (zoneadmd.xcl) is used to exclude those
52 * strings which do not need to be translated.
53 *
54 * - Act as a console server for zlogin -C processes; see comments in zcons.c
55 * for more information about the zone console architecture.
56 *
57 * DESIGN NOTES
58 *
59 * Restart:
60 * A chief design constraint of zoneadmd is that it should be restartable in
61 * the case that the administrator kills it off, or it suffers a fatal error,
62 * without the running zone being impacted; this is akin to being able to
63 * reboot the service processor of a server without affecting the OS instance.
64 */
65
66 #include <sys/param.h>
67 #include <sys/mman.h>
68 #include <sys/types.h>
69 #include <sys/stat.h>
70 #include <sys/sysmacros.h>
71
72 #include <bsm/adt.h>
73 #include <bsm/adt_event.h>
74
75 #include <alloca.h>
76 #include <assert.h>
77 #include <errno.h>
78 #include <door.h>
79 #include <fcntl.h>
80 #include <locale.h>
81 #include <signal.h>
82 #include <stdarg.h>
83 #include <stdio.h>
84 #include <stdlib.h>
85 #include <string.h>
86 #include <strings.h>
87 #include <synch.h>
88 #include <syslog.h>
89 #include <thread.h>
90 #include <unistd.h>
91 #include <wait.h>
92 #include <limits.h>
93 #include <zone.h>
94 #include <libbrand.h>
95 #include <sys/brand.h>
96 #include <libcontract.h>
97 #include <libcontract_priv.h>
98 #include <sys/brand.h>
99 #include <sys/contract/process.h>
100 #include <sys/ctfs.h>
101 #include <libdladm.h>
102 #include <sys/dls_mgmt.h>
103 #include <libscf.h>
104
105 #include <libzonecfg.h>
106 #include <zonestat_impl.h>
107 #include "zoneadmd.h"
108
109 static char *progname;
110 char *zone_name; /* zone which we are managing */
111 char pool_name[MAXNAMELEN];
112 char default_brand[MAXNAMELEN];
113 char brand_name[MAXNAMELEN];
114 boolean_t zone_isnative;
115 boolean_t zone_iscluster;
116 boolean_t zone_islabeled;
117 boolean_t shutdown_in_progress;
118 static zoneid_t zone_id;
119 dladm_handle_t dld_handle = NULL;
120
121 static char pre_statechg_hook[2 * MAXPATHLEN];
122 static char post_statechg_hook[2 * MAXPATHLEN];
123 char query_hook[2 * MAXPATHLEN];
124
125 zlog_t logsys;
126
127 mutex_t lock = DEFAULTMUTEX; /* to serialize stuff */
128 mutex_t msglock = DEFAULTMUTEX; /* for calling setlocale() */
129
130 static sema_t scratch_sem; /* for scratch zones */
131
132 static char zone_door_path[MAXPATHLEN];
133 static int zone_door = -1;
134
135 boolean_t in_death_throes = B_FALSE; /* daemon is dying */
136 boolean_t bringup_failure_recovery = B_FALSE; /* ignore certain failures */
137
138 #if !defined(TEXT_DOMAIN) /* should be defined by cc -D */
139 #define TEXT_DOMAIN "SYS_TEST" /* Use this only if it wasn't */
140 #endif
141
142 #define DEFAULT_LOCALE "C"
143
144 static const char *
145 z_cmd_name(zone_cmd_t zcmd)
146 {
147 /* This list needs to match the enum in sys/zone.h */
148 static const char *zcmdstr[] = {
149 "ready", "boot", "forceboot", "reboot", "halt",
150 "note_uninstalling", "mount", "forcemount", "unmount",
151 "shutdown"
152 };
153
154 if (zcmd >= sizeof (zcmdstr) / sizeof (*zcmdstr))
155 return ("unknown");
156 else
157 return (zcmdstr[(int)zcmd]);
158 }
159
160 static char *
161 get_execbasename(char *execfullname)
162 {
163 char *last_slash, *execbasename;
164
165 /* guard against '/' at end of command invocation */
166 for (;;) {
167 last_slash = strrchr(execfullname, '/');
168 if (last_slash == NULL) {
169 execbasename = execfullname;
170 break;
171 } else {
172 execbasename = last_slash + 1;
173 if (*execbasename == '\0') {
174 *last_slash = '\0';
175 continue;
176 }
177 break;
178 }
179 }
180 return (execbasename);
181 }
182
183 static void
184 usage(void)
185 {
186 (void) fprintf(stderr, gettext("Usage: %s -z zonename\n"), progname);
187 (void) fprintf(stderr,
188 gettext("\tNote: %s should not be run directly.\n"), progname);
189 exit(2);
190 }
191
192 /* ARGSUSED */
193 static void
194 sigchld(int sig)
195 {
196 }
197
198 char *
199 localize_msg(char *locale, const char *msg)
200 {
201 char *out;
202
203 (void) mutex_lock(&msglock);
204 (void) setlocale(LC_MESSAGES, locale);
205 out = gettext(msg);
206 (void) setlocale(LC_MESSAGES, DEFAULT_LOCALE);
207 (void) mutex_unlock(&msglock);
208 return (out);
209 }
210
211 /* PRINTFLIKE3 */
212 void
213 zerror(zlog_t *zlogp, boolean_t use_strerror, const char *fmt, ...)
214 {
215 va_list alist;
216 char buf[MAXPATHLEN * 2]; /* enough space for err msg with a path */
217 char *bp;
218 int saved_errno = errno;
219
220 if (zlogp == NULL)
221 return;
222 if (zlogp == &logsys)
223 (void) snprintf(buf, sizeof (buf), "[zone '%s'] ",
224 zone_name);
225 else
226 buf[0] = '\0';
227 bp = &(buf[strlen(buf)]);
228
229 /*
230 * In theory, the locale pointer should be set to either "C" or a
231 * char array, so it should never be NULL
232 */
233 assert(zlogp->locale != NULL);
234 /* Locale is per process, but we are multi-threaded... */
235 fmt = localize_msg(zlogp->locale, fmt);
236
237 va_start(alist, fmt);
238 (void) vsnprintf(bp, sizeof (buf) - (bp - buf), fmt, alist);
239 va_end(alist);
240 bp = &(buf[strlen(buf)]);
241 if (use_strerror)
242 (void) snprintf(bp, sizeof (buf) - (bp - buf), ": %s",
243 strerror(saved_errno));
244 if (zlogp == &logsys) {
245 (void) syslog(LOG_ERR, "%s", buf);
246 } else if (zlogp->logfile != NULL) {
247 (void) fprintf(zlogp->logfile, "%s\n", buf);
248 } else {
249 size_t buflen;
250 size_t copylen;
251
252 buflen = snprintf(zlogp->log, zlogp->loglen, "%s\n", buf);
253 copylen = MIN(buflen, zlogp->loglen);
254 zlogp->log += copylen;
255 zlogp->loglen -= copylen;
256 }
257 }
258
259 /*
260 * Emit a warning for any boot arguments which are unrecognized. Since
261 * Solaris boot arguments are getopt(3c) compatible (see kernel(1m)), we
262 * put the arguments into an argv style array, use getopt to process them,
263 * and put the resultant argument string back into outargs.
264 *
265 * During the filtering, we pull out any arguments which are truly "boot"
266 * arguments, leaving only those which are to be passed intact to the
267 * progenitor process. The one we support at the moment is -i, which
268 * indicates to the kernel which program should be launched as 'init'.
269 *
270 * A return of Z_INVAL indicates specifically that the arguments are
271 * not valid; this is a non-fatal error. Except for Z_OK, all other return
272 * values are treated as fatal.
273 */
274 static int
275 filter_bootargs(zlog_t *zlogp, const char *inargs, char *outargs,
276 char *init_file, char *badarg)
277 {
278 int argc = 0, argc_save;
279 int i;
280 int err;
281 char *arg, *lasts, **argv = NULL, **argv_save;
282 char zonecfg_args[BOOTARGS_MAX];
283 char scratchargs[BOOTARGS_MAX], *sargs;
284 char c;
285
286 bzero(outargs, BOOTARGS_MAX);
287 bzero(badarg, BOOTARGS_MAX);
288
289 /*
290 * If the user didn't specify transient boot arguments, check
291 * to see if there were any specified in the zone configuration,
292 * and use them if applicable.
293 */
294 if (inargs == NULL || inargs[0] == '\0') {
295 zone_dochandle_t handle;
296 if ((handle = zonecfg_init_handle()) == NULL) {
297 zerror(zlogp, B_TRUE,
298 "getting zone configuration handle");
299 return (Z_BAD_HANDLE);
300 }
301 err = zonecfg_get_snapshot_handle(zone_name, handle);
302 if (err != Z_OK) {
303 zerror(zlogp, B_FALSE,
304 "invalid configuration snapshot");
305 zonecfg_fini_handle(handle);
306 return (Z_BAD_HANDLE);
307 }
308
309 bzero(zonecfg_args, sizeof (zonecfg_args));
310 (void) zonecfg_get_bootargs(handle, zonecfg_args,
311 sizeof (zonecfg_args));
312 inargs = zonecfg_args;
313 zonecfg_fini_handle(handle);
314 }
315
316 if (strlen(inargs) >= BOOTARGS_MAX) {
317 zerror(zlogp, B_FALSE, "boot argument string too long");
318 return (Z_INVAL);
319 }
320
321 (void) strlcpy(scratchargs, inargs, sizeof (scratchargs));
322 sargs = scratchargs;
323 while ((arg = strtok_r(sargs, " \t", &lasts)) != NULL) {
324 sargs = NULL;
325 argc++;
326 }
327
328 if ((argv = calloc(argc + 1, sizeof (char *))) == NULL) {
329 zerror(zlogp, B_FALSE, "memory allocation failed");
330 return (Z_NOMEM);
331 }
332
333 argv_save = argv;
334 argc_save = argc;
335
336 (void) strlcpy(scratchargs, inargs, sizeof (scratchargs));
337 sargs = scratchargs;
338 i = 0;
339 while ((arg = strtok_r(sargs, " \t", &lasts)) != NULL) {
340 sargs = NULL;
341 if ((argv[i] = strdup(arg)) == NULL) {
342 err = Z_NOMEM;
343 zerror(zlogp, B_FALSE, "memory allocation failed");
344 goto done;
345 }
346 i++;
347 }
348
349 /*
350 * We preserve compatibility with the Solaris system boot behavior,
351 * which allows:
352 *
353 * # reboot kernel/unix -s -m verbose
354 *
355 * In this example, kernel/unix tells the booter what file to
356 * boot. We don't want reboot in a zone to be gratuitously different,
357 * so we silently ignore the boot file, if necessary.
358 */
359 if (argv[0] == NULL)
360 goto done;
361
362 assert(argv[0][0] != ' ');
363 assert(argv[0][0] != '\t');
364
365 if (argv[0][0] != '-' && argv[0][0] != '\0') {
366 argv = &argv[1];
367 argc--;
368 }
369
370 optind = 0;
371 opterr = 0;
372 err = Z_OK;
373 while ((c = getopt(argc, argv, "fi:m:s")) != -1) {
374 switch (c) {
375 case 'i':
376 /*
377 * -i is handled by the runtime and is not passed
378 * along to userland
379 */
380 (void) strlcpy(init_file, optarg, MAXPATHLEN);
381 break;
382 case 'f':
383 /* This has already been processed by zoneadm */
384 break;
385 case 'm':
386 case 's':
387 /* These pass through unmolested */
388 (void) snprintf(outargs, BOOTARGS_MAX,
389 "%s -%c %s ", outargs, c, optarg ? optarg : "");
390 break;
391 case '?':
392 /*
393 * We warn about unknown arguments but pass them
394 * along anyway-- if someone wants to develop their
395 * own init replacement, they can pass it whatever
396 * args they want.
397 */
398 err = Z_INVAL;
399 (void) snprintf(outargs, BOOTARGS_MAX,
400 "%s -%c", outargs, optopt);
401 (void) snprintf(badarg, BOOTARGS_MAX,
402 "%s -%c", badarg, optopt);
403 break;
404 }
405 }
406
407 /*
408 * For Solaris Zones we warn about and discard non-option arguments.
409 * Hence 'boot foo bar baz gub' --> 'boot'. However, to be similar
410 * to the kernel, we concat up all the other remaining boot args.
411 * and warn on them as a group.
412 */
413 if (optind < argc) {
414 err = Z_INVAL;
415 while (optind < argc) {
416 (void) snprintf(badarg, BOOTARGS_MAX, "%s%s%s",
417 badarg, strlen(badarg) > 0 ? " " : "",
418 argv[optind]);
419 optind++;
420 }
421 zerror(zlogp, B_FALSE, "WARNING: Unused or invalid boot "
422 "arguments `%s'.", badarg);
423 }
424
425 done:
426 for (i = 0; i < argc_save; i++) {
427 if (argv_save[i] != NULL)
428 free(argv_save[i]);
429 }
430 free(argv_save);
431 return (err);
432 }
433
434
435 static int
436 mkzonedir(zlog_t *zlogp)
437 {
438 struct stat st;
439 /*
440 * We must create and lock everyone but root out of ZONES_TMPDIR
441 * since anyone can open any UNIX domain socket, regardless of
442 * its file system permissions. Sigh...
443 */
444 if (mkdir(ZONES_TMPDIR, S_IRWXU) < 0 && errno != EEXIST) {
445 zerror(zlogp, B_TRUE, "could not mkdir '%s'", ZONES_TMPDIR);
446 return (-1);
447 }
448 /* paranoia */
449 if ((stat(ZONES_TMPDIR, &st) < 0) || !S_ISDIR(st.st_mode)) {
450 zerror(zlogp, B_TRUE, "'%s' is not a directory", ZONES_TMPDIR);
451 return (-1);
452 }
453 (void) chmod(ZONES_TMPDIR, S_IRWXU);
454 return (0);
455 }
456
457 /*
458 * Run the brand's pre-state change callback, if it exists.
459 */
460 static int
461 brand_prestatechg(zlog_t *zlogp, int state, int cmd)
462 {
463 char cmdbuf[2 * MAXPATHLEN];
464 const char *altroot;
465
466 if (pre_statechg_hook[0] == '\0')
467 return (0);
468
469 altroot = zonecfg_get_root();
470 if (snprintf(cmdbuf, sizeof (cmdbuf), "%s %d %d %s", pre_statechg_hook,
471 state, cmd, altroot) > sizeof (cmdbuf))
472 return (-1);
473
474 if (do_subproc(zlogp, cmdbuf, NULL) != 0)
475 return (-1);
476
477 return (0);
478 }
479
480 /*
481 * Run the brand's post-state change callback, if it exists.
482 */
483 static int
484 brand_poststatechg(zlog_t *zlogp, int state, int cmd)
485 {
486 char cmdbuf[2 * MAXPATHLEN];
487 const char *altroot;
488
489 if (post_statechg_hook[0] == '\0')
490 return (0);
491
492 altroot = zonecfg_get_root();
493 if (snprintf(cmdbuf, sizeof (cmdbuf), "%s %d %d %s", post_statechg_hook,
494 state, cmd, altroot) > sizeof (cmdbuf))
495 return (-1);
496
497 if (do_subproc(zlogp, cmdbuf, NULL) != 0)
498 return (-1);
499
500 return (0);
501 }
502
503 /*
504 * Notify zonestatd of the new zone. If zonestatd is not running, this
505 * will do nothing.
506 */
507 static void
508 notify_zonestatd(zoneid_t zoneid)
509 {
510 int cmd[2];
511 int fd;
512 door_arg_t params;
513
514 fd = open(ZS_DOOR_PATH, O_RDONLY);
515 if (fd < 0)
516 return;
517
518 cmd[0] = ZSD_CMD_NEW_ZONE;
519 cmd[1] = zoneid;
520 params.data_ptr = (char *)&cmd;
521 params.data_size = sizeof (cmd);
522 params.desc_ptr = NULL;
523 params.desc_num = 0;
524 params.rbuf = NULL;
525 params.rsize = NULL;
526 (void) door_call(fd, ¶ms);
527 (void) close(fd);
528 }
529
530 /*
531 * Bring a zone up to the pre-boot "ready" stage. The mount_cmd argument is
532 * 'true' if this is being invoked as part of the processing for the "mount"
533 * subcommand.
534 */
535 static int
536 zone_ready(zlog_t *zlogp, zone_mnt_t mount_cmd, int zstate)
537 {
538 int err;
539
540 if (brand_prestatechg(zlogp, zstate, Z_READY) != 0)
541 return (-1);
542
543 if ((err = zonecfg_create_snapshot(zone_name)) != Z_OK) {
544 zerror(zlogp, B_FALSE, "unable to create snapshot: %s",
545 zonecfg_strerror(err));
546 goto bad;
547 }
548
549 if ((zone_id = vplat_create(zlogp, mount_cmd)) == -1) {
550 if ((err = zonecfg_destroy_snapshot(zone_name)) != Z_OK)
551 zerror(zlogp, B_FALSE, "destroying snapshot: %s",
552 zonecfg_strerror(err));
553 goto bad;
554 }
555 if (vplat_bringup(zlogp, mount_cmd, zone_id) != 0) {
556 bringup_failure_recovery = B_TRUE;
557 (void) vplat_teardown(NULL, (mount_cmd != Z_MNT_BOOT), B_FALSE);
558 if ((err = zonecfg_destroy_snapshot(zone_name)) != Z_OK)
559 zerror(zlogp, B_FALSE, "destroying snapshot: %s",
560 zonecfg_strerror(err));
561 goto bad;
562 }
563
564 if (brand_poststatechg(zlogp, zstate, Z_READY) != 0)
565 goto bad;
566
567 return (0);
568
569 bad:
570 /*
571 * If something goes wrong, we up the zones's state to the target
572 * state, READY, and then invoke the hook as if we're halting.
573 */
574 (void) brand_poststatechg(zlogp, ZONE_STATE_READY, Z_HALT);
575 return (-1);
576 }
577
578 int
579 init_template(void)
580 {
581 int fd;
582 int err = 0;
583
584 fd = open64(CTFS_ROOT "/process/template", O_RDWR);
585 if (fd == -1)
586 return (-1);
587
588 /*
589 * For now, zoneadmd doesn't do anything with the contract.
590 * Deliver no events, don't inherit, and allow it to be orphaned.
591 */
592 err |= ct_tmpl_set_critical(fd, 0);
593 err |= ct_tmpl_set_informative(fd, 0);
594 err |= ct_pr_tmpl_set_fatal(fd, CT_PR_EV_HWERR);
595 err |= ct_pr_tmpl_set_param(fd, CT_PR_PGRPONLY | CT_PR_REGENT);
596 if (err || ct_tmpl_activate(fd)) {
597 (void) close(fd);
598 return (-1);
599 }
600
601 return (fd);
602 }
603
604 typedef struct fs_callback {
605 zlog_t *zlogp;
606 zoneid_t zoneid;
607 boolean_t mount_cmd;
608 } fs_callback_t;
609
610 static int
611 mount_early_fs(void *data, const char *spec, const char *dir,
612 const char *fstype, const char *opt)
613 {
614 zlog_t *zlogp = ((fs_callback_t *)data)->zlogp;
615 zoneid_t zoneid = ((fs_callback_t *)data)->zoneid;
616 boolean_t mount_cmd = ((fs_callback_t *)data)->mount_cmd;
617 char rootpath[MAXPATHLEN];
618 pid_t child;
619 int child_status;
620 int tmpl_fd;
621 int rv;
622 ctid_t ct;
623
624 /* determine the zone rootpath */
625 if (mount_cmd) {
626 char zonepath[MAXPATHLEN];
627 char luroot[MAXPATHLEN];
628
629 if (zone_get_zonepath(zone_name,
630 zonepath, sizeof (zonepath)) != Z_OK) {
631 zerror(zlogp, B_FALSE, "unable to determine zone path");
632 return (-1);
633 }
634
635 (void) snprintf(luroot, sizeof (luroot), "%s/lu", zonepath);
636 resolve_lofs(zlogp, luroot, sizeof (luroot));
637 (void) strlcpy(rootpath, luroot, sizeof (rootpath));
638 } else {
639 if (zone_get_rootpath(zone_name,
640 rootpath, sizeof (rootpath)) != Z_OK) {
641 zerror(zlogp, B_FALSE, "unable to determine zone root");
642 return (-1);
643 }
644 }
645
646 if ((rv = valid_mount_path(zlogp, rootpath, spec, dir, fstype)) < 0) {
647 zerror(zlogp, B_FALSE, "%s%s is not a valid mount point",
648 rootpath, dir);
649 return (-1);
650 } else if (rv > 0) {
651 /* The mount point path doesn't exist, create it now. */
652 if (make_one_dir(zlogp, rootpath, dir,
653 DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
654 DEFAULT_DIR_GROUP) != 0) {
655 zerror(zlogp, B_FALSE, "failed to create mount point");
656 return (-1);
657 }
658
659 /*
660 * Now this might seem weird, but we need to invoke
661 * valid_mount_path() again. Why? Because it checks
662 * to make sure that the mount point path is canonical,
663 * which it can only do if the path exists, so now that
664 * we've created the path we have to verify it again.
665 */
666 if ((rv = valid_mount_path(zlogp, rootpath, spec, dir,
667 fstype)) < 0) {
668 zerror(zlogp, B_FALSE,
669 "%s%s is not a valid mount point", rootpath, dir);
670 return (-1);
671 }
672 }
673
674 if ((tmpl_fd = init_template()) == -1) {
675 zerror(zlogp, B_TRUE, "failed to create contract");
676 return (-1);
677 }
678
679 if ((child = fork()) == -1) {
680 (void) ct_tmpl_clear(tmpl_fd);
681 (void) close(tmpl_fd);
682 zerror(zlogp, B_TRUE, "failed to fork");
683 return (-1);
684
685 } else if (child == 0) { /* child */
686 char opt_buf[MAX_MNTOPT_STR];
687 int optlen = 0;
688 int mflag = MS_DATA;
689
690 (void) ct_tmpl_clear(tmpl_fd);
691 /*
692 * Even though there are no procs running in the zone, we
693 * do this for paranoia's sake.
694 */
695 (void) closefrom(0);
696
697 if (zone_enter(zoneid) == -1) {
698 _exit(errno);
699 }
700 if (opt != NULL) {
701 /*
702 * The mount() system call is incredibly annoying.
703 * If options are specified, we need to copy them
704 * into a temporary buffer since the mount() system
705 * call will overwrite the options string. It will
706 * also fail if the new option string it wants to
707 * write is bigger than the one we passed in, so
708 * you must pass in a buffer of the maximum possible
709 * option string length. sigh.
710 */
711 (void) strlcpy(opt_buf, opt, sizeof (opt_buf));
712 opt = opt_buf;
713 optlen = MAX_MNTOPT_STR;
714 mflag = MS_OPTIONSTR;
715 }
716 if (mount(spec, dir, mflag, fstype, NULL, 0, opt, optlen) != 0)
717 _exit(errno);
718 _exit(0);
719 }
720
721 /* parent */
722 if (contract_latest(&ct) == -1)
723 ct = -1;
724 (void) ct_tmpl_clear(tmpl_fd);
725 (void) close(tmpl_fd);
726 if (waitpid(child, &child_status, 0) != child) {
727 /* unexpected: we must have been signalled */
728 (void) contract_abandon_id(ct);
729 return (-1);
730 }
731 (void) contract_abandon_id(ct);
732 if (WEXITSTATUS(child_status) != 0) {
733 errno = WEXITSTATUS(child_status);
734 zerror(zlogp, B_TRUE, "mount of %s failed", dir);
735 return (-1);
736 }
737
738 return (0);
739 }
740
741 /*
742 * If retstr is not NULL, the output of the subproc is returned in the str,
743 * otherwise it is output using zerror(). Any memory allocated for retstr
744 * should be freed by the caller.
745 */
746 int
747 do_subproc(zlog_t *zlogp, char *cmdbuf, char **retstr)
748 {
749 char buf[1024]; /* arbitrary large amount */
750 char *inbuf;
751 FILE *file;
752 int status;
753 int rd_cnt;
754
755 if (retstr != NULL) {
756 if ((*retstr = malloc(1024)) == NULL) {
757 zerror(zlogp, B_FALSE, "out of memory");
758 return (-1);
759 }
760 inbuf = *retstr;
761 rd_cnt = 0;
762 } else {
763 inbuf = buf;
764 }
765
766 file = popen(cmdbuf, "r");
767 if (file == NULL) {
768 zerror(zlogp, B_TRUE, "could not launch: %s", cmdbuf);
769 return (-1);
770 }
771
772 while (fgets(inbuf, 1024, file) != NULL) {
773 if (retstr == NULL) {
774 if (zlogp != &logsys) {
775 int last = strlen(inbuf) - 1;
776
777 if (inbuf[last] == '\n')
778 inbuf[last] = '\0';
779 zerror(zlogp, B_FALSE, "%s", inbuf);
780 }
781 } else {
782 char *p;
783
784 rd_cnt += 1024 - 1;
785 if ((p = realloc(*retstr, rd_cnt + 1024)) == NULL) {
786 zerror(zlogp, B_FALSE, "out of memory");
787 (void) pclose(file);
788 return (-1);
789 }
790
791 *retstr = p;
792 inbuf = *retstr + rd_cnt;
793 }
794 }
795 status = pclose(file);
796
797 if (WIFSIGNALED(status)) {
798 zerror(zlogp, B_FALSE, "%s unexpectedly terminated due to "
799 "signal %d", cmdbuf, WTERMSIG(status));
800 return (-1);
801 }
802 assert(WIFEXITED(status));
803 if (WEXITSTATUS(status) == ZEXIT_EXEC) {
804 zerror(zlogp, B_FALSE, "failed to exec %s", cmdbuf);
805 return (-1);
806 }
807 return (WEXITSTATUS(status));
808 }
809
810 static int
811 zone_bootup(zlog_t *zlogp, const char *bootargs, int zstate)
812 {
813 zoneid_t zoneid;
814 struct stat st;
815 char zpath[MAXPATHLEN], initpath[MAXPATHLEN], init_file[MAXPATHLEN];
816 char nbootargs[BOOTARGS_MAX];
817 char cmdbuf[MAXPATHLEN];
818 fs_callback_t cb;
819 brand_handle_t bh;
820 zone_iptype_t iptype;
821 boolean_t links_loaded = B_FALSE;
822 dladm_status_t status;
823 char errmsg[DLADM_STRSIZE];
824 int err;
825 boolean_t restart_init;
826
827 if (brand_prestatechg(zlogp, zstate, Z_BOOT) != 0)
828 return (-1);
829
830 if ((zoneid = getzoneidbyname(zone_name)) == -1) {
831 zerror(zlogp, B_TRUE, "unable to get zoneid");
832 goto bad;
833 }
834
835 cb.zlogp = zlogp;
836 cb.zoneid = zoneid;
837 cb.mount_cmd = B_FALSE;
838
839 /* Get a handle to the brand info for this zone */
840 if ((bh = brand_open(brand_name)) == NULL) {
841 zerror(zlogp, B_FALSE, "unable to determine zone brand");
842 goto bad;
843 }
844
845 /*
846 * Get the list of filesystems to mount from the brand
847 * configuration. These mounts are done via a thread that will
848 * enter the zone, so they are done from within the context of the
849 * zone.
850 */
851 if (brand_platform_iter_mounts(bh, mount_early_fs, &cb) != 0) {
852 zerror(zlogp, B_FALSE, "unable to mount filesystems");
853 brand_close(bh);
854 goto bad;
855 }
856
857 /*
858 * Get the brand's boot callback if it exists.
859 */
860 if (zone_get_zonepath(zone_name, zpath, sizeof (zpath)) != Z_OK) {
861 zerror(zlogp, B_FALSE, "unable to determine zone path");
862 brand_close(bh);
863 goto bad;
864 }
865 (void) strcpy(cmdbuf, EXEC_PREFIX);
866 if (brand_get_boot(bh, zone_name, zpath, cmdbuf + EXEC_LEN,
867 sizeof (cmdbuf) - EXEC_LEN) != 0) {
868 zerror(zlogp, B_FALSE,
869 "unable to determine branded zone's boot callback");
870 brand_close(bh);
871 goto bad;
872 }
873
874 /* Get the path for this zone's init(1M) (or equivalent) process. */
875 if (brand_get_initname(bh, init_file, MAXPATHLEN) != 0) {
876 zerror(zlogp, B_FALSE,
877 "unable to determine zone's init(1M) location");
878 brand_close(bh);
879 goto bad;
880 }
881
882 /* See if this zone's brand should restart init if it dies. */
883 restart_init = brand_restartinit(bh);
884
885 brand_close(bh);
886
887 err = filter_bootargs(zlogp, bootargs, nbootargs, init_file,
888 bad_boot_arg);
889 if (err == Z_INVAL)
890 eventstream_write(Z_EVT_ZONE_BADARGS);
891 else if (err != Z_OK)
892 goto bad;
893
894 assert(init_file[0] != '\0');
895
896 /* Try to anticipate possible problems: Make sure init is executable. */
897 if (zone_get_rootpath(zone_name, zpath, sizeof (zpath)) != Z_OK) {
898 zerror(zlogp, B_FALSE, "unable to determine zone root");
899 goto bad;
900 }
901
902 (void) snprintf(initpath, sizeof (initpath), "%s%s", zpath, init_file);
903
904 if (stat(initpath, &st) == -1) {
905 zerror(zlogp, B_TRUE, "could not stat %s", initpath);
906 goto bad;
907 }
908
909 if ((st.st_mode & S_IXUSR) == 0) {
910 zerror(zlogp, B_FALSE, "%s is not executable", initpath);
911 goto bad;
912 }
913
914 /*
915 * Exclusive stack zones interact with the dlmgmtd running in the
916 * global zone. dladm_zone_boot() tells dlmgmtd that this zone is
917 * booting, and loads its datalinks from the zone's datalink
918 * configuration file.
919 */
920 if (vplat_get_iptype(zlogp, &iptype) == 0 && iptype == ZS_EXCLUSIVE) {
921 status = dladm_zone_boot(dld_handle, zoneid);
922 if (status != DLADM_STATUS_OK) {
923 zerror(zlogp, B_FALSE, "unable to load zone datalinks: "
924 " %s", dladm_status2str(status, errmsg));
925 goto bad;
926 }
927 links_loaded = B_TRUE;
928 }
929
930 /*
931 * If there is a brand 'boot' callback, execute it now to give the
932 * brand one last chance to do any additional setup before the zone
933 * is booted.
934 */
935 if ((strlen(cmdbuf) > EXEC_LEN) &&
936 (do_subproc(zlogp, cmdbuf, NULL) != Z_OK)) {
937 zerror(zlogp, B_FALSE, "%s failed", cmdbuf);
938 goto bad;
939 }
940
941 if (zone_setattr(zoneid, ZONE_ATTR_INITNAME, init_file, 0) == -1) {
942 zerror(zlogp, B_TRUE, "could not set zone boot file");
943 goto bad;
944 }
945
946 if (zone_setattr(zoneid, ZONE_ATTR_BOOTARGS, nbootargs, 0) == -1) {
947 zerror(zlogp, B_TRUE, "could not set zone boot arguments");
948 goto bad;
949 }
950
951 if (!restart_init && zone_setattr(zoneid, ZONE_ATTR_INITNORESTART,
952 NULL, 0) == -1) {
953 zerror(zlogp, B_TRUE, "could not set zone init-no-restart");
954 goto bad;
955 }
956
957 /*
958 * Inform zonestatd of a new zone so that it can install a door for
959 * the zone to contact it.
960 */
961 notify_zonestatd(zone_id);
962
963 if (zone_boot(zoneid) == -1) {
964 zerror(zlogp, B_TRUE, "unable to boot zone");
965 goto bad;
966 }
967
968 if (brand_poststatechg(zlogp, zstate, Z_BOOT) != 0)
969 goto bad;
970
971 return (0);
972
973 bad:
974 /*
975 * If something goes wrong, we up the zones's state to the target
976 * state, RUNNING, and then invoke the hook as if we're halting.
977 */
978 (void) brand_poststatechg(zlogp, ZONE_STATE_RUNNING, Z_HALT);
979 if (links_loaded)
980 (void) dladm_zone_halt(dld_handle, zoneid);
981 return (-1);
982 }
983
984 static int
985 zone_halt(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting, int zstate)
986 {
987 int err;
988
989 if (brand_prestatechg(zlogp, zstate, Z_HALT) != 0)
990 return (-1);
991
992 if (vplat_teardown(zlogp, unmount_cmd, rebooting) != 0) {
993 if (!bringup_failure_recovery)
994 zerror(zlogp, B_FALSE, "unable to destroy zone");
995 return (-1);
996 }
997
998 if ((err = zonecfg_destroy_snapshot(zone_name)) != Z_OK)
999 zerror(zlogp, B_FALSE, "destroying snapshot: %s",
1000 zonecfg_strerror(err));
1001
1002 if (brand_poststatechg(zlogp, zstate, Z_HALT) != 0)
1003 return (-1);
1004
1005 return (0);
1006 }
1007
1008 static int
1009 zone_graceful_shutdown(zlog_t *zlogp)
1010 {
1011 zoneid_t zoneid;
1012 pid_t child;
1013 char cmdbuf[MAXPATHLEN];
1014 brand_handle_t bh = NULL;
1015 char zpath[MAXPATHLEN];
1016 ctid_t ct;
1017 int tmpl_fd;
1018 int child_status;
1019
1020 if (shutdown_in_progress) {
1021 zerror(zlogp, B_FALSE, "shutdown already in progress");
1022 return (-1);
1023 }
1024
1025 if ((zoneid = getzoneidbyname(zone_name)) == -1) {
1026 zerror(zlogp, B_TRUE, "unable to get zoneid");
1027 return (-1);
1028 }
1029
1030 /* Get a handle to the brand info for this zone */
1031 if ((bh = brand_open(brand_name)) == NULL) {
1032 zerror(zlogp, B_FALSE, "unable to determine zone brand");
1033 return (-1);
1034 }
1035
1036 if (zone_get_zonepath(zone_name, zpath, sizeof (zpath)) != Z_OK) {
1037 zerror(zlogp, B_FALSE, "unable to determine zone path");
1038 brand_close(bh);
1039 return (-1);
1040 }
1041
1042 /*
1043 * If there is a brand 'shutdown' callback, execute it now to give the
1044 * brand a chance to cleanup any custom configuration.
1045 */
1046 (void) strcpy(cmdbuf, EXEC_PREFIX);
1047 if (brand_get_shutdown(bh, zone_name, zpath, cmdbuf + EXEC_LEN,
1048 sizeof (cmdbuf) - EXEC_LEN) != 0 || strlen(cmdbuf) <= EXEC_LEN) {
1049 (void) strcat(cmdbuf, SHUTDOWN_DEFAULT);
1050 }
1051 brand_close(bh);
1052
1053 if ((tmpl_fd = init_template()) == -1) {
1054 zerror(zlogp, B_TRUE, "failed to create contract");
1055 return (-1);
1056 }
1057
1058 if ((child = fork()) == -1) {
1059 (void) ct_tmpl_clear(tmpl_fd);
1060 (void) close(tmpl_fd);
1061 zerror(zlogp, B_TRUE, "failed to fork");
1062 return (-1);
1063 } else if (child == 0) {
1064 (void) ct_tmpl_clear(tmpl_fd);
1065 if (zone_enter(zoneid) == -1) {
1066 _exit(errno);
1067 }
1068 _exit(execl("/bin/sh", "sh", "-c", cmdbuf, (char *)NULL));
1069 }
1070
1071 if (contract_latest(&ct) == -1)
1072 ct = -1;
1073 (void) ct_tmpl_clear(tmpl_fd);
1074 (void) close(tmpl_fd);
1075
1076 if (waitpid(child, &child_status, 0) != child) {
1077 /* unexpected: we must have been signalled */
1078 (void) contract_abandon_id(ct);
1079 return (-1);
1080 }
1081
1082 (void) contract_abandon_id(ct);
1083 if (WEXITSTATUS(child_status) != 0) {
1084 errno = WEXITSTATUS(child_status);
1085 zerror(zlogp, B_FALSE, "unable to shutdown zone");
1086 return (-1);
1087 }
1088
1089 shutdown_in_progress = B_TRUE;
1090
1091 return (0);
1092 }
1093
1094 static int
1095 zone_wait_shutdown(zlog_t *zlogp)
1096 {
1097 zone_state_t zstate;
1098 uint64_t *tm = NULL;
1099 scf_simple_prop_t *prop = NULL;
1100 int timeout;
1101 int tries;
1102 int rc = -1;
1103
1104 /* Get default stop timeout from SMF framework */
1105 timeout = SHUTDOWN_WAIT;
1106 if ((prop = scf_simple_prop_get(NULL, SHUTDOWN_FMRI, "stop",
1107 SCF_PROPERTY_TIMEOUT)) != NULL) {
1108 if ((tm = scf_simple_prop_next_count(prop)) != NULL) {
1109 if (tm != 0)
1110 timeout = *tm;
1111 }
1112 scf_simple_prop_free(prop);
1113 }
1114
1115 /* allow time for zone to shutdown cleanly */
1116 for (tries = 0; tries < timeout; tries ++) {
1117 (void) sleep(1);
1118 if (zone_get_state(zone_name, &zstate) == Z_OK &&
1119 zstate == ZONE_STATE_INSTALLED) {
1120 rc = 0;
1121 break;
1122 }
1123 }
1124
1125 if (rc != 0)
1126 zerror(zlogp, B_FALSE, "unable to shutdown zone");
1127
1128 shutdown_in_progress = B_FALSE;
1129
1130 return (rc);
1131 }
1132
1133
1134
1135 /*
1136 * Generate AUE_zone_state for a command that boots a zone.
1137 */
1138 static void
1139 audit_put_record(zlog_t *zlogp, ucred_t *uc, int return_val,
1140 char *new_state)
1141 {
1142 adt_session_data_t *ah;
1143 adt_event_data_t *event;
1144 int pass_fail, fail_reason;
1145
1146 if (!adt_audit_enabled())
1147 return;
1148
1149 if (return_val == 0) {
1150 pass_fail = ADT_SUCCESS;
1151 fail_reason = ADT_SUCCESS;
1152 } else {
1153 pass_fail = ADT_FAILURE;
1154 fail_reason = ADT_FAIL_VALUE_PROGRAM;
1155 }
1156
1157 if (adt_start_session(&ah, NULL, 0)) {
1158 zerror(zlogp, B_TRUE, gettext("audit failure."));
1159 return;
1160 }
1161 if (adt_set_from_ucred(ah, uc, ADT_NEW)) {
1162 zerror(zlogp, B_TRUE, gettext("audit failure."));
1163 (void) adt_end_session(ah);
1164 return;
1165 }
1166
1167 event = adt_alloc_event(ah, ADT_zone_state);
1168 if (event == NULL) {
1169 zerror(zlogp, B_TRUE, gettext("audit failure."));
1170 (void) adt_end_session(ah);
1171 return;
1172 }
1173 event->adt_zone_state.zonename = zone_name;
1174 event->adt_zone_state.new_state = new_state;
1175
1176 if (adt_put_event(event, pass_fail, fail_reason))
1177 zerror(zlogp, B_TRUE, gettext("audit failure."));
1178
1179 adt_free_event(event);
1180
1181 (void) adt_end_session(ah);
1182 }
1183
1184 /*
1185 * The main routine for the door server that deals with zone state transitions.
1186 */
1187 /* ARGSUSED */
1188 static void
1189 server(void *cookie, char *args, size_t alen, door_desc_t *dp,
1190 uint_t n_desc)
1191 {
1192 ucred_t *uc = NULL;
1193 const priv_set_t *eset;
1194
1195 zone_state_t zstate;
1196 zone_cmd_t cmd;
1197 zone_cmd_arg_t *zargp;
1198
1199 boolean_t kernelcall;
1200
1201 int rval = -1;
1202 uint64_t uniqid;
1203 zoneid_t zoneid = -1;
1204 zlog_t zlog;
1205 zlog_t *zlogp;
1206 zone_cmd_rval_t *rvalp;
1207 size_t rlen = getpagesize(); /* conservative */
1208 fs_callback_t cb;
1209 brand_handle_t bh;
1210 boolean_t wait_shut = B_FALSE;
1211
1212 /* LINTED E_BAD_PTR_CAST_ALIGN */
1213 zargp = (zone_cmd_arg_t *)args;
1214
1215 /*
1216 * When we get the door unref message, we've fdetach'd the door, and
1217 * it is time for us to shut down zoneadmd.
1218 */
1219 if (zargp == DOOR_UNREF_DATA) {
1220 /*
1221 * See comment at end of main() for info on the last rites.
1222 */
1223 exit(0);
1224 }
1225
1226 if (zargp == NULL) {
1227 (void) door_return(NULL, 0, 0, 0);
1228 }
1229
1230 rvalp = alloca(rlen);
1231 bzero(rvalp, rlen);
1232 zlog.logfile = NULL;
1233 zlog.buflen = zlog.loglen = rlen - sizeof (zone_cmd_rval_t) + 1;
1234 zlog.buf = rvalp->errbuf;
1235 zlog.log = zlog.buf;
1236 /* defer initialization of zlog.locale until after credential check */
1237 zlogp = &zlog;
1238
1239 if (alen != sizeof (zone_cmd_arg_t)) {
1240 /*
1241 * This really shouldn't be happening.
1242 */
1243 zerror(&logsys, B_FALSE, "argument size (%d bytes) "
1244 "unexpected (expected %d bytes)", alen,
1245 sizeof (zone_cmd_arg_t));
1246 goto out;
1247 }
1248 cmd = zargp->cmd;
1249
1250 if (door_ucred(&uc) != 0) {
1251 zerror(&logsys, B_TRUE, "door_ucred");
1252 goto out;
1253 }
1254 eset = ucred_getprivset(uc, PRIV_EFFECTIVE);
1255 if (ucred_getzoneid(uc) != GLOBAL_ZONEID ||
1256 (eset != NULL ? !priv_ismember(eset, PRIV_SYS_CONFIG) :
1257 ucred_geteuid(uc) != 0)) {
1258 zerror(&logsys, B_FALSE, "insufficient privileges");
1259 goto out;
1260 }
1261
1262 kernelcall = ucred_getpid(uc) == 0;
1263
1264 /*
1265 * This is safe because we only use a zlog_t throughout the
1266 * duration of a door call; i.e., by the time the pointer
1267 * might become invalid, the door call would be over.
1268 */
1269 zlog.locale = kernelcall ? DEFAULT_LOCALE : zargp->locale;
1270
1271 (void) mutex_lock(&lock);
1272
1273 /*
1274 * Once we start to really die off, we don't want more connections.
1275 */
1276 if (in_death_throes) {
1277 (void) mutex_unlock(&lock);
1278 ucred_free(uc);
1279 (void) door_return(NULL, 0, 0, 0);
1280 thr_exit(NULL);
1281 }
1282
1283 /*
1284 * Check for validity of command.
1285 */
1286 if (cmd != Z_READY && cmd != Z_BOOT && cmd != Z_FORCEBOOT &&
1287 cmd != Z_REBOOT && cmd != Z_SHUTDOWN && cmd != Z_HALT &&
1288 cmd != Z_NOTE_UNINSTALLING && cmd != Z_MOUNT &&
1289 cmd != Z_FORCEMOUNT && cmd != Z_UNMOUNT) {
1290 zerror(&logsys, B_FALSE, "invalid command %d", (int)cmd);
1291 goto out;
1292 }
1293
1294 if (kernelcall && (cmd != Z_HALT && cmd != Z_REBOOT)) {
1295 /*
1296 * Can't happen
1297 */
1298 zerror(&logsys, B_FALSE, "received unexpected kernel upcall %d",
1299 cmd);
1300 goto out;
1301 }
1302 /*
1303 * We ignore the possibility of someone calling zone_create(2)
1304 * explicitly; all requests must come through zoneadmd.
1305 */
1306 if (zone_get_state(zone_name, &zstate) != Z_OK) {
1307 /*
1308 * Something terribly wrong happened
1309 */
1310 zerror(&logsys, B_FALSE, "unable to determine state of zone");
1311 goto out;
1312 }
1313
1314 if (kernelcall) {
1315 /*
1316 * Kernel-initiated requests may lose their validity if the
1317 * zone_t the kernel was referring to has gone away.
1318 */
1319 if ((zoneid = getzoneidbyname(zone_name)) == -1 ||
1320 zone_getattr(zoneid, ZONE_ATTR_UNIQID, &uniqid,
1321 sizeof (uniqid)) == -1 || uniqid != zargp->uniqid) {
1322 /*
1323 * We're not talking about the same zone. The request
1324 * must have arrived too late. Return error.
1325 */
1326 rval = -1;
1327 goto out;
1328 }
1329 zlogp = &logsys; /* Log errors to syslog */
1330 }
1331
1332 /*
1333 * If we are being asked to forcibly mount or boot a zone, we
1334 * pretend that an INCOMPLETE zone is actually INSTALLED.
1335 */
1336 if (zstate == ZONE_STATE_INCOMPLETE &&
1337 (cmd == Z_FORCEBOOT || cmd == Z_FORCEMOUNT))
1338 zstate = ZONE_STATE_INSTALLED;
1339
1340 switch (zstate) {
1341 case ZONE_STATE_CONFIGURED:
1342 case ZONE_STATE_INCOMPLETE:
1343 /*
1344 * Not our area of expertise; we just print a nice message
1345 * and die off.
1346 */
1347 zerror(zlogp, B_FALSE,
1348 "%s operation is invalid for zones in state '%s'",
1349 z_cmd_name(cmd), zone_state_str(zstate));
1350 break;
1351
1352 case ZONE_STATE_INSTALLED:
1353 switch (cmd) {
1354 case Z_READY:
1355 rval = zone_ready(zlogp, Z_MNT_BOOT, zstate);
1356 if (rval == 0)
1357 eventstream_write(Z_EVT_ZONE_READIED);
1358 break;
1359 case Z_BOOT:
1360 case Z_FORCEBOOT:
1361 eventstream_write(Z_EVT_ZONE_BOOTING);
1362 if ((rval = zone_ready(zlogp, Z_MNT_BOOT, zstate))
1363 == 0) {
1364 rval = zone_bootup(zlogp, zargp->bootbuf,
1365 zstate);
1366 }
1367 audit_put_record(zlogp, uc, rval, "boot");
1368 if (rval != 0) {
1369 bringup_failure_recovery = B_TRUE;
1370 (void) zone_halt(zlogp, B_FALSE, B_FALSE,
1371 zstate);
1372 eventstream_write(Z_EVT_ZONE_BOOTFAILED);
1373 }
1374 break;
1375 case Z_SHUTDOWN:
1376 case Z_HALT:
1377 if (kernelcall) /* Invalid; can't happen */
1378 abort();
1379 /*
1380 * We could have two clients racing to halt this
1381 * zone; the second client loses, but his request
1382 * doesn't fail, since the zone is now in the desired
1383 * state.
1384 */
1385 zerror(zlogp, B_FALSE, "zone is already halted");
1386 rval = 0;
1387 break;
1388 case Z_REBOOT:
1389 if (kernelcall) /* Invalid; can't happen */
1390 abort();
1391 zerror(zlogp, B_FALSE, "%s operation is invalid "
1392 "for zones in state '%s'", z_cmd_name(cmd),
1393 zone_state_str(zstate));
1394 rval = -1;
1395 break;
1396 case Z_NOTE_UNINSTALLING:
1397 if (kernelcall) /* Invalid; can't happen */
1398 abort();
1399 /*
1400 * Tell the console to print out a message about this.
1401 * Once it does, we will be in_death_throes.
1402 */
1403 eventstream_write(Z_EVT_ZONE_UNINSTALLING);
1404 break;
1405 case Z_MOUNT:
1406 case Z_FORCEMOUNT:
1407 if (kernelcall) /* Invalid; can't happen */
1408 abort();
1409 if (!zone_isnative && !zone_iscluster &&
1410 !zone_islabeled) {
1411 /*
1412 * -U mounts the zone without lofs mounting
1413 * zone file systems back into the scratch
1414 * zone. This is required when mounting
1415 * non-native branded zones.
1416 */
1417 (void) strlcpy(zargp->bootbuf, "-U",
1418 BOOTARGS_MAX);
1419 }
1420
1421 rval = zone_ready(zlogp,
1422 strcmp(zargp->bootbuf, "-U") == 0 ?
1423 Z_MNT_UPDATE : Z_MNT_SCRATCH, zstate);
1424 if (rval != 0)
1425 break;
1426
1427 eventstream_write(Z_EVT_ZONE_READIED);
1428
1429 /*
1430 * Get a handle to the default brand info.
1431 * We must always use the default brand file system
1432 * list when mounting the zone.
1433 */
1434 if ((bh = brand_open(default_brand)) == NULL) {
1435 rval = -1;
1436 break;
1437 }
1438
1439 /*
1440 * Get the list of filesystems to mount from
1441 * the brand configuration. These mounts are done
1442 * via a thread that will enter the zone, so they
1443 * are done from within the context of the zone.
1444 */
1445 cb.zlogp = zlogp;
1446 cb.zoneid = zone_id;
1447 cb.mount_cmd = B_TRUE;
1448 rval = brand_platform_iter_mounts(bh,
1449 mount_early_fs, &cb);
1450
1451 brand_close(bh);
1452
1453 /*
1454 * Ordinarily, /dev/fd would be mounted inside the zone
1455 * by svc:/system/filesystem/usr:default, but since
1456 * we're not booting the zone, we need to do this
1457 * manually.
1458 */
1459 if (rval == 0)
1460 rval = mount_early_fs(&cb,
1461 "fd", "/dev/fd", "fd", NULL);
1462 break;
1463 case Z_UNMOUNT:
1464 if (kernelcall) /* Invalid; can't happen */
1465 abort();
1466 zerror(zlogp, B_FALSE, "zone is already unmounted");
1467 rval = 0;
1468 break;
1469 }
1470 break;
1471
1472 case ZONE_STATE_READY:
1473 switch (cmd) {
1474 case Z_READY:
1475 /*
1476 * We could have two clients racing to ready this
1477 * zone; the second client loses, but his request
1478 * doesn't fail, since the zone is now in the desired
1479 * state.
1480 */
1481 zerror(zlogp, B_FALSE, "zone is already ready");
1482 rval = 0;
1483 break;
1484 case Z_BOOT:
1485 case Z_FORCEBOOT:
1486 (void) strlcpy(boot_args, zargp->bootbuf,
1487 sizeof (boot_args));
1488 eventstream_write(Z_EVT_ZONE_BOOTING);
1489 rval = zone_bootup(zlogp, zargp->bootbuf, zstate);
1490 audit_put_record(zlogp, uc, rval, "boot");
1491 if (rval != 0) {
1492 bringup_failure_recovery = B_TRUE;
1493 (void) zone_halt(zlogp, B_FALSE, B_TRUE,
1494 zstate);
1495 eventstream_write(Z_EVT_ZONE_BOOTFAILED);
1496 }
1497 boot_args[0] = '\0';
1498 break;
1499 case Z_HALT:
1500 if (kernelcall) /* Invalid; can't happen */
1501 abort();
1502 if ((rval = zone_halt(zlogp, B_FALSE, B_FALSE, zstate))
1503 != 0)
1504 break;
1505 eventstream_write(Z_EVT_ZONE_HALTED);
1506 break;
1507 case Z_SHUTDOWN:
1508 case Z_REBOOT:
1509 case Z_NOTE_UNINSTALLING:
1510 case Z_MOUNT:
1511 case Z_FORCEMOUNT:
1512 case Z_UNMOUNT:
1513 if (kernelcall) /* Invalid; can't happen */
1514 abort();
1515 zerror(zlogp, B_FALSE, "%s operation is invalid "
1516 "for zones in state '%s'", z_cmd_name(cmd),
1517 zone_state_str(zstate));
1518 rval = -1;
1519 break;
1520 }
1521 break;
1522
1523 case ZONE_STATE_MOUNTED:
1524 switch (cmd) {
1525 case Z_UNMOUNT:
1526 if (kernelcall) /* Invalid; can't happen */
1527 abort();
1528 rval = zone_halt(zlogp, B_TRUE, B_FALSE, zstate);
1529 if (rval == 0) {
1530 eventstream_write(Z_EVT_ZONE_HALTED);
1531 (void) sema_post(&scratch_sem);
1532 }
1533 break;
1534 default:
1535 if (kernelcall) /* Invalid; can't happen */
1536 abort();
1537 zerror(zlogp, B_FALSE, "%s operation is invalid "
1538 "for zones in state '%s'", z_cmd_name(cmd),
1539 zone_state_str(zstate));
1540 rval = -1;
1541 break;
1542 }
1543 break;
1544
1545 case ZONE_STATE_RUNNING:
1546 case ZONE_STATE_SHUTTING_DOWN:
1547 case ZONE_STATE_DOWN:
1548 switch (cmd) {
1549 case Z_READY:
1550 if ((rval = zone_halt(zlogp, B_FALSE, B_TRUE, zstate))
1551 != 0)
1552 break;
1553 if ((rval = zone_ready(zlogp, Z_MNT_BOOT, zstate)) == 0)
1554 eventstream_write(Z_EVT_ZONE_READIED);
1555 else
1556 eventstream_write(Z_EVT_ZONE_HALTED);
1557 break;
1558 case Z_BOOT:
1559 case Z_FORCEBOOT:
1560 /*
1561 * We could have two clients racing to boot this
1562 * zone; the second client loses, but his request
1563 * doesn't fail, since the zone is now in the desired
1564 * state.
1565 */
1566 zerror(zlogp, B_FALSE, "zone is already booted");
1567 rval = 0;
1568 break;
1569 case Z_HALT:
1570 if ((rval = zone_halt(zlogp, B_FALSE, B_FALSE, zstate))
1571 != 0)
1572 break;
1573 eventstream_write(Z_EVT_ZONE_HALTED);
1574 break;
1575 case Z_REBOOT:
1576 (void) strlcpy(boot_args, zargp->bootbuf,
1577 sizeof (boot_args));
1578 eventstream_write(Z_EVT_ZONE_REBOOTING);
1579 if ((rval = zone_halt(zlogp, B_FALSE, B_TRUE, zstate))
1580 != 0) {
1581 eventstream_write(Z_EVT_ZONE_BOOTFAILED);
1582 boot_args[0] = '\0';
1583 break;
1584 }
1585 if ((rval = zone_ready(zlogp, Z_MNT_BOOT, zstate))
1586 != 0) {
1587 eventstream_write(Z_EVT_ZONE_BOOTFAILED);
1588 boot_args[0] = '\0';
1589 break;
1590 }
1591 rval = zone_bootup(zlogp, zargp->bootbuf, zstate);
1592 audit_put_record(zlogp, uc, rval, "reboot");
1593 if (rval != 0) {
1594 (void) zone_halt(zlogp, B_FALSE, B_TRUE,
1595 zstate);
1596 eventstream_write(Z_EVT_ZONE_BOOTFAILED);
1597 }
1598 boot_args[0] = '\0';
1599 break;
1600 case Z_SHUTDOWN:
1601 if ((rval = zone_graceful_shutdown(zlogp)) == 0) {
1602 wait_shut = B_TRUE;
1603 }
1604 break;
1605 case Z_NOTE_UNINSTALLING:
1606 case Z_MOUNT:
1607 case Z_FORCEMOUNT:
1608 case Z_UNMOUNT:
1609 zerror(zlogp, B_FALSE, "%s operation is invalid "
1610 "for zones in state '%s'", z_cmd_name(cmd),
1611 zone_state_str(zstate));
1612 rval = -1;
1613 break;
1614 }
1615 break;
1616 default:
1617 abort();
1618 }
1619
1620 /*
1621 * Because the state of the zone may have changed, we make sure
1622 * to wake the console poller, which is in charge of initiating
1623 * the shutdown procedure as necessary.
1624 */
1625 eventstream_write(Z_EVT_NULL);
1626
1627 out:
1628 (void) mutex_unlock(&lock);
1629
1630 /* Wait for the Z_SHUTDOWN commands to complete */
1631 if (wait_shut)
1632 rval = zone_wait_shutdown(zlogp);
1633
1634 if (kernelcall) {
1635 rvalp = NULL;
1636 rlen = 0;
1637 } else {
1638 rvalp->rval = rval;
1639 }
1640 if (uc != NULL)
1641 ucred_free(uc);
1642 (void) door_return((char *)rvalp, rlen, NULL, 0);
1643 thr_exit(NULL);
1644 }
1645
1646 static int
1647 setup_door(zlog_t *zlogp)
1648 {
1649 if ((zone_door = door_create(server, NULL,
1650 DOOR_UNREF | DOOR_REFUSE_DESC | DOOR_NO_CANCEL)) < 0) {
1651 zerror(zlogp, B_TRUE, "%s failed", "door_create");
1652 return (-1);
1653 }
1654 (void) fdetach(zone_door_path);
1655
1656 if (fattach(zone_door, zone_door_path) != 0) {
1657 zerror(zlogp, B_TRUE, "fattach to %s failed", zone_door_path);
1658 (void) door_revoke(zone_door);
1659 (void) fdetach(zone_door_path);
1660 zone_door = -1;
1661 return (-1);
1662 }
1663 return (0);
1664 }
1665
1666 /*
1667 * zoneadm(1m) will start zoneadmd if it thinks it isn't running; this
1668 * is where zoneadmd itself will check to see that another instance of
1669 * zoneadmd isn't already controlling this zone.
1670 *
1671 * The idea here is that we want to open the path to which we will
1672 * attach our door, lock it, and then make sure that no-one has beat us
1673 * to fattach(3c)ing onto it.
1674 *
1675 * fattach(3c) is really a mount, so there are actually two possible
1676 * vnodes we could be dealing with. Our strategy is as follows:
1677 *
1678 * - If the file we opened is a regular file (common case):
1679 * There is no fattach(3c)ed door, so we have a chance of becoming
1680 * the managing zoneadmd. We attempt to lock the file: if it is
1681 * already locked, that means someone else raced us here, so we
1682 * lose and give up. zoneadm(1m) will try to contact the zoneadmd
1683 * that beat us to it.
1684 *
1685 * - If the file we opened is a namefs file:
1686 * This means there is already an established door fattach(3c)'ed
1687 * to the rendezvous path. We've lost the race, so we give up.
1688 * Note that in this case we also try to grab the file lock, and
1689 * will succeed in acquiring it since the vnode locked by the
1690 * "winning" zoneadmd was a regular one, and the one we locked was
1691 * the fattach(3c)'ed door node. At any rate, no harm is done, and
1692 * we just return to zoneadm(1m) which knows to retry.
1693 */
1694 static int
1695 make_daemon_exclusive(zlog_t *zlogp)
1696 {
1697 int doorfd = -1;
1698 int err, ret = -1;
1699 struct stat st;
1700 struct flock flock;
1701 zone_state_t zstate;
1702
1703 top:
1704 if ((err = zone_get_state(zone_name, &zstate)) != Z_OK) {
1705 zerror(zlogp, B_FALSE, "failed to get zone state: %s",
1706 zonecfg_strerror(err));
1707 goto out;
1708 }
1709 if ((doorfd = open(zone_door_path, O_CREAT|O_RDWR,
1710 S_IREAD|S_IWRITE)) < 0) {
1711 zerror(zlogp, B_TRUE, "failed to open %s", zone_door_path);
1712 goto out;
1713 }
1714 if (fstat(doorfd, &st) < 0) {
1715 zerror(zlogp, B_TRUE, "failed to stat %s", zone_door_path);
1716 goto out;
1717 }
1718 /*
1719 * Lock the file to synchronize with other zoneadmd
1720 */
1721 flock.l_type = F_WRLCK;
1722 flock.l_whence = SEEK_SET;
1723 flock.l_start = (off_t)0;
1724 flock.l_len = (off_t)0;
1725 if (fcntl(doorfd, F_SETLK, &flock) < 0) {
1726 /*
1727 * Someone else raced us here and grabbed the lock file
1728 * first. A warning here is inappropriate since nothing
1729 * went wrong.
1730 */
1731 goto out;
1732 }
1733
1734 if (strcmp(st.st_fstype, "namefs") == 0) {
1735 struct door_info info;
1736
1737 /*
1738 * There is already something fattach()'ed to this file.
1739 * Lets see what the door is up to.
1740 */
1741 if (door_info(doorfd, &info) == 0 && info.di_target != -1) {
1742 /*
1743 * Another zoneadmd process seems to be in
1744 * control of the situation and we don't need to
1745 * be here. A warning here is inappropriate
1746 * since nothing went wrong.
1747 *
1748 * If the door has been revoked, the zoneadmd
1749 * process currently managing the zone is going
1750 * away. We'll return control to zoneadm(1m)
1751 * which will try again (by which time zoneadmd
1752 * will hopefully have exited).
1753 */
1754 goto out;
1755 }
1756
1757 /*
1758 * If we got this far, there's a fattach(3c)'ed door
1759 * that belongs to a process that has exited, which can
1760 * happen if the previous zoneadmd died unexpectedly.
1761 *
1762 * Let user know that something is amiss, but that we can
1763 * recover; if the zone is in the installed state, then don't
1764 * message, since having a running zoneadmd isn't really
1765 * expected/needed. We want to keep occurences of this message
1766 * limited to times when zoneadmd is picking back up from a
1767 * zoneadmd that died while the zone was in some non-trivial
1768 * state.
1769 */
1770 if (zstate > ZONE_STATE_INSTALLED) {
1771 zerror(zlogp, B_FALSE,
1772 "zone '%s': WARNING: zone is in state '%s', but "
1773 "zoneadmd does not appear to be available; "
1774 "restarted zoneadmd to recover.",
1775 zone_name, zone_state_str(zstate));
1776 }
1777
1778 (void) fdetach(zone_door_path);
1779 (void) close(doorfd);
1780 goto top;
1781 }
1782 ret = 0;
1783 out:
1784 (void) close(doorfd);
1785 return (ret);
1786 }
1787
1788 /*
1789 * Setup the brand's pre and post state change callbacks, as well as the
1790 * query callback, if any of these exist.
1791 */
1792 static int
1793 brand_callback_init(brand_handle_t bh, char *zone_name)
1794 {
1795 char zpath[MAXPATHLEN];
1796
1797 if (zone_get_zonepath(zone_name, zpath, sizeof (zpath)) != Z_OK)
1798 return (-1);
1799
1800 (void) strlcpy(pre_statechg_hook, EXEC_PREFIX,
1801 sizeof (pre_statechg_hook));
1802
1803 if (brand_get_prestatechange(bh, zone_name, zpath,
1804 pre_statechg_hook + EXEC_LEN,
1805 sizeof (pre_statechg_hook) - EXEC_LEN) != 0)
1806 return (-1);
1807
1808 if (strlen(pre_statechg_hook) <= EXEC_LEN)
1809 pre_statechg_hook[0] = '\0';
1810
1811 (void) strlcpy(post_statechg_hook, EXEC_PREFIX,
1812 sizeof (post_statechg_hook));
1813
1814 if (brand_get_poststatechange(bh, zone_name, zpath,
1815 post_statechg_hook + EXEC_LEN,
1816 sizeof (post_statechg_hook) - EXEC_LEN) != 0)
1817 return (-1);
1818
1819 if (strlen(post_statechg_hook) <= EXEC_LEN)
1820 post_statechg_hook[0] = '\0';
1821
1822 (void) strlcpy(query_hook, EXEC_PREFIX,
1823 sizeof (query_hook));
1824
1825 if (brand_get_query(bh, zone_name, zpath, query_hook + EXEC_LEN,
1826 sizeof (query_hook) - EXEC_LEN) != 0)
1827 return (-1);
1828
1829 if (strlen(query_hook) <= EXEC_LEN)
1830 query_hook[0] = '\0';
1831
1832 return (0);
1833 }
1834
1835 int
1836 main(int argc, char *argv[])
1837 {
1838 int opt;
1839 zoneid_t zid;
1840 priv_set_t *privset;
1841 zone_state_t zstate;
1842 char parents_locale[MAXPATHLEN];
1843 brand_handle_t bh;
1844 int err;
1845
1846 pid_t pid;
1847 sigset_t blockset;
1848 sigset_t block_cld;
1849
1850 struct {
1851 sema_t sem;
1852 int status;
1853 zlog_t log;
1854 } *shstate;
1855 size_t shstatelen = getpagesize();
1856
1857 zlog_t errlog;
1858 zlog_t *zlogp;
1859
1860 int ctfd;
1861
1862 progname = get_execbasename(argv[0]);
1863
1864 /*
1865 * Make sure stderr is unbuffered
1866 */
1867 (void) setbuffer(stderr, NULL, 0);
1868
1869 /*
1870 * Get out of the way of mounted filesystems, since we will daemonize
1871 * soon.
1872 */
1873 (void) chdir("/");
1874
1875 /*
1876 * Use the default system umask per PSARC 1998/110 rather than
1877 * anything that may have been set by the caller.
1878 */
1879 (void) umask(CMASK);
1880
1881 /*
1882 * Initially we want to use our parent's locale.
1883 */
1884 (void) setlocale(LC_ALL, "");
1885 (void) textdomain(TEXT_DOMAIN);
1886 (void) strlcpy(parents_locale, setlocale(LC_MESSAGES, NULL),
1887 sizeof (parents_locale));
1888
1889 /*
1890 * This zlog_t is used for writing to stderr
1891 */
1892 errlog.logfile = stderr;
1893 errlog.buflen = errlog.loglen = 0;
1894 errlog.buf = errlog.log = NULL;
1895 errlog.locale = parents_locale;
1896
1897 /*
1898 * We start off writing to stderr until we're ready to daemonize.
1899 */
1900 zlogp = &errlog;
1901
1902 /*
1903 * Process options.
1904 */
1905 while ((opt = getopt(argc, argv, "R:z:")) != EOF) {
1906 switch (opt) {
1907 case 'R':
1908 zonecfg_set_root(optarg);
1909 break;
1910 case 'z':
1911 zone_name = optarg;
1912 break;
1913 default:
1914 usage();
1915 }
1916 }
1917
1918 if (zone_name == NULL)
1919 usage();
1920
1921 /*
1922 * Because usage() prints directly to stderr, it has gettext()
1923 * wrapping, which depends on the locale. But since zerror() calls
1924 * localize() which tweaks the locale, it is not safe to call zerror()
1925 * until after the last call to usage(). Fortunately, the last call
1926 * to usage() is just above and the first call to zerror() is just
1927 * below. Don't mess this up.
1928 */
1929 if (strcmp(zone_name, GLOBAL_ZONENAME) == 0) {
1930 zerror(zlogp, B_FALSE, "cannot manage the %s zone",
1931 GLOBAL_ZONENAME);
1932 return (1);
1933 }
1934
1935 if (zone_get_id(zone_name, &zid) != 0) {
1936 zerror(zlogp, B_FALSE, "could not manage %s: %s", zone_name,
1937 zonecfg_strerror(Z_NO_ZONE));
1938 return (1);
1939 }
1940
1941 if ((err = zone_get_state(zone_name, &zstate)) != Z_OK) {
1942 zerror(zlogp, B_FALSE, "failed to get zone state: %s",
1943 zonecfg_strerror(err));
1944 return (1);
1945 }
1946 if (zstate < ZONE_STATE_INCOMPLETE) {
1947 zerror(zlogp, B_FALSE,
1948 "cannot manage a zone which is in state '%s'",
1949 zone_state_str(zstate));
1950 return (1);
1951 }
1952
1953 if (zonecfg_default_brand(default_brand,
1954 sizeof (default_brand)) != Z_OK) {
1955 zerror(zlogp, B_FALSE, "unable to determine default brand");
1956 return (1);
1957 }
1958
1959 /* Get a handle to the brand info for this zone */
1960 if (zone_get_brand(zone_name, brand_name, sizeof (brand_name))
1961 != Z_OK) {
1962 zerror(zlogp, B_FALSE, "unable to determine zone brand");
1963 return (1);
1964 }
1965 zone_isnative = (strcmp(brand_name, NATIVE_BRAND_NAME) == 0);
1966 zone_islabeled = (strcmp(brand_name, LABELED_BRAND_NAME) == 0);
1967
1968 /*
1969 * In the alternate root environment, the only supported
1970 * operations are mount and unmount. In this case, just treat
1971 * the zone as native if it is cluster. Cluster zones can be
1972 * native for the purpose of LU or upgrade, and the cluster
1973 * brand may not exist in the miniroot (such as in net install
1974 * upgrade).
1975 */
1976 if (strcmp(brand_name, CLUSTER_BRAND_NAME) == 0) {
1977 zone_iscluster = B_TRUE;
1978 if (zonecfg_in_alt_root()) {
1979 (void) strlcpy(brand_name, default_brand,
1980 sizeof (brand_name));
1981 }
1982 } else {
1983 zone_iscluster = B_FALSE;
1984 }
1985
1986 if ((bh = brand_open(brand_name)) == NULL) {
1987 zerror(zlogp, B_FALSE, "unable to open zone brand");
1988 return (1);
1989 }
1990
1991 /* Get state change brand hooks. */
1992 if (brand_callback_init(bh, zone_name) == -1) {
1993 zerror(zlogp, B_TRUE,
1994 "failed to initialize brand state change hooks");
1995 brand_close(bh);
1996 return (1);
1997 }
1998
1999 brand_close(bh);
2000
2001 /*
2002 * Check that we have all privileges. It would be nice to pare
2003 * this down, but this is at least a first cut.
2004 */
2005 if ((privset = priv_allocset()) == NULL) {
2006 zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
2007 return (1);
2008 }
2009
2010 if (getppriv(PRIV_EFFECTIVE, privset) != 0) {
2011 zerror(zlogp, B_TRUE, "%s failed", "getppriv");
2012 priv_freeset(privset);
2013 return (1);
2014 }
2015
2016 if (priv_isfullset(privset) == B_FALSE) {
2017 zerror(zlogp, B_FALSE, "You lack sufficient privilege to "
2018 "run this command (all privs required)");
2019 priv_freeset(privset);
2020 return (1);
2021 }
2022 priv_freeset(privset);
2023
2024 if (mkzonedir(zlogp) != 0)
2025 return (1);
2026
2027 /*
2028 * Pre-fork: setup shared state
2029 */
2030 if ((shstate = (void *)mmap(NULL, shstatelen,
2031 PROT_READ|PROT_WRITE, MAP_SHARED|MAP_ANON, -1, (off_t)0)) ==
2032 MAP_FAILED) {
2033 zerror(zlogp, B_TRUE, "%s failed", "mmap");
2034 return (1);
2035 }
2036 if (sema_init(&shstate->sem, 0, USYNC_PROCESS, NULL) != 0) {
2037 zerror(zlogp, B_TRUE, "%s failed", "sema_init()");
2038 (void) munmap((char *)shstate, shstatelen);
2039 return (1);
2040 }
2041 shstate->log.logfile = NULL;
2042 shstate->log.buflen = shstatelen - sizeof (*shstate);
2043 shstate->log.loglen = shstate->log.buflen;
2044 shstate->log.buf = (char *)shstate + sizeof (*shstate);
2045 shstate->log.log = shstate->log.buf;
2046 shstate->log.locale = parents_locale;
2047 shstate->status = -1;
2048
2049 /*
2050 * We need a SIGCHLD handler so the sema_wait() below will wake
2051 * up if the child dies without doing a sema_post().
2052 */
2053 (void) sigset(SIGCHLD, sigchld);
2054 /*
2055 * We must mask SIGCHLD until after we've coped with the fork
2056 * sufficiently to deal with it; otherwise we can race and
2057 * receive the signal before pid has been initialized
2058 * (yes, this really happens).
2059 */
2060 (void) sigemptyset(&block_cld);
2061 (void) sigaddset(&block_cld, SIGCHLD);
2062 (void) sigprocmask(SIG_BLOCK, &block_cld, NULL);
2063
2064 if ((ctfd = init_template()) == -1) {
2065 zerror(zlogp, B_TRUE, "failed to create contract");
2066 return (1);
2067 }
2068
2069 /*
2070 * Do not let another thread localize a message while we are forking.
2071 */
2072 (void) mutex_lock(&msglock);
2073 pid = fork();
2074 (void) mutex_unlock(&msglock);
2075
2076 /*
2077 * In all cases (parent, child, and in the event of an error) we
2078 * don't want to cause creation of contracts on subsequent fork()s.
2079 */
2080 (void) ct_tmpl_clear(ctfd);
2081 (void) close(ctfd);
2082
2083 if (pid == -1) {
2084 zerror(zlogp, B_TRUE, "could not fork");
2085 return (1);
2086
2087 } else if (pid > 0) { /* parent */
2088 (void) sigprocmask(SIG_UNBLOCK, &block_cld, NULL);
2089 /*
2090 * This marks a window of vulnerability in which we receive
2091 * the SIGCLD before falling into sema_wait (normally we would
2092 * get woken up from sema_wait with EINTR upon receipt of
2093 * SIGCLD). So we may need to use some other scheme like
2094 * sema_posting in the sigcld handler.
2095 * blech
2096 */
2097 (void) sema_wait(&shstate->sem);
2098 (void) sema_destroy(&shstate->sem);
2099 if (shstate->status != 0)
2100 (void) waitpid(pid, NULL, WNOHANG);
2101 /*
2102 * It's ok if we die with SIGPIPE. It's not like we could have
2103 * done anything about it.
2104 */
2105 (void) fprintf(stderr, "%s", shstate->log.buf);
2106 _exit(shstate->status == 0 ? 0 : 1);
2107 }
2108
2109 /*
2110 * The child charges on.
2111 */
2112 (void) sigset(SIGCHLD, SIG_DFL);
2113 (void) sigprocmask(SIG_UNBLOCK, &block_cld, NULL);
2114
2115 /*
2116 * SIGPIPE can be delivered if we write to a socket for which the
2117 * peer endpoint is gone. That can lead to too-early termination
2118 * of zoneadmd, and that's not good eats.
2119 */
2120 (void) sigset(SIGPIPE, SIG_IGN);
2121 /*
2122 * Stop using stderr
2123 */
2124 zlogp = &shstate->log;
2125
2126 /*
2127 * We don't need stdout/stderr from now on.
2128 */
2129 closefrom(0);
2130
2131 /*
2132 * Initialize the syslog zlog_t. This needs to be done after
2133 * the call to closefrom().
2134 */
2135 logsys.buf = logsys.log = NULL;
2136 logsys.buflen = logsys.loglen = 0;
2137 logsys.logfile = NULL;
2138 logsys.locale = DEFAULT_LOCALE;
2139
2140 openlog("zoneadmd", LOG_PID, LOG_DAEMON);
2141
2142 /*
2143 * The eventstream is used to publish state changes in the zone
2144 * from the door threads to the console I/O poller.
2145 */
2146 if (eventstream_init() == -1) {
2147 zerror(zlogp, B_TRUE, "unable to create eventstream");
2148 goto child_out;
2149 }
2150
2151 (void) snprintf(zone_door_path, sizeof (zone_door_path),
2152 "%s" ZONE_DOOR_PATH, zonecfg_get_root(), zone_name);
2153
2154 /*
2155 * See if another zoneadmd is running for this zone. If not, then we
2156 * can now modify system state.
2157 */
2158 if (make_daemon_exclusive(zlogp) == -1)
2159 goto child_out;
2160
2161
2162 /*
2163 * Create/join a new session; we need to be careful of what we do with
2164 * the console from now on so we don't end up being the session leader
2165 * for the terminal we're going to be handing out.
2166 */
2167 (void) setsid();
2168
2169 /*
2170 * This thread shouldn't be receiving any signals; in particular,
2171 * SIGCHLD should be received by the thread doing the fork().
2172 */
2173 (void) sigfillset(&blockset);
2174 (void) thr_sigsetmask(SIG_BLOCK, &blockset, NULL);
2175
2176 /*
2177 * Setup the console device and get ready to serve the console;
2178 * once this has completed, we're ready to let console clients
2179 * make an attempt to connect (they will block until
2180 * serve_console_sock() below gets called, and any pending
2181 * connection is accept()ed).
2182 */
2183 if (!zonecfg_in_alt_root() && init_console(zlogp) < 0)
2184 goto child_out;
2185
2186 /*
2187 * Take the lock now, so that when the door server gets going, we
2188 * are guaranteed that it won't take a request until we are sure
2189 * that everything is completely set up. See the child_out: label
2190 * below to see why this matters.
2191 */
2192 (void) mutex_lock(&lock);
2193
2194 /* Init semaphore for scratch zones. */
2195 if (sema_init(&scratch_sem, 0, USYNC_THREAD, NULL) == -1) {
2196 zerror(zlogp, B_TRUE,
2197 "failed to initialize semaphore for scratch zone");
2198 goto child_out;
2199 }
2200
2201 /* open the dladm handle */
2202 if (dladm_open(&dld_handle) != DLADM_STATUS_OK) {
2203 zerror(zlogp, B_FALSE, "failed to open dladm handle");
2204 goto child_out;
2205 }
2206
2207 /*
2208 * Note: door setup must occur *after* the console is setup.
2209 * This is so that as zlogin tests the door to see if zoneadmd
2210 * is ready yet, we know that the console will get serviced
2211 * once door_info() indicates that the door is "up".
2212 */
2213 if (setup_door(zlogp) == -1)
2214 goto child_out;
2215
2216 /*
2217 * Things seem OK so far; tell the parent process that we're done
2218 * with setup tasks. This will cause the parent to exit, signalling
2219 * to zoneadm, zlogin, or whatever forked it that we are ready to
2220 * service requests.
2221 */
2222 shstate->status = 0;
2223 (void) sema_post(&shstate->sem);
2224 (void) munmap((char *)shstate, shstatelen);
2225 shstate = NULL;
2226
2227 (void) mutex_unlock(&lock);
2228
2229 /*
2230 * zlogp is now invalid, so reset it to the syslog logger.
2231 */
2232 zlogp = &logsys;
2233
2234 /*
2235 * Now that we are free of any parents, switch to the default locale.
2236 */
2237 (void) setlocale(LC_ALL, DEFAULT_LOCALE);
2238
2239 /*
2240 * At this point the setup portion of main() is basically done, so
2241 * we reuse this thread to manage the zone console. When
2242 * serve_console() has returned, we are past the point of no return
2243 * in the life of this zoneadmd.
2244 */
2245 if (zonecfg_in_alt_root()) {
2246 /*
2247 * This is just awful, but mounted scratch zones don't (and
2248 * can't) have consoles. We just wait for unmount instead.
2249 */
2250 while (sema_wait(&scratch_sem) == EINTR)
2251 ;
2252 } else {
2253 serve_console(zlogp);
2254 assert(in_death_throes);
2255 }
2256
2257 /*
2258 * This is the next-to-last part of the exit interlock. Upon calling
2259 * fdetach(), the door will go unreferenced; once any
2260 * outstanding requests (like the door thread doing Z_HALT) are
2261 * done, the door will get an UNREF notification; when it handles
2262 * the UNREF, the door server will cause the exit. It's possible
2263 * that fdetach() can fail because the file is in use, in which
2264 * case we'll retry the operation.
2265 */
2266 assert(!MUTEX_HELD(&lock));
2267 for (;;) {
2268 if ((fdetach(zone_door_path) == 0) || (errno != EBUSY))
2269 break;
2270 yield();
2271 }
2272
2273 for (;;)
2274 (void) pause();
2275
2276 child_out:
2277 assert(pid == 0);
2278 if (shstate != NULL) {
2279 shstate->status = -1;
2280 (void) sema_post(&shstate->sem);
2281 (void) munmap((char *)shstate, shstatelen);
2282 }
2283
2284 /*
2285 * This might trigger an unref notification, but if so,
2286 * we are still holding the lock, so our call to exit will
2287 * ultimately win the race and will publish the right exit
2288 * code.
2289 */
2290 if (zone_door != -1) {
2291 assert(MUTEX_HELD(&lock));
2292 (void) door_revoke(zone_door);
2293 (void) fdetach(zone_door_path);
2294 }
2295
2296 if (dld_handle != NULL)
2297 dladm_close(dld_handle);
2298
2299 return (1); /* return from main() forcibly exits an MT process */
2300 }