1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Copyright (c) 2012, Joyent Inc. All rights reserved.
  25  */
  26 
  27 /*
  28  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  29  */
  30 
  31 /*
  32  * This module contains functions used to bring up and tear down the
  33  * Virtual Platform: [un]mounting file-systems, [un]plumbing network
  34  * interfaces, [un]configuring devices, establishing resource controls,
  35  * and creating/destroying the zone in the kernel.  These actions, on
  36  * the way up, ready the zone; on the way down, they halt the zone.
  37  * See the much longer block comment at the beginning of zoneadmd.c
  38  * for a bigger picture of how the whole program functions.
  39  *
  40  * This module also has primary responsibility for the layout of "scratch
  41  * zones."  These are mounted, but inactive, zones that are used during
  42  * operating system upgrade and potentially other administrative action.  The
  43  * scratch zone environment is similar to the miniroot environment.  The zone's
  44  * actual root is mounted read-write on /a, and the standard paths (/usr,
  45  * /sbin, /lib) all lead to read-only copies of the running system's binaries.
  46  * This allows the administrative tools to manipulate the zone using "-R /a"
  47  * without relying on any binaries in the zone itself.
  48  *
  49  * If the scratch zone is on an alternate root (Live Upgrade [LU] boot
  50  * environment), then we must resolve the lofs mounts used there to uncover
  51  * writable (unshared) resources.  Shared resources, though, are always
  52  * read-only.  In addition, if the "same" zone with a different root path is
  53  * currently running, then "/b" inside the zone points to the running zone's
  54  * root.  This allows LU to synchronize configuration files during the upgrade
  55  * process.
  56  *
  57  * To construct this environment, this module creates a tmpfs mount on
  58  * $ZONEPATH/lu.  Inside this scratch area, the miniroot-like environment as
  59  * described above is constructed on the fly.  The zone is then created using
  60  * $ZONEPATH/lu as the root.
  61  *
  62  * Note that scratch zones are inactive.  The zone's bits are not running and
  63  * likely cannot be run correctly until upgrade is done.  Init is not running
  64  * there, nor is SMF.  Because of this, the "mounted" state of a scratch zone
  65  * is not a part of the usual halt/ready/boot state machine.
  66  */
  67 
  68 #include <sys/param.h>
  69 #include <sys/mount.h>
  70 #include <sys/mntent.h>
  71 #include <sys/socket.h>
  72 #include <sys/utsname.h>
  73 #include <sys/types.h>
  74 #include <sys/stat.h>
  75 #include <sys/sockio.h>
  76 #include <sys/stropts.h>
  77 #include <sys/conf.h>
  78 #include <sys/systeminfo.h>
  79 
  80 #include <libdlpi.h>
  81 #include <libdllink.h>
  82 #include <libdlvlan.h>
  83 
  84 #include <inet/tcp.h>
  85 #include <arpa/inet.h>
  86 #include <netinet/in.h>
  87 #include <net/route.h>
  88 
  89 #include <stdio.h>
  90 #include <errno.h>
  91 #include <fcntl.h>
  92 #include <unistd.h>
  93 #include <rctl.h>
  94 #include <stdlib.h>
  95 #include <string.h>
  96 #include <strings.h>
  97 #include <wait.h>
  98 #include <limits.h>
  99 #include <libgen.h>
 100 #include <libzfs.h>
 101 #include <libdevinfo.h>
 102 #include <zone.h>
 103 #include <assert.h>
 104 #include <libcontract.h>
 105 #include <libcontract_priv.h>
 106 #include <uuid/uuid.h>
 107 
 108 #include <sys/mntio.h>
 109 #include <sys/mnttab.h>
 110 #include <sys/fs/autofs.h>        /* for _autofssys() */
 111 #include <sys/fs/lofs_info.h>
 112 #include <sys/fs/zfs.h>
 113 
 114 #include <pool.h>
 115 #include <sys/pool.h>
 116 #include <sys/priocntl.h>
 117 
 118 #include <libbrand.h>
 119 #include <sys/brand.h>
 120 #include <libzonecfg.h>
 121 #include <synch.h>
 122 
 123 #include "zoneadmd.h"
 124 #include <tsol/label.h>
 125 #include <libtsnet.h>
 126 #include <sys/priv.h>
 127 #include <libinetutil.h>
 128 
 129 #define V4_ADDR_LEN     32
 130 #define V6_ADDR_LEN     128
 131 
 132 #define RESOURCE_DEFAULT_OPTS \
 133         MNTOPT_RO "," MNTOPT_LOFS_NOSUB "," MNTOPT_NODEVICES
 134 
 135 #define DFSTYPES        "/etc/dfs/fstypes"
 136 #define MAXTNZLEN       2048
 137 
 138 #define ALT_MOUNT(mount_cmd)    ((mount_cmd) != Z_MNT_BOOT)
 139 
 140 /* a reasonable estimate for the number of lwps per process */
 141 #define LWPS_PER_PROCESS        10
 142 
 143 /* for routing socket */
 144 static int rts_seqno = 0;
 145 
 146 /* mangled zone name when mounting in an alternate root environment */
 147 static char kernzone[ZONENAME_MAX];
 148 
 149 /* array of cached mount entries for resolve_lofs */
 150 static struct mnttab *resolve_lofs_mnts, *resolve_lofs_mnt_max;
 151 
 152 /* for Trusted Extensions */
 153 static tsol_zcent_t *get_zone_label(zlog_t *, priv_set_t *);
 154 static int tsol_mounts(zlog_t *, char *, char *);
 155 static void tsol_unmounts(zlog_t *, char *);
 156 
 157 static m_label_t *zlabel = NULL;
 158 static m_label_t *zid_label = NULL;
 159 static priv_set_t *zprivs = NULL;
 160 
 161 /* from libsocket, not in any header file */
 162 extern int getnetmaskbyaddr(struct in_addr, struct in_addr *);
 163 
 164 /* from zoneadmd */
 165 extern char query_hook[];
 166 extern char post_statechg_hook[];
 167 
 168 /*
 169  * For each "net" resource configured in zonecfg, we track a zone_addr_list_t
 170  * node in a linked list that is sorted by linkid.  The list is constructed as
 171  * the xml configuration file is parsed, and the information
 172  * contained in each node is added to the kernel before the zone is
 173  * booted, to be retrieved and applied from within the exclusive-IP NGZ
 174  * on boot.
 175  */
 176 typedef struct zone_addr_list {
 177         struct zone_addr_list *za_next;
 178         datalink_id_t za_linkid;        /* datalink_id_t of interface */
 179         struct zone_nwiftab za_nwiftab; /* address, defrouter properties */
 180 } zone_addr_list_t;
 181 
 182 /*
 183  * An optimization for build_mnttable: reallocate (and potentially copy the
 184  * data) only once every N times through the loop.
 185  */
 186 #define MNTTAB_HUNK     32
 187 
 188 /* some handy macros */
 189 #define SIN(s)  ((struct sockaddr_in *)s)
 190 #define SIN6(s) ((struct sockaddr_in6 *)s)
 191 
 192 /*
 193  * Private autofs system call
 194  */
 195 extern int _autofssys(int, void *);
 196 
 197 static int
 198 autofs_cleanup(zoneid_t zoneid)
 199 {
 200         /*
 201          * Ask autofs to unmount all trigger nodes in the given zone.
 202          */
 203         return (_autofssys(AUTOFS_UNMOUNTALL, (void *)((uintptr_t)zoneid)));
 204 }
 205 
 206 static void
 207 free_mnttable(struct mnttab *mnt_array, uint_t nelem)
 208 {
 209         uint_t i;
 210 
 211         if (mnt_array == NULL)
 212                 return;
 213         for (i = 0; i < nelem; i++) {
 214                 free(mnt_array[i].mnt_mountp);
 215                 free(mnt_array[i].mnt_fstype);
 216                 free(mnt_array[i].mnt_special);
 217                 free(mnt_array[i].mnt_mntopts);
 218                 assert(mnt_array[i].mnt_time == NULL);
 219         }
 220         free(mnt_array);
 221 }
 222 
 223 /*
 224  * Build the mount table for the zone rooted at "zroot", storing the resulting
 225  * array of struct mnttabs in "mnt_arrayp" and the number of elements in the
 226  * array in "nelemp".
 227  */
 228 static int
 229 build_mnttable(zlog_t *zlogp, const char *zroot, size_t zrootlen, FILE *mnttab,
 230     struct mnttab **mnt_arrayp, uint_t *nelemp)
 231 {
 232         struct mnttab mnt;
 233         struct mnttab *mnts;
 234         struct mnttab *mnp;
 235         uint_t nmnt;
 236 
 237         rewind(mnttab);
 238         resetmnttab(mnttab);
 239         nmnt = 0;
 240         mnts = NULL;
 241         while (getmntent(mnttab, &mnt) == 0) {
 242                 struct mnttab *tmp_array;
 243 
 244                 if (strncmp(mnt.mnt_mountp, zroot, zrootlen) != 0)
 245                         continue;
 246                 if (nmnt % MNTTAB_HUNK == 0) {
 247                         tmp_array = realloc(mnts,
 248                             (nmnt + MNTTAB_HUNK) * sizeof (*mnts));
 249                         if (tmp_array == NULL) {
 250                                 free_mnttable(mnts, nmnt);
 251                                 return (-1);
 252                         }
 253                         mnts = tmp_array;
 254                 }
 255                 mnp = &mnts[nmnt++];
 256 
 257                 /*
 258                  * Zero out any fields we're not using.
 259                  */
 260                 (void) memset(mnp, 0, sizeof (*mnp));
 261 
 262                 if (mnt.mnt_special != NULL)
 263                         mnp->mnt_special = strdup(mnt.mnt_special);
 264                 if (mnt.mnt_mntopts != NULL)
 265                         mnp->mnt_mntopts = strdup(mnt.mnt_mntopts);
 266                 mnp->mnt_mountp = strdup(mnt.mnt_mountp);
 267                 mnp->mnt_fstype = strdup(mnt.mnt_fstype);
 268                 if ((mnt.mnt_special != NULL && mnp->mnt_special == NULL) ||
 269                     (mnt.mnt_mntopts != NULL && mnp->mnt_mntopts == NULL) ||
 270                     mnp->mnt_mountp == NULL || mnp->mnt_fstype == NULL) {
 271                         zerror(zlogp, B_TRUE, "memory allocation failed");
 272                         free_mnttable(mnts, nmnt);
 273                         return (-1);
 274                 }
 275         }
 276         *mnt_arrayp = mnts;
 277         *nelemp = nmnt;
 278         return (0);
 279 }
 280 
 281 /*
 282  * This is an optimization.  The resolve_lofs function is used quite frequently
 283  * to manipulate file paths, and on a machine with a large number of zones,
 284  * there will be a huge number of mounted file systems.  Thus, we trigger a
 285  * reread of the list of mount points
 286  */
 287 static void
 288 lofs_discard_mnttab(void)
 289 {
 290         free_mnttable(resolve_lofs_mnts,
 291             resolve_lofs_mnt_max - resolve_lofs_mnts);
 292         resolve_lofs_mnts = resolve_lofs_mnt_max = NULL;
 293 }
 294 
 295 static int
 296 lofs_read_mnttab(zlog_t *zlogp)
 297 {
 298         FILE *mnttab;
 299         uint_t nmnts;
 300 
 301         if ((mnttab = fopen(MNTTAB, "r")) == NULL)
 302                 return (-1);
 303         if (build_mnttable(zlogp, "", 0, mnttab, &resolve_lofs_mnts,
 304             &nmnts) == -1) {
 305                 (void) fclose(mnttab);
 306                 return (-1);
 307         }
 308         (void) fclose(mnttab);
 309         resolve_lofs_mnt_max = resolve_lofs_mnts + nmnts;
 310         return (0);
 311 }
 312 
 313 /*
 314  * This function loops over potential loopback mounts and symlinks in a given
 315  * path and resolves them all down to an absolute path.
 316  */
 317 void
 318 resolve_lofs(zlog_t *zlogp, char *path, size_t pathlen)
 319 {
 320         int len, arlen;
 321         const char *altroot;
 322         char tmppath[MAXPATHLEN];
 323         boolean_t outside_altroot;
 324 
 325         if ((len = resolvepath(path, tmppath, sizeof (tmppath))) == -1)
 326                 return;
 327         tmppath[len] = '\0';
 328         (void) strlcpy(path, tmppath, sizeof (tmppath));
 329 
 330         /* This happens once per zoneadmd operation. */
 331         if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
 332                 return;
 333 
 334         altroot = zonecfg_get_root();
 335         arlen = strlen(altroot);
 336         outside_altroot = B_FALSE;
 337         for (;;) {
 338                 struct mnttab *mnp;
 339 
 340                 /* Search in reverse order to find longest match */
 341                 for (mnp = resolve_lofs_mnt_max - 1; mnp >= resolve_lofs_mnts;
 342                     mnp--) {
 343                         if (mnp->mnt_fstype == NULL ||
 344                             mnp->mnt_mountp == NULL ||
 345                             mnp->mnt_special == NULL)
 346                                 continue;
 347                         len = strlen(mnp->mnt_mountp);
 348                         if (strncmp(mnp->mnt_mountp, path, len) == 0 &&
 349                             (path[len] == '/' || path[len] == '\0'))
 350                                 break;
 351                 }
 352                 if (mnp < resolve_lofs_mnts)
 353                         break;
 354                 /* If it's not a lofs then we're done */
 355                 if (strcmp(mnp->mnt_fstype, MNTTYPE_LOFS) != 0)
 356                         break;
 357                 if (outside_altroot) {
 358                         char *cp;
 359                         int olen = sizeof (MNTOPT_RO) - 1;
 360 
 361                         /*
 362                          * If we run into a read-only mount outside of the
 363                          * alternate root environment, then the user doesn't
 364                          * want this path to be made read-write.
 365                          */
 366                         if (mnp->mnt_mntopts != NULL &&
 367                             (cp = strstr(mnp->mnt_mntopts, MNTOPT_RO)) !=
 368                             NULL &&
 369                             (cp == mnp->mnt_mntopts || cp[-1] == ',') &&
 370                             (cp[olen] == '\0' || cp[olen] == ',')) {
 371                                 break;
 372                         }
 373                 } else if (arlen > 0 &&
 374                     (strncmp(mnp->mnt_special, altroot, arlen) != 0 ||
 375                     (mnp->mnt_special[arlen] != '\0' &&
 376                     mnp->mnt_special[arlen] != '/'))) {
 377                         outside_altroot = B_TRUE;
 378                 }
 379                 /* use temporary buffer because new path might be longer */
 380                 (void) snprintf(tmppath, sizeof (tmppath), "%s%s",
 381                     mnp->mnt_special, path + len);
 382                 if ((len = resolvepath(tmppath, path, pathlen)) == -1)
 383                         break;
 384                 path[len] = '\0';
 385         }
 386 }
 387 
 388 /*
 389  * For a regular mount, check if a replacement lofs mount is needed because the
 390  * referenced device is already mounted somewhere.
 391  */
 392 static int
 393 check_lofs_needed(zlog_t *zlogp, struct zone_fstab *fsptr)
 394 {
 395         struct mnttab *mnp;
 396         zone_fsopt_t *optptr, *onext;
 397 
 398         /* This happens once per zoneadmd operation. */
 399         if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
 400                 return (-1);
 401 
 402         /*
 403          * If this special node isn't already in use, then it's ours alone;
 404          * no need to worry about conflicting mounts.
 405          */
 406         for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max;
 407             mnp++) {
 408                 if (strcmp(mnp->mnt_special, fsptr->zone_fs_special) == 0)
 409                         break;
 410         }
 411         if (mnp >= resolve_lofs_mnt_max)
 412                 return (0);
 413 
 414         /*
 415          * Convert this duplicate mount into a lofs mount.
 416          */
 417         (void) strlcpy(fsptr->zone_fs_special, mnp->mnt_mountp,
 418             sizeof (fsptr->zone_fs_special));
 419         (void) strlcpy(fsptr->zone_fs_type, MNTTYPE_LOFS,
 420             sizeof (fsptr->zone_fs_type));
 421         fsptr->zone_fs_raw[0] = '\0';
 422 
 423         /*
 424          * Discard all but one of the original options and set that to our
 425          * default set of options used for resources.
 426          */
 427         optptr = fsptr->zone_fs_options;
 428         if (optptr == NULL) {
 429                 optptr = malloc(sizeof (*optptr));
 430                 if (optptr == NULL) {
 431                         zerror(zlogp, B_TRUE, "cannot mount %s",
 432                             fsptr->zone_fs_dir);
 433                         return (-1);
 434                 }
 435         } else {
 436                 while ((onext = optptr->zone_fsopt_next) != NULL) {
 437                         optptr->zone_fsopt_next = onext->zone_fsopt_next;
 438                         free(onext);
 439                 }
 440         }
 441         (void) strcpy(optptr->zone_fsopt_opt, RESOURCE_DEFAULT_OPTS);
 442         optptr->zone_fsopt_next = NULL;
 443         fsptr->zone_fs_options = optptr;
 444         return (0);
 445 }
 446 
 447 int
 448 make_one_dir(zlog_t *zlogp, const char *prefix, const char *subdir, mode_t mode,
 449     uid_t userid, gid_t groupid)
 450 {
 451         char path[MAXPATHLEN];
 452         struct stat st;
 453 
 454         if (snprintf(path, sizeof (path), "%s%s", prefix, subdir) >
 455             sizeof (path)) {
 456                 zerror(zlogp, B_FALSE, "pathname %s%s is too long", prefix,
 457                     subdir);
 458                 return (-1);
 459         }
 460 
 461         if (lstat(path, &st) == 0) {
 462                 /*
 463                  * We don't check the file mode since presumably the zone
 464                  * administrator may have had good reason to change the mode,
 465                  * and we don't need to second guess him.
 466                  */
 467                 if (!S_ISDIR(st.st_mode)) {
 468                         if (S_ISREG(st.st_mode)) {
 469                                 /*
 470                                  * Allow readonly mounts of /etc/ files; this
 471                                  * is needed most by Trusted Extensions.
 472                                  */
 473                                 if (strncmp(subdir, "/etc/",
 474                                     strlen("/etc/")) != 0) {
 475                                         zerror(zlogp, B_FALSE,
 476                                             "%s is not in /etc", path);
 477                                         return (-1);
 478                                 }
 479                         } else {
 480                                 zerror(zlogp, B_FALSE,
 481                                     "%s is not a directory", path);
 482                                 return (-1);
 483                         }
 484                 }
 485                 return (0);
 486         }
 487 
 488         if (mkdirp(path, mode) != 0) {
 489                 if (errno == EROFS)
 490                         zerror(zlogp, B_FALSE, "Could not mkdir %s.\nIt is on "
 491                             "a read-only file system in this local zone.\nMake "
 492                             "sure %s exists in the global zone.", path, subdir);
 493                 else
 494                         zerror(zlogp, B_TRUE, "mkdirp of %s failed", path);
 495                 return (-1);
 496         }
 497 
 498         (void) chown(path, userid, groupid);
 499         return (0);
 500 }
 501 
 502 static void
 503 free_remote_fstypes(char **types)
 504 {
 505         uint_t i;
 506 
 507         if (types == NULL)
 508                 return;
 509         for (i = 0; types[i] != NULL; i++)
 510                 free(types[i]);
 511         free(types);
 512 }
 513 
 514 static char **
 515 get_remote_fstypes(zlog_t *zlogp)
 516 {
 517         char **types = NULL;
 518         FILE *fp;
 519         char buf[MAXPATHLEN];
 520         char fstype[MAXPATHLEN];
 521         uint_t lines = 0;
 522         uint_t i;
 523 
 524         if ((fp = fopen(DFSTYPES, "r")) == NULL) {
 525                 zerror(zlogp, B_TRUE, "failed to open %s", DFSTYPES);
 526                 return (NULL);
 527         }
 528         /*
 529          * Count the number of lines
 530          */
 531         while (fgets(buf, sizeof (buf), fp) != NULL)
 532                 lines++;
 533         if (lines == 0) /* didn't read anything; empty file */
 534                 goto out;
 535         rewind(fp);
 536         /*
 537          * Allocate enough space for a NULL-terminated array.
 538          */
 539         types = calloc(lines + 1, sizeof (char *));
 540         if (types == NULL) {
 541                 zerror(zlogp, B_TRUE, "memory allocation failed");
 542                 goto out;
 543         }
 544         i = 0;
 545         while (fgets(buf, sizeof (buf), fp) != NULL) {
 546                 /* LINTED - fstype is big enough to hold buf */
 547                 if (sscanf(buf, "%s", fstype) == 0) {
 548                         zerror(zlogp, B_FALSE, "unable to parse %s", DFSTYPES);
 549                         free_remote_fstypes(types);
 550                         types = NULL;
 551                         goto out;
 552                 }
 553                 types[i] = strdup(fstype);
 554                 if (types[i] == NULL) {
 555                         zerror(zlogp, B_TRUE, "memory allocation failed");
 556                         free_remote_fstypes(types);
 557                         types = NULL;
 558                         goto out;
 559                 }
 560                 i++;
 561         }
 562 out:
 563         (void) fclose(fp);
 564         return (types);
 565 }
 566 
 567 static boolean_t
 568 is_remote_fstype(const char *fstype, char *const *remote_fstypes)
 569 {
 570         uint_t i;
 571 
 572         if (remote_fstypes == NULL)
 573                 return (B_FALSE);
 574         for (i = 0; remote_fstypes[i] != NULL; i++) {
 575                 if (strcmp(remote_fstypes[i], fstype) == 0)
 576                         return (B_TRUE);
 577         }
 578         return (B_FALSE);
 579 }
 580 
 581 /*
 582  * This converts a zone root path (normally of the form .../root) to a Live
 583  * Upgrade scratch zone root (of the form .../lu).
 584  */
 585 static void
 586 root_to_lu(zlog_t *zlogp, char *zroot, size_t zrootlen, boolean_t isresolved)
 587 {
 588         if (!isresolved && zonecfg_in_alt_root())
 589                 resolve_lofs(zlogp, zroot, zrootlen);
 590         (void) strcpy(strrchr(zroot, '/') + 1, "lu");
 591 }
 592 
 593 /*
 594  * Perform brand-specific cleanup if we are unable to unmount a FS.
 595  */
 596 static void
 597 brand_umount_cleanup(zlog_t *zlogp, char *path)
 598 {
 599         char cmdbuf[2 * MAXPATHLEN];
 600 
 601         if (post_statechg_hook[0] == '\0')
 602                 return;
 603 
 604         if (snprintf(cmdbuf, sizeof (cmdbuf), "%s %d %d %s", post_statechg_hook,
 605             ZONE_STATE_DOWN, Z_UNMOUNT, path) > sizeof (cmdbuf))
 606                 return;
 607 
 608         (void) do_subproc(zlogp, cmdbuf, NULL, B_FALSE);
 609 }
 610 
 611 /*
 612  * The general strategy for unmounting filesystems is as follows:
 613  *
 614  * - Remote filesystems may be dead, and attempting to contact them as
 615  * part of a regular unmount may hang forever; we want to always try to
 616  * forcibly unmount such filesystems and only fall back to regular
 617  * unmounts if the filesystem doesn't support forced unmounts.
 618  *
 619  * - We don't want to unnecessarily corrupt metadata on local
 620  * filesystems (ie UFS), so we want to start off with graceful unmounts,
 621  * and only escalate to doing forced unmounts if we get stuck.
 622  *
 623  * We start off walking backwards through the mount table.  This doesn't
 624  * give us strict ordering but ensures that we try to unmount submounts
 625  * first.  We thus limit the number of failed umount2(2) calls.
 626  *
 627  * The mechanism for determining if we're stuck is to count the number
 628  * of failed unmounts each iteration through the mount table.  This
 629  * gives us an upper bound on the number of filesystems which remain
 630  * mounted (autofs trigger nodes are dealt with separately).  If at the
 631  * end of one unmount+autofs_cleanup cycle we still have the same number
 632  * of mounts that we started out with, we're stuck and try a forced
 633  * unmount.  If that fails (filesystem doesn't support forced unmounts)
 634  * then we bail and are unable to teardown the zone.  If it succeeds,
 635  * we're no longer stuck so we continue with our policy of trying
 636  * graceful mounts first.
 637  *
 638  * Zone must be down (ie, no processes or threads active).
 639  */
 640 static int
 641 unmount_filesystems(zlog_t *zlogp, zoneid_t zoneid, boolean_t unmount_cmd)
 642 {
 643         int error = 0;
 644         int fail = 0;
 645         FILE *mnttab;
 646         struct mnttab *mnts;
 647         uint_t nmnt;
 648         char zroot[MAXPATHLEN + 1];
 649         size_t zrootlen;
 650         uint_t oldcount = UINT_MAX;
 651         boolean_t stuck = B_FALSE;
 652         char **remote_fstypes = NULL;
 653 
 654         if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
 655                 zerror(zlogp, B_FALSE, "unable to determine zone root");
 656                 return (-1);
 657         }
 658         if (unmount_cmd)
 659                 root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
 660 
 661         (void) strcat(zroot, "/");
 662         zrootlen = strlen(zroot);
 663 
 664         /*
 665          * For Trusted Extensions unmount each higher level zone's mount
 666          * of our zone's /export/home
 667          */
 668         if (!unmount_cmd)
 669                 tsol_unmounts(zlogp, zone_name);
 670 
 671         if ((mnttab = fopen(MNTTAB, "r")) == NULL) {
 672                 zerror(zlogp, B_TRUE, "failed to open %s", MNTTAB);
 673                 return (-1);
 674         }
 675         /*
 676          * Use our hacky mntfs ioctl so we see everything, even mounts with
 677          * MS_NOMNTTAB.
 678          */
 679         if (ioctl(fileno(mnttab), MNTIOC_SHOWHIDDEN, NULL) < 0) {
 680                 zerror(zlogp, B_TRUE, "unable to configure %s", MNTTAB);
 681                 error++;
 682                 goto out;
 683         }
 684 
 685         /*
 686          * Build the list of remote fstypes so we know which ones we
 687          * should forcibly unmount.
 688          */
 689         remote_fstypes = get_remote_fstypes(zlogp);
 690         for (; /* ever */; ) {
 691                 uint_t newcount = 0;
 692                 boolean_t unmounted;
 693                 struct mnttab *mnp;
 694                 char *path;
 695                 uint_t i;
 696 
 697                 mnts = NULL;
 698                 nmnt = 0;
 699                 /*
 700                  * MNTTAB gives us a way to walk through mounted
 701                  * filesystems; we need to be able to walk them in
 702                  * reverse order, so we build a list of all mounted
 703                  * filesystems.
 704                  */
 705                 if (build_mnttable(zlogp, zroot, zrootlen, mnttab, &mnts,
 706                     &nmnt) != 0) {
 707                         error++;
 708                         goto out;
 709                 }
 710                 for (i = 0; i < nmnt; i++) {
 711                         mnp = &mnts[nmnt - i - 1]; /* access in reverse order */
 712                         path = mnp->mnt_mountp;
 713                         unmounted = B_FALSE;
 714                         /*
 715                          * Try forced unmount first for remote filesystems.
 716                          *
 717                          * Not all remote filesystems support forced unmounts,
 718                          * so if this fails (ENOTSUP) we'll continue on
 719                          * and try a regular unmount.
 720                          */
 721                         if (is_remote_fstype(mnp->mnt_fstype, remote_fstypes)) {
 722                                 if (umount2(path, MS_FORCE) == 0)
 723                                         unmounted = B_TRUE;
 724                         }
 725                         /*
 726                          * Try forced unmount if we're stuck.
 727                          */
 728                         if (stuck) {
 729                                 if (umount2(path, MS_FORCE) == 0) {
 730                                         unmounted = B_TRUE;
 731                                         stuck = B_FALSE;
 732                                         fail = 0;
 733                                 } else {
 734                                         /*
 735                                          * We may hit a failure here if there
 736                                          * is an app in the GZ with an open
 737                                          * pipe into the zone (commonly into
 738                                          * the zone's /var/run).  This type
 739                                          * of app will notice the closed
 740                                          * connection and cleanup, but it may
 741                                          * take a while and we have no easy
 742                                          * way to notice that.  To deal with
 743                                          * this case, we will wait and retry
 744                                          * a few times before we give up.
 745                                          */
 746                                         fail++;
 747                                         if (fail < 16) {
 748                                                 zerror(zlogp, B_FALSE,
 749                                                     "unable to unmount '%s', "
 750                                                     "retrying in 1 second",
 751                                                     path);
 752                                                 (void) sleep(1);
 753                                         } else if (fail > 17) {
 754                                                 error++;
 755                                                 zerror(zlogp, B_FALSE,
 756                                                     "unable to unmount '%s'",
 757                                                     path);
 758                                                 free_mnttable(mnts, nmnt);
 759                                                 goto out;
 760                                         } else {
 761                                                 /* Try the hook 2 times */
 762                                                 brand_umount_cleanup(zlogp,
 763                                                     path);
 764                                         }
 765                                 }
 766                         }
 767                         /*
 768                          * Try regular unmounts for everything else.
 769                          */
 770                         if (!unmounted && umount2(path, 0) != 0)
 771                                 newcount++;
 772                 }
 773                 free_mnttable(mnts, nmnt);
 774 
 775                 if (newcount == 0)
 776                         break;
 777                 if (newcount >= oldcount) {
 778                         /*
 779                          * Last round didn't unmount anything; we're stuck and
 780                          * should start trying forced unmounts.
 781                          */
 782                         stuck = B_TRUE;
 783                 }
 784                 oldcount = newcount;
 785 
 786                 /*
 787                  * Autofs doesn't let you unmount its trigger nodes from
 788                  * userland so we have to tell the kernel to cleanup for us.
 789                  */
 790                 if (autofs_cleanup(zoneid) != 0) {
 791                         zerror(zlogp, B_TRUE, "unable to remove autofs nodes");
 792                         error++;
 793                         goto out;
 794                 }
 795         }
 796 
 797 out:
 798         free_remote_fstypes(remote_fstypes);
 799         (void) fclose(mnttab);
 800         return (error ? -1 : 0);
 801 }
 802 
 803 static int
 804 fs_compare(const void *m1, const void *m2)
 805 {
 806         struct zone_fstab *i = (struct zone_fstab *)m1;
 807         struct zone_fstab *j = (struct zone_fstab *)m2;
 808 
 809         return (strcmp(i->zone_fs_dir, j->zone_fs_dir));
 810 }
 811 
 812 /*
 813  * Fork and exec (and wait for) the mentioned binary with the provided
 814  * arguments.  Returns (-1) if something went wrong with fork(2) or exec(2),
 815  * returns the exit status otherwise.
 816  *
 817  * If we were unable to exec the provided pathname (for whatever
 818  * reason), we return the special token ZEXIT_EXEC.  The current value
 819  * of ZEXIT_EXEC doesn't conflict with legitimate exit codes of the
 820  * consumers of this function; any future consumers must make sure this
 821  * remains the case.
 822  */
 823 static int
 824 forkexec(zlog_t *zlogp, const char *path, char *const argv[])
 825 {
 826         pid_t child_pid;
 827         int child_status = 0;
 828 
 829         /*
 830          * Do not let another thread localize a message while we are forking.
 831          */
 832         (void) mutex_lock(&msglock);
 833         child_pid = fork();
 834         (void) mutex_unlock(&msglock);
 835         if (child_pid == -1) {
 836                 zerror(zlogp, B_TRUE, "could not fork for %s", argv[0]);
 837                 return (-1);
 838         } else if (child_pid == 0) {
 839                 closefrom(0);
 840                 /* redirect stdin, stdout & stderr to /dev/null */
 841                 (void) open("/dev/null", O_RDONLY);     /* stdin */
 842                 (void) open("/dev/null", O_WRONLY);     /* stdout */
 843                 (void) open("/dev/null", O_WRONLY);     /* stderr */
 844                 (void) execv(path, argv);
 845                 /*
 846                  * Since we are in the child, there is no point calling zerror()
 847                  * since there is nobody waiting to consume it.  So exit with a
 848                  * special code that the parent will recognize and call zerror()
 849                  * accordingly.
 850                  */
 851 
 852                 _exit(ZEXIT_EXEC);
 853         } else {
 854                 (void) waitpid(child_pid, &child_status, 0);
 855         }
 856 
 857         if (WIFSIGNALED(child_status)) {
 858                 zerror(zlogp, B_FALSE, "%s unexpectedly terminated due to "
 859                     "signal %d", path, WTERMSIG(child_status));
 860                 return (-1);
 861         }
 862         assert(WIFEXITED(child_status));
 863         if (WEXITSTATUS(child_status) == ZEXIT_EXEC) {
 864                 zerror(zlogp, B_FALSE, "failed to exec %s", path);
 865                 return (-1);
 866         }
 867         return (WEXITSTATUS(child_status));
 868 }
 869 
 870 static int
 871 isregfile(const char *path)
 872 {
 873         struct stat64 st;
 874 
 875         if (stat64(path, &st) == -1)
 876                 return (-1);
 877 
 878         return (S_ISREG(st.st_mode));
 879 }
 880 
 881 static int
 882 dofsck(zlog_t *zlogp, const char *fstype, const char *rawdev)
 883 {
 884         char cmdbuf[MAXPATHLEN];
 885         char *argv[5];
 886         int status;
 887 
 888         /*
 889          * We could alternatively have called /usr/sbin/fsck -F <fstype>, but
 890          * that would cost us an extra fork/exec without buying us anything.
 891          */
 892         if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/fsck", fstype)
 893             >= sizeof (cmdbuf)) {
 894                 zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
 895                 return (-1);
 896         }
 897 
 898         /*
 899          * If it doesn't exist, that's OK: we verified this previously
 900          * in zoneadm.
 901          */
 902         if (isregfile(cmdbuf) == -1)
 903                 return (0);
 904 
 905         argv[0] = "fsck";
 906         argv[1] = "-o";
 907         argv[2] = "p";
 908         argv[3] = (char *)rawdev;
 909         argv[4] = NULL;
 910 
 911         status = forkexec(zlogp, cmdbuf, argv);
 912         if (status == 0 || status == -1)
 913                 return (status);
 914         zerror(zlogp, B_FALSE, "fsck of '%s' failed with exit status %d; "
 915             "run fsck manually", rawdev, status);
 916         return (-1);
 917 }
 918 
 919 static int
 920 domount(zlog_t *zlogp, const char *fstype, const char *opts,
 921     const char *special, const char *directory)
 922 {
 923         char cmdbuf[MAXPATHLEN];
 924         char *argv[6];
 925         int status;
 926 
 927         /*
 928          * We could alternatively have called /usr/sbin/mount -F <fstype>, but
 929          * that would cost us an extra fork/exec without buying us anything.
 930          */
 931         if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/mount", fstype)
 932             >= sizeof (cmdbuf)) {
 933                 zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
 934                 return (-1);
 935         }
 936         argv[0] = "mount";
 937         if (opts[0] == '\0') {
 938                 argv[1] = (char *)special;
 939                 argv[2] = (char *)directory;
 940                 argv[3] = NULL;
 941         } else {
 942                 argv[1] = "-o";
 943                 argv[2] = (char *)opts;
 944                 argv[3] = (char *)special;
 945                 argv[4] = (char *)directory;
 946                 argv[5] = NULL;
 947         }
 948 
 949         status = forkexec(zlogp, cmdbuf, argv);
 950         if (status == 0 || status == -1)
 951                 return (status);
 952         if (opts[0] == '\0')
 953                 zerror(zlogp, B_FALSE, "\"%s %s %s\" "
 954                     "failed with exit code %d",
 955                     cmdbuf, special, directory, status);
 956         else
 957                 zerror(zlogp, B_FALSE, "\"%s -o %s %s %s\" "
 958                     "failed with exit code %d",
 959                     cmdbuf, opts, special, directory, status);
 960         return (-1);
 961 }
 962 
 963 /*
 964  * Check if a given mount point path exists.
 965  * If it does, make sure it doesn't contain any symlinks.
 966  * Note that if "leaf" is false we're checking an intermediate
 967  * component of the mount point path, so it must be a directory.
 968  * If "leaf" is true, then we're checking the entire mount point
 969  * path, so the mount point itself can be anything aside from a
 970  * symbolic link.
 971  *
 972  * If the path is invalid then a negative value is returned.  If the
 973  * path exists and is a valid mount point path then 0 is returned.
 974  * If the path doesn't exist return a positive value.
 975  */
 976 static int
 977 valid_mount_point(zlog_t *zlogp, const char *path, const boolean_t leaf)
 978 {
 979         struct stat statbuf;
 980         char respath[MAXPATHLEN];
 981         int res;
 982 
 983         if (lstat(path, &statbuf) != 0) {
 984                 if (errno == ENOENT)
 985                         return (1);
 986                 zerror(zlogp, B_TRUE, "can't stat %s", path);
 987                 return (-1);
 988         }
 989         if (S_ISLNK(statbuf.st_mode)) {
 990                 zerror(zlogp, B_FALSE, "%s is a symlink", path);
 991                 return (-1);
 992         }
 993         if (!leaf && !S_ISDIR(statbuf.st_mode)) {
 994                 zerror(zlogp, B_FALSE, "%s is not a directory", path);
 995                 return (-1);
 996         }
 997         if ((res = resolvepath(path, respath, sizeof (respath))) == -1) {
 998                 zerror(zlogp, B_TRUE, "unable to resolve path %s", path);
 999                 return (-1);
1000         }
1001         respath[res] = '\0';
1002         if (strcmp(path, respath) != 0) {
1003                 /*
1004                  * We don't like ".."s, "."s, or "//"s throwing us off
1005                  */
1006                 zerror(zlogp, B_FALSE, "%s is not a canonical path", path);
1007                 return (-1);
1008         }
1009         return (0);
1010 }
1011 
1012 /*
1013  * Validate a mount point path.  A valid mount point path is an
1014  * absolute path that either doesn't exist, or, if it does exists it
1015  * must be an absolute canonical path that doesn't have any symbolic
1016  * links in it.  The target of a mount point path can be any filesystem
1017  * object.  (Different filesystems can support different mount points,
1018  * for example "lofs" and "mntfs" both support files and directories
1019  * while "ufs" just supports directories.)
1020  *
1021  * If the path is invalid then a negative value is returned.  If the
1022  * path exists and is a valid mount point path then 0 is returned.
1023  * If the path doesn't exist return a positive value.
1024  */
1025 int
1026 valid_mount_path(zlog_t *zlogp, const char *rootpath, const char *spec,
1027     const char *dir, const char *fstype)
1028 {
1029         char abspath[MAXPATHLEN], *slashp, *slashp_next;
1030         int rv;
1031 
1032         /*
1033          * Sanity check the target mount point path.
1034          * It must be a non-null string that starts with a '/'.
1035          */
1036         if (dir[0] != '/') {
1037                 /* Something went wrong. */
1038                 zerror(zlogp, B_FALSE, "invalid mount directory, "
1039                     "type: \"%s\", special: \"%s\", dir: \"%s\"",
1040                     fstype, spec, dir);
1041                 return (-1);
1042         }
1043 
1044         /*
1045          * Join rootpath and dir.  Make sure abspath ends with '/', this
1046          * is added to all paths (even non-directory paths) to allow us
1047          * to detect the end of paths below.  If the path already ends
1048          * in a '/', then that's ok too (although we'll fail the
1049          * cannonical path check in valid_mount_point()).
1050          */
1051         if (snprintf(abspath, sizeof (abspath),
1052             "%s%s/", rootpath, dir) >= sizeof (abspath)) {
1053                 zerror(zlogp, B_FALSE, "pathname %s%s is too long",
1054                     rootpath, dir);
1055                 return (-1);
1056         }
1057 
1058         /*
1059          * Starting with rootpath, verify the mount path one component
1060          * at a time.  Continue until we've evaluated all of abspath.
1061          */
1062         slashp = &abspath[strlen(rootpath)];
1063         assert(*slashp == '/');
1064         do {
1065                 slashp_next = strchr(slashp + 1, '/');
1066                 *slashp = '\0';
1067                 if (slashp_next != NULL) {
1068                         /* This is an intermediary mount path component. */
1069                         rv = valid_mount_point(zlogp, abspath, B_FALSE);
1070                 } else {
1071                         /* This is the last component of the mount path. */
1072                         rv = valid_mount_point(zlogp, abspath, B_TRUE);
1073                 }
1074                 if (rv < 0)
1075                         return (rv);
1076                 *slashp = '/';
1077         } while ((slashp = slashp_next) != NULL);
1078         return (rv);
1079 }
1080 
1081 static int
1082 mount_one_dev_device_cb(void *arg, const char *match, const char *name)
1083 {
1084         di_prof_t prof = arg;
1085 
1086         if (name == NULL)
1087                 return (di_prof_add_dev(prof, match));
1088         return (di_prof_add_map(prof, match, name));
1089 }
1090 
1091 static int
1092 mount_one_dev_symlink_cb(void *arg, const char *source, const char *target)
1093 {
1094         di_prof_t prof = arg;
1095 
1096         return (di_prof_add_symlink(prof, source, target));
1097 }
1098 
1099 int
1100 vplat_get_iptype(zlog_t *zlogp, zone_iptype_t *iptypep)
1101 {
1102         if (zonecfg_get_iptype(snap_hndl, iptypep) != Z_OK) {
1103                 zerror(zlogp, B_FALSE, "invalid ip-type configuration");
1104                 return (-1);
1105         }
1106         return (0);
1107 }
1108 
1109 /*
1110  * Apply the standard lists of devices/symlinks/mappings and the user-specified
1111  * list of devices (via zonecfg) to the /dev filesystem.  The filesystem will
1112  * use these as a profile/filter to determine what exists in /dev.
1113  */
1114 static int
1115 mount_one_dev(zlog_t *zlogp, char *devpath, zone_mnt_t mount_cmd)
1116 {
1117         char                    brand[MAXNAMELEN];
1118         brand_handle_t          bh = NULL;
1119         struct zone_devtab      ztab;
1120         di_prof_t               prof = NULL;
1121         int                     err;
1122         int                     retval = -1;
1123         zone_iptype_t           iptype;
1124         const char              *curr_iptype;
1125 
1126         if (di_prof_init(devpath, &prof)) {
1127                 zerror(zlogp, B_TRUE, "failed to initialize profile");
1128                 goto cleanup;
1129         }
1130 
1131         /*
1132          * Get a handle to the brand info for this zone.
1133          * If we are mounting the zone, then we must always use the default
1134          * brand device mounts.
1135          */
1136         if (ALT_MOUNT(mount_cmd)) {
1137                 (void) strlcpy(brand, default_brand, sizeof (brand));
1138         } else {
1139                 (void) strlcpy(brand, brand_name, sizeof (brand));
1140         }
1141 
1142         if ((bh = brand_open(brand)) == NULL) {
1143                 zerror(zlogp, B_FALSE, "unable to determine zone brand");
1144                 goto cleanup;
1145         }
1146 
1147         if (vplat_get_iptype(zlogp, &iptype) < 0) {
1148                 zerror(zlogp, B_TRUE, "unable to determine ip-type");
1149                 goto cleanup;
1150         }
1151         switch (iptype) {
1152         case ZS_SHARED:
1153                 curr_iptype = "shared";
1154                 break;
1155         case ZS_EXCLUSIVE:
1156                 curr_iptype = "exclusive";
1157                 break;
1158         }
1159 
1160         if (brand_platform_iter_devices(bh, zone_name,
1161             mount_one_dev_device_cb, prof, curr_iptype) != 0) {
1162                 zerror(zlogp, B_TRUE, "failed to add standard device");
1163                 goto cleanup;
1164         }
1165 
1166         if (brand_platform_iter_link(bh,
1167             mount_one_dev_symlink_cb, prof) != 0) {
1168                 zerror(zlogp, B_TRUE, "failed to add standard symlink");
1169                 goto cleanup;
1170         }
1171 
1172         /* Add user-specified devices and directories */
1173         if (err = zonecfg_setdevent(snap_hndl)) {
1174                 zerror(zlogp, B_FALSE, "%s: %s", zone_name,
1175                     zonecfg_strerror(err));
1176                 goto cleanup;
1177         }
1178         while (zonecfg_getdevent(snap_hndl, &ztab) == Z_OK) {
1179                 if (di_prof_add_dev(prof, ztab.zone_dev_match)) {
1180                         zerror(zlogp, B_TRUE, "failed to add "
1181                             "user-specified device");
1182                         goto cleanup;
1183                 }
1184         }
1185         (void) zonecfg_enddevent(snap_hndl);
1186 
1187         /* Send profile to kernel */
1188         if (di_prof_commit(prof)) {
1189                 zerror(zlogp, B_TRUE, "failed to commit profile");
1190                 goto cleanup;
1191         }
1192 
1193         retval = 0;
1194 
1195 cleanup:
1196         if (bh != NULL)
1197                 brand_close(bh);
1198         if (prof)
1199                 di_prof_fini(prof);
1200         return (retval);
1201 }
1202 
1203 static int
1204 mount_one(zlog_t *zlogp, struct zone_fstab *fsptr, const char *rootpath,
1205     zone_mnt_t mount_cmd)
1206 {
1207         char path[MAXPATHLEN];
1208         char optstr[MAX_MNTOPT_STR];
1209         zone_fsopt_t *optptr;
1210         int rv;
1211 
1212         if ((rv = valid_mount_path(zlogp, rootpath, fsptr->zone_fs_special,
1213             fsptr->zone_fs_dir, fsptr->zone_fs_type)) < 0) {
1214                 zerror(zlogp, B_FALSE, "%s%s is not a valid mount point",
1215                     rootpath, fsptr->zone_fs_dir);
1216                 return (-1);
1217         } else if (rv > 0) {
1218                 /* The mount point path doesn't exist, create it now. */
1219                 if (make_one_dir(zlogp, rootpath, fsptr->zone_fs_dir,
1220                     DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
1221                     DEFAULT_DIR_GROUP) != 0) {
1222                         zerror(zlogp, B_FALSE, "failed to create mount point");
1223                         return (-1);
1224                 }
1225 
1226                 /*
1227                  * Now this might seem weird, but we need to invoke
1228                  * valid_mount_path() again.  Why?  Because it checks
1229                  * to make sure that the mount point path is canonical,
1230                  * which it can only do if the path exists, so now that
1231                  * we've created the path we have to verify it again.
1232                  */
1233                 if ((rv = valid_mount_path(zlogp, rootpath,
1234                     fsptr->zone_fs_special, fsptr->zone_fs_dir,
1235                     fsptr->zone_fs_type)) < 0) {
1236                         zerror(zlogp, B_FALSE,
1237                             "%s%s is not a valid mount point",
1238                             rootpath, fsptr->zone_fs_dir);
1239                         return (-1);
1240                 }
1241         }
1242 
1243         (void) snprintf(path, sizeof (path), "%s%s", rootpath,
1244             fsptr->zone_fs_dir);
1245 
1246         /*
1247          * In general the strategy here is to do just as much verification as
1248          * necessary to avoid crashing or otherwise doing something bad; if the
1249          * administrator initiated the operation via zoneadm(1m), he'll get
1250          * auto-verification which will let him know what's wrong.  If he
1251          * modifies the zone configuration of a running zone and doesn't attempt
1252          * to verify that it's OK we won't crash but won't bother trying to be
1253          * too helpful either.  zoneadm verify is only a couple keystrokes away.
1254          */
1255         if (!zonecfg_valid_fs_type(fsptr->zone_fs_type)) {
1256                 zerror(zlogp, B_FALSE, "cannot mount %s on %s: "
1257                     "invalid file-system type %s", fsptr->zone_fs_special,
1258                     fsptr->zone_fs_dir, fsptr->zone_fs_type);
1259                 return (-1);
1260         }
1261 
1262         /*
1263          * If we're looking at an alternate root environment, then construct
1264          * read-only loopback mounts as necessary.  Note that any special
1265          * paths for lofs zone mounts in an alternate root must have
1266          * already been pre-pended with any alternate root path by the
1267          * time we get here.
1268          */
1269         if (zonecfg_in_alt_root()) {
1270                 struct stat64 st;
1271 
1272                 if (stat64(fsptr->zone_fs_special, &st) != -1 &&
1273                     S_ISBLK(st.st_mode)) {
1274                         /*
1275                          * If we're going to mount a block device we need
1276                          * to check if that device is already mounted
1277                          * somewhere else, and if so, do a lofs mount
1278                          * of the device instead of a direct mount
1279                          */
1280                         if (check_lofs_needed(zlogp, fsptr) == -1)
1281                                 return (-1);
1282                 } else if (strcmp(fsptr->zone_fs_type, MNTTYPE_LOFS) == 0) {
1283                         /*
1284                          * For lofs mounts, the special node is inside the
1285                          * alternate root.  We need lofs resolution for
1286                          * this case in order to get at the underlying
1287                          * read-write path.
1288                          */
1289                         resolve_lofs(zlogp, fsptr->zone_fs_special,
1290                             sizeof (fsptr->zone_fs_special));
1291                 }
1292         }
1293 
1294         /*
1295          * Run 'fsck -m' if there's a device to fsck.
1296          */
1297         if (fsptr->zone_fs_raw[0] != '\0' &&
1298             dofsck(zlogp, fsptr->zone_fs_type, fsptr->zone_fs_raw) != 0) {
1299                 return (-1);
1300         } else if (isregfile(fsptr->zone_fs_special) == 1 &&
1301             dofsck(zlogp, fsptr->zone_fs_type, fsptr->zone_fs_special) != 0) {
1302                 return (-1);
1303         }
1304 
1305         /*
1306          * Build up mount option string.
1307          */
1308         optstr[0] = '\0';
1309         if (fsptr->zone_fs_options != NULL) {
1310                 (void) strlcpy(optstr, fsptr->zone_fs_options->zone_fsopt_opt,
1311                     sizeof (optstr));
1312                 for (optptr = fsptr->zone_fs_options->zone_fsopt_next;
1313                     optptr != NULL; optptr = optptr->zone_fsopt_next) {
1314                         (void) strlcat(optstr, ",", sizeof (optstr));
1315                         (void) strlcat(optstr, optptr->zone_fsopt_opt,
1316                             sizeof (optstr));
1317                 }
1318         }
1319 
1320         if ((rv = domount(zlogp, fsptr->zone_fs_type, optstr,
1321             fsptr->zone_fs_special, path)) != 0)
1322                 return (rv);
1323 
1324         /*
1325          * The mount succeeded.  If this was not a mount of /dev then
1326          * we're done.
1327          */
1328         if (strcmp(fsptr->zone_fs_type, MNTTYPE_DEV) != 0)
1329                 return (0);
1330 
1331         /*
1332          * We just mounted an instance of a /dev filesystem, so now we
1333          * need to configure it.
1334          */
1335         return (mount_one_dev(zlogp, path, mount_cmd));
1336 }
1337 
1338 static void
1339 free_fs_data(struct zone_fstab *fsarray, uint_t nelem)
1340 {
1341         uint_t i;
1342 
1343         if (fsarray == NULL)
1344                 return;
1345         for (i = 0; i < nelem; i++)
1346                 zonecfg_free_fs_option_list(fsarray[i].zone_fs_options);
1347         free(fsarray);
1348 }
1349 
1350 /*
1351  * This function initiates the creation of a small Solaris Environment for
1352  * scratch zone. The Environment creation process is split up into two
1353  * functions(build_mounted_pre_var() and build_mounted_post_var()). It
1354  * is done this way because:
1355  *      We need to have both /etc and /var in the root of the scratchzone.
1356  *      We loopback mount zone's own /etc and /var into the root of the
1357  *      scratch zone. Unlike /etc, /var can be a seperate filesystem. So we
1358  *      need to delay the mount of /var till the zone's root gets populated.
1359  *      So mounting of localdirs[](/etc and /var) have been moved to the
1360  *      build_mounted_post_var() which gets called only after the zone
1361  *      specific filesystems are mounted.
1362  *
1363  * Note that the scratch zone we set up for updating the zone (Z_MNT_UPDATE)
1364  * does not loopback mount the zone's own /etc and /var into the root of the
1365  * scratch zone.
1366  */
1367 static boolean_t
1368 build_mounted_pre_var(zlog_t *zlogp, char *rootpath,
1369     size_t rootlen, const char *zonepath, char *luroot, size_t lurootlen)
1370 {
1371         char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1372         const char **cpp;
1373         static const char *mkdirs[] = {
1374                 "/system", "/system/contract", "/system/object", "/proc",
1375                 "/dev", "/tmp", "/a", NULL
1376         };
1377         char *altstr;
1378         FILE *fp;
1379         uuid_t uuid;
1380 
1381         resolve_lofs(zlogp, rootpath, rootlen);
1382         (void) snprintf(luroot, lurootlen, "%s/lu", zonepath);
1383         resolve_lofs(zlogp, luroot, lurootlen);
1384         (void) snprintf(tmp, sizeof (tmp), "%s/bin", luroot);
1385         (void) symlink("./usr/bin", tmp);
1386 
1387         /*
1388          * These are mostly special mount points; not handled here.  (See
1389          * zone_mount_early.)
1390          */
1391         for (cpp = mkdirs; *cpp != NULL; cpp++) {
1392                 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1393                 if (mkdir(tmp, 0755) != 0) {
1394                         zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1395                         return (B_FALSE);
1396                 }
1397         }
1398         /*
1399          * This is here to support lucopy.  If there's an instance of this same
1400          * zone on the current running system, then we mount its root up as
1401          * read-only inside the scratch zone.
1402          */
1403         (void) zonecfg_get_uuid(zone_name, uuid);
1404         altstr = strdup(zonecfg_get_root());
1405         if (altstr == NULL) {
1406                 zerror(zlogp, B_TRUE, "memory allocation failed");
1407                 return (B_FALSE);
1408         }
1409         zonecfg_set_root("");
1410         (void) strlcpy(tmp, zone_name, sizeof (tmp));
1411         (void) zonecfg_get_name_by_uuid(uuid, tmp, sizeof (tmp));
1412         if (zone_get_rootpath(tmp, fromdir, sizeof (fromdir)) == Z_OK &&
1413             strcmp(fromdir, rootpath) != 0) {
1414                 (void) snprintf(tmp, sizeof (tmp), "%s/b", luroot);
1415                 if (mkdir(tmp, 0755) != 0) {
1416                         zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1417                         return (B_FALSE);
1418                 }
1419                 if (domount(zlogp, MNTTYPE_LOFS, RESOURCE_DEFAULT_OPTS, fromdir,
1420                     tmp) != 0) {
1421                         zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1422                             fromdir);
1423                         return (B_FALSE);
1424                 }
1425         }
1426         zonecfg_set_root(altstr);
1427         free(altstr);
1428 
1429         if ((fp = zonecfg_open_scratch(luroot, B_TRUE)) == NULL) {
1430                 zerror(zlogp, B_TRUE, "cannot open zone mapfile");
1431                 return (B_FALSE);
1432         }
1433         (void) ftruncate(fileno(fp), 0);
1434         if (zonecfg_add_scratch(fp, zone_name, kernzone, "/") == -1) {
1435                 zerror(zlogp, B_TRUE, "cannot add zone mapfile entry");
1436         }
1437         zonecfg_close_scratch(fp);
1438         (void) snprintf(tmp, sizeof (tmp), "%s/a", luroot);
1439         if (domount(zlogp, MNTTYPE_LOFS, "", rootpath, tmp) != 0)
1440                 return (B_FALSE);
1441         (void) strlcpy(rootpath, tmp, rootlen);
1442         return (B_TRUE);
1443 }
1444 
1445 
1446 static boolean_t
1447 build_mounted_post_var(zlog_t *zlogp, zone_mnt_t mount_cmd, char *rootpath,
1448     const char *luroot)
1449 {
1450         char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1451         const char **cpp;
1452         const char **loopdirs;
1453         const char **tmpdirs;
1454         static const char *localdirs[] = {
1455                 "/etc", "/var", NULL
1456         };
1457         static const char *scr_loopdirs[] = {
1458                 "/etc/lib", "/etc/fs", "/lib", "/sbin", "/platform",
1459                 "/usr", NULL
1460         };
1461         static const char *upd_loopdirs[] = {
1462                 "/etc", "/kernel", "/lib", "/opt", "/platform", "/sbin",
1463                 "/usr", "/var", NULL
1464         };
1465         static const char *scr_tmpdirs[] = {
1466                 "/tmp", "/var/run", NULL
1467         };
1468         static const char *upd_tmpdirs[] = {
1469                 "/tmp", "/var/run", "/var/tmp", NULL
1470         };
1471         struct stat st;
1472 
1473         if (mount_cmd == Z_MNT_SCRATCH) {
1474                 /*
1475                  * These are mounted read-write from the zone undergoing
1476                  * upgrade.  We must be careful not to 'leak' things from the
1477                  * main system into the zone, and this accomplishes that goal.
1478                  */
1479                 for (cpp = localdirs; *cpp != NULL; cpp++) {
1480                         (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot,
1481                             *cpp);
1482                         (void) snprintf(fromdir, sizeof (fromdir), "%s%s",
1483                             rootpath, *cpp);
1484                         if (mkdir(tmp, 0755) != 0) {
1485                                 zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1486                                 return (B_FALSE);
1487                         }
1488                         if (domount(zlogp, MNTTYPE_LOFS, "", fromdir, tmp)
1489                             != 0) {
1490                                 zerror(zlogp, B_TRUE, "cannot mount %s on %s",
1491                                     tmp, *cpp);
1492                                 return (B_FALSE);
1493                         }
1494                 }
1495         }
1496 
1497         if (mount_cmd == Z_MNT_UPDATE)
1498                 loopdirs = upd_loopdirs;
1499         else
1500                 loopdirs = scr_loopdirs;
1501 
1502         /*
1503          * These are things mounted read-only from the running system because
1504          * they contain binaries that must match system.
1505          */
1506         for (cpp = loopdirs; *cpp != NULL; cpp++) {
1507                 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1508                 if (mkdir(tmp, 0755) != 0) {
1509                         if (errno != EEXIST) {
1510                                 zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1511                                 return (B_FALSE);
1512                         }
1513                         if (lstat(tmp, &st) != 0) {
1514                                 zerror(zlogp, B_TRUE, "cannot stat %s", tmp);
1515                                 return (B_FALSE);
1516                         }
1517                         /*
1518                          * Ignore any non-directories encountered.  These are
1519                          * things that have been converted into symlinks
1520                          * (/etc/fs and /etc/lib) and no longer need a lofs
1521                          * fixup.
1522                          */
1523                         if (!S_ISDIR(st.st_mode))
1524                                 continue;
1525                 }
1526                 if (domount(zlogp, MNTTYPE_LOFS, RESOURCE_DEFAULT_OPTS, *cpp,
1527                     tmp) != 0) {
1528                         zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1529                             *cpp);
1530                         return (B_FALSE);
1531                 }
1532         }
1533 
1534         if (mount_cmd == Z_MNT_UPDATE)
1535                 tmpdirs = upd_tmpdirs;
1536         else
1537                 tmpdirs = scr_tmpdirs;
1538 
1539         /*
1540          * These are things with tmpfs mounted inside.
1541          */
1542         for (cpp = tmpdirs; *cpp != NULL; cpp++) {
1543                 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1544                 if (mount_cmd == Z_MNT_SCRATCH && mkdir(tmp, 0755) != 0 &&
1545                     errno != EEXIST) {
1546                         zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1547                         return (B_FALSE);
1548                 }
1549 
1550                 /*
1551                  * We could set the mode for /tmp when we do the mkdir but
1552                  * since that can be modified by the umask we will just set
1553                  * the correct mode for /tmp now.
1554                  */
1555                 if (strcmp(*cpp, "/tmp") == 0 && chmod(tmp, 01777) != 0) {
1556                         zerror(zlogp, B_TRUE, "cannot chmod %s", tmp);
1557                         return (B_FALSE);
1558                 }
1559 
1560                 if (domount(zlogp, MNTTYPE_TMPFS, "", "swap", tmp) != 0) {
1561                         zerror(zlogp, B_TRUE, "cannot mount swap on %s", *cpp);
1562                         return (B_FALSE);
1563                 }
1564         }
1565         return (B_TRUE);
1566 }
1567 
1568 typedef struct plat_gmount_cb_data {
1569         zlog_t                  *pgcd_zlogp;
1570         struct zone_fstab       **pgcd_fs_tab;
1571         int                     *pgcd_num_fs;
1572 } plat_gmount_cb_data_t;
1573 
1574 /*
1575  * plat_gmount_cb() is a callback function invoked by libbrand to iterate
1576  * through all global brand platform mounts.
1577  */
1578 int
1579 plat_gmount_cb(void *data, const char *spec, const char *dir,
1580     const char *fstype, const char *opt)
1581 {
1582         plat_gmount_cb_data_t   *cp = data;
1583         zlog_t                  *zlogp = cp->pgcd_zlogp;
1584         struct zone_fstab       *fs_ptr = *cp->pgcd_fs_tab;
1585         int                     num_fs = *cp->pgcd_num_fs;
1586         struct zone_fstab       *fsp, *tmp_ptr;
1587 
1588         num_fs++;
1589         if ((tmp_ptr = realloc(fs_ptr, num_fs * sizeof (*tmp_ptr))) == NULL) {
1590                 zerror(zlogp, B_TRUE, "memory allocation failed");
1591                 return (-1);
1592         }
1593 
1594         fs_ptr = tmp_ptr;
1595         fsp = &fs_ptr[num_fs - 1];
1596 
1597         /* update the callback struct passed in */
1598         *cp->pgcd_fs_tab = fs_ptr;
1599         *cp->pgcd_num_fs = num_fs;
1600 
1601         fsp->zone_fs_raw[0] = '\0';
1602         (void) strlcpy(fsp->zone_fs_special, spec,
1603             sizeof (fsp->zone_fs_special));
1604         (void) strlcpy(fsp->zone_fs_dir, dir, sizeof (fsp->zone_fs_dir));
1605         (void) strlcpy(fsp->zone_fs_type, fstype, sizeof (fsp->zone_fs_type));
1606         fsp->zone_fs_options = NULL;
1607         if ((opt != NULL) &&
1608             (zonecfg_add_fs_option(fsp, (char *)opt) != Z_OK)) {
1609                 zerror(zlogp, B_FALSE, "error adding property");
1610                 return (-1);
1611         }
1612 
1613         return (0);
1614 }
1615 
1616 static int
1617 mount_filesystems_fsent(zone_dochandle_t handle, zlog_t *zlogp,
1618     struct zone_fstab **fs_tabp, int *num_fsp, zone_mnt_t mount_cmd)
1619 {
1620         struct zone_fstab *tmp_ptr, *fs_ptr, *fsp, fstab;
1621         int num_fs;
1622 
1623         num_fs = *num_fsp;
1624         fs_ptr = *fs_tabp;
1625 
1626         if (zonecfg_setfsent(handle) != Z_OK) {
1627                 zerror(zlogp, B_FALSE, "invalid configuration");
1628                 return (-1);
1629         }
1630         while (zonecfg_getfsent(handle, &fstab) == Z_OK) {
1631                 /*
1632                  * ZFS filesystems will not be accessible under an alternate
1633                  * root, since the pool will not be known.  Ignore them in this
1634                  * case.
1635                  */
1636                 if (ALT_MOUNT(mount_cmd) &&
1637                     strcmp(fstab.zone_fs_type, MNTTYPE_ZFS) == 0)
1638                         continue;
1639 
1640                 num_fs++;
1641                 if ((tmp_ptr = realloc(fs_ptr,
1642                     num_fs * sizeof (*tmp_ptr))) == NULL) {
1643                         zerror(zlogp, B_TRUE, "memory allocation failed");
1644                         (void) zonecfg_endfsent(handle);
1645                         return (-1);
1646                 }
1647                 /* update the pointers passed in */
1648                 *fs_tabp = tmp_ptr;
1649                 *num_fsp = num_fs;
1650 
1651                 fs_ptr = tmp_ptr;
1652                 fsp = &fs_ptr[num_fs - 1];
1653                 (void) strlcpy(fsp->zone_fs_dir,
1654                     fstab.zone_fs_dir, sizeof (fsp->zone_fs_dir));
1655                 (void) strlcpy(fsp->zone_fs_raw, fstab.zone_fs_raw,
1656                     sizeof (fsp->zone_fs_raw));
1657                 (void) strlcpy(fsp->zone_fs_type, fstab.zone_fs_type,
1658                     sizeof (fsp->zone_fs_type));
1659                 fsp->zone_fs_options = fstab.zone_fs_options;
1660 
1661                 /*
1662                  * For all lofs mounts, make sure that the 'special'
1663                  * entry points inside the alternate root.  The
1664                  * source path for a lofs mount in a given zone needs
1665                  * to be relative to the root of the boot environment
1666                  * that contains the zone.  Note that we don't do this
1667                  * for non-lofs mounts since they will have a device
1668                  * as a backing store and device paths must always be
1669                  * specified relative to the current boot environment.
1670                  */
1671                 fsp->zone_fs_special[0] = '\0';
1672                 if (strcmp(fsp->zone_fs_type, MNTTYPE_LOFS) == 0) {
1673                         (void) strlcat(fsp->zone_fs_special, zonecfg_get_root(),
1674                             sizeof (fsp->zone_fs_special));
1675                 }
1676                 (void) strlcat(fsp->zone_fs_special, fstab.zone_fs_special,
1677                     sizeof (fsp->zone_fs_special));
1678         }
1679         (void) zonecfg_endfsent(handle);
1680         return (0);
1681 }
1682 
1683 static int
1684 mount_filesystems(zlog_t *zlogp, zone_mnt_t mount_cmd)
1685 {
1686         char rootpath[MAXPATHLEN];
1687         char zonepath[MAXPATHLEN];
1688         char brand[MAXNAMELEN];
1689         char luroot[MAXPATHLEN];
1690         int i, num_fs = 0;
1691         struct zone_fstab *fs_ptr = NULL;
1692         zone_state_t zstate;
1693         brand_handle_t bh;
1694         plat_gmount_cb_data_t cb;
1695 
1696         if (zone_get_state(zone_name, &zstate) != Z_OK ||
1697             (zstate != ZONE_STATE_READY && zstate != ZONE_STATE_MOUNTED)) {
1698                 zerror(zlogp, B_FALSE,
1699                     "zone must be in '%s' or '%s' state to mount file-systems",
1700                     zone_state_str(ZONE_STATE_READY),
1701                     zone_state_str(ZONE_STATE_MOUNTED));
1702                 goto bad;
1703         }
1704 
1705         if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
1706                 zerror(zlogp, B_TRUE, "unable to determine zone path");
1707                 goto bad;
1708         }
1709 
1710         if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
1711                 zerror(zlogp, B_TRUE, "unable to determine zone root");
1712                 goto bad;
1713         }
1714 
1715         if (zonecfg_setfsent(snap_hndl) != Z_OK) {
1716                 zerror(zlogp, B_FALSE, "invalid configuration");
1717                 goto bad;
1718         }
1719 
1720         /*
1721          * If we are mounting the zone, then we must always use the default
1722          * brand global mounts.
1723          */
1724         if (ALT_MOUNT(mount_cmd)) {
1725                 (void) strlcpy(brand, default_brand, sizeof (brand));
1726         } else {
1727                 (void) strlcpy(brand, brand_name, sizeof (brand));
1728         }
1729 
1730         /* Get a handle to the brand info for this zone */
1731         if ((bh = brand_open(brand)) == NULL) {
1732                 zerror(zlogp, B_FALSE, "unable to determine zone brand");
1733                 return (-1);
1734         }
1735 
1736         /*
1737          * Get the list of global filesystems to mount from the brand
1738          * configuration.
1739          */
1740         cb.pgcd_zlogp = zlogp;
1741         cb.pgcd_fs_tab = &fs_ptr;
1742         cb.pgcd_num_fs = &num_fs;
1743         if (brand_platform_iter_gmounts(bh, zonepath,
1744             plat_gmount_cb, &cb) != 0) {
1745                 zerror(zlogp, B_FALSE, "unable to mount filesystems");
1746                 brand_close(bh);
1747                 return (-1);
1748         }
1749         brand_close(bh);
1750 
1751         /*
1752          * Iterate through the rest of the filesystems. Sort them all,
1753          * then mount them in sorted order. This is to make sure the
1754          * higher level directories (e.g., /usr) get mounted before
1755          * any beneath them (e.g., /usr/local).
1756          */
1757         if (mount_filesystems_fsent(snap_hndl, zlogp, &fs_ptr, &num_fs,
1758             mount_cmd) != 0)
1759                 goto bad;
1760 
1761         /*
1762          * Normally when we mount a zone all the zone filesystems
1763          * get mounted relative to rootpath, which is usually
1764          * <zonepath>/root.  But when mounting a zone for administration
1765          * purposes via the zone "mount" state, build_mounted_pre_var()
1766          * updates rootpath to be <zonepath>/lu/a so we'll mount all
1767          * the zones filesystems there instead.
1768          *
1769          * build_mounted_pre_var() and build_mounted_post_var() will
1770          * also do some extra work to create directories and lofs mount
1771          * a bunch of global zone file system paths into <zonepath>/lu.
1772          *
1773          * This allows us to be able to enter the zone (now rooted at
1774          * <zonepath>/lu) and run the upgrade/patch tools that are in the
1775          * global zone and have them upgrade the to-be-modified zone's
1776          * files mounted on /a.  (Which mirrors the existing standard
1777          * upgrade environment.)
1778          *
1779          * There is of course one catch.  When doing the upgrade
1780          * we need <zoneroot>/lu/dev to be the /dev filesystem
1781          * for the zone and we don't want to have any /dev filesystem
1782          * mounted at <zoneroot>/lu/a/dev.  Since /dev is specified
1783          * as a normal zone filesystem by default we'll try to mount
1784          * it at <zoneroot>/lu/a/dev, so we have to detect this
1785          * case and instead mount it at <zoneroot>/lu/dev.
1786          *
1787          * All this work is done in three phases:
1788          *   1) Create and populate lu directory (build_mounted_pre_var()).
1789          *   2) Mount the required filesystems as per the zone configuration.
1790          *   3) Set up the rest of the scratch zone environment
1791          *      (build_mounted_post_var()).
1792          */
1793         if (ALT_MOUNT(mount_cmd) && !build_mounted_pre_var(zlogp,
1794             rootpath, sizeof (rootpath), zonepath, luroot, sizeof (luroot)))
1795                 goto bad;
1796 
1797         qsort(fs_ptr, num_fs, sizeof (*fs_ptr), fs_compare);
1798 
1799         for (i = 0; i < num_fs; i++) {
1800                 if (ALT_MOUNT(mount_cmd) &&
1801                     strcmp(fs_ptr[i].zone_fs_dir, "/dev") == 0) {
1802                         size_t slen = strlen(rootpath) - 2;
1803 
1804                         /*
1805                          * By default we'll try to mount /dev as /a/dev
1806                          * but /dev is special and always goes at the top
1807                          * so strip the trailing '/a' from the rootpath.
1808                          */
1809                         assert(strcmp(&rootpath[slen], "/a") == 0);
1810                         rootpath[slen] = '\0';
1811                         if (mount_one(zlogp, &fs_ptr[i], rootpath, mount_cmd)
1812                             != 0)
1813                                 goto bad;
1814                         rootpath[slen] = '/';
1815                         continue;
1816                 }
1817                 if (mount_one(zlogp, &fs_ptr[i], rootpath, mount_cmd) != 0)
1818                         goto bad;
1819         }
1820         if (ALT_MOUNT(mount_cmd) &&
1821             !build_mounted_post_var(zlogp, mount_cmd, rootpath, luroot))
1822                 goto bad;
1823 
1824         /*
1825          * For Trusted Extensions cross-mount each lower level /export/home
1826          */
1827         if (mount_cmd == Z_MNT_BOOT &&
1828             tsol_mounts(zlogp, zone_name, rootpath) != 0)
1829                 goto bad;
1830 
1831         free_fs_data(fs_ptr, num_fs);
1832 
1833         /*
1834          * Everything looks fine.
1835          */
1836         return (0);
1837 
1838 bad:
1839         free_fs_data(fs_ptr, num_fs);
1840         return (-1);
1841 }
1842 
1843 /* caller makes sure neither parameter is NULL */
1844 static int
1845 addr2netmask(char *prefixstr, int maxprefixlen, uchar_t *maskstr)
1846 {
1847         int prefixlen;
1848 
1849         prefixlen = atoi(prefixstr);
1850         if (prefixlen < 0 || prefixlen > maxprefixlen)
1851                 return (1);
1852         while (prefixlen > 0) {
1853                 if (prefixlen >= 8) {
1854                         *maskstr++ = 0xFF;
1855                         prefixlen -= 8;
1856                         continue;
1857                 }
1858                 *maskstr |= 1 << (8 - prefixlen);
1859                 prefixlen--;
1860         }
1861         return (0);
1862 }
1863 
1864 /*
1865  * Tear down all interfaces belonging to the given zone.  This should
1866  * be called with the zone in a state other than "running", so that
1867  * interfaces can't be assigned to the zone after this returns.
1868  *
1869  * If anything goes wrong, log an error message and return an error.
1870  */
1871 static int
1872 unconfigure_shared_network_interfaces(zlog_t *zlogp, zoneid_t zone_id)
1873 {
1874         struct lifnum lifn;
1875         struct lifconf lifc;
1876         struct lifreq *lifrp, lifrl;
1877         int64_t lifc_flags = LIFC_NOXMIT | LIFC_ALLZONES;
1878         int num_ifs, s, i, ret_code = 0;
1879         uint_t bufsize;
1880         char *buf = NULL;
1881 
1882         if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
1883                 zerror(zlogp, B_TRUE, "could not get socket");
1884                 ret_code = -1;
1885                 goto bad;
1886         }
1887         lifn.lifn_family = AF_UNSPEC;
1888         lifn.lifn_flags = (int)lifc_flags;
1889         if (ioctl(s, SIOCGLIFNUM, (char *)&lifn) < 0) {
1890                 zerror(zlogp, B_TRUE,
1891                     "could not determine number of network interfaces");
1892                 ret_code = -1;
1893                 goto bad;
1894         }
1895         num_ifs = lifn.lifn_count;
1896         bufsize = num_ifs * sizeof (struct lifreq);
1897         if ((buf = malloc(bufsize)) == NULL) {
1898                 zerror(zlogp, B_TRUE, "memory allocation failed");
1899                 ret_code = -1;
1900                 goto bad;
1901         }
1902         lifc.lifc_family = AF_UNSPEC;
1903         lifc.lifc_flags = (int)lifc_flags;
1904         lifc.lifc_len = bufsize;
1905         lifc.lifc_buf = buf;
1906         if (ioctl(s, SIOCGLIFCONF, (char *)&lifc) < 0) {
1907                 zerror(zlogp, B_TRUE, "could not get configured network "
1908                     "interfaces");
1909                 ret_code = -1;
1910                 goto bad;
1911         }
1912         lifrp = lifc.lifc_req;
1913         for (i = lifc.lifc_len / sizeof (struct lifreq); i > 0; i--, lifrp++) {
1914                 (void) close(s);
1915                 if ((s = socket(lifrp->lifr_addr.ss_family, SOCK_DGRAM, 0)) <
1916                     0) {
1917                         zerror(zlogp, B_TRUE, "%s: could not get socket",
1918                             lifrl.lifr_name);
1919                         ret_code = -1;
1920                         continue;
1921                 }
1922                 (void) memset(&lifrl, 0, sizeof (lifrl));
1923                 (void) strncpy(lifrl.lifr_name, lifrp->lifr_name,
1924                     sizeof (lifrl.lifr_name));
1925                 if (ioctl(s, SIOCGLIFZONE, (caddr_t)&lifrl) < 0) {
1926                         if (errno == ENXIO)
1927                                 /*
1928                                  * Interface may have been removed by admin or
1929                                  * another zone halting.
1930                                  */
1931                                 continue;
1932                         zerror(zlogp, B_TRUE,
1933                             "%s: could not determine the zone to which this "
1934                             "network interface is bound", lifrl.lifr_name);
1935                         ret_code = -1;
1936                         continue;
1937                 }
1938                 if (lifrl.lifr_zoneid == zone_id) {
1939                         if (ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifrl) < 0) {
1940                                 zerror(zlogp, B_TRUE,
1941                                     "%s: could not remove network interface",
1942                                     lifrl.lifr_name);
1943                                 ret_code = -1;
1944                                 continue;
1945                         }
1946                 }
1947         }
1948 bad:
1949         if (s > 0)
1950                 (void) close(s);
1951         if (buf)
1952                 free(buf);
1953         return (ret_code);
1954 }
1955 
1956 static union    sockunion {
1957         struct  sockaddr sa;
1958         struct  sockaddr_in sin;
1959         struct  sockaddr_dl sdl;
1960         struct  sockaddr_in6 sin6;
1961 } so_dst, so_ifp;
1962 
1963 static struct {
1964         struct  rt_msghdr hdr;
1965         char    space[512];
1966 } rtmsg;
1967 
1968 static int
1969 salen(struct sockaddr *sa)
1970 {
1971         switch (sa->sa_family) {
1972         case AF_INET:
1973                 return (sizeof (struct sockaddr_in));
1974         case AF_LINK:
1975                 return (sizeof (struct sockaddr_dl));
1976         case AF_INET6:
1977                 return (sizeof (struct sockaddr_in6));
1978         default:
1979                 return (sizeof (struct sockaddr));
1980         }
1981 }
1982 
1983 #define ROUNDUP_LONG(a) \
1984         ((a) > 0 ? (1 + (((a) - 1) | (sizeof (long) - 1))) : sizeof (long))
1985 
1986 /*
1987  * Look up which zone is using a given IP address.  The address in question
1988  * is expected to have been stuffed into the structure to which lifr points
1989  * via a previous SIOCGLIFADDR ioctl().
1990  *
1991  * This is done using black router socket magic.
1992  *
1993  * Return the name of the zone on success or NULL on failure.
1994  *
1995  * This is a lot of code for a simple task; a new ioctl request to take care
1996  * of this might be a useful RFE.
1997  */
1998 
1999 static char *
2000 who_is_using(zlog_t *zlogp, struct lifreq *lifr)
2001 {
2002         static char answer[ZONENAME_MAX];
2003         pid_t pid;
2004         int s, rlen, l, i;
2005         char *cp = rtmsg.space;
2006         struct sockaddr_dl *ifp = NULL;
2007         struct sockaddr *sa;
2008         char save_if_name[LIFNAMSIZ];
2009 
2010         answer[0] = '\0';
2011 
2012         pid = getpid();
2013         if ((s = socket(PF_ROUTE, SOCK_RAW, 0)) < 0) {
2014                 zerror(zlogp, B_TRUE, "could not get routing socket");
2015                 return (NULL);
2016         }
2017 
2018         if (lifr->lifr_addr.ss_family == AF_INET) {
2019                 struct sockaddr_in *sin4;
2020 
2021                 so_dst.sa.sa_family = AF_INET;
2022                 sin4 = (struct sockaddr_in *)&lifr->lifr_addr;
2023                 so_dst.sin.sin_addr = sin4->sin_addr;
2024         } else {
2025                 struct sockaddr_in6 *sin6;
2026 
2027                 so_dst.sa.sa_family = AF_INET6;
2028                 sin6 = (struct sockaddr_in6 *)&lifr->lifr_addr;
2029                 so_dst.sin6.sin6_addr = sin6->sin6_addr;
2030         }
2031 
2032         so_ifp.sa.sa_family = AF_LINK;
2033 
2034         (void) memset(&rtmsg, 0, sizeof (rtmsg));
2035         rtmsg.hdr.rtm_type = RTM_GET;
2036         rtmsg.hdr.rtm_flags = RTF_UP | RTF_HOST;
2037         rtmsg.hdr.rtm_version = RTM_VERSION;
2038         rtmsg.hdr.rtm_seq = ++rts_seqno;
2039         rtmsg.hdr.rtm_addrs = RTA_IFP | RTA_DST;
2040 
2041         l = ROUNDUP_LONG(salen(&so_dst.sa));
2042         (void) memmove(cp, &(so_dst), l);
2043         cp += l;
2044         l = ROUNDUP_LONG(salen(&so_ifp.sa));
2045         (void) memmove(cp, &(so_ifp), l);
2046         cp += l;
2047 
2048         rtmsg.hdr.rtm_msglen = l = cp - (char *)&rtmsg;
2049 
2050         if ((rlen = write(s, &rtmsg, l)) < 0) {
2051                 zerror(zlogp, B_TRUE, "writing to routing socket");
2052                 return (NULL);
2053         } else if (rlen < (int)rtmsg.hdr.rtm_msglen) {
2054                 zerror(zlogp, B_TRUE,
2055                     "write to routing socket got only %d for len\n", rlen);
2056                 return (NULL);
2057         }
2058         do {
2059                 l = read(s, &rtmsg, sizeof (rtmsg));
2060         } while (l > 0 && (rtmsg.hdr.rtm_seq != rts_seqno ||
2061             rtmsg.hdr.rtm_pid != pid));
2062         if (l < 0) {
2063                 zerror(zlogp, B_TRUE, "reading from routing socket");
2064                 return (NULL);
2065         }
2066 
2067         if (rtmsg.hdr.rtm_version != RTM_VERSION) {
2068                 zerror(zlogp, B_FALSE,
2069                     "routing message version %d not understood",
2070                     rtmsg.hdr.rtm_version);
2071                 return (NULL);
2072         }
2073         if (rtmsg.hdr.rtm_msglen != (ushort_t)l) {
2074                 zerror(zlogp, B_FALSE, "message length mismatch, "
2075                     "expected %d bytes, returned %d bytes",
2076                     rtmsg.hdr.rtm_msglen, l);
2077                 return (NULL);
2078         }
2079         if (rtmsg.hdr.rtm_errno != 0)  {
2080                 errno = rtmsg.hdr.rtm_errno;
2081                 zerror(zlogp, B_TRUE, "RTM_GET routing socket message");
2082                 return (NULL);
2083         }
2084         if ((rtmsg.hdr.rtm_addrs & RTA_IFP) == 0) {
2085                 zerror(zlogp, B_FALSE, "network interface not found");
2086                 return (NULL);
2087         }
2088         cp = ((char *)(&rtmsg.hdr + 1));
2089         for (i = 1; i != 0; i <<= 1) {
2090                 /* LINTED E_BAD_PTR_CAST_ALIGN */
2091                 sa = (struct sockaddr *)cp;
2092                 if (i != RTA_IFP) {
2093                         if ((i & rtmsg.hdr.rtm_addrs) != 0)
2094                                 cp += ROUNDUP_LONG(salen(sa));
2095                         continue;
2096                 }
2097                 if (sa->sa_family == AF_LINK &&
2098                     ((struct sockaddr_dl *)sa)->sdl_nlen != 0)
2099                         ifp = (struct sockaddr_dl *)sa;
2100                 break;
2101         }
2102         if (ifp == NULL) {
2103                 zerror(zlogp, B_FALSE, "network interface could not be "
2104                     "determined");
2105                 return (NULL);
2106         }
2107 
2108         /*
2109          * We need to set the I/F name to what we got above, then do the
2110          * appropriate ioctl to get its zone name.  But lifr->lifr_name is
2111          * used by the calling function to do a REMOVEIF, so if we leave the
2112          * "good" zone's I/F name in place, *that* I/F will be removed instead
2113          * of the bad one.  So we save the old (bad) I/F name before over-
2114          * writing it and doing the ioctl, then restore it after the ioctl.
2115          */
2116         (void) strlcpy(save_if_name, lifr->lifr_name, sizeof (save_if_name));
2117         (void) strncpy(lifr->lifr_name, ifp->sdl_data, ifp->sdl_nlen);
2118         lifr->lifr_name[ifp->sdl_nlen] = '\0';
2119         i = ioctl(s, SIOCGLIFZONE, lifr);
2120         (void) strlcpy(lifr->lifr_name, save_if_name, sizeof (save_if_name));
2121         if (i < 0) {
2122                 zerror(zlogp, B_TRUE,
2123                     "%s: could not determine the zone network interface "
2124                     "belongs to", lifr->lifr_name);
2125                 return (NULL);
2126         }
2127         if (getzonenamebyid(lifr->lifr_zoneid, answer, sizeof (answer)) < 0)
2128                 (void) snprintf(answer, sizeof (answer), "%d",
2129                     lifr->lifr_zoneid);
2130 
2131         if (strlen(answer) > 0)
2132                 return (answer);
2133         return (NULL);
2134 }
2135 
2136 /*
2137  * Configures a single interface: a new virtual interface is added, based on
2138  * the physical interface nwiftabptr->zone_nwif_physical, with the address
2139  * specified in nwiftabptr->zone_nwif_address, for zone zone_id.  Note that
2140  * the "address" can be an IPv6 address (with a /prefixlength required), an
2141  * IPv4 address (with a /prefixlength optional), or a name; for the latter,
2142  * an IPv4 name-to-address resolution will be attempted.
2143  *
2144  * If anything goes wrong, we log an detailed error message, attempt to tear
2145  * down whatever we set up and return an error.
2146  */
2147 static int
2148 configure_one_interface(zlog_t *zlogp, zoneid_t zone_id,
2149     struct zone_nwiftab *nwiftabptr)
2150 {
2151         struct lifreq lifr;
2152         struct sockaddr_in netmask4;
2153         struct sockaddr_in6 netmask6;
2154         struct sockaddr_storage laddr;
2155         struct in_addr in4;
2156         sa_family_t af;
2157         char *slashp = strchr(nwiftabptr->zone_nwif_address, '/');
2158         int s;
2159         boolean_t got_netmask = B_FALSE;
2160         boolean_t is_loopback = B_FALSE;
2161         char addrstr4[INET_ADDRSTRLEN];
2162         int res;
2163 
2164         res = zonecfg_valid_net_address(nwiftabptr->zone_nwif_address, &lifr);
2165         if (res != Z_OK) {
2166                 zerror(zlogp, B_FALSE, "%s: %s", zonecfg_strerror(res),
2167                     nwiftabptr->zone_nwif_address);
2168                 return (-1);
2169         }
2170         af = lifr.lifr_addr.ss_family;
2171         if (af == AF_INET)
2172                 in4 = ((struct sockaddr_in *)(&lifr.lifr_addr))->sin_addr;
2173         if ((s = socket(af, SOCK_DGRAM, 0)) < 0) {
2174                 zerror(zlogp, B_TRUE, "could not get socket");
2175                 return (-1);
2176         }
2177 
2178         /*
2179          * This is a similar kind of "hack" like in addif() to get around
2180          * the problem of SIOCLIFADDIF.  The problem is that this ioctl
2181          * does not include the netmask when adding a logical interface.
2182          * To get around this problem, we first add the logical interface
2183          * with a 0 address.  After that, we set the netmask if provided.
2184          * Finally we set the interface address.
2185          */
2186         laddr = lifr.lifr_addr;
2187         (void) strlcpy(lifr.lifr_name, nwiftabptr->zone_nwif_physical,
2188             sizeof (lifr.lifr_name));
2189         (void) memset(&lifr.lifr_addr, 0, sizeof (lifr.lifr_addr));
2190 
2191         if (ioctl(s, SIOCLIFADDIF, (caddr_t)&lifr) < 0) {
2192                 /*
2193                  * Here, we know that the interface can't be brought up.
2194                  */
2195                 (void) close(s);
2196                 return (Z_OK);
2197         }
2198 
2199         /* Preserve literal IPv4 address for later potential printing. */
2200         if (af == AF_INET)
2201                 (void) inet_ntop(AF_INET, &in4, addrstr4, INET_ADDRSTRLEN);
2202 
2203         lifr.lifr_zoneid = zone_id;
2204         if (ioctl(s, SIOCSLIFZONE, (caddr_t)&lifr) < 0) {
2205                 zerror(zlogp, B_TRUE, "%s: could not place network interface "
2206                     "into zone", lifr.lifr_name);
2207                 goto bad;
2208         }
2209 
2210         /*
2211          * Loopback interface will use the default netmask assigned, if no
2212          * netmask is found.
2213          */
2214         if (strcmp(nwiftabptr->zone_nwif_physical, "lo0") == 0) {
2215                 is_loopback = B_TRUE;
2216         }
2217         if (af == AF_INET) {
2218                 /*
2219                  * The IPv4 netmask can be determined either
2220                  * directly if a prefix length was supplied with
2221                  * the address or via the netmasks database.  Not
2222                  * being able to determine it is a common failure,
2223                  * but it often is not fatal to operation of the
2224                  * interface.  In that case, a warning will be
2225                  * printed after the rest of the interface's
2226                  * parameters have been configured.
2227                  */
2228                 (void) memset(&netmask4, 0, sizeof (netmask4));
2229                 if (slashp != NULL) {
2230                         if (addr2netmask(slashp + 1, V4_ADDR_LEN,
2231                             (uchar_t *)&netmask4.sin_addr) != 0) {
2232                                 *slashp = '/';
2233                                 zerror(zlogp, B_FALSE,
2234                                     "%s: invalid prefix length in %s",
2235                                     lifr.lifr_name,
2236                                     nwiftabptr->zone_nwif_address);
2237                                 goto bad;
2238                         }
2239                         got_netmask = B_TRUE;
2240                 } else if (getnetmaskbyaddr(in4,
2241                     &netmask4.sin_addr) == 0) {
2242                         got_netmask = B_TRUE;
2243                 }
2244                 if (got_netmask) {
2245                         netmask4.sin_family = af;
2246                         (void) memcpy(&lifr.lifr_addr, &netmask4,
2247                             sizeof (netmask4));
2248                 }
2249         } else {
2250                 (void) memset(&netmask6, 0, sizeof (netmask6));
2251                 if (addr2netmask(slashp + 1, V6_ADDR_LEN,
2252                     (uchar_t *)&netmask6.sin6_addr) != 0) {
2253                         *slashp = '/';
2254                         zerror(zlogp, B_FALSE,
2255                             "%s: invalid prefix length in %s",
2256                             lifr.lifr_name,
2257                             nwiftabptr->zone_nwif_address);
2258                         goto bad;
2259                 }
2260                 got_netmask = B_TRUE;
2261                 netmask6.sin6_family = af;
2262                 (void) memcpy(&lifr.lifr_addr, &netmask6,
2263                     sizeof (netmask6));
2264         }
2265         if (got_netmask &&
2266             ioctl(s, SIOCSLIFNETMASK, (caddr_t)&lifr) < 0) {
2267                 zerror(zlogp, B_TRUE, "%s: could not set netmask",
2268                     lifr.lifr_name);
2269                 goto bad;
2270         }
2271 
2272         /* Set the interface address */
2273         lifr.lifr_addr = laddr;
2274         if (ioctl(s, SIOCSLIFADDR, (caddr_t)&lifr) < 0) {
2275                 zerror(zlogp, B_TRUE,
2276                     "%s: could not set IP address to %s",
2277                     lifr.lifr_name, nwiftabptr->zone_nwif_address);
2278                 goto bad;
2279         }
2280 
2281         if (ioctl(s, SIOCGLIFFLAGS, (caddr_t)&lifr) < 0) {
2282                 zerror(zlogp, B_TRUE, "%s: could not get flags",
2283                     lifr.lifr_name);
2284                 goto bad;
2285         }
2286         lifr.lifr_flags |= IFF_UP;
2287         if (ioctl(s, SIOCSLIFFLAGS, (caddr_t)&lifr) < 0) {
2288                 int save_errno = errno;
2289                 char *zone_using;
2290 
2291                 /*
2292                  * If we failed with something other than EADDRNOTAVAIL,
2293                  * then skip to the end.  Otherwise, look up our address,
2294                  * then call a function to determine which zone is already
2295                  * using that address.
2296                  */
2297                 if (errno != EADDRNOTAVAIL) {
2298                         zerror(zlogp, B_TRUE,
2299                             "%s: could not bring network interface up",
2300                             lifr.lifr_name);
2301                         goto bad;
2302                 }
2303                 if (ioctl(s, SIOCGLIFADDR, (caddr_t)&lifr) < 0) {
2304                         zerror(zlogp, B_TRUE, "%s: could not get address",
2305                             lifr.lifr_name);
2306                         goto bad;
2307                 }
2308                 zone_using = who_is_using(zlogp, &lifr);
2309                 errno = save_errno;
2310                 if (zone_using == NULL)
2311                         zerror(zlogp, B_TRUE,
2312                             "%s: could not bring network interface up",
2313                             lifr.lifr_name);
2314                 else
2315                         zerror(zlogp, B_TRUE, "%s: could not bring network "
2316                             "interface up: address in use by zone '%s'",
2317                             lifr.lifr_name, zone_using);
2318                 goto bad;
2319         }
2320 
2321         if (!got_netmask && !is_loopback) {
2322                 /*
2323                  * A common, but often non-fatal problem, is that the system
2324                  * cannot find the netmask for an interface address. This is
2325                  * often caused by it being only in /etc/inet/netmasks, but
2326                  * /etc/nsswitch.conf says to use NIS or NIS+ and it's not
2327                  * in that. This doesn't show up at boot because the netmask
2328                  * is obtained from /etc/inet/netmasks when no network
2329                  * interfaces are up, but isn't consulted when NIS/NIS+ is
2330                  * available. We warn the user here that something like this
2331                  * has happened and we're just running with a default and
2332                  * possible incorrect netmask.
2333                  */
2334                 char buffer[INET6_ADDRSTRLEN];
2335                 void  *addr;
2336                 const char *nomatch = "no matching subnet found in netmasks(4)";
2337 
2338                 if (af == AF_INET)
2339                         addr = &((struct sockaddr_in *)
2340                             (&lifr.lifr_addr))->sin_addr;
2341                 else
2342                         addr = &((struct sockaddr_in6 *)
2343                             (&lifr.lifr_addr))->sin6_addr;
2344 
2345                 /*
2346                  * Find out what netmask the interface is going to be using.
2347                  * If we just brought up an IPMP data address on an underlying
2348                  * interface above, the address will have already migrated, so
2349                  * the SIOCGLIFNETMASK won't be able to find it (but we need
2350                  * to bring the address up to get the actual netmask).  Just
2351                  * omit printing the actual netmask in this corner-case.
2352                  */
2353                 if (ioctl(s, SIOCGLIFNETMASK, (caddr_t)&lifr) < 0 ||
2354                     inet_ntop(af, addr, buffer, sizeof (buffer)) == NULL) {
2355                         zerror(zlogp, B_FALSE, "WARNING: %s; using default.",
2356                             nomatch);
2357                 } else {
2358                         zerror(zlogp, B_FALSE,
2359                             "WARNING: %s: %s: %s; using default of %s.",
2360                             lifr.lifr_name, nomatch, addrstr4, buffer);
2361                 }
2362         }
2363 
2364         /*
2365          * If a default router was specified for this interface
2366          * set the route now. Ignore if already set.
2367          */
2368         if (strlen(nwiftabptr->zone_nwif_defrouter) > 0) {
2369                 int status;
2370                 char *argv[7];
2371 
2372                 argv[0] = "route";
2373                 argv[1] = "add";
2374                 argv[2] = "-ifp";
2375                 argv[3] = nwiftabptr->zone_nwif_physical;
2376                 argv[4] = "default";
2377                 argv[5] = nwiftabptr->zone_nwif_defrouter;
2378                 argv[6] = NULL;
2379 
2380                 status = forkexec(zlogp, "/usr/sbin/route", argv);
2381                 if (status != 0 && status != EEXIST)
2382                         zerror(zlogp, B_FALSE, "Unable to set route for "
2383                             "interface %s to %s\n",
2384                             nwiftabptr->zone_nwif_physical,
2385                             nwiftabptr->zone_nwif_defrouter);
2386         }
2387 
2388         (void) close(s);
2389         return (Z_OK);
2390 bad:
2391         (void) ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifr);
2392         (void) close(s);
2393         return (-1);
2394 }
2395 
2396 /*
2397  * Sets up network interfaces based on information from the zone configuration.
2398  * IPv4 and IPv6 loopback interfaces are set up "for free", modeling the global
2399  * system.
2400  *
2401  * If anything goes wrong, we log a general error message, attempt to tear down
2402  * whatever we set up, and return an error.
2403  */
2404 static int
2405 configure_shared_network_interfaces(zlog_t *zlogp)
2406 {
2407         struct zone_nwiftab nwiftab, loopback_iftab;
2408         zoneid_t zoneid;
2409 
2410         if ((zoneid = getzoneidbyname(zone_name)) == ZONE_ID_UNDEFINED) {
2411                 zerror(zlogp, B_TRUE, "unable to get zoneid");
2412                 return (-1);
2413         }
2414 
2415         if (zonecfg_setnwifent(snap_hndl) == Z_OK) {
2416                 for (;;) {
2417                         if (zonecfg_getnwifent(snap_hndl, &nwiftab) != Z_OK)
2418                                 break;
2419                         nwifent_free_attrs(&nwiftab);
2420                         if (configure_one_interface(zlogp, zoneid, &nwiftab) !=
2421                             Z_OK) {
2422                                 (void) zonecfg_endnwifent(snap_hndl);
2423                                 return (-1);
2424                         }
2425                 }
2426                 (void) zonecfg_endnwifent(snap_hndl);
2427         }
2428         if (is_system_labeled()) {
2429                 /*
2430                  * Labeled zones share the loopback interface
2431                  * so it is not plumbed for shared stack instances.
2432                  */
2433                 return (0);
2434         }
2435         (void) strlcpy(loopback_iftab.zone_nwif_physical, "lo0",
2436             sizeof (loopback_iftab.zone_nwif_physical));
2437         (void) strlcpy(loopback_iftab.zone_nwif_address, "127.0.0.1",
2438             sizeof (loopback_iftab.zone_nwif_address));
2439         loopback_iftab.zone_nwif_defrouter[0] = '\0';
2440         if (configure_one_interface(zlogp, zoneid, &loopback_iftab) != Z_OK)
2441                 return (-1);
2442 
2443         /* Always plumb up the IPv6 loopback interface. */
2444         (void) strlcpy(loopback_iftab.zone_nwif_address, "::1/128",
2445             sizeof (loopback_iftab.zone_nwif_address));
2446         if (configure_one_interface(zlogp, zoneid, &loopback_iftab) != Z_OK)
2447                 return (-1);
2448         return (0);
2449 }
2450 
2451 static void
2452 zdlerror(zlog_t *zlogp, dladm_status_t err, const char *dlname, const char *str)
2453 {
2454         char errmsg[DLADM_STRSIZE];
2455 
2456         (void) dladm_status2str(err, errmsg);
2457         zerror(zlogp, B_FALSE, "%s '%s': %s", str, dlname, errmsg);
2458 }
2459 
2460 static int
2461 add_datalink(zlog_t *zlogp, char *zone_name, datalink_id_t linkid, char *dlname)
2462 {
2463         dladm_status_t err;
2464         boolean_t cpuset, poolset;
2465         char *poolp;
2466 
2467         /* First check if it's in use by global zone. */
2468         if (zonecfg_ifname_exists(AF_INET, dlname) ||
2469             zonecfg_ifname_exists(AF_INET6, dlname)) {
2470                 zerror(zlogp, B_FALSE, "WARNING: skipping network interface "
2471                     "'%s' which is used in the global zone", dlname);
2472                 return (-1);
2473         }
2474 
2475         /* Set zoneid of this link. */
2476         err = dladm_set_linkprop(dld_handle, linkid, "zone", &zone_name, 1,
2477             DLADM_OPT_ACTIVE);
2478         if (err != DLADM_STATUS_OK) {
2479                 zdlerror(zlogp, err, dlname,
2480                     "WARNING: unable to add network interface");
2481                 return (-1);
2482         }
2483 
2484         /*
2485          * Set the pool of this link if the zone has a pool and
2486          * neither the cpus nor the pool datalink property is
2487          * already set.
2488          */
2489         err = dladm_linkprop_is_set(dld_handle, linkid, DLADM_PROP_VAL_CURRENT,
2490             "cpus", &cpuset);
2491         if (err != DLADM_STATUS_OK) {
2492                 zdlerror(zlogp, err, dlname,
2493                     "WARNING: unable to check if cpus link property is set");
2494         }
2495         err = dladm_linkprop_is_set(dld_handle, linkid, DLADM_PROP_VAL_CURRENT,
2496             "pool", &poolset);
2497         if (err != DLADM_STATUS_OK) {
2498                 zdlerror(zlogp, err, dlname,
2499                     "WARNING: unable to check if pool link property is set");
2500         }
2501 
2502         if ((strlen(pool_name) != 0) && !cpuset && !poolset) {
2503                 poolp = pool_name;
2504                 err = dladm_set_linkprop(dld_handle, linkid, "pool",
2505                     &poolp, 1, DLADM_OPT_ACTIVE);
2506                 if (err != DLADM_STATUS_OK) {
2507                         zerror(zlogp, B_FALSE, "WARNING: unable to set "
2508                             "pool %s to datalink %s", pool_name, dlname);
2509                         bzero(pool_name, sizeof (pool_name));
2510                 }
2511         } else {
2512                 bzero(pool_name, sizeof (pool_name));
2513         }
2514         return (0);
2515 }
2516 
2517 static boolean_t
2518 sockaddr_to_str(sa_family_t af, const struct sockaddr *sockaddr,
2519     char *straddr, size_t len)
2520 {
2521         struct sockaddr_in *sin;
2522         struct sockaddr_in6 *sin6;
2523         const char *str = NULL;
2524 
2525         if (af == AF_INET) {
2526                 /* LINTED E_BAD_PTR_CAST_ALIGN */
2527                 sin = SIN(sockaddr);
2528                 str = inet_ntop(AF_INET, (void *)&sin->sin_addr, straddr, len);
2529         } else if (af == AF_INET6) {
2530                 /* LINTED E_BAD_PTR_CAST_ALIGN */
2531                 sin6 = SIN6(sockaddr);
2532                 str = inet_ntop(AF_INET6, (void *)&sin6->sin6_addr, straddr,
2533                     len);
2534         }
2535 
2536         return (str != NULL);
2537 }
2538 
2539 static int
2540 ipv4_prefixlen(struct sockaddr_in *sin)
2541 {
2542         struct sockaddr_in *m;
2543         struct sockaddr_storage mask;
2544 
2545         m = SIN(&mask);
2546         m->sin_family = AF_INET;
2547         if (getnetmaskbyaddr(sin->sin_addr, &m->sin_addr) == 0) {
2548                 return (mask2plen((struct sockaddr *)&mask));
2549         } else if (IN_CLASSA(htonl(sin->sin_addr.s_addr))) {
2550                 return (8);
2551         } else if (IN_CLASSB(ntohl(sin->sin_addr.s_addr))) {
2552                 return (16);
2553         } else if (IN_CLASSC(ntohl(sin->sin_addr.s_addr))) {
2554                 return (24);
2555         }
2556         return (0);
2557 }
2558 
2559 static int
2560 zone_setattr_network(int type, zoneid_t zoneid, datalink_id_t linkid,
2561     void *buf, size_t bufsize)
2562 {
2563         zone_net_data_t *zndata;
2564         size_t znsize;
2565         int err;
2566 
2567         znsize = sizeof (*zndata) + bufsize;
2568         zndata = calloc(1, znsize);
2569         if (zndata == NULL)
2570                 return (ENOMEM);
2571         zndata->zn_type = type;
2572         zndata->zn_len = bufsize;
2573         zndata->zn_linkid = linkid;
2574         bcopy(buf, zndata->zn_val, zndata->zn_len);
2575         err = zone_setattr(zoneid, ZONE_ATTR_NETWORK, zndata, znsize);
2576         free(zndata);
2577         return (err);
2578 }
2579 
2580 static int
2581 add_net_for_linkid(zlog_t *zlogp, zoneid_t zoneid, zone_addr_list_t *start)
2582 {
2583         struct lifreq lifr;
2584         char **astr, *address;
2585         dladm_status_t dlstatus;
2586         char *ip_nospoof = "ip-nospoof";
2587         int nnet, naddr, err = 0, j;
2588         size_t zlen, cpleft;
2589         zone_addr_list_t *ptr, *end;
2590         char  tmp[INET6_ADDRSTRLEN], *maskstr;
2591         char *zaddr, *cp;
2592         struct in6_addr *routes = NULL;
2593         boolean_t is_set;
2594         datalink_id_t linkid;
2595 
2596         assert(start != NULL);
2597         naddr = 0; /* number of addresses */
2598         nnet = 0; /* number of net resources */
2599         linkid = start->za_linkid;
2600         for (ptr = start; ptr != NULL && ptr->za_linkid == linkid;
2601             ptr = ptr->za_next) {
2602                 nnet++;
2603         }
2604         end = ptr;
2605         zlen = nnet * (INET6_ADDRSTRLEN + 1);
2606         astr = calloc(1, nnet * sizeof (uintptr_t));
2607         zaddr = calloc(1, zlen);
2608         if (astr == NULL || zaddr == NULL) {
2609                 err = ENOMEM;
2610                 goto done;
2611         }
2612         cp = zaddr;
2613         cpleft = zlen;
2614         j = 0;
2615         for (ptr = start; ptr != end; ptr = ptr->za_next) {
2616                 address = ptr->za_nwiftab.zone_nwif_allowed_address;
2617                 if (address[0] == '\0')
2618                         continue;
2619                 (void) snprintf(tmp, sizeof (tmp), "%s", address);
2620                 /*
2621                  * Validate the data. zonecfg_valid_net_address() clobbers
2622                  * the /<mask> in the address string.
2623                  */
2624                 if (zonecfg_valid_net_address(address, &lifr) != Z_OK) {
2625                         zerror(zlogp, B_FALSE, "invalid address [%s]\n",
2626                             address);
2627                         err = EINVAL;
2628                         goto done;
2629                 }
2630                 /*
2631                  * convert any hostnames to numeric address strings.
2632                  */
2633                 if (!sockaddr_to_str(lifr.lifr_addr.ss_family,
2634                     (const struct sockaddr *)&lifr.lifr_addr, cp, cpleft)) {
2635                         err = EINVAL;
2636                         goto done;
2637                 }
2638                 /*
2639                  * make a copy of the numeric string for the data needed
2640                  * by the "allowed-ips" datalink property.
2641                  */
2642                 astr[j] = strdup(cp);
2643                 if (astr[j] == NULL) {
2644                         err = ENOMEM;
2645                         goto done;
2646                 }
2647                 j++;
2648                 /*
2649                  * compute the default netmask from the address, if necessary
2650                  */
2651                 if ((maskstr = strchr(tmp, '/')) == NULL) {
2652                         int prefixlen;
2653 
2654                         if (lifr.lifr_addr.ss_family == AF_INET) {
2655                                 prefixlen = ipv4_prefixlen(
2656                                     SIN(&lifr.lifr_addr));
2657                         } else {
2658                                 struct sockaddr_in6 *sin6;
2659 
2660                                 sin6 = SIN6(&lifr.lifr_addr);
2661                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2662                                         prefixlen = 10;
2663                                 else
2664                                         prefixlen = 64;
2665                         }
2666                         (void) snprintf(tmp, sizeof (tmp), "%d", prefixlen);
2667                         maskstr = tmp;
2668                 } else {
2669                         maskstr++;
2670                 }
2671                 /* append the "/<netmask>" */
2672                 (void) strlcat(cp, "/", cpleft);
2673                 (void) strlcat(cp, maskstr, cpleft);
2674                 (void) strlcat(cp, ",", cpleft);
2675                 cp += strnlen(cp, zlen);
2676                 cpleft = &zaddr[INET6_ADDRSTRLEN] - cp;
2677         }
2678         naddr = j; /* the actual number of addresses in the net resource */
2679         assert(naddr <= nnet);
2680 
2681         /*
2682          * zonecfg has already verified that the defrouter property can only
2683          * be set if there is at least one address defined for the net resource.
2684          * If j is 0, there are no addresses defined, and therefore no routers
2685          * to configure, and we are done at that point.
2686          */
2687         if (j == 0)
2688                 goto done;
2689 
2690         /* over-write last ',' with '\0' */
2691         zaddr[strnlen(zaddr, zlen) + 1] = '\0';
2692 
2693         /*
2694          * First make sure L3 protection is not already set on the link.
2695          */
2696         dlstatus = dladm_linkprop_is_set(dld_handle, linkid, DLADM_OPT_ACTIVE,
2697             "protection", &is_set);
2698         if (dlstatus != DLADM_STATUS_OK) {
2699                 err = EINVAL;
2700                 zerror(zlogp, B_FALSE, "unable to check if protection is set");
2701                 goto done;
2702         }
2703         if (is_set) {
2704                 err = EINVAL;
2705                 zerror(zlogp, B_FALSE, "Protection is already set");
2706                 goto done;
2707         }
2708         dlstatus = dladm_linkprop_is_set(dld_handle, linkid, DLADM_OPT_ACTIVE,
2709             "allowed-ips", &is_set);
2710         if (dlstatus != DLADM_STATUS_OK) {
2711                 err = EINVAL;
2712                 zerror(zlogp, B_FALSE, "unable to check if allowed-ips is set");
2713                 goto done;
2714         }
2715         if (is_set) {
2716                 zerror(zlogp, B_FALSE, "allowed-ips is already set");
2717                 err = EINVAL;
2718                 goto done;
2719         }
2720 
2721         /*
2722          * Enable ip-nospoof for the link, and add address to the allowed-ips
2723          * list.
2724          */
2725         dlstatus = dladm_set_linkprop(dld_handle, linkid, "protection",
2726             &ip_nospoof, 1, DLADM_OPT_ACTIVE);
2727         if (dlstatus != DLADM_STATUS_OK) {
2728                 zerror(zlogp, B_FALSE, "could not set protection\n");
2729                 err = EINVAL;
2730                 goto done;
2731         }
2732         dlstatus = dladm_set_linkprop(dld_handle, linkid, "allowed-ips",
2733             astr, naddr, DLADM_OPT_ACTIVE);
2734         if (dlstatus != DLADM_STATUS_OK) {
2735                 zerror(zlogp, B_FALSE, "could not set allowed-ips\n");
2736                 err = EINVAL;
2737                 goto done;
2738         }
2739 
2740         /* now set the address in the data-store */
2741         err = zone_setattr_network(ZONE_NETWORK_ADDRESS, zoneid, linkid,
2742             zaddr, strnlen(zaddr, zlen) + 1);
2743         if (err != 0)
2744                 goto done;
2745 
2746         /*
2747          * add the defaultrouters
2748          */
2749         routes = calloc(1, nnet * sizeof (*routes));
2750         j = 0;
2751         for (ptr = start; ptr != end; ptr = ptr->za_next) {
2752                 address = ptr->za_nwiftab.zone_nwif_defrouter;
2753                 if (address[0] == '\0')
2754                         continue;
2755                 if (strchr(address, '/') == NULL && strchr(address, ':') != 0) {
2756                         /*
2757                          * zonecfg_valid_net_address() expects numeric IPv6
2758                          * addresses to have a CIDR format netmask.
2759                          */
2760                         (void) snprintf(tmp, sizeof (tmp), "/%d", V6_ADDR_LEN);
2761                         (void) strlcat(address, tmp, INET6_ADDRSTRLEN);
2762                 }
2763                 if (zonecfg_valid_net_address(address, &lifr) != Z_OK) {
2764                         zerror(zlogp, B_FALSE,
2765                             "invalid router [%s]\n", address);
2766                         err = EINVAL;
2767                         goto done;
2768                 }
2769                 if (lifr.lifr_addr.ss_family == AF_INET6) {
2770                         routes[j] = SIN6(&lifr.lifr_addr)->sin6_addr;
2771                 } else {
2772                         IN6_INADDR_TO_V4MAPPED(&SIN(&lifr.lifr_addr)->sin_addr,
2773                             &routes[j]);
2774                 }
2775                 j++;
2776         }
2777         assert(j <= nnet);
2778         if (j > 0) {
2779                 err = zone_setattr_network(ZONE_NETWORK_DEFROUTER, zoneid,
2780                     linkid, routes, j * sizeof (*routes));
2781         }
2782 done:
2783         free(routes);
2784         for (j = 0; j < naddr; j++)
2785                 free(astr[j]);
2786         free(astr);
2787         free(zaddr);
2788         return (err);
2789 
2790 }
2791 
2792 static int
2793 add_net(zlog_t *zlogp, zoneid_t zoneid, zone_addr_list_t *zalist)
2794 {
2795         zone_addr_list_t *ptr;
2796         datalink_id_t linkid;
2797         int err;
2798 
2799         if (zalist == NULL)
2800                 return (0);
2801 
2802         linkid = zalist->za_linkid;
2803 
2804         err = add_net_for_linkid(zlogp, zoneid, zalist);
2805         if (err != 0)
2806                 return (err);
2807 
2808         for (ptr = zalist; ptr != NULL; ptr = ptr->za_next) {
2809                 if (ptr->za_linkid == linkid)
2810                         continue;
2811                 linkid = ptr->za_linkid;
2812                 err = add_net_for_linkid(zlogp, zoneid, ptr);
2813                 if (err != 0)
2814                         return (err);
2815         }
2816         return (0);
2817 }
2818 
2819 /*
2820  * Add "new" to the list of network interfaces to be configured  by
2821  * add_net on zone boot in "old". The list of interfaces in "old" is
2822  * sorted by datalink_id_t, with interfaces sorted FIFO for a given
2823  * datalink_id_t.
2824  *
2825  * Returns the merged list of IP interfaces containing "old" and "new"
2826  */
2827 static zone_addr_list_t *
2828 add_ip_interface(zone_addr_list_t *old, zone_addr_list_t *new)
2829 {
2830         zone_addr_list_t *ptr, *next;
2831         datalink_id_t linkid = new->za_linkid;
2832 
2833         assert(old != new);
2834 
2835         if (old == NULL)
2836                 return (new);
2837         for (ptr = old; ptr != NULL; ptr = ptr->za_next) {
2838                 if (ptr->za_linkid == linkid)
2839                         break;
2840         }
2841         if (ptr == NULL) {
2842                 /* linkid does not already exist, add to the beginning */
2843                 new->za_next = old;
2844                 return (new);
2845         }
2846         /*
2847          * adding to the middle of the list; ptr points at the first
2848          * occurrence of linkid. Find the last occurrence.
2849          */
2850         while ((next = ptr->za_next) != NULL) {
2851                 if (next->za_linkid != linkid)
2852                         break;
2853                 ptr = next;
2854         }
2855         /* insert new after ptr */
2856         new->za_next = next;
2857         ptr->za_next = new;
2858         return (old);
2859 }
2860 
2861 void
2862 free_ip_interface(zone_addr_list_t *zalist)
2863 {
2864         zone_addr_list_t *ptr, *new;
2865 
2866         for (ptr = zalist; ptr != NULL; ) {
2867                 new = ptr;
2868                 ptr = ptr->za_next;
2869                 free(new);
2870         }
2871 }
2872 
2873 /*
2874  * Add the kernel access control information for the interface names.
2875  * If anything goes wrong, we log a general error message, attempt to tear down
2876  * whatever we set up, and return an error.
2877  */
2878 static int
2879 configure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
2880 {
2881         struct zone_nwiftab nwiftab;
2882         char rootpath[MAXPATHLEN];
2883         char path[MAXPATHLEN];
2884         datalink_id_t linkid;
2885         di_prof_t prof = NULL;
2886         boolean_t added = B_FALSE;
2887         zone_addr_list_t *zalist = NULL, *new;
2888 
2889         if (zonecfg_setnwifent(snap_hndl) != Z_OK)
2890                 return (0);
2891 
2892         for (;;) {
2893                 if (zonecfg_getnwifent(snap_hndl, &nwiftab) != Z_OK)
2894                         break;
2895 
2896                 nwifent_free_attrs(&nwiftab);
2897                 if (prof == NULL) {
2898                         if (zone_get_devroot(zone_name, rootpath,
2899                             sizeof (rootpath)) != Z_OK) {
2900                                 (void) zonecfg_endnwifent(snap_hndl);
2901                                 zerror(zlogp, B_TRUE,
2902                                     "unable to determine dev root");
2903                                 return (-1);
2904                         }
2905                         (void) snprintf(path, sizeof (path), "%s%s", rootpath,
2906                             "/dev");
2907                         if (di_prof_init(path, &prof) != 0) {
2908                                 (void) zonecfg_endnwifent(snap_hndl);
2909                                 zerror(zlogp, B_TRUE,
2910                                     "failed to initialize profile");
2911                                 return (-1);
2912                         }
2913                 }
2914 
2915                 /*
2916                  * Create the /dev entry for backward compatibility.
2917                  * Only create the /dev entry if it's not in use.
2918                  * Note that the zone still boots when the assigned
2919                  * interface is inaccessible, used by others, etc.
2920                  * Also, when vanity naming is used, some interface do
2921                  * do not have corresponding /dev node names (for example,
2922                  * vanity named aggregations).  The /dev entry is not
2923                  * created in that case.  The /dev/net entry is always
2924                  * accessible.
2925                  */
2926                 if (dladm_name2info(dld_handle, nwiftab.zone_nwif_physical,
2927                     &linkid, NULL, NULL, NULL) == DLADM_STATUS_OK &&
2928                     add_datalink(zlogp, zone_name, linkid,
2929                     nwiftab.zone_nwif_physical) == 0) {
2930                         added = B_TRUE;
2931                 } else {
2932                         /*
2933                          * Failed to add network device, but the brand hook
2934                          * might be doing this for us, so keep silent.
2935                          */
2936                         continue;
2937                 }
2938                 /* set up the new IP interface, and add them all later */
2939                 new = malloc(sizeof (*new));
2940                 if (new == NULL) {
2941                         zerror(zlogp, B_TRUE, "no memory for %s",
2942                             nwiftab.zone_nwif_physical);
2943                         free_ip_interface(zalist);
2944                 }
2945                 bzero(new, sizeof (*new));
2946                 new->za_nwiftab = nwiftab;
2947                 new->za_linkid = linkid;
2948                 zalist = add_ip_interface(zalist, new);
2949         }
2950         if (zalist != NULL) {
2951                 if ((errno = add_net(zlogp, zoneid, zalist)) != 0) {
2952                         (void) zonecfg_endnwifent(snap_hndl);
2953                         zerror(zlogp, B_TRUE, "failed to add address");
2954                         free_ip_interface(zalist);
2955                         return (-1);
2956                 }
2957                 free_ip_interface(zalist);
2958         }
2959         (void) zonecfg_endnwifent(snap_hndl);
2960 
2961         if (prof != NULL && added) {
2962                 if (di_prof_commit(prof) != 0) {
2963                         zerror(zlogp, B_TRUE, "failed to commit profile");
2964                         return (-1);
2965                 }
2966         }
2967         if (prof != NULL)
2968                 di_prof_fini(prof);
2969 
2970         return (0);
2971 }
2972 
2973 static int
2974 remove_datalink_pool(zlog_t *zlogp, zoneid_t zoneid)
2975 {
2976         ushort_t flags;
2977         zone_iptype_t iptype;
2978         int i, dlnum = 0;
2979         datalink_id_t *dllink, *dllinks = NULL;
2980         dladm_status_t err;
2981 
2982         if (strlen(pool_name) == 0)
2983                 return (0);
2984 
2985         if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
2986             sizeof (flags)) < 0) {
2987                 if (vplat_get_iptype(zlogp, &iptype) < 0) {
2988                         zerror(zlogp, B_FALSE, "unable to determine ip-type");
2989                         return (-1);
2990                 }
2991         } else {
2992                 if (flags & ZF_NET_EXCL)
2993                         iptype = ZS_EXCLUSIVE;
2994                 else
2995                         iptype = ZS_SHARED;
2996         }
2997 
2998         if (iptype == ZS_EXCLUSIVE) {
2999                 /*
3000                  * Get the datalink count and for each datalink,
3001                  * attempt to clear the pool property and clear
3002                  * the pool_name.
3003                  */
3004                 if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
3005                         zerror(zlogp, B_TRUE, "unable to count network "
3006                             "interfaces");
3007                         return (-1);
3008                 }
3009 
3010                 if (dlnum == 0)
3011                         return (0);
3012 
3013                 if ((dllinks = malloc(dlnum * sizeof (datalink_id_t)))
3014                     == NULL) {
3015                         zerror(zlogp, B_TRUE, "memory allocation failed");
3016                         return (-1);
3017                 }
3018                 if (zone_list_datalink(zoneid, &dlnum, dllinks) != 0) {
3019                         zerror(zlogp, B_TRUE, "unable to list network "
3020                             "interfaces");
3021                         return (-1);
3022                 }
3023 
3024                 bzero(pool_name, sizeof (pool_name));
3025                 for (i = 0, dllink = dllinks; i < dlnum; i++, dllink++) {
3026                         err = dladm_set_linkprop(dld_handle, *dllink, "pool",
3027                             NULL, 0, DLADM_OPT_ACTIVE);
3028                         if (err != DLADM_STATUS_OK) {
3029                                 zerror(zlogp, B_TRUE,
3030                                     "WARNING: unable to clear pool");
3031                         }
3032                 }
3033                 free(dllinks);
3034         }
3035         return (0);
3036 }
3037 
3038 static int
3039 remove_datalink_protect(zlog_t *zlogp, zoneid_t zoneid)
3040 {
3041         ushort_t flags;
3042         zone_iptype_t iptype;
3043         int i, dlnum = 0;
3044         dladm_status_t dlstatus;
3045         datalink_id_t *dllink, *dllinks = NULL;
3046 
3047         if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
3048             sizeof (flags)) < 0) {
3049                 if (vplat_get_iptype(zlogp, &iptype) < 0) {
3050                         zerror(zlogp, B_FALSE, "unable to determine ip-type");
3051                         return (-1);
3052                 }
3053         } else {
3054                 if (flags & ZF_NET_EXCL)
3055                         iptype = ZS_EXCLUSIVE;
3056                 else
3057                         iptype = ZS_SHARED;
3058         }
3059 
3060         if (iptype != ZS_EXCLUSIVE)
3061                 return (0);
3062 
3063         /*
3064          * Get the datalink count and for each datalink,
3065          * attempt to clear the pool property and clear
3066          * the pool_name.
3067          */
3068         if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
3069                 zerror(zlogp, B_TRUE, "unable to count network interfaces");
3070                 return (-1);
3071         }
3072 
3073         if (dlnum == 0)
3074                 return (0);
3075 
3076         if ((dllinks = malloc(dlnum * sizeof (datalink_id_t))) == NULL) {
3077                 zerror(zlogp, B_TRUE, "memory allocation failed");
3078                 return (-1);
3079         }
3080         if (zone_list_datalink(zoneid, &dlnum, dllinks) != 0) {
3081                 zerror(zlogp, B_TRUE, "unable to list network interfaces");
3082                 free(dllinks);
3083                 return (-1);
3084         }
3085 
3086         for (i = 0, dllink = dllinks; i < dlnum; i++, dllink++) {
3087                 char dlerr[DLADM_STRSIZE];
3088 
3089                 dlstatus = dladm_set_linkprop(dld_handle, *dllink,
3090                     "protection", NULL, 0, DLADM_OPT_ACTIVE);
3091                 if (dlstatus == DLADM_STATUS_NOTFOUND) {
3092                         /* datalink does not belong to the GZ */
3093                         continue;
3094                 }
3095                 if (dlstatus != DLADM_STATUS_OK)
3096                         zerror(zlogp, B_FALSE,
3097                             "clear 'protection' link property: %s",
3098                             dladm_status2str(dlstatus, dlerr));
3099 
3100                 dlstatus = dladm_set_linkprop(dld_handle, *dllink,
3101                     "allowed-ips", NULL, 0, DLADM_OPT_ACTIVE);
3102                 if (dlstatus != DLADM_STATUS_OK)
3103                         zerror(zlogp, B_FALSE,
3104                             "clear 'allowed-ips' link property: %s",
3105                             dladm_status2str(dlstatus, dlerr));
3106         }
3107         free(dllinks);
3108         return (0);
3109 }
3110 
3111 static int
3112 tcp_abort_conn(zlog_t *zlogp, zoneid_t zoneid,
3113     const struct sockaddr_storage *local, const struct sockaddr_storage *remote)
3114 {
3115         int fd;
3116         struct strioctl ioc;
3117         tcp_ioc_abort_conn_t conn;
3118         int error;
3119 
3120         conn.ac_local = *local;
3121         conn.ac_remote = *remote;
3122         conn.ac_start = TCPS_SYN_SENT;
3123         conn.ac_end = TCPS_TIME_WAIT;
3124         conn.ac_zoneid = zoneid;
3125 
3126         ioc.ic_cmd = TCP_IOC_ABORT_CONN;
3127         ioc.ic_timout = -1; /* infinite timeout */
3128         ioc.ic_len = sizeof (conn);
3129         ioc.ic_dp = (char *)&conn;
3130 
3131         if ((fd = open("/dev/tcp", O_RDONLY)) < 0) {
3132                 zerror(zlogp, B_TRUE, "unable to open %s", "/dev/tcp");
3133                 return (-1);
3134         }
3135 
3136         error = ioctl(fd, I_STR, &ioc);
3137         (void) close(fd);
3138         if (error == 0 || errno == ENOENT)      /* ENOENT is not an error */
3139                 return (0);
3140         return (-1);
3141 }
3142 
3143 static int
3144 tcp_abort_connections(zlog_t *zlogp, zoneid_t zoneid)
3145 {
3146         struct sockaddr_storage l, r;
3147         struct sockaddr_in *local, *remote;
3148         struct sockaddr_in6 *local6, *remote6;
3149         int error;
3150 
3151         /*
3152          * Abort IPv4 connections.
3153          */
3154         bzero(&l, sizeof (*local));
3155         local = (struct sockaddr_in *)&l;
3156         local->sin_family = AF_INET;
3157         local->sin_addr.s_addr = INADDR_ANY;
3158         local->sin_port = 0;
3159 
3160         bzero(&r, sizeof (*remote));
3161         remote = (struct sockaddr_in *)&r;
3162         remote->sin_family = AF_INET;
3163         remote->sin_addr.s_addr = INADDR_ANY;
3164         remote->sin_port = 0;
3165 
3166         if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
3167                 return (error);
3168 
3169         /*
3170          * Abort IPv6 connections.
3171          */
3172         bzero(&l, sizeof (*local6));
3173         local6 = (struct sockaddr_in6 *)&l;
3174         local6->sin6_family = AF_INET6;
3175         local6->sin6_port = 0;
3176         local6->sin6_addr = in6addr_any;
3177 
3178         bzero(&r, sizeof (*remote6));
3179         remote6 = (struct sockaddr_in6 *)&r;
3180         remote6->sin6_family = AF_INET6;
3181         remote6->sin6_port = 0;
3182         remote6->sin6_addr = in6addr_any;
3183 
3184         if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
3185                 return (error);
3186         return (0);
3187 }
3188 
3189 static int
3190 get_privset(zlog_t *zlogp, priv_set_t *privs, zone_mnt_t mount_cmd)
3191 {
3192         int error = -1;
3193         char *privname = NULL;
3194 
3195         if (ALT_MOUNT(mount_cmd)) {
3196                 zone_iptype_t   iptype;
3197                 const char      *curr_iptype;
3198 
3199                 if (zonecfg_get_iptype(snap_hndl, &iptype) != Z_OK) {
3200                         zerror(zlogp, B_TRUE, "unable to determine ip-type");
3201                         return (-1);
3202                 }
3203 
3204                 switch (iptype) {
3205                 case ZS_SHARED:
3206                         curr_iptype = "shared";
3207                         break;
3208                 case ZS_EXCLUSIVE:
3209                         curr_iptype = "exclusive";
3210                         break;
3211                 }
3212 
3213                 if (zonecfg_default_privset(privs, curr_iptype) == Z_OK)
3214                         return (0);
3215 
3216                 zerror(zlogp, B_FALSE,
3217                     "failed to determine the zone's default privilege set");
3218                 return (-1);
3219         }
3220 
3221         switch (zonecfg_get_privset(snap_hndl, privs, &privname)) {
3222         case Z_OK:
3223                 error = 0;
3224                 break;
3225         case Z_PRIV_PROHIBITED:
3226                 zerror(zlogp, B_FALSE, "privilege \"%s\" is not permitted "
3227                     "within the zone's privilege set", privname);
3228                 break;
3229         case Z_PRIV_REQUIRED:
3230                 zerror(zlogp, B_FALSE, "required privilege \"%s\" is missing "
3231                     "from the zone's privilege set", privname);
3232                 break;
3233         case Z_PRIV_UNKNOWN:
3234                 zerror(zlogp, B_FALSE, "unknown privilege \"%s\" specified "
3235                     "in the zone's privilege set", privname);
3236                 break;
3237         default:
3238                 zerror(zlogp, B_FALSE, "failed to determine the zone's "
3239                     "privilege set");
3240                 break;
3241         }
3242 
3243         free(privname);
3244         return (error);
3245 }
3246 
3247 static int
3248 get_rctls(zlog_t *zlogp, char **bufp, size_t *bufsizep)
3249 {
3250         nvlist_t *nvl = NULL;
3251         char *nvl_packed = NULL;
3252         size_t nvl_size = 0;
3253         nvlist_t **nvlv = NULL;
3254         int rctlcount = 0;
3255         int error = -1;
3256         struct zone_rctltab rctltab;
3257         rctlblk_t *rctlblk = NULL;
3258         uint64_t maxlwps;
3259         uint64_t maxprocs;
3260 
3261         *bufp = NULL;
3262         *bufsizep = 0;
3263 
3264         rctltab.zone_rctl_valptr = NULL;
3265         if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0) {
3266                 zerror(zlogp, B_TRUE, "%s failed", "nvlist_alloc");
3267                 goto out;
3268         }
3269 
3270         /*
3271          * Allow the administrator to control both the maximum number of
3272          * process table slots and the maximum number of lwps with just the
3273          * max-processes property.  If only the max-processes property is set,
3274          * we add a max-lwps property with a limit derived from max-processes.
3275          */
3276         if (zonecfg_get_aliased_rctl(snap_hndl, ALIAS_MAXPROCS, &maxprocs)
3277             == Z_OK &&
3278             zonecfg_get_aliased_rctl(snap_hndl, ALIAS_MAXLWPS, &maxlwps)
3279             == Z_NO_ENTRY) {
3280                 if (zonecfg_set_aliased_rctl(snap_hndl, ALIAS_MAXLWPS,
3281                     maxprocs * LWPS_PER_PROCESS) != Z_OK) {
3282                         zerror(zlogp, B_FALSE, "unable to set max-lwps alias");
3283                         goto out;
3284                 }
3285         }
3286 
3287         if (zonecfg_setrctlent(snap_hndl) != Z_OK) {
3288                 zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setrctlent");
3289                 goto out;
3290         }
3291 
3292         if ((rctlblk = malloc(rctlblk_size())) == NULL) {
3293                 zerror(zlogp, B_TRUE, "memory allocation failed");
3294                 goto out;
3295         }
3296         while (zonecfg_getrctlent(snap_hndl, &rctltab) == Z_OK) {
3297                 struct zone_rctlvaltab *rctlval;
3298                 uint_t i, count;
3299                 const char *name = rctltab.zone_rctl_name;
3300 
3301                 /* zoneadm should have already warned about unknown rctls. */
3302                 if (!zonecfg_is_rctl(name)) {
3303                         zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3304                         rctltab.zone_rctl_valptr = NULL;
3305                         continue;
3306                 }
3307                 count = 0;
3308                 for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
3309                     rctlval = rctlval->zone_rctlval_next) {
3310                         count++;
3311                 }
3312                 if (count == 0) {       /* ignore */
3313                         continue;       /* Nothing to free */
3314                 }
3315                 if ((nvlv = malloc(sizeof (*nvlv) * count)) == NULL)
3316                         goto out;
3317                 i = 0;
3318                 for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
3319                     rctlval = rctlval->zone_rctlval_next, i++) {
3320                         if (nvlist_alloc(&nvlv[i], NV_UNIQUE_NAME, 0) != 0) {
3321                                 zerror(zlogp, B_TRUE, "%s failed",
3322                                     "nvlist_alloc");
3323                                 goto out;
3324                         }
3325                         if (zonecfg_construct_rctlblk(rctlval, rctlblk)
3326                             != Z_OK) {
3327                                 zerror(zlogp, B_FALSE, "invalid rctl value: "
3328                                     "(priv=%s,limit=%s,action=%s)",
3329                                     rctlval->zone_rctlval_priv,
3330                                     rctlval->zone_rctlval_limit,
3331                                     rctlval->zone_rctlval_action);
3332                                 goto out;
3333                         }
3334                         if (!zonecfg_valid_rctl(name, rctlblk)) {
3335                                 zerror(zlogp, B_FALSE,
3336                                     "(priv=%s,limit=%s,action=%s) is not a "
3337                                     "valid value for rctl '%s'",
3338                                     rctlval->zone_rctlval_priv,
3339                                     rctlval->zone_rctlval_limit,
3340                                     rctlval->zone_rctlval_action,
3341                                     name);
3342                                 goto out;
3343                         }
3344                         if (nvlist_add_uint64(nvlv[i], "privilege",
3345                             rctlblk_get_privilege(rctlblk)) != 0) {
3346                                 zerror(zlogp, B_FALSE, "%s failed",
3347                                     "nvlist_add_uint64");
3348                                 goto out;
3349                         }
3350                         if (nvlist_add_uint64(nvlv[i], "limit",
3351                             rctlblk_get_value(rctlblk)) != 0) {
3352                                 zerror(zlogp, B_FALSE, "%s failed",
3353                                     "nvlist_add_uint64");
3354                                 goto out;
3355                         }
3356                         if (nvlist_add_uint64(nvlv[i], "action",
3357                             (uint_t)rctlblk_get_local_action(rctlblk, NULL))
3358                             != 0) {
3359                                 zerror(zlogp, B_FALSE, "%s failed",
3360                                     "nvlist_add_uint64");
3361                                 goto out;
3362                         }
3363                 }
3364                 zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3365                 rctltab.zone_rctl_valptr = NULL;
3366                 if (nvlist_add_nvlist_array(nvl, (char *)name, nvlv, count)
3367                     != 0) {
3368                         zerror(zlogp, B_FALSE, "%s failed",
3369                             "nvlist_add_nvlist_array");
3370                         goto out;
3371                 }
3372                 for (i = 0; i < count; i++)
3373                         nvlist_free(nvlv[i]);
3374                 free(nvlv);
3375                 nvlv = NULL;
3376                 rctlcount++;
3377         }
3378         (void) zonecfg_endrctlent(snap_hndl);
3379 
3380         if (rctlcount == 0) {
3381                 error = 0;
3382                 goto out;
3383         }
3384         if (nvlist_pack(nvl, &nvl_packed, &nvl_size, NV_ENCODE_NATIVE, 0)
3385             != 0) {
3386                 zerror(zlogp, B_FALSE, "%s failed", "nvlist_pack");
3387                 goto out;
3388         }
3389 
3390         error = 0;
3391         *bufp = nvl_packed;
3392         *bufsizep = nvl_size;
3393 
3394 out:
3395         free(rctlblk);
3396         zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3397         if (error && nvl_packed != NULL)
3398                 free(nvl_packed);
3399         if (nvl != NULL)
3400                 nvlist_free(nvl);
3401         if (nvlv != NULL)
3402                 free(nvlv);
3403         return (error);
3404 }
3405 
3406 static int
3407 get_implicit_datasets(zlog_t *zlogp, char **retstr)
3408 {
3409         char cmdbuf[2 * MAXPATHLEN];
3410 
3411         if (query_hook[0] == '\0')
3412                 return (0);
3413 
3414         if (snprintf(cmdbuf, sizeof (cmdbuf), "%s datasets", query_hook)
3415             > sizeof (cmdbuf))
3416                 return (-1);
3417 
3418         if (do_subproc(zlogp, cmdbuf, retstr, B_FALSE) != 0)
3419                 return (-1);
3420 
3421         return (0);
3422 }
3423 
3424 static int
3425 get_datasets(zlog_t *zlogp, char **bufp, size_t *bufsizep)
3426 {
3427         struct zone_dstab dstab;
3428         size_t total, offset, len;
3429         int error = -1;
3430         char *str = NULL;
3431         char *implicit_datasets = NULL;
3432         int implicit_len = 0;
3433 
3434         *bufp = NULL;
3435         *bufsizep = 0;
3436 
3437         if (get_implicit_datasets(zlogp, &implicit_datasets) != 0) {
3438                 zerror(zlogp, B_FALSE, "getting implicit datasets failed");
3439                 goto out;
3440         }
3441 
3442         if (zonecfg_setdsent(snap_hndl) != Z_OK) {
3443                 zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
3444                 goto out;
3445         }
3446 
3447         total = 0;
3448         while (zonecfg_getdsent(snap_hndl, &dstab) == Z_OK)
3449                 total += strlen(dstab.zone_dataset_name) + 1;
3450         (void) zonecfg_enddsent(snap_hndl);
3451 
3452         if (implicit_datasets != NULL)
3453                 implicit_len = strlen(implicit_datasets);
3454         if (implicit_len > 0)
3455                 total += implicit_len + 1;
3456 
3457         if (total == 0) {
3458                 error = 0;
3459                 goto out;
3460         }
3461 
3462         if ((str = malloc(total)) == NULL) {
3463                 zerror(zlogp, B_TRUE, "memory allocation failed");
3464                 goto out;
3465         }
3466 
3467         if (zonecfg_setdsent(snap_hndl) != Z_OK) {
3468                 zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
3469                 goto out;
3470         }
3471         offset = 0;
3472         while (zonecfg_getdsent(snap_hndl, &dstab) == Z_OK) {
3473                 len = strlen(dstab.zone_dataset_name);
3474                 (void) strlcpy(str + offset, dstab.zone_dataset_name,
3475                     total - offset);
3476                 offset += len;
3477                 if (offset < total - 1)
3478                         str[offset++] = ',';
3479         }
3480         (void) zonecfg_enddsent(snap_hndl);
3481 
3482         if (implicit_len > 0)
3483                 (void) strlcpy(str + offset, implicit_datasets, total - offset);
3484 
3485         error = 0;
3486         *bufp = str;
3487         *bufsizep = total;
3488 
3489 out:
3490         if (error != 0 && str != NULL)
3491                 free(str);
3492         if (implicit_datasets != NULL)
3493                 free(implicit_datasets);
3494 
3495         return (error);
3496 }
3497 
3498 static int
3499 validate_datasets(zlog_t *zlogp)
3500 {
3501         struct zone_dstab dstab;
3502         zfs_handle_t *zhp;
3503         libzfs_handle_t *hdl;
3504 
3505         if (zonecfg_setdsent(snap_hndl) != Z_OK) {
3506                 zerror(zlogp, B_FALSE, "invalid configuration");
3507                 return (-1);
3508         }
3509 
3510         if ((hdl = libzfs_init()) == NULL) {
3511                 zerror(zlogp, B_FALSE, "opening ZFS library");
3512                 return (-1);
3513         }
3514 
3515         while (zonecfg_getdsent(snap_hndl, &dstab) == Z_OK) {
3516 
3517                 if ((zhp = zfs_open(hdl, dstab.zone_dataset_name,
3518                     ZFS_TYPE_FILESYSTEM)) == NULL) {
3519                         zerror(zlogp, B_FALSE, "cannot open ZFS dataset '%s'",
3520                             dstab.zone_dataset_name);
3521                         libzfs_fini(hdl);
3522                         return (-1);
3523                 }
3524 
3525                 /*
3526                  * Automatically set the 'zoned' property.  We check the value
3527                  * first because we'll get EPERM if it is already set.
3528                  */
3529                 if (!zfs_prop_get_int(zhp, ZFS_PROP_ZONED) &&
3530                     zfs_prop_set(zhp, zfs_prop_to_name(ZFS_PROP_ZONED),
3531                     "on") != 0) {
3532                         zerror(zlogp, B_FALSE, "cannot set 'zoned' "
3533                             "property for ZFS dataset '%s'\n",
3534                             dstab.zone_dataset_name);
3535                         zfs_close(zhp);
3536                         libzfs_fini(hdl);
3537                         return (-1);
3538                 }
3539 
3540                 zfs_close(zhp);
3541         }
3542         (void) zonecfg_enddsent(snap_hndl);
3543 
3544         libzfs_fini(hdl);
3545 
3546         return (0);
3547 }
3548 
3549 /*
3550  * Return true if the path is its own zfs file system.  We determine this
3551  * by stat-ing the path to see if it is zfs and stat-ing the parent to see
3552  * if it is a different fs.
3553  */
3554 boolean_t
3555 is_zonepath_zfs(char *zonepath)
3556 {
3557         int res;
3558         char *path;
3559         char *parent;
3560         struct statvfs64 buf1, buf2;
3561 
3562         if (statvfs64(zonepath, &buf1) != 0)
3563                 return (B_FALSE);
3564 
3565         if (strcmp(buf1.f_basetype, "zfs") != 0)
3566                 return (B_FALSE);
3567 
3568         if ((path = strdup(zonepath)) == NULL)
3569                 return (B_FALSE);
3570 
3571         parent = dirname(path);
3572         res = statvfs64(parent, &buf2);
3573         free(path);
3574 
3575         if (res != 0)
3576                 return (B_FALSE);
3577 
3578         if (buf1.f_fsid == buf2.f_fsid)
3579                 return (B_FALSE);
3580 
3581         return (B_TRUE);
3582 }
3583 
3584 /*
3585  * Verify the MAC label in the root dataset for the zone.
3586  * If the label exists, it must match the label configured for the zone.
3587  * Otherwise if there's no label on the dataset, create one here.
3588  */
3589 
3590 static int
3591 validate_rootds_label(zlog_t *zlogp, char *rootpath, m_label_t *zone_sl)
3592 {
3593         int             error = -1;
3594         zfs_handle_t    *zhp;
3595         libzfs_handle_t *hdl;
3596         m_label_t       ds_sl;
3597         char            zonepath[MAXPATHLEN];
3598         char            ds_hexsl[MAXNAMELEN];
3599 
3600         if (!is_system_labeled())
3601                 return (0);
3602 
3603         if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
3604                 zerror(zlogp, B_TRUE, "unable to determine zone path");
3605                 return (-1);
3606         }
3607 
3608         if (!is_zonepath_zfs(zonepath))
3609                 return (0);
3610 
3611         if ((hdl = libzfs_init()) == NULL) {
3612                 zerror(zlogp, B_FALSE, "opening ZFS library");
3613                 return (-1);
3614         }
3615 
3616         if ((zhp = zfs_path_to_zhandle(hdl, rootpath,
3617             ZFS_TYPE_FILESYSTEM)) == NULL) {
3618                 zerror(zlogp, B_FALSE, "cannot open ZFS dataset for path '%s'",
3619                     rootpath);
3620                 libzfs_fini(hdl);
3621                 return (-1);
3622         }
3623 
3624         /* Get the mlslabel property if it exists. */
3625         if ((zfs_prop_get(zhp, ZFS_PROP_MLSLABEL, ds_hexsl, MAXNAMELEN,
3626             NULL, NULL, 0, B_TRUE) != 0) ||
3627             (strcmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) == 0)) {
3628                 char            *str2 = NULL;
3629 
3630                 /*
3631                  * No label on the dataset (or default only); create one.
3632                  * (Only do this automatic labeling for the labeled brand.)
3633                  */
3634                 if (strcmp(brand_name, LABELED_BRAND_NAME) != 0) {
3635                         error = 0;
3636                         goto out;
3637                 }
3638 
3639                 error = l_to_str_internal(zone_sl, &str2);
3640                 if (error)
3641                         goto out;
3642                 if (str2 == NULL) {
3643                         error = -1;
3644                         goto out;
3645                 }
3646                 if ((error = zfs_prop_set(zhp,
3647                     zfs_prop_to_name(ZFS_PROP_MLSLABEL), str2)) != 0) {
3648                         zerror(zlogp, B_FALSE, "cannot set 'mlslabel' "
3649                             "property for root dataset at '%s'\n", rootpath);
3650                 }
3651                 free(str2);
3652                 goto out;
3653         }
3654 
3655         /* Convert the retrieved dataset label to binary form. */
3656         error = hexstr_to_label(ds_hexsl, &ds_sl);
3657         if (error) {
3658                 zerror(zlogp, B_FALSE, "invalid 'mlslabel' "
3659                     "property on root dataset at '%s'\n", rootpath);
3660                 goto out;                       /* exit with error */
3661         }
3662 
3663         /*
3664          * Perform a MAC check by comparing the zone label with the
3665          * dataset label.
3666          */
3667         error = (!blequal(zone_sl, &ds_sl));
3668         if (error)
3669                 zerror(zlogp, B_FALSE, "Rootpath dataset has mismatched label");
3670 out:
3671         zfs_close(zhp);
3672         libzfs_fini(hdl);
3673 
3674         return (error);
3675 }
3676 
3677 /*
3678  * Mount lower level home directories into/from current zone
3679  * Share exported directories specified in dfstab for zone
3680  */
3681 static int
3682 tsol_mounts(zlog_t *zlogp, char *zone_name, char *rootpath)
3683 {
3684         zoneid_t *zids = NULL;
3685         priv_set_t *zid_privs;
3686         const priv_impl_info_t *ip = NULL;
3687         uint_t nzents_saved;
3688         uint_t nzents;
3689         int i;
3690         char readonly[] = "ro";
3691         struct zone_fstab lower_fstab;
3692         char *argv[4];
3693 
3694         if (!is_system_labeled())
3695                 return (0);
3696 
3697         if (zid_label == NULL) {
3698                 zid_label = m_label_alloc(MAC_LABEL);
3699                 if (zid_label == NULL)
3700                         return (-1);
3701         }
3702 
3703         /* Make sure our zone has an /export/home dir */
3704         (void) make_one_dir(zlogp, rootpath, "/export/home",
3705             DEFAULT_DIR_MODE, DEFAULT_DIR_USER, DEFAULT_DIR_GROUP);
3706 
3707         lower_fstab.zone_fs_raw[0] = '\0';
3708         (void) strlcpy(lower_fstab.zone_fs_type, MNTTYPE_LOFS,
3709             sizeof (lower_fstab.zone_fs_type));
3710         lower_fstab.zone_fs_options = NULL;
3711         (void) zonecfg_add_fs_option(&lower_fstab, readonly);
3712 
3713         /*
3714          * Get the list of zones from the kernel
3715          */
3716         if (zone_list(NULL, &nzents) != 0) {
3717                 zerror(zlogp, B_TRUE, "unable to list zones");
3718                 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3719                 return (-1);
3720         }
3721 again:
3722         if (nzents == 0) {
3723                 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3724                 return (-1);
3725         }
3726 
3727         zids = malloc(nzents * sizeof (zoneid_t));
3728         if (zids == NULL) {
3729                 zerror(zlogp, B_TRUE, "memory allocation failed");
3730                 return (-1);
3731         }
3732         nzents_saved = nzents;
3733 
3734         if (zone_list(zids, &nzents) != 0) {
3735                 zerror(zlogp, B_TRUE, "unable to list zones");
3736                 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3737                 free(zids);
3738                 return (-1);
3739         }
3740         if (nzents != nzents_saved) {
3741                 /* list changed, try again */
3742                 free(zids);
3743                 goto again;
3744         }
3745 
3746         ip = getprivimplinfo();
3747         if ((zid_privs = priv_allocset()) == NULL) {
3748                 zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
3749                 zonecfg_free_fs_option_list(
3750                     lower_fstab.zone_fs_options);
3751                 free(zids);
3752                 return (-1);
3753         }
3754 
3755         for (i = 0; i < nzents; i++) {
3756                 char zid_name[ZONENAME_MAX];
3757                 zone_state_t zid_state;
3758                 char zid_rpath[MAXPATHLEN];
3759                 struct stat stat_buf;
3760 
3761                 if (zids[i] == GLOBAL_ZONEID)
3762                         continue;
3763 
3764                 if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
3765                         continue;
3766 
3767                 /*
3768                  * Do special setup for the zone we are booting
3769                  */
3770                 if (strcmp(zid_name, zone_name) == 0) {
3771                         struct zone_fstab autofs_fstab;
3772                         char map_path[MAXPATHLEN];
3773                         int fd;
3774 
3775                         /*
3776                          * Create auto_home_<zone> map for this zone
3777                          * in the global zone. The non-global zone entry
3778                          * will be created by automount when the zone
3779                          * is booted.
3780                          */
3781 
3782                         (void) snprintf(autofs_fstab.zone_fs_special,
3783                             MAXPATHLEN, "auto_home_%s", zid_name);
3784 
3785                         (void) snprintf(autofs_fstab.zone_fs_dir, MAXPATHLEN,
3786                             "/zone/%s/home", zid_name);
3787 
3788                         (void) snprintf(map_path, sizeof (map_path),
3789                             "/etc/%s", autofs_fstab.zone_fs_special);
3790                         /*
3791                          * If the map file doesn't exist create a template
3792                          */
3793                         if ((fd = open(map_path, O_RDWR | O_CREAT | O_EXCL,
3794                             S_IRUSR | S_IWUSR | S_IRGRP| S_IROTH)) != -1) {
3795                                 int len;
3796                                 char map_rec[MAXPATHLEN];
3797 
3798                                 len = snprintf(map_rec, sizeof (map_rec),
3799                                     "+%s\n*\t-fstype=lofs\t:%s/export/home/&\n",
3800                                     autofs_fstab.zone_fs_special, rootpath);
3801                                 (void) write(fd, map_rec, len);
3802                                 (void) close(fd);
3803                         }
3804 
3805                         /*
3806                          * Mount auto_home_<zone> in the global zone if absent.
3807                          * If it's already of type autofs, then
3808                          * don't mount it again.
3809                          */
3810                         if ((stat(autofs_fstab.zone_fs_dir, &stat_buf) == -1) ||
3811                             strcmp(stat_buf.st_fstype, MNTTYPE_AUTOFS) != 0) {
3812                                 char optstr[] = "indirect,ignore,nobrowse";
3813 
3814                                 (void) make_one_dir(zlogp, "",
3815                                     autofs_fstab.zone_fs_dir, DEFAULT_DIR_MODE,
3816                                     DEFAULT_DIR_USER, DEFAULT_DIR_GROUP);
3817 
3818                                 /*
3819                                  * Mount will fail if automounter has already
3820                                  * processed the auto_home_<zonename> map
3821                                  */
3822                                 (void) domount(zlogp, MNTTYPE_AUTOFS, optstr,
3823                                     autofs_fstab.zone_fs_special,
3824                                     autofs_fstab.zone_fs_dir);
3825                         }
3826                         continue;
3827                 }
3828 
3829 
3830                 if (zone_get_state(zid_name, &zid_state) != Z_OK ||
3831                     (zid_state != ZONE_STATE_READY &&
3832                     zid_state != ZONE_STATE_RUNNING))
3833                         /* Skip over zones without mounted filesystems */
3834                         continue;
3835 
3836                 if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
3837                     sizeof (m_label_t)) < 0)
3838                         /* Skip over zones with unspecified label */
3839                         continue;
3840 
3841                 if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
3842                     sizeof (zid_rpath)) == -1)
3843                         /* Skip over zones with bad path */
3844                         continue;
3845 
3846                 if (zone_getattr(zids[i], ZONE_ATTR_PRIVSET, zid_privs,
3847                     sizeof (priv_chunk_t) * ip->priv_setsize) == -1)
3848                         /* Skip over zones with bad privs */
3849                         continue;
3850 
3851                 /*
3852                  * Reading down is valid according to our label model
3853                  * but some customers want to disable it because it
3854                  * allows execute down and other possible attacks.
3855                  * Therefore, we restrict this feature to zones that
3856                  * have the NET_MAC_AWARE privilege which is required
3857                  * for NFS read-down semantics.
3858                  */
3859                 if ((bldominates(zlabel, zid_label)) &&
3860                     (priv_ismember(zprivs, PRIV_NET_MAC_AWARE))) {
3861                         /*
3862                          * Our zone dominates this one.
3863                          * Create a lofs mount from lower zone's /export/home
3864                          */
3865                         (void) snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
3866                             "%s/zone/%s/export/home", rootpath, zid_name);
3867 
3868                         /*
3869                          * If the target is already an LOFS mount
3870                          * then don't do it again.
3871                          */
3872                         if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
3873                             strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
3874 
3875                                 if (snprintf(lower_fstab.zone_fs_special,
3876                                     MAXPATHLEN, "%s/export",
3877                                     zid_rpath) > MAXPATHLEN)
3878                                         continue;
3879 
3880                                 /*
3881                                  * Make sure the lower-level home exists
3882                                  */
3883                                 if (make_one_dir(zlogp,
3884                                     lower_fstab.zone_fs_special, "/home",
3885                                     DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
3886                                     DEFAULT_DIR_GROUP) != 0)
3887                                         continue;
3888 
3889                                 (void) strlcat(lower_fstab.zone_fs_special,
3890                                     "/home", MAXPATHLEN);
3891 
3892                                 /*
3893                                  * Mount can fail because the lower-level
3894                                  * zone may have already done a mount up.
3895                                  */
3896                                 (void) mount_one(zlogp, &lower_fstab, "",
3897                                     Z_MNT_BOOT);
3898                         }
3899                 } else if ((bldominates(zid_label, zlabel)) &&
3900                     (priv_ismember(zid_privs, PRIV_NET_MAC_AWARE))) {
3901                         /*
3902                          * This zone dominates our zone.
3903                          * Create a lofs mount from our zone's /export/home
3904                          */
3905                         if (snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
3906                             "%s/zone/%s/export/home", zid_rpath,
3907                             zone_name) > MAXPATHLEN)
3908                                 continue;
3909 
3910                         /*
3911                          * If the target is already an LOFS mount
3912                          * then don't do it again.
3913                          */
3914                         if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
3915                             strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
3916 
3917                                 (void) snprintf(lower_fstab.zone_fs_special,
3918                                     MAXPATHLEN, "%s/export/home", rootpath);
3919 
3920                                 /*
3921                                  * Mount can fail because the higher-level
3922                                  * zone may have already done a mount down.
3923                                  */
3924                                 (void) mount_one(zlogp, &lower_fstab, "",
3925                                     Z_MNT_BOOT);
3926                         }
3927                 }
3928         }
3929         zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3930         priv_freeset(zid_privs);
3931         free(zids);
3932 
3933         /*
3934          * Now share any exported directories from this zone.
3935          * Each zone can have its own dfstab.
3936          */
3937 
3938         argv[0] = "zoneshare";
3939         argv[1] = "-z";
3940         argv[2] = zone_name;
3941         argv[3] = NULL;
3942 
3943         (void) forkexec(zlogp, "/usr/lib/zones/zoneshare", argv);
3944         /* Don't check for errors since they don't affect the zone */
3945 
3946         return (0);
3947 }
3948 
3949 /*
3950  * Unmount lofs mounts from higher level zones
3951  * Unshare nfs exported directories
3952  */
3953 static void
3954 tsol_unmounts(zlog_t *zlogp, char *zone_name)
3955 {
3956         zoneid_t *zids = NULL;
3957         uint_t nzents_saved;
3958         uint_t nzents;
3959         int i;
3960         char *argv[4];
3961         char path[MAXPATHLEN];
3962 
3963         if (!is_system_labeled())
3964                 return;
3965 
3966         /*
3967          * Get the list of zones from the kernel
3968          */
3969         if (zone_list(NULL, &nzents) != 0) {
3970                 return;
3971         }
3972 
3973         if (zid_label == NULL) {
3974                 zid_label = m_label_alloc(MAC_LABEL);
3975                 if (zid_label == NULL)
3976                         return;
3977         }
3978 
3979 again:
3980         if (nzents == 0)
3981                 return;
3982 
3983         zids = malloc(nzents * sizeof (zoneid_t));
3984         if (zids == NULL) {
3985                 zerror(zlogp, B_TRUE, "memory allocation failed");
3986                 return;
3987         }
3988         nzents_saved = nzents;
3989 
3990         if (zone_list(zids, &nzents) != 0) {
3991                 free(zids);
3992                 return;
3993         }
3994         if (nzents != nzents_saved) {
3995                 /* list changed, try again */
3996                 free(zids);
3997                 goto again;
3998         }
3999 
4000         for (i = 0; i < nzents; i++) {
4001                 char zid_name[ZONENAME_MAX];
4002                 zone_state_t zid_state;
4003                 char zid_rpath[MAXPATHLEN];
4004 
4005                 if (zids[i] == GLOBAL_ZONEID)
4006                         continue;
4007 
4008                 if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
4009                         continue;
4010 
4011                 /*
4012                  * Skip the zone we are halting
4013                  */
4014                 if (strcmp(zid_name, zone_name) == 0)
4015                         continue;
4016 
4017                 if ((zone_getattr(zids[i], ZONE_ATTR_STATUS, &zid_state,
4018                     sizeof (zid_state)) < 0) ||
4019                     (zid_state < ZONE_IS_READY))
4020                         /* Skip over zones without mounted filesystems */
4021                         continue;
4022 
4023                 if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
4024                     sizeof (m_label_t)) < 0)
4025                         /* Skip over zones with unspecified label */
4026                         continue;
4027 
4028                 if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
4029                     sizeof (zid_rpath)) == -1)
4030                         /* Skip over zones with bad path */
4031                         continue;
4032 
4033                 if (zlabel != NULL && bldominates(zid_label, zlabel)) {
4034                         /*
4035                          * This zone dominates our zone.
4036                          * Unmount the lofs mount of our zone's /export/home
4037                          */
4038 
4039                         if (snprintf(path, MAXPATHLEN,
4040                             "%s/zone/%s/export/home", zid_rpath,
4041                             zone_name) > MAXPATHLEN)
4042                                 continue;
4043 
4044                         /* Skip over mount failures */
4045                         (void) umount(path);
4046                 }
4047         }
4048         free(zids);
4049 
4050         /*
4051          * Unmount global zone autofs trigger for this zone
4052          */
4053         (void) snprintf(path, MAXPATHLEN, "/zone/%s/home", zone_name);
4054         /* Skip over mount failures */
4055         (void) umount(path);
4056 
4057         /*
4058          * Next unshare any exported directories from this zone.
4059          */
4060 
4061         argv[0] = "zoneunshare";
4062         argv[1] = "-z";
4063         argv[2] = zone_name;
4064         argv[3] = NULL;
4065 
4066         (void) forkexec(zlogp, "/usr/lib/zones/zoneunshare", argv);
4067         /* Don't check for errors since they don't affect the zone */
4068 
4069         /*
4070          * Finally, deallocate any devices in the zone.
4071          */
4072 
4073         argv[0] = "deallocate";
4074         argv[1] = "-Isz";
4075         argv[2] = zone_name;
4076         argv[3] = NULL;
4077 
4078         (void) forkexec(zlogp, "/usr/sbin/deallocate", argv);
4079         /* Don't check for errors since they don't affect the zone */
4080 }
4081 
4082 /*
4083  * Fetch the Trusted Extensions label and multi-level ports (MLPs) for
4084  * this zone.
4085  */
4086 static tsol_zcent_t *
4087 get_zone_label(zlog_t *zlogp, priv_set_t *privs)
4088 {
4089         FILE *fp;
4090         tsol_zcent_t *zcent = NULL;
4091         char line[MAXTNZLEN];
4092 
4093         if ((fp = fopen(TNZONECFG_PATH, "r")) == NULL) {
4094                 zerror(zlogp, B_TRUE, "%s", TNZONECFG_PATH);
4095                 return (NULL);
4096         }
4097 
4098         while (fgets(line, sizeof (line), fp) != NULL) {
4099                 /*
4100                  * Check for malformed database
4101                  */
4102                 if (strlen(line) == MAXTNZLEN - 1)
4103                         break;
4104                 if ((zcent = tsol_sgetzcent(line, NULL, NULL)) == NULL)
4105                         continue;
4106                 if (strcmp(zcent->zc_name, zone_name) == 0)
4107                         break;
4108                 tsol_freezcent(zcent);
4109                 zcent = NULL;
4110         }
4111         (void) fclose(fp);
4112 
4113         if (zcent == NULL) {
4114                 zerror(zlogp, B_FALSE, "zone requires a label assignment. "
4115                     "See tnzonecfg(4)");
4116         } else {
4117                 if (zlabel == NULL)
4118                         zlabel = m_label_alloc(MAC_LABEL);
4119                 /*
4120                  * Save this zone's privileges for later read-down processing
4121                  */
4122                 if ((zprivs = priv_allocset()) == NULL) {
4123                         zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
4124                         return (NULL);
4125                 } else {
4126                         priv_copyset(privs, zprivs);
4127                 }
4128         }
4129         return (zcent);
4130 }
4131 
4132 /*
4133  * Add the Trusted Extensions multi-level ports for this zone.
4134  */
4135 static void
4136 set_mlps(zlog_t *zlogp, zoneid_t zoneid, tsol_zcent_t *zcent)
4137 {
4138         tsol_mlp_t *mlp;
4139         tsol_mlpent_t tsme;
4140 
4141         if (!is_system_labeled())
4142                 return;
4143 
4144         tsme.tsme_zoneid = zoneid;
4145         tsme.tsme_flags = 0;
4146         for (mlp = zcent->zc_private_mlp; !TSOL_MLP_END(mlp); mlp++) {
4147                 tsme.tsme_mlp = *mlp;
4148                 if (tnmlp(TNDB_LOAD, &tsme) != 0) {
4149                         zerror(zlogp, B_TRUE, "cannot set zone-specific MLP "
4150                             "on %d-%d/%d", mlp->mlp_port,
4151                             mlp->mlp_port_upper, mlp->mlp_ipp);
4152                 }
4153         }
4154 
4155         tsme.tsme_flags = TSOL_MEF_SHARED;
4156         for (mlp = zcent->zc_shared_mlp; !TSOL_MLP_END(mlp); mlp++) {
4157                 tsme.tsme_mlp = *mlp;
4158                 if (tnmlp(TNDB_LOAD, &tsme) != 0) {
4159                         zerror(zlogp, B_TRUE, "cannot set shared MLP "
4160                             "on %d-%d/%d", mlp->mlp_port,
4161                             mlp->mlp_port_upper, mlp->mlp_ipp);
4162                 }
4163         }
4164 }
4165 
4166 static void
4167 remove_mlps(zlog_t *zlogp, zoneid_t zoneid)
4168 {
4169         tsol_mlpent_t tsme;
4170 
4171         if (!is_system_labeled())
4172                 return;
4173 
4174         (void) memset(&tsme, 0, sizeof (tsme));
4175         tsme.tsme_zoneid = zoneid;
4176         if (tnmlp(TNDB_FLUSH, &tsme) != 0)
4177                 zerror(zlogp, B_TRUE, "cannot flush MLPs");
4178 }
4179 
4180 int
4181 prtmount(const struct mnttab *fs, void *x) {
4182         zerror((zlog_t *)x, B_FALSE, "  %s", fs->mnt_mountp);
4183         return (0);
4184 }
4185 
4186 /*
4187  * Look for zones running on the main system that are using this root (or any
4188  * subdirectory of it).  Return B_TRUE and print an error if a conflicting zone
4189  * is found or if we can't tell.
4190  */
4191 static boolean_t
4192 duplicate_zone_root(zlog_t *zlogp, const char *rootpath)
4193 {
4194         zoneid_t *zids = NULL;
4195         uint_t nzids = 0;
4196         boolean_t retv;
4197         int rlen, zlen;
4198         char zroot[MAXPATHLEN];
4199         char zonename[ZONENAME_MAX];
4200 
4201         for (;;) {
4202                 nzids += 10;
4203                 zids = malloc(nzids * sizeof (*zids));
4204                 if (zids == NULL) {
4205                         zerror(zlogp, B_TRUE, "memory allocation failed");
4206                         return (B_TRUE);
4207                 }
4208                 if (zone_list(zids, &nzids) == 0)
4209                         break;
4210                 free(zids);
4211         }
4212         retv = B_FALSE;
4213         rlen = strlen(rootpath);
4214         while (nzids > 0) {
4215                 /*
4216                  * Ignore errors; they just mean that the zone has disappeared
4217                  * while we were busy.
4218                  */
4219                 if (zone_getattr(zids[--nzids], ZONE_ATTR_ROOT, zroot,
4220                     sizeof (zroot)) == -1)
4221                         continue;
4222                 zlen = strlen(zroot);
4223                 if (zlen > rlen)
4224                         zlen = rlen;
4225                 if (strncmp(rootpath, zroot, zlen) == 0 &&
4226                     (zroot[zlen] == '\0' || zroot[zlen] == '/') &&
4227                     (rootpath[zlen] == '\0' || rootpath[zlen] == '/')) {
4228                         if (getzonenamebyid(zids[nzids], zonename,
4229                             sizeof (zonename)) == -1)
4230                                 (void) snprintf(zonename, sizeof (zonename),
4231                                     "id %d", (int)zids[nzids]);
4232                         zerror(zlogp, B_FALSE,
4233                             "zone root %s already in use by zone %s",
4234                             rootpath, zonename);
4235                         retv = B_TRUE;
4236                         break;
4237                 }
4238         }
4239         free(zids);
4240         return (retv);
4241 }
4242 
4243 /*
4244  * Search for loopback mounts that use this same source node (same device and
4245  * inode).  Return B_TRUE if there is one or if we can't tell.
4246  */
4247 static boolean_t
4248 duplicate_reachable_path(zlog_t *zlogp, const char *rootpath)
4249 {
4250         struct stat64 rst, zst;
4251         struct mnttab *mnp;
4252 
4253         if (stat64(rootpath, &rst) == -1) {
4254                 zerror(zlogp, B_TRUE, "can't stat %s", rootpath);
4255                 return (B_TRUE);
4256         }
4257         if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
4258                 return (B_TRUE);
4259         for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max; mnp++) {
4260                 if (mnp->mnt_fstype == NULL ||
4261                     strcmp(MNTTYPE_LOFS, mnp->mnt_fstype) != 0)
4262                         continue;
4263                 /* We're looking at a loopback mount.  Stat it. */
4264                 if (mnp->mnt_special != NULL &&
4265                     stat64(mnp->mnt_special, &zst) != -1 &&
4266                     rst.st_dev == zst.st_dev && rst.st_ino == zst.st_ino) {
4267                         zerror(zlogp, B_FALSE,
4268                             "zone root %s is reachable through %s",
4269                             rootpath, mnp->mnt_mountp);
4270                         return (B_TRUE);
4271                 }
4272         }
4273         return (B_FALSE);
4274 }
4275 
4276 /*
4277  * Set pool info for the zone's resource management configuration.
4278  */
4279 static int
4280 setup_zone_rm(zlog_t *zlogp, char *zone_name, zoneid_t zoneid)
4281 {
4282         int res;
4283         uint64_t tmp;
4284         char sched[MAXNAMELEN];
4285         char pool_err[128];
4286 
4287         /* Get the scheduling class set in the zone configuration. */
4288         if (zonecfg_get_sched_class(snap_hndl, sched, sizeof (sched)) == Z_OK &&
4289             strlen(sched) > 0) {
4290                 if (zone_setattr(zoneid, ZONE_ATTR_SCHED_CLASS, sched,
4291                     strlen(sched)) == -1)
4292                         zerror(zlogp, B_TRUE, "WARNING: unable to set the "
4293                             "default scheduling class");
4294 
4295         } else if (zonecfg_get_aliased_rctl(snap_hndl, ALIAS_SHARES, &tmp)
4296             == Z_OK) {
4297                 /*
4298                  * If the zone has the zone.cpu-shares rctl set then we want to
4299                  * use the Fair Share Scheduler (FSS) for processes in the
4300                  * zone.  Check what scheduling class the zone would be running
4301                  * in by default so we can print a warning and modify the class
4302                  * if we wouldn't be using FSS.
4303                  */
4304                 char class_name[PC_CLNMSZ];
4305 
4306                 if (zonecfg_get_dflt_sched_class(snap_hndl, class_name,
4307                     sizeof (class_name)) != Z_OK) {
4308                         zerror(zlogp, B_FALSE, "WARNING: unable to determine "
4309                             "the zone's scheduling class");
4310 
4311                 } else if (strcmp("FSS", class_name) != 0) {
4312                         zerror(zlogp, B_FALSE, "WARNING: The zone.cpu-shares "
4313                             "rctl is set but\nFSS is not the default "
4314                             "scheduling class for\nthis zone.  FSS will be "
4315                             "used for processes\nin the zone but to get the "
4316                             "full benefit of FSS,\nit should be the default "
4317                             "scheduling class.\nSee dispadmin(1M) for more "
4318                             "details.");
4319 
4320                         if (zone_setattr(zoneid, ZONE_ATTR_SCHED_CLASS, "FSS",
4321                             strlen("FSS")) == -1)
4322                                 zerror(zlogp, B_TRUE, "WARNING: unable to set "
4323                                     "zone scheduling class to FSS");
4324                 }
4325         }
4326 
4327         /*
4328          * The next few blocks of code attempt to set up temporary pools as
4329          * well as persistent pools.  In all cases we call the functions
4330          * unconditionally.  Within each funtion the code will check if the
4331          * zone is actually configured for a temporary pool or persistent pool
4332          * and just return if there is nothing to do.
4333          *
4334          * If we are rebooting we want to attempt to reuse any temporary pool
4335          * that was previously set up.  zonecfg_bind_tmp_pool() will do the
4336          * right thing in all cases (reuse or create) based on the current
4337          * zonecfg.
4338          */
4339         if ((res = zonecfg_bind_tmp_pool(snap_hndl, zoneid, pool_err,
4340             sizeof (pool_err))) != Z_OK) {
4341                 if (res == Z_POOL || res == Z_POOL_CREATE || res == Z_POOL_BIND)
4342                         zerror(zlogp, B_FALSE, "%s: %s\ndedicated-cpu setting "
4343                             "cannot be instantiated", zonecfg_strerror(res),
4344                             pool_err);
4345                 else
4346                         zerror(zlogp, B_FALSE, "could not bind zone to "
4347                             "temporary pool: %s", zonecfg_strerror(res));
4348                 return (Z_POOL_BIND);
4349         }
4350 
4351         /*
4352          * Check if we need to warn about poold not being enabled.
4353          */
4354         if (zonecfg_warn_poold(snap_hndl)) {
4355                 zerror(zlogp, B_FALSE, "WARNING: A range of dedicated-cpus has "
4356                     "been specified\nbut the dynamic pool service is not "
4357                     "enabled.\nThe system will not dynamically adjust the\n"
4358                     "processor allocation within the specified range\n"
4359                     "until svc:/system/pools/dynamic is enabled.\n"
4360                     "See poold(1M).");
4361         }
4362 
4363         /* The following is a warning, not an error. */
4364         if ((res = zonecfg_bind_pool(snap_hndl, zoneid, pool_err,
4365             sizeof (pool_err))) != Z_OK) {
4366                 if (res == Z_POOL_BIND)
4367                         zerror(zlogp, B_FALSE, "WARNING: unable to bind to "
4368                             "pool '%s'; using default pool.", pool_err);
4369                 else if (res == Z_POOL)
4370                         zerror(zlogp, B_FALSE, "WARNING: %s: %s",
4371                             zonecfg_strerror(res), pool_err);
4372                 else
4373                         zerror(zlogp, B_FALSE, "WARNING: %s",
4374                             zonecfg_strerror(res));
4375         }
4376 
4377         /* Update saved pool name in case it has changed */
4378         (void) zonecfg_get_poolname(snap_hndl, zone_name, pool_name,
4379             sizeof (pool_name));
4380 
4381         return (Z_OK);
4382 }
4383 
4384 static void
4385 report_prop_err(zlog_t *zlogp, const char *name, const char *value, int res)
4386 {
4387         switch (res) {
4388         case Z_TOO_BIG:
4389                 zerror(zlogp, B_FALSE, "%s property value is too large.", name);
4390                 break;
4391 
4392         case Z_INVALID_PROPERTY:
4393                 zerror(zlogp, B_FALSE, "%s property value \"%s\" is not valid",
4394                     name, value);
4395                 break;
4396 
4397         default:
4398                 zerror(zlogp, B_TRUE, "fetching property %s: %d", name, res);
4399                 break;
4400         }
4401 }
4402 
4403 /*
4404  * Sets the hostid of the new zone based on its configured value.  The zone's
4405  * zone_t structure must already exist in kernel memory.  'zlogp' refers to the
4406  * log used to report errors and warnings and must be non-NULL.  'zone_namep'
4407  * is the name of the new zone and must be non-NULL.  'zoneid' is the numeric
4408  * ID of the new zone.
4409  *
4410  * This function returns zero on success and a nonzero error code on failure.
4411  */
4412 static int
4413 setup_zone_hostid(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4414 {
4415         int res;
4416         char hostidp[HW_HOSTID_LEN];
4417         unsigned int hostid;
4418 
4419         res = zonecfg_get_hostid(handle, hostidp, sizeof (hostidp));
4420 
4421         if (res == Z_BAD_PROPERTY) {
4422                 return (Z_OK);
4423         } else if (res != Z_OK) {
4424                 report_prop_err(zlogp, "hostid", hostidp, res);
4425                 return (res);
4426         }
4427 
4428         hostid = (unsigned int)strtoul(hostidp, NULL, 16);
4429         if ((res = zone_setattr(zoneid, ZONE_ATTR_HOSTID, &hostid,
4430             sizeof (hostid))) != 0) {
4431                 zerror(zlogp, B_TRUE,
4432                     "zone hostid is not valid: %s: %d", hostidp, res);
4433                 return (Z_SYSTEM);
4434         }
4435 
4436         return (res);
4437 }
4438 
4439 static int
4440 setup_zone_fs_allowed(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4441 {
4442         char fsallowedp[ZONE_FS_ALLOWED_MAX];
4443         int res;
4444 
4445         res = zonecfg_get_fs_allowed(handle, fsallowedp, sizeof (fsallowedp));
4446 
4447         if (res == Z_BAD_PROPERTY) {
4448                 return (Z_OK);
4449         } else if (res != Z_OK) {
4450                 report_prop_err(zlogp, "fs-allowed", fsallowedp, res);
4451                 return (res);
4452         }
4453 
4454         if (zone_setattr(zoneid, ZONE_ATTR_FS_ALLOWED, &fsallowedp,
4455             sizeof (fsallowedp)) != 0) {
4456                 zerror(zlogp, B_TRUE,
4457                     "fs-allowed couldn't be set: %s: %d", fsallowedp, res);
4458                 return (Z_SYSTEM);
4459         }
4460 
4461         return (res);
4462 }
4463 
4464 static int
4465 setup_zone_attrs(zlog_t *zlogp, zoneid_t zoneid)
4466 {
4467         int res = Z_OK;
4468 
4469         if ((res = setup_zone_hostid(snap_hndl, zlogp, zoneid)) != Z_OK)
4470                 goto out;
4471 
4472         if ((res = setup_zone_fs_allowed(snap_hndl, zlogp, zoneid)) != Z_OK)
4473                 goto out;
4474 
4475 out:
4476         return (res);
4477 }
4478 
4479 /*
4480  * The zone_did is a persistent debug ID.  Each zone should have a unique ID
4481  * in the kernel.  This is used for things like DTrace which want to monitor
4482  * zones across reboots.  They can't use the zoneid since that changes on
4483  * each boot.
4484  */
4485 zoneid_t
4486 vplat_create(zlog_t *zlogp, zone_mnt_t mount_cmd, zoneid_t zone_did)
4487 {
4488         zoneid_t rval = -1;
4489         priv_set_t *privs;
4490         char rootpath[MAXPATHLEN];
4491         char *rctlbuf = NULL;
4492         size_t rctlbufsz = 0;
4493         char *zfsbuf = NULL;
4494         size_t zfsbufsz = 0;
4495         zoneid_t zoneid = -1;
4496         int xerr;
4497         char *kzone;
4498         FILE *fp = NULL;
4499         tsol_zcent_t *zcent = NULL;
4500         int match = 0;
4501         int doi = 0;
4502         int flags;
4503         zone_iptype_t iptype;
4504 
4505         if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
4506                 zerror(zlogp, B_TRUE, "unable to determine zone root");
4507                 return (-1);
4508         }
4509         if (zonecfg_in_alt_root())
4510                 resolve_lofs(zlogp, rootpath, sizeof (rootpath));
4511 
4512         if (vplat_get_iptype(zlogp, &iptype) < 0) {
4513                 zerror(zlogp, B_TRUE, "unable to determine ip-type");
4514                 return (-1);
4515         }
4516         switch (iptype) {
4517         case ZS_SHARED:
4518                 flags = 0;
4519                 break;
4520         case ZS_EXCLUSIVE:
4521                 flags = ZCF_NET_EXCL;
4522                 break;
4523         }
4524 
4525         if ((privs = priv_allocset()) == NULL) {
4526                 zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
4527                 return (-1);
4528         }
4529         priv_emptyset(privs);
4530         if (get_privset(zlogp, privs, mount_cmd) != 0)
4531                 goto error;
4532 
4533         if (mount_cmd == Z_MNT_BOOT &&
4534             get_rctls(zlogp, &rctlbuf, &rctlbufsz) != 0) {
4535                 zerror(zlogp, B_FALSE, "Unable to get list of rctls");
4536                 goto error;
4537         }
4538 
4539         if (get_datasets(zlogp, &zfsbuf, &zfsbufsz) != 0) {
4540                 zerror(zlogp, B_FALSE, "Unable to get list of ZFS datasets");
4541                 goto error;
4542         }
4543 
4544         if (mount_cmd == Z_MNT_BOOT && is_system_labeled()) {
4545                 zcent = get_zone_label(zlogp, privs);
4546                 if (zcent != NULL) {
4547                         match = zcent->zc_match;
4548                         doi = zcent->zc_doi;
4549                         *zlabel = zcent->zc_label;
4550                 } else {
4551                         goto error;
4552                 }
4553                 if (validate_rootds_label(zlogp, rootpath, zlabel) != 0)
4554                         goto error;
4555         }
4556 
4557         kzone = zone_name;
4558 
4559         /*
4560          * We must do this scan twice.  First, we look for zones running on the
4561          * main system that are using this root (or any subdirectory of it).
4562          * Next, we reduce to the shortest path and search for loopback mounts
4563          * that use this same source node (same device and inode).
4564          */
4565         if (duplicate_zone_root(zlogp, rootpath))
4566                 goto error;
4567         if (duplicate_reachable_path(zlogp, rootpath))
4568                 goto error;
4569 
4570         if (ALT_MOUNT(mount_cmd)) {
4571                 root_to_lu(zlogp, rootpath, sizeof (rootpath), B_TRUE);
4572 
4573                 /*
4574                  * Forge up a special root for this zone.  When a zone is
4575                  * mounted, we can't let the zone have its own root because the
4576                  * tools that will be used in this "scratch zone" need access
4577                  * to both the zone's resources and the running machine's
4578                  * executables.
4579                  *
4580                  * Note that the mkdir here also catches read-only filesystems.
4581                  */
4582                 if (mkdir(rootpath, 0755) != 0 && errno != EEXIST) {
4583                         zerror(zlogp, B_TRUE, "cannot create %s", rootpath);
4584                         goto error;
4585                 }
4586                 if (domount(zlogp, "tmpfs", "", "swap", rootpath) != 0)
4587                         goto error;
4588         }
4589 
4590         if (zonecfg_in_alt_root()) {
4591                 /*
4592                  * If we are mounting up a zone in an alternate root partition,
4593                  * then we have some additional work to do before starting the
4594                  * zone.  First, resolve the root path down so that we're not
4595                  * fooled by duplicates.  Then forge up an internal name for
4596                  * the zone.
4597                  */
4598                 if ((fp = zonecfg_open_scratch("", B_TRUE)) == NULL) {
4599                         zerror(zlogp, B_TRUE, "cannot open mapfile");
4600                         goto error;
4601                 }
4602                 if (zonecfg_lock_scratch(fp) != 0) {
4603                         zerror(zlogp, B_TRUE, "cannot lock mapfile");
4604                         goto error;
4605                 }
4606                 if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
4607                     NULL, 0) == 0) {
4608                         zerror(zlogp, B_FALSE, "scratch zone already running");
4609                         goto error;
4610                 }
4611                 /* This is the preferred name */
4612                 (void) snprintf(kernzone, sizeof (kernzone), "SUNWlu-%s",
4613                     zone_name);
4614                 srandom(getpid());
4615                 while (zonecfg_reverse_scratch(fp, kernzone, NULL, 0, NULL,
4616                     0) == 0) {
4617                         /* This is just an arbitrary name; note "." usage */
4618                         (void) snprintf(kernzone, sizeof (kernzone),
4619                             "SUNWlu.%08lX%08lX", random(), random());
4620                 }
4621                 kzone = kernzone;
4622         }
4623 
4624         xerr = 0;
4625         if ((zoneid = zone_create(kzone, rootpath, privs, rctlbuf,
4626             rctlbufsz, zfsbuf, zfsbufsz, &xerr, match, doi, zlabel,
4627             flags, zone_did)) == -1) {
4628                 if (xerr == ZE_AREMOUNTS) {
4629                         if (zonecfg_find_mounts(rootpath, NULL, NULL) < 1) {
4630                                 zerror(zlogp, B_FALSE,
4631                                     "An unknown file-system is mounted on "
4632                                     "a subdirectory of %s", rootpath);
4633                         } else {
4634 
4635                                 zerror(zlogp, B_FALSE,
4636                                     "These file-systems are mounted on "
4637                                     "subdirectories of %s:", rootpath);
4638                                 (void) zonecfg_find_mounts(rootpath,
4639                                     prtmount, zlogp);
4640                         }
4641                 } else if (xerr == ZE_CHROOTED) {
4642                         zerror(zlogp, B_FALSE, "%s: "
4643                             "cannot create a zone from a chrooted "
4644                             "environment", "zone_create");
4645                 } else if (xerr == ZE_LABELINUSE) {
4646                         char zonename[ZONENAME_MAX];
4647                         (void) getzonenamebyid(getzoneidbylabel(zlabel),
4648                             zonename, ZONENAME_MAX);
4649                         zerror(zlogp, B_FALSE, "The zone label is already "
4650                             "used by the zone '%s'.", zonename);
4651                 } else {
4652                         zerror(zlogp, B_TRUE, "%s failed", "zone_create");
4653                 }
4654                 goto error;
4655         }
4656 
4657         if (zonecfg_in_alt_root() &&
4658             zonecfg_add_scratch(fp, zone_name, kernzone,
4659             zonecfg_get_root()) == -1) {
4660                 zerror(zlogp, B_TRUE, "cannot add mapfile entry");
4661                 goto error;
4662         }
4663 
4664         /*
4665          * The following actions are not performed when merely mounting a zone
4666          * for administrative use.
4667          */
4668         if (mount_cmd == Z_MNT_BOOT) {
4669                 brand_handle_t bh;
4670                 struct brand_attr attr;
4671                 char modname[MAXPATHLEN];
4672 
4673                 if (setup_zone_attrs(zlogp, zoneid) != Z_OK)
4674                         goto error;
4675 
4676                 if ((bh = brand_open(brand_name)) == NULL) {
4677                         zerror(zlogp, B_FALSE,
4678                             "unable to determine brand name");
4679                         goto error;
4680                 }
4681 
4682                 if (!is_system_labeled() &&
4683                     (strcmp(brand_name, LABELED_BRAND_NAME) == 0)) {
4684                         brand_close(bh);
4685                         zerror(zlogp, B_FALSE,
4686                             "cannot boot labeled zone on unlabeled system");
4687                         goto error;
4688                 }
4689 
4690                 /*
4691                  * If this brand requires any kernel support, now is the time to
4692                  * get it loaded and initialized.
4693                  */
4694                 if (brand_get_modname(bh, modname, MAXPATHLEN) < 0) {
4695                         brand_close(bh);
4696                         zerror(zlogp, B_FALSE,
4697                             "unable to determine brand kernel module");
4698                         goto error;
4699                 }
4700                 brand_close(bh);
4701 
4702                 if (strlen(modname) > 0) {
4703                         (void) strlcpy(attr.ba_brandname, brand_name,
4704                             sizeof (attr.ba_brandname));
4705                         (void) strlcpy(attr.ba_modname, modname,
4706                             sizeof (attr.ba_modname));
4707                         if (zone_setattr(zoneid, ZONE_ATTR_BRAND, &attr,
4708                             sizeof (attr) != 0)) {
4709                                 zerror(zlogp, B_TRUE,
4710                                     "could not set zone brand attribute.");
4711                                 goto error;
4712                         }
4713                 }
4714 
4715                 if (setup_zone_rm(zlogp, zone_name, zoneid) != Z_OK)
4716                         goto error;
4717 
4718                 set_mlps(zlogp, zoneid, zcent);
4719         }
4720 
4721         rval = zoneid;
4722         zoneid = -1;
4723 
4724 error:
4725         if (zoneid != -1) {
4726                 (void) zone_shutdown(zoneid);
4727                 (void) zone_destroy(zoneid);
4728         }
4729         if (rctlbuf != NULL)
4730                 free(rctlbuf);
4731         if (zfsbuf != NULL)
4732                 free(zfsbuf);
4733         priv_freeset(privs);
4734         if (fp != NULL)
4735                 zonecfg_close_scratch(fp);
4736         lofs_discard_mnttab();
4737         if (zcent != NULL)
4738                 tsol_freezcent(zcent);
4739         return (rval);
4740 }
4741 
4742 /*
4743  * Enter the zone and write a /etc/zones/index file there.  This allows
4744  * libzonecfg (and thus zoneadm) to report the UUID and potentially other zone
4745  * details from inside the zone.
4746  */
4747 static void
4748 write_index_file(zoneid_t zoneid)
4749 {
4750         FILE *zef;
4751         FILE *zet;
4752         struct zoneent *zep;
4753         pid_t child;
4754         int tmpl_fd;
4755         ctid_t ct;
4756         int fd;
4757         char uuidstr[UUID_PRINTABLE_STRING_LENGTH];
4758 
4759         /* Locate the zone entry in the global zone's index file */
4760         if ((zef = setzoneent()) == NULL)
4761                 return;
4762         while ((zep = getzoneent_private(zef)) != NULL) {
4763                 if (strcmp(zep->zone_name, zone_name) == 0)
4764                         break;
4765                 free(zep);
4766         }
4767         endzoneent(zef);
4768         if (zep == NULL)
4769                 return;
4770 
4771         if ((tmpl_fd = init_template()) == -1) {
4772                 free(zep);
4773                 return;
4774         }
4775 
4776         if ((child = fork()) == -1) {
4777                 (void) ct_tmpl_clear(tmpl_fd);
4778                 (void) close(tmpl_fd);
4779                 free(zep);
4780                 return;
4781         }
4782 
4783         /* parent waits for child to finish */
4784         if (child != 0) {
4785                 free(zep);
4786                 if (contract_latest(&ct) == -1)
4787                         ct = -1;
4788                 (void) ct_tmpl_clear(tmpl_fd);
4789                 (void) close(tmpl_fd);
4790                 (void) waitpid(child, NULL, 0);
4791                 (void) contract_abandon_id(ct);
4792                 return;
4793         }
4794 
4795         /* child enters zone and sets up index file */
4796         (void) ct_tmpl_clear(tmpl_fd);
4797         if (zone_enter(zoneid) != -1) {
4798                 (void) mkdir(ZONE_CONFIG_ROOT, ZONE_CONFIG_MODE);
4799                 (void) chown(ZONE_CONFIG_ROOT, ZONE_CONFIG_UID,
4800                     ZONE_CONFIG_GID);
4801                 fd = open(ZONE_INDEX_FILE, O_WRONLY|O_CREAT|O_TRUNC,
4802                     ZONE_INDEX_MODE);
4803                 if (fd != -1 && (zet = fdopen(fd, "w")) != NULL) {
4804                         (void) fchown(fd, ZONE_INDEX_UID, ZONE_INDEX_GID);
4805                         if (uuid_is_null(zep->zone_uuid))
4806                                 uuidstr[0] = '\0';
4807                         else
4808                                 uuid_unparse(zep->zone_uuid, uuidstr);
4809                         (void) fprintf(zet, "%s:%s:/:%s\n", zep->zone_name,
4810                             zone_state_str(zep->zone_state),
4811                             uuidstr);
4812                         (void) fclose(zet);
4813                 }
4814         }
4815         _exit(0);
4816 }
4817 
4818 int
4819 vplat_bringup(zlog_t *zlogp, zone_mnt_t mount_cmd, zoneid_t zoneid)
4820 {
4821         char zonepath[MAXPATHLEN];
4822 
4823         if (mount_cmd == Z_MNT_BOOT && validate_datasets(zlogp) != 0) {
4824                 lofs_discard_mnttab();
4825                 return (-1);
4826         }
4827 
4828         /*
4829          * Before we try to mount filesystems we need to create the
4830          * attribute backing store for /dev
4831          */
4832         if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
4833                 lofs_discard_mnttab();
4834                 return (-1);
4835         }
4836         resolve_lofs(zlogp, zonepath, sizeof (zonepath));
4837 
4838         /* Make /dev directory owned by root, grouped sys */
4839         if (make_one_dir(zlogp, zonepath, "/dev", DEFAULT_DIR_MODE,
4840             0, 3) != 0) {
4841                 lofs_discard_mnttab();
4842                 return (-1);
4843         }
4844 
4845         if (mount_filesystems(zlogp, mount_cmd) != 0) {
4846                 lofs_discard_mnttab();
4847                 return (-1);
4848         }
4849 
4850         if (mount_cmd == Z_MNT_BOOT) {
4851                 zone_iptype_t iptype;
4852 
4853                 if (vplat_get_iptype(zlogp, &iptype) < 0) {
4854                         zerror(zlogp, B_TRUE, "unable to determine ip-type");
4855                         lofs_discard_mnttab();
4856                         return (-1);
4857                 }
4858 
4859                 switch (iptype) {
4860                 case ZS_SHARED:
4861                         /* Always do this to make lo0 get configured */
4862                         if (configure_shared_network_interfaces(zlogp) != 0) {
4863                                 lofs_discard_mnttab();
4864                                 return (-1);
4865                         }
4866                         break;
4867                 case ZS_EXCLUSIVE:
4868                         if (configure_exclusive_network_interfaces(zlogp,
4869                             zoneid) !=
4870                             0) {
4871                                 lofs_discard_mnttab();
4872                                 return (-1);
4873                         }
4874                         break;
4875                 }
4876         }
4877 
4878         write_index_file(zoneid);
4879 
4880         lofs_discard_mnttab();
4881         return (0);
4882 }
4883 
4884 static int
4885 lu_root_teardown(zlog_t *zlogp)
4886 {
4887         char zroot[MAXPATHLEN];
4888 
4889         if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
4890                 zerror(zlogp, B_FALSE, "unable to determine zone root");
4891                 return (-1);
4892         }
4893         root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
4894 
4895         /*
4896          * At this point, the processes are gone, the filesystems (save the
4897          * root) are unmounted, and the zone is on death row.  But there may
4898          * still be creds floating about in the system that reference the
4899          * zone_t, and which pin down zone_rootvp causing this call to fail
4900          * with EBUSY.  Thus, we try for a little while before just giving up.
4901          * (How I wish this were not true, and umount2 just did the right
4902          * thing, or tmpfs supported MS_FORCE This is a gross hack.)
4903          */
4904         if (umount2(zroot, MS_FORCE) != 0) {
4905                 if (errno == ENOTSUP && umount2(zroot, 0) == 0)
4906                         goto unmounted;
4907                 if (errno == EBUSY) {
4908                         int tries = 10;
4909 
4910                         while (--tries >= 0) {
4911                                 (void) sleep(1);
4912                                 if (umount2(zroot, 0) == 0)
4913                                         goto unmounted;
4914                                 if (errno != EBUSY)
4915                                         break;
4916                         }
4917                 }
4918                 zerror(zlogp, B_TRUE, "unable to unmount '%s'", zroot);
4919                 return (-1);
4920         }
4921 unmounted:
4922 
4923         /*
4924          * Only zones in an alternate root environment have scratch zone
4925          * entries.
4926          */
4927         if (zonecfg_in_alt_root()) {
4928                 FILE *fp;
4929                 int retv;
4930 
4931                 if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
4932                         zerror(zlogp, B_TRUE, "cannot open mapfile");
4933                         return (-1);
4934                 }
4935                 retv = -1;
4936                 if (zonecfg_lock_scratch(fp) != 0)
4937                         zerror(zlogp, B_TRUE, "cannot lock mapfile");
4938                 else if (zonecfg_delete_scratch(fp, kernzone) != 0)
4939                         zerror(zlogp, B_TRUE, "cannot delete map entry");
4940                 else
4941                         retv = 0;
4942                 zonecfg_close_scratch(fp);
4943                 return (retv);
4944         } else {
4945                 return (0);
4946         }
4947 }
4948 
4949 int
4950 vplat_teardown(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting,
4951     boolean_t debug)
4952 {
4953         char *kzone;
4954         zoneid_t zoneid;
4955         int res;
4956         char pool_err[128];
4957         char zpath[MAXPATHLEN];
4958         char cmdbuf[MAXPATHLEN];
4959         brand_handle_t bh = NULL;
4960         dladm_status_t status;
4961         char errmsg[DLADM_STRSIZE];
4962         ushort_t flags;
4963 
4964         kzone = zone_name;
4965         if (zonecfg_in_alt_root()) {
4966                 FILE *fp;
4967 
4968                 if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
4969                         zerror(zlogp, B_TRUE, "unable to open map file");
4970                         goto error;
4971                 }
4972                 if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
4973                     kernzone, sizeof (kernzone)) != 0) {
4974                         zerror(zlogp, B_FALSE, "unable to find scratch zone");
4975                         zonecfg_close_scratch(fp);
4976                         goto error;
4977                 }
4978                 zonecfg_close_scratch(fp);
4979                 kzone = kernzone;
4980         }
4981 
4982         if ((zoneid = getzoneidbyname(kzone)) == ZONE_ID_UNDEFINED) {
4983                 if (!bringup_failure_recovery)
4984                         zerror(zlogp, B_TRUE, "unable to get zoneid");
4985                 if (unmount_cmd)
4986                         (void) lu_root_teardown(zlogp);
4987                 goto error;
4988         }
4989 
4990         if (remove_datalink_pool(zlogp, zoneid) != 0)
4991                 zerror(zlogp, B_FALSE, "unable clear datalink pool property");
4992 
4993         if (remove_datalink_protect(zlogp, zoneid) != 0)
4994                 zerror(zlogp, B_FALSE,
4995                     "unable clear datalink protect property");
4996 
4997         /*
4998          * The datalinks assigned to the zone will be removed from the NGZ as
4999          * part of zone_shutdown() so that we need to remove protect/pool etc.
5000          * before zone_shutdown(). Even if the shutdown itself fails, the zone
5001          * will not be able to violate any constraints applied because the
5002          * datalinks are no longer available to the zone.
5003          */
5004         if (zone_shutdown(zoneid) != 0) {
5005                 zerror(zlogp, B_TRUE, "unable to shutdown zone");
5006                 goto error;
5007         }
5008 
5009         /* Get the zonepath of this zone */
5010         if (zone_get_zonepath(zone_name, zpath, sizeof (zpath)) != Z_OK) {
5011                 zerror(zlogp, B_FALSE, "unable to determine zone path");
5012                 goto error;
5013         }
5014 
5015         /* Get a handle to the brand info for this zone */
5016         if ((bh = brand_open(brand_name)) == NULL) {
5017                 zerror(zlogp, B_FALSE, "unable to determine zone brand");
5018                 return (-1);
5019         }
5020         /*
5021          * If there is a brand 'halt' callback, execute it now to give the
5022          * brand a chance to cleanup any custom configuration.
5023          */
5024         (void) strcpy(cmdbuf, EXEC_PREFIX);
5025         if (brand_get_halt(bh, zone_name, zpath, cmdbuf + EXEC_LEN,
5026             sizeof (cmdbuf) - EXEC_LEN) < 0) {
5027                 brand_close(bh);
5028                 zerror(zlogp, B_FALSE, "unable to determine branded zone's "
5029                     "halt callback.");
5030                 goto error;
5031         }
5032         brand_close(bh);
5033 
5034         if ((strlen(cmdbuf) > EXEC_LEN) &&
5035             (do_subproc(zlogp, cmdbuf, NULL, debug) != Z_OK)) {
5036                 zerror(zlogp, B_FALSE, "%s failed", cmdbuf);
5037                 goto error;
5038         }
5039 
5040         if (!unmount_cmd) {
5041                 zone_iptype_t iptype;
5042 
5043                 if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
5044                     sizeof (flags)) < 0) {
5045                         if (vplat_get_iptype(zlogp, &iptype) < 0) {
5046                                 zerror(zlogp, B_TRUE, "unable to determine "
5047                                     "ip-type");
5048                                 goto error;
5049                         }
5050                 } else {
5051                         if (flags & ZF_NET_EXCL)
5052                                 iptype = ZS_EXCLUSIVE;
5053                         else
5054                                 iptype = ZS_SHARED;
5055                 }
5056 
5057                 switch (iptype) {
5058                 case ZS_SHARED:
5059                         if (unconfigure_shared_network_interfaces(zlogp,
5060                             zoneid) != 0) {
5061                                 zerror(zlogp, B_FALSE, "unable to unconfigure "
5062                                     "network interfaces in zone");
5063                                 goto error;
5064                         }
5065                         break;
5066                 case ZS_EXCLUSIVE:
5067                         status = dladm_zone_halt(dld_handle, zoneid);
5068                         if (status != DLADM_STATUS_OK) {
5069                                 zerror(zlogp, B_FALSE, "unable to notify "
5070                                     "dlmgmtd of zone halt: %s",
5071                                     dladm_status2str(status, errmsg));
5072                         }
5073                         break;
5074                 }
5075         }
5076 
5077         if (!unmount_cmd && tcp_abort_connections(zlogp, zoneid) != 0) {
5078                 zerror(zlogp, B_TRUE, "unable to abort TCP connections");
5079                 goto error;
5080         }
5081 
5082         if (unmount_filesystems(zlogp, zoneid, unmount_cmd) != 0) {
5083                 zerror(zlogp, B_FALSE,
5084                     "unable to unmount file systems in zone");
5085                 goto error;
5086         }
5087 
5088         /*
5089          * If we are rebooting then we normally don't want to destroy an
5090          * existing temporary pool at this point so that we can just reuse it
5091          * when the zone boots back up.  However, it is also possible we were
5092          * running with a temporary pool and the zone configuration has been
5093          * modified to no longer use a temporary pool.  In that case we need
5094          * to destroy the temporary pool now.  This case looks like the case
5095          * where we never had a temporary pool configured but
5096          * zonecfg_destroy_tmp_pool will do the right thing either way.
5097          */
5098         if (!unmount_cmd) {
5099                 boolean_t destroy_tmp_pool = B_TRUE;
5100 
5101                 if (rebooting) {
5102                         struct zone_psettab pset_tab;
5103 
5104                         if (zonecfg_lookup_pset(snap_hndl, &pset_tab) == Z_OK)
5105                                 destroy_tmp_pool = B_FALSE;
5106                 }
5107 
5108                 if (destroy_tmp_pool) {
5109                         if ((res = zonecfg_destroy_tmp_pool(zone_name, pool_err,
5110                             sizeof (pool_err))) != Z_OK) {
5111                                 if (res == Z_POOL)
5112                                         zerror(zlogp, B_FALSE, pool_err);
5113                         }
5114                 }
5115         }
5116 
5117         remove_mlps(zlogp, zoneid);
5118 
5119         if (zone_destroy(zoneid) != 0) {
5120                 zerror(zlogp, B_TRUE, "unable to destroy zone");
5121                 goto error;
5122         }
5123 
5124         /*
5125          * Special teardown for alternate boot environments: remove the tmpfs
5126          * root for the zone and then remove it from the map file.
5127          */
5128         if (unmount_cmd && lu_root_teardown(zlogp) != 0)
5129                 goto error;
5130 
5131         lofs_discard_mnttab();
5132         return (0);
5133 
5134 error:
5135         lofs_discard_mnttab();
5136         return (-1);
5137 }