1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright (c) 2012, Joyent Inc. All rights reserved.
25 */
26
27 /*
28 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
29 */
30
31 /*
32 * This module contains functions used to bring up and tear down the
33 * Virtual Platform: [un]mounting file-systems, [un]plumbing network
34 * interfaces, [un]configuring devices, establishing resource controls,
35 * and creating/destroying the zone in the kernel. These actions, on
36 * the way up, ready the zone; on the way down, they halt the zone.
37 * See the much longer block comment at the beginning of zoneadmd.c
38 * for a bigger picture of how the whole program functions.
39 *
40 * This module also has primary responsibility for the layout of "scratch
41 * zones." These are mounted, but inactive, zones that are used during
42 * operating system upgrade and potentially other administrative action. The
43 * scratch zone environment is similar to the miniroot environment. The zone's
44 * actual root is mounted read-write on /a, and the standard paths (/usr,
45 * /sbin, /lib) all lead to read-only copies of the running system's binaries.
46 * This allows the administrative tools to manipulate the zone using "-R /a"
47 * without relying on any binaries in the zone itself.
48 *
49 * If the scratch zone is on an alternate root (Live Upgrade [LU] boot
50 * environment), then we must resolve the lofs mounts used there to uncover
51 * writable (unshared) resources. Shared resources, though, are always
52 * read-only. In addition, if the "same" zone with a different root path is
53 * currently running, then "/b" inside the zone points to the running zone's
54 * root. This allows LU to synchronize configuration files during the upgrade
55 * process.
56 *
57 * To construct this environment, this module creates a tmpfs mount on
58 * $ZONEPATH/lu. Inside this scratch area, the miniroot-like environment as
59 * described above is constructed on the fly. The zone is then created using
60 * $ZONEPATH/lu as the root.
61 *
62 * Note that scratch zones are inactive. The zone's bits are not running and
63 * likely cannot be run correctly until upgrade is done. Init is not running
64 * there, nor is SMF. Because of this, the "mounted" state of a scratch zone
65 * is not a part of the usual halt/ready/boot state machine.
66 */
67
68 #include <sys/param.h>
69 #include <sys/mount.h>
70 #include <sys/mntent.h>
71 #include <sys/socket.h>
72 #include <sys/utsname.h>
73 #include <sys/types.h>
74 #include <sys/stat.h>
75 #include <sys/sockio.h>
76 #include <sys/stropts.h>
77 #include <sys/conf.h>
78 #include <sys/systeminfo.h>
79
80 #include <libdlpi.h>
81 #include <libdllink.h>
82 #include <libdlvlan.h>
83
84 #include <inet/tcp.h>
85 #include <arpa/inet.h>
86 #include <netinet/in.h>
87 #include <net/route.h>
88
89 #include <stdio.h>
90 #include <errno.h>
91 #include <fcntl.h>
92 #include <unistd.h>
93 #include <rctl.h>
94 #include <stdlib.h>
95 #include <string.h>
96 #include <strings.h>
97 #include <wait.h>
98 #include <limits.h>
99 #include <libgen.h>
100 #include <libzfs.h>
101 #include <libdevinfo.h>
102 #include <zone.h>
103 #include <assert.h>
104 #include <libcontract.h>
105 #include <libcontract_priv.h>
106 #include <uuid/uuid.h>
107
108 #include <sys/mntio.h>
109 #include <sys/mnttab.h>
110 #include <sys/fs/autofs.h> /* for _autofssys() */
111 #include <sys/fs/lofs_info.h>
112 #include <sys/fs/zfs.h>
113
114 #include <pool.h>
115 #include <sys/pool.h>
116 #include <sys/priocntl.h>
117
118 #include <libbrand.h>
119 #include <sys/brand.h>
120 #include <libzonecfg.h>
121 #include <synch.h>
122
123 #include "zoneadmd.h"
124 #include <tsol/label.h>
125 #include <libtsnet.h>
126 #include <sys/priv.h>
127 #include <libinetutil.h>
128
129 #define V4_ADDR_LEN 32
130 #define V6_ADDR_LEN 128
131
132 #define RESOURCE_DEFAULT_OPTS \
133 MNTOPT_RO "," MNTOPT_LOFS_NOSUB "," MNTOPT_NODEVICES
134
135 #define DFSTYPES "/etc/dfs/fstypes"
136 #define MAXTNZLEN 2048
137
138 #define ALT_MOUNT(mount_cmd) ((mount_cmd) != Z_MNT_BOOT)
139
140 /* a reasonable estimate for the number of lwps per process */
141 #define LWPS_PER_PROCESS 10
142
143 /* for routing socket */
144 static int rts_seqno = 0;
145
146 /* mangled zone name when mounting in an alternate root environment */
147 static char kernzone[ZONENAME_MAX];
148
149 /* array of cached mount entries for resolve_lofs */
150 static struct mnttab *resolve_lofs_mnts, *resolve_lofs_mnt_max;
151
152 /* for Trusted Extensions */
153 static tsol_zcent_t *get_zone_label(zlog_t *, priv_set_t *);
154 static int tsol_mounts(zlog_t *, char *, char *);
155 static void tsol_unmounts(zlog_t *, char *);
156
157 static m_label_t *zlabel = NULL;
158 static m_label_t *zid_label = NULL;
159 static priv_set_t *zprivs = NULL;
160
161 /* from libsocket, not in any header file */
162 extern int getnetmaskbyaddr(struct in_addr, struct in_addr *);
163
164 /* from zoneadmd */
165 extern char query_hook[];
166 extern char post_statechg_hook[];
167
168 /*
169 * For each "net" resource configured in zonecfg, we track a zone_addr_list_t
170 * node in a linked list that is sorted by linkid. The list is constructed as
171 * the xml configuration file is parsed, and the information
172 * contained in each node is added to the kernel before the zone is
173 * booted, to be retrieved and applied from within the exclusive-IP NGZ
174 * on boot.
175 */
176 typedef struct zone_addr_list {
177 struct zone_addr_list *za_next;
178 datalink_id_t za_linkid; /* datalink_id_t of interface */
179 struct zone_nwiftab za_nwiftab; /* address, defrouter properties */
180 } zone_addr_list_t;
181
182 /*
183 * An optimization for build_mnttable: reallocate (and potentially copy the
184 * data) only once every N times through the loop.
185 */
186 #define MNTTAB_HUNK 32
187
188 /* some handy macros */
189 #define SIN(s) ((struct sockaddr_in *)s)
190 #define SIN6(s) ((struct sockaddr_in6 *)s)
191
192 /*
193 * Private autofs system call
194 */
195 extern int _autofssys(int, void *);
196
197 static int
198 autofs_cleanup(zoneid_t zoneid)
199 {
200 /*
201 * Ask autofs to unmount all trigger nodes in the given zone.
202 */
203 return (_autofssys(AUTOFS_UNMOUNTALL, (void *)((uintptr_t)zoneid)));
204 }
205
206 static void
207 free_mnttable(struct mnttab *mnt_array, uint_t nelem)
208 {
209 uint_t i;
210
211 if (mnt_array == NULL)
212 return;
213 for (i = 0; i < nelem; i++) {
214 free(mnt_array[i].mnt_mountp);
215 free(mnt_array[i].mnt_fstype);
216 free(mnt_array[i].mnt_special);
217 free(mnt_array[i].mnt_mntopts);
218 assert(mnt_array[i].mnt_time == NULL);
219 }
220 free(mnt_array);
221 }
222
223 /*
224 * Build the mount table for the zone rooted at "zroot", storing the resulting
225 * array of struct mnttabs in "mnt_arrayp" and the number of elements in the
226 * array in "nelemp".
227 */
228 static int
229 build_mnttable(zlog_t *zlogp, const char *zroot, size_t zrootlen, FILE *mnttab,
230 struct mnttab **mnt_arrayp, uint_t *nelemp)
231 {
232 struct mnttab mnt;
233 struct mnttab *mnts;
234 struct mnttab *mnp;
235 uint_t nmnt;
236
237 rewind(mnttab);
238 resetmnttab(mnttab);
239 nmnt = 0;
240 mnts = NULL;
241 while (getmntent(mnttab, &mnt) == 0) {
242 struct mnttab *tmp_array;
243
244 if (strncmp(mnt.mnt_mountp, zroot, zrootlen) != 0)
245 continue;
246 if (nmnt % MNTTAB_HUNK == 0) {
247 tmp_array = realloc(mnts,
248 (nmnt + MNTTAB_HUNK) * sizeof (*mnts));
249 if (tmp_array == NULL) {
250 free_mnttable(mnts, nmnt);
251 return (-1);
252 }
253 mnts = tmp_array;
254 }
255 mnp = &mnts[nmnt++];
256
257 /*
258 * Zero out any fields we're not using.
259 */
260 (void) memset(mnp, 0, sizeof (*mnp));
261
262 if (mnt.mnt_special != NULL)
263 mnp->mnt_special = strdup(mnt.mnt_special);
264 if (mnt.mnt_mntopts != NULL)
265 mnp->mnt_mntopts = strdup(mnt.mnt_mntopts);
266 mnp->mnt_mountp = strdup(mnt.mnt_mountp);
267 mnp->mnt_fstype = strdup(mnt.mnt_fstype);
268 if ((mnt.mnt_special != NULL && mnp->mnt_special == NULL) ||
269 (mnt.mnt_mntopts != NULL && mnp->mnt_mntopts == NULL) ||
270 mnp->mnt_mountp == NULL || mnp->mnt_fstype == NULL) {
271 zerror(zlogp, B_TRUE, "memory allocation failed");
272 free_mnttable(mnts, nmnt);
273 return (-1);
274 }
275 }
276 *mnt_arrayp = mnts;
277 *nelemp = nmnt;
278 return (0);
279 }
280
281 /*
282 * This is an optimization. The resolve_lofs function is used quite frequently
283 * to manipulate file paths, and on a machine with a large number of zones,
284 * there will be a huge number of mounted file systems. Thus, we trigger a
285 * reread of the list of mount points
286 */
287 static void
288 lofs_discard_mnttab(void)
289 {
290 free_mnttable(resolve_lofs_mnts,
291 resolve_lofs_mnt_max - resolve_lofs_mnts);
292 resolve_lofs_mnts = resolve_lofs_mnt_max = NULL;
293 }
294
295 static int
296 lofs_read_mnttab(zlog_t *zlogp)
297 {
298 FILE *mnttab;
299 uint_t nmnts;
300
301 if ((mnttab = fopen(MNTTAB, "r")) == NULL)
302 return (-1);
303 if (build_mnttable(zlogp, "", 0, mnttab, &resolve_lofs_mnts,
304 &nmnts) == -1) {
305 (void) fclose(mnttab);
306 return (-1);
307 }
308 (void) fclose(mnttab);
309 resolve_lofs_mnt_max = resolve_lofs_mnts + nmnts;
310 return (0);
311 }
312
313 /*
314 * This function loops over potential loopback mounts and symlinks in a given
315 * path and resolves them all down to an absolute path.
316 */
317 void
318 resolve_lofs(zlog_t *zlogp, char *path, size_t pathlen)
319 {
320 int len, arlen;
321 const char *altroot;
322 char tmppath[MAXPATHLEN];
323 boolean_t outside_altroot;
324
325 if ((len = resolvepath(path, tmppath, sizeof (tmppath))) == -1)
326 return;
327 tmppath[len] = '\0';
328 (void) strlcpy(path, tmppath, sizeof (tmppath));
329
330 /* This happens once per zoneadmd operation. */
331 if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
332 return;
333
334 altroot = zonecfg_get_root();
335 arlen = strlen(altroot);
336 outside_altroot = B_FALSE;
337 for (;;) {
338 struct mnttab *mnp;
339
340 /* Search in reverse order to find longest match */
341 for (mnp = resolve_lofs_mnt_max - 1; mnp >= resolve_lofs_mnts;
342 mnp--) {
343 if (mnp->mnt_fstype == NULL ||
344 mnp->mnt_mountp == NULL ||
345 mnp->mnt_special == NULL)
346 continue;
347 len = strlen(mnp->mnt_mountp);
348 if (strncmp(mnp->mnt_mountp, path, len) == 0 &&
349 (path[len] == '/' || path[len] == '\0'))
350 break;
351 }
352 if (mnp < resolve_lofs_mnts)
353 break;
354 /* If it's not a lofs then we're done */
355 if (strcmp(mnp->mnt_fstype, MNTTYPE_LOFS) != 0)
356 break;
357 if (outside_altroot) {
358 char *cp;
359 int olen = sizeof (MNTOPT_RO) - 1;
360
361 /*
362 * If we run into a read-only mount outside of the
363 * alternate root environment, then the user doesn't
364 * want this path to be made read-write.
365 */
366 if (mnp->mnt_mntopts != NULL &&
367 (cp = strstr(mnp->mnt_mntopts, MNTOPT_RO)) !=
368 NULL &&
369 (cp == mnp->mnt_mntopts || cp[-1] == ',') &&
370 (cp[olen] == '\0' || cp[olen] == ',')) {
371 break;
372 }
373 } else if (arlen > 0 &&
374 (strncmp(mnp->mnt_special, altroot, arlen) != 0 ||
375 (mnp->mnt_special[arlen] != '\0' &&
376 mnp->mnt_special[arlen] != '/'))) {
377 outside_altroot = B_TRUE;
378 }
379 /* use temporary buffer because new path might be longer */
380 (void) snprintf(tmppath, sizeof (tmppath), "%s%s",
381 mnp->mnt_special, path + len);
382 if ((len = resolvepath(tmppath, path, pathlen)) == -1)
383 break;
384 path[len] = '\0';
385 }
386 }
387
388 /*
389 * For a regular mount, check if a replacement lofs mount is needed because the
390 * referenced device is already mounted somewhere.
391 */
392 static int
393 check_lofs_needed(zlog_t *zlogp, struct zone_fstab *fsptr)
394 {
395 struct mnttab *mnp;
396 zone_fsopt_t *optptr, *onext;
397
398 /* This happens once per zoneadmd operation. */
399 if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
400 return (-1);
401
402 /*
403 * If this special node isn't already in use, then it's ours alone;
404 * no need to worry about conflicting mounts.
405 */
406 for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max;
407 mnp++) {
408 if (strcmp(mnp->mnt_special, fsptr->zone_fs_special) == 0)
409 break;
410 }
411 if (mnp >= resolve_lofs_mnt_max)
412 return (0);
413
414 /*
415 * Convert this duplicate mount into a lofs mount.
416 */
417 (void) strlcpy(fsptr->zone_fs_special, mnp->mnt_mountp,
418 sizeof (fsptr->zone_fs_special));
419 (void) strlcpy(fsptr->zone_fs_type, MNTTYPE_LOFS,
420 sizeof (fsptr->zone_fs_type));
421 fsptr->zone_fs_raw[0] = '\0';
422
423 /*
424 * Discard all but one of the original options and set that to our
425 * default set of options used for resources.
426 */
427 optptr = fsptr->zone_fs_options;
428 if (optptr == NULL) {
429 optptr = malloc(sizeof (*optptr));
430 if (optptr == NULL) {
431 zerror(zlogp, B_TRUE, "cannot mount %s",
432 fsptr->zone_fs_dir);
433 return (-1);
434 }
435 } else {
436 while ((onext = optptr->zone_fsopt_next) != NULL) {
437 optptr->zone_fsopt_next = onext->zone_fsopt_next;
438 free(onext);
439 }
440 }
441 (void) strcpy(optptr->zone_fsopt_opt, RESOURCE_DEFAULT_OPTS);
442 optptr->zone_fsopt_next = NULL;
443 fsptr->zone_fs_options = optptr;
444 return (0);
445 }
446
447 int
448 make_one_dir(zlog_t *zlogp, const char *prefix, const char *subdir, mode_t mode,
449 uid_t userid, gid_t groupid)
450 {
451 char path[MAXPATHLEN];
452 struct stat st;
453
454 if (snprintf(path, sizeof (path), "%s%s", prefix, subdir) >
455 sizeof (path)) {
456 zerror(zlogp, B_FALSE, "pathname %s%s is too long", prefix,
457 subdir);
458 return (-1);
459 }
460
461 if (lstat(path, &st) == 0) {
462 /*
463 * We don't check the file mode since presumably the zone
464 * administrator may have had good reason to change the mode,
465 * and we don't need to second guess him.
466 */
467 if (!S_ISDIR(st.st_mode)) {
468 if (S_ISREG(st.st_mode)) {
469 /*
470 * Allow readonly mounts of /etc/ files; this
471 * is needed most by Trusted Extensions.
472 */
473 if (strncmp(subdir, "/etc/",
474 strlen("/etc/")) != 0) {
475 zerror(zlogp, B_FALSE,
476 "%s is not in /etc", path);
477 return (-1);
478 }
479 } else {
480 zerror(zlogp, B_FALSE,
481 "%s is not a directory", path);
482 return (-1);
483 }
484 }
485 return (0);
486 }
487
488 if (mkdirp(path, mode) != 0) {
489 if (errno == EROFS)
490 zerror(zlogp, B_FALSE, "Could not mkdir %s.\nIt is on "
491 "a read-only file system in this local zone.\nMake "
492 "sure %s exists in the global zone.", path, subdir);
493 else
494 zerror(zlogp, B_TRUE, "mkdirp of %s failed", path);
495 return (-1);
496 }
497
498 (void) chown(path, userid, groupid);
499 return (0);
500 }
501
502 static void
503 free_remote_fstypes(char **types)
504 {
505 uint_t i;
506
507 if (types == NULL)
508 return;
509 for (i = 0; types[i] != NULL; i++)
510 free(types[i]);
511 free(types);
512 }
513
514 static char **
515 get_remote_fstypes(zlog_t *zlogp)
516 {
517 char **types = NULL;
518 FILE *fp;
519 char buf[MAXPATHLEN];
520 char fstype[MAXPATHLEN];
521 uint_t lines = 0;
522 uint_t i;
523
524 if ((fp = fopen(DFSTYPES, "r")) == NULL) {
525 zerror(zlogp, B_TRUE, "failed to open %s", DFSTYPES);
526 return (NULL);
527 }
528 /*
529 * Count the number of lines
530 */
531 while (fgets(buf, sizeof (buf), fp) != NULL)
532 lines++;
533 if (lines == 0) /* didn't read anything; empty file */
534 goto out;
535 rewind(fp);
536 /*
537 * Allocate enough space for a NULL-terminated array.
538 */
539 types = calloc(lines + 1, sizeof (char *));
540 if (types == NULL) {
541 zerror(zlogp, B_TRUE, "memory allocation failed");
542 goto out;
543 }
544 i = 0;
545 while (fgets(buf, sizeof (buf), fp) != NULL) {
546 /* LINTED - fstype is big enough to hold buf */
547 if (sscanf(buf, "%s", fstype) == 0) {
548 zerror(zlogp, B_FALSE, "unable to parse %s", DFSTYPES);
549 free_remote_fstypes(types);
550 types = NULL;
551 goto out;
552 }
553 types[i] = strdup(fstype);
554 if (types[i] == NULL) {
555 zerror(zlogp, B_TRUE, "memory allocation failed");
556 free_remote_fstypes(types);
557 types = NULL;
558 goto out;
559 }
560 i++;
561 }
562 out:
563 (void) fclose(fp);
564 return (types);
565 }
566
567 static boolean_t
568 is_remote_fstype(const char *fstype, char *const *remote_fstypes)
569 {
570 uint_t i;
571
572 if (remote_fstypes == NULL)
573 return (B_FALSE);
574 for (i = 0; remote_fstypes[i] != NULL; i++) {
575 if (strcmp(remote_fstypes[i], fstype) == 0)
576 return (B_TRUE);
577 }
578 return (B_FALSE);
579 }
580
581 /*
582 * This converts a zone root path (normally of the form .../root) to a Live
583 * Upgrade scratch zone root (of the form .../lu).
584 */
585 static void
586 root_to_lu(zlog_t *zlogp, char *zroot, size_t zrootlen, boolean_t isresolved)
587 {
588 if (!isresolved && zonecfg_in_alt_root())
589 resolve_lofs(zlogp, zroot, zrootlen);
590 (void) strcpy(strrchr(zroot, '/') + 1, "lu");
591 }
592
593 /*
594 * Perform brand-specific cleanup if we are unable to unmount a FS.
595 */
596 static void
597 brand_umount_cleanup(zlog_t *zlogp, char *path)
598 {
599 char cmdbuf[2 * MAXPATHLEN];
600
601 if (post_statechg_hook[0] == '\0')
602 return;
603
604 if (snprintf(cmdbuf, sizeof (cmdbuf), "%s %d %d %s", post_statechg_hook,
605 ZONE_STATE_DOWN, Z_UNMOUNT, path) > sizeof (cmdbuf))
606 return;
607
608 (void) do_subproc(zlogp, cmdbuf, NULL, B_FALSE);
609 }
610
611 /*
612 * The general strategy for unmounting filesystems is as follows:
613 *
614 * - Remote filesystems may be dead, and attempting to contact them as
615 * part of a regular unmount may hang forever; we want to always try to
616 * forcibly unmount such filesystems and only fall back to regular
617 * unmounts if the filesystem doesn't support forced unmounts.
618 *
619 * - We don't want to unnecessarily corrupt metadata on local
620 * filesystems (ie UFS), so we want to start off with graceful unmounts,
621 * and only escalate to doing forced unmounts if we get stuck.
622 *
623 * We start off walking backwards through the mount table. This doesn't
624 * give us strict ordering but ensures that we try to unmount submounts
625 * first. We thus limit the number of failed umount2(2) calls.
626 *
627 * The mechanism for determining if we're stuck is to count the number
628 * of failed unmounts each iteration through the mount table. This
629 * gives us an upper bound on the number of filesystems which remain
630 * mounted (autofs trigger nodes are dealt with separately). If at the
631 * end of one unmount+autofs_cleanup cycle we still have the same number
632 * of mounts that we started out with, we're stuck and try a forced
633 * unmount. If that fails (filesystem doesn't support forced unmounts)
634 * then we bail and are unable to teardown the zone. If it succeeds,
635 * we're no longer stuck so we continue with our policy of trying
636 * graceful mounts first.
637 *
638 * Zone must be down (ie, no processes or threads active).
639 */
640 static int
641 unmount_filesystems(zlog_t *zlogp, zoneid_t zoneid, boolean_t unmount_cmd)
642 {
643 int error = 0;
644 int fail = 0;
645 FILE *mnttab;
646 struct mnttab *mnts;
647 uint_t nmnt;
648 char zroot[MAXPATHLEN + 1];
649 size_t zrootlen;
650 uint_t oldcount = UINT_MAX;
651 boolean_t stuck = B_FALSE;
652 char **remote_fstypes = NULL;
653
654 if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
655 zerror(zlogp, B_FALSE, "unable to determine zone root");
656 return (-1);
657 }
658 if (unmount_cmd)
659 root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
660
661 (void) strcat(zroot, "/");
662 zrootlen = strlen(zroot);
663
664 /*
665 * For Trusted Extensions unmount each higher level zone's mount
666 * of our zone's /export/home
667 */
668 if (!unmount_cmd)
669 tsol_unmounts(zlogp, zone_name);
670
671 if ((mnttab = fopen(MNTTAB, "r")) == NULL) {
672 zerror(zlogp, B_TRUE, "failed to open %s", MNTTAB);
673 return (-1);
674 }
675 /*
676 * Use our hacky mntfs ioctl so we see everything, even mounts with
677 * MS_NOMNTTAB.
678 */
679 if (ioctl(fileno(mnttab), MNTIOC_SHOWHIDDEN, NULL) < 0) {
680 zerror(zlogp, B_TRUE, "unable to configure %s", MNTTAB);
681 error++;
682 goto out;
683 }
684
685 /*
686 * Build the list of remote fstypes so we know which ones we
687 * should forcibly unmount.
688 */
689 remote_fstypes = get_remote_fstypes(zlogp);
690 for (; /* ever */; ) {
691 uint_t newcount = 0;
692 boolean_t unmounted;
693 struct mnttab *mnp;
694 char *path;
695 uint_t i;
696
697 mnts = NULL;
698 nmnt = 0;
699 /*
700 * MNTTAB gives us a way to walk through mounted
701 * filesystems; we need to be able to walk them in
702 * reverse order, so we build a list of all mounted
703 * filesystems.
704 */
705 if (build_mnttable(zlogp, zroot, zrootlen, mnttab, &mnts,
706 &nmnt) != 0) {
707 error++;
708 goto out;
709 }
710 for (i = 0; i < nmnt; i++) {
711 mnp = &mnts[nmnt - i - 1]; /* access in reverse order */
712 path = mnp->mnt_mountp;
713 unmounted = B_FALSE;
714 /*
715 * Try forced unmount first for remote filesystems.
716 *
717 * Not all remote filesystems support forced unmounts,
718 * so if this fails (ENOTSUP) we'll continue on
719 * and try a regular unmount.
720 */
721 if (is_remote_fstype(mnp->mnt_fstype, remote_fstypes)) {
722 if (umount2(path, MS_FORCE) == 0)
723 unmounted = B_TRUE;
724 }
725 /*
726 * Try forced unmount if we're stuck.
727 */
728 if (stuck) {
729 if (umount2(path, MS_FORCE) == 0) {
730 unmounted = B_TRUE;
731 stuck = B_FALSE;
732 fail = 0;
733 } else {
734 /*
735 * We may hit a failure here if there
736 * is an app in the GZ with an open
737 * pipe into the zone (commonly into
738 * the zone's /var/run). This type
739 * of app will notice the closed
740 * connection and cleanup, but it may
741 * take a while and we have no easy
742 * way to notice that. To deal with
743 * this case, we will wait and retry
744 * a few times before we give up.
745 */
746 fail++;
747 if (fail < 16) {
748 zerror(zlogp, B_FALSE,
749 "unable to unmount '%s', "
750 "retrying in 1 second",
751 path);
752 (void) sleep(1);
753 } else if (fail > 17) {
754 error++;
755 zerror(zlogp, B_FALSE,
756 "unable to unmount '%s'",
757 path);
758 free_mnttable(mnts, nmnt);
759 goto out;
760 } else {
761 /* Try the hook 2 times */
762 brand_umount_cleanup(zlogp,
763 path);
764 }
765 }
766 }
767 /*
768 * Try regular unmounts for everything else.
769 */
770 if (!unmounted && umount2(path, 0) != 0)
771 newcount++;
772 }
773 free_mnttable(mnts, nmnt);
774
775 if (newcount == 0)
776 break;
777 if (newcount >= oldcount) {
778 /*
779 * Last round didn't unmount anything; we're stuck and
780 * should start trying forced unmounts.
781 */
782 stuck = B_TRUE;
783 }
784 oldcount = newcount;
785
786 /*
787 * Autofs doesn't let you unmount its trigger nodes from
788 * userland so we have to tell the kernel to cleanup for us.
789 */
790 if (autofs_cleanup(zoneid) != 0) {
791 zerror(zlogp, B_TRUE, "unable to remove autofs nodes");
792 error++;
793 goto out;
794 }
795 }
796
797 out:
798 free_remote_fstypes(remote_fstypes);
799 (void) fclose(mnttab);
800 return (error ? -1 : 0);
801 }
802
803 static int
804 fs_compare(const void *m1, const void *m2)
805 {
806 struct zone_fstab *i = (struct zone_fstab *)m1;
807 struct zone_fstab *j = (struct zone_fstab *)m2;
808
809 return (strcmp(i->zone_fs_dir, j->zone_fs_dir));
810 }
811
812 /*
813 * Fork and exec (and wait for) the mentioned binary with the provided
814 * arguments. Returns (-1) if something went wrong with fork(2) or exec(2),
815 * returns the exit status otherwise.
816 *
817 * If we were unable to exec the provided pathname (for whatever
818 * reason), we return the special token ZEXIT_EXEC. The current value
819 * of ZEXIT_EXEC doesn't conflict with legitimate exit codes of the
820 * consumers of this function; any future consumers must make sure this
821 * remains the case.
822 */
823 static int
824 forkexec(zlog_t *zlogp, const char *path, char *const argv[])
825 {
826 pid_t child_pid;
827 int child_status = 0;
828
829 /*
830 * Do not let another thread localize a message while we are forking.
831 */
832 (void) mutex_lock(&msglock);
833 child_pid = fork();
834 (void) mutex_unlock(&msglock);
835 if (child_pid == -1) {
836 zerror(zlogp, B_TRUE, "could not fork for %s", argv[0]);
837 return (-1);
838 } else if (child_pid == 0) {
839 closefrom(0);
840 /* redirect stdin, stdout & stderr to /dev/null */
841 (void) open("/dev/null", O_RDONLY); /* stdin */
842 (void) open("/dev/null", O_WRONLY); /* stdout */
843 (void) open("/dev/null", O_WRONLY); /* stderr */
844 (void) execv(path, argv);
845 /*
846 * Since we are in the child, there is no point calling zerror()
847 * since there is nobody waiting to consume it. So exit with a
848 * special code that the parent will recognize and call zerror()
849 * accordingly.
850 */
851
852 _exit(ZEXIT_EXEC);
853 } else {
854 (void) waitpid(child_pid, &child_status, 0);
855 }
856
857 if (WIFSIGNALED(child_status)) {
858 zerror(zlogp, B_FALSE, "%s unexpectedly terminated due to "
859 "signal %d", path, WTERMSIG(child_status));
860 return (-1);
861 }
862 assert(WIFEXITED(child_status));
863 if (WEXITSTATUS(child_status) == ZEXIT_EXEC) {
864 zerror(zlogp, B_FALSE, "failed to exec %s", path);
865 return (-1);
866 }
867 return (WEXITSTATUS(child_status));
868 }
869
870 static int
871 isregfile(const char *path)
872 {
873 struct stat64 st;
874
875 if (stat64(path, &st) == -1)
876 return (-1);
877
878 return (S_ISREG(st.st_mode));
879 }
880
881 static int
882 dofsck(zlog_t *zlogp, const char *fstype, const char *rawdev)
883 {
884 char cmdbuf[MAXPATHLEN];
885 char *argv[5];
886 int status;
887
888 /*
889 * We could alternatively have called /usr/sbin/fsck -F <fstype>, but
890 * that would cost us an extra fork/exec without buying us anything.
891 */
892 if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/fsck", fstype)
893 >= sizeof (cmdbuf)) {
894 zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
895 return (-1);
896 }
897
898 /*
899 * If it doesn't exist, that's OK: we verified this previously
900 * in zoneadm.
901 */
902 if (isregfile(cmdbuf) == -1)
903 return (0);
904
905 argv[0] = "fsck";
906 argv[1] = "-o";
907 argv[2] = "p";
908 argv[3] = (char *)rawdev;
909 argv[4] = NULL;
910
911 status = forkexec(zlogp, cmdbuf, argv);
912 if (status == 0 || status == -1)
913 return (status);
914 zerror(zlogp, B_FALSE, "fsck of '%s' failed with exit status %d; "
915 "run fsck manually", rawdev, status);
916 return (-1);
917 }
918
919 static int
920 domount(zlog_t *zlogp, const char *fstype, const char *opts,
921 const char *special, const char *directory)
922 {
923 char cmdbuf[MAXPATHLEN];
924 char *argv[6];
925 int status;
926
927 /*
928 * We could alternatively have called /usr/sbin/mount -F <fstype>, but
929 * that would cost us an extra fork/exec without buying us anything.
930 */
931 if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/mount", fstype)
932 >= sizeof (cmdbuf)) {
933 zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
934 return (-1);
935 }
936 argv[0] = "mount";
937 if (opts[0] == '\0') {
938 argv[1] = (char *)special;
939 argv[2] = (char *)directory;
940 argv[3] = NULL;
941 } else {
942 argv[1] = "-o";
943 argv[2] = (char *)opts;
944 argv[3] = (char *)special;
945 argv[4] = (char *)directory;
946 argv[5] = NULL;
947 }
948
949 status = forkexec(zlogp, cmdbuf, argv);
950 if (status == 0 || status == -1)
951 return (status);
952 if (opts[0] == '\0')
953 zerror(zlogp, B_FALSE, "\"%s %s %s\" "
954 "failed with exit code %d",
955 cmdbuf, special, directory, status);
956 else
957 zerror(zlogp, B_FALSE, "\"%s -o %s %s %s\" "
958 "failed with exit code %d",
959 cmdbuf, opts, special, directory, status);
960 return (-1);
961 }
962
963 /*
964 * Check if a given mount point path exists.
965 * If it does, make sure it doesn't contain any symlinks.
966 * Note that if "leaf" is false we're checking an intermediate
967 * component of the mount point path, so it must be a directory.
968 * If "leaf" is true, then we're checking the entire mount point
969 * path, so the mount point itself can be anything aside from a
970 * symbolic link.
971 *
972 * If the path is invalid then a negative value is returned. If the
973 * path exists and is a valid mount point path then 0 is returned.
974 * If the path doesn't exist return a positive value.
975 */
976 static int
977 valid_mount_point(zlog_t *zlogp, const char *path, const boolean_t leaf)
978 {
979 struct stat statbuf;
980 char respath[MAXPATHLEN];
981 int res;
982
983 if (lstat(path, &statbuf) != 0) {
984 if (errno == ENOENT)
985 return (1);
986 zerror(zlogp, B_TRUE, "can't stat %s", path);
987 return (-1);
988 }
989 if (S_ISLNK(statbuf.st_mode)) {
990 zerror(zlogp, B_FALSE, "%s is a symlink", path);
991 return (-1);
992 }
993 if (!leaf && !S_ISDIR(statbuf.st_mode)) {
994 zerror(zlogp, B_FALSE, "%s is not a directory", path);
995 return (-1);
996 }
997 if ((res = resolvepath(path, respath, sizeof (respath))) == -1) {
998 zerror(zlogp, B_TRUE, "unable to resolve path %s", path);
999 return (-1);
1000 }
1001 respath[res] = '\0';
1002 if (strcmp(path, respath) != 0) {
1003 /*
1004 * We don't like ".."s, "."s, or "//"s throwing us off
1005 */
1006 zerror(zlogp, B_FALSE, "%s is not a canonical path", path);
1007 return (-1);
1008 }
1009 return (0);
1010 }
1011
1012 /*
1013 * Validate a mount point path. A valid mount point path is an
1014 * absolute path that either doesn't exist, or, if it does exists it
1015 * must be an absolute canonical path that doesn't have any symbolic
1016 * links in it. The target of a mount point path can be any filesystem
1017 * object. (Different filesystems can support different mount points,
1018 * for example "lofs" and "mntfs" both support files and directories
1019 * while "ufs" just supports directories.)
1020 *
1021 * If the path is invalid then a negative value is returned. If the
1022 * path exists and is a valid mount point path then 0 is returned.
1023 * If the path doesn't exist return a positive value.
1024 */
1025 int
1026 valid_mount_path(zlog_t *zlogp, const char *rootpath, const char *spec,
1027 const char *dir, const char *fstype)
1028 {
1029 char abspath[MAXPATHLEN], *slashp, *slashp_next;
1030 int rv;
1031
1032 /*
1033 * Sanity check the target mount point path.
1034 * It must be a non-null string that starts with a '/'.
1035 */
1036 if (dir[0] != '/') {
1037 /* Something went wrong. */
1038 zerror(zlogp, B_FALSE, "invalid mount directory, "
1039 "type: \"%s\", special: \"%s\", dir: \"%s\"",
1040 fstype, spec, dir);
1041 return (-1);
1042 }
1043
1044 /*
1045 * Join rootpath and dir. Make sure abspath ends with '/', this
1046 * is added to all paths (even non-directory paths) to allow us
1047 * to detect the end of paths below. If the path already ends
1048 * in a '/', then that's ok too (although we'll fail the
1049 * cannonical path check in valid_mount_point()).
1050 */
1051 if (snprintf(abspath, sizeof (abspath),
1052 "%s%s/", rootpath, dir) >= sizeof (abspath)) {
1053 zerror(zlogp, B_FALSE, "pathname %s%s is too long",
1054 rootpath, dir);
1055 return (-1);
1056 }
1057
1058 /*
1059 * Starting with rootpath, verify the mount path one component
1060 * at a time. Continue until we've evaluated all of abspath.
1061 */
1062 slashp = &abspath[strlen(rootpath)];
1063 assert(*slashp == '/');
1064 do {
1065 slashp_next = strchr(slashp + 1, '/');
1066 *slashp = '\0';
1067 if (slashp_next != NULL) {
1068 /* This is an intermediary mount path component. */
1069 rv = valid_mount_point(zlogp, abspath, B_FALSE);
1070 } else {
1071 /* This is the last component of the mount path. */
1072 rv = valid_mount_point(zlogp, abspath, B_TRUE);
1073 }
1074 if (rv < 0)
1075 return (rv);
1076 *slashp = '/';
1077 } while ((slashp = slashp_next) != NULL);
1078 return (rv);
1079 }
1080
1081 static int
1082 mount_one_dev_device_cb(void *arg, const char *match, const char *name)
1083 {
1084 di_prof_t prof = arg;
1085
1086 if (name == NULL)
1087 return (di_prof_add_dev(prof, match));
1088 return (di_prof_add_map(prof, match, name));
1089 }
1090
1091 static int
1092 mount_one_dev_symlink_cb(void *arg, const char *source, const char *target)
1093 {
1094 di_prof_t prof = arg;
1095
1096 return (di_prof_add_symlink(prof, source, target));
1097 }
1098
1099 int
1100 vplat_get_iptype(zlog_t *zlogp, zone_iptype_t *iptypep)
1101 {
1102 if (zonecfg_get_iptype(snap_hndl, iptypep) != Z_OK) {
1103 zerror(zlogp, B_FALSE, "invalid ip-type configuration");
1104 return (-1);
1105 }
1106 return (0);
1107 }
1108
1109 /*
1110 * Apply the standard lists of devices/symlinks/mappings and the user-specified
1111 * list of devices (via zonecfg) to the /dev filesystem. The filesystem will
1112 * use these as a profile/filter to determine what exists in /dev.
1113 */
1114 static int
1115 mount_one_dev(zlog_t *zlogp, char *devpath, zone_mnt_t mount_cmd)
1116 {
1117 char brand[MAXNAMELEN];
1118 brand_handle_t bh = NULL;
1119 struct zone_devtab ztab;
1120 di_prof_t prof = NULL;
1121 int err;
1122 int retval = -1;
1123 zone_iptype_t iptype;
1124 const char *curr_iptype = NULL;
1125
1126 if (di_prof_init(devpath, &prof)) {
1127 zerror(zlogp, B_TRUE, "failed to initialize profile");
1128 goto cleanup;
1129 }
1130
1131 /*
1132 * Get a handle to the brand info for this zone.
1133 * If we are mounting the zone, then we must always use the default
1134 * brand device mounts.
1135 */
1136 if (ALT_MOUNT(mount_cmd)) {
1137 (void) strlcpy(brand, default_brand, sizeof (brand));
1138 } else {
1139 (void) strlcpy(brand, brand_name, sizeof (brand));
1140 }
1141
1142 if ((bh = brand_open(brand)) == NULL) {
1143 zerror(zlogp, B_FALSE, "unable to determine zone brand");
1144 goto cleanup;
1145 }
1146
1147 if (vplat_get_iptype(zlogp, &iptype) < 0) {
1148 zerror(zlogp, B_TRUE, "unable to determine ip-type");
1149 goto cleanup;
1150 }
1151 switch (iptype) {
1152 case ZS_SHARED:
1153 curr_iptype = "shared";
1154 break;
1155 case ZS_EXCLUSIVE:
1156 curr_iptype = "exclusive";
1157 break;
1158 }
1159 if (curr_iptype == NULL)
1160 abort();
1161
1162 if (brand_platform_iter_devices(bh, zone_name,
1163 mount_one_dev_device_cb, prof, curr_iptype) != 0) {
1164 zerror(zlogp, B_TRUE, "failed to add standard device");
1165 goto cleanup;
1166 }
1167
1168 if (brand_platform_iter_link(bh,
1169 mount_one_dev_symlink_cb, prof) != 0) {
1170 zerror(zlogp, B_TRUE, "failed to add standard symlink");
1171 goto cleanup;
1172 }
1173
1174 /* Add user-specified devices and directories */
1175 if ((err = zonecfg_setdevent(snap_hndl)) != 0) {
1176 zerror(zlogp, B_FALSE, "%s: %s", zone_name,
1177 zonecfg_strerror(err));
1178 goto cleanup;
1179 }
1180 while (zonecfg_getdevent(snap_hndl, &ztab) == Z_OK) {
1181 if (di_prof_add_dev(prof, ztab.zone_dev_match)) {
1182 zerror(zlogp, B_TRUE, "failed to add "
1183 "user-specified device");
1184 goto cleanup;
1185 }
1186 }
1187 (void) zonecfg_enddevent(snap_hndl);
1188
1189 /* Send profile to kernel */
1190 if (di_prof_commit(prof)) {
1191 zerror(zlogp, B_TRUE, "failed to commit profile");
1192 goto cleanup;
1193 }
1194
1195 retval = 0;
1196
1197 cleanup:
1198 if (bh != NULL)
1199 brand_close(bh);
1200 if (prof)
1201 di_prof_fini(prof);
1202 return (retval);
1203 }
1204
1205 static int
1206 mount_one(zlog_t *zlogp, struct zone_fstab *fsptr, const char *rootpath,
1207 zone_mnt_t mount_cmd)
1208 {
1209 char path[MAXPATHLEN];
1210 char optstr[MAX_MNTOPT_STR];
1211 zone_fsopt_t *optptr;
1212 int rv;
1213
1214 if ((rv = valid_mount_path(zlogp, rootpath, fsptr->zone_fs_special,
1215 fsptr->zone_fs_dir, fsptr->zone_fs_type)) < 0) {
1216 zerror(zlogp, B_FALSE, "%s%s is not a valid mount point",
1217 rootpath, fsptr->zone_fs_dir);
1218 return (-1);
1219 } else if (rv > 0) {
1220 /* The mount point path doesn't exist, create it now. */
1221 if (make_one_dir(zlogp, rootpath, fsptr->zone_fs_dir,
1222 DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
1223 DEFAULT_DIR_GROUP) != 0) {
1224 zerror(zlogp, B_FALSE, "failed to create mount point");
1225 return (-1);
1226 }
1227
1228 /*
1229 * Now this might seem weird, but we need to invoke
1230 * valid_mount_path() again. Why? Because it checks
1231 * to make sure that the mount point path is canonical,
1232 * which it can only do if the path exists, so now that
1233 * we've created the path we have to verify it again.
1234 */
1235 if ((rv = valid_mount_path(zlogp, rootpath,
1236 fsptr->zone_fs_special, fsptr->zone_fs_dir,
1237 fsptr->zone_fs_type)) < 0) {
1238 zerror(zlogp, B_FALSE,
1239 "%s%s is not a valid mount point",
1240 rootpath, fsptr->zone_fs_dir);
1241 return (-1);
1242 }
1243 }
1244
1245 (void) snprintf(path, sizeof (path), "%s%s", rootpath,
1246 fsptr->zone_fs_dir);
1247
1248 /*
1249 * In general the strategy here is to do just as much verification as
1250 * necessary to avoid crashing or otherwise doing something bad; if the
1251 * administrator initiated the operation via zoneadm(1m), he'll get
1252 * auto-verification which will let him know what's wrong. If he
1253 * modifies the zone configuration of a running zone and doesn't attempt
1254 * to verify that it's OK we won't crash but won't bother trying to be
1255 * too helpful either. zoneadm verify is only a couple keystrokes away.
1256 */
1257 if (!zonecfg_valid_fs_type(fsptr->zone_fs_type)) {
1258 zerror(zlogp, B_FALSE, "cannot mount %s on %s: "
1259 "invalid file-system type %s", fsptr->zone_fs_special,
1260 fsptr->zone_fs_dir, fsptr->zone_fs_type);
1261 return (-1);
1262 }
1263
1264 /*
1265 * If we're looking at an alternate root environment, then construct
1266 * read-only loopback mounts as necessary. Note that any special
1267 * paths for lofs zone mounts in an alternate root must have
1268 * already been pre-pended with any alternate root path by the
1269 * time we get here.
1270 */
1271 if (zonecfg_in_alt_root()) {
1272 struct stat64 st;
1273
1274 if (stat64(fsptr->zone_fs_special, &st) != -1 &&
1275 S_ISBLK(st.st_mode)) {
1276 /*
1277 * If we're going to mount a block device we need
1278 * to check if that device is already mounted
1279 * somewhere else, and if so, do a lofs mount
1280 * of the device instead of a direct mount
1281 */
1282 if (check_lofs_needed(zlogp, fsptr) == -1)
1283 return (-1);
1284 } else if (strcmp(fsptr->zone_fs_type, MNTTYPE_LOFS) == 0) {
1285 /*
1286 * For lofs mounts, the special node is inside the
1287 * alternate root. We need lofs resolution for
1288 * this case in order to get at the underlying
1289 * read-write path.
1290 */
1291 resolve_lofs(zlogp, fsptr->zone_fs_special,
1292 sizeof (fsptr->zone_fs_special));
1293 }
1294 }
1295
1296 /*
1297 * Run 'fsck -m' if there's a device to fsck.
1298 */
1299 if (fsptr->zone_fs_raw[0] != '\0' &&
1300 dofsck(zlogp, fsptr->zone_fs_type, fsptr->zone_fs_raw) != 0) {
1301 return (-1);
1302 } else if (isregfile(fsptr->zone_fs_special) == 1 &&
1303 dofsck(zlogp, fsptr->zone_fs_type, fsptr->zone_fs_special) != 0) {
1304 return (-1);
1305 }
1306
1307 /*
1308 * Build up mount option string.
1309 */
1310 optstr[0] = '\0';
1311 if (fsptr->zone_fs_options != NULL) {
1312 (void) strlcpy(optstr, fsptr->zone_fs_options->zone_fsopt_opt,
1313 sizeof (optstr));
1314 for (optptr = fsptr->zone_fs_options->zone_fsopt_next;
1315 optptr != NULL; optptr = optptr->zone_fsopt_next) {
1316 (void) strlcat(optstr, ",", sizeof (optstr));
1317 (void) strlcat(optstr, optptr->zone_fsopt_opt,
1318 sizeof (optstr));
1319 }
1320 }
1321
1322 if ((rv = domount(zlogp, fsptr->zone_fs_type, optstr,
1323 fsptr->zone_fs_special, path)) != 0)
1324 return (rv);
1325
1326 /*
1327 * The mount succeeded. If this was not a mount of /dev then
1328 * we're done.
1329 */
1330 if (strcmp(fsptr->zone_fs_type, MNTTYPE_DEV) != 0)
1331 return (0);
1332
1333 /*
1334 * We just mounted an instance of a /dev filesystem, so now we
1335 * need to configure it.
1336 */
1337 return (mount_one_dev(zlogp, path, mount_cmd));
1338 }
1339
1340 static void
1341 free_fs_data(struct zone_fstab *fsarray, uint_t nelem)
1342 {
1343 uint_t i;
1344
1345 if (fsarray == NULL)
1346 return;
1347 for (i = 0; i < nelem; i++)
1348 zonecfg_free_fs_option_list(fsarray[i].zone_fs_options);
1349 free(fsarray);
1350 }
1351
1352 /*
1353 * This function initiates the creation of a small Solaris Environment for
1354 * scratch zone. The Environment creation process is split up into two
1355 * functions(build_mounted_pre_var() and build_mounted_post_var()). It
1356 * is done this way because:
1357 * We need to have both /etc and /var in the root of the scratchzone.
1358 * We loopback mount zone's own /etc and /var into the root of the
1359 * scratch zone. Unlike /etc, /var can be a seperate filesystem. So we
1360 * need to delay the mount of /var till the zone's root gets populated.
1361 * So mounting of localdirs[](/etc and /var) have been moved to the
1362 * build_mounted_post_var() which gets called only after the zone
1363 * specific filesystems are mounted.
1364 *
1365 * Note that the scratch zone we set up for updating the zone (Z_MNT_UPDATE)
1366 * does not loopback mount the zone's own /etc and /var into the root of the
1367 * scratch zone.
1368 */
1369 static boolean_t
1370 build_mounted_pre_var(zlog_t *zlogp, char *rootpath,
1371 size_t rootlen, const char *zonepath, char *luroot, size_t lurootlen)
1372 {
1373 char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1374 const char **cpp;
1375 static const char *mkdirs[] = {
1376 "/system", "/system/contract", "/system/object", "/proc",
1377 "/dev", "/tmp", "/a", NULL
1378 };
1379 char *altstr;
1380 FILE *fp;
1381 uuid_t uuid;
1382
1383 resolve_lofs(zlogp, rootpath, rootlen);
1384 (void) snprintf(luroot, lurootlen, "%s/lu", zonepath);
1385 resolve_lofs(zlogp, luroot, lurootlen);
1386 (void) snprintf(tmp, sizeof (tmp), "%s/bin", luroot);
1387 (void) symlink("./usr/bin", tmp);
1388
1389 /*
1390 * These are mostly special mount points; not handled here. (See
1391 * zone_mount_early.)
1392 */
1393 for (cpp = mkdirs; *cpp != NULL; cpp++) {
1394 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1395 if (mkdir(tmp, 0755) != 0) {
1396 zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1397 return (B_FALSE);
1398 }
1399 }
1400 /*
1401 * This is here to support lucopy. If there's an instance of this same
1402 * zone on the current running system, then we mount its root up as
1403 * read-only inside the scratch zone.
1404 */
1405 (void) zonecfg_get_uuid(zone_name, uuid);
1406 altstr = strdup(zonecfg_get_root());
1407 if (altstr == NULL) {
1408 zerror(zlogp, B_TRUE, "memory allocation failed");
1409 return (B_FALSE);
1410 }
1411 zonecfg_set_root("");
1412 (void) strlcpy(tmp, zone_name, sizeof (tmp));
1413 (void) zonecfg_get_name_by_uuid(uuid, tmp, sizeof (tmp));
1414 if (zone_get_rootpath(tmp, fromdir, sizeof (fromdir)) == Z_OK &&
1415 strcmp(fromdir, rootpath) != 0) {
1416 (void) snprintf(tmp, sizeof (tmp), "%s/b", luroot);
1417 if (mkdir(tmp, 0755) != 0) {
1418 zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1419 return (B_FALSE);
1420 }
1421 if (domount(zlogp, MNTTYPE_LOFS, RESOURCE_DEFAULT_OPTS, fromdir,
1422 tmp) != 0) {
1423 zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1424 fromdir);
1425 return (B_FALSE);
1426 }
1427 }
1428 zonecfg_set_root(altstr);
1429 free(altstr);
1430
1431 if ((fp = zonecfg_open_scratch(luroot, B_TRUE)) == NULL) {
1432 zerror(zlogp, B_TRUE, "cannot open zone mapfile");
1433 return (B_FALSE);
1434 }
1435 (void) ftruncate(fileno(fp), 0);
1436 if (zonecfg_add_scratch(fp, zone_name, kernzone, "/") == -1) {
1437 zerror(zlogp, B_TRUE, "cannot add zone mapfile entry");
1438 }
1439 zonecfg_close_scratch(fp);
1440 (void) snprintf(tmp, sizeof (tmp), "%s/a", luroot);
1441 if (domount(zlogp, MNTTYPE_LOFS, "", rootpath, tmp) != 0)
1442 return (B_FALSE);
1443 (void) strlcpy(rootpath, tmp, rootlen);
1444 return (B_TRUE);
1445 }
1446
1447
1448 static boolean_t
1449 build_mounted_post_var(zlog_t *zlogp, zone_mnt_t mount_cmd, char *rootpath,
1450 const char *luroot)
1451 {
1452 char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1453 const char **cpp;
1454 const char **loopdirs;
1455 const char **tmpdirs;
1456 static const char *localdirs[] = {
1457 "/etc", "/var", NULL
1458 };
1459 static const char *scr_loopdirs[] = {
1460 "/etc/lib", "/etc/fs", "/lib", "/sbin", "/platform",
1461 "/usr", NULL
1462 };
1463 static const char *upd_loopdirs[] = {
1464 "/etc", "/kernel", "/lib", "/opt", "/platform", "/sbin",
1465 "/usr", "/var", NULL
1466 };
1467 static const char *scr_tmpdirs[] = {
1468 "/tmp", "/var/run", NULL
1469 };
1470 static const char *upd_tmpdirs[] = {
1471 "/tmp", "/var/run", "/var/tmp", NULL
1472 };
1473 struct stat st;
1474
1475 if (mount_cmd == Z_MNT_SCRATCH) {
1476 /*
1477 * These are mounted read-write from the zone undergoing
1478 * upgrade. We must be careful not to 'leak' things from the
1479 * main system into the zone, and this accomplishes that goal.
1480 */
1481 for (cpp = localdirs; *cpp != NULL; cpp++) {
1482 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot,
1483 *cpp);
1484 (void) snprintf(fromdir, sizeof (fromdir), "%s%s",
1485 rootpath, *cpp);
1486 if (mkdir(tmp, 0755) != 0) {
1487 zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1488 return (B_FALSE);
1489 }
1490 if (domount(zlogp, MNTTYPE_LOFS, "", fromdir, tmp)
1491 != 0) {
1492 zerror(zlogp, B_TRUE, "cannot mount %s on %s",
1493 tmp, *cpp);
1494 return (B_FALSE);
1495 }
1496 }
1497 }
1498
1499 if (mount_cmd == Z_MNT_UPDATE)
1500 loopdirs = upd_loopdirs;
1501 else
1502 loopdirs = scr_loopdirs;
1503
1504 /*
1505 * These are things mounted read-only from the running system because
1506 * they contain binaries that must match system.
1507 */
1508 for (cpp = loopdirs; *cpp != NULL; cpp++) {
1509 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1510 if (mkdir(tmp, 0755) != 0) {
1511 if (errno != EEXIST) {
1512 zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1513 return (B_FALSE);
1514 }
1515 if (lstat(tmp, &st) != 0) {
1516 zerror(zlogp, B_TRUE, "cannot stat %s", tmp);
1517 return (B_FALSE);
1518 }
1519 /*
1520 * Ignore any non-directories encountered. These are
1521 * things that have been converted into symlinks
1522 * (/etc/fs and /etc/lib) and no longer need a lofs
1523 * fixup.
1524 */
1525 if (!S_ISDIR(st.st_mode))
1526 continue;
1527 }
1528 if (domount(zlogp, MNTTYPE_LOFS, RESOURCE_DEFAULT_OPTS, *cpp,
1529 tmp) != 0) {
1530 zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1531 *cpp);
1532 return (B_FALSE);
1533 }
1534 }
1535
1536 if (mount_cmd == Z_MNT_UPDATE)
1537 tmpdirs = upd_tmpdirs;
1538 else
1539 tmpdirs = scr_tmpdirs;
1540
1541 /*
1542 * These are things with tmpfs mounted inside.
1543 */
1544 for (cpp = tmpdirs; *cpp != NULL; cpp++) {
1545 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1546 if (mount_cmd == Z_MNT_SCRATCH && mkdir(tmp, 0755) != 0 &&
1547 errno != EEXIST) {
1548 zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1549 return (B_FALSE);
1550 }
1551
1552 /*
1553 * We could set the mode for /tmp when we do the mkdir but
1554 * since that can be modified by the umask we will just set
1555 * the correct mode for /tmp now.
1556 */
1557 if (strcmp(*cpp, "/tmp") == 0 && chmod(tmp, 01777) != 0) {
1558 zerror(zlogp, B_TRUE, "cannot chmod %s", tmp);
1559 return (B_FALSE);
1560 }
1561
1562 if (domount(zlogp, MNTTYPE_TMPFS, "", "swap", tmp) != 0) {
1563 zerror(zlogp, B_TRUE, "cannot mount swap on %s", *cpp);
1564 return (B_FALSE);
1565 }
1566 }
1567 return (B_TRUE);
1568 }
1569
1570 typedef struct plat_gmount_cb_data {
1571 zlog_t *pgcd_zlogp;
1572 struct zone_fstab **pgcd_fs_tab;
1573 int *pgcd_num_fs;
1574 } plat_gmount_cb_data_t;
1575
1576 /*
1577 * plat_gmount_cb() is a callback function invoked by libbrand to iterate
1578 * through all global brand platform mounts.
1579 */
1580 int
1581 plat_gmount_cb(void *data, const char *spec, const char *dir,
1582 const char *fstype, const char *opt)
1583 {
1584 plat_gmount_cb_data_t *cp = data;
1585 zlog_t *zlogp = cp->pgcd_zlogp;
1586 struct zone_fstab *fs_ptr = *cp->pgcd_fs_tab;
1587 int num_fs = *cp->pgcd_num_fs;
1588 struct zone_fstab *fsp, *tmp_ptr;
1589
1590 num_fs++;
1591 if ((tmp_ptr = realloc(fs_ptr, num_fs * sizeof (*tmp_ptr))) == NULL) {
1592 zerror(zlogp, B_TRUE, "memory allocation failed");
1593 return (-1);
1594 }
1595
1596 fs_ptr = tmp_ptr;
1597 fsp = &fs_ptr[num_fs - 1];
1598
1599 /* update the callback struct passed in */
1600 *cp->pgcd_fs_tab = fs_ptr;
1601 *cp->pgcd_num_fs = num_fs;
1602
1603 fsp->zone_fs_raw[0] = '\0';
1604 (void) strlcpy(fsp->zone_fs_special, spec,
1605 sizeof (fsp->zone_fs_special));
1606 (void) strlcpy(fsp->zone_fs_dir, dir, sizeof (fsp->zone_fs_dir));
1607 (void) strlcpy(fsp->zone_fs_type, fstype, sizeof (fsp->zone_fs_type));
1608 fsp->zone_fs_options = NULL;
1609 if ((opt != NULL) &&
1610 (zonecfg_add_fs_option(fsp, (char *)opt) != Z_OK)) {
1611 zerror(zlogp, B_FALSE, "error adding property");
1612 return (-1);
1613 }
1614
1615 return (0);
1616 }
1617
1618 static int
1619 mount_filesystems_fsent(zone_dochandle_t handle, zlog_t *zlogp,
1620 struct zone_fstab **fs_tabp, int *num_fsp, zone_mnt_t mount_cmd)
1621 {
1622 struct zone_fstab *tmp_ptr, *fs_ptr, *fsp, fstab;
1623 int num_fs;
1624
1625 num_fs = *num_fsp;
1626 fs_ptr = *fs_tabp;
1627
1628 if (zonecfg_setfsent(handle) != Z_OK) {
1629 zerror(zlogp, B_FALSE, "invalid configuration");
1630 return (-1);
1631 }
1632 while (zonecfg_getfsent(handle, &fstab) == Z_OK) {
1633 /*
1634 * ZFS filesystems will not be accessible under an alternate
1635 * root, since the pool will not be known. Ignore them in this
1636 * case.
1637 */
1638 if (ALT_MOUNT(mount_cmd) &&
1639 strcmp(fstab.zone_fs_type, MNTTYPE_ZFS) == 0)
1640 continue;
1641
1642 num_fs++;
1643 if ((tmp_ptr = realloc(fs_ptr,
1644 num_fs * sizeof (*tmp_ptr))) == NULL) {
1645 zerror(zlogp, B_TRUE, "memory allocation failed");
1646 (void) zonecfg_endfsent(handle);
1647 return (-1);
1648 }
1649 /* update the pointers passed in */
1650 *fs_tabp = tmp_ptr;
1651 *num_fsp = num_fs;
1652
1653 fs_ptr = tmp_ptr;
1654 fsp = &fs_ptr[num_fs - 1];
1655 (void) strlcpy(fsp->zone_fs_dir,
1656 fstab.zone_fs_dir, sizeof (fsp->zone_fs_dir));
1657 (void) strlcpy(fsp->zone_fs_raw, fstab.zone_fs_raw,
1658 sizeof (fsp->zone_fs_raw));
1659 (void) strlcpy(fsp->zone_fs_type, fstab.zone_fs_type,
1660 sizeof (fsp->zone_fs_type));
1661 fsp->zone_fs_options = fstab.zone_fs_options;
1662
1663 /*
1664 * For all lofs mounts, make sure that the 'special'
1665 * entry points inside the alternate root. The
1666 * source path for a lofs mount in a given zone needs
1667 * to be relative to the root of the boot environment
1668 * that contains the zone. Note that we don't do this
1669 * for non-lofs mounts since they will have a device
1670 * as a backing store and device paths must always be
1671 * specified relative to the current boot environment.
1672 */
1673 fsp->zone_fs_special[0] = '\0';
1674 if (strcmp(fsp->zone_fs_type, MNTTYPE_LOFS) == 0) {
1675 (void) strlcat(fsp->zone_fs_special, zonecfg_get_root(),
1676 sizeof (fsp->zone_fs_special));
1677 }
1678 (void) strlcat(fsp->zone_fs_special, fstab.zone_fs_special,
1679 sizeof (fsp->zone_fs_special));
1680 }
1681 (void) zonecfg_endfsent(handle);
1682 return (0);
1683 }
1684
1685 static int
1686 mount_filesystems(zlog_t *zlogp, zone_mnt_t mount_cmd)
1687 {
1688 char rootpath[MAXPATHLEN];
1689 char zonepath[MAXPATHLEN];
1690 char brand[MAXNAMELEN];
1691 char luroot[MAXPATHLEN];
1692 int i, num_fs = 0;
1693 struct zone_fstab *fs_ptr = NULL;
1694 zone_state_t zstate;
1695 brand_handle_t bh;
1696 plat_gmount_cb_data_t cb;
1697
1698 if (zone_get_state(zone_name, &zstate) != Z_OK ||
1699 (zstate != ZONE_STATE_READY && zstate != ZONE_STATE_MOUNTED)) {
1700 zerror(zlogp, B_FALSE,
1701 "zone must be in '%s' or '%s' state to mount file-systems",
1702 zone_state_str(ZONE_STATE_READY),
1703 zone_state_str(ZONE_STATE_MOUNTED));
1704 goto bad;
1705 }
1706
1707 if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
1708 zerror(zlogp, B_TRUE, "unable to determine zone path");
1709 goto bad;
1710 }
1711
1712 if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
1713 zerror(zlogp, B_TRUE, "unable to determine zone root");
1714 goto bad;
1715 }
1716
1717 if (zonecfg_setfsent(snap_hndl) != Z_OK) {
1718 zerror(zlogp, B_FALSE, "invalid configuration");
1719 goto bad;
1720 }
1721
1722 /*
1723 * If we are mounting the zone, then we must always use the default
1724 * brand global mounts.
1725 */
1726 if (ALT_MOUNT(mount_cmd)) {
1727 (void) strlcpy(brand, default_brand, sizeof (brand));
1728 } else {
1729 (void) strlcpy(brand, brand_name, sizeof (brand));
1730 }
1731
1732 /* Get a handle to the brand info for this zone */
1733 if ((bh = brand_open(brand)) == NULL) {
1734 zerror(zlogp, B_FALSE, "unable to determine zone brand");
1735 return (-1);
1736 }
1737
1738 /*
1739 * Get the list of global filesystems to mount from the brand
1740 * configuration.
1741 */
1742 cb.pgcd_zlogp = zlogp;
1743 cb.pgcd_fs_tab = &fs_ptr;
1744 cb.pgcd_num_fs = &num_fs;
1745 if (brand_platform_iter_gmounts(bh, zonepath,
1746 plat_gmount_cb, &cb) != 0) {
1747 zerror(zlogp, B_FALSE, "unable to mount filesystems");
1748 brand_close(bh);
1749 return (-1);
1750 }
1751 brand_close(bh);
1752
1753 /*
1754 * Iterate through the rest of the filesystems. Sort them all,
1755 * then mount them in sorted order. This is to make sure the
1756 * higher level directories (e.g., /usr) get mounted before
1757 * any beneath them (e.g., /usr/local).
1758 */
1759 if (mount_filesystems_fsent(snap_hndl, zlogp, &fs_ptr, &num_fs,
1760 mount_cmd) != 0)
1761 goto bad;
1762
1763 /*
1764 * Normally when we mount a zone all the zone filesystems
1765 * get mounted relative to rootpath, which is usually
1766 * <zonepath>/root. But when mounting a zone for administration
1767 * purposes via the zone "mount" state, build_mounted_pre_var()
1768 * updates rootpath to be <zonepath>/lu/a so we'll mount all
1769 * the zones filesystems there instead.
1770 *
1771 * build_mounted_pre_var() and build_mounted_post_var() will
1772 * also do some extra work to create directories and lofs mount
1773 * a bunch of global zone file system paths into <zonepath>/lu.
1774 *
1775 * This allows us to be able to enter the zone (now rooted at
1776 * <zonepath>/lu) and run the upgrade/patch tools that are in the
1777 * global zone and have them upgrade the to-be-modified zone's
1778 * files mounted on /a. (Which mirrors the existing standard
1779 * upgrade environment.)
1780 *
1781 * There is of course one catch. When doing the upgrade
1782 * we need <zoneroot>/lu/dev to be the /dev filesystem
1783 * for the zone and we don't want to have any /dev filesystem
1784 * mounted at <zoneroot>/lu/a/dev. Since /dev is specified
1785 * as a normal zone filesystem by default we'll try to mount
1786 * it at <zoneroot>/lu/a/dev, so we have to detect this
1787 * case and instead mount it at <zoneroot>/lu/dev.
1788 *
1789 * All this work is done in three phases:
1790 * 1) Create and populate lu directory (build_mounted_pre_var()).
1791 * 2) Mount the required filesystems as per the zone configuration.
1792 * 3) Set up the rest of the scratch zone environment
1793 * (build_mounted_post_var()).
1794 */
1795 if (ALT_MOUNT(mount_cmd) && !build_mounted_pre_var(zlogp,
1796 rootpath, sizeof (rootpath), zonepath, luroot, sizeof (luroot)))
1797 goto bad;
1798
1799 qsort(fs_ptr, num_fs, sizeof (*fs_ptr), fs_compare);
1800
1801 for (i = 0; i < num_fs; i++) {
1802 if (ALT_MOUNT(mount_cmd) &&
1803 strcmp(fs_ptr[i].zone_fs_dir, "/dev") == 0) {
1804 size_t slen = strlen(rootpath) - 2;
1805
1806 /*
1807 * By default we'll try to mount /dev as /a/dev
1808 * but /dev is special and always goes at the top
1809 * so strip the trailing '/a' from the rootpath.
1810 */
1811 assert(strcmp(&rootpath[slen], "/a") == 0);
1812 rootpath[slen] = '\0';
1813 if (mount_one(zlogp, &fs_ptr[i], rootpath, mount_cmd)
1814 != 0)
1815 goto bad;
1816 rootpath[slen] = '/';
1817 continue;
1818 }
1819 if (mount_one(zlogp, &fs_ptr[i], rootpath, mount_cmd) != 0)
1820 goto bad;
1821 }
1822 if (ALT_MOUNT(mount_cmd) &&
1823 !build_mounted_post_var(zlogp, mount_cmd, rootpath, luroot))
1824 goto bad;
1825
1826 /*
1827 * For Trusted Extensions cross-mount each lower level /export/home
1828 */
1829 if (mount_cmd == Z_MNT_BOOT &&
1830 tsol_mounts(zlogp, zone_name, rootpath) != 0)
1831 goto bad;
1832
1833 free_fs_data(fs_ptr, num_fs);
1834
1835 /*
1836 * Everything looks fine.
1837 */
1838 return (0);
1839
1840 bad:
1841 free_fs_data(fs_ptr, num_fs);
1842 return (-1);
1843 }
1844
1845 /* caller makes sure neither parameter is NULL */
1846 static int
1847 addr2netmask(char *prefixstr, int maxprefixlen, uchar_t *maskstr)
1848 {
1849 int prefixlen;
1850
1851 prefixlen = atoi(prefixstr);
1852 if (prefixlen < 0 || prefixlen > maxprefixlen)
1853 return (1);
1854 while (prefixlen > 0) {
1855 if (prefixlen >= 8) {
1856 *maskstr++ = 0xFF;
1857 prefixlen -= 8;
1858 continue;
1859 }
1860 *maskstr |= 1 << (8 - prefixlen);
1861 prefixlen--;
1862 }
1863 return (0);
1864 }
1865
1866 /*
1867 * Tear down all interfaces belonging to the given zone. This should
1868 * be called with the zone in a state other than "running", so that
1869 * interfaces can't be assigned to the zone after this returns.
1870 *
1871 * If anything goes wrong, log an error message and return an error.
1872 */
1873 static int
1874 unconfigure_shared_network_interfaces(zlog_t *zlogp, zoneid_t zone_id)
1875 {
1876 struct lifnum lifn;
1877 struct lifconf lifc;
1878 struct lifreq *lifrp, lifrl;
1879 int64_t lifc_flags = LIFC_NOXMIT | LIFC_ALLZONES;
1880 int num_ifs, s, i, ret_code = 0;
1881 uint_t bufsize;
1882 char *buf = NULL;
1883
1884 if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
1885 zerror(zlogp, B_TRUE, "could not get socket");
1886 ret_code = -1;
1887 goto bad;
1888 }
1889 lifn.lifn_family = AF_UNSPEC;
1890 lifn.lifn_flags = (int)lifc_flags;
1891 if (ioctl(s, SIOCGLIFNUM, (char *)&lifn) < 0) {
1892 zerror(zlogp, B_TRUE,
1893 "could not determine number of network interfaces");
1894 ret_code = -1;
1895 goto bad;
1896 }
1897 num_ifs = lifn.lifn_count;
1898 bufsize = num_ifs * sizeof (struct lifreq);
1899 if ((buf = malloc(bufsize)) == NULL) {
1900 zerror(zlogp, B_TRUE, "memory allocation failed");
1901 ret_code = -1;
1902 goto bad;
1903 }
1904 lifc.lifc_family = AF_UNSPEC;
1905 lifc.lifc_flags = (int)lifc_flags;
1906 lifc.lifc_len = bufsize;
1907 lifc.lifc_buf = buf;
1908 if (ioctl(s, SIOCGLIFCONF, (char *)&lifc) < 0) {
1909 zerror(zlogp, B_TRUE, "could not get configured network "
1910 "interfaces");
1911 ret_code = -1;
1912 goto bad;
1913 }
1914 lifrp = lifc.lifc_req;
1915 for (i = lifc.lifc_len / sizeof (struct lifreq); i > 0; i--, lifrp++) {
1916 (void) close(s);
1917 if ((s = socket(lifrp->lifr_addr.ss_family, SOCK_DGRAM, 0)) <
1918 0) {
1919 zerror(zlogp, B_TRUE, "%s: could not get socket",
1920 lifrl.lifr_name);
1921 ret_code = -1;
1922 continue;
1923 }
1924 (void) memset(&lifrl, 0, sizeof (lifrl));
1925 (void) strncpy(lifrl.lifr_name, lifrp->lifr_name,
1926 sizeof (lifrl.lifr_name));
1927 if (ioctl(s, SIOCGLIFZONE, (caddr_t)&lifrl) < 0) {
1928 if (errno == ENXIO)
1929 /*
1930 * Interface may have been removed by admin or
1931 * another zone halting.
1932 */
1933 continue;
1934 zerror(zlogp, B_TRUE,
1935 "%s: could not determine the zone to which this "
1936 "network interface is bound", lifrl.lifr_name);
1937 ret_code = -1;
1938 continue;
1939 }
1940 if (lifrl.lifr_zoneid == zone_id) {
1941 if (ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifrl) < 0) {
1942 zerror(zlogp, B_TRUE,
1943 "%s: could not remove network interface",
1944 lifrl.lifr_name);
1945 ret_code = -1;
1946 continue;
1947 }
1948 }
1949 }
1950 bad:
1951 if (s > 0)
1952 (void) close(s);
1953 if (buf)
1954 free(buf);
1955 return (ret_code);
1956 }
1957
1958 static union sockunion {
1959 struct sockaddr sa;
1960 struct sockaddr_in sin;
1961 struct sockaddr_dl sdl;
1962 struct sockaddr_in6 sin6;
1963 } so_dst, so_ifp;
1964
1965 static struct {
1966 struct rt_msghdr hdr;
1967 char space[512];
1968 } rtmsg;
1969
1970 static int
1971 salen(struct sockaddr *sa)
1972 {
1973 switch (sa->sa_family) {
1974 case AF_INET:
1975 return (sizeof (struct sockaddr_in));
1976 case AF_LINK:
1977 return (sizeof (struct sockaddr_dl));
1978 case AF_INET6:
1979 return (sizeof (struct sockaddr_in6));
1980 default:
1981 return (sizeof (struct sockaddr));
1982 }
1983 }
1984
1985 #define ROUNDUP_LONG(a) \
1986 ((a) > 0 ? (1 + (((a) - 1) | (sizeof (long) - 1))) : sizeof (long))
1987
1988 /*
1989 * Look up which zone is using a given IP address. The address in question
1990 * is expected to have been stuffed into the structure to which lifr points
1991 * via a previous SIOCGLIFADDR ioctl().
1992 *
1993 * This is done using black router socket magic.
1994 *
1995 * Return the name of the zone on success or NULL on failure.
1996 *
1997 * This is a lot of code for a simple task; a new ioctl request to take care
1998 * of this might be a useful RFE.
1999 */
2000
2001 static char *
2002 who_is_using(zlog_t *zlogp, struct lifreq *lifr)
2003 {
2004 static char answer[ZONENAME_MAX];
2005 pid_t pid;
2006 int s, rlen, l, i;
2007 char *cp = rtmsg.space;
2008 struct sockaddr_dl *ifp = NULL;
2009 struct sockaddr *sa;
2010 char save_if_name[LIFNAMSIZ];
2011
2012 answer[0] = '\0';
2013
2014 pid = getpid();
2015 if ((s = socket(PF_ROUTE, SOCK_RAW, 0)) < 0) {
2016 zerror(zlogp, B_TRUE, "could not get routing socket");
2017 return (NULL);
2018 }
2019
2020 if (lifr->lifr_addr.ss_family == AF_INET) {
2021 struct sockaddr_in *sin4;
2022
2023 so_dst.sa.sa_family = AF_INET;
2024 sin4 = (struct sockaddr_in *)&lifr->lifr_addr;
2025 so_dst.sin.sin_addr = sin4->sin_addr;
2026 } else {
2027 struct sockaddr_in6 *sin6;
2028
2029 so_dst.sa.sa_family = AF_INET6;
2030 sin6 = (struct sockaddr_in6 *)&lifr->lifr_addr;
2031 so_dst.sin6.sin6_addr = sin6->sin6_addr;
2032 }
2033
2034 so_ifp.sa.sa_family = AF_LINK;
2035
2036 (void) memset(&rtmsg, 0, sizeof (rtmsg));
2037 rtmsg.hdr.rtm_type = RTM_GET;
2038 rtmsg.hdr.rtm_flags = RTF_UP | RTF_HOST;
2039 rtmsg.hdr.rtm_version = RTM_VERSION;
2040 rtmsg.hdr.rtm_seq = ++rts_seqno;
2041 rtmsg.hdr.rtm_addrs = RTA_IFP | RTA_DST;
2042
2043 l = ROUNDUP_LONG(salen(&so_dst.sa));
2044 (void) memmove(cp, &(so_dst), l);
2045 cp += l;
2046 l = ROUNDUP_LONG(salen(&so_ifp.sa));
2047 (void) memmove(cp, &(so_ifp), l);
2048 cp += l;
2049
2050 rtmsg.hdr.rtm_msglen = l = cp - (char *)&rtmsg;
2051
2052 if ((rlen = write(s, &rtmsg, l)) < 0) {
2053 zerror(zlogp, B_TRUE, "writing to routing socket");
2054 return (NULL);
2055 } else if (rlen < (int)rtmsg.hdr.rtm_msglen) {
2056 zerror(zlogp, B_TRUE,
2057 "write to routing socket got only %d for len\n", rlen);
2058 return (NULL);
2059 }
2060 do {
2061 l = read(s, &rtmsg, sizeof (rtmsg));
2062 } while (l > 0 && (rtmsg.hdr.rtm_seq != rts_seqno ||
2063 rtmsg.hdr.rtm_pid != pid));
2064 if (l < 0) {
2065 zerror(zlogp, B_TRUE, "reading from routing socket");
2066 return (NULL);
2067 }
2068
2069 if (rtmsg.hdr.rtm_version != RTM_VERSION) {
2070 zerror(zlogp, B_FALSE,
2071 "routing message version %d not understood",
2072 rtmsg.hdr.rtm_version);
2073 return (NULL);
2074 }
2075 if (rtmsg.hdr.rtm_msglen != (ushort_t)l) {
2076 zerror(zlogp, B_FALSE, "message length mismatch, "
2077 "expected %d bytes, returned %d bytes",
2078 rtmsg.hdr.rtm_msglen, l);
2079 return (NULL);
2080 }
2081 if (rtmsg.hdr.rtm_errno != 0) {
2082 errno = rtmsg.hdr.rtm_errno;
2083 zerror(zlogp, B_TRUE, "RTM_GET routing socket message");
2084 return (NULL);
2085 }
2086 if ((rtmsg.hdr.rtm_addrs & RTA_IFP) == 0) {
2087 zerror(zlogp, B_FALSE, "network interface not found");
2088 return (NULL);
2089 }
2090 cp = ((char *)(&rtmsg.hdr + 1));
2091 for (i = 1; i != 0; i <<= 1) {
2092 /* LINTED E_BAD_PTR_CAST_ALIGN */
2093 sa = (struct sockaddr *)cp;
2094 if (i != RTA_IFP) {
2095 if ((i & rtmsg.hdr.rtm_addrs) != 0)
2096 cp += ROUNDUP_LONG(salen(sa));
2097 continue;
2098 }
2099 if (sa->sa_family == AF_LINK &&
2100 ((struct sockaddr_dl *)sa)->sdl_nlen != 0)
2101 ifp = (struct sockaddr_dl *)sa;
2102 break;
2103 }
2104 if (ifp == NULL) {
2105 zerror(zlogp, B_FALSE, "network interface could not be "
2106 "determined");
2107 return (NULL);
2108 }
2109
2110 /*
2111 * We need to set the I/F name to what we got above, then do the
2112 * appropriate ioctl to get its zone name. But lifr->lifr_name is
2113 * used by the calling function to do a REMOVEIF, so if we leave the
2114 * "good" zone's I/F name in place, *that* I/F will be removed instead
2115 * of the bad one. So we save the old (bad) I/F name before over-
2116 * writing it and doing the ioctl, then restore it after the ioctl.
2117 */
2118 (void) strlcpy(save_if_name, lifr->lifr_name, sizeof (save_if_name));
2119 (void) strncpy(lifr->lifr_name, ifp->sdl_data, ifp->sdl_nlen);
2120 lifr->lifr_name[ifp->sdl_nlen] = '\0';
2121 i = ioctl(s, SIOCGLIFZONE, lifr);
2122 (void) strlcpy(lifr->lifr_name, save_if_name, sizeof (save_if_name));
2123 if (i < 0) {
2124 zerror(zlogp, B_TRUE,
2125 "%s: could not determine the zone network interface "
2126 "belongs to", lifr->lifr_name);
2127 return (NULL);
2128 }
2129 if (getzonenamebyid(lifr->lifr_zoneid, answer, sizeof (answer)) < 0)
2130 (void) snprintf(answer, sizeof (answer), "%d",
2131 lifr->lifr_zoneid);
2132
2133 if (strlen(answer) > 0)
2134 return (answer);
2135 return (NULL);
2136 }
2137
2138 /*
2139 * Configures a single interface: a new virtual interface is added, based on
2140 * the physical interface nwiftabptr->zone_nwif_physical, with the address
2141 * specified in nwiftabptr->zone_nwif_address, for zone zone_id. Note that
2142 * the "address" can be an IPv6 address (with a /prefixlength required), an
2143 * IPv4 address (with a /prefixlength optional), or a name; for the latter,
2144 * an IPv4 name-to-address resolution will be attempted.
2145 *
2146 * If anything goes wrong, we log an detailed error message, attempt to tear
2147 * down whatever we set up and return an error.
2148 */
2149 static int
2150 configure_one_interface(zlog_t *zlogp, zoneid_t zone_id,
2151 struct zone_nwiftab *nwiftabptr)
2152 {
2153 struct lifreq lifr;
2154 struct sockaddr_in netmask4;
2155 struct sockaddr_in6 netmask6;
2156 struct sockaddr_storage laddr;
2157 struct in_addr in4;
2158 sa_family_t af;
2159 char *slashp = strchr(nwiftabptr->zone_nwif_address, '/');
2160 int s;
2161 boolean_t got_netmask = B_FALSE;
2162 boolean_t is_loopback = B_FALSE;
2163 char addrstr4[INET_ADDRSTRLEN];
2164 int res;
2165
2166 res = zonecfg_valid_net_address(nwiftabptr->zone_nwif_address, &lifr);
2167 if (res != Z_OK) {
2168 zerror(zlogp, B_FALSE, "%s: %s", zonecfg_strerror(res),
2169 nwiftabptr->zone_nwif_address);
2170 return (-1);
2171 }
2172 af = lifr.lifr_addr.ss_family;
2173 if (af == AF_INET)
2174 in4 = ((struct sockaddr_in *)(&lifr.lifr_addr))->sin_addr;
2175 if ((s = socket(af, SOCK_DGRAM, 0)) < 0) {
2176 zerror(zlogp, B_TRUE, "could not get socket");
2177 return (-1);
2178 }
2179
2180 /*
2181 * This is a similar kind of "hack" like in addif() to get around
2182 * the problem of SIOCLIFADDIF. The problem is that this ioctl
2183 * does not include the netmask when adding a logical interface.
2184 * To get around this problem, we first add the logical interface
2185 * with a 0 address. After that, we set the netmask if provided.
2186 * Finally we set the interface address.
2187 */
2188 laddr = lifr.lifr_addr;
2189 (void) strlcpy(lifr.lifr_name, nwiftabptr->zone_nwif_physical,
2190 sizeof (lifr.lifr_name));
2191 (void) memset(&lifr.lifr_addr, 0, sizeof (lifr.lifr_addr));
2192
2193 if (ioctl(s, SIOCLIFADDIF, (caddr_t)&lifr) < 0) {
2194 /*
2195 * Here, we know that the interface can't be brought up.
2196 */
2197 (void) close(s);
2198 return (Z_OK);
2199 }
2200
2201 /* Preserve literal IPv4 address for later potential printing. */
2202 if (af == AF_INET)
2203 (void) inet_ntop(AF_INET, &in4, addrstr4, INET_ADDRSTRLEN);
2204
2205 lifr.lifr_zoneid = zone_id;
2206 if (ioctl(s, SIOCSLIFZONE, (caddr_t)&lifr) < 0) {
2207 zerror(zlogp, B_TRUE, "%s: could not place network interface "
2208 "into zone", lifr.lifr_name);
2209 goto bad;
2210 }
2211
2212 /*
2213 * Loopback interface will use the default netmask assigned, if no
2214 * netmask is found.
2215 */
2216 if (strcmp(nwiftabptr->zone_nwif_physical, "lo0") == 0) {
2217 is_loopback = B_TRUE;
2218 }
2219 if (af == AF_INET) {
2220 /*
2221 * The IPv4 netmask can be determined either
2222 * directly if a prefix length was supplied with
2223 * the address or via the netmasks database. Not
2224 * being able to determine it is a common failure,
2225 * but it often is not fatal to operation of the
2226 * interface. In that case, a warning will be
2227 * printed after the rest of the interface's
2228 * parameters have been configured.
2229 */
2230 (void) memset(&netmask4, 0, sizeof (netmask4));
2231 if (slashp != NULL) {
2232 if (addr2netmask(slashp + 1, V4_ADDR_LEN,
2233 (uchar_t *)&netmask4.sin_addr) != 0) {
2234 *slashp = '/';
2235 zerror(zlogp, B_FALSE,
2236 "%s: invalid prefix length in %s",
2237 lifr.lifr_name,
2238 nwiftabptr->zone_nwif_address);
2239 goto bad;
2240 }
2241 got_netmask = B_TRUE;
2242 } else if (getnetmaskbyaddr(in4,
2243 &netmask4.sin_addr) == 0) {
2244 got_netmask = B_TRUE;
2245 }
2246 if (got_netmask) {
2247 netmask4.sin_family = af;
2248 (void) memcpy(&lifr.lifr_addr, &netmask4,
2249 sizeof (netmask4));
2250 }
2251 } else {
2252 (void) memset(&netmask6, 0, sizeof (netmask6));
2253 if (addr2netmask(slashp + 1, V6_ADDR_LEN,
2254 (uchar_t *)&netmask6.sin6_addr) != 0) {
2255 *slashp = '/';
2256 zerror(zlogp, B_FALSE,
2257 "%s: invalid prefix length in %s",
2258 lifr.lifr_name,
2259 nwiftabptr->zone_nwif_address);
2260 goto bad;
2261 }
2262 got_netmask = B_TRUE;
2263 netmask6.sin6_family = af;
2264 (void) memcpy(&lifr.lifr_addr, &netmask6,
2265 sizeof (netmask6));
2266 }
2267 if (got_netmask &&
2268 ioctl(s, SIOCSLIFNETMASK, (caddr_t)&lifr) < 0) {
2269 zerror(zlogp, B_TRUE, "%s: could not set netmask",
2270 lifr.lifr_name);
2271 goto bad;
2272 }
2273
2274 /* Set the interface address */
2275 lifr.lifr_addr = laddr;
2276 if (ioctl(s, SIOCSLIFADDR, (caddr_t)&lifr) < 0) {
2277 zerror(zlogp, B_TRUE,
2278 "%s: could not set IP address to %s",
2279 lifr.lifr_name, nwiftabptr->zone_nwif_address);
2280 goto bad;
2281 }
2282
2283 if (ioctl(s, SIOCGLIFFLAGS, (caddr_t)&lifr) < 0) {
2284 zerror(zlogp, B_TRUE, "%s: could not get flags",
2285 lifr.lifr_name);
2286 goto bad;
2287 }
2288 lifr.lifr_flags |= IFF_UP;
2289 if (ioctl(s, SIOCSLIFFLAGS, (caddr_t)&lifr) < 0) {
2290 int save_errno = errno;
2291 char *zone_using;
2292
2293 /*
2294 * If we failed with something other than EADDRNOTAVAIL,
2295 * then skip to the end. Otherwise, look up our address,
2296 * then call a function to determine which zone is already
2297 * using that address.
2298 */
2299 if (errno != EADDRNOTAVAIL) {
2300 zerror(zlogp, B_TRUE,
2301 "%s: could not bring network interface up",
2302 lifr.lifr_name);
2303 goto bad;
2304 }
2305 if (ioctl(s, SIOCGLIFADDR, (caddr_t)&lifr) < 0) {
2306 zerror(zlogp, B_TRUE, "%s: could not get address",
2307 lifr.lifr_name);
2308 goto bad;
2309 }
2310 zone_using = who_is_using(zlogp, &lifr);
2311 errno = save_errno;
2312 if (zone_using == NULL)
2313 zerror(zlogp, B_TRUE,
2314 "%s: could not bring network interface up",
2315 lifr.lifr_name);
2316 else
2317 zerror(zlogp, B_TRUE, "%s: could not bring network "
2318 "interface up: address in use by zone '%s'",
2319 lifr.lifr_name, zone_using);
2320 goto bad;
2321 }
2322
2323 if (!got_netmask && !is_loopback) {
2324 /*
2325 * A common, but often non-fatal problem, is that the system
2326 * cannot find the netmask for an interface address. This is
2327 * often caused by it being only in /etc/inet/netmasks, but
2328 * /etc/nsswitch.conf says to use NIS or NIS+ and it's not
2329 * in that. This doesn't show up at boot because the netmask
2330 * is obtained from /etc/inet/netmasks when no network
2331 * interfaces are up, but isn't consulted when NIS/NIS+ is
2332 * available. We warn the user here that something like this
2333 * has happened and we're just running with a default and
2334 * possible incorrect netmask.
2335 */
2336 char buffer[INET6_ADDRSTRLEN];
2337 void *addr;
2338 const char *nomatch = "no matching subnet found in netmasks(4)";
2339
2340 if (af == AF_INET)
2341 addr = &((struct sockaddr_in *)
2342 (&lifr.lifr_addr))->sin_addr;
2343 else
2344 addr = &((struct sockaddr_in6 *)
2345 (&lifr.lifr_addr))->sin6_addr;
2346
2347 /*
2348 * Find out what netmask the interface is going to be using.
2349 * If we just brought up an IPMP data address on an underlying
2350 * interface above, the address will have already migrated, so
2351 * the SIOCGLIFNETMASK won't be able to find it (but we need
2352 * to bring the address up to get the actual netmask). Just
2353 * omit printing the actual netmask in this corner-case.
2354 */
2355 if (ioctl(s, SIOCGLIFNETMASK, (caddr_t)&lifr) < 0 ||
2356 inet_ntop(af, addr, buffer, sizeof (buffer)) == NULL) {
2357 zerror(zlogp, B_FALSE, "WARNING: %s; using default.",
2358 nomatch);
2359 } else {
2360 zerror(zlogp, B_FALSE,
2361 "WARNING: %s: %s: %s; using default of %s.",
2362 lifr.lifr_name, nomatch, addrstr4, buffer);
2363 }
2364 }
2365
2366 /*
2367 * If a default router was specified for this interface
2368 * set the route now. Ignore if already set.
2369 */
2370 if (strlen(nwiftabptr->zone_nwif_defrouter) > 0) {
2371 int status;
2372 char *argv[7];
2373
2374 argv[0] = "route";
2375 argv[1] = "add";
2376 argv[2] = "-ifp";
2377 argv[3] = nwiftabptr->zone_nwif_physical;
2378 argv[4] = "default";
2379 argv[5] = nwiftabptr->zone_nwif_defrouter;
2380 argv[6] = NULL;
2381
2382 status = forkexec(zlogp, "/usr/sbin/route", argv);
2383 if (status != 0 && status != EEXIST)
2384 zerror(zlogp, B_FALSE, "Unable to set route for "
2385 "interface %s to %s\n",
2386 nwiftabptr->zone_nwif_physical,
2387 nwiftabptr->zone_nwif_defrouter);
2388 }
2389
2390 (void) close(s);
2391 return (Z_OK);
2392 bad:
2393 (void) ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifr);
2394 (void) close(s);
2395 return (-1);
2396 }
2397
2398 /*
2399 * Sets up network interfaces based on information from the zone configuration.
2400 * IPv4 and IPv6 loopback interfaces are set up "for free", modeling the global
2401 * system.
2402 *
2403 * If anything goes wrong, we log a general error message, attempt to tear down
2404 * whatever we set up, and return an error.
2405 */
2406 static int
2407 configure_shared_network_interfaces(zlog_t *zlogp)
2408 {
2409 struct zone_nwiftab nwiftab, loopback_iftab;
2410 zoneid_t zoneid;
2411
2412 if ((zoneid = getzoneidbyname(zone_name)) == ZONE_ID_UNDEFINED) {
2413 zerror(zlogp, B_TRUE, "unable to get zoneid");
2414 return (-1);
2415 }
2416
2417 if (zonecfg_setnwifent(snap_hndl) == Z_OK) {
2418 for (;;) {
2419 if (zonecfg_getnwifent(snap_hndl, &nwiftab) != Z_OK)
2420 break;
2421 nwifent_free_attrs(&nwiftab);
2422 if (configure_one_interface(zlogp, zoneid, &nwiftab) !=
2423 Z_OK) {
2424 (void) zonecfg_endnwifent(snap_hndl);
2425 return (-1);
2426 }
2427 }
2428 (void) zonecfg_endnwifent(snap_hndl);
2429 }
2430 if (is_system_labeled()) {
2431 /*
2432 * Labeled zones share the loopback interface
2433 * so it is not plumbed for shared stack instances.
2434 */
2435 return (0);
2436 }
2437 (void) strlcpy(loopback_iftab.zone_nwif_physical, "lo0",
2438 sizeof (loopback_iftab.zone_nwif_physical));
2439 (void) strlcpy(loopback_iftab.zone_nwif_address, "127.0.0.1",
2440 sizeof (loopback_iftab.zone_nwif_address));
2441 loopback_iftab.zone_nwif_defrouter[0] = '\0';
2442 if (configure_one_interface(zlogp, zoneid, &loopback_iftab) != Z_OK)
2443 return (-1);
2444
2445 /* Always plumb up the IPv6 loopback interface. */
2446 (void) strlcpy(loopback_iftab.zone_nwif_address, "::1/128",
2447 sizeof (loopback_iftab.zone_nwif_address));
2448 if (configure_one_interface(zlogp, zoneid, &loopback_iftab) != Z_OK)
2449 return (-1);
2450 return (0);
2451 }
2452
2453 static void
2454 zdlerror(zlog_t *zlogp, dladm_status_t err, const char *dlname, const char *str)
2455 {
2456 char errmsg[DLADM_STRSIZE];
2457
2458 (void) dladm_status2str(err, errmsg);
2459 zerror(zlogp, B_FALSE, "%s '%s': %s", str, dlname, errmsg);
2460 }
2461
2462 static int
2463 add_datalink(zlog_t *zlogp, char *zone_name, datalink_id_t linkid, char *dlname)
2464 {
2465 dladm_status_t err;
2466 boolean_t cpuset, poolset;
2467 char *poolp;
2468
2469 /* First check if it's in use by global zone. */
2470 if (zonecfg_ifname_exists(AF_INET, dlname) ||
2471 zonecfg_ifname_exists(AF_INET6, dlname)) {
2472 zerror(zlogp, B_FALSE, "WARNING: skipping network interface "
2473 "'%s' which is used in the global zone", dlname);
2474 return (-1);
2475 }
2476
2477 /* Set zoneid of this link. */
2478 err = dladm_set_linkprop(dld_handle, linkid, "zone", &zone_name, 1,
2479 DLADM_OPT_ACTIVE);
2480 if (err != DLADM_STATUS_OK) {
2481 zdlerror(zlogp, err, dlname,
2482 "WARNING: unable to add network interface");
2483 return (-1);
2484 }
2485
2486 /*
2487 * Set the pool of this link if the zone has a pool and
2488 * neither the cpus nor the pool datalink property is
2489 * already set.
2490 */
2491 err = dladm_linkprop_is_set(dld_handle, linkid, DLADM_PROP_VAL_CURRENT,
2492 "cpus", &cpuset);
2493 if (err != DLADM_STATUS_OK) {
2494 zdlerror(zlogp, err, dlname,
2495 "WARNING: unable to check if cpus link property is set");
2496 }
2497 err = dladm_linkprop_is_set(dld_handle, linkid, DLADM_PROP_VAL_CURRENT,
2498 "pool", &poolset);
2499 if (err != DLADM_STATUS_OK) {
2500 zdlerror(zlogp, err, dlname,
2501 "WARNING: unable to check if pool link property is set");
2502 }
2503
2504 if ((strlen(pool_name) != 0) && !cpuset && !poolset) {
2505 poolp = pool_name;
2506 err = dladm_set_linkprop(dld_handle, linkid, "pool",
2507 &poolp, 1, DLADM_OPT_ACTIVE);
2508 if (err != DLADM_STATUS_OK) {
2509 zerror(zlogp, B_FALSE, "WARNING: unable to set "
2510 "pool %s to datalink %s", pool_name, dlname);
2511 bzero(pool_name, sizeof (pool_name));
2512 }
2513 } else {
2514 bzero(pool_name, sizeof (pool_name));
2515 }
2516 return (0);
2517 }
2518
2519 static boolean_t
2520 sockaddr_to_str(sa_family_t af, const struct sockaddr *sockaddr,
2521 char *straddr, size_t len)
2522 {
2523 struct sockaddr_in *sin;
2524 struct sockaddr_in6 *sin6;
2525 const char *str = NULL;
2526
2527 if (af == AF_INET) {
2528 /* LINTED E_BAD_PTR_CAST_ALIGN */
2529 sin = SIN(sockaddr);
2530 str = inet_ntop(AF_INET, (void *)&sin->sin_addr, straddr, len);
2531 } else if (af == AF_INET6) {
2532 /* LINTED E_BAD_PTR_CAST_ALIGN */
2533 sin6 = SIN6(sockaddr);
2534 str = inet_ntop(AF_INET6, (void *)&sin6->sin6_addr, straddr,
2535 len);
2536 }
2537
2538 return (str != NULL);
2539 }
2540
2541 static int
2542 ipv4_prefixlen(struct sockaddr_in *sin)
2543 {
2544 struct sockaddr_in *m;
2545 struct sockaddr_storage mask;
2546
2547 m = SIN(&mask);
2548 m->sin_family = AF_INET;
2549 if (getnetmaskbyaddr(sin->sin_addr, &m->sin_addr) == 0) {
2550 return (mask2plen((struct sockaddr *)&mask));
2551 } else if (IN_CLASSA(htonl(sin->sin_addr.s_addr))) {
2552 return (8);
2553 } else if (IN_CLASSB(ntohl(sin->sin_addr.s_addr))) {
2554 return (16);
2555 } else if (IN_CLASSC(ntohl(sin->sin_addr.s_addr))) {
2556 return (24);
2557 }
2558 return (0);
2559 }
2560
2561 static int
2562 zone_setattr_network(int type, zoneid_t zoneid, datalink_id_t linkid,
2563 void *buf, size_t bufsize)
2564 {
2565 zone_net_data_t *zndata;
2566 size_t znsize;
2567 int err;
2568
2569 znsize = sizeof (*zndata) + bufsize;
2570 zndata = calloc(1, znsize);
2571 if (zndata == NULL)
2572 return (ENOMEM);
2573 zndata->zn_type = type;
2574 zndata->zn_len = bufsize;
2575 zndata->zn_linkid = linkid;
2576 bcopy(buf, zndata->zn_val, zndata->zn_len);
2577 err = zone_setattr(zoneid, ZONE_ATTR_NETWORK, zndata, znsize);
2578 free(zndata);
2579 return (err);
2580 }
2581
2582 static int
2583 add_net_for_linkid(zlog_t *zlogp, zoneid_t zoneid, zone_addr_list_t *start)
2584 {
2585 struct lifreq lifr;
2586 char **astr, *address;
2587 dladm_status_t dlstatus;
2588 char *ip_nospoof = "ip-nospoof";
2589 int nnet, naddr, err = 0, j;
2590 size_t zlen, cpleft;
2591 zone_addr_list_t *ptr, *end;
2592 char tmp[INET6_ADDRSTRLEN], *maskstr;
2593 char *zaddr, *cp;
2594 struct in6_addr *routes = NULL;
2595 boolean_t is_set;
2596 datalink_id_t linkid;
2597
2598 assert(start != NULL);
2599 naddr = 0; /* number of addresses */
2600 nnet = 0; /* number of net resources */
2601 linkid = start->za_linkid;
2602 for (ptr = start; ptr != NULL && ptr->za_linkid == linkid;
2603 ptr = ptr->za_next) {
2604 nnet++;
2605 }
2606 end = ptr;
2607 zlen = nnet * (INET6_ADDRSTRLEN + 1);
2608 astr = calloc(1, nnet * sizeof (uintptr_t));
2609 zaddr = calloc(1, zlen);
2610 if (astr == NULL || zaddr == NULL) {
2611 err = ENOMEM;
2612 goto done;
2613 }
2614 cp = zaddr;
2615 cpleft = zlen;
2616 j = 0;
2617 for (ptr = start; ptr != end; ptr = ptr->za_next) {
2618 address = ptr->za_nwiftab.zone_nwif_allowed_address;
2619 if (address[0] == '\0')
2620 continue;
2621 (void) snprintf(tmp, sizeof (tmp), "%s", address);
2622 /*
2623 * Validate the data. zonecfg_valid_net_address() clobbers
2624 * the /<mask> in the address string.
2625 */
2626 if (zonecfg_valid_net_address(address, &lifr) != Z_OK) {
2627 zerror(zlogp, B_FALSE, "invalid address [%s]\n",
2628 address);
2629 err = EINVAL;
2630 goto done;
2631 }
2632 /*
2633 * convert any hostnames to numeric address strings.
2634 */
2635 if (!sockaddr_to_str(lifr.lifr_addr.ss_family,
2636 (const struct sockaddr *)&lifr.lifr_addr, cp, cpleft)) {
2637 err = EINVAL;
2638 goto done;
2639 }
2640 /*
2641 * make a copy of the numeric string for the data needed
2642 * by the "allowed-ips" datalink property.
2643 */
2644 astr[j] = strdup(cp);
2645 if (astr[j] == NULL) {
2646 err = ENOMEM;
2647 goto done;
2648 }
2649 j++;
2650 /*
2651 * compute the default netmask from the address, if necessary
2652 */
2653 if ((maskstr = strchr(tmp, '/')) == NULL) {
2654 int prefixlen;
2655
2656 if (lifr.lifr_addr.ss_family == AF_INET) {
2657 prefixlen = ipv4_prefixlen(
2658 SIN(&lifr.lifr_addr));
2659 } else {
2660 struct sockaddr_in6 *sin6;
2661
2662 sin6 = SIN6(&lifr.lifr_addr);
2663 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2664 prefixlen = 10;
2665 else
2666 prefixlen = 64;
2667 }
2668 (void) snprintf(tmp, sizeof (tmp), "%d", prefixlen);
2669 maskstr = tmp;
2670 } else {
2671 maskstr++;
2672 }
2673 /* append the "/<netmask>" */
2674 (void) strlcat(cp, "/", cpleft);
2675 (void) strlcat(cp, maskstr, cpleft);
2676 (void) strlcat(cp, ",", cpleft);
2677 cp += strnlen(cp, zlen);
2678 cpleft = &zaddr[INET6_ADDRSTRLEN] - cp;
2679 }
2680 naddr = j; /* the actual number of addresses in the net resource */
2681 assert(naddr <= nnet);
2682
2683 /*
2684 * zonecfg has already verified that the defrouter property can only
2685 * be set if there is at least one address defined for the net resource.
2686 * If j is 0, there are no addresses defined, and therefore no routers
2687 * to configure, and we are done at that point.
2688 */
2689 if (j == 0)
2690 goto done;
2691
2692 /* over-write last ',' with '\0' */
2693 zaddr[strnlen(zaddr, zlen) + 1] = '\0';
2694
2695 /*
2696 * First make sure L3 protection is not already set on the link.
2697 */
2698 dlstatus = dladm_linkprop_is_set(dld_handle, linkid, DLADM_OPT_ACTIVE,
2699 "protection", &is_set);
2700 if (dlstatus != DLADM_STATUS_OK) {
2701 err = EINVAL;
2702 zerror(zlogp, B_FALSE, "unable to check if protection is set");
2703 goto done;
2704 }
2705 if (is_set) {
2706 err = EINVAL;
2707 zerror(zlogp, B_FALSE, "Protection is already set");
2708 goto done;
2709 }
2710 dlstatus = dladm_linkprop_is_set(dld_handle, linkid, DLADM_OPT_ACTIVE,
2711 "allowed-ips", &is_set);
2712 if (dlstatus != DLADM_STATUS_OK) {
2713 err = EINVAL;
2714 zerror(zlogp, B_FALSE, "unable to check if allowed-ips is set");
2715 goto done;
2716 }
2717 if (is_set) {
2718 zerror(zlogp, B_FALSE, "allowed-ips is already set");
2719 err = EINVAL;
2720 goto done;
2721 }
2722
2723 /*
2724 * Enable ip-nospoof for the link, and add address to the allowed-ips
2725 * list.
2726 */
2727 dlstatus = dladm_set_linkprop(dld_handle, linkid, "protection",
2728 &ip_nospoof, 1, DLADM_OPT_ACTIVE);
2729 if (dlstatus != DLADM_STATUS_OK) {
2730 zerror(zlogp, B_FALSE, "could not set protection\n");
2731 err = EINVAL;
2732 goto done;
2733 }
2734 dlstatus = dladm_set_linkprop(dld_handle, linkid, "allowed-ips",
2735 astr, naddr, DLADM_OPT_ACTIVE);
2736 if (dlstatus != DLADM_STATUS_OK) {
2737 zerror(zlogp, B_FALSE, "could not set allowed-ips\n");
2738 err = EINVAL;
2739 goto done;
2740 }
2741
2742 /* now set the address in the data-store */
2743 err = zone_setattr_network(ZONE_NETWORK_ADDRESS, zoneid, linkid,
2744 zaddr, strnlen(zaddr, zlen) + 1);
2745 if (err != 0)
2746 goto done;
2747
2748 /*
2749 * add the defaultrouters
2750 */
2751 routes = calloc(1, nnet * sizeof (*routes));
2752 j = 0;
2753 for (ptr = start; ptr != end; ptr = ptr->za_next) {
2754 address = ptr->za_nwiftab.zone_nwif_defrouter;
2755 if (address[0] == '\0')
2756 continue;
2757 if (strchr(address, '/') == NULL && strchr(address, ':') != 0) {
2758 /*
2759 * zonecfg_valid_net_address() expects numeric IPv6
2760 * addresses to have a CIDR format netmask.
2761 */
2762 (void) snprintf(tmp, sizeof (tmp), "/%d", V6_ADDR_LEN);
2763 (void) strlcat(address, tmp, INET6_ADDRSTRLEN);
2764 }
2765 if (zonecfg_valid_net_address(address, &lifr) != Z_OK) {
2766 zerror(zlogp, B_FALSE,
2767 "invalid router [%s]\n", address);
2768 err = EINVAL;
2769 goto done;
2770 }
2771 if (lifr.lifr_addr.ss_family == AF_INET6) {
2772 routes[j] = SIN6(&lifr.lifr_addr)->sin6_addr;
2773 } else {
2774 IN6_INADDR_TO_V4MAPPED(&SIN(&lifr.lifr_addr)->sin_addr,
2775 &routes[j]);
2776 }
2777 j++;
2778 }
2779 assert(j <= nnet);
2780 if (j > 0) {
2781 err = zone_setattr_network(ZONE_NETWORK_DEFROUTER, zoneid,
2782 linkid, routes, j * sizeof (*routes));
2783 }
2784 done:
2785 free(routes);
2786 for (j = 0; j < naddr; j++)
2787 free(astr[j]);
2788 free(astr);
2789 free(zaddr);
2790 return (err);
2791
2792 }
2793
2794 static int
2795 add_net(zlog_t *zlogp, zoneid_t zoneid, zone_addr_list_t *zalist)
2796 {
2797 zone_addr_list_t *ptr;
2798 datalink_id_t linkid;
2799 int err;
2800
2801 if (zalist == NULL)
2802 return (0);
2803
2804 linkid = zalist->za_linkid;
2805
2806 err = add_net_for_linkid(zlogp, zoneid, zalist);
2807 if (err != 0)
2808 return (err);
2809
2810 for (ptr = zalist; ptr != NULL; ptr = ptr->za_next) {
2811 if (ptr->za_linkid == linkid)
2812 continue;
2813 linkid = ptr->za_linkid;
2814 err = add_net_for_linkid(zlogp, zoneid, ptr);
2815 if (err != 0)
2816 return (err);
2817 }
2818 return (0);
2819 }
2820
2821 /*
2822 * Add "new" to the list of network interfaces to be configured by
2823 * add_net on zone boot in "old". The list of interfaces in "old" is
2824 * sorted by datalink_id_t, with interfaces sorted FIFO for a given
2825 * datalink_id_t.
2826 *
2827 * Returns the merged list of IP interfaces containing "old" and "new"
2828 */
2829 static zone_addr_list_t *
2830 add_ip_interface(zone_addr_list_t *old, zone_addr_list_t *new)
2831 {
2832 zone_addr_list_t *ptr, *next;
2833 datalink_id_t linkid = new->za_linkid;
2834
2835 assert(old != new);
2836
2837 if (old == NULL)
2838 return (new);
2839 for (ptr = old; ptr != NULL; ptr = ptr->za_next) {
2840 if (ptr->za_linkid == linkid)
2841 break;
2842 }
2843 if (ptr == NULL) {
2844 /* linkid does not already exist, add to the beginning */
2845 new->za_next = old;
2846 return (new);
2847 }
2848 /*
2849 * adding to the middle of the list; ptr points at the first
2850 * occurrence of linkid. Find the last occurrence.
2851 */
2852 while ((next = ptr->za_next) != NULL) {
2853 if (next->za_linkid != linkid)
2854 break;
2855 ptr = next;
2856 }
2857 /* insert new after ptr */
2858 new->za_next = next;
2859 ptr->za_next = new;
2860 return (old);
2861 }
2862
2863 void
2864 free_ip_interface(zone_addr_list_t *zalist)
2865 {
2866 zone_addr_list_t *ptr, *new;
2867
2868 for (ptr = zalist; ptr != NULL; ) {
2869 new = ptr;
2870 ptr = ptr->za_next;
2871 free(new);
2872 }
2873 }
2874
2875 /*
2876 * Add the kernel access control information for the interface names.
2877 * If anything goes wrong, we log a general error message, attempt to tear down
2878 * whatever we set up, and return an error.
2879 */
2880 static int
2881 configure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
2882 {
2883 struct zone_nwiftab nwiftab;
2884 char rootpath[MAXPATHLEN];
2885 char path[MAXPATHLEN];
2886 datalink_id_t linkid;
2887 di_prof_t prof = NULL;
2888 boolean_t added = B_FALSE;
2889 zone_addr_list_t *zalist = NULL, *new;
2890
2891 if (zonecfg_setnwifent(snap_hndl) != Z_OK)
2892 return (0);
2893
2894 for (;;) {
2895 if (zonecfg_getnwifent(snap_hndl, &nwiftab) != Z_OK)
2896 break;
2897
2898 nwifent_free_attrs(&nwiftab);
2899 if (prof == NULL) {
2900 if (zone_get_devroot(zone_name, rootpath,
2901 sizeof (rootpath)) != Z_OK) {
2902 (void) zonecfg_endnwifent(snap_hndl);
2903 zerror(zlogp, B_TRUE,
2904 "unable to determine dev root");
2905 return (-1);
2906 }
2907 (void) snprintf(path, sizeof (path), "%s%s", rootpath,
2908 "/dev");
2909 if (di_prof_init(path, &prof) != 0) {
2910 (void) zonecfg_endnwifent(snap_hndl);
2911 zerror(zlogp, B_TRUE,
2912 "failed to initialize profile");
2913 return (-1);
2914 }
2915 }
2916
2917 /*
2918 * Create the /dev entry for backward compatibility.
2919 * Only create the /dev entry if it's not in use.
2920 * Note that the zone still boots when the assigned
2921 * interface is inaccessible, used by others, etc.
2922 * Also, when vanity naming is used, some interface do
2923 * do not have corresponding /dev node names (for example,
2924 * vanity named aggregations). The /dev entry is not
2925 * created in that case. The /dev/net entry is always
2926 * accessible.
2927 */
2928 if (dladm_name2info(dld_handle, nwiftab.zone_nwif_physical,
2929 &linkid, NULL, NULL, NULL) == DLADM_STATUS_OK &&
2930 add_datalink(zlogp, zone_name, linkid,
2931 nwiftab.zone_nwif_physical) == 0) {
2932 added = B_TRUE;
2933 } else {
2934 /*
2935 * Failed to add network device, but the brand hook
2936 * might be doing this for us, so keep silent.
2937 */
2938 continue;
2939 }
2940 /* set up the new IP interface, and add them all later */
2941 new = malloc(sizeof (*new));
2942 if (new == NULL) {
2943 zerror(zlogp, B_TRUE, "no memory for %s",
2944 nwiftab.zone_nwif_physical);
2945 free_ip_interface(zalist);
2946 }
2947 bzero(new, sizeof (*new));
2948 new->za_nwiftab = nwiftab;
2949 new->za_linkid = linkid;
2950 zalist = add_ip_interface(zalist, new);
2951 }
2952 if (zalist != NULL) {
2953 if ((errno = add_net(zlogp, zoneid, zalist)) != 0) {
2954 (void) zonecfg_endnwifent(snap_hndl);
2955 zerror(zlogp, B_TRUE, "failed to add address");
2956 free_ip_interface(zalist);
2957 return (-1);
2958 }
2959 free_ip_interface(zalist);
2960 }
2961 (void) zonecfg_endnwifent(snap_hndl);
2962
2963 if (prof != NULL && added) {
2964 if (di_prof_commit(prof) != 0) {
2965 zerror(zlogp, B_TRUE, "failed to commit profile");
2966 return (-1);
2967 }
2968 }
2969 if (prof != NULL)
2970 di_prof_fini(prof);
2971
2972 return (0);
2973 }
2974
2975 static int
2976 remove_datalink_pool(zlog_t *zlogp, zoneid_t zoneid)
2977 {
2978 ushort_t flags;
2979 zone_iptype_t iptype;
2980 int i, dlnum = 0;
2981 datalink_id_t *dllink, *dllinks = NULL;
2982 dladm_status_t err;
2983
2984 if (strlen(pool_name) == 0)
2985 return (0);
2986
2987 if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
2988 sizeof (flags)) < 0) {
2989 if (vplat_get_iptype(zlogp, &iptype) < 0) {
2990 zerror(zlogp, B_FALSE, "unable to determine ip-type");
2991 return (-1);
2992 }
2993 } else {
2994 if (flags & ZF_NET_EXCL)
2995 iptype = ZS_EXCLUSIVE;
2996 else
2997 iptype = ZS_SHARED;
2998 }
2999
3000 if (iptype == ZS_EXCLUSIVE) {
3001 /*
3002 * Get the datalink count and for each datalink,
3003 * attempt to clear the pool property and clear
3004 * the pool_name.
3005 */
3006 if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
3007 zerror(zlogp, B_TRUE, "unable to count network "
3008 "interfaces");
3009 return (-1);
3010 }
3011
3012 if (dlnum == 0)
3013 return (0);
3014
3015 if ((dllinks = malloc(dlnum * sizeof (datalink_id_t)))
3016 == NULL) {
3017 zerror(zlogp, B_TRUE, "memory allocation failed");
3018 return (-1);
3019 }
3020 if (zone_list_datalink(zoneid, &dlnum, dllinks) != 0) {
3021 zerror(zlogp, B_TRUE, "unable to list network "
3022 "interfaces");
3023 return (-1);
3024 }
3025
3026 bzero(pool_name, sizeof (pool_name));
3027 for (i = 0, dllink = dllinks; i < dlnum; i++, dllink++) {
3028 err = dladm_set_linkprop(dld_handle, *dllink, "pool",
3029 NULL, 0, DLADM_OPT_ACTIVE);
3030 if (err != DLADM_STATUS_OK) {
3031 zerror(zlogp, B_TRUE,
3032 "WARNING: unable to clear pool");
3033 }
3034 }
3035 free(dllinks);
3036 }
3037 return (0);
3038 }
3039
3040 static int
3041 remove_datalink_protect(zlog_t *zlogp, zoneid_t zoneid)
3042 {
3043 ushort_t flags;
3044 zone_iptype_t iptype;
3045 int i, dlnum = 0;
3046 dladm_status_t dlstatus;
3047 datalink_id_t *dllink, *dllinks = NULL;
3048
3049 if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
3050 sizeof (flags)) < 0) {
3051 if (vplat_get_iptype(zlogp, &iptype) < 0) {
3052 zerror(zlogp, B_FALSE, "unable to determine ip-type");
3053 return (-1);
3054 }
3055 } else {
3056 if (flags & ZF_NET_EXCL)
3057 iptype = ZS_EXCLUSIVE;
3058 else
3059 iptype = ZS_SHARED;
3060 }
3061
3062 if (iptype != ZS_EXCLUSIVE)
3063 return (0);
3064
3065 /*
3066 * Get the datalink count and for each datalink,
3067 * attempt to clear the pool property and clear
3068 * the pool_name.
3069 */
3070 if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
3071 zerror(zlogp, B_TRUE, "unable to count network interfaces");
3072 return (-1);
3073 }
3074
3075 if (dlnum == 0)
3076 return (0);
3077
3078 if ((dllinks = malloc(dlnum * sizeof (datalink_id_t))) == NULL) {
3079 zerror(zlogp, B_TRUE, "memory allocation failed");
3080 return (-1);
3081 }
3082 if (zone_list_datalink(zoneid, &dlnum, dllinks) != 0) {
3083 zerror(zlogp, B_TRUE, "unable to list network interfaces");
3084 free(dllinks);
3085 return (-1);
3086 }
3087
3088 for (i = 0, dllink = dllinks; i < dlnum; i++, dllink++) {
3089 char dlerr[DLADM_STRSIZE];
3090
3091 dlstatus = dladm_set_linkprop(dld_handle, *dllink,
3092 "protection", NULL, 0, DLADM_OPT_ACTIVE);
3093 if (dlstatus == DLADM_STATUS_NOTFOUND) {
3094 /* datalink does not belong to the GZ */
3095 continue;
3096 }
3097 if (dlstatus != DLADM_STATUS_OK)
3098 zerror(zlogp, B_FALSE,
3099 "clear 'protection' link property: %s",
3100 dladm_status2str(dlstatus, dlerr));
3101
3102 dlstatus = dladm_set_linkprop(dld_handle, *dllink,
3103 "allowed-ips", NULL, 0, DLADM_OPT_ACTIVE);
3104 if (dlstatus != DLADM_STATUS_OK)
3105 zerror(zlogp, B_FALSE,
3106 "clear 'allowed-ips' link property: %s",
3107 dladm_status2str(dlstatus, dlerr));
3108 }
3109 free(dllinks);
3110 return (0);
3111 }
3112
3113 static int
3114 tcp_abort_conn(zlog_t *zlogp, zoneid_t zoneid,
3115 const struct sockaddr_storage *local, const struct sockaddr_storage *remote)
3116 {
3117 int fd;
3118 struct strioctl ioc;
3119 tcp_ioc_abort_conn_t conn;
3120 int error;
3121
3122 conn.ac_local = *local;
3123 conn.ac_remote = *remote;
3124 conn.ac_start = TCPS_SYN_SENT;
3125 conn.ac_end = TCPS_TIME_WAIT;
3126 conn.ac_zoneid = zoneid;
3127
3128 ioc.ic_cmd = TCP_IOC_ABORT_CONN;
3129 ioc.ic_timout = -1; /* infinite timeout */
3130 ioc.ic_len = sizeof (conn);
3131 ioc.ic_dp = (char *)&conn;
3132
3133 if ((fd = open("/dev/tcp", O_RDONLY)) < 0) {
3134 zerror(zlogp, B_TRUE, "unable to open %s", "/dev/tcp");
3135 return (-1);
3136 }
3137
3138 error = ioctl(fd, I_STR, &ioc);
3139 (void) close(fd);
3140 if (error == 0 || errno == ENOENT) /* ENOENT is not an error */
3141 return (0);
3142 return (-1);
3143 }
3144
3145 static int
3146 tcp_abort_connections(zlog_t *zlogp, zoneid_t zoneid)
3147 {
3148 struct sockaddr_storage l, r;
3149 struct sockaddr_in *local, *remote;
3150 struct sockaddr_in6 *local6, *remote6;
3151 int error;
3152
3153 /*
3154 * Abort IPv4 connections.
3155 */
3156 bzero(&l, sizeof (*local));
3157 local = (struct sockaddr_in *)&l;
3158 local->sin_family = AF_INET;
3159 local->sin_addr.s_addr = INADDR_ANY;
3160 local->sin_port = 0;
3161
3162 bzero(&r, sizeof (*remote));
3163 remote = (struct sockaddr_in *)&r;
3164 remote->sin_family = AF_INET;
3165 remote->sin_addr.s_addr = INADDR_ANY;
3166 remote->sin_port = 0;
3167
3168 if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
3169 return (error);
3170
3171 /*
3172 * Abort IPv6 connections.
3173 */
3174 bzero(&l, sizeof (*local6));
3175 local6 = (struct sockaddr_in6 *)&l;
3176 local6->sin6_family = AF_INET6;
3177 local6->sin6_port = 0;
3178 local6->sin6_addr = in6addr_any;
3179
3180 bzero(&r, sizeof (*remote6));
3181 remote6 = (struct sockaddr_in6 *)&r;
3182 remote6->sin6_family = AF_INET6;
3183 remote6->sin6_port = 0;
3184 remote6->sin6_addr = in6addr_any;
3185
3186 if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
3187 return (error);
3188 return (0);
3189 }
3190
3191 static int
3192 get_privset(zlog_t *zlogp, priv_set_t *privs, zone_mnt_t mount_cmd)
3193 {
3194 int error = -1;
3195 char *privname = NULL;
3196
3197 if (ALT_MOUNT(mount_cmd)) {
3198 zone_iptype_t iptype;
3199 const char *curr_iptype = NULL;
3200
3201 if (zonecfg_get_iptype(snap_hndl, &iptype) != Z_OK) {
3202 zerror(zlogp, B_TRUE, "unable to determine ip-type");
3203 return (-1);
3204 }
3205
3206 switch (iptype) {
3207 case ZS_SHARED:
3208 curr_iptype = "shared";
3209 break;
3210 case ZS_EXCLUSIVE:
3211 curr_iptype = "exclusive";
3212 break;
3213 }
3214
3215 if (zonecfg_default_privset(privs, curr_iptype) == Z_OK)
3216 return (0);
3217
3218 zerror(zlogp, B_FALSE,
3219 "failed to determine the zone's default privilege set");
3220 return (-1);
3221 }
3222
3223 switch (zonecfg_get_privset(snap_hndl, privs, &privname)) {
3224 case Z_OK:
3225 error = 0;
3226 break;
3227 case Z_PRIV_PROHIBITED:
3228 zerror(zlogp, B_FALSE, "privilege \"%s\" is not permitted "
3229 "within the zone's privilege set", privname);
3230 break;
3231 case Z_PRIV_REQUIRED:
3232 zerror(zlogp, B_FALSE, "required privilege \"%s\" is missing "
3233 "from the zone's privilege set", privname);
3234 break;
3235 case Z_PRIV_UNKNOWN:
3236 zerror(zlogp, B_FALSE, "unknown privilege \"%s\" specified "
3237 "in the zone's privilege set", privname);
3238 break;
3239 default:
3240 zerror(zlogp, B_FALSE, "failed to determine the zone's "
3241 "privilege set");
3242 break;
3243 }
3244
3245 free(privname);
3246 return (error);
3247 }
3248
3249 static int
3250 get_rctls(zlog_t *zlogp, char **bufp, size_t *bufsizep)
3251 {
3252 nvlist_t *nvl = NULL;
3253 char *nvl_packed = NULL;
3254 size_t nvl_size = 0;
3255 nvlist_t **nvlv = NULL;
3256 int rctlcount = 0;
3257 int error = -1;
3258 struct zone_rctltab rctltab;
3259 rctlblk_t *rctlblk = NULL;
3260 uint64_t maxlwps;
3261 uint64_t maxprocs;
3262
3263 *bufp = NULL;
3264 *bufsizep = 0;
3265
3266 rctltab.zone_rctl_valptr = NULL;
3267 if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0) {
3268 zerror(zlogp, B_TRUE, "%s failed", "nvlist_alloc");
3269 goto out;
3270 }
3271
3272 /*
3273 * Allow the administrator to control both the maximum number of
3274 * process table slots and the maximum number of lwps with just the
3275 * max-processes property. If only the max-processes property is set,
3276 * we add a max-lwps property with a limit derived from max-processes.
3277 */
3278 if (zonecfg_get_aliased_rctl(snap_hndl, ALIAS_MAXPROCS, &maxprocs)
3279 == Z_OK &&
3280 zonecfg_get_aliased_rctl(snap_hndl, ALIAS_MAXLWPS, &maxlwps)
3281 == Z_NO_ENTRY) {
3282 if (zonecfg_set_aliased_rctl(snap_hndl, ALIAS_MAXLWPS,
3283 maxprocs * LWPS_PER_PROCESS) != Z_OK) {
3284 zerror(zlogp, B_FALSE, "unable to set max-lwps alias");
3285 goto out;
3286 }
3287 }
3288
3289 if (zonecfg_setrctlent(snap_hndl) != Z_OK) {
3290 zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setrctlent");
3291 goto out;
3292 }
3293
3294 if ((rctlblk = malloc(rctlblk_size())) == NULL) {
3295 zerror(zlogp, B_TRUE, "memory allocation failed");
3296 goto out;
3297 }
3298 while (zonecfg_getrctlent(snap_hndl, &rctltab) == Z_OK) {
3299 struct zone_rctlvaltab *rctlval;
3300 uint_t i, count;
3301 const char *name = rctltab.zone_rctl_name;
3302
3303 /* zoneadm should have already warned about unknown rctls. */
3304 if (!zonecfg_is_rctl(name)) {
3305 zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3306 rctltab.zone_rctl_valptr = NULL;
3307 continue;
3308 }
3309 count = 0;
3310 for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
3311 rctlval = rctlval->zone_rctlval_next) {
3312 count++;
3313 }
3314 if (count == 0) { /* ignore */
3315 continue; /* Nothing to free */
3316 }
3317 if ((nvlv = malloc(sizeof (*nvlv) * count)) == NULL)
3318 goto out;
3319 i = 0;
3320 for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
3321 rctlval = rctlval->zone_rctlval_next, i++) {
3322 if (nvlist_alloc(&nvlv[i], NV_UNIQUE_NAME, 0) != 0) {
3323 zerror(zlogp, B_TRUE, "%s failed",
3324 "nvlist_alloc");
3325 goto out;
3326 }
3327 if (zonecfg_construct_rctlblk(rctlval, rctlblk)
3328 != Z_OK) {
3329 zerror(zlogp, B_FALSE, "invalid rctl value: "
3330 "(priv=%s,limit=%s,action=%s)",
3331 rctlval->zone_rctlval_priv,
3332 rctlval->zone_rctlval_limit,
3333 rctlval->zone_rctlval_action);
3334 goto out;
3335 }
3336 if (!zonecfg_valid_rctl(name, rctlblk)) {
3337 zerror(zlogp, B_FALSE,
3338 "(priv=%s,limit=%s,action=%s) is not a "
3339 "valid value for rctl '%s'",
3340 rctlval->zone_rctlval_priv,
3341 rctlval->zone_rctlval_limit,
3342 rctlval->zone_rctlval_action,
3343 name);
3344 goto out;
3345 }
3346 if (nvlist_add_uint64(nvlv[i], "privilege",
3347 rctlblk_get_privilege(rctlblk)) != 0) {
3348 zerror(zlogp, B_FALSE, "%s failed",
3349 "nvlist_add_uint64");
3350 goto out;
3351 }
3352 if (nvlist_add_uint64(nvlv[i], "limit",
3353 rctlblk_get_value(rctlblk)) != 0) {
3354 zerror(zlogp, B_FALSE, "%s failed",
3355 "nvlist_add_uint64");
3356 goto out;
3357 }
3358 if (nvlist_add_uint64(nvlv[i], "action",
3359 (uint_t)rctlblk_get_local_action(rctlblk, NULL))
3360 != 0) {
3361 zerror(zlogp, B_FALSE, "%s failed",
3362 "nvlist_add_uint64");
3363 goto out;
3364 }
3365 }
3366 zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3367 rctltab.zone_rctl_valptr = NULL;
3368 if (nvlist_add_nvlist_array(nvl, (char *)name, nvlv, count)
3369 != 0) {
3370 zerror(zlogp, B_FALSE, "%s failed",
3371 "nvlist_add_nvlist_array");
3372 goto out;
3373 }
3374 for (i = 0; i < count; i++)
3375 nvlist_free(nvlv[i]);
3376 free(nvlv);
3377 nvlv = NULL;
3378 rctlcount++;
3379 }
3380 (void) zonecfg_endrctlent(snap_hndl);
3381
3382 if (rctlcount == 0) {
3383 error = 0;
3384 goto out;
3385 }
3386 if (nvlist_pack(nvl, &nvl_packed, &nvl_size, NV_ENCODE_NATIVE, 0)
3387 != 0) {
3388 zerror(zlogp, B_FALSE, "%s failed", "nvlist_pack");
3389 goto out;
3390 }
3391
3392 error = 0;
3393 *bufp = nvl_packed;
3394 *bufsizep = nvl_size;
3395
3396 out:
3397 free(rctlblk);
3398 zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3399 if (error && nvl_packed != NULL)
3400 free(nvl_packed);
3401 if (nvl != NULL)
3402 nvlist_free(nvl);
3403 if (nvlv != NULL)
3404 free(nvlv);
3405 return (error);
3406 }
3407
3408 static int
3409 get_implicit_datasets(zlog_t *zlogp, char **retstr)
3410 {
3411 char cmdbuf[2 * MAXPATHLEN];
3412
3413 if (query_hook[0] == '\0')
3414 return (0);
3415
3416 if (snprintf(cmdbuf, sizeof (cmdbuf), "%s datasets", query_hook)
3417 > sizeof (cmdbuf))
3418 return (-1);
3419
3420 if (do_subproc(zlogp, cmdbuf, retstr, B_FALSE) != 0)
3421 return (-1);
3422
3423 return (0);
3424 }
3425
3426 static int
3427 get_datasets(zlog_t *zlogp, char **bufp, size_t *bufsizep)
3428 {
3429 struct zone_dstab dstab;
3430 size_t total, offset, len;
3431 int error = -1;
3432 char *str = NULL;
3433 char *implicit_datasets = NULL;
3434 int implicit_len = 0;
3435
3436 *bufp = NULL;
3437 *bufsizep = 0;
3438
3439 if (get_implicit_datasets(zlogp, &implicit_datasets) != 0) {
3440 zerror(zlogp, B_FALSE, "getting implicit datasets failed");
3441 goto out;
3442 }
3443
3444 if (zonecfg_setdsent(snap_hndl) != Z_OK) {
3445 zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
3446 goto out;
3447 }
3448
3449 total = 0;
3450 while (zonecfg_getdsent(snap_hndl, &dstab) == Z_OK)
3451 total += strlen(dstab.zone_dataset_name) + 1;
3452 (void) zonecfg_enddsent(snap_hndl);
3453
3454 if (implicit_datasets != NULL)
3455 implicit_len = strlen(implicit_datasets);
3456 if (implicit_len > 0)
3457 total += implicit_len + 1;
3458
3459 if (total == 0) {
3460 error = 0;
3461 goto out;
3462 }
3463
3464 if ((str = malloc(total)) == NULL) {
3465 zerror(zlogp, B_TRUE, "memory allocation failed");
3466 goto out;
3467 }
3468
3469 if (zonecfg_setdsent(snap_hndl) != Z_OK) {
3470 zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
3471 goto out;
3472 }
3473 offset = 0;
3474 while (zonecfg_getdsent(snap_hndl, &dstab) == Z_OK) {
3475 len = strlen(dstab.zone_dataset_name);
3476 (void) strlcpy(str + offset, dstab.zone_dataset_name,
3477 total - offset);
3478 offset += len;
3479 if (offset < total - 1)
3480 str[offset++] = ',';
3481 }
3482 (void) zonecfg_enddsent(snap_hndl);
3483
3484 if (implicit_len > 0)
3485 (void) strlcpy(str + offset, implicit_datasets, total - offset);
3486
3487 error = 0;
3488 *bufp = str;
3489 *bufsizep = total;
3490
3491 out:
3492 if (error != 0 && str != NULL)
3493 free(str);
3494 if (implicit_datasets != NULL)
3495 free(implicit_datasets);
3496
3497 return (error);
3498 }
3499
3500 static int
3501 validate_datasets(zlog_t *zlogp)
3502 {
3503 struct zone_dstab dstab;
3504 zfs_handle_t *zhp;
3505 libzfs_handle_t *hdl;
3506
3507 if (zonecfg_setdsent(snap_hndl) != Z_OK) {
3508 zerror(zlogp, B_FALSE, "invalid configuration");
3509 return (-1);
3510 }
3511
3512 if ((hdl = libzfs_init()) == NULL) {
3513 zerror(zlogp, B_FALSE, "opening ZFS library");
3514 return (-1);
3515 }
3516
3517 while (zonecfg_getdsent(snap_hndl, &dstab) == Z_OK) {
3518
3519 if ((zhp = zfs_open(hdl, dstab.zone_dataset_name,
3520 ZFS_TYPE_FILESYSTEM)) == NULL) {
3521 zerror(zlogp, B_FALSE, "cannot open ZFS dataset '%s'",
3522 dstab.zone_dataset_name);
3523 libzfs_fini(hdl);
3524 return (-1);
3525 }
3526
3527 /*
3528 * Automatically set the 'zoned' property. We check the value
3529 * first because we'll get EPERM if it is already set.
3530 */
3531 if (!zfs_prop_get_int(zhp, ZFS_PROP_ZONED) &&
3532 zfs_prop_set(zhp, zfs_prop_to_name(ZFS_PROP_ZONED),
3533 "on") != 0) {
3534 zerror(zlogp, B_FALSE, "cannot set 'zoned' "
3535 "property for ZFS dataset '%s'\n",
3536 dstab.zone_dataset_name);
3537 zfs_close(zhp);
3538 libzfs_fini(hdl);
3539 return (-1);
3540 }
3541
3542 zfs_close(zhp);
3543 }
3544 (void) zonecfg_enddsent(snap_hndl);
3545
3546 libzfs_fini(hdl);
3547
3548 return (0);
3549 }
3550
3551 /*
3552 * Return true if the path is its own zfs file system. We determine this
3553 * by stat-ing the path to see if it is zfs and stat-ing the parent to see
3554 * if it is a different fs.
3555 */
3556 boolean_t
3557 is_zonepath_zfs(char *zonepath)
3558 {
3559 int res;
3560 char *path;
3561 char *parent;
3562 struct statvfs64 buf1, buf2;
3563
3564 if (statvfs64(zonepath, &buf1) != 0)
3565 return (B_FALSE);
3566
3567 if (strcmp(buf1.f_basetype, "zfs") != 0)
3568 return (B_FALSE);
3569
3570 if ((path = strdup(zonepath)) == NULL)
3571 return (B_FALSE);
3572
3573 parent = dirname(path);
3574 res = statvfs64(parent, &buf2);
3575 free(path);
3576
3577 if (res != 0)
3578 return (B_FALSE);
3579
3580 if (buf1.f_fsid == buf2.f_fsid)
3581 return (B_FALSE);
3582
3583 return (B_TRUE);
3584 }
3585
3586 /*
3587 * Verify the MAC label in the root dataset for the zone.
3588 * If the label exists, it must match the label configured for the zone.
3589 * Otherwise if there's no label on the dataset, create one here.
3590 */
3591
3592 static int
3593 validate_rootds_label(zlog_t *zlogp, char *rootpath, m_label_t *zone_sl)
3594 {
3595 int error = -1;
3596 zfs_handle_t *zhp;
3597 libzfs_handle_t *hdl;
3598 m_label_t ds_sl;
3599 char zonepath[MAXPATHLEN];
3600 char ds_hexsl[MAXNAMELEN];
3601
3602 if (!is_system_labeled())
3603 return (0);
3604
3605 if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
3606 zerror(zlogp, B_TRUE, "unable to determine zone path");
3607 return (-1);
3608 }
3609
3610 if (!is_zonepath_zfs(zonepath))
3611 return (0);
3612
3613 if ((hdl = libzfs_init()) == NULL) {
3614 zerror(zlogp, B_FALSE, "opening ZFS library");
3615 return (-1);
3616 }
3617
3618 if ((zhp = zfs_path_to_zhandle(hdl, rootpath,
3619 ZFS_TYPE_FILESYSTEM)) == NULL) {
3620 zerror(zlogp, B_FALSE, "cannot open ZFS dataset for path '%s'",
3621 rootpath);
3622 libzfs_fini(hdl);
3623 return (-1);
3624 }
3625
3626 /* Get the mlslabel property if it exists. */
3627 if ((zfs_prop_get(zhp, ZFS_PROP_MLSLABEL, ds_hexsl, MAXNAMELEN,
3628 NULL, NULL, 0, B_TRUE) != 0) ||
3629 (strcmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) == 0)) {
3630 char *str2 = NULL;
3631
3632 /*
3633 * No label on the dataset (or default only); create one.
3634 * (Only do this automatic labeling for the labeled brand.)
3635 */
3636 if (strcmp(brand_name, LABELED_BRAND_NAME) != 0) {
3637 error = 0;
3638 goto out;
3639 }
3640
3641 error = l_to_str_internal(zone_sl, &str2);
3642 if (error)
3643 goto out;
3644 if (str2 == NULL) {
3645 error = -1;
3646 goto out;
3647 }
3648 if ((error = zfs_prop_set(zhp,
3649 zfs_prop_to_name(ZFS_PROP_MLSLABEL), str2)) != 0) {
3650 zerror(zlogp, B_FALSE, "cannot set 'mlslabel' "
3651 "property for root dataset at '%s'\n", rootpath);
3652 }
3653 free(str2);
3654 goto out;
3655 }
3656
3657 /* Convert the retrieved dataset label to binary form. */
3658 error = hexstr_to_label(ds_hexsl, &ds_sl);
3659 if (error) {
3660 zerror(zlogp, B_FALSE, "invalid 'mlslabel' "
3661 "property on root dataset at '%s'\n", rootpath);
3662 goto out; /* exit with error */
3663 }
3664
3665 /*
3666 * Perform a MAC check by comparing the zone label with the
3667 * dataset label.
3668 */
3669 error = (!blequal(zone_sl, &ds_sl));
3670 if (error)
3671 zerror(zlogp, B_FALSE, "Rootpath dataset has mismatched label");
3672 out:
3673 zfs_close(zhp);
3674 libzfs_fini(hdl);
3675
3676 return (error);
3677 }
3678
3679 /*
3680 * Mount lower level home directories into/from current zone
3681 * Share exported directories specified in dfstab for zone
3682 */
3683 static int
3684 tsol_mounts(zlog_t *zlogp, char *zone_name, char *rootpath)
3685 {
3686 zoneid_t *zids = NULL;
3687 priv_set_t *zid_privs;
3688 const priv_impl_info_t *ip = NULL;
3689 uint_t nzents_saved;
3690 uint_t nzents;
3691 int i;
3692 char readonly[] = "ro";
3693 struct zone_fstab lower_fstab;
3694 char *argv[4];
3695
3696 if (!is_system_labeled())
3697 return (0);
3698
3699 if (zid_label == NULL) {
3700 zid_label = m_label_alloc(MAC_LABEL);
3701 if (zid_label == NULL)
3702 return (-1);
3703 }
3704
3705 /* Make sure our zone has an /export/home dir */
3706 (void) make_one_dir(zlogp, rootpath, "/export/home",
3707 DEFAULT_DIR_MODE, DEFAULT_DIR_USER, DEFAULT_DIR_GROUP);
3708
3709 lower_fstab.zone_fs_raw[0] = '\0';
3710 (void) strlcpy(lower_fstab.zone_fs_type, MNTTYPE_LOFS,
3711 sizeof (lower_fstab.zone_fs_type));
3712 lower_fstab.zone_fs_options = NULL;
3713 (void) zonecfg_add_fs_option(&lower_fstab, readonly);
3714
3715 /*
3716 * Get the list of zones from the kernel
3717 */
3718 if (zone_list(NULL, &nzents) != 0) {
3719 zerror(zlogp, B_TRUE, "unable to list zones");
3720 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3721 return (-1);
3722 }
3723 again:
3724 if (nzents == 0) {
3725 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3726 return (-1);
3727 }
3728
3729 zids = malloc(nzents * sizeof (zoneid_t));
3730 if (zids == NULL) {
3731 zerror(zlogp, B_TRUE, "memory allocation failed");
3732 return (-1);
3733 }
3734 nzents_saved = nzents;
3735
3736 if (zone_list(zids, &nzents) != 0) {
3737 zerror(zlogp, B_TRUE, "unable to list zones");
3738 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3739 free(zids);
3740 return (-1);
3741 }
3742 if (nzents != nzents_saved) {
3743 /* list changed, try again */
3744 free(zids);
3745 goto again;
3746 }
3747
3748 ip = getprivimplinfo();
3749 if ((zid_privs = priv_allocset()) == NULL) {
3750 zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
3751 zonecfg_free_fs_option_list(
3752 lower_fstab.zone_fs_options);
3753 free(zids);
3754 return (-1);
3755 }
3756
3757 for (i = 0; i < nzents; i++) {
3758 char zid_name[ZONENAME_MAX];
3759 zone_state_t zid_state;
3760 char zid_rpath[MAXPATHLEN];
3761 struct stat stat_buf;
3762
3763 if (zids[i] == GLOBAL_ZONEID)
3764 continue;
3765
3766 if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
3767 continue;
3768
3769 /*
3770 * Do special setup for the zone we are booting
3771 */
3772 if (strcmp(zid_name, zone_name) == 0) {
3773 struct zone_fstab autofs_fstab;
3774 char map_path[MAXPATHLEN];
3775 int fd;
3776
3777 /*
3778 * Create auto_home_<zone> map for this zone
3779 * in the global zone. The non-global zone entry
3780 * will be created by automount when the zone
3781 * is booted.
3782 */
3783
3784 (void) snprintf(autofs_fstab.zone_fs_special,
3785 MAXPATHLEN, "auto_home_%s", zid_name);
3786
3787 (void) snprintf(autofs_fstab.zone_fs_dir, MAXPATHLEN,
3788 "/zone/%s/home", zid_name);
3789
3790 (void) snprintf(map_path, sizeof (map_path),
3791 "/etc/%s", autofs_fstab.zone_fs_special);
3792 /*
3793 * If the map file doesn't exist create a template
3794 */
3795 if ((fd = open(map_path, O_RDWR | O_CREAT | O_EXCL,
3796 S_IRUSR | S_IWUSR | S_IRGRP| S_IROTH)) != -1) {
3797 int len;
3798 char map_rec[MAXPATHLEN];
3799
3800 len = snprintf(map_rec, sizeof (map_rec),
3801 "+%s\n*\t-fstype=lofs\t:%s/export/home/&\n",
3802 autofs_fstab.zone_fs_special, rootpath);
3803 (void) write(fd, map_rec, len);
3804 (void) close(fd);
3805 }
3806
3807 /*
3808 * Mount auto_home_<zone> in the global zone if absent.
3809 * If it's already of type autofs, then
3810 * don't mount it again.
3811 */
3812 if ((stat(autofs_fstab.zone_fs_dir, &stat_buf) == -1) ||
3813 strcmp(stat_buf.st_fstype, MNTTYPE_AUTOFS) != 0) {
3814 char optstr[] = "indirect,ignore,nobrowse";
3815
3816 (void) make_one_dir(zlogp, "",
3817 autofs_fstab.zone_fs_dir, DEFAULT_DIR_MODE,
3818 DEFAULT_DIR_USER, DEFAULT_DIR_GROUP);
3819
3820 /*
3821 * Mount will fail if automounter has already
3822 * processed the auto_home_<zonename> map
3823 */
3824 (void) domount(zlogp, MNTTYPE_AUTOFS, optstr,
3825 autofs_fstab.zone_fs_special,
3826 autofs_fstab.zone_fs_dir);
3827 }
3828 continue;
3829 }
3830
3831
3832 if (zone_get_state(zid_name, &zid_state) != Z_OK ||
3833 (zid_state != ZONE_STATE_READY &&
3834 zid_state != ZONE_STATE_RUNNING))
3835 /* Skip over zones without mounted filesystems */
3836 continue;
3837
3838 if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
3839 sizeof (m_label_t)) < 0)
3840 /* Skip over zones with unspecified label */
3841 continue;
3842
3843 if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
3844 sizeof (zid_rpath)) == -1)
3845 /* Skip over zones with bad path */
3846 continue;
3847
3848 if (zone_getattr(zids[i], ZONE_ATTR_PRIVSET, zid_privs,
3849 sizeof (priv_chunk_t) * ip->priv_setsize) == -1)
3850 /* Skip over zones with bad privs */
3851 continue;
3852
3853 /*
3854 * Reading down is valid according to our label model
3855 * but some customers want to disable it because it
3856 * allows execute down and other possible attacks.
3857 * Therefore, we restrict this feature to zones that
3858 * have the NET_MAC_AWARE privilege which is required
3859 * for NFS read-down semantics.
3860 */
3861 if ((bldominates(zlabel, zid_label)) &&
3862 (priv_ismember(zprivs, PRIV_NET_MAC_AWARE))) {
3863 /*
3864 * Our zone dominates this one.
3865 * Create a lofs mount from lower zone's /export/home
3866 */
3867 (void) snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
3868 "%s/zone/%s/export/home", rootpath, zid_name);
3869
3870 /*
3871 * If the target is already an LOFS mount
3872 * then don't do it again.
3873 */
3874 if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
3875 strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
3876
3877 if (snprintf(lower_fstab.zone_fs_special,
3878 MAXPATHLEN, "%s/export",
3879 zid_rpath) > MAXPATHLEN)
3880 continue;
3881
3882 /*
3883 * Make sure the lower-level home exists
3884 */
3885 if (make_one_dir(zlogp,
3886 lower_fstab.zone_fs_special, "/home",
3887 DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
3888 DEFAULT_DIR_GROUP) != 0)
3889 continue;
3890
3891 (void) strlcat(lower_fstab.zone_fs_special,
3892 "/home", MAXPATHLEN);
3893
3894 /*
3895 * Mount can fail because the lower-level
3896 * zone may have already done a mount up.
3897 */
3898 (void) mount_one(zlogp, &lower_fstab, "",
3899 Z_MNT_BOOT);
3900 }
3901 } else if ((bldominates(zid_label, zlabel)) &&
3902 (priv_ismember(zid_privs, PRIV_NET_MAC_AWARE))) {
3903 /*
3904 * This zone dominates our zone.
3905 * Create a lofs mount from our zone's /export/home
3906 */
3907 if (snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
3908 "%s/zone/%s/export/home", zid_rpath,
3909 zone_name) > MAXPATHLEN)
3910 continue;
3911
3912 /*
3913 * If the target is already an LOFS mount
3914 * then don't do it again.
3915 */
3916 if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
3917 strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
3918
3919 (void) snprintf(lower_fstab.zone_fs_special,
3920 MAXPATHLEN, "%s/export/home", rootpath);
3921
3922 /*
3923 * Mount can fail because the higher-level
3924 * zone may have already done a mount down.
3925 */
3926 (void) mount_one(zlogp, &lower_fstab, "",
3927 Z_MNT_BOOT);
3928 }
3929 }
3930 }
3931 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3932 priv_freeset(zid_privs);
3933 free(zids);
3934
3935 /*
3936 * Now share any exported directories from this zone.
3937 * Each zone can have its own dfstab.
3938 */
3939
3940 argv[0] = "zoneshare";
3941 argv[1] = "-z";
3942 argv[2] = zone_name;
3943 argv[3] = NULL;
3944
3945 (void) forkexec(zlogp, "/usr/lib/zones/zoneshare", argv);
3946 /* Don't check for errors since they don't affect the zone */
3947
3948 return (0);
3949 }
3950
3951 /*
3952 * Unmount lofs mounts from higher level zones
3953 * Unshare nfs exported directories
3954 */
3955 static void
3956 tsol_unmounts(zlog_t *zlogp, char *zone_name)
3957 {
3958 zoneid_t *zids = NULL;
3959 uint_t nzents_saved;
3960 uint_t nzents;
3961 int i;
3962 char *argv[4];
3963 char path[MAXPATHLEN];
3964
3965 if (!is_system_labeled())
3966 return;
3967
3968 /*
3969 * Get the list of zones from the kernel
3970 */
3971 if (zone_list(NULL, &nzents) != 0) {
3972 return;
3973 }
3974
3975 if (zid_label == NULL) {
3976 zid_label = m_label_alloc(MAC_LABEL);
3977 if (zid_label == NULL)
3978 return;
3979 }
3980
3981 again:
3982 if (nzents == 0)
3983 return;
3984
3985 zids = malloc(nzents * sizeof (zoneid_t));
3986 if (zids == NULL) {
3987 zerror(zlogp, B_TRUE, "memory allocation failed");
3988 return;
3989 }
3990 nzents_saved = nzents;
3991
3992 if (zone_list(zids, &nzents) != 0) {
3993 free(zids);
3994 return;
3995 }
3996 if (nzents != nzents_saved) {
3997 /* list changed, try again */
3998 free(zids);
3999 goto again;
4000 }
4001
4002 for (i = 0; i < nzents; i++) {
4003 char zid_name[ZONENAME_MAX];
4004 zone_state_t zid_state;
4005 char zid_rpath[MAXPATHLEN];
4006
4007 if (zids[i] == GLOBAL_ZONEID)
4008 continue;
4009
4010 if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
4011 continue;
4012
4013 /*
4014 * Skip the zone we are halting
4015 */
4016 if (strcmp(zid_name, zone_name) == 0)
4017 continue;
4018
4019 if ((zone_getattr(zids[i], ZONE_ATTR_STATUS, &zid_state,
4020 sizeof (zid_state)) < 0) ||
4021 (zid_state < ZONE_IS_READY))
4022 /* Skip over zones without mounted filesystems */
4023 continue;
4024
4025 if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
4026 sizeof (m_label_t)) < 0)
4027 /* Skip over zones with unspecified label */
4028 continue;
4029
4030 if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
4031 sizeof (zid_rpath)) == -1)
4032 /* Skip over zones with bad path */
4033 continue;
4034
4035 if (zlabel != NULL && bldominates(zid_label, zlabel)) {
4036 /*
4037 * This zone dominates our zone.
4038 * Unmount the lofs mount of our zone's /export/home
4039 */
4040
4041 if (snprintf(path, MAXPATHLEN,
4042 "%s/zone/%s/export/home", zid_rpath,
4043 zone_name) > MAXPATHLEN)
4044 continue;
4045
4046 /* Skip over mount failures */
4047 (void) umount(path);
4048 }
4049 }
4050 free(zids);
4051
4052 /*
4053 * Unmount global zone autofs trigger for this zone
4054 */
4055 (void) snprintf(path, MAXPATHLEN, "/zone/%s/home", zone_name);
4056 /* Skip over mount failures */
4057 (void) umount(path);
4058
4059 /*
4060 * Next unshare any exported directories from this zone.
4061 */
4062
4063 argv[0] = "zoneunshare";
4064 argv[1] = "-z";
4065 argv[2] = zone_name;
4066 argv[3] = NULL;
4067
4068 (void) forkexec(zlogp, "/usr/lib/zones/zoneunshare", argv);
4069 /* Don't check for errors since they don't affect the zone */
4070
4071 /*
4072 * Finally, deallocate any devices in the zone.
4073 */
4074
4075 argv[0] = "deallocate";
4076 argv[1] = "-Isz";
4077 argv[2] = zone_name;
4078 argv[3] = NULL;
4079
4080 (void) forkexec(zlogp, "/usr/sbin/deallocate", argv);
4081 /* Don't check for errors since they don't affect the zone */
4082 }
4083
4084 /*
4085 * Fetch the Trusted Extensions label and multi-level ports (MLPs) for
4086 * this zone.
4087 */
4088 static tsol_zcent_t *
4089 get_zone_label(zlog_t *zlogp, priv_set_t *privs)
4090 {
4091 FILE *fp;
4092 tsol_zcent_t *zcent = NULL;
4093 char line[MAXTNZLEN];
4094
4095 if ((fp = fopen(TNZONECFG_PATH, "r")) == NULL) {
4096 zerror(zlogp, B_TRUE, "%s", TNZONECFG_PATH);
4097 return (NULL);
4098 }
4099
4100 while (fgets(line, sizeof (line), fp) != NULL) {
4101 /*
4102 * Check for malformed database
4103 */
4104 if (strlen(line) == MAXTNZLEN - 1)
4105 break;
4106 if ((zcent = tsol_sgetzcent(line, NULL, NULL)) == NULL)
4107 continue;
4108 if (strcmp(zcent->zc_name, zone_name) == 0)
4109 break;
4110 tsol_freezcent(zcent);
4111 zcent = NULL;
4112 }
4113 (void) fclose(fp);
4114
4115 if (zcent == NULL) {
4116 zerror(zlogp, B_FALSE, "zone requires a label assignment. "
4117 "See tnzonecfg(4)");
4118 } else {
4119 if (zlabel == NULL)
4120 zlabel = m_label_alloc(MAC_LABEL);
4121 /*
4122 * Save this zone's privileges for later read-down processing
4123 */
4124 if ((zprivs = priv_allocset()) == NULL) {
4125 zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
4126 return (NULL);
4127 } else {
4128 priv_copyset(privs, zprivs);
4129 }
4130 }
4131 return (zcent);
4132 }
4133
4134 /*
4135 * Add the Trusted Extensions multi-level ports for this zone.
4136 */
4137 static void
4138 set_mlps(zlog_t *zlogp, zoneid_t zoneid, tsol_zcent_t *zcent)
4139 {
4140 tsol_mlp_t *mlp;
4141 tsol_mlpent_t tsme;
4142
4143 if (!is_system_labeled())
4144 return;
4145
4146 tsme.tsme_zoneid = zoneid;
4147 tsme.tsme_flags = 0;
4148 for (mlp = zcent->zc_private_mlp; !TSOL_MLP_END(mlp); mlp++) {
4149 tsme.tsme_mlp = *mlp;
4150 if (tnmlp(TNDB_LOAD, &tsme) != 0) {
4151 zerror(zlogp, B_TRUE, "cannot set zone-specific MLP "
4152 "on %d-%d/%d", mlp->mlp_port,
4153 mlp->mlp_port_upper, mlp->mlp_ipp);
4154 }
4155 }
4156
4157 tsme.tsme_flags = TSOL_MEF_SHARED;
4158 for (mlp = zcent->zc_shared_mlp; !TSOL_MLP_END(mlp); mlp++) {
4159 tsme.tsme_mlp = *mlp;
4160 if (tnmlp(TNDB_LOAD, &tsme) != 0) {
4161 zerror(zlogp, B_TRUE, "cannot set shared MLP "
4162 "on %d-%d/%d", mlp->mlp_port,
4163 mlp->mlp_port_upper, mlp->mlp_ipp);
4164 }
4165 }
4166 }
4167
4168 static void
4169 remove_mlps(zlog_t *zlogp, zoneid_t zoneid)
4170 {
4171 tsol_mlpent_t tsme;
4172
4173 if (!is_system_labeled())
4174 return;
4175
4176 (void) memset(&tsme, 0, sizeof (tsme));
4177 tsme.tsme_zoneid = zoneid;
4178 if (tnmlp(TNDB_FLUSH, &tsme) != 0)
4179 zerror(zlogp, B_TRUE, "cannot flush MLPs");
4180 }
4181
4182 int
4183 prtmount(const struct mnttab *fs, void *x) {
4184 zerror((zlog_t *)x, B_FALSE, " %s", fs->mnt_mountp);
4185 return (0);
4186 }
4187
4188 /*
4189 * Look for zones running on the main system that are using this root (or any
4190 * subdirectory of it). Return B_TRUE and print an error if a conflicting zone
4191 * is found or if we can't tell.
4192 */
4193 static boolean_t
4194 duplicate_zone_root(zlog_t *zlogp, const char *rootpath)
4195 {
4196 zoneid_t *zids = NULL;
4197 uint_t nzids = 0;
4198 boolean_t retv;
4199 int rlen, zlen;
4200 char zroot[MAXPATHLEN];
4201 char zonename[ZONENAME_MAX];
4202
4203 for (;;) {
4204 nzids += 10;
4205 zids = malloc(nzids * sizeof (*zids));
4206 if (zids == NULL) {
4207 zerror(zlogp, B_TRUE, "memory allocation failed");
4208 return (B_TRUE);
4209 }
4210 if (zone_list(zids, &nzids) == 0)
4211 break;
4212 free(zids);
4213 }
4214 retv = B_FALSE;
4215 rlen = strlen(rootpath);
4216 while (nzids > 0) {
4217 /*
4218 * Ignore errors; they just mean that the zone has disappeared
4219 * while we were busy.
4220 */
4221 if (zone_getattr(zids[--nzids], ZONE_ATTR_ROOT, zroot,
4222 sizeof (zroot)) == -1)
4223 continue;
4224 zlen = strlen(zroot);
4225 if (zlen > rlen)
4226 zlen = rlen;
4227 if (strncmp(rootpath, zroot, zlen) == 0 &&
4228 (zroot[zlen] == '\0' || zroot[zlen] == '/') &&
4229 (rootpath[zlen] == '\0' || rootpath[zlen] == '/')) {
4230 if (getzonenamebyid(zids[nzids], zonename,
4231 sizeof (zonename)) == -1)
4232 (void) snprintf(zonename, sizeof (zonename),
4233 "id %d", (int)zids[nzids]);
4234 zerror(zlogp, B_FALSE,
4235 "zone root %s already in use by zone %s",
4236 rootpath, zonename);
4237 retv = B_TRUE;
4238 break;
4239 }
4240 }
4241 free(zids);
4242 return (retv);
4243 }
4244
4245 /*
4246 * Search for loopback mounts that use this same source node (same device and
4247 * inode). Return B_TRUE if there is one or if we can't tell.
4248 */
4249 static boolean_t
4250 duplicate_reachable_path(zlog_t *zlogp, const char *rootpath)
4251 {
4252 struct stat64 rst, zst;
4253 struct mnttab *mnp;
4254
4255 if (stat64(rootpath, &rst) == -1) {
4256 zerror(zlogp, B_TRUE, "can't stat %s", rootpath);
4257 return (B_TRUE);
4258 }
4259 if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
4260 return (B_TRUE);
4261 for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max; mnp++) {
4262 if (mnp->mnt_fstype == NULL ||
4263 strcmp(MNTTYPE_LOFS, mnp->mnt_fstype) != 0)
4264 continue;
4265 /* We're looking at a loopback mount. Stat it. */
4266 if (mnp->mnt_special != NULL &&
4267 stat64(mnp->mnt_special, &zst) != -1 &&
4268 rst.st_dev == zst.st_dev && rst.st_ino == zst.st_ino) {
4269 zerror(zlogp, B_FALSE,
4270 "zone root %s is reachable through %s",
4271 rootpath, mnp->mnt_mountp);
4272 return (B_TRUE);
4273 }
4274 }
4275 return (B_FALSE);
4276 }
4277
4278 /*
4279 * Set pool info for the zone's resource management configuration.
4280 */
4281 static int
4282 setup_zone_rm(zlog_t *zlogp, char *zone_name, zoneid_t zoneid)
4283 {
4284 int res;
4285 uint64_t tmp;
4286 char sched[MAXNAMELEN];
4287 char pool_err[128];
4288
4289 /* Get the scheduling class set in the zone configuration. */
4290 if (zonecfg_get_sched_class(snap_hndl, sched, sizeof (sched)) == Z_OK &&
4291 strlen(sched) > 0) {
4292 if (zone_setattr(zoneid, ZONE_ATTR_SCHED_CLASS, sched,
4293 strlen(sched)) == -1)
4294 zerror(zlogp, B_TRUE, "WARNING: unable to set the "
4295 "default scheduling class");
4296
4297 } else if (zonecfg_get_aliased_rctl(snap_hndl, ALIAS_SHARES, &tmp)
4298 == Z_OK) {
4299 /*
4300 * If the zone has the zone.cpu-shares rctl set then we want to
4301 * use the Fair Share Scheduler (FSS) for processes in the
4302 * zone. Check what scheduling class the zone would be running
4303 * in by default so we can print a warning and modify the class
4304 * if we wouldn't be using FSS.
4305 */
4306 char class_name[PC_CLNMSZ];
4307
4308 if (zonecfg_get_dflt_sched_class(snap_hndl, class_name,
4309 sizeof (class_name)) != Z_OK) {
4310 zerror(zlogp, B_FALSE, "WARNING: unable to determine "
4311 "the zone's scheduling class");
4312
4313 } else if (strcmp("FSS", class_name) != 0) {
4314 zerror(zlogp, B_FALSE, "WARNING: The zone.cpu-shares "
4315 "rctl is set but\nFSS is not the default "
4316 "scheduling class for\nthis zone. FSS will be "
4317 "used for processes\nin the zone but to get the "
4318 "full benefit of FSS,\nit should be the default "
4319 "scheduling class.\nSee dispadmin(1M) for more "
4320 "details.");
4321
4322 if (zone_setattr(zoneid, ZONE_ATTR_SCHED_CLASS, "FSS",
4323 strlen("FSS")) == -1)
4324 zerror(zlogp, B_TRUE, "WARNING: unable to set "
4325 "zone scheduling class to FSS");
4326 }
4327 }
4328
4329 /*
4330 * The next few blocks of code attempt to set up temporary pools as
4331 * well as persistent pools. In all cases we call the functions
4332 * unconditionally. Within each funtion the code will check if the
4333 * zone is actually configured for a temporary pool or persistent pool
4334 * and just return if there is nothing to do.
4335 *
4336 * If we are rebooting we want to attempt to reuse any temporary pool
4337 * that was previously set up. zonecfg_bind_tmp_pool() will do the
4338 * right thing in all cases (reuse or create) based on the current
4339 * zonecfg.
4340 */
4341 if ((res = zonecfg_bind_tmp_pool(snap_hndl, zoneid, pool_err,
4342 sizeof (pool_err))) != Z_OK) {
4343 if (res == Z_POOL || res == Z_POOL_CREATE || res == Z_POOL_BIND)
4344 zerror(zlogp, B_FALSE, "%s: %s\ndedicated-cpu setting "
4345 "cannot be instantiated", zonecfg_strerror(res),
4346 pool_err);
4347 else
4348 zerror(zlogp, B_FALSE, "could not bind zone to "
4349 "temporary pool: %s", zonecfg_strerror(res));
4350 return (Z_POOL_BIND);
4351 }
4352
4353 /*
4354 * Check if we need to warn about poold not being enabled.
4355 */
4356 if (zonecfg_warn_poold(snap_hndl)) {
4357 zerror(zlogp, B_FALSE, "WARNING: A range of dedicated-cpus has "
4358 "been specified\nbut the dynamic pool service is not "
4359 "enabled.\nThe system will not dynamically adjust the\n"
4360 "processor allocation within the specified range\n"
4361 "until svc:/system/pools/dynamic is enabled.\n"
4362 "See poold(1M).");
4363 }
4364
4365 /* The following is a warning, not an error. */
4366 if ((res = zonecfg_bind_pool(snap_hndl, zoneid, pool_err,
4367 sizeof (pool_err))) != Z_OK) {
4368 if (res == Z_POOL_BIND)
4369 zerror(zlogp, B_FALSE, "WARNING: unable to bind to "
4370 "pool '%s'; using default pool.", pool_err);
4371 else if (res == Z_POOL)
4372 zerror(zlogp, B_FALSE, "WARNING: %s: %s",
4373 zonecfg_strerror(res), pool_err);
4374 else
4375 zerror(zlogp, B_FALSE, "WARNING: %s",
4376 zonecfg_strerror(res));
4377 }
4378
4379 /* Update saved pool name in case it has changed */
4380 (void) zonecfg_get_poolname(snap_hndl, zone_name, pool_name,
4381 sizeof (pool_name));
4382
4383 return (Z_OK);
4384 }
4385
4386 static void
4387 report_prop_err(zlog_t *zlogp, const char *name, const char *value, int res)
4388 {
4389 switch (res) {
4390 case Z_TOO_BIG:
4391 zerror(zlogp, B_FALSE, "%s property value is too large.", name);
4392 break;
4393
4394 case Z_INVALID_PROPERTY:
4395 zerror(zlogp, B_FALSE, "%s property value \"%s\" is not valid",
4396 name, value);
4397 break;
4398
4399 default:
4400 zerror(zlogp, B_TRUE, "fetching property %s: %d", name, res);
4401 break;
4402 }
4403 }
4404
4405 /*
4406 * Sets the hostid of the new zone based on its configured value. The zone's
4407 * zone_t structure must already exist in kernel memory. 'zlogp' refers to the
4408 * log used to report errors and warnings and must be non-NULL. 'zone_namep'
4409 * is the name of the new zone and must be non-NULL. 'zoneid' is the numeric
4410 * ID of the new zone.
4411 *
4412 * This function returns zero on success and a nonzero error code on failure.
4413 */
4414 static int
4415 setup_zone_hostid(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4416 {
4417 int res;
4418 char hostidp[HW_HOSTID_LEN];
4419 unsigned int hostid;
4420
4421 res = zonecfg_get_hostid(handle, hostidp, sizeof (hostidp));
4422
4423 if (res == Z_BAD_PROPERTY) {
4424 return (Z_OK);
4425 } else if (res != Z_OK) {
4426 report_prop_err(zlogp, "hostid", hostidp, res);
4427 return (res);
4428 }
4429
4430 hostid = (unsigned int)strtoul(hostidp, NULL, 16);
4431 if ((res = zone_setattr(zoneid, ZONE_ATTR_HOSTID, &hostid,
4432 sizeof (hostid))) != 0) {
4433 zerror(zlogp, B_TRUE,
4434 "zone hostid is not valid: %s: %d", hostidp, res);
4435 return (Z_SYSTEM);
4436 }
4437
4438 return (res);
4439 }
4440
4441 static int
4442 setup_zone_fs_allowed(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4443 {
4444 char fsallowedp[ZONE_FS_ALLOWED_MAX];
4445 int res;
4446
4447 res = zonecfg_get_fs_allowed(handle, fsallowedp, sizeof (fsallowedp));
4448
4449 if (res == Z_BAD_PROPERTY) {
4450 return (Z_OK);
4451 } else if (res != Z_OK) {
4452 report_prop_err(zlogp, "fs-allowed", fsallowedp, res);
4453 return (res);
4454 }
4455
4456 if (zone_setattr(zoneid, ZONE_ATTR_FS_ALLOWED, &fsallowedp,
4457 sizeof (fsallowedp)) != 0) {
4458 zerror(zlogp, B_TRUE,
4459 "fs-allowed couldn't be set: %s: %d", fsallowedp, res);
4460 return (Z_SYSTEM);
4461 }
4462
4463 return (res);
4464 }
4465
4466 static int
4467 setup_zone_attrs(zlog_t *zlogp, zoneid_t zoneid)
4468 {
4469 int res = Z_OK;
4470
4471 if ((res = setup_zone_hostid(snap_hndl, zlogp, zoneid)) != Z_OK)
4472 goto out;
4473
4474 if ((res = setup_zone_fs_allowed(snap_hndl, zlogp, zoneid)) != Z_OK)
4475 goto out;
4476
4477 out:
4478 return (res);
4479 }
4480
4481 /*
4482 * The zone_did is a persistent debug ID. Each zone should have a unique ID
4483 * in the kernel. This is used for things like DTrace which want to monitor
4484 * zones across reboots. They can't use the zoneid since that changes on
4485 * each boot.
4486 */
4487 zoneid_t
4488 vplat_create(zlog_t *zlogp, zone_mnt_t mount_cmd, zoneid_t zone_did)
4489 {
4490 zoneid_t rval = -1;
4491 priv_set_t *privs;
4492 char rootpath[MAXPATHLEN];
4493 char *rctlbuf = NULL;
4494 size_t rctlbufsz = 0;
4495 char *zfsbuf = NULL;
4496 size_t zfsbufsz = 0;
4497 zoneid_t zoneid = -1;
4498 int xerr;
4499 char *kzone;
4500 FILE *fp = NULL;
4501 tsol_zcent_t *zcent = NULL;
4502 int match = 0;
4503 int doi = 0;
4504 int flags = -1;
4505 zone_iptype_t iptype;
4506
4507 if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
4508 zerror(zlogp, B_TRUE, "unable to determine zone root");
4509 return (-1);
4510 }
4511 if (zonecfg_in_alt_root())
4512 resolve_lofs(zlogp, rootpath, sizeof (rootpath));
4513
4514 if (vplat_get_iptype(zlogp, &iptype) < 0) {
4515 zerror(zlogp, B_TRUE, "unable to determine ip-type");
4516 return (-1);
4517 }
4518 switch (iptype) {
4519 case ZS_SHARED:
4520 flags = 0;
4521 break;
4522 case ZS_EXCLUSIVE:
4523 flags = ZCF_NET_EXCL;
4524 break;
4525 }
4526 if (flags == -1)
4527 abort();
4528
4529 if ((privs = priv_allocset()) == NULL) {
4530 zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
4531 return (-1);
4532 }
4533 priv_emptyset(privs);
4534 if (get_privset(zlogp, privs, mount_cmd) != 0)
4535 goto error;
4536
4537 if (mount_cmd == Z_MNT_BOOT &&
4538 get_rctls(zlogp, &rctlbuf, &rctlbufsz) != 0) {
4539 zerror(zlogp, B_FALSE, "Unable to get list of rctls");
4540 goto error;
4541 }
4542
4543 if (get_datasets(zlogp, &zfsbuf, &zfsbufsz) != 0) {
4544 zerror(zlogp, B_FALSE, "Unable to get list of ZFS datasets");
4545 goto error;
4546 }
4547
4548 if (mount_cmd == Z_MNT_BOOT && is_system_labeled()) {
4549 zcent = get_zone_label(zlogp, privs);
4550 if (zcent != NULL) {
4551 match = zcent->zc_match;
4552 doi = zcent->zc_doi;
4553 *zlabel = zcent->zc_label;
4554 } else {
4555 goto error;
4556 }
4557 if (validate_rootds_label(zlogp, rootpath, zlabel) != 0)
4558 goto error;
4559 }
4560
4561 kzone = zone_name;
4562
4563 /*
4564 * We must do this scan twice. First, we look for zones running on the
4565 * main system that are using this root (or any subdirectory of it).
4566 * Next, we reduce to the shortest path and search for loopback mounts
4567 * that use this same source node (same device and inode).
4568 */
4569 if (duplicate_zone_root(zlogp, rootpath))
4570 goto error;
4571 if (duplicate_reachable_path(zlogp, rootpath))
4572 goto error;
4573
4574 if (ALT_MOUNT(mount_cmd)) {
4575 root_to_lu(zlogp, rootpath, sizeof (rootpath), B_TRUE);
4576
4577 /*
4578 * Forge up a special root for this zone. When a zone is
4579 * mounted, we can't let the zone have its own root because the
4580 * tools that will be used in this "scratch zone" need access
4581 * to both the zone's resources and the running machine's
4582 * executables.
4583 *
4584 * Note that the mkdir here also catches read-only filesystems.
4585 */
4586 if (mkdir(rootpath, 0755) != 0 && errno != EEXIST) {
4587 zerror(zlogp, B_TRUE, "cannot create %s", rootpath);
4588 goto error;
4589 }
4590 if (domount(zlogp, "tmpfs", "", "swap", rootpath) != 0)
4591 goto error;
4592 }
4593
4594 if (zonecfg_in_alt_root()) {
4595 /*
4596 * If we are mounting up a zone in an alternate root partition,
4597 * then we have some additional work to do before starting the
4598 * zone. First, resolve the root path down so that we're not
4599 * fooled by duplicates. Then forge up an internal name for
4600 * the zone.
4601 */
4602 if ((fp = zonecfg_open_scratch("", B_TRUE)) == NULL) {
4603 zerror(zlogp, B_TRUE, "cannot open mapfile");
4604 goto error;
4605 }
4606 if (zonecfg_lock_scratch(fp) != 0) {
4607 zerror(zlogp, B_TRUE, "cannot lock mapfile");
4608 goto error;
4609 }
4610 if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
4611 NULL, 0) == 0) {
4612 zerror(zlogp, B_FALSE, "scratch zone already running");
4613 goto error;
4614 }
4615 /* This is the preferred name */
4616 (void) snprintf(kernzone, sizeof (kernzone), "SUNWlu-%s",
4617 zone_name);
4618 srandom(getpid());
4619 while (zonecfg_reverse_scratch(fp, kernzone, NULL, 0, NULL,
4620 0) == 0) {
4621 /* This is just an arbitrary name; note "." usage */
4622 (void) snprintf(kernzone, sizeof (kernzone),
4623 "SUNWlu.%08lX%08lX", random(), random());
4624 }
4625 kzone = kernzone;
4626 }
4627
4628 xerr = 0;
4629 if ((zoneid = zone_create(kzone, rootpath, privs, rctlbuf,
4630 rctlbufsz, zfsbuf, zfsbufsz, &xerr, match, doi, zlabel,
4631 flags, zone_did)) == -1) {
4632 if (xerr == ZE_AREMOUNTS) {
4633 if (zonecfg_find_mounts(rootpath, NULL, NULL) < 1) {
4634 zerror(zlogp, B_FALSE,
4635 "An unknown file-system is mounted on "
4636 "a subdirectory of %s", rootpath);
4637 } else {
4638
4639 zerror(zlogp, B_FALSE,
4640 "These file-systems are mounted on "
4641 "subdirectories of %s:", rootpath);
4642 (void) zonecfg_find_mounts(rootpath,
4643 prtmount, zlogp);
4644 }
4645 } else if (xerr == ZE_CHROOTED) {
4646 zerror(zlogp, B_FALSE, "%s: "
4647 "cannot create a zone from a chrooted "
4648 "environment", "zone_create");
4649 } else if (xerr == ZE_LABELINUSE) {
4650 char zonename[ZONENAME_MAX];
4651 (void) getzonenamebyid(getzoneidbylabel(zlabel),
4652 zonename, ZONENAME_MAX);
4653 zerror(zlogp, B_FALSE, "The zone label is already "
4654 "used by the zone '%s'.", zonename);
4655 } else {
4656 zerror(zlogp, B_TRUE, "%s failed", "zone_create");
4657 }
4658 goto error;
4659 }
4660
4661 if (zonecfg_in_alt_root() &&
4662 zonecfg_add_scratch(fp, zone_name, kernzone,
4663 zonecfg_get_root()) == -1) {
4664 zerror(zlogp, B_TRUE, "cannot add mapfile entry");
4665 goto error;
4666 }
4667
4668 /*
4669 * The following actions are not performed when merely mounting a zone
4670 * for administrative use.
4671 */
4672 if (mount_cmd == Z_MNT_BOOT) {
4673 brand_handle_t bh;
4674 struct brand_attr attr;
4675 char modname[MAXPATHLEN];
4676
4677 if (setup_zone_attrs(zlogp, zoneid) != Z_OK)
4678 goto error;
4679
4680 if ((bh = brand_open(brand_name)) == NULL) {
4681 zerror(zlogp, B_FALSE,
4682 "unable to determine brand name");
4683 goto error;
4684 }
4685
4686 if (!is_system_labeled() &&
4687 (strcmp(brand_name, LABELED_BRAND_NAME) == 0)) {
4688 brand_close(bh);
4689 zerror(zlogp, B_FALSE,
4690 "cannot boot labeled zone on unlabeled system");
4691 goto error;
4692 }
4693
4694 /*
4695 * If this brand requires any kernel support, now is the time to
4696 * get it loaded and initialized.
4697 */
4698 if (brand_get_modname(bh, modname, MAXPATHLEN) < 0) {
4699 brand_close(bh);
4700 zerror(zlogp, B_FALSE,
4701 "unable to determine brand kernel module");
4702 goto error;
4703 }
4704 brand_close(bh);
4705
4706 if (strlen(modname) > 0) {
4707 (void) strlcpy(attr.ba_brandname, brand_name,
4708 sizeof (attr.ba_brandname));
4709 (void) strlcpy(attr.ba_modname, modname,
4710 sizeof (attr.ba_modname));
4711 if (zone_setattr(zoneid, ZONE_ATTR_BRAND, &attr,
4712 sizeof (attr) != 0)) {
4713 zerror(zlogp, B_TRUE,
4714 "could not set zone brand attribute.");
4715 goto error;
4716 }
4717 }
4718
4719 if (setup_zone_rm(zlogp, zone_name, zoneid) != Z_OK)
4720 goto error;
4721
4722 set_mlps(zlogp, zoneid, zcent);
4723 }
4724
4725 rval = zoneid;
4726 zoneid = -1;
4727
4728 error:
4729 if (zoneid != -1) {
4730 (void) zone_shutdown(zoneid);
4731 (void) zone_destroy(zoneid);
4732 }
4733 if (rctlbuf != NULL)
4734 free(rctlbuf);
4735 if (zfsbuf != NULL)
4736 free(zfsbuf);
4737 priv_freeset(privs);
4738 if (fp != NULL)
4739 zonecfg_close_scratch(fp);
4740 lofs_discard_mnttab();
4741 if (zcent != NULL)
4742 tsol_freezcent(zcent);
4743 return (rval);
4744 }
4745
4746 /*
4747 * Enter the zone and write a /etc/zones/index file there. This allows
4748 * libzonecfg (and thus zoneadm) to report the UUID and potentially other zone
4749 * details from inside the zone.
4750 */
4751 static void
4752 write_index_file(zoneid_t zoneid)
4753 {
4754 FILE *zef;
4755 FILE *zet;
4756 struct zoneent *zep;
4757 pid_t child;
4758 int tmpl_fd;
4759 ctid_t ct;
4760 int fd;
4761 char uuidstr[UUID_PRINTABLE_STRING_LENGTH];
4762
4763 /* Locate the zone entry in the global zone's index file */
4764 if ((zef = setzoneent()) == NULL)
4765 return;
4766 while ((zep = getzoneent_private(zef)) != NULL) {
4767 if (strcmp(zep->zone_name, zone_name) == 0)
4768 break;
4769 free(zep);
4770 }
4771 endzoneent(zef);
4772 if (zep == NULL)
4773 return;
4774
4775 if ((tmpl_fd = init_template()) == -1) {
4776 free(zep);
4777 return;
4778 }
4779
4780 if ((child = fork()) == -1) {
4781 (void) ct_tmpl_clear(tmpl_fd);
4782 (void) close(tmpl_fd);
4783 free(zep);
4784 return;
4785 }
4786
4787 /* parent waits for child to finish */
4788 if (child != 0) {
4789 free(zep);
4790 if (contract_latest(&ct) == -1)
4791 ct = -1;
4792 (void) ct_tmpl_clear(tmpl_fd);
4793 (void) close(tmpl_fd);
4794 (void) waitpid(child, NULL, 0);
4795 (void) contract_abandon_id(ct);
4796 return;
4797 }
4798
4799 /* child enters zone and sets up index file */
4800 (void) ct_tmpl_clear(tmpl_fd);
4801 if (zone_enter(zoneid) != -1) {
4802 (void) mkdir(ZONE_CONFIG_ROOT, ZONE_CONFIG_MODE);
4803 (void) chown(ZONE_CONFIG_ROOT, ZONE_CONFIG_UID,
4804 ZONE_CONFIG_GID);
4805 fd = open(ZONE_INDEX_FILE, O_WRONLY|O_CREAT|O_TRUNC,
4806 ZONE_INDEX_MODE);
4807 if (fd != -1 && (zet = fdopen(fd, "w")) != NULL) {
4808 (void) fchown(fd, ZONE_INDEX_UID, ZONE_INDEX_GID);
4809 if (uuid_is_null(zep->zone_uuid))
4810 uuidstr[0] = '\0';
4811 else
4812 uuid_unparse(zep->zone_uuid, uuidstr);
4813 (void) fprintf(zet, "%s:%s:/:%s\n", zep->zone_name,
4814 zone_state_str(zep->zone_state),
4815 uuidstr);
4816 (void) fclose(zet);
4817 }
4818 }
4819 _exit(0);
4820 }
4821
4822 int
4823 vplat_bringup(zlog_t *zlogp, zone_mnt_t mount_cmd, zoneid_t zoneid)
4824 {
4825 char zonepath[MAXPATHLEN];
4826
4827 if (mount_cmd == Z_MNT_BOOT && validate_datasets(zlogp) != 0) {
4828 lofs_discard_mnttab();
4829 return (-1);
4830 }
4831
4832 /*
4833 * Before we try to mount filesystems we need to create the
4834 * attribute backing store for /dev
4835 */
4836 if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
4837 lofs_discard_mnttab();
4838 return (-1);
4839 }
4840 resolve_lofs(zlogp, zonepath, sizeof (zonepath));
4841
4842 /* Make /dev directory owned by root, grouped sys */
4843 if (make_one_dir(zlogp, zonepath, "/dev", DEFAULT_DIR_MODE,
4844 0, 3) != 0) {
4845 lofs_discard_mnttab();
4846 return (-1);
4847 }
4848
4849 if (mount_filesystems(zlogp, mount_cmd) != 0) {
4850 lofs_discard_mnttab();
4851 return (-1);
4852 }
4853
4854 if (mount_cmd == Z_MNT_BOOT) {
4855 zone_iptype_t iptype;
4856
4857 if (vplat_get_iptype(zlogp, &iptype) < 0) {
4858 zerror(zlogp, B_TRUE, "unable to determine ip-type");
4859 lofs_discard_mnttab();
4860 return (-1);
4861 }
4862
4863 switch (iptype) {
4864 case ZS_SHARED:
4865 /* Always do this to make lo0 get configured */
4866 if (configure_shared_network_interfaces(zlogp) != 0) {
4867 lofs_discard_mnttab();
4868 return (-1);
4869 }
4870 break;
4871 case ZS_EXCLUSIVE:
4872 if (configure_exclusive_network_interfaces(zlogp,
4873 zoneid) !=
4874 0) {
4875 lofs_discard_mnttab();
4876 return (-1);
4877 }
4878 break;
4879 default:
4880 abort();
4881 }
4882 }
4883
4884 write_index_file(zoneid);
4885
4886 lofs_discard_mnttab();
4887 return (0);
4888 }
4889
4890 static int
4891 lu_root_teardown(zlog_t *zlogp)
4892 {
4893 char zroot[MAXPATHLEN];
4894
4895 if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
4896 zerror(zlogp, B_FALSE, "unable to determine zone root");
4897 return (-1);
4898 }
4899 root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
4900
4901 /*
4902 * At this point, the processes are gone, the filesystems (save the
4903 * root) are unmounted, and the zone is on death row. But there may
4904 * still be creds floating about in the system that reference the
4905 * zone_t, and which pin down zone_rootvp causing this call to fail
4906 * with EBUSY. Thus, we try for a little while before just giving up.
4907 * (How I wish this were not true, and umount2 just did the right
4908 * thing, or tmpfs supported MS_FORCE This is a gross hack.)
4909 */
4910 if (umount2(zroot, MS_FORCE) != 0) {
4911 if (errno == ENOTSUP && umount2(zroot, 0) == 0)
4912 goto unmounted;
4913 if (errno == EBUSY) {
4914 int tries = 10;
4915
4916 while (--tries >= 0) {
4917 (void) sleep(1);
4918 if (umount2(zroot, 0) == 0)
4919 goto unmounted;
4920 if (errno != EBUSY)
4921 break;
4922 }
4923 }
4924 zerror(zlogp, B_TRUE, "unable to unmount '%s'", zroot);
4925 return (-1);
4926 }
4927 unmounted:
4928
4929 /*
4930 * Only zones in an alternate root environment have scratch zone
4931 * entries.
4932 */
4933 if (zonecfg_in_alt_root()) {
4934 FILE *fp;
4935 int retv;
4936
4937 if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
4938 zerror(zlogp, B_TRUE, "cannot open mapfile");
4939 return (-1);
4940 }
4941 retv = -1;
4942 if (zonecfg_lock_scratch(fp) != 0)
4943 zerror(zlogp, B_TRUE, "cannot lock mapfile");
4944 else if (zonecfg_delete_scratch(fp, kernzone) != 0)
4945 zerror(zlogp, B_TRUE, "cannot delete map entry");
4946 else
4947 retv = 0;
4948 zonecfg_close_scratch(fp);
4949 return (retv);
4950 } else {
4951 return (0);
4952 }
4953 }
4954
4955 int
4956 vplat_teardown(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting,
4957 boolean_t debug)
4958 {
4959 char *kzone;
4960 zoneid_t zoneid;
4961 int res;
4962 char pool_err[128];
4963 char zpath[MAXPATHLEN];
4964 char cmdbuf[MAXPATHLEN];
4965 brand_handle_t bh = NULL;
4966 dladm_status_t status;
4967 char errmsg[DLADM_STRSIZE];
4968 ushort_t flags;
4969
4970 kzone = zone_name;
4971 if (zonecfg_in_alt_root()) {
4972 FILE *fp;
4973
4974 if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
4975 zerror(zlogp, B_TRUE, "unable to open map file");
4976 goto error;
4977 }
4978 if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
4979 kernzone, sizeof (kernzone)) != 0) {
4980 zerror(zlogp, B_FALSE, "unable to find scratch zone");
4981 zonecfg_close_scratch(fp);
4982 goto error;
4983 }
4984 zonecfg_close_scratch(fp);
4985 kzone = kernzone;
4986 }
4987
4988 if ((zoneid = getzoneidbyname(kzone)) == ZONE_ID_UNDEFINED) {
4989 if (!bringup_failure_recovery)
4990 zerror(zlogp, B_TRUE, "unable to get zoneid");
4991 if (unmount_cmd)
4992 (void) lu_root_teardown(zlogp);
4993 goto error;
4994 }
4995
4996 if (remove_datalink_pool(zlogp, zoneid) != 0)
4997 zerror(zlogp, B_FALSE, "unable clear datalink pool property");
4998
4999 if (remove_datalink_protect(zlogp, zoneid) != 0)
5000 zerror(zlogp, B_FALSE,
5001 "unable clear datalink protect property");
5002
5003 /*
5004 * The datalinks assigned to the zone will be removed from the NGZ as
5005 * part of zone_shutdown() so that we need to remove protect/pool etc.
5006 * before zone_shutdown(). Even if the shutdown itself fails, the zone
5007 * will not be able to violate any constraints applied because the
5008 * datalinks are no longer available to the zone.
5009 */
5010 if (zone_shutdown(zoneid) != 0) {
5011 zerror(zlogp, B_TRUE, "unable to shutdown zone");
5012 goto error;
5013 }
5014
5015 /* Get the zonepath of this zone */
5016 if (zone_get_zonepath(zone_name, zpath, sizeof (zpath)) != Z_OK) {
5017 zerror(zlogp, B_FALSE, "unable to determine zone path");
5018 goto error;
5019 }
5020
5021 /* Get a handle to the brand info for this zone */
5022 if ((bh = brand_open(brand_name)) == NULL) {
5023 zerror(zlogp, B_FALSE, "unable to determine zone brand");
5024 return (-1);
5025 }
5026 /*
5027 * If there is a brand 'halt' callback, execute it now to give the
5028 * brand a chance to cleanup any custom configuration.
5029 */
5030 (void) strcpy(cmdbuf, EXEC_PREFIX);
5031 if (brand_get_halt(bh, zone_name, zpath, cmdbuf + EXEC_LEN,
5032 sizeof (cmdbuf) - EXEC_LEN) < 0) {
5033 brand_close(bh);
5034 zerror(zlogp, B_FALSE, "unable to determine branded zone's "
5035 "halt callback.");
5036 goto error;
5037 }
5038 brand_close(bh);
5039
5040 if ((strlen(cmdbuf) > EXEC_LEN) &&
5041 (do_subproc(zlogp, cmdbuf, NULL, debug) != Z_OK)) {
5042 zerror(zlogp, B_FALSE, "%s failed", cmdbuf);
5043 goto error;
5044 }
5045
5046 if (!unmount_cmd) {
5047 zone_iptype_t iptype;
5048
5049 if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
5050 sizeof (flags)) < 0) {
5051 if (vplat_get_iptype(zlogp, &iptype) < 0) {
5052 zerror(zlogp, B_TRUE, "unable to determine "
5053 "ip-type");
5054 goto error;
5055 }
5056 } else {
5057 if (flags & ZF_NET_EXCL)
5058 iptype = ZS_EXCLUSIVE;
5059 else
5060 iptype = ZS_SHARED;
5061 }
5062
5063 switch (iptype) {
5064 case ZS_SHARED:
5065 if (unconfigure_shared_network_interfaces(zlogp,
5066 zoneid) != 0) {
5067 zerror(zlogp, B_FALSE, "unable to unconfigure "
5068 "network interfaces in zone");
5069 goto error;
5070 }
5071 break;
5072 case ZS_EXCLUSIVE:
5073 status = dladm_zone_halt(dld_handle, zoneid);
5074 if (status != DLADM_STATUS_OK) {
5075 zerror(zlogp, B_FALSE, "unable to notify "
5076 "dlmgmtd of zone halt: %s",
5077 dladm_status2str(status, errmsg));
5078 }
5079 break;
5080 }
5081 }
5082
5083 if (!unmount_cmd && tcp_abort_connections(zlogp, zoneid) != 0) {
5084 zerror(zlogp, B_TRUE, "unable to abort TCP connections");
5085 goto error;
5086 }
5087
5088 if (unmount_filesystems(zlogp, zoneid, unmount_cmd) != 0) {
5089 zerror(zlogp, B_FALSE,
5090 "unable to unmount file systems in zone");
5091 goto error;
5092 }
5093
5094 /*
5095 * If we are rebooting then we normally don't want to destroy an
5096 * existing temporary pool at this point so that we can just reuse it
5097 * when the zone boots back up. However, it is also possible we were
5098 * running with a temporary pool and the zone configuration has been
5099 * modified to no longer use a temporary pool. In that case we need
5100 * to destroy the temporary pool now. This case looks like the case
5101 * where we never had a temporary pool configured but
5102 * zonecfg_destroy_tmp_pool will do the right thing either way.
5103 */
5104 if (!unmount_cmd) {
5105 boolean_t destroy_tmp_pool = B_TRUE;
5106
5107 if (rebooting) {
5108 struct zone_psettab pset_tab;
5109
5110 if (zonecfg_lookup_pset(snap_hndl, &pset_tab) == Z_OK)
5111 destroy_tmp_pool = B_FALSE;
5112 }
5113
5114 if (destroy_tmp_pool) {
5115 if ((res = zonecfg_destroy_tmp_pool(zone_name, pool_err,
5116 sizeof (pool_err))) != Z_OK) {
5117 if (res == Z_POOL)
5118 zerror(zlogp, B_FALSE, pool_err);
5119 }
5120 }
5121 }
5122
5123 remove_mlps(zlogp, zoneid);
5124
5125 if (zone_destroy(zoneid) != 0) {
5126 zerror(zlogp, B_TRUE, "unable to destroy zone");
5127 goto error;
5128 }
5129
5130 /*
5131 * Special teardown for alternate boot environments: remove the tmpfs
5132 * root for the zone and then remove it from the map file.
5133 */
5134 if (unmount_cmd && lu_root_teardown(zlogp) != 0)
5135 goto error;
5136
5137 lofs_discard_mnttab();
5138 return (0);
5139
5140 error:
5141 lofs_discard_mnttab();
5142 return (-1);
5143 }