1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved. 23 * Copyright 2013 DEY Storage Systems, Inc. 24 * Copyright (c) 2014 Gary Mills 25 */ 26 27 /* 28 * zlogin provides three types of login which allow users in the global 29 * zone to access non-global zones. 30 * 31 * - "interactive login" is similar to rlogin(1); for example, the user could 32 * issue 'zlogin my-zone' or 'zlogin -e ^ -l me my-zone'. The user is 33 * granted a new pty (which is then shoved into the zone), and an I/O 34 * loop between parent and child processes takes care of the interactive 35 * session. In this mode, login(1) (and its -c option, which means 36 * "already authenticated") is employed to take care of the initialization 37 * of the user's session. 38 * 39 * - "non-interactive login" is similar to su(1M); the user could issue 40 * 'zlogin my-zone ls -l' and the command would be run as specified. 41 * In this mode, zlogin sets up pipes as the communication channel, and 42 * 'su' is used to do the login setup work. 43 * 44 * - "console login" is the equivalent to accessing the tip line for a 45 * zone. For example, the user can issue 'zlogin -C my-zone'. 46 * In this mode, zlogin contacts the zoneadmd process via unix domain 47 * socket. If zoneadmd is not running, it starts it. This allows the 48 * console to be available anytime the zone is installed, regardless of 49 * whether it is running. 50 */ 51 52 #include <sys/socket.h> 53 #include <sys/termios.h> 54 #include <sys/utsname.h> 55 #include <sys/stat.h> 56 #include <sys/types.h> 57 #include <sys/contract/process.h> 58 #include <sys/ctfs.h> 59 #include <sys/brand.h> 60 #include <sys/wait.h> 61 #include <alloca.h> 62 #include <assert.h> 63 #include <ctype.h> 64 #include <paths.h> 65 #include <door.h> 66 #include <errno.h> 67 #include <nss_dbdefs.h> 68 #include <poll.h> 69 #include <priv.h> 70 #include <pwd.h> 71 #include <unistd.h> 72 #include <utmpx.h> 73 #include <sac.h> 74 #include <signal.h> 75 #include <stdarg.h> 76 #include <stdio.h> 77 #include <stdlib.h> 78 #include <string.h> 79 #include <strings.h> 80 #include <stropts.h> 81 #include <wait.h> 82 #include <zone.h> 83 #include <fcntl.h> 84 #include <libdevinfo.h> 85 #include <libintl.h> 86 #include <locale.h> 87 #include <libzonecfg.h> 88 #include <libcontract.h> 89 #include <libbrand.h> 90 #include <auth_list.h> 91 #include <auth_attr.h> 92 #include <secdb.h> 93 94 static int masterfd; 95 static struct termios save_termios; 96 static struct termios effective_termios; 97 static int save_fd; 98 static struct winsize winsize; 99 static volatile int dead; 100 static volatile pid_t child_pid = -1; 101 static int interactive = 0; 102 static priv_set_t *dropprivs; 103 104 static int nocmdchar = 0; 105 static int failsafe = 0; 106 static char cmdchar = '~'; 107 static int quiet = 0; 108 109 static int pollerr = 0; 110 111 static const char *pname; 112 static char *username; 113 114 /* 115 * When forced_login is true, the user is not prompted 116 * for an authentication password in the target zone. 117 */ 118 static boolean_t forced_login = B_FALSE; 119 120 #if !defined(TEXT_DOMAIN) /* should be defined by cc -D */ 121 #define TEXT_DOMAIN "SYS_TEST" /* Use this only if it wasn't */ 122 #endif 123 124 #define SUPATH "/usr/bin/su" 125 #define FAILSAFESHELL "/sbin/sh" 126 #define DEFAULTSHELL "/sbin/sh" 127 #define DEF_PATH "/usr/sbin:/usr/bin" 128 129 #define CLUSTER_BRAND_NAME "cluster" 130 131 /* 132 * The ZLOGIN_BUFSIZ is larger than PIPE_BUF so we can be sure we're clearing 133 * out the pipe when the child is exiting. The ZLOGIN_RDBUFSIZ must be less 134 * than ZLOGIN_BUFSIZ (because we share the buffer in doio). This value is 135 * also chosen in conjunction with the HI_WATER setting to make sure we 136 * don't fill up the pipe. We can write FIFOHIWAT (16k) into the pipe before 137 * blocking. By having ZLOGIN_RDBUFSIZ set to 1k and HI_WATER set to 8k, we 138 * know we can always write a ZLOGIN_RDBUFSIZ chunk into the pipe when there 139 * is less than HI_WATER data already in the pipe. 140 */ 141 #define ZLOGIN_BUFSIZ 8192 142 #define ZLOGIN_RDBUFSIZ 1024 143 #define HI_WATER 8192 144 145 /* 146 * See canonify() below. CANONIFY_LEN is the maximum length that a 147 * "canonical" sequence will expand to (backslash, three octal digits, NUL). 148 */ 149 #define CANONIFY_LEN 5 150 151 static void 152 usage(void) 153 { 154 (void) fprintf(stderr, gettext("usage: %s [ -nQCES ] [ -e cmdchar ] " 155 "[-l user] zonename [command [args ...] ]\n"), pname); 156 exit(2); 157 } 158 159 static const char * 160 getpname(const char *arg0) 161 { 162 const char *p = strrchr(arg0, '/'); 163 164 if (p == NULL) 165 p = arg0; 166 else 167 p++; 168 169 pname = p; 170 return (p); 171 } 172 173 static void 174 zerror(const char *fmt, ...) 175 { 176 va_list alist; 177 178 (void) fprintf(stderr, "%s: ", pname); 179 va_start(alist, fmt); 180 (void) vfprintf(stderr, fmt, alist); 181 va_end(alist); 182 (void) fprintf(stderr, "\n"); 183 } 184 185 static void 186 zperror(const char *str) 187 { 188 const char *estr; 189 190 if ((estr = strerror(errno)) != NULL) 191 (void) fprintf(stderr, "%s: %s: %s\n", pname, str, estr); 192 else 193 (void) fprintf(stderr, "%s: %s: errno %d\n", pname, str, errno); 194 } 195 196 /* 197 * The first part of our privilege dropping scheme needs to be called before 198 * fork(), since we must have it for security; we don't want to be surprised 199 * later that we couldn't allocate the privset. 200 */ 201 static int 202 prefork_dropprivs() 203 { 204 if ((dropprivs = priv_allocset()) == NULL) 205 return (1); 206 207 priv_basicset(dropprivs); 208 (void) priv_delset(dropprivs, PRIV_PROC_INFO); 209 (void) priv_delset(dropprivs, PRIV_PROC_FORK); 210 (void) priv_delset(dropprivs, PRIV_PROC_EXEC); 211 (void) priv_delset(dropprivs, PRIV_FILE_LINK_ANY); 212 213 /* 214 * We need to keep the basic privilege PROC_SESSION and all unknown 215 * basic privileges as well as the privileges PROC_ZONE and 216 * PROC_OWNER in order to query session information and 217 * send signals. 218 */ 219 if (interactive == 0) { 220 (void) priv_addset(dropprivs, PRIV_PROC_ZONE); 221 (void) priv_addset(dropprivs, PRIV_PROC_OWNER); 222 } else { 223 (void) priv_delset(dropprivs, PRIV_PROC_SESSION); 224 } 225 226 return (0); 227 } 228 229 /* 230 * The second part of the privilege drop. We are paranoid about being attacked 231 * by the zone, so we drop all privileges. This should prevent a compromise 232 * which gets us to fork(), exec(), symlink(), etc. 233 */ 234 static void 235 postfork_dropprivs() 236 { 237 if ((setppriv(PRIV_SET, PRIV_PERMITTED, dropprivs)) == -1) { 238 zperror(gettext("Warning: could not set permitted privileges")); 239 } 240 if ((setppriv(PRIV_SET, PRIV_LIMIT, dropprivs)) == -1) { 241 zperror(gettext("Warning: could not set limit privileges")); 242 } 243 if ((setppriv(PRIV_SET, PRIV_INHERITABLE, dropprivs)) == -1) { 244 zperror(gettext("Warning: could not set inheritable " 245 "privileges")); 246 } 247 } 248 249 /* 250 * Create the unix domain socket and call the zoneadmd server; handshake 251 * with it to determine whether it will allow us to connect. 252 */ 253 static int 254 get_console_master(const char *zname) 255 { 256 int sockfd = -1; 257 struct sockaddr_un servaddr; 258 char clientid[MAXPATHLEN]; 259 char handshake[MAXPATHLEN], c; 260 int msglen; 261 int i = 0, err = 0; 262 263 if ((sockfd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) { 264 zperror(gettext("could not create socket")); 265 return (-1); 266 } 267 268 bzero(&servaddr, sizeof (servaddr)); 269 servaddr.sun_family = AF_UNIX; 270 (void) snprintf(servaddr.sun_path, sizeof (servaddr.sun_path), 271 "%s/%s.console_sock", ZONES_TMPDIR, zname); 272 273 if (connect(sockfd, (struct sockaddr *)&servaddr, 274 sizeof (servaddr)) == -1) { 275 zperror(gettext("Could not connect to zone console")); 276 goto bad; 277 } 278 masterfd = sockfd; 279 280 msglen = snprintf(clientid, sizeof (clientid), "IDENT %lu %s\n", 281 getpid(), setlocale(LC_MESSAGES, NULL)); 282 283 if (msglen >= sizeof (clientid) || msglen < 0) { 284 zerror("protocol error"); 285 goto bad; 286 } 287 288 if (write(masterfd, clientid, msglen) != msglen) { 289 zerror("protocol error"); 290 goto bad; 291 } 292 293 bzero(handshake, sizeof (handshake)); 294 295 /* 296 * Take care not to accumulate more than our fill, and leave room for 297 * the NUL at the end. 298 */ 299 while ((err = read(masterfd, &c, 1)) == 1) { 300 if (i >= (sizeof (handshake) - 1)) 301 break; 302 if (c == '\n') 303 break; 304 handshake[i] = c; 305 i++; 306 } 307 308 /* 309 * If something went wrong during the handshake we bail; perhaps 310 * the server died off. 311 */ 312 if (err == -1) { 313 zperror(gettext("Could not connect to zone console")); 314 goto bad; 315 } 316 317 if (strncmp(handshake, "OK", sizeof (handshake)) == 0) 318 return (0); 319 320 zerror(gettext("Console is already in use by process ID %s."), 321 handshake); 322 bad: 323 (void) close(sockfd); 324 masterfd = -1; 325 return (-1); 326 } 327 328 329 /* 330 * Routines to handle pty creation upon zone entry and to shuttle I/O back 331 * and forth between the two terminals. We also compute and store the 332 * name of the slave terminal associated with the master side. 333 */ 334 static int 335 get_master_pty() 336 { 337 if ((masterfd = open("/dev/ptmx", O_RDWR|O_NONBLOCK)) < 0) { 338 zperror(gettext("failed to obtain a pseudo-tty")); 339 return (-1); 340 } 341 if (tcgetattr(STDIN_FILENO, &save_termios) == -1) { 342 zperror(gettext("failed to get terminal settings from stdin")); 343 return (-1); 344 } 345 (void) ioctl(STDIN_FILENO, TIOCGWINSZ, (char *)&winsize); 346 347 return (0); 348 } 349 350 /* 351 * This is a bit tricky; normally a pts device will belong to the zone it 352 * is granted to. But in the case of "entering" a zone, we need to establish 353 * the pty before entering the zone so that we can vector I/O to and from it 354 * from the global zone. 355 * 356 * We use the zonept() call to let the ptm driver know what we are up to; 357 * the only other hairy bit is the setting of zoneslavename (which happens 358 * above, in get_master_pty()). 359 */ 360 static int 361 init_slave_pty(zoneid_t zoneid, char *devroot) 362 { 363 int slavefd = -1; 364 char *slavename, zoneslavename[MAXPATHLEN]; 365 366 /* 367 * Set slave permissions, zone the pts, then unlock it. 368 */ 369 if (grantpt(masterfd) != 0) { 370 zperror(gettext("grantpt failed")); 371 return (-1); 372 } 373 374 if (unlockpt(masterfd) != 0) { 375 zperror(gettext("unlockpt failed")); 376 return (-1); 377 } 378 379 /* 380 * We must open the slave side before zoning this pty; otherwise 381 * the kernel would refuse us the open-- zoning a pty makes it 382 * inaccessible to the global zone. Note we are trying to open 383 * the device node via the $ZONEROOT/dev path for this pty. 384 * 385 * Later we'll close the slave out when once we've opened it again 386 * from within the target zone. Blarg. 387 */ 388 if ((slavename = ptsname(masterfd)) == NULL) { 389 zperror(gettext("failed to get name for pseudo-tty")); 390 return (-1); 391 } 392 393 (void) snprintf(zoneslavename, sizeof (zoneslavename), "%s%s", 394 devroot, slavename); 395 396 if ((slavefd = open(zoneslavename, O_RDWR)) < 0) { 397 zerror(gettext("failed to open %s: %s"), zoneslavename, 398 strerror(errno)); 399 return (-1); 400 } 401 402 /* 403 * Push hardware emulation (ptem), line discipline (ldterm), 404 * and V7/4BSD/Xenix compatibility (ttcompat) modules. 405 */ 406 if (ioctl(slavefd, I_PUSH, "ptem") == -1) { 407 zperror(gettext("failed to push ptem module")); 408 if (!failsafe) 409 goto bad; 410 } 411 412 /* 413 * Anchor the stream to prevent malicious I_POPs; we prefer to do 414 * this prior to entering the zone so that we can detect any errors 415 * early, and so that we can set the anchor from the global zone. 416 */ 417 if (ioctl(slavefd, I_ANCHOR) == -1) { 418 zperror(gettext("failed to set stream anchor")); 419 if (!failsafe) 420 goto bad; 421 } 422 423 if (ioctl(slavefd, I_PUSH, "ldterm") == -1) { 424 zperror(gettext("failed to push ldterm module")); 425 if (!failsafe) 426 goto bad; 427 } 428 if (ioctl(slavefd, I_PUSH, "ttcompat") == -1) { 429 zperror(gettext("failed to push ttcompat module")); 430 if (!failsafe) 431 goto bad; 432 } 433 434 /* 435 * Propagate terminal settings from the external term to the new one. 436 */ 437 if (tcsetattr(slavefd, TCSAFLUSH, &save_termios) == -1) { 438 zperror(gettext("failed to set terminal settings")); 439 if (!failsafe) 440 goto bad; 441 } 442 (void) ioctl(slavefd, TIOCSWINSZ, (char *)&winsize); 443 444 if (zonept(masterfd, zoneid) != 0) { 445 zperror(gettext("could not set zoneid of pty")); 446 goto bad; 447 } 448 449 return (slavefd); 450 451 bad: 452 (void) close(slavefd); 453 return (-1); 454 } 455 456 /* 457 * Place terminal into raw mode. 458 */ 459 static int 460 set_tty_rawmode(int fd) 461 { 462 struct termios term; 463 if (tcgetattr(fd, &term) < 0) { 464 zperror(gettext("failed to get user terminal settings")); 465 return (-1); 466 } 467 468 /* Stash for later, so we can revert back to previous mode */ 469 save_termios = term; 470 save_fd = fd; 471 472 /* disable 8->7 bit strip, start/stop, enable any char to restart */ 473 term.c_iflag &= ~(ISTRIP|IXON|IXANY); 474 /* disable NL->CR, CR->NL, ignore CR, UPPER->lower */ 475 term.c_iflag &= ~(INLCR|ICRNL|IGNCR|IUCLC); 476 /* disable output post-processing */ 477 term.c_oflag &= ~OPOST; 478 /* disable canonical mode, signal chars, echo & extended functions */ 479 term.c_lflag &= ~(ICANON|ISIG|ECHO|IEXTEN); 480 481 term.c_cc[VMIN] = 1; /* byte-at-a-time */ 482 term.c_cc[VTIME] = 0; 483 484 if (tcsetattr(STDIN_FILENO, TCSAFLUSH, &term)) { 485 zperror(gettext("failed to set user terminal to raw mode")); 486 return (-1); 487 } 488 489 /* 490 * We need to know the value of VEOF so that we can properly process for 491 * client-side ~<EOF>. But we have obliterated VEOF in term, 492 * because VMIN overloads the same array slot in non-canonical mode. 493 * Stupid @&^%! 494 * 495 * So here we construct the "effective" termios from the current 496 * terminal settings, and the corrected VEOF and VEOL settings. 497 */ 498 if (tcgetattr(STDIN_FILENO, &effective_termios) < 0) { 499 zperror(gettext("failed to get user terminal settings")); 500 return (-1); 501 } 502 effective_termios.c_cc[VEOF] = save_termios.c_cc[VEOF]; 503 effective_termios.c_cc[VEOL] = save_termios.c_cc[VEOL]; 504 505 return (0); 506 } 507 508 /* 509 * Copy terminal window size from our terminal to the pts. 510 */ 511 /*ARGSUSED*/ 512 static void 513 sigwinch(int s) 514 { 515 struct winsize ws; 516 517 if (ioctl(0, TIOCGWINSZ, &ws) == 0) 518 (void) ioctl(masterfd, TIOCSWINSZ, &ws); 519 } 520 521 static volatile int close_on_sig = -1; 522 523 static void 524 /*ARGSUSED*/ 525 sigcld(int s) 526 { 527 int status; 528 pid_t pid; 529 530 /* 531 * Peek at the exit status. If this isn't the process we cared 532 * about, then just reap it. 533 */ 534 if ((pid = waitpid(child_pid, &status, WNOHANG|WNOWAIT)) != -1) { 535 if (pid == child_pid && 536 (WIFEXITED(status) || WIFSIGNALED(status))) { 537 dead = 1; 538 if (close_on_sig != -1) { 539 (void) write(close_on_sig, "a", 1); 540 (void) close(close_on_sig); 541 close_on_sig = -1; 542 } 543 } else { 544 (void) waitpid(pid, &status, WNOHANG); 545 } 546 } 547 } 548 549 /* 550 * Some signals (currently, SIGINT) must be forwarded on to the process 551 * group of the child process. 552 */ 553 static void 554 sig_forward(int s) 555 { 556 if (child_pid != -1) { 557 pid_t pgid = getpgid(child_pid); 558 if (pgid != -1) 559 (void) sigsend(P_PGID, pgid, s); 560 } 561 } 562 563 /* 564 * reset terminal settings for global environment 565 */ 566 static void 567 reset_tty() 568 { 569 (void) tcsetattr(save_fd, TCSADRAIN, &save_termios); 570 } 571 572 /* 573 * Convert character to printable representation, for display with locally 574 * echoed command characters (like when we need to display ~^D) 575 */ 576 static void 577 canonify(char c, char *cc) 578 { 579 if (isprint(c)) { 580 cc[0] = c; 581 cc[1] = '\0'; 582 } else if (c >= 0 && c <= 31) { /* ^@ through ^_ */ 583 cc[0] = '^'; 584 cc[1] = c + '@'; 585 cc[2] = '\0'; 586 } else { 587 cc[0] = '\\'; 588 cc[1] = ((c >> 6) & 7) + '0'; 589 cc[2] = ((c >> 3) & 7) + '0'; 590 cc[3] = (c & 7) + '0'; 591 cc[4] = '\0'; 592 } 593 } 594 595 /* 596 * process_user_input watches the input stream for the escape sequence for 597 * 'quit' (by default, tilde-period). Because we might be fed just one 598 * keystroke at a time, state associated with the user input (are we at the 599 * beginning of the line? are we locally echoing the next character?) is 600 * maintained by beginning_of_line and local_echo across calls to the routine. 601 * If the write to outfd fails, we'll try to read from infd in an attempt 602 * to prevent deadlock between the two processes. 603 * 604 * This routine returns -1 when the 'quit' escape sequence has been issued, 605 * or an error is encountered, 1 if stdin is EOF, and 0 otherwise. 606 */ 607 static int 608 process_user_input(int outfd, int infd) 609 { 610 static boolean_t beginning_of_line = B_TRUE; 611 static boolean_t local_echo = B_FALSE; 612 char ibuf[ZLOGIN_BUFSIZ]; 613 int nbytes; 614 char *buf = ibuf; 615 char c = *buf; 616 617 nbytes = read(STDIN_FILENO, ibuf, ZLOGIN_RDBUFSIZ); 618 if (nbytes == -1 && (errno != EINTR || dead)) 619 return (-1); 620 621 if (nbytes == -1) /* The read was interrupted. */ 622 return (0); 623 624 /* 0 read means EOF, close the pipe to the child */ 625 if (nbytes == 0) 626 return (1); 627 628 for (c = *buf; nbytes > 0; c = *buf, --nbytes) { 629 buf++; 630 if (beginning_of_line && !nocmdchar) { 631 beginning_of_line = B_FALSE; 632 if (c == cmdchar) { 633 local_echo = B_TRUE; 634 continue; 635 } 636 } else if (local_echo) { 637 local_echo = B_FALSE; 638 if (c == '.' || c == effective_termios.c_cc[VEOF]) { 639 char cc[CANONIFY_LEN]; 640 641 canonify(c, cc); 642 (void) write(STDOUT_FILENO, &cmdchar, 1); 643 (void) write(STDOUT_FILENO, cc, strlen(cc)); 644 return (-1); 645 } 646 } 647 retry: 648 if (write(outfd, &c, 1) <= 0) { 649 /* 650 * Since the fd we are writing to is opened with 651 * O_NONBLOCK it is possible to get EAGAIN if the 652 * pipe is full. One way this could happen is if we 653 * are writing a lot of data into the pipe in this loop 654 * and the application on the other end is echoing that 655 * data back out to its stdout. The output pipe can 656 * fill up since we are stuck here in this loop and not 657 * draining the other pipe. We can try to read some of 658 * the data to see if we can drain the pipe so that the 659 * application can continue to make progress. The read 660 * is non-blocking so we won't hang here. We also wait 661 * a bit before retrying since there could be other 662 * reasons why the pipe is full and we don't want to 663 * continuously retry. 664 */ 665 if (errno == EAGAIN) { 666 struct timespec rqtp; 667 int ln; 668 char obuf[ZLOGIN_BUFSIZ]; 669 670 if ((ln = read(infd, obuf, ZLOGIN_BUFSIZ)) > 0) 671 (void) write(STDOUT_FILENO, obuf, ln); 672 673 /* sleep for 10 milliseconds */ 674 rqtp.tv_sec = 0; 675 rqtp.tv_nsec = 10 * (NANOSEC / MILLISEC); 676 (void) nanosleep(&rqtp, NULL); 677 if (!dead) 678 goto retry; 679 } 680 681 return (-1); 682 } 683 beginning_of_line = (c == '\r' || c == '\n' || 684 c == effective_termios.c_cc[VKILL] || 685 c == effective_termios.c_cc[VEOL] || 686 c == effective_termios.c_cc[VSUSP] || 687 c == effective_termios.c_cc[VINTR]); 688 } 689 return (0); 690 } 691 692 /* 693 * This function prevents deadlock between zlogin and the application in the 694 * zone that it is talking to. This can happen when we read from zlogin's 695 * stdin and write the data down the pipe to the application. If the pipe 696 * is full, we'll block in the write. Because zlogin could be blocked in 697 * the write, it would never read the application's stdout/stderr so the 698 * application can then block on those writes (when the pipe fills up). If the 699 * the application gets blocked this way, it can never get around to reading 700 * its stdin so that zlogin can unblock from its write. Once in this state, 701 * the two processes are deadlocked. 702 * 703 * To prevent this, we want to verify that we can write into the pipe before we 704 * read from our stdin. If the pipe already is pretty full, we bypass the read 705 * for now. We'll circle back here again after the poll() so that we can 706 * try again. When this function is called, we already know there is data 707 * ready to read on STDIN_FILENO. We return -1 if there is a problem, 1 if 708 * stdin is EOF, and 0 if everything is ok (even though we might not have 709 * read/written any data into the pipe on this iteration). 710 */ 711 static int 712 process_raw_input(int stdin_fd, int appin_fd) 713 { 714 int cc; 715 struct stat64 sb; 716 char ibuf[ZLOGIN_RDBUFSIZ]; 717 718 /* Check how much data is already in the pipe */ 719 if (fstat64(appin_fd, &sb) == -1) { 720 perror("stat failed"); 721 return (-1); 722 } 723 724 if (dead) 725 return (-1); 726 727 /* 728 * The pipe already has a lot of data in it, don't write any more 729 * right now. 730 */ 731 if (sb.st_size >= HI_WATER) 732 return (0); 733 734 cc = read(STDIN_FILENO, ibuf, ZLOGIN_RDBUFSIZ); 735 if (cc == -1 && (errno != EINTR || dead)) 736 return (-1); 737 738 if (cc == -1) /* The read was interrupted. */ 739 return (0); 740 741 /* 0 read means EOF, close the pipe to the child */ 742 if (cc == 0) 743 return (1); 744 745 /* 746 * stdin_fd is stdin of the target; so, the thing we'll write the user 747 * data *to*. 748 */ 749 if (write(stdin_fd, ibuf, cc) == -1) 750 return (-1); 751 752 return (0); 753 } 754 755 /* 756 * Write the output from the application running in the zone. We can get 757 * a signal during the write (usually it would be SIGCHLD when the application 758 * has exited) so we loop to make sure we have written all of the data we read. 759 */ 760 static int 761 process_output(int in_fd, int out_fd) 762 { 763 int wrote = 0; 764 int cc; 765 char ibuf[ZLOGIN_BUFSIZ]; 766 767 cc = read(in_fd, ibuf, ZLOGIN_BUFSIZ); 768 if (cc == -1 && (errno != EINTR || dead)) 769 return (-1); 770 if (cc == 0) /* EOF */ 771 return (-1); 772 if (cc == -1) /* The read was interrupted. */ 773 return (0); 774 775 do { 776 int len; 777 778 len = write(out_fd, ibuf + wrote, cc - wrote); 779 if (len == -1 && errno != EINTR) 780 return (-1); 781 if (len != -1) 782 wrote += len; 783 } while (wrote < cc); 784 785 return (0); 786 } 787 788 /* 789 * This is the main I/O loop, and is shared across all zlogin modes. 790 * Parameters: 791 * stdin_fd: The fd representing 'stdin' for the slave side; input to 792 * the zone will be written here. 793 * 794 * appin_fd: The fd representing the other end of the 'stdin' pipe (when 795 * we're running non-interactive); used in process_raw_input 796 * to ensure we don't fill up the application's stdin pipe. 797 * 798 * stdout_fd: The fd representing 'stdout' for the slave side; output 799 * from the zone will arrive here. 800 * 801 * stderr_fd: The fd representing 'stderr' for the slave side; output 802 * from the zone will arrive here. 803 * 804 * raw_mode: If TRUE, then no processing (for example, for '~.') will 805 * be performed on the input coming from STDIN. 806 * 807 * stderr_fd may be specified as -1 if there is no stderr (only non-interactive 808 * mode supplies a stderr). 809 * 810 */ 811 static void 812 doio(int stdin_fd, int appin_fd, int stdout_fd, int stderr_fd, int sig_fd, 813 boolean_t raw_mode) 814 { 815 struct pollfd pollfds[4]; 816 char ibuf[ZLOGIN_BUFSIZ]; 817 int cc, ret; 818 819 /* read from stdout of zone and write to stdout of global zone */ 820 pollfds[0].fd = stdout_fd; 821 pollfds[0].events = POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI; 822 823 /* read from stderr of zone and write to stderr of global zone */ 824 pollfds[1].fd = stderr_fd; 825 pollfds[1].events = pollfds[0].events; 826 827 /* read from stdin of global zone and write to stdin of zone */ 828 pollfds[2].fd = STDIN_FILENO; 829 pollfds[2].events = pollfds[0].events; 830 831 /* read from signalling pipe so we know when child dies */ 832 pollfds[3].fd = sig_fd; 833 pollfds[3].events = pollfds[0].events; 834 835 for (;;) { 836 pollfds[0].revents = pollfds[1].revents = 837 pollfds[2].revents = pollfds[3].revents = 0; 838 839 if (dead) 840 break; 841 842 /* 843 * There is a race condition here where we can receive the 844 * child death signal, set the dead flag, but since we have 845 * passed the test above, we would go into poll and hang. 846 * To avoid this we use the sig_fd as an additional poll fd. 847 * The signal handler writes into the other end of this pipe 848 * when the child dies so that the poll will always see that 849 * input and proceed. We just loop around at that point and 850 * then notice the dead flag. 851 */ 852 853 ret = poll(pollfds, 854 sizeof (pollfds) / sizeof (struct pollfd), -1); 855 856 if (ret == -1 && errno != EINTR) { 857 perror("poll failed"); 858 break; 859 } 860 861 if (errno == EINTR && dead) { 862 break; 863 } 864 865 /* event from master side stdout */ 866 if (pollfds[0].revents) { 867 if (pollfds[0].revents & 868 (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) { 869 if (process_output(stdout_fd, STDOUT_FILENO) 870 != 0) 871 break; 872 } else { 873 pollerr = pollfds[0].revents; 874 break; 875 } 876 } 877 878 /* event from master side stderr */ 879 if (pollfds[1].revents) { 880 if (pollfds[1].revents & 881 (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) { 882 if (process_output(stderr_fd, STDERR_FILENO) 883 != 0) 884 break; 885 } else { 886 pollerr = pollfds[1].revents; 887 break; 888 } 889 } 890 891 /* event from user STDIN side */ 892 if (pollfds[2].revents) { 893 if (pollfds[2].revents & 894 (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) { 895 /* 896 * stdin fd is stdin of the target; so, 897 * the thing we'll write the user data *to*. 898 * 899 * Also, unlike on the output side, we 900 * close the pipe on a zero-length message. 901 */ 902 int res; 903 904 if (raw_mode) 905 res = process_raw_input(stdin_fd, 906 appin_fd); 907 else 908 res = process_user_input(stdin_fd, 909 stdout_fd); 910 911 if (res < 0) 912 break; 913 if (res > 0) { 914 /* EOF (close) child's stdin_fd */ 915 pollfds[2].fd = -1; 916 while ((res = close(stdin_fd)) != 0 && 917 errno == EINTR) 918 ; 919 if (res != 0) 920 break; 921 } 922 923 } else if (raw_mode && pollfds[2].revents & POLLHUP) { 924 /* 925 * It's OK to get a POLLHUP on STDIN-- it 926 * always happens if you do: 927 * 928 * echo foo | zlogin <zone> <command> 929 * 930 * We reset fd to -1 in this case to clear 931 * the condition and close the pipe (EOF) to 932 * the other side in order to wrap things up. 933 */ 934 int res; 935 936 pollfds[2].fd = -1; 937 while ((res = close(stdin_fd)) != 0 && 938 errno == EINTR) 939 ; 940 if (res != 0) 941 break; 942 } else { 943 pollerr = pollfds[2].revents; 944 break; 945 } 946 } 947 } 948 949 /* 950 * We are in the midst of dying, but try to poll with a short 951 * timeout to see if we can catch the last bit of I/O from the 952 * children. 953 */ 954 retry: 955 pollfds[0].revents = pollfds[1].revents = 0; 956 (void) poll(pollfds, 2, 100); 957 if (pollfds[0].revents & 958 (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) { 959 if ((cc = read(stdout_fd, ibuf, ZLOGIN_BUFSIZ)) > 0) { 960 (void) write(STDOUT_FILENO, ibuf, cc); 961 goto retry; 962 } 963 } 964 if (pollfds[1].revents & 965 (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) { 966 if ((cc = read(stderr_fd, ibuf, ZLOGIN_BUFSIZ)) > 0) { 967 (void) write(STDERR_FILENO, ibuf, cc); 968 goto retry; 969 } 970 } 971 } 972 973 /* 974 * Fetch the user_cmd brand hook for getting a user's passwd(4) entry. 975 */ 976 static const char * 977 zone_get_user_cmd(brand_handle_t bh, const char *login, char *user_cmd, 978 size_t len) 979 { 980 bzero(user_cmd, sizeof (user_cmd)); 981 if (brand_get_user_cmd(bh, login, user_cmd, len) != 0) 982 return (NULL); 983 984 return (user_cmd); 985 } 986 987 /* From libc */ 988 extern int str2passwd(const char *, int, void *, char *, int); 989 990 /* 991 * exec() the user_cmd brand hook, and convert the output string to a 992 * struct passwd. This is to be called after zone_enter(). 993 * 994 */ 995 static struct passwd * 996 zone_get_user_pw(const char *user_cmd, struct passwd *pwent, char *pwbuf, 997 int pwbuflen) 998 { 999 char pwline[NSS_BUFLEN_PASSWD]; 1000 char *cin = NULL; 1001 FILE *fin; 1002 int status; 1003 1004 assert(getzoneid() != GLOBAL_ZONEID); 1005 1006 if ((fin = popen(user_cmd, "r")) == NULL) 1007 return (NULL); 1008 1009 while (cin == NULL && !feof(fin)) 1010 cin = fgets(pwline, sizeof (pwline), fin); 1011 1012 if (cin == NULL) { 1013 (void) pclose(fin); 1014 return (NULL); 1015 } 1016 1017 status = pclose(fin); 1018 if (!WIFEXITED(status)) 1019 return (NULL); 1020 if (WEXITSTATUS(status) != 0) 1021 return (NULL); 1022 1023 if (str2passwd(pwline, sizeof (pwline), pwent, pwbuf, pwbuflen) == 0) 1024 return (pwent); 1025 else 1026 return (NULL); 1027 } 1028 1029 static char ** 1030 zone_login_cmd(brand_handle_t bh, const char *login) 1031 { 1032 static char result_buf[ARG_MAX]; 1033 char **new_argv, *ptr, *lasts; 1034 int n, a; 1035 1036 /* Get the login command for the target zone. */ 1037 bzero(result_buf, sizeof (result_buf)); 1038 1039 if (forced_login) { 1040 if (brand_get_forcedlogin_cmd(bh, login, 1041 result_buf, sizeof (result_buf)) != 0) 1042 return (NULL); 1043 } else { 1044 if (brand_get_login_cmd(bh, login, 1045 result_buf, sizeof (result_buf)) != 0) 1046 return (NULL); 1047 } 1048 1049 /* 1050 * We got back a string that we'd like to execute. But since 1051 * we're not doing the execution via a shell we'll need to convert 1052 * the exec string to an array of strings. We'll do that here 1053 * but we're going to be very simplistic about it and break stuff 1054 * up based on spaces. We're not even going to support any kind 1055 * of quoting or escape characters. It's truly amazing that 1056 * there is no library function in OpenSolaris to do this for us. 1057 */ 1058 1059 /* 1060 * Be paranoid. Since we're deliniating based on spaces make 1061 * sure there are no adjacent spaces. 1062 */ 1063 if (strstr(result_buf, " ") != NULL) 1064 return (NULL); 1065 1066 /* Remove any trailing whitespace. */ 1067 n = strlen(result_buf); 1068 if (result_buf[n - 1] == ' ') 1069 result_buf[n - 1] = '\0'; 1070 1071 /* Count how many elements there are in the exec string. */ 1072 ptr = result_buf; 1073 for (n = 2; ((ptr = strchr(ptr + 1, (int)' ')) != NULL); n++) 1074 ; 1075 1076 /* Allocate the argv array that we're going to return. */ 1077 if ((new_argv = malloc(sizeof (char *) * n)) == NULL) 1078 return (NULL); 1079 1080 /* Tokenize the exec string and return. */ 1081 a = 0; 1082 new_argv[a++] = result_buf; 1083 if (n > 2) { 1084 (void) strtok_r(result_buf, " ", &lasts); 1085 while ((new_argv[a++] = strtok_r(NULL, " ", &lasts)) != NULL) 1086 ; 1087 } else { 1088 new_argv[a++] = NULL; 1089 } 1090 assert(n == a); 1091 return (new_argv); 1092 } 1093 1094 /* 1095 * Prepare argv array for exec'd process; if we're passing commands to the 1096 * new process, then use su(1M) to do the invocation. Otherwise, use 1097 * 'login -z <from_zonename> -f' (-z is an undocumented option which tells 1098 * login that we're coming from another zone, and to disregard its CONSOLE 1099 * checks). 1100 */ 1101 static char ** 1102 prep_args(brand_handle_t bh, const char *login, char **argv) 1103 { 1104 int argc = 0, a = 0, i, n = -1; 1105 char **new_argv; 1106 1107 if (argv != NULL) { 1108 size_t subshell_len = 1; 1109 char *subshell; 1110 1111 while (argv[argc] != NULL) 1112 argc++; 1113 1114 for (i = 0; i < argc; i++) { 1115 subshell_len += strlen(argv[i]) + 1; 1116 } 1117 if ((subshell = calloc(1, subshell_len)) == NULL) 1118 return (NULL); 1119 1120 for (i = 0; i < argc; i++) { 1121 (void) strcat(subshell, argv[i]); 1122 (void) strcat(subshell, " "); 1123 } 1124 1125 if (failsafe) { 1126 n = 4; 1127 if ((new_argv = malloc(sizeof (char *) * n)) == NULL) 1128 return (NULL); 1129 1130 new_argv[a++] = FAILSAFESHELL; 1131 } else { 1132 n = 5; 1133 if ((new_argv = malloc(sizeof (char *) * n)) == NULL) 1134 return (NULL); 1135 1136 new_argv[a++] = SUPATH; 1137 if (strcmp(login, "root") != 0) { 1138 new_argv[a++] = "-"; 1139 n++; 1140 } 1141 new_argv[a++] = (char *)login; 1142 } 1143 new_argv[a++] = "-c"; 1144 new_argv[a++] = subshell; 1145 new_argv[a++] = NULL; 1146 assert(a == n); 1147 } else { 1148 if (failsafe) { 1149 n = 2; 1150 if ((new_argv = malloc(sizeof (char *) * n)) == NULL) 1151 return (NULL); 1152 new_argv[a++] = FAILSAFESHELL; 1153 new_argv[a++] = NULL; 1154 assert(n == a); 1155 } else { 1156 new_argv = zone_login_cmd(bh, login); 1157 } 1158 } 1159 1160 return (new_argv); 1161 } 1162 1163 /* 1164 * Helper routine for prep_env below. 1165 */ 1166 static char * 1167 add_env(char *name, char *value) 1168 { 1169 size_t sz = strlen(name) + strlen(value) + 2; /* name, =, value, NUL */ 1170 char *str; 1171 1172 if ((str = malloc(sz)) == NULL) 1173 return (NULL); 1174 1175 (void) snprintf(str, sz, "%s=%s", name, value); 1176 return (str); 1177 } 1178 1179 /* 1180 * Prepare envp array for exec'd process. 1181 */ 1182 static char ** 1183 prep_env() 1184 { 1185 int e = 0, size = 1; 1186 char **new_env, *estr; 1187 char *term = getenv("TERM"); 1188 1189 size++; /* for $PATH */ 1190 if (term != NULL) 1191 size++; 1192 1193 /* 1194 * In failsafe mode we set $HOME, since '-l' isn't valid in this mode. 1195 * We also set $SHELL, since neither login nor su will be around to do 1196 * it. 1197 */ 1198 if (failsafe) 1199 size += 2; 1200 1201 if ((new_env = malloc(sizeof (char *) * size)) == NULL) 1202 return (NULL); 1203 1204 if ((estr = add_env("PATH", DEF_PATH)) == NULL) 1205 return (NULL); 1206 new_env[e++] = estr; 1207 1208 if (term != NULL) { 1209 if ((estr = add_env("TERM", term)) == NULL) 1210 return (NULL); 1211 new_env[e++] = estr; 1212 } 1213 1214 if (failsafe) { 1215 if ((estr = add_env("HOME", "/")) == NULL) 1216 return (NULL); 1217 new_env[e++] = estr; 1218 1219 if ((estr = add_env("SHELL", FAILSAFESHELL)) == NULL) 1220 return (NULL); 1221 new_env[e++] = estr; 1222 } 1223 1224 new_env[e++] = NULL; 1225 1226 assert(e == size); 1227 1228 return (new_env); 1229 } 1230 1231 /* 1232 * Finish the preparation of the envp array for exec'd non-interactive 1233 * zlogins. This is called in the child process *after* we zone_enter(), since 1234 * it derives things we can only know within the zone, such as $HOME, $SHELL, 1235 * etc. We need only do this in the non-interactive, mode, since otherwise 1236 * login(1) will do it. We don't do this in failsafe mode, since it presents 1237 * additional ways in which the command could fail, and we'd prefer to avoid 1238 * that. 1239 */ 1240 static char ** 1241 prep_env_noninteractive(const char *user_cmd, char **env) 1242 { 1243 size_t size; 1244 char **new_env; 1245 int e, i; 1246 char *estr; 1247 char varmail[LOGNAME_MAX + 11]; /* strlen(/var/mail/) = 10, NUL */ 1248 char pwbuf[NSS_BUFLEN_PASSWD + 1]; 1249 struct passwd pwent; 1250 struct passwd *pw = NULL; 1251 1252 assert(env != NULL); 1253 assert(failsafe == 0); 1254 1255 /* 1256 * Exec the "user_cmd" brand hook to get a pwent for the 1257 * login user. If this fails, HOME will be set to "/", SHELL 1258 * will be set to $DEFAULTSHELL, and we will continue to exec 1259 * SUPATH <login> -c <cmd>. 1260 */ 1261 pw = zone_get_user_pw(user_cmd, &pwent, pwbuf, sizeof (pwbuf)); 1262 1263 /* 1264 * Get existing envp size. 1265 */ 1266 for (size = 0; env[size] != NULL; size++) 1267 ; 1268 1269 e = size; 1270 1271 /* 1272 * Finish filling out the environment; we duplicate the environment 1273 * setup described in login(1), for lack of a better precedent. 1274 */ 1275 if (pw != NULL) 1276 size += 3; /* LOGNAME, HOME, MAIL */ 1277 else 1278 size += 1; /* HOME */ 1279 1280 size++; /* always fill in SHELL */ 1281 size++; /* terminating NULL */ 1282 1283 if ((new_env = malloc(sizeof (char *) * size)) == NULL) 1284 goto malloc_fail; 1285 1286 /* 1287 * Copy existing elements of env into new_env. 1288 */ 1289 for (i = 0; env[i] != NULL; i++) { 1290 if ((new_env[i] = strdup(env[i])) == NULL) 1291 goto malloc_fail; 1292 } 1293 assert(e == i); 1294 1295 if (pw != NULL) { 1296 if ((estr = add_env("LOGNAME", pw->pw_name)) == NULL) 1297 goto malloc_fail; 1298 new_env[e++] = estr; 1299 1300 if ((estr = add_env("HOME", pw->pw_dir)) == NULL) 1301 goto malloc_fail; 1302 new_env[e++] = estr; 1303 1304 if (chdir(pw->pw_dir) != 0) 1305 zerror(gettext("Could not chdir to home directory " 1306 "%s: %s"), pw->pw_dir, strerror(errno)); 1307 1308 (void) snprintf(varmail, sizeof (varmail), "/var/mail/%s", 1309 pw->pw_name); 1310 if ((estr = add_env("MAIL", varmail)) == NULL) 1311 goto malloc_fail; 1312 new_env[e++] = estr; 1313 } else { 1314 if ((estr = add_env("HOME", "/")) == NULL) 1315 goto malloc_fail; 1316 new_env[e++] = estr; 1317 } 1318 1319 if (pw != NULL && strlen(pw->pw_shell) > 0) { 1320 if ((estr = add_env("SHELL", pw->pw_shell)) == NULL) 1321 goto malloc_fail; 1322 new_env[e++] = estr; 1323 } else { 1324 if ((estr = add_env("SHELL", DEFAULTSHELL)) == NULL) 1325 goto malloc_fail; 1326 new_env[e++] = estr; 1327 } 1328 1329 new_env[e++] = NULL; /* add terminating NULL */ 1330 1331 assert(e == size); 1332 return (new_env); 1333 1334 malloc_fail: 1335 zperror(gettext("failed to allocate memory for process environment")); 1336 return (NULL); 1337 } 1338 1339 static int 1340 close_func(void *slavefd, int fd) 1341 { 1342 if (fd != *(int *)slavefd) 1343 (void) close(fd); 1344 return (0); 1345 } 1346 1347 static void 1348 set_cmdchar(char *cmdcharstr) 1349 { 1350 char c; 1351 long lc; 1352 1353 if ((c = *cmdcharstr) != '\\') { 1354 cmdchar = c; 1355 return; 1356 } 1357 1358 c = cmdcharstr[1]; 1359 if (c == '\0' || c == '\\') { 1360 cmdchar = '\\'; 1361 return; 1362 } 1363 1364 if (c < '0' || c > '7') { 1365 zerror(gettext("Unrecognized escape character option %s"), 1366 cmdcharstr); 1367 usage(); 1368 } 1369 1370 lc = strtol(cmdcharstr + 1, NULL, 8); 1371 if (lc < 0 || lc > 255) { 1372 zerror(gettext("Octal escape character '%s' too large"), 1373 cmdcharstr); 1374 usage(); 1375 } 1376 cmdchar = (char)lc; 1377 } 1378 1379 static int 1380 setup_utmpx(char *slavename) 1381 { 1382 struct utmpx ut; 1383 1384 bzero(&ut, sizeof (ut)); 1385 (void) strncpy(ut.ut_user, ".zlogin", sizeof (ut.ut_user)); 1386 (void) strncpy(ut.ut_line, slavename, sizeof (ut.ut_line)); 1387 ut.ut_pid = getpid(); 1388 ut.ut_id[0] = 'z'; 1389 ut.ut_id[1] = ut.ut_id[2] = ut.ut_id[3] = (char)SC_WILDC; 1390 ut.ut_type = LOGIN_PROCESS; 1391 (void) time(&ut.ut_tv.tv_sec); 1392 1393 if (makeutx(&ut) == NULL) { 1394 zerror(gettext("makeutx failed")); 1395 return (-1); 1396 } 1397 return (0); 1398 } 1399 1400 static void 1401 release_lock_file(int lockfd) 1402 { 1403 (void) close(lockfd); 1404 } 1405 1406 static int 1407 grab_lock_file(const char *zone_name, int *lockfd) 1408 { 1409 char pathbuf[PATH_MAX]; 1410 struct flock flock; 1411 1412 if (mkdir(ZONES_TMPDIR, S_IRWXU) < 0 && errno != EEXIST) { 1413 zerror(gettext("could not mkdir %s: %s"), ZONES_TMPDIR, 1414 strerror(errno)); 1415 return (-1); 1416 } 1417 (void) chmod(ZONES_TMPDIR, S_IRWXU); 1418 (void) snprintf(pathbuf, sizeof (pathbuf), "%s/%s.zoneadm.lock", 1419 ZONES_TMPDIR, zone_name); 1420 1421 if ((*lockfd = open(pathbuf, O_RDWR|O_CREAT, S_IRUSR|S_IWUSR)) < 0) { 1422 zerror(gettext("could not open %s: %s"), pathbuf, 1423 strerror(errno)); 1424 return (-1); 1425 } 1426 /* 1427 * Lock the file to synchronize with other zoneadmds 1428 */ 1429 flock.l_type = F_WRLCK; 1430 flock.l_whence = SEEK_SET; 1431 flock.l_start = (off_t)0; 1432 flock.l_len = (off_t)0; 1433 if (fcntl(*lockfd, F_SETLKW, &flock) < 0) { 1434 zerror(gettext("unable to lock %s: %s"), pathbuf, 1435 strerror(errno)); 1436 release_lock_file(*lockfd); 1437 return (-1); 1438 } 1439 return (Z_OK); 1440 } 1441 1442 static int 1443 start_zoneadmd(const char *zone_name) 1444 { 1445 pid_t retval; 1446 int pstatus = 0, error = -1, lockfd, doorfd; 1447 struct door_info info; 1448 char doorpath[MAXPATHLEN]; 1449 1450 (void) snprintf(doorpath, sizeof (doorpath), ZONE_DOOR_PATH, zone_name); 1451 1452 if (grab_lock_file(zone_name, &lockfd) != Z_OK) 1453 return (-1); 1454 /* 1455 * We must do the door check with the lock held. Otherwise, we 1456 * might race against another zoneadm/zlogin process and wind 1457 * up with two processes trying to start zoneadmd at the same 1458 * time. zoneadmd will detect this, and fail, but we prefer this 1459 * to be as seamless as is practical, from a user perspective. 1460 */ 1461 if ((doorfd = open(doorpath, O_RDONLY)) < 0) { 1462 if (errno != ENOENT) { 1463 zerror("failed to open %s: %s", doorpath, 1464 strerror(errno)); 1465 goto out; 1466 } 1467 } else { 1468 /* 1469 * Seems to be working ok. 1470 */ 1471 if (door_info(doorfd, &info) == 0 && 1472 ((info.di_attributes & DOOR_REVOKED) == 0)) { 1473 error = 0; 1474 goto out; 1475 } 1476 } 1477 1478 if ((child_pid = fork()) == -1) { 1479 zperror(gettext("could not fork")); 1480 goto out; 1481 } else if (child_pid == 0) { 1482 /* child process */ 1483 (void) execl("/usr/lib/zones/zoneadmd", "zoneadmd", "-z", 1484 zone_name, NULL); 1485 zperror(gettext("could not exec zoneadmd")); 1486 _exit(1); 1487 } 1488 1489 /* parent process */ 1490 do { 1491 retval = waitpid(child_pid, &pstatus, 0); 1492 } while (retval != child_pid); 1493 if (WIFSIGNALED(pstatus) || 1494 (WIFEXITED(pstatus) && WEXITSTATUS(pstatus) != 0)) { 1495 zerror(gettext("could not start %s"), "zoneadmd"); 1496 goto out; 1497 } 1498 error = 0; 1499 out: 1500 release_lock_file(lockfd); 1501 (void) close(doorfd); 1502 return (error); 1503 } 1504 1505 static int 1506 init_template(void) 1507 { 1508 int fd; 1509 int err = 0; 1510 1511 fd = open64(CTFS_ROOT "/process/template", O_RDWR); 1512 if (fd == -1) 1513 return (-1); 1514 1515 /* 1516 * zlogin doesn't do anything with the contract. 1517 * Deliver no events, don't inherit, and allow it to be orphaned. 1518 */ 1519 err |= ct_tmpl_set_critical(fd, 0); 1520 err |= ct_tmpl_set_informative(fd, 0); 1521 err |= ct_pr_tmpl_set_fatal(fd, CT_PR_EV_HWERR); 1522 err |= ct_pr_tmpl_set_param(fd, CT_PR_PGRPONLY | CT_PR_REGENT); 1523 if (err || ct_tmpl_activate(fd)) { 1524 (void) close(fd); 1525 return (-1); 1526 } 1527 1528 return (fd); 1529 } 1530 1531 static int 1532 noninteractive_login(char *zonename, const char *user_cmd, zoneid_t zoneid, 1533 char **new_args, char **new_env) 1534 { 1535 pid_t retval; 1536 int stdin_pipe[2], stdout_pipe[2], stderr_pipe[2], dead_child_pipe[2]; 1537 int child_status; 1538 int tmpl_fd; 1539 sigset_t block_cld; 1540 1541 if ((tmpl_fd = init_template()) == -1) { 1542 reset_tty(); 1543 zperror(gettext("could not create contract")); 1544 return (1); 1545 } 1546 1547 if (pipe(stdin_pipe) != 0) { 1548 zperror(gettext("could not create STDIN pipe")); 1549 return (1); 1550 } 1551 /* 1552 * When the user types ^D, we get a zero length message on STDIN. 1553 * We need to echo that down the pipe to send it to the other side; 1554 * but by default, pipes don't propagate zero-length messages. We 1555 * toggle that behavior off using I_SWROPT. See streamio(7i). 1556 */ 1557 if (ioctl(stdin_pipe[0], I_SWROPT, SNDZERO) != 0) { 1558 zperror(gettext("could not configure STDIN pipe")); 1559 return (1); 1560 1561 } 1562 if (pipe(stdout_pipe) != 0) { 1563 zperror(gettext("could not create STDOUT pipe")); 1564 return (1); 1565 } 1566 if (pipe(stderr_pipe) != 0) { 1567 zperror(gettext("could not create STDERR pipe")); 1568 return (1); 1569 } 1570 1571 if (pipe(dead_child_pipe) != 0) { 1572 zperror(gettext("could not create signalling pipe")); 1573 return (1); 1574 } 1575 close_on_sig = dead_child_pipe[0]; 1576 1577 /* 1578 * If any of the pipe FD's winds up being less than STDERR, then we 1579 * have a mess on our hands-- and we are lacking some of the I/O 1580 * streams we would expect anyway. So we bail. 1581 */ 1582 if (stdin_pipe[0] <= STDERR_FILENO || 1583 stdin_pipe[1] <= STDERR_FILENO || 1584 stdout_pipe[0] <= STDERR_FILENO || 1585 stdout_pipe[1] <= STDERR_FILENO || 1586 stderr_pipe[0] <= STDERR_FILENO || 1587 stderr_pipe[1] <= STDERR_FILENO || 1588 dead_child_pipe[0] <= STDERR_FILENO || 1589 dead_child_pipe[1] <= STDERR_FILENO) { 1590 zperror(gettext("process lacks valid STDIN, STDOUT, STDERR")); 1591 return (1); 1592 } 1593 1594 if (prefork_dropprivs() != 0) { 1595 zperror(gettext("could not allocate privilege set")); 1596 return (1); 1597 } 1598 1599 (void) sigset(SIGCLD, sigcld); 1600 (void) sigemptyset(&block_cld); 1601 (void) sigaddset(&block_cld, SIGCLD); 1602 (void) sigprocmask(SIG_BLOCK, &block_cld, NULL); 1603 1604 if ((child_pid = fork()) == -1) { 1605 (void) ct_tmpl_clear(tmpl_fd); 1606 (void) close(tmpl_fd); 1607 zperror(gettext("could not fork")); 1608 return (1); 1609 } else if (child_pid == 0) { /* child process */ 1610 (void) ct_tmpl_clear(tmpl_fd); 1611 1612 /* 1613 * Do a dance to get the pipes hooked up as FD's 0, 1 and 2. 1614 */ 1615 (void) close(STDIN_FILENO); 1616 (void) close(STDOUT_FILENO); 1617 (void) close(STDERR_FILENO); 1618 (void) dup2(stdin_pipe[1], STDIN_FILENO); 1619 (void) dup2(stdout_pipe[1], STDOUT_FILENO); 1620 (void) dup2(stderr_pipe[1], STDERR_FILENO); 1621 (void) closefrom(STDERR_FILENO + 1); 1622 1623 (void) sigset(SIGCLD, SIG_DFL); 1624 (void) sigprocmask(SIG_UNBLOCK, &block_cld, NULL); 1625 /* 1626 * In case any of stdin, stdout or stderr are streams, 1627 * anchor them to prevent malicious I_POPs. 1628 */ 1629 (void) ioctl(STDIN_FILENO, I_ANCHOR); 1630 (void) ioctl(STDOUT_FILENO, I_ANCHOR); 1631 (void) ioctl(STDERR_FILENO, I_ANCHOR); 1632 1633 if (zone_enter(zoneid) == -1) { 1634 zerror(gettext("could not enter zone %s: %s"), 1635 zonename, strerror(errno)); 1636 _exit(1); 1637 } 1638 1639 /* 1640 * For non-native zones, tell libc where it can find locale 1641 * specific getttext() messages. 1642 */ 1643 if (access("/.SUNWnative/usr/lib/locale", R_OK) == 0) 1644 (void) bindtextdomain(TEXT_DOMAIN, 1645 "/.SUNWnative/usr/lib/locale"); 1646 else if (access("/native/usr/lib/locale", R_OK) == 0) 1647 (void) bindtextdomain(TEXT_DOMAIN, 1648 "/native/usr/lib/locale"); 1649 1650 if (!failsafe) 1651 new_env = prep_env_noninteractive(user_cmd, new_env); 1652 1653 if (new_env == NULL) { 1654 _exit(1); 1655 } 1656 1657 /* 1658 * Move into a new process group; the zone_enter will have 1659 * placed us into zsched's session, and we want to be in 1660 * a unique process group. 1661 */ 1662 (void) setpgid(getpid(), getpid()); 1663 1664 /* 1665 * The child needs to run as root to 1666 * execute the su program. 1667 */ 1668 if (setuid(0) == -1) { 1669 zperror(gettext("insufficient privilege")); 1670 return (1); 1671 } 1672 1673 (void) execve(new_args[0], new_args, new_env); 1674 zperror(gettext("exec failure")); 1675 _exit(1); 1676 } 1677 /* parent */ 1678 1679 /* close pipe sides written by child */ 1680 (void) close(stdout_pipe[1]); 1681 (void) close(stderr_pipe[1]); 1682 1683 (void) sigset(SIGINT, sig_forward); 1684 1685 postfork_dropprivs(); 1686 1687 (void) ct_tmpl_clear(tmpl_fd); 1688 (void) close(tmpl_fd); 1689 1690 (void) sigprocmask(SIG_UNBLOCK, &block_cld, NULL); 1691 doio(stdin_pipe[0], stdin_pipe[1], stdout_pipe[0], stderr_pipe[0], 1692 dead_child_pipe[1], B_TRUE); 1693 do { 1694 retval = waitpid(child_pid, &child_status, 0); 1695 if (retval == -1) { 1696 child_status = 0; 1697 } 1698 } while (retval != child_pid && errno != ECHILD); 1699 1700 return (WEXITSTATUS(child_status)); 1701 } 1702 1703 static char * 1704 get_username() 1705 { 1706 uid_t uid; 1707 struct passwd *nptr; 1708 1709 /* 1710 * Authorizations are checked to restrict access based on the 1711 * requested operation and zone name, It is assumed that the 1712 * program is running with all privileges, but that the real 1713 * user ID is that of the user or role on whose behalf we are 1714 * operating. So we start by getting the username that will be 1715 * used for subsequent authorization checks. 1716 */ 1717 1718 uid = getuid(); 1719 if ((nptr = getpwuid(uid)) == NULL) { 1720 zerror(gettext("could not get user name.")); 1721 _exit(1); 1722 } 1723 return (nptr->pw_name); 1724 } 1725 1726 int 1727 main(int argc, char **argv) 1728 { 1729 int arg, console = 0; 1730 zoneid_t zoneid; 1731 zone_state_t st; 1732 char *login = "root"; 1733 int lflag = 0; 1734 int nflag = 0; 1735 char *zonename = NULL; 1736 char **proc_args = NULL; 1737 char **new_args, **new_env; 1738 sigset_t block_cld; 1739 char devroot[MAXPATHLEN]; 1740 char *slavename, slaveshortname[MAXPATHLEN]; 1741 priv_set_t *privset; 1742 int tmpl_fd; 1743 char zonebrand[MAXNAMELEN]; 1744 char default_brand[MAXNAMELEN]; 1745 struct stat sb; 1746 char kernzone[ZONENAME_MAX]; 1747 brand_handle_t bh; 1748 char user_cmd[MAXPATHLEN]; 1749 char authname[MAXAUTHS]; 1750 1751 (void) setlocale(LC_ALL, ""); 1752 (void) textdomain(TEXT_DOMAIN); 1753 1754 (void) getpname(argv[0]); 1755 username = get_username(); 1756 1757 while ((arg = getopt(argc, argv, "nECR:Se:l:Q")) != EOF) { 1758 switch (arg) { 1759 case 'C': 1760 console = 1; 1761 break; 1762 case 'E': 1763 nocmdchar = 1; 1764 break; 1765 case 'R': /* undocumented */ 1766 if (*optarg != '/') { 1767 zerror(gettext("root path must be absolute.")); 1768 exit(2); 1769 } 1770 if (stat(optarg, &sb) == -1 || !S_ISDIR(sb.st_mode)) { 1771 zerror( 1772 gettext("root path must be a directory.")); 1773 exit(2); 1774 } 1775 zonecfg_set_root(optarg); 1776 break; 1777 case 'Q': 1778 quiet = 1; 1779 break; 1780 case 'S': 1781 failsafe = 1; 1782 break; 1783 case 'e': 1784 set_cmdchar(optarg); 1785 break; 1786 case 'l': 1787 login = optarg; 1788 lflag = 1; 1789 break; 1790 case 'n': 1791 nflag = 1; 1792 break; 1793 default: 1794 usage(); 1795 } 1796 } 1797 1798 if (console != 0) { 1799 1800 if (lflag != 0) { 1801 zerror(gettext( 1802 "-l may not be specified for console login")); 1803 usage(); 1804 } 1805 1806 if (nflag != 0) { 1807 zerror(gettext( 1808 "-n may not be specified for console login")); 1809 usage(); 1810 } 1811 1812 if (failsafe != 0) { 1813 zerror(gettext( 1814 "-S may not be specified for console login")); 1815 usage(); 1816 } 1817 1818 if (zonecfg_in_alt_root()) { 1819 zerror(gettext( 1820 "-R may not be specified for console login")); 1821 exit(2); 1822 } 1823 1824 } 1825 1826 if (failsafe != 0 && lflag != 0) { 1827 zerror(gettext("-l may not be specified for failsafe login")); 1828 usage(); 1829 } 1830 1831 if (optind == (argc - 1)) { 1832 /* 1833 * zone name, no process name; this should be an interactive 1834 * as long as STDIN is really a tty. 1835 */ 1836 if (nflag != 0) { 1837 zerror(gettext( 1838 "-n may not be specified for interactive login")); 1839 usage(); 1840 } 1841 if (isatty(STDIN_FILENO)) 1842 interactive = 1; 1843 zonename = argv[optind]; 1844 } else if (optind < (argc - 1)) { 1845 if (console) { 1846 zerror(gettext("Commands may not be specified for " 1847 "console login.")); 1848 usage(); 1849 } 1850 /* zone name and process name, and possibly some args */ 1851 zonename = argv[optind]; 1852 proc_args = &argv[optind + 1]; 1853 interactive = 0; 1854 } else { 1855 usage(); 1856 } 1857 1858 if (getzoneid() != GLOBAL_ZONEID) { 1859 zerror(gettext("'%s' may only be used from the global zone"), 1860 pname); 1861 return (1); 1862 } 1863 1864 if (strcmp(zonename, GLOBAL_ZONENAME) == 0) { 1865 zerror(gettext("'%s' not applicable to the global zone"), 1866 pname); 1867 return (1); 1868 } 1869 1870 if (zone_get_state(zonename, &st) != Z_OK) { 1871 zerror(gettext("zone '%s' unknown"), zonename); 1872 return (1); 1873 } 1874 1875 if (st < ZONE_STATE_INSTALLED) { 1876 zerror(gettext("cannot login to a zone which is '%s'"), 1877 zone_state_str(st)); 1878 return (1); 1879 } 1880 1881 /* 1882 * In both console and non-console cases, we require all privs. 1883 * In the console case, because we may need to startup zoneadmd. 1884 * In the non-console case in order to do zone_enter(2), zonept() 1885 * and other tasks. 1886 */ 1887 1888 if ((privset = priv_allocset()) == NULL) { 1889 zperror(gettext("priv_allocset failed")); 1890 return (1); 1891 } 1892 1893 if (getppriv(PRIV_EFFECTIVE, privset) != 0) { 1894 zperror(gettext("getppriv failed")); 1895 priv_freeset(privset); 1896 return (1); 1897 } 1898 1899 if (priv_isfullset(privset) == B_FALSE) { 1900 zerror(gettext("You lack sufficient privilege to run " 1901 "this command (all privs required)")); 1902 priv_freeset(privset); 1903 return (1); 1904 } 1905 priv_freeset(privset); 1906 1907 /* 1908 * Check if user is authorized for requested usage of the zone 1909 */ 1910 1911 (void) snprintf(authname, MAXAUTHS, "%s%s%s", 1912 ZONE_MANAGE_AUTH, KV_OBJECT, zonename); 1913 if (chkauthattr(authname, username) == 0) { 1914 if (console) { 1915 zerror(gettext("%s is not authorized for console " 1916 "access to %s zone."), 1917 username, zonename); 1918 return (1); 1919 } else { 1920 (void) snprintf(authname, MAXAUTHS, "%s%s%s", 1921 ZONE_LOGIN_AUTH, KV_OBJECT, zonename); 1922 if (failsafe || !interactive) { 1923 zerror(gettext("%s is not authorized for " 1924 "failsafe or non-interactive login " 1925 "to %s zone."), username, zonename); 1926 return (1); 1927 } else if (chkauthattr(authname, username) == 0) { 1928 zerror(gettext("%s is not authorized " 1929 " to login to %s zone."), 1930 username, zonename); 1931 return (1); 1932 } 1933 } 1934 } else { 1935 forced_login = B_TRUE; 1936 } 1937 1938 /* 1939 * The console is a separate case from the rest of the code; handle 1940 * it first. 1941 */ 1942 if (console) { 1943 /* 1944 * Ensure that zoneadmd for this zone is running. 1945 */ 1946 if (start_zoneadmd(zonename) == -1) 1947 return (1); 1948 1949 /* 1950 * Make contact with zoneadmd. 1951 */ 1952 if (get_console_master(zonename) == -1) 1953 return (1); 1954 1955 if (!quiet) 1956 (void) printf( 1957 gettext("[Connected to zone '%s' console]\n"), 1958 zonename); 1959 1960 if (set_tty_rawmode(STDIN_FILENO) == -1) { 1961 reset_tty(); 1962 zperror(gettext("failed to set stdin pty to raw mode")); 1963 return (1); 1964 } 1965 1966 (void) sigset(SIGWINCH, sigwinch); 1967 (void) sigwinch(0); 1968 1969 /* 1970 * Run the I/O loop until we get disconnected. 1971 */ 1972 doio(masterfd, -1, masterfd, -1, -1, B_FALSE); 1973 reset_tty(); 1974 if (!quiet) 1975 (void) printf( 1976 gettext("\n[Connection to zone '%s' console " 1977 "closed]\n"), zonename); 1978 1979 return (0); 1980 } 1981 1982 if (st != ZONE_STATE_RUNNING && st != ZONE_STATE_MOUNTED) { 1983 zerror(gettext("login allowed only to running zones " 1984 "(%s is '%s')."), zonename, zone_state_str(st)); 1985 return (1); 1986 } 1987 1988 (void) strlcpy(kernzone, zonename, sizeof (kernzone)); 1989 if (zonecfg_in_alt_root()) { 1990 FILE *fp = zonecfg_open_scratch("", B_FALSE); 1991 1992 if (fp == NULL || zonecfg_find_scratch(fp, zonename, 1993 zonecfg_get_root(), kernzone, sizeof (kernzone)) == -1) { 1994 zerror(gettext("cannot find scratch zone %s"), 1995 zonename); 1996 if (fp != NULL) 1997 zonecfg_close_scratch(fp); 1998 return (1); 1999 } 2000 zonecfg_close_scratch(fp); 2001 } 2002 2003 if ((zoneid = getzoneidbyname(kernzone)) == -1) { 2004 zerror(gettext("failed to get zoneid for zone '%s'"), 2005 zonename); 2006 return (1); 2007 } 2008 2009 /* 2010 * We need the zone root path only if we are setting up a pty. 2011 */ 2012 if (zone_get_devroot(zonename, devroot, sizeof (devroot)) == -1) { 2013 zerror(gettext("could not get dev path for zone %s"), 2014 zonename); 2015 return (1); 2016 } 2017 2018 if (zone_get_brand(zonename, zonebrand, sizeof (zonebrand)) != Z_OK) { 2019 zerror(gettext("could not get brand for zone %s"), zonename); 2020 return (1); 2021 } 2022 /* 2023 * In the alternate root environment, the only supported 2024 * operations are mount and unmount. In this case, just treat 2025 * the zone as native if it is cluster. Cluster zones can be 2026 * native for the purpose of LU or upgrade, and the cluster 2027 * brand may not exist in the miniroot (such as in net install 2028 * upgrade). 2029 */ 2030 if (zonecfg_default_brand(default_brand, 2031 sizeof (default_brand)) != Z_OK) { 2032 zerror(gettext("unable to determine default brand")); 2033 return (1); 2034 } 2035 if (zonecfg_in_alt_root() && 2036 strcmp(zonebrand, CLUSTER_BRAND_NAME) == 0) { 2037 (void) strlcpy(zonebrand, default_brand, sizeof (zonebrand)); 2038 } 2039 2040 if ((bh = brand_open(zonebrand)) == NULL) { 2041 zerror(gettext("could not open brand for zone %s"), zonename); 2042 return (1); 2043 } 2044 2045 if ((new_args = prep_args(bh, login, proc_args)) == NULL) { 2046 zperror(gettext("could not assemble new arguments")); 2047 brand_close(bh); 2048 return (1); 2049 } 2050 /* 2051 * Get the brand specific user_cmd. This command is used to get 2052 * a passwd(4) entry for login. 2053 */ 2054 if (!interactive && !failsafe) { 2055 if (zone_get_user_cmd(bh, login, user_cmd, 2056 sizeof (user_cmd)) == NULL) { 2057 zerror(gettext("could not get user_cmd for zone %s"), 2058 zonename); 2059 brand_close(bh); 2060 return (1); 2061 } 2062 } 2063 brand_close(bh); 2064 2065 if ((new_env = prep_env()) == NULL) { 2066 zperror(gettext("could not assemble new environment")); 2067 return (1); 2068 } 2069 2070 if (!interactive) { 2071 if (nflag) { 2072 int nfd; 2073 2074 if ((nfd = open(_PATH_DEVNULL, O_RDONLY)) < 0) { 2075 zperror(gettext("failed to open null device")); 2076 return (1); 2077 } 2078 if (nfd != STDIN_FILENO) { 2079 if (dup2(nfd, STDIN_FILENO) < 0) { 2080 zperror(gettext( 2081 "failed to dup2 null device")); 2082 return (1); 2083 } 2084 (void) close(nfd); 2085 } 2086 /* /dev/null is now standard input */ 2087 } 2088 return (noninteractive_login(zonename, user_cmd, zoneid, 2089 new_args, new_env)); 2090 } 2091 2092 if (zonecfg_in_alt_root()) { 2093 zerror(gettext("cannot use interactive login with scratch " 2094 "zone")); 2095 return (1); 2096 } 2097 2098 /* 2099 * Things are more complex in interactive mode; we get the 2100 * master side of the pty, then place the user's terminal into 2101 * raw mode. 2102 */ 2103 if (get_master_pty() == -1) { 2104 zerror(gettext("could not setup master pty device")); 2105 return (1); 2106 } 2107 2108 /* 2109 * Compute the "short name" of the pts. /dev/pts/2 --> pts/2 2110 */ 2111 if ((slavename = ptsname(masterfd)) == NULL) { 2112 zperror(gettext("failed to get name for pseudo-tty")); 2113 return (1); 2114 } 2115 if (strncmp(slavename, "/dev/", strlen("/dev/")) == 0) 2116 (void) strlcpy(slaveshortname, slavename + strlen("/dev/"), 2117 sizeof (slaveshortname)); 2118 else 2119 (void) strlcpy(slaveshortname, slavename, 2120 sizeof (slaveshortname)); 2121 2122 if (!quiet) 2123 (void) printf(gettext("[Connected to zone '%s' %s]\n"), 2124 zonename, slaveshortname); 2125 2126 if (set_tty_rawmode(STDIN_FILENO) == -1) { 2127 reset_tty(); 2128 zperror(gettext("failed to set stdin pty to raw mode")); 2129 return (1); 2130 } 2131 2132 if (prefork_dropprivs() != 0) { 2133 reset_tty(); 2134 zperror(gettext("could not allocate privilege set")); 2135 return (1); 2136 } 2137 2138 /* 2139 * We must mask SIGCLD until after we have coped with the fork 2140 * sufficiently to deal with it; otherwise we can race and receive the 2141 * signal before child_pid has been initialized (yes, this really 2142 * happens). 2143 */ 2144 (void) sigset(SIGCLD, sigcld); 2145 (void) sigemptyset(&block_cld); 2146 (void) sigaddset(&block_cld, SIGCLD); 2147 (void) sigprocmask(SIG_BLOCK, &block_cld, NULL); 2148 2149 /* 2150 * We activate the contract template at the last minute to 2151 * avoid intermediate functions that could be using fork(2) 2152 * internally. 2153 */ 2154 if ((tmpl_fd = init_template()) == -1) { 2155 reset_tty(); 2156 zperror(gettext("could not create contract")); 2157 return (1); 2158 } 2159 2160 if ((child_pid = fork()) == -1) { 2161 (void) ct_tmpl_clear(tmpl_fd); 2162 reset_tty(); 2163 zperror(gettext("could not fork")); 2164 return (1); 2165 } else if (child_pid == 0) { /* child process */ 2166 int slavefd, newslave; 2167 2168 (void) ct_tmpl_clear(tmpl_fd); 2169 (void) close(tmpl_fd); 2170 2171 (void) sigprocmask(SIG_UNBLOCK, &block_cld, NULL); 2172 2173 if ((slavefd = init_slave_pty(zoneid, devroot)) == -1) 2174 return (1); 2175 2176 /* 2177 * Close all fds except for the slave pty. 2178 */ 2179 (void) fdwalk(close_func, &slavefd); 2180 2181 /* 2182 * Temporarily dup slavefd to stderr; that way if we have 2183 * to print out that zone_enter failed, the output will 2184 * have somewhere to go. 2185 */ 2186 if (slavefd != STDERR_FILENO) 2187 (void) dup2(slavefd, STDERR_FILENO); 2188 2189 if (zone_enter(zoneid) == -1) { 2190 zerror(gettext("could not enter zone %s: %s"), 2191 zonename, strerror(errno)); 2192 return (1); 2193 } 2194 2195 if (slavefd != STDERR_FILENO) 2196 (void) close(STDERR_FILENO); 2197 2198 /* 2199 * We take pains to get this process into a new process 2200 * group, and subsequently a new session. In this way, 2201 * we'll have a session which doesn't yet have a controlling 2202 * terminal. When we open the slave, it will become the 2203 * controlling terminal; no PIDs concerning pgrps or sids 2204 * will leak inappropriately into the zone. 2205 */ 2206 (void) setpgrp(); 2207 2208 /* 2209 * We need the slave pty to be referenced from the zone's 2210 * /dev in order to ensure that the devt's, etc are all 2211 * correct. Otherwise we break ttyname and the like. 2212 */ 2213 if ((newslave = open(slavename, O_RDWR)) == -1) { 2214 (void) close(slavefd); 2215 return (1); 2216 } 2217 (void) close(slavefd); 2218 slavefd = newslave; 2219 2220 /* 2221 * dup the slave to the various FDs, so that when the 2222 * spawned process does a write/read it maps to the slave 2223 * pty. 2224 */ 2225 (void) dup2(slavefd, STDIN_FILENO); 2226 (void) dup2(slavefd, STDOUT_FILENO); 2227 (void) dup2(slavefd, STDERR_FILENO); 2228 if (slavefd != STDIN_FILENO && slavefd != STDOUT_FILENO && 2229 slavefd != STDERR_FILENO) { 2230 (void) close(slavefd); 2231 } 2232 2233 /* 2234 * In failsafe mode, we don't use login(1), so don't try 2235 * setting up a utmpx entry. 2236 */ 2237 if (!failsafe) 2238 if (setup_utmpx(slaveshortname) == -1) 2239 return (1); 2240 2241 /* 2242 * The child needs to run as root to 2243 * execute the brand's login program. 2244 */ 2245 if (setuid(0) == -1) { 2246 zperror(gettext("insufficient privilege")); 2247 return (1); 2248 } 2249 2250 (void) execve(new_args[0], new_args, new_env); 2251 zperror(gettext("exec failure")); 2252 return (1); 2253 } 2254 2255 (void) ct_tmpl_clear(tmpl_fd); 2256 (void) close(tmpl_fd); 2257 2258 /* 2259 * The rest is only for the parent process. 2260 */ 2261 (void) sigset(SIGWINCH, sigwinch); 2262 2263 postfork_dropprivs(); 2264 2265 (void) sigprocmask(SIG_UNBLOCK, &block_cld, NULL); 2266 doio(masterfd, -1, masterfd, -1, -1, B_FALSE); 2267 2268 reset_tty(); 2269 if (!quiet) 2270 (void) fprintf(stderr, 2271 gettext("\n[Connection to zone '%s' %s closed]\n"), 2272 zonename, slaveshortname); 2273 2274 if (pollerr != 0) { 2275 (void) fprintf(stderr, gettext("Error: connection closed due " 2276 "to unexpected pollevents=0x%x.\n"), pollerr); 2277 return (1); 2278 } 2279 2280 return (0); 2281 }