1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Copyright (c) 2013, Joyent Inc. All rights reserved.
  25  * Copyright (c) 2015 by Delphix. All rights reserved.
  26  */
  27 
  28 /*
  29  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  30  */
  31 
  32 /*
  33  * This module contains functions used to bring up and tear down the
  34  * Virtual Platform: [un]mounting file-systems, [un]plumbing network
  35  * interfaces, [un]configuring devices, establishing resource controls,
  36  * and creating/destroying the zone in the kernel.  These actions, on
  37  * the way up, ready the zone; on the way down, they halt the zone.
  38  * See the much longer block comment at the beginning of zoneadmd.c
  39  * for a bigger picture of how the whole program functions.
  40  *
  41  * This module also has primary responsibility for the layout of "scratch
  42  * zones."  These are mounted, but inactive, zones that are used during
  43  * operating system upgrade and potentially other administrative action.  The
  44  * scratch zone environment is similar to the miniroot environment.  The zone's
  45  * actual root is mounted read-write on /a, and the standard paths (/usr,
  46  * /sbin, /lib) all lead to read-only copies of the running system's binaries.
  47  * This allows the administrative tools to manipulate the zone using "-R /a"
  48  * without relying on any binaries in the zone itself.
  49  *
  50  * If the scratch zone is on an alternate root (Live Upgrade [LU] boot
  51  * environment), then we must resolve the lofs mounts used there to uncover
  52  * writable (unshared) resources.  Shared resources, though, are always
  53  * read-only.  In addition, if the "same" zone with a different root path is
  54  * currently running, then "/b" inside the zone points to the running zone's
  55  * root.  This allows LU to synchronize configuration files during the upgrade
  56  * process.
  57  *
  58  * To construct this environment, this module creates a tmpfs mount on
  59  * $ZONEPATH/lu.  Inside this scratch area, the miniroot-like environment as
  60  * described above is constructed on the fly.  The zone is then created using
  61  * $ZONEPATH/lu as the root.
  62  *
  63  * Note that scratch zones are inactive.  The zone's bits are not running and
  64  * likely cannot be run correctly until upgrade is done.  Init is not running
  65  * there, nor is SMF.  Because of this, the "mounted" state of a scratch zone
  66  * is not a part of the usual halt/ready/boot state machine.
  67  */
  68 
  69 #include <sys/param.h>
  70 #include <sys/mount.h>
  71 #include <sys/mntent.h>
  72 #include <sys/socket.h>
  73 #include <sys/utsname.h>
  74 #include <sys/types.h>
  75 #include <sys/stat.h>
  76 #include <sys/sockio.h>
  77 #include <sys/stropts.h>
  78 #include <sys/conf.h>
  79 #include <sys/systeminfo.h>
  80 #include <sys/secflags.h>
  81 
  82 #include <libdlpi.h>
  83 #include <libdllink.h>
  84 #include <libdlvlan.h>
  85 
  86 #include <inet/tcp.h>
  87 #include <arpa/inet.h>
  88 #include <netinet/in.h>
  89 #include <net/route.h>
  90 
  91 #include <stdio.h>
  92 #include <errno.h>
  93 #include <fcntl.h>
  94 #include <unistd.h>
  95 #include <rctl.h>
  96 #include <stdlib.h>
  97 #include <string.h>
  98 #include <strings.h>
  99 #include <wait.h>
 100 #include <limits.h>
 101 #include <libgen.h>
 102 #include <libzfs.h>
 103 #include <libdevinfo.h>
 104 #include <zone.h>
 105 #include <assert.h>
 106 #include <libcontract.h>
 107 #include <libcontract_priv.h>
 108 #include <uuid/uuid.h>
 109 
 110 #include <sys/mntio.h>
 111 #include <sys/mnttab.h>
 112 #include <sys/fs/autofs.h>        /* for _autofssys() */
 113 #include <sys/fs/lofs_info.h>
 114 #include <sys/fs/zfs.h>
 115 
 116 #include <pool.h>
 117 #include <sys/pool.h>
 118 #include <sys/priocntl.h>
 119 
 120 #include <libbrand.h>
 121 #include <sys/brand.h>
 122 #include <libzonecfg.h>
 123 #include <synch.h>
 124 
 125 #include "zoneadmd.h"
 126 #include <tsol/label.h>
 127 #include <libtsnet.h>
 128 #include <sys/priv.h>
 129 #include <libinetutil.h>
 130 
 131 #define V4_ADDR_LEN     32
 132 #define V6_ADDR_LEN     128
 133 
 134 #define RESOURCE_DEFAULT_OPTS \
 135         MNTOPT_RO "," MNTOPT_LOFS_NOSUB "," MNTOPT_NODEVICES
 136 
 137 #define DFSTYPES        "/etc/dfs/fstypes"
 138 #define MAXTNZLEN       2048
 139 
 140 #define ALT_MOUNT(mount_cmd)    ((mount_cmd) != Z_MNT_BOOT)
 141 
 142 /* a reasonable estimate for the number of lwps per process */
 143 #define LWPS_PER_PROCESS        10
 144 
 145 /* for routing socket */
 146 static int rts_seqno = 0;
 147 
 148 /* mangled zone name when mounting in an alternate root environment */
 149 static char kernzone[ZONENAME_MAX];
 150 
 151 /* array of cached mount entries for resolve_lofs */
 152 static struct mnttab *resolve_lofs_mnts, *resolve_lofs_mnt_max;
 153 
 154 /* for Trusted Extensions */
 155 static tsol_zcent_t *get_zone_label(zlog_t *, priv_set_t *);
 156 static int tsol_mounts(zlog_t *, char *, char *);
 157 static void tsol_unmounts(zlog_t *, char *);
 158 
 159 static m_label_t *zlabel = NULL;
 160 static m_label_t *zid_label = NULL;
 161 static priv_set_t *zprivs = NULL;
 162 
 163 static const char *DFLT_FS_ALLOWED = "hsfs,smbfs,nfs,nfs3,nfs4,nfsdyn";
 164 
 165 /* from libsocket, not in any header file */
 166 extern int getnetmaskbyaddr(struct in_addr, struct in_addr *);
 167 
 168 /* from zoneadmd */
 169 extern char query_hook[];
 170 
 171 /*
 172  * For each "net" resource configured in zonecfg, we track a zone_addr_list_t
 173  * node in a linked list that is sorted by linkid.  The list is constructed as
 174  * the xml configuration file is parsed, and the information
 175  * contained in each node is added to the kernel before the zone is
 176  * booted, to be retrieved and applied from within the exclusive-IP NGZ
 177  * on boot.
 178  */
 179 typedef struct zone_addr_list {
 180         struct zone_addr_list *za_next;
 181         datalink_id_t za_linkid;        /* datalink_id_t of interface */
 182         struct zone_nwiftab za_nwiftab; /* address, defrouter properties */
 183 } zone_addr_list_t;
 184 
 185 /*
 186  * An optimization for build_mnttable: reallocate (and potentially copy the
 187  * data) only once every N times through the loop.
 188  */
 189 #define MNTTAB_HUNK     32
 190 
 191 /* some handy macros */
 192 #define SIN(s)  ((struct sockaddr_in *)s)
 193 #define SIN6(s) ((struct sockaddr_in6 *)s)
 194 
 195 /*
 196  * Private autofs system call
 197  */
 198 extern int _autofssys(int, void *);
 199 
 200 static int
 201 autofs_cleanup(zoneid_t zoneid)
 202 {
 203         /*
 204          * Ask autofs to unmount all trigger nodes in the given zone.
 205          */
 206         return (_autofssys(AUTOFS_UNMOUNTALL, (void *)zoneid));
 207 }
 208 
 209 static void
 210 free_mnttable(struct mnttab *mnt_array, uint_t nelem)
 211 {
 212         uint_t i;
 213 
 214         if (mnt_array == NULL)
 215                 return;
 216         for (i = 0; i < nelem; i++) {
 217                 free(mnt_array[i].mnt_mountp);
 218                 free(mnt_array[i].mnt_fstype);
 219                 free(mnt_array[i].mnt_special);
 220                 free(mnt_array[i].mnt_mntopts);
 221                 assert(mnt_array[i].mnt_time == NULL);
 222         }
 223         free(mnt_array);
 224 }
 225 
 226 /*
 227  * Build the mount table for the zone rooted at "zroot", storing the resulting
 228  * array of struct mnttabs in "mnt_arrayp" and the number of elements in the
 229  * array in "nelemp".
 230  */
 231 static int
 232 build_mnttable(zlog_t *zlogp, const char *zroot, size_t zrootlen, FILE *mnttab,
 233     struct mnttab **mnt_arrayp, uint_t *nelemp)
 234 {
 235         struct mnttab mnt;
 236         struct mnttab *mnts;
 237         struct mnttab *mnp;
 238         uint_t nmnt;
 239 
 240         rewind(mnttab);
 241         resetmnttab(mnttab);
 242         nmnt = 0;
 243         mnts = NULL;
 244         while (getmntent(mnttab, &mnt) == 0) {
 245                 struct mnttab *tmp_array;
 246 
 247                 if (strncmp(mnt.mnt_mountp, zroot, zrootlen) != 0)
 248                         continue;
 249                 if (nmnt % MNTTAB_HUNK == 0) {
 250                         tmp_array = realloc(mnts,
 251                             (nmnt + MNTTAB_HUNK) * sizeof (*mnts));
 252                         if (tmp_array == NULL) {
 253                                 free_mnttable(mnts, nmnt);
 254                                 return (-1);
 255                         }
 256                         mnts = tmp_array;
 257                 }
 258                 mnp = &mnts[nmnt++];
 259 
 260                 /*
 261                  * Zero out any fields we're not using.
 262                  */
 263                 (void) memset(mnp, 0, sizeof (*mnp));
 264 
 265                 if (mnt.mnt_special != NULL)
 266                         mnp->mnt_special = strdup(mnt.mnt_special);
 267                 if (mnt.mnt_mntopts != NULL)
 268                         mnp->mnt_mntopts = strdup(mnt.mnt_mntopts);
 269                 mnp->mnt_mountp = strdup(mnt.mnt_mountp);
 270                 mnp->mnt_fstype = strdup(mnt.mnt_fstype);
 271                 if ((mnt.mnt_special != NULL && mnp->mnt_special == NULL) ||
 272                     (mnt.mnt_mntopts != NULL && mnp->mnt_mntopts == NULL) ||
 273                     mnp->mnt_mountp == NULL || mnp->mnt_fstype == NULL) {
 274                         zerror(zlogp, B_TRUE, "memory allocation failed");
 275                         free_mnttable(mnts, nmnt);
 276                         return (-1);
 277                 }
 278         }
 279         *mnt_arrayp = mnts;
 280         *nelemp = nmnt;
 281         return (0);
 282 }
 283 
 284 /*
 285  * This is an optimization.  The resolve_lofs function is used quite frequently
 286  * to manipulate file paths, and on a machine with a large number of zones,
 287  * there will be a huge number of mounted file systems.  Thus, we trigger a
 288  * reread of the list of mount points
 289  */
 290 static void
 291 lofs_discard_mnttab(void)
 292 {
 293         free_mnttable(resolve_lofs_mnts,
 294             resolve_lofs_mnt_max - resolve_lofs_mnts);
 295         resolve_lofs_mnts = resolve_lofs_mnt_max = NULL;
 296 }
 297 
 298 static int
 299 lofs_read_mnttab(zlog_t *zlogp)
 300 {
 301         FILE *mnttab;
 302         uint_t nmnts;
 303 
 304         if ((mnttab = fopen(MNTTAB, "r")) == NULL)
 305                 return (-1);
 306         if (build_mnttable(zlogp, "", 0, mnttab, &resolve_lofs_mnts,
 307             &nmnts) == -1) {
 308                 (void) fclose(mnttab);
 309                 return (-1);
 310         }
 311         (void) fclose(mnttab);
 312         resolve_lofs_mnt_max = resolve_lofs_mnts + nmnts;
 313         return (0);
 314 }
 315 
 316 /*
 317  * This function loops over potential loopback mounts and symlinks in a given
 318  * path and resolves them all down to an absolute path.
 319  */
 320 void
 321 resolve_lofs(zlog_t *zlogp, char *path, size_t pathlen)
 322 {
 323         int len, arlen;
 324         const char *altroot;
 325         char tmppath[MAXPATHLEN];
 326         boolean_t outside_altroot;
 327 
 328         if ((len = resolvepath(path, tmppath, sizeof (tmppath))) == -1)
 329                 return;
 330         tmppath[len] = '\0';
 331         (void) strlcpy(path, tmppath, sizeof (tmppath));
 332 
 333         /* This happens once per zoneadmd operation. */
 334         if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
 335                 return;
 336 
 337         altroot = zonecfg_get_root();
 338         arlen = strlen(altroot);
 339         outside_altroot = B_FALSE;
 340         for (;;) {
 341                 struct mnttab *mnp;
 342 
 343                 /* Search in reverse order to find longest match */
 344                 for (mnp = resolve_lofs_mnt_max - 1; mnp >= resolve_lofs_mnts;
 345                     mnp--) {
 346                         if (mnp->mnt_fstype == NULL ||
 347                             mnp->mnt_mountp == NULL ||
 348                             mnp->mnt_special == NULL)
 349                                 continue;
 350                         len = strlen(mnp->mnt_mountp);
 351                         if (strncmp(mnp->mnt_mountp, path, len) == 0 &&
 352                             (path[len] == '/' || path[len] == '\0'))
 353                                 break;
 354                 }
 355                 if (mnp < resolve_lofs_mnts)
 356                         break;
 357                 /* If it's not a lofs then we're done */
 358                 if (strcmp(mnp->mnt_fstype, MNTTYPE_LOFS) != 0)
 359                         break;
 360                 if (outside_altroot) {
 361                         char *cp;
 362                         int olen = sizeof (MNTOPT_RO) - 1;
 363 
 364                         /*
 365                          * If we run into a read-only mount outside of the
 366                          * alternate root environment, then the user doesn't
 367                          * want this path to be made read-write.
 368                          */
 369                         if (mnp->mnt_mntopts != NULL &&
 370                             (cp = strstr(mnp->mnt_mntopts, MNTOPT_RO)) !=
 371                             NULL &&
 372                             (cp == mnp->mnt_mntopts || cp[-1] == ',') &&
 373                             (cp[olen] == '\0' || cp[olen] == ',')) {
 374                                 break;
 375                         }
 376                 } else if (arlen > 0 &&
 377                     (strncmp(mnp->mnt_special, altroot, arlen) != 0 ||
 378                     (mnp->mnt_special[arlen] != '\0' &&
 379                     mnp->mnt_special[arlen] != '/'))) {
 380                         outside_altroot = B_TRUE;
 381                 }
 382                 /* use temporary buffer because new path might be longer */
 383                 (void) snprintf(tmppath, sizeof (tmppath), "%s%s",
 384                     mnp->mnt_special, path + len);
 385                 if ((len = resolvepath(tmppath, path, pathlen)) == -1)
 386                         break;
 387                 path[len] = '\0';
 388         }
 389 }
 390 
 391 /*
 392  * For a regular mount, check if a replacement lofs mount is needed because the
 393  * referenced device is already mounted somewhere.
 394  */
 395 static int
 396 check_lofs_needed(zlog_t *zlogp, struct zone_fstab *fsptr)
 397 {
 398         struct mnttab *mnp;
 399         zone_fsopt_t *optptr, *onext;
 400 
 401         /* This happens once per zoneadmd operation. */
 402         if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
 403                 return (-1);
 404 
 405         /*
 406          * If this special node isn't already in use, then it's ours alone;
 407          * no need to worry about conflicting mounts.
 408          */
 409         for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max;
 410             mnp++) {
 411                 if (strcmp(mnp->mnt_special, fsptr->zone_fs_special) == 0)
 412                         break;
 413         }
 414         if (mnp >= resolve_lofs_mnt_max)
 415                 return (0);
 416 
 417         /*
 418          * Convert this duplicate mount into a lofs mount.
 419          */
 420         (void) strlcpy(fsptr->zone_fs_special, mnp->mnt_mountp,
 421             sizeof (fsptr->zone_fs_special));
 422         (void) strlcpy(fsptr->zone_fs_type, MNTTYPE_LOFS,
 423             sizeof (fsptr->zone_fs_type));
 424         fsptr->zone_fs_raw[0] = '\0';
 425 
 426         /*
 427          * Discard all but one of the original options and set that to our
 428          * default set of options used for resources.
 429          */
 430         optptr = fsptr->zone_fs_options;
 431         if (optptr == NULL) {
 432                 optptr = malloc(sizeof (*optptr));
 433                 if (optptr == NULL) {
 434                         zerror(zlogp, B_TRUE, "cannot mount %s",
 435                             fsptr->zone_fs_dir);
 436                         return (-1);
 437                 }
 438         } else {
 439                 while ((onext = optptr->zone_fsopt_next) != NULL) {
 440                         optptr->zone_fsopt_next = onext->zone_fsopt_next;
 441                         free(onext);
 442                 }
 443         }
 444         (void) strcpy(optptr->zone_fsopt_opt, RESOURCE_DEFAULT_OPTS);
 445         optptr->zone_fsopt_next = NULL;
 446         fsptr->zone_fs_options = optptr;
 447         return (0);
 448 }
 449 
 450 int
 451 make_one_dir(zlog_t *zlogp, const char *prefix, const char *subdir, mode_t mode,
 452     uid_t userid, gid_t groupid)
 453 {
 454         char path[MAXPATHLEN];
 455         struct stat st;
 456 
 457         if (snprintf(path, sizeof (path), "%s%s", prefix, subdir) >
 458             sizeof (path)) {
 459                 zerror(zlogp, B_FALSE, "pathname %s%s is too long", prefix,
 460                     subdir);
 461                 return (-1);
 462         }
 463 
 464         if (lstat(path, &st) == 0) {
 465                 /*
 466                  * We don't check the file mode since presumably the zone
 467                  * administrator may have had good reason to change the mode,
 468                  * and we don't need to second guess him.
 469                  */
 470                 if (!S_ISDIR(st.st_mode)) {
 471                         if (S_ISREG(st.st_mode)) {
 472                                 /*
 473                                  * Allow readonly mounts of /etc/ files; this
 474                                  * is needed most by Trusted Extensions.
 475                                  */
 476                                 if (strncmp(subdir, "/etc/",
 477                                     strlen("/etc/")) != 0) {
 478                                         zerror(zlogp, B_FALSE,
 479                                             "%s is not in /etc", path);
 480                                         return (-1);
 481                                 }
 482                         } else {
 483                                 zerror(zlogp, B_FALSE,
 484                                     "%s is not a directory", path);
 485                                 return (-1);
 486                         }
 487                 }
 488                 return (0);
 489         }
 490 
 491         if (mkdirp(path, mode) != 0) {
 492                 if (errno == EROFS)
 493                         zerror(zlogp, B_FALSE, "Could not mkdir %s.\nIt is on "
 494                             "a read-only file system in this local zone.\nMake "
 495                             "sure %s exists in the global zone.", path, subdir);
 496                 else
 497                         zerror(zlogp, B_TRUE, "mkdirp of %s failed", path);
 498                 return (-1);
 499         }
 500 
 501         (void) chown(path, userid, groupid);
 502         return (0);
 503 }
 504 
 505 static void
 506 free_remote_fstypes(char **types)
 507 {
 508         uint_t i;
 509 
 510         if (types == NULL)
 511                 return;
 512         for (i = 0; types[i] != NULL; i++)
 513                 free(types[i]);
 514         free(types);
 515 }
 516 
 517 static char **
 518 get_remote_fstypes(zlog_t *zlogp)
 519 {
 520         char **types = NULL;
 521         FILE *fp;
 522         char buf[MAXPATHLEN];
 523         char fstype[MAXPATHLEN];
 524         uint_t lines = 0;
 525         uint_t i;
 526 
 527         if ((fp = fopen(DFSTYPES, "r")) == NULL) {
 528                 zerror(zlogp, B_TRUE, "failed to open %s", DFSTYPES);
 529                 return (NULL);
 530         }
 531         /*
 532          * Count the number of lines
 533          */
 534         while (fgets(buf, sizeof (buf), fp) != NULL)
 535                 lines++;
 536         if (lines == 0) /* didn't read anything; empty file */
 537                 goto out;
 538         rewind(fp);
 539         /*
 540          * Allocate enough space for a NULL-terminated array.
 541          */
 542         types = calloc(lines + 1, sizeof (char *));
 543         if (types == NULL) {
 544                 zerror(zlogp, B_TRUE, "memory allocation failed");
 545                 goto out;
 546         }
 547         i = 0;
 548         while (fgets(buf, sizeof (buf), fp) != NULL) {
 549                 /* LINTED - fstype is big enough to hold buf */
 550                 if (sscanf(buf, "%s", fstype) == 0) {
 551                         zerror(zlogp, B_FALSE, "unable to parse %s", DFSTYPES);
 552                         free_remote_fstypes(types);
 553                         types = NULL;
 554                         goto out;
 555                 }
 556                 types[i] = strdup(fstype);
 557                 if (types[i] == NULL) {
 558                         zerror(zlogp, B_TRUE, "memory allocation failed");
 559                         free_remote_fstypes(types);
 560                         types = NULL;
 561                         goto out;
 562                 }
 563                 i++;
 564         }
 565 out:
 566         (void) fclose(fp);
 567         return (types);
 568 }
 569 
 570 static boolean_t
 571 is_remote_fstype(const char *fstype, char *const *remote_fstypes)
 572 {
 573         uint_t i;
 574 
 575         if (remote_fstypes == NULL)
 576                 return (B_FALSE);
 577         for (i = 0; remote_fstypes[i] != NULL; i++) {
 578                 if (strcmp(remote_fstypes[i], fstype) == 0)
 579                         return (B_TRUE);
 580         }
 581         return (B_FALSE);
 582 }
 583 
 584 /*
 585  * This converts a zone root path (normally of the form .../root) to a Live
 586  * Upgrade scratch zone root (of the form .../lu).
 587  */
 588 static void
 589 root_to_lu(zlog_t *zlogp, char *zroot, size_t zrootlen, boolean_t isresolved)
 590 {
 591         if (!isresolved && zonecfg_in_alt_root())
 592                 resolve_lofs(zlogp, zroot, zrootlen);
 593         (void) strcpy(strrchr(zroot, '/') + 1, "lu");
 594 }
 595 
 596 /*
 597  * The general strategy for unmounting filesystems is as follows:
 598  *
 599  * - Remote filesystems may be dead, and attempting to contact them as
 600  * part of a regular unmount may hang forever; we want to always try to
 601  * forcibly unmount such filesystems and only fall back to regular
 602  * unmounts if the filesystem doesn't support forced unmounts.
 603  *
 604  * - We don't want to unnecessarily corrupt metadata on local
 605  * filesystems (ie UFS), so we want to start off with graceful unmounts,
 606  * and only escalate to doing forced unmounts if we get stuck.
 607  *
 608  * We start off walking backwards through the mount table.  This doesn't
 609  * give us strict ordering but ensures that we try to unmount submounts
 610  * first.  We thus limit the number of failed umount2(2) calls.
 611  *
 612  * The mechanism for determining if we're stuck is to count the number
 613  * of failed unmounts each iteration through the mount table.  This
 614  * gives us an upper bound on the number of filesystems which remain
 615  * mounted (autofs trigger nodes are dealt with separately).  If at the
 616  * end of one unmount+autofs_cleanup cycle we still have the same number
 617  * of mounts that we started out with, we're stuck and try a forced
 618  * unmount.  If that fails (filesystem doesn't support forced unmounts)
 619  * then we bail and are unable to teardown the zone.  If it succeeds,
 620  * we're no longer stuck so we continue with our policy of trying
 621  * graceful mounts first.
 622  *
 623  * Zone must be down (ie, no processes or threads active).
 624  */
 625 static int
 626 unmount_filesystems(zlog_t *zlogp, zoneid_t zoneid, boolean_t unmount_cmd)
 627 {
 628         int error = 0;
 629         FILE *mnttab;
 630         struct mnttab *mnts;
 631         uint_t nmnt;
 632         char zroot[MAXPATHLEN + 1];
 633         size_t zrootlen;
 634         uint_t oldcount = UINT_MAX;
 635         boolean_t stuck = B_FALSE;
 636         char **remote_fstypes = NULL;
 637 
 638         if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
 639                 zerror(zlogp, B_FALSE, "unable to determine zone root");
 640                 return (-1);
 641         }
 642         if (unmount_cmd)
 643                 root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
 644 
 645         (void) strcat(zroot, "/");
 646         zrootlen = strlen(zroot);
 647 
 648         /*
 649          * For Trusted Extensions unmount each higher level zone's mount
 650          * of our zone's /export/home
 651          */
 652         if (!unmount_cmd)
 653                 tsol_unmounts(zlogp, zone_name);
 654 
 655         if ((mnttab = fopen(MNTTAB, "r")) == NULL) {
 656                 zerror(zlogp, B_TRUE, "failed to open %s", MNTTAB);
 657                 return (-1);
 658         }
 659         /*
 660          * Use our hacky mntfs ioctl so we see everything, even mounts with
 661          * MS_NOMNTTAB.
 662          */
 663         if (ioctl(fileno(mnttab), MNTIOC_SHOWHIDDEN, NULL) < 0) {
 664                 zerror(zlogp, B_TRUE, "unable to configure %s", MNTTAB);
 665                 error++;
 666                 goto out;
 667         }
 668 
 669         /*
 670          * Build the list of remote fstypes so we know which ones we
 671          * should forcibly unmount.
 672          */
 673         remote_fstypes = get_remote_fstypes(zlogp);
 674         for (; /* ever */; ) {
 675                 uint_t newcount = 0;
 676                 boolean_t unmounted;
 677                 struct mnttab *mnp;
 678                 char *path;
 679                 uint_t i;
 680 
 681                 mnts = NULL;
 682                 nmnt = 0;
 683                 /*
 684                  * MNTTAB gives us a way to walk through mounted
 685                  * filesystems; we need to be able to walk them in
 686                  * reverse order, so we build a list of all mounted
 687                  * filesystems.
 688                  */
 689                 if (build_mnttable(zlogp, zroot, zrootlen, mnttab, &mnts,
 690                     &nmnt) != 0) {
 691                         error++;
 692                         goto out;
 693                 }
 694                 for (i = 0; i < nmnt; i++) {
 695                         mnp = &mnts[nmnt - i - 1]; /* access in reverse order */
 696                         path = mnp->mnt_mountp;
 697                         unmounted = B_FALSE;
 698                         /*
 699                          * Try forced unmount first for remote filesystems.
 700                          *
 701                          * Not all remote filesystems support forced unmounts,
 702                          * so if this fails (ENOTSUP) we'll continue on
 703                          * and try a regular unmount.
 704                          */
 705                         if (is_remote_fstype(mnp->mnt_fstype, remote_fstypes)) {
 706                                 if (umount2(path, MS_FORCE) == 0)
 707                                         unmounted = B_TRUE;
 708                         }
 709                         /*
 710                          * Try forced unmount if we're stuck.
 711                          */
 712                         if (stuck) {
 713                                 if (umount2(path, MS_FORCE) == 0) {
 714                                         unmounted = B_TRUE;
 715                                         stuck = B_FALSE;
 716                                 } else {
 717                                         /*
 718                                          * The first failure indicates a
 719                                          * mount we won't be able to get
 720                                          * rid of automatically, so we
 721                                          * bail.
 722                                          */
 723                                         error++;
 724                                         zerror(zlogp, B_FALSE,
 725                                             "unable to unmount '%s'", path);
 726                                         free_mnttable(mnts, nmnt);
 727                                         goto out;
 728                                 }
 729                         }
 730                         /*
 731                          * Try regular unmounts for everything else.
 732                          */
 733                         if (!unmounted && umount2(path, 0) != 0)
 734                                 newcount++;
 735                 }
 736                 free_mnttable(mnts, nmnt);
 737 
 738                 if (newcount == 0)
 739                         break;
 740                 if (newcount >= oldcount) {
 741                         /*
 742                          * Last round didn't unmount anything; we're stuck and
 743                          * should start trying forced unmounts.
 744                          */
 745                         stuck = B_TRUE;
 746                 }
 747                 oldcount = newcount;
 748 
 749                 /*
 750                  * Autofs doesn't let you unmount its trigger nodes from
 751                  * userland so we have to tell the kernel to cleanup for us.
 752                  */
 753                 if (autofs_cleanup(zoneid) != 0) {
 754                         zerror(zlogp, B_TRUE, "unable to remove autofs nodes");
 755                         error++;
 756                         goto out;
 757                 }
 758         }
 759 
 760 out:
 761         free_remote_fstypes(remote_fstypes);
 762         (void) fclose(mnttab);
 763         return (error ? -1 : 0);
 764 }
 765 
 766 static int
 767 fs_compare(const void *m1, const void *m2)
 768 {
 769         struct zone_fstab *i = (struct zone_fstab *)m1;
 770         struct zone_fstab *j = (struct zone_fstab *)m2;
 771 
 772         return (strcmp(i->zone_fs_dir, j->zone_fs_dir));
 773 }
 774 
 775 /*
 776  * Fork and exec (and wait for) the mentioned binary with the provided
 777  * arguments.  Returns (-1) if something went wrong with fork(2) or exec(2),
 778  * returns the exit status otherwise.
 779  *
 780  * If we were unable to exec the provided pathname (for whatever
 781  * reason), we return the special token ZEXIT_EXEC.  The current value
 782  * of ZEXIT_EXEC doesn't conflict with legitimate exit codes of the
 783  * consumers of this function; any future consumers must make sure this
 784  * remains the case.
 785  */
 786 static int
 787 forkexec(zlog_t *zlogp, const char *path, char *const argv[])
 788 {
 789         pid_t child_pid;
 790         int child_status = 0;
 791 
 792         /*
 793          * Do not let another thread localize a message while we are forking.
 794          */
 795         (void) mutex_lock(&msglock);
 796         child_pid = fork();
 797         (void) mutex_unlock(&msglock);
 798         if (child_pid == -1) {
 799                 zerror(zlogp, B_TRUE, "could not fork for %s", argv[0]);
 800                 return (-1);
 801         } else if (child_pid == 0) {
 802                 closefrom(0);
 803                 /* redirect stdin, stdout & stderr to /dev/null */
 804                 (void) open("/dev/null", O_RDONLY);     /* stdin */
 805                 (void) open("/dev/null", O_WRONLY);     /* stdout */
 806                 (void) open("/dev/null", O_WRONLY);     /* stderr */
 807                 (void) execv(path, argv);
 808                 /*
 809                  * Since we are in the child, there is no point calling zerror()
 810                  * since there is nobody waiting to consume it.  So exit with a
 811                  * special code that the parent will recognize and call zerror()
 812                  * accordingly.
 813                  */
 814 
 815                 _exit(ZEXIT_EXEC);
 816         } else {
 817                 (void) waitpid(child_pid, &child_status, 0);
 818         }
 819 
 820         if (WIFSIGNALED(child_status)) {
 821                 zerror(zlogp, B_FALSE, "%s unexpectedly terminated due to "
 822                     "signal %d", path, WTERMSIG(child_status));
 823                 return (-1);
 824         }
 825         assert(WIFEXITED(child_status));
 826         if (WEXITSTATUS(child_status) == ZEXIT_EXEC) {
 827                 zerror(zlogp, B_FALSE, "failed to exec %s", path);
 828                 return (-1);
 829         }
 830         return (WEXITSTATUS(child_status));
 831 }
 832 
 833 static int
 834 isregfile(const char *path)
 835 {
 836         struct stat64 st;
 837 
 838         if (stat64(path, &st) == -1)
 839                 return (-1);
 840 
 841         return (S_ISREG(st.st_mode));
 842 }
 843 
 844 static int
 845 dofsck(zlog_t *zlogp, const char *fstype, const char *rawdev)
 846 {
 847         char cmdbuf[MAXPATHLEN];
 848         char *argv[5];
 849         int status;
 850 
 851         /*
 852          * We could alternatively have called /usr/sbin/fsck -F <fstype>, but
 853          * that would cost us an extra fork/exec without buying us anything.
 854          */
 855         if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/fsck", fstype)
 856             >= sizeof (cmdbuf)) {
 857                 zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
 858                 return (-1);
 859         }
 860 
 861         /*
 862          * If it doesn't exist, that's OK: we verified this previously
 863          * in zoneadm.
 864          */
 865         if (isregfile(cmdbuf) == -1)
 866                 return (0);
 867 
 868         argv[0] = "fsck";
 869         argv[1] = "-o";
 870         argv[2] = "p";
 871         argv[3] = (char *)rawdev;
 872         argv[4] = NULL;
 873 
 874         status = forkexec(zlogp, cmdbuf, argv);
 875         if (status == 0 || status == -1)
 876                 return (status);
 877         zerror(zlogp, B_FALSE, "fsck of '%s' failed with exit status %d; "
 878             "run fsck manually", rawdev, status);
 879         return (-1);
 880 }
 881 
 882 static int
 883 domount(zlog_t *zlogp, const char *fstype, const char *opts,
 884     const char *special, const char *directory)
 885 {
 886         char cmdbuf[MAXPATHLEN];
 887         char *argv[6];
 888         int status;
 889 
 890         /*
 891          * We could alternatively have called /usr/sbin/mount -F <fstype>, but
 892          * that would cost us an extra fork/exec without buying us anything.
 893          */
 894         if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/mount", fstype)
 895             >= sizeof (cmdbuf)) {
 896                 zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
 897                 return (-1);
 898         }
 899         argv[0] = "mount";
 900         if (opts[0] == '\0') {
 901                 argv[1] = (char *)special;
 902                 argv[2] = (char *)directory;
 903                 argv[3] = NULL;
 904         } else {
 905                 argv[1] = "-o";
 906                 argv[2] = (char *)opts;
 907                 argv[3] = (char *)special;
 908                 argv[4] = (char *)directory;
 909                 argv[5] = NULL;
 910         }
 911 
 912         status = forkexec(zlogp, cmdbuf, argv);
 913         if (status == 0 || status == -1)
 914                 return (status);
 915         if (opts[0] == '\0')
 916                 zerror(zlogp, B_FALSE, "\"%s %s %s\" "
 917                     "failed with exit code %d",
 918                     cmdbuf, special, directory, status);
 919         else
 920                 zerror(zlogp, B_FALSE, "\"%s -o %s %s %s\" "
 921                     "failed with exit code %d",
 922                     cmdbuf, opts, special, directory, status);
 923         return (-1);
 924 }
 925 
 926 /*
 927  * Check if a given mount point path exists.
 928  * If it does, make sure it doesn't contain any symlinks.
 929  * Note that if "leaf" is false we're checking an intermediate
 930  * component of the mount point path, so it must be a directory.
 931  * If "leaf" is true, then we're checking the entire mount point
 932  * path, so the mount point itself can be anything aside from a
 933  * symbolic link.
 934  *
 935  * If the path is invalid then a negative value is returned.  If the
 936  * path exists and is a valid mount point path then 0 is returned.
 937  * If the path doesn't exist return a positive value.
 938  */
 939 static int
 940 valid_mount_point(zlog_t *zlogp, const char *path, const boolean_t leaf)
 941 {
 942         struct stat statbuf;
 943         char respath[MAXPATHLEN];
 944         int res;
 945 
 946         if (lstat(path, &statbuf) != 0) {
 947                 if (errno == ENOENT)
 948                         return (1);
 949                 zerror(zlogp, B_TRUE, "can't stat %s", path);
 950                 return (-1);
 951         }
 952         if (S_ISLNK(statbuf.st_mode)) {
 953                 zerror(zlogp, B_FALSE, "%s is a symlink", path);
 954                 return (-1);
 955         }
 956         if (!leaf && !S_ISDIR(statbuf.st_mode)) {
 957                 zerror(zlogp, B_FALSE, "%s is not a directory", path);
 958                 return (-1);
 959         }
 960         if ((res = resolvepath(path, respath, sizeof (respath))) == -1) {
 961                 zerror(zlogp, B_TRUE, "unable to resolve path %s", path);
 962                 return (-1);
 963         }
 964         respath[res] = '\0';
 965         if (strcmp(path, respath) != 0) {
 966                 /*
 967                  * We don't like ".."s, "."s, or "//"s throwing us off
 968                  */
 969                 zerror(zlogp, B_FALSE, "%s is not a canonical path", path);
 970                 return (-1);
 971         }
 972         return (0);
 973 }
 974 
 975 /*
 976  * Validate a mount point path.  A valid mount point path is an
 977  * absolute path that either doesn't exist, or, if it does exists it
 978  * must be an absolute canonical path that doesn't have any symbolic
 979  * links in it.  The target of a mount point path can be any filesystem
 980  * object.  (Different filesystems can support different mount points,
 981  * for example "lofs" and "mntfs" both support files and directories
 982  * while "ufs" just supports directories.)
 983  *
 984  * If the path is invalid then a negative value is returned.  If the
 985  * path exists and is a valid mount point path then 0 is returned.
 986  * If the path doesn't exist return a positive value.
 987  */
 988 int
 989 valid_mount_path(zlog_t *zlogp, const char *rootpath, const char *spec,
 990     const char *dir, const char *fstype)
 991 {
 992         char abspath[MAXPATHLEN], *slashp, *slashp_next;
 993         int rv;
 994 
 995         /*
 996          * Sanity check the target mount point path.
 997          * It must be a non-null string that starts with a '/'.
 998          */
 999         if (dir[0] != '/') {
1000                 /* Something went wrong. */
1001                 zerror(zlogp, B_FALSE, "invalid mount directory, "
1002                     "type: \"%s\", special: \"%s\", dir: \"%s\"",
1003                     fstype, spec, dir);
1004                 return (-1);
1005         }
1006 
1007         /*
1008          * Join rootpath and dir.  Make sure abspath ends with '/', this
1009          * is added to all paths (even non-directory paths) to allow us
1010          * to detect the end of paths below.  If the path already ends
1011          * in a '/', then that's ok too (although we'll fail the
1012          * cannonical path check in valid_mount_point()).
1013          */
1014         if (snprintf(abspath, sizeof (abspath),
1015             "%s%s/", rootpath, dir) >= sizeof (abspath)) {
1016                 zerror(zlogp, B_FALSE, "pathname %s%s is too long",
1017                     rootpath, dir);
1018                 return (-1);
1019         }
1020 
1021         /*
1022          * Starting with rootpath, verify the mount path one component
1023          * at a time.  Continue until we've evaluated all of abspath.
1024          */
1025         slashp = &abspath[strlen(rootpath)];
1026         assert(*slashp == '/');
1027         do {
1028                 slashp_next = strchr(slashp + 1, '/');
1029                 *slashp = '\0';
1030                 if (slashp_next != NULL) {
1031                         /* This is an intermediary mount path component. */
1032                         rv = valid_mount_point(zlogp, abspath, B_FALSE);
1033                 } else {
1034                         /* This is the last component of the mount path. */
1035                         rv = valid_mount_point(zlogp, abspath, B_TRUE);
1036                 }
1037                 if (rv < 0)
1038                         return (rv);
1039                 *slashp = '/';
1040         } while ((slashp = slashp_next) != NULL);
1041         return (rv);
1042 }
1043 
1044 static int
1045 mount_one_dev_device_cb(void *arg, const char *match, const char *name)
1046 {
1047         di_prof_t prof = arg;
1048 
1049         if (name == NULL)
1050                 return (di_prof_add_dev(prof, match));
1051         return (di_prof_add_map(prof, match, name));
1052 }
1053 
1054 static int
1055 mount_one_dev_symlink_cb(void *arg, const char *source, const char *target)
1056 {
1057         di_prof_t prof = arg;
1058 
1059         return (di_prof_add_symlink(prof, source, target));
1060 }
1061 
1062 int
1063 vplat_get_iptype(zlog_t *zlogp, zone_iptype_t *iptypep)
1064 {
1065         zone_dochandle_t handle;
1066 
1067         if ((handle = zonecfg_init_handle()) == NULL) {
1068                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
1069                 return (-1);
1070         }
1071         if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
1072                 zerror(zlogp, B_FALSE, "invalid configuration");
1073                 zonecfg_fini_handle(handle);
1074                 return (-1);
1075         }
1076         if (zonecfg_get_iptype(handle, iptypep) != Z_OK) {
1077                 zerror(zlogp, B_FALSE, "invalid ip-type configuration");
1078                 zonecfg_fini_handle(handle);
1079                 return (-1);
1080         }
1081         zonecfg_fini_handle(handle);
1082         return (0);
1083 }
1084 
1085 /*
1086  * Apply the standard lists of devices/symlinks/mappings and the user-specified
1087  * list of devices (via zonecfg) to the /dev filesystem.  The filesystem will
1088  * use these as a profile/filter to determine what exists in /dev.
1089  */
1090 static int
1091 mount_one_dev(zlog_t *zlogp, char *devpath, zone_mnt_t mount_cmd)
1092 {
1093         char                    brand[MAXNAMELEN];
1094         zone_dochandle_t        handle = NULL;
1095         brand_handle_t          bh = NULL;
1096         struct zone_devtab      ztab;
1097         di_prof_t               prof = NULL;
1098         int                     err;
1099         int                     retval = -1;
1100         zone_iptype_t           iptype;
1101         const char              *curr_iptype;
1102 
1103         if (di_prof_init(devpath, &prof)) {
1104                 zerror(zlogp, B_TRUE, "failed to initialize profile");
1105                 goto cleanup;
1106         }
1107 
1108         /*
1109          * Get a handle to the brand info for this zone.
1110          * If we are mounting the zone, then we must always use the default
1111          * brand device mounts.
1112          */
1113         if (ALT_MOUNT(mount_cmd)) {
1114                 (void) strlcpy(brand, default_brand, sizeof (brand));
1115         } else {
1116                 (void) strlcpy(brand, brand_name, sizeof (brand));
1117         }
1118 
1119         if ((bh = brand_open(brand)) == NULL) {
1120                 zerror(zlogp, B_FALSE, "unable to determine zone brand");
1121                 goto cleanup;
1122         }
1123 
1124         if (vplat_get_iptype(zlogp, &iptype) < 0) {
1125                 zerror(zlogp, B_TRUE, "unable to determine ip-type");
1126                 goto cleanup;
1127         }
1128         switch (iptype) {
1129         case ZS_SHARED:
1130                 curr_iptype = "shared";
1131                 break;
1132         case ZS_EXCLUSIVE:
1133                 curr_iptype = "exclusive";
1134                 break;
1135         }
1136 
1137         if (brand_platform_iter_devices(bh, zone_name,
1138             mount_one_dev_device_cb, prof, curr_iptype) != 0) {
1139                 zerror(zlogp, B_TRUE, "failed to add standard device");
1140                 goto cleanup;
1141         }
1142 
1143         if (brand_platform_iter_link(bh,
1144             mount_one_dev_symlink_cb, prof) != 0) {
1145                 zerror(zlogp, B_TRUE, "failed to add standard symlink");
1146                 goto cleanup;
1147         }
1148 
1149         /* Add user-specified devices and directories */
1150         if ((handle = zonecfg_init_handle()) == NULL) {
1151                 zerror(zlogp, B_FALSE, "can't initialize zone handle");
1152                 goto cleanup;
1153         }
1154         if (err = zonecfg_get_handle(zone_name, handle)) {
1155                 zerror(zlogp, B_FALSE, "can't get handle for zone "
1156                     "%s: %s", zone_name, zonecfg_strerror(err));
1157                 goto cleanup;
1158         }
1159         if (err = zonecfg_setdevent(handle)) {
1160                 zerror(zlogp, B_FALSE, "%s: %s", zone_name,
1161                     zonecfg_strerror(err));
1162                 goto cleanup;
1163         }
1164         while (zonecfg_getdevent(handle, &ztab) == Z_OK) {
1165                 if (di_prof_add_dev(prof, ztab.zone_dev_match)) {
1166                         zerror(zlogp, B_TRUE, "failed to add "
1167                             "user-specified device");
1168                         goto cleanup;
1169                 }
1170         }
1171         (void) zonecfg_enddevent(handle);
1172 
1173         /* Send profile to kernel */
1174         if (di_prof_commit(prof)) {
1175                 zerror(zlogp, B_TRUE, "failed to commit profile");
1176                 goto cleanup;
1177         }
1178 
1179         retval = 0;
1180 
1181 cleanup:
1182         if (bh != NULL)
1183                 brand_close(bh);
1184         if (handle != NULL)
1185                 zonecfg_fini_handle(handle);
1186         if (prof)
1187                 di_prof_fini(prof);
1188         return (retval);
1189 }
1190 
1191 static int
1192 mount_one(zlog_t *zlogp, struct zone_fstab *fsptr, const char *rootpath,
1193     zone_mnt_t mount_cmd)
1194 {
1195         char path[MAXPATHLEN];
1196         char optstr[MAX_MNTOPT_STR];
1197         zone_fsopt_t *optptr;
1198         int rv;
1199 
1200         if ((rv = valid_mount_path(zlogp, rootpath, fsptr->zone_fs_special,
1201             fsptr->zone_fs_dir, fsptr->zone_fs_type)) < 0) {
1202                 zerror(zlogp, B_FALSE, "%s%s is not a valid mount point",
1203                     rootpath, fsptr->zone_fs_dir);
1204                 return (-1);
1205         } else if (rv > 0) {
1206                 /* The mount point path doesn't exist, create it now. */
1207                 if (make_one_dir(zlogp, rootpath, fsptr->zone_fs_dir,
1208                     DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
1209                     DEFAULT_DIR_GROUP) != 0) {
1210                         zerror(zlogp, B_FALSE, "failed to create mount point");
1211                         return (-1);
1212                 }
1213 
1214                 /*
1215                  * Now this might seem weird, but we need to invoke
1216                  * valid_mount_path() again.  Why?  Because it checks
1217                  * to make sure that the mount point path is canonical,
1218                  * which it can only do if the path exists, so now that
1219                  * we've created the path we have to verify it again.
1220                  */
1221                 if ((rv = valid_mount_path(zlogp, rootpath,
1222                     fsptr->zone_fs_special, fsptr->zone_fs_dir,
1223                     fsptr->zone_fs_type)) < 0) {
1224                         zerror(zlogp, B_FALSE,
1225                             "%s%s is not a valid mount point",
1226                             rootpath, fsptr->zone_fs_dir);
1227                         return (-1);
1228                 }
1229         }
1230 
1231         (void) snprintf(path, sizeof (path), "%s%s", rootpath,
1232             fsptr->zone_fs_dir);
1233 
1234         /*
1235          * In general the strategy here is to do just as much verification as
1236          * necessary to avoid crashing or otherwise doing something bad; if the
1237          * administrator initiated the operation via zoneadm(1m), he'll get
1238          * auto-verification which will let him know what's wrong.  If he
1239          * modifies the zone configuration of a running zone and doesn't attempt
1240          * to verify that it's OK we won't crash but won't bother trying to be
1241          * too helpful either.  zoneadm verify is only a couple keystrokes away.
1242          */
1243         if (!zonecfg_valid_fs_type(fsptr->zone_fs_type)) {
1244                 zerror(zlogp, B_FALSE, "cannot mount %s on %s: "
1245                     "invalid file-system type %s", fsptr->zone_fs_special,
1246                     fsptr->zone_fs_dir, fsptr->zone_fs_type);
1247                 return (-1);
1248         }
1249 
1250         /*
1251          * If we're looking at an alternate root environment, then construct
1252          * read-only loopback mounts as necessary.  Note that any special
1253          * paths for lofs zone mounts in an alternate root must have
1254          * already been pre-pended with any alternate root path by the
1255          * time we get here.
1256          */
1257         if (zonecfg_in_alt_root()) {
1258                 struct stat64 st;
1259 
1260                 if (stat64(fsptr->zone_fs_special, &st) != -1 &&
1261                     S_ISBLK(st.st_mode)) {
1262                         /*
1263                          * If we're going to mount a block device we need
1264                          * to check if that device is already mounted
1265                          * somewhere else, and if so, do a lofs mount
1266                          * of the device instead of a direct mount
1267                          */
1268                         if (check_lofs_needed(zlogp, fsptr) == -1)
1269                                 return (-1);
1270                 } else if (strcmp(fsptr->zone_fs_type, MNTTYPE_LOFS) == 0) {
1271                         /*
1272                          * For lofs mounts, the special node is inside the
1273                          * alternate root.  We need lofs resolution for
1274                          * this case in order to get at the underlying
1275                          * read-write path.
1276                          */
1277                         resolve_lofs(zlogp, fsptr->zone_fs_special,
1278                             sizeof (fsptr->zone_fs_special));
1279                 }
1280         }
1281 
1282         /*
1283          * Run 'fsck -m' if there's a device to fsck.
1284          */
1285         if (fsptr->zone_fs_raw[0] != '\0' &&
1286             dofsck(zlogp, fsptr->zone_fs_type, fsptr->zone_fs_raw) != 0) {
1287                 return (-1);
1288         } else if (isregfile(fsptr->zone_fs_special) == 1 &&
1289             dofsck(zlogp, fsptr->zone_fs_type, fsptr->zone_fs_special) != 0) {
1290                 return (-1);
1291         }
1292 
1293         /*
1294          * Build up mount option string.
1295          */
1296         optstr[0] = '\0';
1297         if (fsptr->zone_fs_options != NULL) {
1298                 (void) strlcpy(optstr, fsptr->zone_fs_options->zone_fsopt_opt,
1299                     sizeof (optstr));
1300                 for (optptr = fsptr->zone_fs_options->zone_fsopt_next;
1301                     optptr != NULL; optptr = optptr->zone_fsopt_next) {
1302                         (void) strlcat(optstr, ",", sizeof (optstr));
1303                         (void) strlcat(optstr, optptr->zone_fsopt_opt,
1304                             sizeof (optstr));
1305                 }
1306         }
1307 
1308         if ((rv = domount(zlogp, fsptr->zone_fs_type, optstr,
1309             fsptr->zone_fs_special, path)) != 0)
1310                 return (rv);
1311 
1312         /*
1313          * The mount succeeded.  If this was not a mount of /dev then
1314          * we're done.
1315          */
1316         if (strcmp(fsptr->zone_fs_type, MNTTYPE_DEV) != 0)
1317                 return (0);
1318 
1319         /*
1320          * We just mounted an instance of a /dev filesystem, so now we
1321          * need to configure it.
1322          */
1323         return (mount_one_dev(zlogp, path, mount_cmd));
1324 }
1325 
1326 static void
1327 free_fs_data(struct zone_fstab *fsarray, uint_t nelem)
1328 {
1329         uint_t i;
1330 
1331         if (fsarray == NULL)
1332                 return;
1333         for (i = 0; i < nelem; i++)
1334                 zonecfg_free_fs_option_list(fsarray[i].zone_fs_options);
1335         free(fsarray);
1336 }
1337 
1338 /*
1339  * This function initiates the creation of a small Solaris Environment for
1340  * scratch zone. The Environment creation process is split up into two
1341  * functions(build_mounted_pre_var() and build_mounted_post_var()). It
1342  * is done this way because:
1343  *      We need to have both /etc and /var in the root of the scratchzone.
1344  *      We loopback mount zone's own /etc and /var into the root of the
1345  *      scratch zone. Unlike /etc, /var can be a seperate filesystem. So we
1346  *      need to delay the mount of /var till the zone's root gets populated.
1347  *      So mounting of localdirs[](/etc and /var) have been moved to the
1348  *      build_mounted_post_var() which gets called only after the zone
1349  *      specific filesystems are mounted.
1350  *
1351  * Note that the scratch zone we set up for updating the zone (Z_MNT_UPDATE)
1352  * does not loopback mount the zone's own /etc and /var into the root of the
1353  * scratch zone.
1354  */
1355 static boolean_t
1356 build_mounted_pre_var(zlog_t *zlogp, char *rootpath,
1357     size_t rootlen, const char *zonepath, char *luroot, size_t lurootlen)
1358 {
1359         char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1360         const char **cpp;
1361         static const char *mkdirs[] = {
1362                 "/system", "/system/contract", "/system/object", "/proc",
1363                 "/dev", "/tmp", "/a", NULL
1364         };
1365         char *altstr;
1366         FILE *fp;
1367         uuid_t uuid;
1368 
1369         resolve_lofs(zlogp, rootpath, rootlen);
1370         (void) snprintf(luroot, lurootlen, "%s/lu", zonepath);
1371         resolve_lofs(zlogp, luroot, lurootlen);
1372         (void) snprintf(tmp, sizeof (tmp), "%s/bin", luroot);
1373         (void) symlink("./usr/bin", tmp);
1374 
1375         /*
1376          * These are mostly special mount points; not handled here.  (See
1377          * zone_mount_early.)
1378          */
1379         for (cpp = mkdirs; *cpp != NULL; cpp++) {
1380                 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1381                 if (mkdir(tmp, 0755) != 0) {
1382                         zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1383                         return (B_FALSE);
1384                 }
1385         }
1386         /*
1387          * This is here to support lucopy.  If there's an instance of this same
1388          * zone on the current running system, then we mount its root up as
1389          * read-only inside the scratch zone.
1390          */
1391         (void) zonecfg_get_uuid(zone_name, uuid);
1392         altstr = strdup(zonecfg_get_root());
1393         if (altstr == NULL) {
1394                 zerror(zlogp, B_TRUE, "memory allocation failed");
1395                 return (B_FALSE);
1396         }
1397         zonecfg_set_root("");
1398         (void) strlcpy(tmp, zone_name, sizeof (tmp));
1399         (void) zonecfg_get_name_by_uuid(uuid, tmp, sizeof (tmp));
1400         if (zone_get_rootpath(tmp, fromdir, sizeof (fromdir)) == Z_OK &&
1401             strcmp(fromdir, rootpath) != 0) {
1402                 (void) snprintf(tmp, sizeof (tmp), "%s/b", luroot);
1403                 if (mkdir(tmp, 0755) != 0) {
1404                         zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1405                         return (B_FALSE);
1406                 }
1407                 if (domount(zlogp, MNTTYPE_LOFS, RESOURCE_DEFAULT_OPTS, fromdir,
1408                     tmp) != 0) {
1409                         zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1410                             fromdir);
1411                         return (B_FALSE);
1412                 }
1413         }
1414         zonecfg_set_root(altstr);
1415         free(altstr);
1416 
1417         if ((fp = zonecfg_open_scratch(luroot, B_TRUE)) == NULL) {
1418                 zerror(zlogp, B_TRUE, "cannot open zone mapfile");
1419                 return (B_FALSE);
1420         }
1421         (void) ftruncate(fileno(fp), 0);
1422         if (zonecfg_add_scratch(fp, zone_name, kernzone, "/") == -1) {
1423                 zerror(zlogp, B_TRUE, "cannot add zone mapfile entry");
1424         }
1425         zonecfg_close_scratch(fp);
1426         (void) snprintf(tmp, sizeof (tmp), "%s/a", luroot);
1427         if (domount(zlogp, MNTTYPE_LOFS, "", rootpath, tmp) != 0)
1428                 return (B_FALSE);
1429         (void) strlcpy(rootpath, tmp, rootlen);
1430         return (B_TRUE);
1431 }
1432 
1433 
1434 static boolean_t
1435 build_mounted_post_var(zlog_t *zlogp, zone_mnt_t mount_cmd, char *rootpath,
1436     const char *luroot)
1437 {
1438         char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1439         const char **cpp;
1440         const char **loopdirs;
1441         const char **tmpdirs;
1442         static const char *localdirs[] = {
1443                 "/etc", "/var", NULL
1444         };
1445         static const char *scr_loopdirs[] = {
1446                 "/etc/lib", "/etc/fs", "/lib", "/sbin", "/platform",
1447                 "/usr", NULL
1448         };
1449         static const char *upd_loopdirs[] = {
1450                 "/etc", "/kernel", "/lib", "/opt", "/platform", "/sbin",
1451                 "/usr", "/var", NULL
1452         };
1453         static const char *scr_tmpdirs[] = {
1454                 "/tmp", "/var/run", NULL
1455         };
1456         static const char *upd_tmpdirs[] = {
1457                 "/tmp", "/var/run", "/var/tmp", NULL
1458         };
1459         struct stat st;
1460 
1461         if (mount_cmd == Z_MNT_SCRATCH) {
1462                 /*
1463                  * These are mounted read-write from the zone undergoing
1464                  * upgrade.  We must be careful not to 'leak' things from the
1465                  * main system into the zone, and this accomplishes that goal.
1466                  */
1467                 for (cpp = localdirs; *cpp != NULL; cpp++) {
1468                         (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot,
1469                             *cpp);
1470                         (void) snprintf(fromdir, sizeof (fromdir), "%s%s",
1471                             rootpath, *cpp);
1472                         if (mkdir(tmp, 0755) != 0) {
1473                                 zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1474                                 return (B_FALSE);
1475                         }
1476                         if (domount(zlogp, MNTTYPE_LOFS, "", fromdir, tmp)
1477                             != 0) {
1478                                 zerror(zlogp, B_TRUE, "cannot mount %s on %s",
1479                                     tmp, *cpp);
1480                                 return (B_FALSE);
1481                         }
1482                 }
1483         }
1484 
1485         if (mount_cmd == Z_MNT_UPDATE)
1486                 loopdirs = upd_loopdirs;
1487         else
1488                 loopdirs = scr_loopdirs;
1489 
1490         /*
1491          * These are things mounted read-only from the running system because
1492          * they contain binaries that must match system.
1493          */
1494         for (cpp = loopdirs; *cpp != NULL; cpp++) {
1495                 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1496                 if (mkdir(tmp, 0755) != 0) {
1497                         if (errno != EEXIST) {
1498                                 zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1499                                 return (B_FALSE);
1500                         }
1501                         if (lstat(tmp, &st) != 0) {
1502                                 zerror(zlogp, B_TRUE, "cannot stat %s", tmp);
1503                                 return (B_FALSE);
1504                         }
1505                         /*
1506                          * Ignore any non-directories encountered.  These are
1507                          * things that have been converted into symlinks
1508                          * (/etc/fs and /etc/lib) and no longer need a lofs
1509                          * fixup.
1510                          */
1511                         if (!S_ISDIR(st.st_mode))
1512                                 continue;
1513                 }
1514                 if (domount(zlogp, MNTTYPE_LOFS, RESOURCE_DEFAULT_OPTS, *cpp,
1515                     tmp) != 0) {
1516                         zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1517                             *cpp);
1518                         return (B_FALSE);
1519                 }
1520         }
1521 
1522         if (mount_cmd == Z_MNT_UPDATE)
1523                 tmpdirs = upd_tmpdirs;
1524         else
1525                 tmpdirs = scr_tmpdirs;
1526 
1527         /*
1528          * These are things with tmpfs mounted inside.
1529          */
1530         for (cpp = tmpdirs; *cpp != NULL; cpp++) {
1531                 (void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1532                 if (mount_cmd == Z_MNT_SCRATCH && mkdir(tmp, 0755) != 0 &&
1533                     errno != EEXIST) {
1534                         zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1535                         return (B_FALSE);
1536                 }
1537 
1538                 /*
1539                  * We could set the mode for /tmp when we do the mkdir but
1540                  * since that can be modified by the umask we will just set
1541                  * the correct mode for /tmp now.
1542                  */
1543                 if (strcmp(*cpp, "/tmp") == 0 && chmod(tmp, 01777) != 0) {
1544                         zerror(zlogp, B_TRUE, "cannot chmod %s", tmp);
1545                         return (B_FALSE);
1546                 }
1547 
1548                 if (domount(zlogp, MNTTYPE_TMPFS, "", "swap", tmp) != 0) {
1549                         zerror(zlogp, B_TRUE, "cannot mount swap on %s", *cpp);
1550                         return (B_FALSE);
1551                 }
1552         }
1553         return (B_TRUE);
1554 }
1555 
1556 typedef struct plat_gmount_cb_data {
1557         zlog_t                  *pgcd_zlogp;
1558         struct zone_fstab       **pgcd_fs_tab;
1559         int                     *pgcd_num_fs;
1560 } plat_gmount_cb_data_t;
1561 
1562 /*
1563  * plat_gmount_cb() is a callback function invoked by libbrand to iterate
1564  * through all global brand platform mounts.
1565  */
1566 int
1567 plat_gmount_cb(void *data, const char *spec, const char *dir,
1568     const char *fstype, const char *opt)
1569 {
1570         plat_gmount_cb_data_t   *cp = data;
1571         zlog_t                  *zlogp = cp->pgcd_zlogp;
1572         struct zone_fstab       *fs_ptr = *cp->pgcd_fs_tab;
1573         int                     num_fs = *cp->pgcd_num_fs;
1574         struct zone_fstab       *fsp, *tmp_ptr;
1575 
1576         num_fs++;
1577         if ((tmp_ptr = realloc(fs_ptr, num_fs * sizeof (*tmp_ptr))) == NULL) {
1578                 zerror(zlogp, B_TRUE, "memory allocation failed");
1579                 return (-1);
1580         }
1581 
1582         fs_ptr = tmp_ptr;
1583         fsp = &fs_ptr[num_fs - 1];
1584 
1585         /* update the callback struct passed in */
1586         *cp->pgcd_fs_tab = fs_ptr;
1587         *cp->pgcd_num_fs = num_fs;
1588 
1589         fsp->zone_fs_raw[0] = '\0';
1590         (void) strlcpy(fsp->zone_fs_special, spec,
1591             sizeof (fsp->zone_fs_special));
1592         (void) strlcpy(fsp->zone_fs_dir, dir, sizeof (fsp->zone_fs_dir));
1593         (void) strlcpy(fsp->zone_fs_type, fstype, sizeof (fsp->zone_fs_type));
1594         fsp->zone_fs_options = NULL;
1595         if ((opt != NULL) &&
1596             (zonecfg_add_fs_option(fsp, (char *)opt) != Z_OK)) {
1597                 zerror(zlogp, B_FALSE, "error adding property");
1598                 return (-1);
1599         }
1600 
1601         return (0);
1602 }
1603 
1604 static int
1605 mount_filesystems_fsent(zone_dochandle_t handle, zlog_t *zlogp,
1606     struct zone_fstab **fs_tabp, int *num_fsp, zone_mnt_t mount_cmd)
1607 {
1608         struct zone_fstab *tmp_ptr, *fs_ptr, *fsp, fstab;
1609         int num_fs;
1610 
1611         num_fs = *num_fsp;
1612         fs_ptr = *fs_tabp;
1613 
1614         if (zonecfg_setfsent(handle) != Z_OK) {
1615                 zerror(zlogp, B_FALSE, "invalid configuration");
1616                 return (-1);
1617         }
1618         while (zonecfg_getfsent(handle, &fstab) == Z_OK) {
1619                 /*
1620                  * ZFS filesystems will not be accessible under an alternate
1621                  * root, since the pool will not be known.  Ignore them in this
1622                  * case.
1623                  */
1624                 if (ALT_MOUNT(mount_cmd) &&
1625                     strcmp(fstab.zone_fs_type, MNTTYPE_ZFS) == 0)
1626                         continue;
1627 
1628                 num_fs++;
1629                 if ((tmp_ptr = realloc(fs_ptr,
1630                     num_fs * sizeof (*tmp_ptr))) == NULL) {
1631                         zerror(zlogp, B_TRUE, "memory allocation failed");
1632                         (void) zonecfg_endfsent(handle);
1633                         return (-1);
1634                 }
1635                 /* update the pointers passed in */
1636                 *fs_tabp = tmp_ptr;
1637                 *num_fsp = num_fs;
1638 
1639                 fs_ptr = tmp_ptr;
1640                 fsp = &fs_ptr[num_fs - 1];
1641                 (void) strlcpy(fsp->zone_fs_dir,
1642                     fstab.zone_fs_dir, sizeof (fsp->zone_fs_dir));
1643                 (void) strlcpy(fsp->zone_fs_raw, fstab.zone_fs_raw,
1644                     sizeof (fsp->zone_fs_raw));
1645                 (void) strlcpy(fsp->zone_fs_type, fstab.zone_fs_type,
1646                     sizeof (fsp->zone_fs_type));
1647                 fsp->zone_fs_options = fstab.zone_fs_options;
1648 
1649                 /*
1650                  * For all lofs mounts, make sure that the 'special'
1651                  * entry points inside the alternate root.  The
1652                  * source path for a lofs mount in a given zone needs
1653                  * to be relative to the root of the boot environment
1654                  * that contains the zone.  Note that we don't do this
1655                  * for non-lofs mounts since they will have a device
1656                  * as a backing store and device paths must always be
1657                  * specified relative to the current boot environment.
1658                  */
1659                 fsp->zone_fs_special[0] = '\0';
1660                 if (strcmp(fsp->zone_fs_type, MNTTYPE_LOFS) == 0) {
1661                         (void) strlcat(fsp->zone_fs_special, zonecfg_get_root(),
1662                             sizeof (fsp->zone_fs_special));
1663                 }
1664                 (void) strlcat(fsp->zone_fs_special, fstab.zone_fs_special,
1665                     sizeof (fsp->zone_fs_special));
1666         }
1667         (void) zonecfg_endfsent(handle);
1668         return (0);
1669 }
1670 
1671 static int
1672 mount_filesystems(zlog_t *zlogp, zone_mnt_t mount_cmd)
1673 {
1674         char rootpath[MAXPATHLEN];
1675         char zonepath[MAXPATHLEN];
1676         char brand[MAXNAMELEN];
1677         char luroot[MAXPATHLEN];
1678         int i, num_fs = 0;
1679         struct zone_fstab *fs_ptr = NULL;
1680         zone_dochandle_t handle = NULL;
1681         zone_state_t zstate;
1682         brand_handle_t bh;
1683         plat_gmount_cb_data_t cb;
1684 
1685         if (zone_get_state(zone_name, &zstate) != Z_OK ||
1686             (zstate != ZONE_STATE_READY && zstate != ZONE_STATE_MOUNTED)) {
1687                 zerror(zlogp, B_FALSE,
1688                     "zone must be in '%s' or '%s' state to mount file-systems",
1689                     zone_state_str(ZONE_STATE_READY),
1690                     zone_state_str(ZONE_STATE_MOUNTED));
1691                 goto bad;
1692         }
1693 
1694         if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
1695                 zerror(zlogp, B_TRUE, "unable to determine zone path");
1696                 goto bad;
1697         }
1698 
1699         if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
1700                 zerror(zlogp, B_TRUE, "unable to determine zone root");
1701                 goto bad;
1702         }
1703 
1704         if ((handle = zonecfg_init_handle()) == NULL) {
1705                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
1706                 goto bad;
1707         }
1708         if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK ||
1709             zonecfg_setfsent(handle) != Z_OK) {
1710                 zerror(zlogp, B_FALSE, "invalid configuration");
1711                 goto bad;
1712         }
1713 
1714         /*
1715          * If we are mounting the zone, then we must always use the default
1716          * brand global mounts.
1717          */
1718         if (ALT_MOUNT(mount_cmd)) {
1719                 (void) strlcpy(brand, default_brand, sizeof (brand));
1720         } else {
1721                 (void) strlcpy(brand, brand_name, sizeof (brand));
1722         }
1723 
1724         /* Get a handle to the brand info for this zone */
1725         if ((bh = brand_open(brand)) == NULL) {
1726                 zerror(zlogp, B_FALSE, "unable to determine zone brand");
1727                 zonecfg_fini_handle(handle);
1728                 return (-1);
1729         }
1730 
1731         /*
1732          * Get the list of global filesystems to mount from the brand
1733          * configuration.
1734          */
1735         cb.pgcd_zlogp = zlogp;
1736         cb.pgcd_fs_tab = &fs_ptr;
1737         cb.pgcd_num_fs = &num_fs;
1738         if (brand_platform_iter_gmounts(bh, zonepath,
1739             plat_gmount_cb, &cb) != 0) {
1740                 zerror(zlogp, B_FALSE, "unable to mount filesystems");
1741                 brand_close(bh);
1742                 zonecfg_fini_handle(handle);
1743                 return (-1);
1744         }
1745         brand_close(bh);
1746 
1747         /*
1748          * Iterate through the rest of the filesystems. Sort them all,
1749          * then mount them in sorted order. This is to make sure the
1750          * higher level directories (e.g., /usr) get mounted before
1751          * any beneath them (e.g., /usr/local).
1752          */
1753         if (mount_filesystems_fsent(handle, zlogp, &fs_ptr, &num_fs,
1754             mount_cmd) != 0)
1755                 goto bad;
1756 
1757         zonecfg_fini_handle(handle);
1758         handle = NULL;
1759 
1760         /*
1761          * Normally when we mount a zone all the zone filesystems
1762          * get mounted relative to rootpath, which is usually
1763          * <zonepath>/root.  But when mounting a zone for administration
1764          * purposes via the zone "mount" state, build_mounted_pre_var()
1765          * updates rootpath to be <zonepath>/lu/a so we'll mount all
1766          * the zones filesystems there instead.
1767          *
1768          * build_mounted_pre_var() and build_mounted_post_var() will
1769          * also do some extra work to create directories and lofs mount
1770          * a bunch of global zone file system paths into <zonepath>/lu.
1771          *
1772          * This allows us to be able to enter the zone (now rooted at
1773          * <zonepath>/lu) and run the upgrade/patch tools that are in the
1774          * global zone and have them upgrade the to-be-modified zone's
1775          * files mounted on /a.  (Which mirrors the existing standard
1776          * upgrade environment.)
1777          *
1778          * There is of course one catch.  When doing the upgrade
1779          * we need <zoneroot>/lu/dev to be the /dev filesystem
1780          * for the zone and we don't want to have any /dev filesystem
1781          * mounted at <zoneroot>/lu/a/dev.  Since /dev is specified
1782          * as a normal zone filesystem by default we'll try to mount
1783          * it at <zoneroot>/lu/a/dev, so we have to detect this
1784          * case and instead mount it at <zoneroot>/lu/dev.
1785          *
1786          * All this work is done in three phases:
1787          *   1) Create and populate lu directory (build_mounted_pre_var()).
1788          *   2) Mount the required filesystems as per the zone configuration.
1789          *   3) Set up the rest of the scratch zone environment
1790          *      (build_mounted_post_var()).
1791          */
1792         if (ALT_MOUNT(mount_cmd) && !build_mounted_pre_var(zlogp,
1793             rootpath, sizeof (rootpath), zonepath, luroot, sizeof (luroot)))
1794                 goto bad;
1795 
1796         qsort(fs_ptr, num_fs, sizeof (*fs_ptr), fs_compare);
1797 
1798         for (i = 0; i < num_fs; i++) {
1799                 if (ALT_MOUNT(mount_cmd) &&
1800                     strcmp(fs_ptr[i].zone_fs_dir, "/dev") == 0) {
1801                         size_t slen = strlen(rootpath) - 2;
1802 
1803                         /*
1804                          * By default we'll try to mount /dev as /a/dev
1805                          * but /dev is special and always goes at the top
1806                          * so strip the trailing '/a' from the rootpath.
1807                          */
1808                         assert(strcmp(&rootpath[slen], "/a") == 0);
1809                         rootpath[slen] = '\0';
1810                         if (mount_one(zlogp, &fs_ptr[i], rootpath, mount_cmd)
1811                             != 0)
1812                                 goto bad;
1813                         rootpath[slen] = '/';
1814                         continue;
1815                 }
1816                 if (mount_one(zlogp, &fs_ptr[i], rootpath, mount_cmd) != 0)
1817                         goto bad;
1818         }
1819         if (ALT_MOUNT(mount_cmd) &&
1820             !build_mounted_post_var(zlogp, mount_cmd, rootpath, luroot))
1821                 goto bad;
1822 
1823         /*
1824          * For Trusted Extensions cross-mount each lower level /export/home
1825          */
1826         if (mount_cmd == Z_MNT_BOOT &&
1827             tsol_mounts(zlogp, zone_name, rootpath) != 0)
1828                 goto bad;
1829 
1830         free_fs_data(fs_ptr, num_fs);
1831 
1832         /*
1833          * Everything looks fine.
1834          */
1835         return (0);
1836 
1837 bad:
1838         if (handle != NULL)
1839                 zonecfg_fini_handle(handle);
1840         free_fs_data(fs_ptr, num_fs);
1841         return (-1);
1842 }
1843 
1844 /* caller makes sure neither parameter is NULL */
1845 static int
1846 addr2netmask(char *prefixstr, int maxprefixlen, uchar_t *maskstr)
1847 {
1848         int prefixlen;
1849 
1850         prefixlen = atoi(prefixstr);
1851         if (prefixlen < 0 || prefixlen > maxprefixlen)
1852                 return (1);
1853         while (prefixlen > 0) {
1854                 if (prefixlen >= 8) {
1855                         *maskstr++ = 0xFF;
1856                         prefixlen -= 8;
1857                         continue;
1858                 }
1859                 *maskstr |= 1 << (8 - prefixlen);
1860                 prefixlen--;
1861         }
1862         return (0);
1863 }
1864 
1865 /*
1866  * Tear down all interfaces belonging to the given zone.  This should
1867  * be called with the zone in a state other than "running", so that
1868  * interfaces can't be assigned to the zone after this returns.
1869  *
1870  * If anything goes wrong, log an error message and return an error.
1871  */
1872 static int
1873 unconfigure_shared_network_interfaces(zlog_t *zlogp, zoneid_t zone_id)
1874 {
1875         struct lifnum lifn;
1876         struct lifconf lifc;
1877         struct lifreq *lifrp, lifrl;
1878         int64_t lifc_flags = LIFC_NOXMIT | LIFC_ALLZONES;
1879         int num_ifs, s, i, ret_code = 0;
1880         uint_t bufsize;
1881         char *buf = NULL;
1882 
1883         if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
1884                 zerror(zlogp, B_TRUE, "could not get socket");
1885                 ret_code = -1;
1886                 goto bad;
1887         }
1888         lifn.lifn_family = AF_UNSPEC;
1889         lifn.lifn_flags = (int)lifc_flags;
1890         if (ioctl(s, SIOCGLIFNUM, (char *)&lifn) < 0) {
1891                 zerror(zlogp, B_TRUE,
1892                     "could not determine number of network interfaces");
1893                 ret_code = -1;
1894                 goto bad;
1895         }
1896         num_ifs = lifn.lifn_count;
1897         bufsize = num_ifs * sizeof (struct lifreq);
1898         if ((buf = malloc(bufsize)) == NULL) {
1899                 zerror(zlogp, B_TRUE, "memory allocation failed");
1900                 ret_code = -1;
1901                 goto bad;
1902         }
1903         lifc.lifc_family = AF_UNSPEC;
1904         lifc.lifc_flags = (int)lifc_flags;
1905         lifc.lifc_len = bufsize;
1906         lifc.lifc_buf = buf;
1907         if (ioctl(s, SIOCGLIFCONF, (char *)&lifc) < 0) {
1908                 zerror(zlogp, B_TRUE, "could not get configured network "
1909                     "interfaces");
1910                 ret_code = -1;
1911                 goto bad;
1912         }
1913         lifrp = lifc.lifc_req;
1914         for (i = lifc.lifc_len / sizeof (struct lifreq); i > 0; i--, lifrp++) {
1915                 (void) close(s);
1916                 if ((s = socket(lifrp->lifr_addr.ss_family, SOCK_DGRAM, 0)) <
1917                     0) {
1918                         zerror(zlogp, B_TRUE, "%s: could not get socket",
1919                             lifrl.lifr_name);
1920                         ret_code = -1;
1921                         continue;
1922                 }
1923                 (void) memset(&lifrl, 0, sizeof (lifrl));
1924                 (void) strncpy(lifrl.lifr_name, lifrp->lifr_name,
1925                     sizeof (lifrl.lifr_name));
1926                 if (ioctl(s, SIOCGLIFZONE, (caddr_t)&lifrl) < 0) {
1927                         if (errno == ENXIO)
1928                                 /*
1929                                  * Interface may have been removed by admin or
1930                                  * another zone halting.
1931                                  */
1932                                 continue;
1933                         zerror(zlogp, B_TRUE,
1934                             "%s: could not determine the zone to which this "
1935                             "network interface is bound", lifrl.lifr_name);
1936                         ret_code = -1;
1937                         continue;
1938                 }
1939                 if (lifrl.lifr_zoneid == zone_id) {
1940                         if (ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifrl) < 0) {
1941                                 zerror(zlogp, B_TRUE,
1942                                     "%s: could not remove network interface",
1943                                     lifrl.lifr_name);
1944                                 ret_code = -1;
1945                                 continue;
1946                         }
1947                 }
1948         }
1949 bad:
1950         if (s > 0)
1951                 (void) close(s);
1952         if (buf)
1953                 free(buf);
1954         return (ret_code);
1955 }
1956 
1957 static union    sockunion {
1958         struct  sockaddr sa;
1959         struct  sockaddr_in sin;
1960         struct  sockaddr_dl sdl;
1961         struct  sockaddr_in6 sin6;
1962 } so_dst, so_ifp;
1963 
1964 static struct {
1965         struct  rt_msghdr hdr;
1966         char    space[512];
1967 } rtmsg;
1968 
1969 static int
1970 salen(struct sockaddr *sa)
1971 {
1972         switch (sa->sa_family) {
1973         case AF_INET:
1974                 return (sizeof (struct sockaddr_in));
1975         case AF_LINK:
1976                 return (sizeof (struct sockaddr_dl));
1977         case AF_INET6:
1978                 return (sizeof (struct sockaddr_in6));
1979         default:
1980                 return (sizeof (struct sockaddr));
1981         }
1982 }
1983 
1984 #define ROUNDUP_LONG(a) \
1985         ((a) > 0 ? (1 + (((a) - 1) | (sizeof (long) - 1))) : sizeof (long))
1986 
1987 /*
1988  * Look up which zone is using a given IP address.  The address in question
1989  * is expected to have been stuffed into the structure to which lifr points
1990  * via a previous SIOCGLIFADDR ioctl().
1991  *
1992  * This is done using black router socket magic.
1993  *
1994  * Return the name of the zone on success or NULL on failure.
1995  *
1996  * This is a lot of code for a simple task; a new ioctl request to take care
1997  * of this might be a useful RFE.
1998  */
1999 
2000 static char *
2001 who_is_using(zlog_t *zlogp, struct lifreq *lifr)
2002 {
2003         static char answer[ZONENAME_MAX];
2004         pid_t pid;
2005         int s, rlen, l, i;
2006         char *cp = rtmsg.space;
2007         struct sockaddr_dl *ifp = NULL;
2008         struct sockaddr *sa;
2009         char save_if_name[LIFNAMSIZ];
2010 
2011         answer[0] = '\0';
2012 
2013         pid = getpid();
2014         if ((s = socket(PF_ROUTE, SOCK_RAW, 0)) < 0) {
2015                 zerror(zlogp, B_TRUE, "could not get routing socket");
2016                 return (NULL);
2017         }
2018 
2019         if (lifr->lifr_addr.ss_family == AF_INET) {
2020                 struct sockaddr_in *sin4;
2021 
2022                 so_dst.sa.sa_family = AF_INET;
2023                 sin4 = (struct sockaddr_in *)&lifr->lifr_addr;
2024                 so_dst.sin.sin_addr = sin4->sin_addr;
2025         } else {
2026                 struct sockaddr_in6 *sin6;
2027 
2028                 so_dst.sa.sa_family = AF_INET6;
2029                 sin6 = (struct sockaddr_in6 *)&lifr->lifr_addr;
2030                 so_dst.sin6.sin6_addr = sin6->sin6_addr;
2031         }
2032 
2033         so_ifp.sa.sa_family = AF_LINK;
2034 
2035         (void) memset(&rtmsg, 0, sizeof (rtmsg));
2036         rtmsg.hdr.rtm_type = RTM_GET;
2037         rtmsg.hdr.rtm_flags = RTF_UP | RTF_HOST;
2038         rtmsg.hdr.rtm_version = RTM_VERSION;
2039         rtmsg.hdr.rtm_seq = ++rts_seqno;
2040         rtmsg.hdr.rtm_addrs = RTA_IFP | RTA_DST;
2041 
2042         l = ROUNDUP_LONG(salen(&so_dst.sa));
2043         (void) memmove(cp, &(so_dst), l);
2044         cp += l;
2045         l = ROUNDUP_LONG(salen(&so_ifp.sa));
2046         (void) memmove(cp, &(so_ifp), l);
2047         cp += l;
2048 
2049         rtmsg.hdr.rtm_msglen = l = cp - (char *)&rtmsg;
2050 
2051         if ((rlen = write(s, &rtmsg, l)) < 0) {
2052                 zerror(zlogp, B_TRUE, "writing to routing socket");
2053                 return (NULL);
2054         } else if (rlen < (int)rtmsg.hdr.rtm_msglen) {
2055                 zerror(zlogp, B_TRUE,
2056                     "write to routing socket got only %d for len\n", rlen);
2057                 return (NULL);
2058         }
2059         do {
2060                 l = read(s, &rtmsg, sizeof (rtmsg));
2061         } while (l > 0 && (rtmsg.hdr.rtm_seq != rts_seqno ||
2062             rtmsg.hdr.rtm_pid != pid));
2063         if (l < 0) {
2064                 zerror(zlogp, B_TRUE, "reading from routing socket");
2065                 return (NULL);
2066         }
2067 
2068         if (rtmsg.hdr.rtm_version != RTM_VERSION) {
2069                 zerror(zlogp, B_FALSE,
2070                     "routing message version %d not understood",
2071                     rtmsg.hdr.rtm_version);
2072                 return (NULL);
2073         }
2074         if (rtmsg.hdr.rtm_msglen != (ushort_t)l) {
2075                 zerror(zlogp, B_FALSE, "message length mismatch, "
2076                     "expected %d bytes, returned %d bytes",
2077                     rtmsg.hdr.rtm_msglen, l);
2078                 return (NULL);
2079         }
2080         if (rtmsg.hdr.rtm_errno != 0)  {
2081                 errno = rtmsg.hdr.rtm_errno;
2082                 zerror(zlogp, B_TRUE, "RTM_GET routing socket message");
2083                 return (NULL);
2084         }
2085         if ((rtmsg.hdr.rtm_addrs & RTA_IFP) == 0) {
2086                 zerror(zlogp, B_FALSE, "network interface not found");
2087                 return (NULL);
2088         }
2089         cp = ((char *)(&rtmsg.hdr + 1));
2090         for (i = 1; i != 0; i <<= 1) {
2091                 /* LINTED E_BAD_PTR_CAST_ALIGN */
2092                 sa = (struct sockaddr *)cp;
2093                 if (i != RTA_IFP) {
2094                         if ((i & rtmsg.hdr.rtm_addrs) != 0)
2095                                 cp += ROUNDUP_LONG(salen(sa));
2096                         continue;
2097                 }
2098                 if (sa->sa_family == AF_LINK &&
2099                     ((struct sockaddr_dl *)sa)->sdl_nlen != 0)
2100                         ifp = (struct sockaddr_dl *)sa;
2101                 break;
2102         }
2103         if (ifp == NULL) {
2104                 zerror(zlogp, B_FALSE, "network interface could not be "
2105                     "determined");
2106                 return (NULL);
2107         }
2108 
2109         /*
2110          * We need to set the I/F name to what we got above, then do the
2111          * appropriate ioctl to get its zone name.  But lifr->lifr_name is
2112          * used by the calling function to do a REMOVEIF, so if we leave the
2113          * "good" zone's I/F name in place, *that* I/F will be removed instead
2114          * of the bad one.  So we save the old (bad) I/F name before over-
2115          * writing it and doing the ioctl, then restore it after the ioctl.
2116          */
2117         (void) strlcpy(save_if_name, lifr->lifr_name, sizeof (save_if_name));
2118         (void) strncpy(lifr->lifr_name, ifp->sdl_data, ifp->sdl_nlen);
2119         lifr->lifr_name[ifp->sdl_nlen] = '\0';
2120         i = ioctl(s, SIOCGLIFZONE, lifr);
2121         (void) strlcpy(lifr->lifr_name, save_if_name, sizeof (save_if_name));
2122         if (i < 0) {
2123                 zerror(zlogp, B_TRUE,
2124                     "%s: could not determine the zone network interface "
2125                     "belongs to", lifr->lifr_name);
2126                 return (NULL);
2127         }
2128         if (getzonenamebyid(lifr->lifr_zoneid, answer, sizeof (answer)) < 0)
2129                 (void) snprintf(answer, sizeof (answer), "%d",
2130                     lifr->lifr_zoneid);
2131 
2132         if (strlen(answer) > 0)
2133                 return (answer);
2134         return (NULL);
2135 }
2136 
2137 /*
2138  * Configures a single interface: a new virtual interface is added, based on
2139  * the physical interface nwiftabptr->zone_nwif_physical, with the address
2140  * specified in nwiftabptr->zone_nwif_address, for zone zone_id.  Note that
2141  * the "address" can be an IPv6 address (with a /prefixlength required), an
2142  * IPv4 address (with a /prefixlength optional), or a name; for the latter,
2143  * an IPv4 name-to-address resolution will be attempted.
2144  *
2145  * If anything goes wrong, we log an detailed error message, attempt to tear
2146  * down whatever we set up and return an error.
2147  */
2148 static int
2149 configure_one_interface(zlog_t *zlogp, zoneid_t zone_id,
2150     struct zone_nwiftab *nwiftabptr)
2151 {
2152         struct lifreq lifr;
2153         struct sockaddr_in netmask4;
2154         struct sockaddr_in6 netmask6;
2155         struct sockaddr_storage laddr;
2156         struct in_addr in4;
2157         sa_family_t af;
2158         char *slashp = strchr(nwiftabptr->zone_nwif_address, '/');
2159         int s;
2160         boolean_t got_netmask = B_FALSE;
2161         boolean_t is_loopback = B_FALSE;
2162         char addrstr4[INET_ADDRSTRLEN];
2163         int res;
2164 
2165         res = zonecfg_valid_net_address(nwiftabptr->zone_nwif_address, &lifr);
2166         if (res != Z_OK) {
2167                 zerror(zlogp, B_FALSE, "%s: %s", zonecfg_strerror(res),
2168                     nwiftabptr->zone_nwif_address);
2169                 return (-1);
2170         }
2171         af = lifr.lifr_addr.ss_family;
2172         if (af == AF_INET)
2173                 in4 = ((struct sockaddr_in *)(&lifr.lifr_addr))->sin_addr;
2174         if ((s = socket(af, SOCK_DGRAM, 0)) < 0) {
2175                 zerror(zlogp, B_TRUE, "could not get socket");
2176                 return (-1);
2177         }
2178 
2179         /*
2180          * This is a similar kind of "hack" like in addif() to get around
2181          * the problem of SIOCLIFADDIF.  The problem is that this ioctl
2182          * does not include the netmask when adding a logical interface.
2183          * To get around this problem, we first add the logical interface
2184          * with a 0 address.  After that, we set the netmask if provided.
2185          * Finally we set the interface address.
2186          */
2187         laddr = lifr.lifr_addr;
2188         (void) strlcpy(lifr.lifr_name, nwiftabptr->zone_nwif_physical,
2189             sizeof (lifr.lifr_name));
2190         (void) memset(&lifr.lifr_addr, 0, sizeof (lifr.lifr_addr));
2191 
2192         if (ioctl(s, SIOCLIFADDIF, (caddr_t)&lifr) < 0) {
2193                 /*
2194                  * Here, we know that the interface can't be brought up.
2195                  * A similar warning message was already printed out to
2196                  * the console by zoneadm(1M) so instead we log the
2197                  * message to syslog and continue.
2198                  */
2199                 zerror(&logsys, B_TRUE, "WARNING: skipping network interface "
2200                     "'%s' which may not be present/plumbed in the "
2201                     "global zone.", lifr.lifr_name);
2202                 (void) close(s);
2203                 return (Z_OK);
2204         }
2205 
2206         /* Preserve literal IPv4 address for later potential printing. */
2207         if (af == AF_INET)
2208                 (void) inet_ntop(AF_INET, &in4, addrstr4, INET_ADDRSTRLEN);
2209 
2210         lifr.lifr_zoneid = zone_id;
2211         if (ioctl(s, SIOCSLIFZONE, (caddr_t)&lifr) < 0) {
2212                 zerror(zlogp, B_TRUE, "%s: could not place network interface "
2213                     "into zone", lifr.lifr_name);
2214                 goto bad;
2215         }
2216 
2217         /*
2218          * Loopback interface will use the default netmask assigned, if no
2219          * netmask is found.
2220          */
2221         if (strcmp(nwiftabptr->zone_nwif_physical, "lo0") == 0) {
2222                 is_loopback = B_TRUE;
2223         }
2224         if (af == AF_INET) {
2225                 /*
2226                  * The IPv4 netmask can be determined either
2227                  * directly if a prefix length was supplied with
2228                  * the address or via the netmasks database.  Not
2229                  * being able to determine it is a common failure,
2230                  * but it often is not fatal to operation of the
2231                  * interface.  In that case, a warning will be
2232                  * printed after the rest of the interface's
2233                  * parameters have been configured.
2234                  */
2235                 (void) memset(&netmask4, 0, sizeof (netmask4));
2236                 if (slashp != NULL) {
2237                         if (addr2netmask(slashp + 1, V4_ADDR_LEN,
2238                             (uchar_t *)&netmask4.sin_addr) != 0) {
2239                                 *slashp = '/';
2240                                 zerror(zlogp, B_FALSE,
2241                                     "%s: invalid prefix length in %s",
2242                                     lifr.lifr_name,
2243                                     nwiftabptr->zone_nwif_address);
2244                                 goto bad;
2245                         }
2246                         got_netmask = B_TRUE;
2247                 } else if (getnetmaskbyaddr(in4,
2248                     &netmask4.sin_addr) == 0) {
2249                         got_netmask = B_TRUE;
2250                 }
2251                 if (got_netmask) {
2252                         netmask4.sin_family = af;
2253                         (void) memcpy(&lifr.lifr_addr, &netmask4,
2254                             sizeof (netmask4));
2255                 }
2256         } else {
2257                 (void) memset(&netmask6, 0, sizeof (netmask6));
2258                 if (addr2netmask(slashp + 1, V6_ADDR_LEN,
2259                     (uchar_t *)&netmask6.sin6_addr) != 0) {
2260                         *slashp = '/';
2261                         zerror(zlogp, B_FALSE,
2262                             "%s: invalid prefix length in %s",
2263                             lifr.lifr_name,
2264                             nwiftabptr->zone_nwif_address);
2265                         goto bad;
2266                 }
2267                 got_netmask = B_TRUE;
2268                 netmask6.sin6_family = af;
2269                 (void) memcpy(&lifr.lifr_addr, &netmask6,
2270                     sizeof (netmask6));
2271         }
2272         if (got_netmask &&
2273             ioctl(s, SIOCSLIFNETMASK, (caddr_t)&lifr) < 0) {
2274                 zerror(zlogp, B_TRUE, "%s: could not set netmask",
2275                     lifr.lifr_name);
2276                 goto bad;
2277         }
2278 
2279         /* Set the interface address */
2280         lifr.lifr_addr = laddr;
2281         if (ioctl(s, SIOCSLIFADDR, (caddr_t)&lifr) < 0) {
2282                 zerror(zlogp, B_TRUE,
2283                     "%s: could not set IP address to %s",
2284                     lifr.lifr_name, nwiftabptr->zone_nwif_address);
2285                 goto bad;
2286         }
2287 
2288         if (ioctl(s, SIOCGLIFFLAGS, (caddr_t)&lifr) < 0) {
2289                 zerror(zlogp, B_TRUE, "%s: could not get flags",
2290                     lifr.lifr_name);
2291                 goto bad;
2292         }
2293         lifr.lifr_flags |= IFF_UP;
2294         if (ioctl(s, SIOCSLIFFLAGS, (caddr_t)&lifr) < 0) {
2295                 int save_errno = errno;
2296                 char *zone_using;
2297 
2298                 /*
2299                  * If we failed with something other than EADDRNOTAVAIL,
2300                  * then skip to the end.  Otherwise, look up our address,
2301                  * then call a function to determine which zone is already
2302                  * using that address.
2303                  */
2304                 if (errno != EADDRNOTAVAIL) {
2305                         zerror(zlogp, B_TRUE,
2306                             "%s: could not bring network interface up",
2307                             lifr.lifr_name);
2308                         goto bad;
2309                 }
2310                 if (ioctl(s, SIOCGLIFADDR, (caddr_t)&lifr) < 0) {
2311                         zerror(zlogp, B_TRUE, "%s: could not get address",
2312                             lifr.lifr_name);
2313                         goto bad;
2314                 }
2315                 zone_using = who_is_using(zlogp, &lifr);
2316                 errno = save_errno;
2317                 if (zone_using == NULL)
2318                         zerror(zlogp, B_TRUE,
2319                             "%s: could not bring network interface up",
2320                             lifr.lifr_name);
2321                 else
2322                         zerror(zlogp, B_TRUE, "%s: could not bring network "
2323                             "interface up: address in use by zone '%s'",
2324                             lifr.lifr_name, zone_using);
2325                 goto bad;
2326         }
2327 
2328         if (!got_netmask && !is_loopback) {
2329                 /*
2330                  * A common, but often non-fatal problem, is that the system
2331                  * cannot find the netmask for an interface address. This is
2332                  * often caused by it being only in /etc/inet/netmasks, but
2333                  * /etc/nsswitch.conf says to use NIS or NIS+ and it's not
2334                  * in that. This doesn't show up at boot because the netmask
2335                  * is obtained from /etc/inet/netmasks when no network
2336                  * interfaces are up, but isn't consulted when NIS/NIS+ is
2337                  * available. We warn the user here that something like this
2338                  * has happened and we're just running with a default and
2339                  * possible incorrect netmask.
2340                  */
2341                 char buffer[INET6_ADDRSTRLEN];
2342                 void  *addr;
2343                 const char *nomatch = "no matching subnet found in netmasks(4)";
2344 
2345                 if (af == AF_INET)
2346                         addr = &((struct sockaddr_in *)
2347                             (&lifr.lifr_addr))->sin_addr;
2348                 else
2349                         addr = &((struct sockaddr_in6 *)
2350                             (&lifr.lifr_addr))->sin6_addr;
2351 
2352                 /*
2353                  * Find out what netmask the interface is going to be using.
2354                  * If we just brought up an IPMP data address on an underlying
2355                  * interface above, the address will have already migrated, so
2356                  * the SIOCGLIFNETMASK won't be able to find it (but we need
2357                  * to bring the address up to get the actual netmask).  Just
2358                  * omit printing the actual netmask in this corner-case.
2359                  */
2360                 if (ioctl(s, SIOCGLIFNETMASK, (caddr_t)&lifr) < 0 ||
2361                     inet_ntop(af, addr, buffer, sizeof (buffer)) == NULL) {
2362                         zerror(zlogp, B_FALSE, "WARNING: %s; using default.",
2363                             nomatch);
2364                 } else {
2365                         zerror(zlogp, B_FALSE,
2366                             "WARNING: %s: %s: %s; using default of %s.",
2367                             lifr.lifr_name, nomatch, addrstr4, buffer);
2368                 }
2369         }
2370 
2371         /*
2372          * If a default router was specified for this interface
2373          * set the route now. Ignore if already set.
2374          */
2375         if (strlen(nwiftabptr->zone_nwif_defrouter) > 0) {
2376                 int status;
2377                 char *argv[7];
2378 
2379                 argv[0] = "route";
2380                 argv[1] = "add";
2381                 argv[2] = "-ifp";
2382                 argv[3] = nwiftabptr->zone_nwif_physical;
2383                 argv[4] = "default";
2384                 argv[5] = nwiftabptr->zone_nwif_defrouter;
2385                 argv[6] = NULL;
2386 
2387                 status = forkexec(zlogp, "/usr/sbin/route", argv);
2388                 if (status != 0 && status != EEXIST)
2389                         zerror(zlogp, B_FALSE, "Unable to set route for "
2390                             "interface %s to %s\n",
2391                             nwiftabptr->zone_nwif_physical,
2392                             nwiftabptr->zone_nwif_defrouter);
2393         }
2394 
2395         (void) close(s);
2396         return (Z_OK);
2397 bad:
2398         (void) ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifr);
2399         (void) close(s);
2400         return (-1);
2401 }
2402 
2403 /*
2404  * Sets up network interfaces based on information from the zone configuration.
2405  * IPv4 and IPv6 loopback interfaces are set up "for free", modeling the global
2406  * system.
2407  *
2408  * If anything goes wrong, we log a general error message, attempt to tear down
2409  * whatever we set up, and return an error.
2410  */
2411 static int
2412 configure_shared_network_interfaces(zlog_t *zlogp)
2413 {
2414         zone_dochandle_t handle;
2415         struct zone_nwiftab nwiftab, loopback_iftab;
2416         zoneid_t zoneid;
2417 
2418         if ((zoneid = getzoneidbyname(zone_name)) == ZONE_ID_UNDEFINED) {
2419                 zerror(zlogp, B_TRUE, "unable to get zoneid");
2420                 return (-1);
2421         }
2422 
2423         if ((handle = zonecfg_init_handle()) == NULL) {
2424                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
2425                 return (-1);
2426         }
2427         if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2428                 zerror(zlogp, B_FALSE, "invalid configuration");
2429                 zonecfg_fini_handle(handle);
2430                 return (-1);
2431         }
2432         if (zonecfg_setnwifent(handle) == Z_OK) {
2433                 for (;;) {
2434                         if (zonecfg_getnwifent(handle, &nwiftab) != Z_OK)
2435                                 break;
2436                         if (configure_one_interface(zlogp, zoneid, &nwiftab) !=
2437                             Z_OK) {
2438                                 (void) zonecfg_endnwifent(handle);
2439                                 zonecfg_fini_handle(handle);
2440                                 return (-1);
2441                         }
2442                 }
2443                 (void) zonecfg_endnwifent(handle);
2444         }
2445         zonecfg_fini_handle(handle);
2446         if (is_system_labeled()) {
2447                 /*
2448                  * Labeled zones share the loopback interface
2449                  * so it is not plumbed for shared stack instances.
2450                  */
2451                 return (0);
2452         }
2453         (void) strlcpy(loopback_iftab.zone_nwif_physical, "lo0",
2454             sizeof (loopback_iftab.zone_nwif_physical));
2455         (void) strlcpy(loopback_iftab.zone_nwif_address, "127.0.0.1",
2456             sizeof (loopback_iftab.zone_nwif_address));
2457         loopback_iftab.zone_nwif_defrouter[0] = '\0';
2458         if (configure_one_interface(zlogp, zoneid, &loopback_iftab) != Z_OK)
2459                 return (-1);
2460 
2461         /* Always plumb up the IPv6 loopback interface. */
2462         (void) strlcpy(loopback_iftab.zone_nwif_address, "::1/128",
2463             sizeof (loopback_iftab.zone_nwif_address));
2464         if (configure_one_interface(zlogp, zoneid, &loopback_iftab) != Z_OK)
2465                 return (-1);
2466         return (0);
2467 }
2468 
2469 static void
2470 zdlerror(zlog_t *zlogp, dladm_status_t err, const char *dlname, const char *str)
2471 {
2472         char errmsg[DLADM_STRSIZE];
2473 
2474         (void) dladm_status2str(err, errmsg);
2475         zerror(zlogp, B_FALSE, "%s '%s': %s", str, dlname, errmsg);
2476 }
2477 
2478 static int
2479 add_datalink(zlog_t *zlogp, char *zone_name, datalink_id_t linkid, char *dlname)
2480 {
2481         dladm_status_t err;
2482         boolean_t cpuset, poolset;
2483         char *poolp;
2484 
2485         /* First check if it's in use by global zone. */
2486         if (zonecfg_ifname_exists(AF_INET, dlname) ||
2487             zonecfg_ifname_exists(AF_INET6, dlname)) {
2488                 zerror(zlogp, B_FALSE, "WARNING: skipping network interface "
2489                     "'%s' which is used in the global zone", dlname);
2490                 return (-1);
2491         }
2492 
2493         /* Set zoneid of this link. */
2494         err = dladm_set_linkprop(dld_handle, linkid, "zone", &zone_name, 1,
2495             DLADM_OPT_ACTIVE);
2496         if (err != DLADM_STATUS_OK) {
2497                 zdlerror(zlogp, err, dlname,
2498                     "WARNING: unable to add network interface");
2499                 return (-1);
2500         }
2501 
2502         /*
2503          * Set the pool of this link if the zone has a pool and
2504          * neither the cpus nor the pool datalink property is
2505          * already set.
2506          */
2507         err = dladm_linkprop_is_set(dld_handle, linkid, DLADM_PROP_VAL_CURRENT,
2508             "cpus", &cpuset);
2509         if (err != DLADM_STATUS_OK) {
2510                 zdlerror(zlogp, err, dlname,
2511                     "WARNING: unable to check if cpus link property is set");
2512         }
2513         err = dladm_linkprop_is_set(dld_handle, linkid, DLADM_PROP_VAL_CURRENT,
2514             "pool", &poolset);
2515         if (err != DLADM_STATUS_OK) {
2516                 zdlerror(zlogp, err, dlname,
2517                     "WARNING: unable to check if pool link property is set");
2518         }
2519 
2520         if ((strlen(pool_name) != 0) && !cpuset && !poolset) {
2521                 poolp = pool_name;
2522                 err = dladm_set_linkprop(dld_handle, linkid, "pool",
2523                     &poolp, 1, DLADM_OPT_ACTIVE);
2524                 if (err != DLADM_STATUS_OK) {
2525                         zerror(zlogp, B_FALSE, "WARNING: unable to set "
2526                             "pool %s to datalink %s", pool_name, dlname);
2527                         bzero(pool_name, sizeof (pool_name));
2528                 }
2529         } else {
2530                 bzero(pool_name, sizeof (pool_name));
2531         }
2532         return (0);
2533 }
2534 
2535 static boolean_t
2536 sockaddr_to_str(sa_family_t af, const struct sockaddr *sockaddr,
2537     char *straddr, size_t len)
2538 {
2539         struct sockaddr_in *sin;
2540         struct sockaddr_in6 *sin6;
2541         const char *str = NULL;
2542 
2543         if (af == AF_INET) {
2544                 /* LINTED E_BAD_PTR_CAST_ALIGN */
2545                 sin = SIN(sockaddr);
2546                 str = inet_ntop(AF_INET, (void *)&sin->sin_addr, straddr, len);
2547         } else if (af == AF_INET6) {
2548                 /* LINTED E_BAD_PTR_CAST_ALIGN */
2549                 sin6 = SIN6(sockaddr);
2550                 str = inet_ntop(AF_INET6, (void *)&sin6->sin6_addr, straddr,
2551                     len);
2552         }
2553 
2554         return (str != NULL);
2555 }
2556 
2557 static int
2558 ipv4_prefixlen(struct sockaddr_in *sin)
2559 {
2560         struct sockaddr_in *m;
2561         struct sockaddr_storage mask;
2562 
2563         m = SIN(&mask);
2564         m->sin_family = AF_INET;
2565         if (getnetmaskbyaddr(sin->sin_addr, &m->sin_addr) == 0) {
2566                 return (mask2plen((struct sockaddr *)&mask));
2567         } else if (IN_CLASSA(htonl(sin->sin_addr.s_addr))) {
2568                 return (8);
2569         } else if (IN_CLASSB(ntohl(sin->sin_addr.s_addr))) {
2570                 return (16);
2571         } else if (IN_CLASSC(ntohl(sin->sin_addr.s_addr))) {
2572                 return (24);
2573         }
2574         return (0);
2575 }
2576 
2577 static int
2578 zone_setattr_network(int type, zoneid_t zoneid, datalink_id_t linkid,
2579     void *buf, size_t bufsize)
2580 {
2581         zone_net_data_t *zndata;
2582         size_t znsize;
2583         int err;
2584 
2585         znsize = sizeof (*zndata) + bufsize;
2586         zndata = calloc(1, znsize);
2587         if (zndata == NULL)
2588                 return (ENOMEM);
2589         zndata->zn_type = type;
2590         zndata->zn_len = bufsize;
2591         zndata->zn_linkid = linkid;
2592         bcopy(buf, zndata->zn_val, zndata->zn_len);
2593         err = zone_setattr(zoneid, ZONE_ATTR_NETWORK, zndata, znsize);
2594         free(zndata);
2595         return (err);
2596 }
2597 
2598 static int
2599 add_net_for_linkid(zlog_t *zlogp, zoneid_t zoneid, zone_addr_list_t *start)
2600 {
2601         struct lifreq lifr;
2602         char **astr, *address;
2603         dladm_status_t dlstatus;
2604         char *ip_nospoof = "ip-nospoof";
2605         int nnet, naddr, err = 0, j;
2606         size_t zlen, cpleft;
2607         zone_addr_list_t *ptr, *end;
2608         char  tmp[INET6_ADDRSTRLEN], *maskstr;
2609         char *zaddr, *cp;
2610         struct in6_addr *routes = NULL;
2611         boolean_t is_set;
2612         datalink_id_t linkid;
2613 
2614         assert(start != NULL);
2615         naddr = 0; /* number of addresses */
2616         nnet = 0; /* number of net resources */
2617         linkid = start->za_linkid;
2618         for (ptr = start; ptr != NULL && ptr->za_linkid == linkid;
2619             ptr = ptr->za_next) {
2620                 nnet++;
2621         }
2622         end = ptr;
2623         zlen = nnet * (INET6_ADDRSTRLEN + 1);
2624         astr = calloc(1, nnet * sizeof (uintptr_t));
2625         zaddr = calloc(1, zlen);
2626         if (astr == NULL || zaddr == NULL) {
2627                 err = ENOMEM;
2628                 goto done;
2629         }
2630         cp = zaddr;
2631         cpleft = zlen;
2632         j = 0;
2633         for (ptr = start; ptr != end; ptr = ptr->za_next) {
2634                 address = ptr->za_nwiftab.zone_nwif_allowed_address;
2635                 if (address[0] == '\0')
2636                         continue;
2637                 (void) snprintf(tmp, sizeof (tmp), "%s", address);
2638                 /*
2639                  * Validate the data. zonecfg_valid_net_address() clobbers
2640                  * the /<mask> in the address string.
2641                  */
2642                 if (zonecfg_valid_net_address(address, &lifr) != Z_OK) {
2643                         zerror(zlogp, B_FALSE, "invalid address [%s]\n",
2644                             address);
2645                         err = EINVAL;
2646                         goto done;
2647                 }
2648                 /*
2649                  * convert any hostnames to numeric address strings.
2650                  */
2651                 if (!sockaddr_to_str(lifr.lifr_addr.ss_family,
2652                     (const struct sockaddr *)&lifr.lifr_addr, cp, cpleft)) {
2653                         err = EINVAL;
2654                         goto done;
2655                 }
2656                 /*
2657                  * make a copy of the numeric string for the data needed
2658                  * by the "allowed-ips" datalink property.
2659                  */
2660                 astr[j] = strdup(cp);
2661                 if (astr[j] == NULL) {
2662                         err = ENOMEM;
2663                         goto done;
2664                 }
2665                 j++;
2666                 /*
2667                  * compute the default netmask from the address, if necessary
2668                  */
2669                 if ((maskstr = strchr(tmp, '/')) == NULL) {
2670                         int prefixlen;
2671 
2672                         if (lifr.lifr_addr.ss_family == AF_INET) {
2673                                 prefixlen = ipv4_prefixlen(
2674                                     SIN(&lifr.lifr_addr));
2675                         } else {
2676                                 struct sockaddr_in6 *sin6;
2677 
2678                                 sin6 = SIN6(&lifr.lifr_addr);
2679                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2680                                         prefixlen = 10;
2681                                 else
2682                                         prefixlen = 64;
2683                         }
2684                         (void) snprintf(tmp, sizeof (tmp), "%d", prefixlen);
2685                         maskstr = tmp;
2686                 } else {
2687                         maskstr++;
2688                 }
2689                 /* append the "/<netmask>" */
2690                 (void) strlcat(cp, "/", cpleft);
2691                 (void) strlcat(cp, maskstr, cpleft);
2692                 (void) strlcat(cp, ",", cpleft);
2693                 cp += strnlen(cp, zlen);
2694                 cpleft = &zaddr[INET6_ADDRSTRLEN] - cp;
2695         }
2696         naddr = j; /* the actual number of addresses in the net resource */
2697         assert(naddr <= nnet);
2698 
2699         /*
2700          * zonecfg has already verified that the defrouter property can only
2701          * be set if there is at least one address defined for the net resource.
2702          * If j is 0, there are no addresses defined, and therefore no routers
2703          * to configure, and we are done at that point.
2704          */
2705         if (j == 0)
2706                 goto done;
2707 
2708         /* over-write last ',' with '\0' */
2709         zaddr[strnlen(zaddr, zlen) + 1] = '\0';
2710 
2711         /*
2712          * First make sure L3 protection is not already set on the link.
2713          */
2714         dlstatus = dladm_linkprop_is_set(dld_handle, linkid, DLADM_OPT_ACTIVE,
2715             "protection", &is_set);
2716         if (dlstatus != DLADM_STATUS_OK) {
2717                 err = EINVAL;
2718                 zerror(zlogp, B_FALSE, "unable to check if protection is set");
2719                 goto done;
2720         }
2721         if (is_set) {
2722                 err = EINVAL;
2723                 zerror(zlogp, B_FALSE, "Protection is already set");
2724                 goto done;
2725         }
2726         dlstatus = dladm_linkprop_is_set(dld_handle, linkid, DLADM_OPT_ACTIVE,
2727             "allowed-ips", &is_set);
2728         if (dlstatus != DLADM_STATUS_OK) {
2729                 err = EINVAL;
2730                 zerror(zlogp, B_FALSE, "unable to check if allowed-ips is set");
2731                 goto done;
2732         }
2733         if (is_set) {
2734                 zerror(zlogp, B_FALSE, "allowed-ips is already set");
2735                 err = EINVAL;
2736                 goto done;
2737         }
2738 
2739         /*
2740          * Enable ip-nospoof for the link, and add address to the allowed-ips
2741          * list.
2742          */
2743         dlstatus = dladm_set_linkprop(dld_handle, linkid, "protection",
2744             &ip_nospoof, 1, DLADM_OPT_ACTIVE);
2745         if (dlstatus != DLADM_STATUS_OK) {
2746                 zerror(zlogp, B_FALSE, "could not set protection\n");
2747                 err = EINVAL;
2748                 goto done;
2749         }
2750         dlstatus = dladm_set_linkprop(dld_handle, linkid, "allowed-ips",
2751             astr, naddr, DLADM_OPT_ACTIVE);
2752         if (dlstatus != DLADM_STATUS_OK) {
2753                 zerror(zlogp, B_FALSE, "could not set allowed-ips\n");
2754                 err = EINVAL;
2755                 goto done;
2756         }
2757 
2758         /* now set the address in the data-store */
2759         err = zone_setattr_network(ZONE_NETWORK_ADDRESS, zoneid, linkid,
2760             zaddr, strnlen(zaddr, zlen) + 1);
2761         if (err != 0)
2762                 goto done;
2763 
2764         /*
2765          * add the defaultrouters
2766          */
2767         routes = calloc(1, nnet * sizeof (*routes));
2768         j = 0;
2769         for (ptr = start; ptr != end; ptr = ptr->za_next) {
2770                 address = ptr->za_nwiftab.zone_nwif_defrouter;
2771                 if (address[0] == '\0')
2772                         continue;
2773                 if (strchr(address, '/') == NULL && strchr(address, ':') != 0) {
2774                         /*
2775                          * zonecfg_valid_net_address() expects numeric IPv6
2776                          * addresses to have a CIDR format netmask.
2777                          */
2778                         (void) snprintf(tmp, sizeof (tmp), "/%d", V6_ADDR_LEN);
2779                         (void) strlcat(address, tmp, INET6_ADDRSTRLEN);
2780                 }
2781                 if (zonecfg_valid_net_address(address, &lifr) != Z_OK) {
2782                         zerror(zlogp, B_FALSE,
2783                             "invalid router [%s]\n", address);
2784                         err = EINVAL;
2785                         goto done;
2786                 }
2787                 if (lifr.lifr_addr.ss_family == AF_INET6) {
2788                         routes[j] = SIN6(&lifr.lifr_addr)->sin6_addr;
2789                 } else {
2790                         IN6_INADDR_TO_V4MAPPED(&SIN(&lifr.lifr_addr)->sin_addr,
2791                             &routes[j]);
2792                 }
2793                 j++;
2794         }
2795         assert(j <= nnet);
2796         if (j > 0) {
2797                 err = zone_setattr_network(ZONE_NETWORK_DEFROUTER, zoneid,
2798                     linkid, routes, j * sizeof (*routes));
2799         }
2800 done:
2801         free(routes);
2802         for (j = 0; j < naddr; j++)
2803                 free(astr[j]);
2804         free(astr);
2805         free(zaddr);
2806         return (err);
2807 
2808 }
2809 
2810 static int
2811 add_net(zlog_t *zlogp, zoneid_t zoneid, zone_addr_list_t *zalist)
2812 {
2813         zone_addr_list_t *ptr;
2814         datalink_id_t linkid;
2815         int err;
2816 
2817         if (zalist == NULL)
2818                 return (0);
2819 
2820         linkid = zalist->za_linkid;
2821 
2822         err = add_net_for_linkid(zlogp, zoneid, zalist);
2823         if (err != 0)
2824                 return (err);
2825 
2826         for (ptr = zalist; ptr != NULL; ptr = ptr->za_next) {
2827                 if (ptr->za_linkid == linkid)
2828                         continue;
2829                 linkid = ptr->za_linkid;
2830                 err = add_net_for_linkid(zlogp, zoneid, ptr);
2831                 if (err != 0)
2832                         return (err);
2833         }
2834         return (0);
2835 }
2836 
2837 /*
2838  * Add "new" to the list of network interfaces to be configured  by
2839  * add_net on zone boot in "old". The list of interfaces in "old" is
2840  * sorted by datalink_id_t, with interfaces sorted FIFO for a given
2841  * datalink_id_t.
2842  *
2843  * Returns the merged list of IP interfaces containing "old" and "new"
2844  */
2845 static zone_addr_list_t *
2846 add_ip_interface(zone_addr_list_t *old, zone_addr_list_t *new)
2847 {
2848         zone_addr_list_t *ptr, *next;
2849         datalink_id_t linkid = new->za_linkid;
2850 
2851         assert(old != new);
2852 
2853         if (old == NULL)
2854                 return (new);
2855         for (ptr = old; ptr != NULL; ptr = ptr->za_next) {
2856                 if (ptr->za_linkid == linkid)
2857                         break;
2858         }
2859         if (ptr == NULL) {
2860                 /* linkid does not already exist, add to the beginning */
2861                 new->za_next = old;
2862                 return (new);
2863         }
2864         /*
2865          * adding to the middle of the list; ptr points at the first
2866          * occurrence of linkid. Find the last occurrence.
2867          */
2868         while ((next = ptr->za_next) != NULL) {
2869                 if (next->za_linkid != linkid)
2870                         break;
2871                 ptr = next;
2872         }
2873         /* insert new after ptr */
2874         new->za_next = next;
2875         ptr->za_next = new;
2876         return (old);
2877 }
2878 
2879 void
2880 free_ip_interface(zone_addr_list_t *zalist)
2881 {
2882         zone_addr_list_t *ptr, *new;
2883 
2884         for (ptr = zalist; ptr != NULL; ) {
2885                 new = ptr;
2886                 ptr = ptr->za_next;
2887                 free(new);
2888         }
2889 }
2890 
2891 /*
2892  * Add the kernel access control information for the interface names.
2893  * If anything goes wrong, we log a general error message, attempt to tear down
2894  * whatever we set up, and return an error.
2895  */
2896 static int
2897 configure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
2898 {
2899         zone_dochandle_t handle;
2900         struct zone_nwiftab nwiftab;
2901         char rootpath[MAXPATHLEN];
2902         char path[MAXPATHLEN];
2903         datalink_id_t linkid;
2904         di_prof_t prof = NULL;
2905         boolean_t added = B_FALSE;
2906         zone_addr_list_t *zalist = NULL, *new;
2907 
2908         if ((handle = zonecfg_init_handle()) == NULL) {
2909                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
2910                 return (-1);
2911         }
2912         if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2913                 zerror(zlogp, B_FALSE, "invalid configuration");
2914                 zonecfg_fini_handle(handle);
2915                 return (-1);
2916         }
2917 
2918         if (zonecfg_setnwifent(handle) != Z_OK) {
2919                 zonecfg_fini_handle(handle);
2920                 return (0);
2921         }
2922 
2923         for (;;) {
2924                 if (zonecfg_getnwifent(handle, &nwiftab) != Z_OK)
2925                         break;
2926 
2927                 if (prof == NULL) {
2928                         if (zone_get_devroot(zone_name, rootpath,
2929                             sizeof (rootpath)) != Z_OK) {
2930                                 (void) zonecfg_endnwifent(handle);
2931                                 zonecfg_fini_handle(handle);
2932                                 zerror(zlogp, B_TRUE,
2933                                     "unable to determine dev root");
2934                                 return (-1);
2935                         }
2936                         (void) snprintf(path, sizeof (path), "%s%s", rootpath,
2937                             "/dev");
2938                         if (di_prof_init(path, &prof) != 0) {
2939                                 (void) zonecfg_endnwifent(handle);
2940                                 zonecfg_fini_handle(handle);
2941                                 zerror(zlogp, B_TRUE,
2942                                     "failed to initialize profile");
2943                                 return (-1);
2944                         }
2945                 }
2946 
2947                 /*
2948                  * Create the /dev entry for backward compatibility.
2949                  * Only create the /dev entry if it's not in use.
2950                  * Note that the zone still boots when the assigned
2951                  * interface is inaccessible, used by others, etc.
2952                  * Also, when vanity naming is used, some interface do
2953                  * do not have corresponding /dev node names (for example,
2954                  * vanity named aggregations).  The /dev entry is not
2955                  * created in that case.  The /dev/net entry is always
2956                  * accessible.
2957                  */
2958                 if (dladm_name2info(dld_handle, nwiftab.zone_nwif_physical,
2959                     &linkid, NULL, NULL, NULL) == DLADM_STATUS_OK &&
2960                     add_datalink(zlogp, zone_name, linkid,
2961                     nwiftab.zone_nwif_physical) == 0) {
2962                         added = B_TRUE;
2963                 } else {
2964                         (void) zonecfg_endnwifent(handle);
2965                         zonecfg_fini_handle(handle);
2966                         zerror(zlogp, B_TRUE, "failed to add network device");
2967                         return (-1);
2968                 }
2969                 /* set up the new IP interface, and add them all later */
2970                 new = malloc(sizeof (*new));
2971                 if (new == NULL) {
2972                         zerror(zlogp, B_TRUE, "no memory for %s",
2973                             nwiftab.zone_nwif_physical);
2974                         zonecfg_fini_handle(handle);
2975                         free_ip_interface(zalist);
2976                 }
2977                 bzero(new, sizeof (*new));
2978                 new->za_nwiftab = nwiftab;
2979                 new->za_linkid = linkid;
2980                 zalist = add_ip_interface(zalist, new);
2981         }
2982         if (zalist != NULL) {
2983                 if ((errno = add_net(zlogp, zoneid, zalist)) != 0) {
2984                         (void) zonecfg_endnwifent(handle);
2985                         zonecfg_fini_handle(handle);
2986                         zerror(zlogp, B_TRUE, "failed to add address");
2987                         free_ip_interface(zalist);
2988                         return (-1);
2989                 }
2990                 free_ip_interface(zalist);
2991         }
2992         (void) zonecfg_endnwifent(handle);
2993         zonecfg_fini_handle(handle);
2994 
2995         if (prof != NULL && added) {
2996                 if (di_prof_commit(prof) != 0) {
2997                         zerror(zlogp, B_TRUE, "failed to commit profile");
2998                         return (-1);
2999                 }
3000         }
3001         if (prof != NULL)
3002                 di_prof_fini(prof);
3003 
3004         return (0);
3005 }
3006 
3007 static int
3008 remove_datalink_pool(zlog_t *zlogp, zoneid_t zoneid)
3009 {
3010         ushort_t flags;
3011         zone_iptype_t iptype;
3012         int i, dlnum = 0;
3013         datalink_id_t *dllink, *dllinks = NULL;
3014         dladm_status_t err;
3015 
3016         if (strlen(pool_name) == 0)
3017                 return (0);
3018 
3019         if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
3020             sizeof (flags)) < 0) {
3021                 if (vplat_get_iptype(zlogp, &iptype) < 0) {
3022                         zerror(zlogp, B_FALSE, "unable to determine ip-type");
3023                         return (-1);
3024                 }
3025         } else {
3026                 if (flags & ZF_NET_EXCL)
3027                         iptype = ZS_EXCLUSIVE;
3028                 else
3029                         iptype = ZS_SHARED;
3030         }
3031 
3032         if (iptype == ZS_EXCLUSIVE) {
3033                 /*
3034                  * Get the datalink count and for each datalink,
3035                  * attempt to clear the pool property and clear
3036                  * the pool_name.
3037                  */
3038                 if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
3039                         zerror(zlogp, B_TRUE, "unable to count network "
3040                             "interfaces");
3041                         return (-1);
3042                 }
3043 
3044                 if (dlnum == 0)
3045                         return (0);
3046 
3047                 if ((dllinks = malloc(dlnum * sizeof (datalink_id_t)))
3048                     == NULL) {
3049                         zerror(zlogp, B_TRUE, "memory allocation failed");
3050                         return (-1);
3051                 }
3052                 if (zone_list_datalink(zoneid, &dlnum, dllinks) != 0) {
3053                         zerror(zlogp, B_TRUE, "unable to list network "
3054                             "interfaces");
3055                         return (-1);
3056                 }
3057 
3058                 bzero(pool_name, sizeof (pool_name));
3059                 for (i = 0, dllink = dllinks; i < dlnum; i++, dllink++) {
3060                         err = dladm_set_linkprop(dld_handle, *dllink, "pool",
3061                             NULL, 0, DLADM_OPT_ACTIVE);
3062                         if (err != DLADM_STATUS_OK) {
3063                                 zerror(zlogp, B_TRUE,
3064                                     "WARNING: unable to clear pool");
3065                         }
3066                 }
3067                 free(dllinks);
3068         }
3069         return (0);
3070 }
3071 
3072 static int
3073 remove_datalink_protect(zlog_t *zlogp, zoneid_t zoneid)
3074 {
3075         ushort_t flags;
3076         zone_iptype_t iptype;
3077         int i, dlnum = 0;
3078         dladm_status_t dlstatus;
3079         datalink_id_t *dllink, *dllinks = NULL;
3080 
3081         if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
3082             sizeof (flags)) < 0) {
3083                 if (vplat_get_iptype(zlogp, &iptype) < 0) {
3084                         zerror(zlogp, B_FALSE, "unable to determine ip-type");
3085                         return (-1);
3086                 }
3087         } else {
3088                 if (flags & ZF_NET_EXCL)
3089                         iptype = ZS_EXCLUSIVE;
3090                 else
3091                         iptype = ZS_SHARED;
3092         }
3093 
3094         if (iptype != ZS_EXCLUSIVE)
3095                 return (0);
3096 
3097         /*
3098          * Get the datalink count and for each datalink,
3099          * attempt to clear the pool property and clear
3100          * the pool_name.
3101          */
3102         if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
3103                 zerror(zlogp, B_TRUE, "unable to count network interfaces");
3104                 return (-1);
3105         }
3106 
3107         if (dlnum == 0)
3108                 return (0);
3109 
3110         if ((dllinks = malloc(dlnum * sizeof (datalink_id_t))) == NULL) {
3111                 zerror(zlogp, B_TRUE, "memory allocation failed");
3112                 return (-1);
3113         }
3114         if (zone_list_datalink(zoneid, &dlnum, dllinks) != 0) {
3115                 zerror(zlogp, B_TRUE, "unable to list network interfaces");
3116                 free(dllinks);
3117                 return (-1);
3118         }
3119 
3120         for (i = 0, dllink = dllinks; i < dlnum; i++, dllink++) {
3121                 char dlerr[DLADM_STRSIZE];
3122 
3123                 dlstatus = dladm_set_linkprop(dld_handle, *dllink,
3124                     "protection", NULL, 0, DLADM_OPT_ACTIVE);
3125                 if (dlstatus == DLADM_STATUS_NOTFOUND) {
3126                         /* datalink does not belong to the GZ */
3127                         continue;
3128                 }
3129                 if (dlstatus != DLADM_STATUS_OK) {
3130                         zerror(zlogp, B_FALSE,
3131                             dladm_status2str(dlstatus, dlerr));
3132                         free(dllinks);
3133                         return (-1);
3134                 }
3135                 dlstatus = dladm_set_linkprop(dld_handle, *dllink,
3136                     "allowed-ips", NULL, 0, DLADM_OPT_ACTIVE);
3137                 if (dlstatus != DLADM_STATUS_OK) {
3138                         zerror(zlogp, B_FALSE,
3139                             dladm_status2str(dlstatus, dlerr));
3140                         free(dllinks);
3141                         return (-1);
3142                 }
3143         }
3144         free(dllinks);
3145         return (0);
3146 }
3147 
3148 static int
3149 unconfigure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
3150 {
3151         int dlnum = 0;
3152 
3153         /*
3154          * The kernel shutdown callback for the dls module should have removed
3155          * all datalinks from this zone.  If any remain, then there's a
3156          * problem.
3157          */
3158         if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
3159                 zerror(zlogp, B_TRUE, "unable to list network interfaces");
3160                 return (-1);
3161         }
3162         if (dlnum != 0) {
3163                 zerror(zlogp, B_FALSE,
3164                     "datalinks remain in zone after shutdown");
3165                 return (-1);
3166         }
3167         return (0);
3168 }
3169 
3170 static int
3171 tcp_abort_conn(zlog_t *zlogp, zoneid_t zoneid,
3172     const struct sockaddr_storage *local, const struct sockaddr_storage *remote)
3173 {
3174         int fd;
3175         struct strioctl ioc;
3176         tcp_ioc_abort_conn_t conn;
3177         int error;
3178 
3179         conn.ac_local = *local;
3180         conn.ac_remote = *remote;
3181         conn.ac_start = TCPS_SYN_SENT;
3182         conn.ac_end = TCPS_TIME_WAIT;
3183         conn.ac_zoneid = zoneid;
3184 
3185         ioc.ic_cmd = TCP_IOC_ABORT_CONN;
3186         ioc.ic_timout = -1; /* infinite timeout */
3187         ioc.ic_len = sizeof (conn);
3188         ioc.ic_dp = (char *)&conn;
3189 
3190         if ((fd = open("/dev/tcp", O_RDONLY)) < 0) {
3191                 zerror(zlogp, B_TRUE, "unable to open %s", "/dev/tcp");
3192                 return (-1);
3193         }
3194 
3195         error = ioctl(fd, I_STR, &ioc);
3196         (void) close(fd);
3197         if (error == 0 || errno == ENOENT)      /* ENOENT is not an error */
3198                 return (0);
3199         return (-1);
3200 }
3201 
3202 static int
3203 tcp_abort_connections(zlog_t *zlogp, zoneid_t zoneid)
3204 {
3205         struct sockaddr_storage l, r;
3206         struct sockaddr_in *local, *remote;
3207         struct sockaddr_in6 *local6, *remote6;
3208         int error;
3209 
3210         /*
3211          * Abort IPv4 connections.
3212          */
3213         bzero(&l, sizeof (*local));
3214         local = (struct sockaddr_in *)&l;
3215         local->sin_family = AF_INET;
3216         local->sin_addr.s_addr = INADDR_ANY;
3217         local->sin_port = 0;
3218 
3219         bzero(&r, sizeof (*remote));
3220         remote = (struct sockaddr_in *)&r;
3221         remote->sin_family = AF_INET;
3222         remote->sin_addr.s_addr = INADDR_ANY;
3223         remote->sin_port = 0;
3224 
3225         if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
3226                 return (error);
3227 
3228         /*
3229          * Abort IPv6 connections.
3230          */
3231         bzero(&l, sizeof (*local6));
3232         local6 = (struct sockaddr_in6 *)&l;
3233         local6->sin6_family = AF_INET6;
3234         local6->sin6_port = 0;
3235         local6->sin6_addr = in6addr_any;
3236 
3237         bzero(&r, sizeof (*remote6));
3238         remote6 = (struct sockaddr_in6 *)&r;
3239         remote6->sin6_family = AF_INET6;
3240         remote6->sin6_port = 0;
3241         remote6->sin6_addr = in6addr_any;
3242 
3243         if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
3244                 return (error);
3245         return (0);
3246 }
3247 
3248 static int
3249 get_privset(zlog_t *zlogp, priv_set_t *privs, zone_mnt_t mount_cmd)
3250 {
3251         int error = -1;
3252         zone_dochandle_t handle;
3253         char *privname = NULL;
3254 
3255         if ((handle = zonecfg_init_handle()) == NULL) {
3256                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
3257                 return (-1);
3258         }
3259         if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
3260                 zerror(zlogp, B_FALSE, "invalid configuration");
3261                 zonecfg_fini_handle(handle);
3262                 return (-1);
3263         }
3264 
3265         if (ALT_MOUNT(mount_cmd)) {
3266                 zone_iptype_t   iptype;
3267                 const char      *curr_iptype;
3268 
3269                 if (zonecfg_get_iptype(handle, &iptype) != Z_OK) {
3270                         zerror(zlogp, B_TRUE, "unable to determine ip-type");
3271                         zonecfg_fini_handle(handle);
3272                         return (-1);
3273                 }
3274 
3275                 switch (iptype) {
3276                 case ZS_SHARED:
3277                         curr_iptype = "shared";
3278                         break;
3279                 case ZS_EXCLUSIVE:
3280                         curr_iptype = "exclusive";
3281                         break;
3282                 }
3283 
3284                 if (zonecfg_default_privset(privs, curr_iptype) == Z_OK) {
3285                         zonecfg_fini_handle(handle);
3286                         return (0);
3287                 }
3288                 zerror(zlogp, B_FALSE,
3289                     "failed to determine the zone's default privilege set");
3290                 zonecfg_fini_handle(handle);
3291                 return (-1);
3292         }
3293 
3294         switch (zonecfg_get_privset(handle, privs, &privname)) {
3295         case Z_OK:
3296                 error = 0;
3297                 break;
3298         case Z_PRIV_PROHIBITED:
3299                 zerror(zlogp, B_FALSE, "privilege \"%s\" is not permitted "
3300                     "within the zone's privilege set", privname);
3301                 break;
3302         case Z_PRIV_REQUIRED:
3303                 zerror(zlogp, B_FALSE, "required privilege \"%s\" is missing "
3304                     "from the zone's privilege set", privname);
3305                 break;
3306         case Z_PRIV_UNKNOWN:
3307                 zerror(zlogp, B_FALSE, "unknown privilege \"%s\" specified "
3308                     "in the zone's privilege set", privname);
3309                 break;
3310         default:
3311                 zerror(zlogp, B_FALSE, "failed to determine the zone's "
3312                     "privilege set");
3313                 break;
3314         }
3315 
3316         free(privname);
3317         zonecfg_fini_handle(handle);
3318         return (error);
3319 }
3320 
3321 static int
3322 get_rctls(zlog_t *zlogp, char **bufp, size_t *bufsizep)
3323 {
3324         nvlist_t *nvl = NULL;
3325         char *nvl_packed = NULL;
3326         size_t nvl_size = 0;
3327         nvlist_t **nvlv = NULL;
3328         int rctlcount = 0;
3329         int error = -1;
3330         zone_dochandle_t handle;
3331         struct zone_rctltab rctltab;
3332         rctlblk_t *rctlblk = NULL;
3333         uint64_t maxlwps;
3334         uint64_t maxprocs;
3335 
3336         *bufp = NULL;
3337         *bufsizep = 0;
3338 
3339         if ((handle = zonecfg_init_handle()) == NULL) {
3340                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
3341                 return (-1);
3342         }
3343         if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
3344                 zerror(zlogp, B_FALSE, "invalid configuration");
3345                 zonecfg_fini_handle(handle);
3346                 return (-1);
3347         }
3348 
3349         rctltab.zone_rctl_valptr = NULL;
3350         if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0) {
3351                 zerror(zlogp, B_TRUE, "%s failed", "nvlist_alloc");
3352                 goto out;
3353         }
3354 
3355         /*
3356          * Allow the administrator to control both the maximum number of
3357          * process table slots and the maximum number of lwps with just the
3358          * max-processes property.  If only the max-processes property is set,
3359          * we add a max-lwps property with a limit derived from max-processes.
3360          */
3361         if (zonecfg_get_aliased_rctl(handle, ALIAS_MAXPROCS, &maxprocs)
3362             == Z_OK &&
3363             zonecfg_get_aliased_rctl(handle, ALIAS_MAXLWPS, &maxlwps)
3364             == Z_NO_ENTRY) {
3365                 if (zonecfg_set_aliased_rctl(handle, ALIAS_MAXLWPS,
3366                     maxprocs * LWPS_PER_PROCESS) != Z_OK) {
3367                         zerror(zlogp, B_FALSE, "unable to set max-lwps alias");
3368                         goto out;
3369                 }
3370         }
3371 
3372         if (zonecfg_setrctlent(handle) != Z_OK) {
3373                 zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setrctlent");
3374                 goto out;
3375         }
3376 
3377         if ((rctlblk = malloc(rctlblk_size())) == NULL) {
3378                 zerror(zlogp, B_TRUE, "memory allocation failed");
3379                 goto out;
3380         }
3381         while (zonecfg_getrctlent(handle, &rctltab) == Z_OK) {
3382                 struct zone_rctlvaltab *rctlval;
3383                 uint_t i, count;
3384                 const char *name = rctltab.zone_rctl_name;
3385 
3386                 /* zoneadm should have already warned about unknown rctls. */
3387                 if (!zonecfg_is_rctl(name)) {
3388                         zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3389                         rctltab.zone_rctl_valptr = NULL;
3390                         continue;
3391                 }
3392                 count = 0;
3393                 for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
3394                     rctlval = rctlval->zone_rctlval_next) {
3395                         count++;
3396                 }
3397                 if (count == 0) {       /* ignore */
3398                         continue;       /* Nothing to free */
3399                 }
3400                 if ((nvlv = malloc(sizeof (*nvlv) * count)) == NULL)
3401                         goto out;
3402                 i = 0;
3403                 for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
3404                     rctlval = rctlval->zone_rctlval_next, i++) {
3405                         if (nvlist_alloc(&nvlv[i], NV_UNIQUE_NAME, 0) != 0) {
3406                                 zerror(zlogp, B_TRUE, "%s failed",
3407                                     "nvlist_alloc");
3408                                 goto out;
3409                         }
3410                         if (zonecfg_construct_rctlblk(rctlval, rctlblk)
3411                             != Z_OK) {
3412                                 zerror(zlogp, B_FALSE, "invalid rctl value: "
3413                                     "(priv=%s,limit=%s,action=%s)",
3414                                     rctlval->zone_rctlval_priv,
3415                                     rctlval->zone_rctlval_limit,
3416                                     rctlval->zone_rctlval_action);
3417                                 goto out;
3418                         }
3419                         if (!zonecfg_valid_rctl(name, rctlblk)) {
3420                                 zerror(zlogp, B_FALSE,
3421                                     "(priv=%s,limit=%s,action=%s) is not a "
3422                                     "valid value for rctl '%s'",
3423                                     rctlval->zone_rctlval_priv,
3424                                     rctlval->zone_rctlval_limit,
3425                                     rctlval->zone_rctlval_action,
3426                                     name);
3427                                 goto out;
3428                         }
3429                         if (nvlist_add_uint64(nvlv[i], "privilege",
3430                             rctlblk_get_privilege(rctlblk)) != 0) {
3431                                 zerror(zlogp, B_FALSE, "%s failed",
3432                                     "nvlist_add_uint64");
3433                                 goto out;
3434                         }
3435                         if (nvlist_add_uint64(nvlv[i], "limit",
3436                             rctlblk_get_value(rctlblk)) != 0) {
3437                                 zerror(zlogp, B_FALSE, "%s failed",
3438                                     "nvlist_add_uint64");
3439                                 goto out;
3440                         }
3441                         if (nvlist_add_uint64(nvlv[i], "action",
3442                             (uint_t)rctlblk_get_local_action(rctlblk, NULL))
3443                             != 0) {
3444                                 zerror(zlogp, B_FALSE, "%s failed",
3445                                     "nvlist_add_uint64");
3446                                 goto out;
3447                         }
3448                 }
3449                 zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3450                 rctltab.zone_rctl_valptr = NULL;
3451                 if (nvlist_add_nvlist_array(nvl, (char *)name, nvlv, count)
3452                     != 0) {
3453                         zerror(zlogp, B_FALSE, "%s failed",
3454                             "nvlist_add_nvlist_array");
3455                         goto out;
3456                 }
3457                 for (i = 0; i < count; i++)
3458                         nvlist_free(nvlv[i]);
3459                 free(nvlv);
3460                 nvlv = NULL;
3461                 rctlcount++;
3462         }
3463         (void) zonecfg_endrctlent(handle);
3464 
3465         if (rctlcount == 0) {
3466                 error = 0;
3467                 goto out;
3468         }
3469         if (nvlist_pack(nvl, &nvl_packed, &nvl_size, NV_ENCODE_NATIVE, 0)
3470             != 0) {
3471                 zerror(zlogp, B_FALSE, "%s failed", "nvlist_pack");
3472                 goto out;
3473         }
3474 
3475         error = 0;
3476         *bufp = nvl_packed;
3477         *bufsizep = nvl_size;
3478 
3479 out:
3480         free(rctlblk);
3481         zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3482         if (error && nvl_packed != NULL)
3483                 free(nvl_packed);
3484         nvlist_free(nvl);
3485         if (nvlv != NULL)
3486                 free(nvlv);
3487         if (handle != NULL)
3488                 zonecfg_fini_handle(handle);
3489         return (error);
3490 }
3491 
3492 static int
3493 get_implicit_datasets(zlog_t *zlogp, char **retstr)
3494 {
3495         char cmdbuf[2 * MAXPATHLEN];
3496 
3497         if (query_hook[0] == '\0')
3498                 return (0);
3499 
3500         if (snprintf(cmdbuf, sizeof (cmdbuf), "%s datasets", query_hook)
3501             > sizeof (cmdbuf))
3502                 return (-1);
3503 
3504         if (do_subproc(zlogp, cmdbuf, retstr) != 0)
3505                 return (-1);
3506 
3507         return (0);
3508 }
3509 
3510 static int
3511 get_datasets(zlog_t *zlogp, char **bufp, size_t *bufsizep)
3512 {
3513         zone_dochandle_t handle;
3514         struct zone_dstab dstab;
3515         size_t total, offset, len;
3516         int error = -1;
3517         char *str = NULL;
3518         char *implicit_datasets = NULL;
3519         int implicit_len = 0;
3520 
3521         *bufp = NULL;
3522         *bufsizep = 0;
3523 
3524         if ((handle = zonecfg_init_handle()) == NULL) {
3525                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
3526                 return (-1);
3527         }
3528         if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
3529                 zerror(zlogp, B_FALSE, "invalid configuration");
3530                 zonecfg_fini_handle(handle);
3531                 return (-1);
3532         }
3533 
3534         if (get_implicit_datasets(zlogp, &implicit_datasets) != 0) {
3535                 zerror(zlogp, B_FALSE, "getting implicit datasets failed");
3536                 goto out;
3537         }
3538 
3539         if (zonecfg_setdsent(handle) != Z_OK) {
3540                 zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
3541                 goto out;
3542         }
3543 
3544         total = 0;
3545         while (zonecfg_getdsent(handle, &dstab) == Z_OK)
3546                 total += strlen(dstab.zone_dataset_name) + 1;
3547         (void) zonecfg_enddsent(handle);
3548 
3549         if (implicit_datasets != NULL)
3550                 implicit_len = strlen(implicit_datasets);
3551         if (implicit_len > 0)
3552                 total += implicit_len + 1;
3553 
3554         if (total == 0) {
3555                 error = 0;
3556                 goto out;
3557         }
3558 
3559         if ((str = malloc(total)) == NULL) {
3560                 zerror(zlogp, B_TRUE, "memory allocation failed");
3561                 goto out;
3562         }
3563 
3564         if (zonecfg_setdsent(handle) != Z_OK) {
3565                 zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
3566                 goto out;
3567         }
3568         offset = 0;
3569         while (zonecfg_getdsent(handle, &dstab) == Z_OK) {
3570                 len = strlen(dstab.zone_dataset_name);
3571                 (void) strlcpy(str + offset, dstab.zone_dataset_name,
3572                     total - offset);
3573                 offset += len;
3574                 if (offset < total - 1)
3575                         str[offset++] = ',';
3576         }
3577         (void) zonecfg_enddsent(handle);
3578 
3579         if (implicit_len > 0)
3580                 (void) strlcpy(str + offset, implicit_datasets, total - offset);
3581 
3582         error = 0;
3583         *bufp = str;
3584         *bufsizep = total;
3585 
3586 out:
3587         if (error != 0 && str != NULL)
3588                 free(str);
3589         if (handle != NULL)
3590                 zonecfg_fini_handle(handle);
3591         if (implicit_datasets != NULL)
3592                 free(implicit_datasets);
3593 
3594         return (error);
3595 }
3596 
3597 static int
3598 validate_datasets(zlog_t *zlogp)
3599 {
3600         zone_dochandle_t handle;
3601         struct zone_dstab dstab;
3602         zfs_handle_t *zhp;
3603         libzfs_handle_t *hdl;
3604 
3605         if ((handle = zonecfg_init_handle()) == NULL) {
3606                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
3607                 return (-1);
3608         }
3609         if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
3610                 zerror(zlogp, B_FALSE, "invalid configuration");
3611                 zonecfg_fini_handle(handle);
3612                 return (-1);
3613         }
3614 
3615         if (zonecfg_setdsent(handle) != Z_OK) {
3616                 zerror(zlogp, B_FALSE, "invalid configuration");
3617                 zonecfg_fini_handle(handle);
3618                 return (-1);
3619         }
3620 
3621         if ((hdl = libzfs_init()) == NULL) {
3622                 zerror(zlogp, B_FALSE, "opening ZFS library");
3623                 zonecfg_fini_handle(handle);
3624                 return (-1);
3625         }
3626 
3627         while (zonecfg_getdsent(handle, &dstab) == Z_OK) {
3628 
3629                 if ((zhp = zfs_open(hdl, dstab.zone_dataset_name,
3630                     ZFS_TYPE_FILESYSTEM)) == NULL) {
3631                         zerror(zlogp, B_FALSE, "cannot open ZFS dataset '%s'",
3632                             dstab.zone_dataset_name);
3633                         zonecfg_fini_handle(handle);
3634                         libzfs_fini(hdl);
3635                         return (-1);
3636                 }
3637 
3638                 /*
3639                  * Automatically set the 'zoned' property.  We check the value
3640                  * first because we'll get EPERM if it is already set.
3641                  */
3642                 if (!zfs_prop_get_int(zhp, ZFS_PROP_ZONED) &&
3643                     zfs_prop_set(zhp, zfs_prop_to_name(ZFS_PROP_ZONED),
3644                     "on") != 0) {
3645                         zerror(zlogp, B_FALSE, "cannot set 'zoned' "
3646                             "property for ZFS dataset '%s'\n",
3647                             dstab.zone_dataset_name);
3648                         zonecfg_fini_handle(handle);
3649                         zfs_close(zhp);
3650                         libzfs_fini(hdl);
3651                         return (-1);
3652                 }
3653 
3654                 zfs_close(zhp);
3655         }
3656         (void) zonecfg_enddsent(handle);
3657 
3658         zonecfg_fini_handle(handle);
3659         libzfs_fini(hdl);
3660 
3661         return (0);
3662 }
3663 
3664 /*
3665  * Return true if the path is its own zfs file system.  We determine this
3666  * by stat-ing the path to see if it is zfs and stat-ing the parent to see
3667  * if it is a different fs.
3668  */
3669 boolean_t
3670 is_zonepath_zfs(char *zonepath)
3671 {
3672         int res;
3673         char *path;
3674         char *parent;
3675         struct statvfs64 buf1, buf2;
3676 
3677         if (statvfs64(zonepath, &buf1) != 0)
3678                 return (B_FALSE);
3679 
3680         if (strcmp(buf1.f_basetype, "zfs") != 0)
3681                 return (B_FALSE);
3682 
3683         if ((path = strdup(zonepath)) == NULL)
3684                 return (B_FALSE);
3685 
3686         parent = dirname(path);
3687         res = statvfs64(parent, &buf2);
3688         free(path);
3689 
3690         if (res != 0)
3691                 return (B_FALSE);
3692 
3693         if (buf1.f_fsid == buf2.f_fsid)
3694                 return (B_FALSE);
3695 
3696         return (B_TRUE);
3697 }
3698 
3699 /*
3700  * Verify the MAC label in the root dataset for the zone.
3701  * If the label exists, it must match the label configured for the zone.
3702  * Otherwise if there's no label on the dataset, create one here.
3703  */
3704 
3705 static int
3706 validate_rootds_label(zlog_t *zlogp, char *rootpath, m_label_t *zone_sl)
3707 {
3708         int             error = -1;
3709         zfs_handle_t    *zhp;
3710         libzfs_handle_t *hdl;
3711         m_label_t       ds_sl;
3712         char            zonepath[MAXPATHLEN];
3713         char            ds_hexsl[MAXNAMELEN];
3714 
3715         if (!is_system_labeled())
3716                 return (0);
3717 
3718         if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
3719                 zerror(zlogp, B_TRUE, "unable to determine zone path");
3720                 return (-1);
3721         }
3722 
3723         if (!is_zonepath_zfs(zonepath))
3724                 return (0);
3725 
3726         if ((hdl = libzfs_init()) == NULL) {
3727                 zerror(zlogp, B_FALSE, "opening ZFS library");
3728                 return (-1);
3729         }
3730 
3731         if ((zhp = zfs_path_to_zhandle(hdl, rootpath,
3732             ZFS_TYPE_FILESYSTEM)) == NULL) {
3733                 zerror(zlogp, B_FALSE, "cannot open ZFS dataset for path '%s'",
3734                     rootpath);
3735                 libzfs_fini(hdl);
3736                 return (-1);
3737         }
3738 
3739         /* Get the mlslabel property if it exists. */
3740         if ((zfs_prop_get(zhp, ZFS_PROP_MLSLABEL, ds_hexsl, MAXNAMELEN,
3741             NULL, NULL, 0, B_TRUE) != 0) ||
3742             (strcmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) == 0)) {
3743                 char            *str2 = NULL;
3744 
3745                 /*
3746                  * No label on the dataset (or default only); create one.
3747                  * (Only do this automatic labeling for the labeled brand.)
3748                  */
3749                 if (strcmp(brand_name, LABELED_BRAND_NAME) != 0) {
3750                         error = 0;
3751                         goto out;
3752                 }
3753 
3754                 error = l_to_str_internal(zone_sl, &str2);
3755                 if (error)
3756                         goto out;
3757                 if (str2 == NULL) {
3758                         error = -1;
3759                         goto out;
3760                 }
3761                 if ((error = zfs_prop_set(zhp,
3762                     zfs_prop_to_name(ZFS_PROP_MLSLABEL), str2)) != 0) {
3763                         zerror(zlogp, B_FALSE, "cannot set 'mlslabel' "
3764                             "property for root dataset at '%s'\n", rootpath);
3765                 }
3766                 free(str2);
3767                 goto out;
3768         }
3769 
3770         /* Convert the retrieved dataset label to binary form. */
3771         error = hexstr_to_label(ds_hexsl, &ds_sl);
3772         if (error) {
3773                 zerror(zlogp, B_FALSE, "invalid 'mlslabel' "
3774                     "property on root dataset at '%s'\n", rootpath);
3775                 goto out;                       /* exit with error */
3776         }
3777 
3778         /*
3779          * Perform a MAC check by comparing the zone label with the
3780          * dataset label.
3781          */
3782         error = (!blequal(zone_sl, &ds_sl));
3783         if (error)
3784                 zerror(zlogp, B_FALSE, "Rootpath dataset has mismatched label");
3785 out:
3786         zfs_close(zhp);
3787         libzfs_fini(hdl);
3788 
3789         return (error);
3790 }
3791 
3792 /*
3793  * Mount lower level home directories into/from current zone
3794  * Share exported directories specified in dfstab for zone
3795  */
3796 static int
3797 tsol_mounts(zlog_t *zlogp, char *zone_name, char *rootpath)
3798 {
3799         zoneid_t *zids = NULL;
3800         priv_set_t *zid_privs;
3801         const priv_impl_info_t *ip = NULL;
3802         uint_t nzents_saved;
3803         uint_t nzents;
3804         int i;
3805         char readonly[] = "ro";
3806         struct zone_fstab lower_fstab;
3807         char *argv[4];
3808 
3809         if (!is_system_labeled())
3810                 return (0);
3811 
3812         if (zid_label == NULL) {
3813                 zid_label = m_label_alloc(MAC_LABEL);
3814                 if (zid_label == NULL)
3815                         return (-1);
3816         }
3817 
3818         /* Make sure our zone has an /export/home dir */
3819         (void) make_one_dir(zlogp, rootpath, "/export/home",
3820             DEFAULT_DIR_MODE, DEFAULT_DIR_USER, DEFAULT_DIR_GROUP);
3821 
3822         lower_fstab.zone_fs_raw[0] = '\0';
3823         (void) strlcpy(lower_fstab.zone_fs_type, MNTTYPE_LOFS,
3824             sizeof (lower_fstab.zone_fs_type));
3825         lower_fstab.zone_fs_options = NULL;
3826         (void) zonecfg_add_fs_option(&lower_fstab, readonly);
3827 
3828         /*
3829          * Get the list of zones from the kernel
3830          */
3831         if (zone_list(NULL, &nzents) != 0) {
3832                 zerror(zlogp, B_TRUE, "unable to list zones");
3833                 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3834                 return (-1);
3835         }
3836 again:
3837         if (nzents == 0) {
3838                 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3839                 return (-1);
3840         }
3841 
3842         zids = malloc(nzents * sizeof (zoneid_t));
3843         if (zids == NULL) {
3844                 zerror(zlogp, B_TRUE, "memory allocation failed");
3845                 return (-1);
3846         }
3847         nzents_saved = nzents;
3848 
3849         if (zone_list(zids, &nzents) != 0) {
3850                 zerror(zlogp, B_TRUE, "unable to list zones");
3851                 zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3852                 free(zids);
3853                 return (-1);
3854         }
3855         if (nzents != nzents_saved) {
3856                 /* list changed, try again */
3857                 free(zids);
3858                 goto again;
3859         }
3860 
3861         ip = getprivimplinfo();
3862         if ((zid_privs = priv_allocset()) == NULL) {
3863                 zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
3864                 zonecfg_free_fs_option_list(
3865                     lower_fstab.zone_fs_options);
3866                 free(zids);
3867                 return (-1);
3868         }
3869 
3870         for (i = 0; i < nzents; i++) {
3871                 char zid_name[ZONENAME_MAX];
3872                 zone_state_t zid_state;
3873                 char zid_rpath[MAXPATHLEN];
3874                 struct stat stat_buf;
3875 
3876                 if (zids[i] == GLOBAL_ZONEID)
3877                         continue;
3878 
3879                 if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
3880                         continue;
3881 
3882                 /*
3883                  * Do special setup for the zone we are booting
3884                  */
3885                 if (strcmp(zid_name, zone_name) == 0) {
3886                         struct zone_fstab autofs_fstab;
3887                         char map_path[MAXPATHLEN];
3888                         int fd;
3889 
3890                         /*
3891                          * Create auto_home_<zone> map for this zone
3892                          * in the global zone. The non-global zone entry
3893                          * will be created by automount when the zone
3894                          * is booted.
3895                          */
3896 
3897                         (void) snprintf(autofs_fstab.zone_fs_special,
3898                             MAXPATHLEN, "auto_home_%s", zid_name);
3899 
3900                         (void) snprintf(autofs_fstab.zone_fs_dir, MAXPATHLEN,
3901                             "/zone/%s/home", zid_name);
3902 
3903                         (void) snprintf(map_path, sizeof (map_path),
3904                             "/etc/%s", autofs_fstab.zone_fs_special);
3905                         /*
3906                          * If the map file doesn't exist create a template
3907                          */
3908                         if ((fd = open(map_path, O_RDWR | O_CREAT | O_EXCL,
3909                             S_IRUSR | S_IWUSR | S_IRGRP| S_IROTH)) != -1) {
3910                                 int len;
3911                                 char map_rec[MAXPATHLEN];
3912 
3913                                 len = snprintf(map_rec, sizeof (map_rec),
3914                                     "+%s\n*\t-fstype=lofs\t:%s/export/home/&\n",
3915                                     autofs_fstab.zone_fs_special, rootpath);
3916                                 (void) write(fd, map_rec, len);
3917                                 (void) close(fd);
3918                         }
3919 
3920                         /*
3921                          * Mount auto_home_<zone> in the global zone if absent.
3922                          * If it's already of type autofs, then
3923                          * don't mount it again.
3924                          */
3925                         if ((stat(autofs_fstab.zone_fs_dir, &stat_buf) == -1) ||
3926                             strcmp(stat_buf.st_fstype, MNTTYPE_AUTOFS) != 0) {
3927                                 char optstr[] = "indirect,ignore,nobrowse";
3928 
3929                                 (void) make_one_dir(zlogp, "",
3930                                     autofs_fstab.zone_fs_dir, DEFAULT_DIR_MODE,
3931                                     DEFAULT_DIR_USER, DEFAULT_DIR_GROUP);
3932 
3933                                 /*
3934                                  * Mount will fail if automounter has already
3935                                  * processed the auto_home_<zonename> map
3936                                  */
3937                                 (void) domount(zlogp, MNTTYPE_AUTOFS, optstr,
3938                                     autofs_fstab.zone_fs_special,
3939                                     autofs_fstab.zone_fs_dir);
3940                         }
3941                         continue;
3942                 }
3943 
3944 
3945                 if (zone_get_state(zid_name, &zid_state) != Z_OK ||
3946                     (zid_state != ZONE_STATE_READY &&
3947                     zid_state != ZONE_STATE_RUNNING))
3948                         /* Skip over zones without mounted filesystems */
3949                         continue;
3950 
3951                 if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
3952                     sizeof (m_label_t)) < 0)
3953                         /* Skip over zones with unspecified label */
3954                         continue;
3955 
3956                 if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
3957                     sizeof (zid_rpath)) == -1)
3958                         /* Skip over zones with bad path */
3959                         continue;
3960 
3961                 if (zone_getattr(zids[i], ZONE_ATTR_PRIVSET, zid_privs,
3962                     sizeof (priv_chunk_t) * ip->priv_setsize) == -1)
3963                         /* Skip over zones with bad privs */
3964                         continue;
3965 
3966                 /*
3967                  * Reading down is valid according to our label model
3968                  * but some customers want to disable it because it
3969                  * allows execute down and other possible attacks.
3970                  * Therefore, we restrict this feature to zones that
3971                  * have the NET_MAC_AWARE privilege which is required
3972                  * for NFS read-down semantics.
3973                  */
3974                 if ((bldominates(zlabel, zid_label)) &&
3975                     (priv_ismember(zprivs, PRIV_NET_MAC_AWARE))) {
3976                         /*
3977                          * Our zone dominates this one.
3978                          * Create a lofs mount from lower zone's /export/home
3979                          */
3980                         (void) snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
3981                             "%s/zone/%s/export/home", rootpath, zid_name);
3982 
3983                         /*
3984                          * If the target is already an LOFS mount
3985                          * then don't do it again.
3986                          */
3987                         if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
3988                             strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
3989 
3990                                 if (snprintf(lower_fstab.zone_fs_special,
3991                                     MAXPATHLEN, "%s/export",
3992                                     zid_rpath) > MAXPATHLEN)
3993                                         continue;
3994 
3995                                 /*
3996                                  * Make sure the lower-level home exists
3997                                  */
3998                                 if (make_one_dir(zlogp,
3999                                     lower_fstab.zone_fs_special, "/home",
4000                                     DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
4001                                     DEFAULT_DIR_GROUP) != 0)
4002                                         continue;
4003 
4004                                 (void) strlcat(lower_fstab.zone_fs_special,
4005                                     "/home", MAXPATHLEN);
4006 
4007                                 /*
4008                                  * Mount can fail because the lower-level
4009                                  * zone may have already done a mount up.
4010                                  */
4011                                 (void) mount_one(zlogp, &lower_fstab, "",
4012                                     Z_MNT_BOOT);
4013                         }
4014                 } else if ((bldominates(zid_label, zlabel)) &&
4015                     (priv_ismember(zid_privs, PRIV_NET_MAC_AWARE))) {
4016                         /*
4017                          * This zone dominates our zone.
4018                          * Create a lofs mount from our zone's /export/home
4019                          */
4020                         if (snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
4021                             "%s/zone/%s/export/home", zid_rpath,
4022                             zone_name) > MAXPATHLEN)
4023                                 continue;
4024 
4025                         /*
4026                          * If the target is already an LOFS mount
4027                          * then don't do it again.
4028                          */
4029                         if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
4030                             strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
4031 
4032                                 (void) snprintf(lower_fstab.zone_fs_special,
4033                                     MAXPATHLEN, "%s/export/home", rootpath);
4034 
4035                                 /*
4036                                  * Mount can fail because the higher-level
4037                                  * zone may have already done a mount down.
4038                                  */
4039                                 (void) mount_one(zlogp, &lower_fstab, "",
4040                                     Z_MNT_BOOT);
4041                         }
4042                 }
4043         }
4044         zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
4045         priv_freeset(zid_privs);
4046         free(zids);
4047 
4048         /*
4049          * Now share any exported directories from this zone.
4050          * Each zone can have its own dfstab.
4051          */
4052 
4053         argv[0] = "zoneshare";
4054         argv[1] = "-z";
4055         argv[2] = zone_name;
4056         argv[3] = NULL;
4057 
4058         (void) forkexec(zlogp, "/usr/lib/zones/zoneshare", argv);
4059         /* Don't check for errors since they don't affect the zone */
4060 
4061         return (0);
4062 }
4063 
4064 /*
4065  * Unmount lofs mounts from higher level zones
4066  * Unshare nfs exported directories
4067  */
4068 static void
4069 tsol_unmounts(zlog_t *zlogp, char *zone_name)
4070 {
4071         zoneid_t *zids = NULL;
4072         uint_t nzents_saved;
4073         uint_t nzents;
4074         int i;
4075         char *argv[4];
4076         char path[MAXPATHLEN];
4077 
4078         if (!is_system_labeled())
4079                 return;
4080 
4081         /*
4082          * Get the list of zones from the kernel
4083          */
4084         if (zone_list(NULL, &nzents) != 0) {
4085                 return;
4086         }
4087 
4088         if (zid_label == NULL) {
4089                 zid_label = m_label_alloc(MAC_LABEL);
4090                 if (zid_label == NULL)
4091                         return;
4092         }
4093 
4094 again:
4095         if (nzents == 0)
4096                 return;
4097 
4098         zids = malloc(nzents * sizeof (zoneid_t));
4099         if (zids == NULL) {
4100                 zerror(zlogp, B_TRUE, "memory allocation failed");
4101                 return;
4102         }
4103         nzents_saved = nzents;
4104 
4105         if (zone_list(zids, &nzents) != 0) {
4106                 free(zids);
4107                 return;
4108         }
4109         if (nzents != nzents_saved) {
4110                 /* list changed, try again */
4111                 free(zids);
4112                 goto again;
4113         }
4114 
4115         for (i = 0; i < nzents; i++) {
4116                 char zid_name[ZONENAME_MAX];
4117                 zone_state_t zid_state;
4118                 char zid_rpath[MAXPATHLEN];
4119 
4120                 if (zids[i] == GLOBAL_ZONEID)
4121                         continue;
4122 
4123                 if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
4124                         continue;
4125 
4126                 /*
4127                  * Skip the zone we are halting
4128                  */
4129                 if (strcmp(zid_name, zone_name) == 0)
4130                         continue;
4131 
4132                 if ((zone_getattr(zids[i], ZONE_ATTR_STATUS, &zid_state,
4133                     sizeof (zid_state)) < 0) ||
4134                     (zid_state < ZONE_IS_READY))
4135                         /* Skip over zones without mounted filesystems */
4136                         continue;
4137 
4138                 if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
4139                     sizeof (m_label_t)) < 0)
4140                         /* Skip over zones with unspecified label */
4141                         continue;
4142 
4143                 if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
4144                     sizeof (zid_rpath)) == -1)
4145                         /* Skip over zones with bad path */
4146                         continue;
4147 
4148                 if (zlabel != NULL && bldominates(zid_label, zlabel)) {
4149                         /*
4150                          * This zone dominates our zone.
4151                          * Unmount the lofs mount of our zone's /export/home
4152                          */
4153 
4154                         if (snprintf(path, MAXPATHLEN,
4155                             "%s/zone/%s/export/home", zid_rpath,
4156                             zone_name) > MAXPATHLEN)
4157                                 continue;
4158 
4159                         /* Skip over mount failures */
4160                         (void) umount(path);
4161                 }
4162         }
4163         free(zids);
4164 
4165         /*
4166          * Unmount global zone autofs trigger for this zone
4167          */
4168         (void) snprintf(path, MAXPATHLEN, "/zone/%s/home", zone_name);
4169         /* Skip over mount failures */
4170         (void) umount(path);
4171 
4172         /*
4173          * Next unshare any exported directories from this zone.
4174          */
4175 
4176         argv[0] = "zoneunshare";
4177         argv[1] = "-z";
4178         argv[2] = zone_name;
4179         argv[3] = NULL;
4180 
4181         (void) forkexec(zlogp, "/usr/lib/zones/zoneunshare", argv);
4182         /* Don't check for errors since they don't affect the zone */
4183 
4184         /*
4185          * Finally, deallocate any devices in the zone.
4186          */
4187 
4188         argv[0] = "deallocate";
4189         argv[1] = "-Isz";
4190         argv[2] = zone_name;
4191         argv[3] = NULL;
4192 
4193         (void) forkexec(zlogp, "/usr/sbin/deallocate", argv);
4194         /* Don't check for errors since they don't affect the zone */
4195 }
4196 
4197 /*
4198  * Fetch the Trusted Extensions label and multi-level ports (MLPs) for
4199  * this zone.
4200  */
4201 static tsol_zcent_t *
4202 get_zone_label(zlog_t *zlogp, priv_set_t *privs)
4203 {
4204         FILE *fp;
4205         tsol_zcent_t *zcent = NULL;
4206         char line[MAXTNZLEN];
4207 
4208         if ((fp = fopen(TNZONECFG_PATH, "r")) == NULL) {
4209                 zerror(zlogp, B_TRUE, "%s", TNZONECFG_PATH);
4210                 return (NULL);
4211         }
4212 
4213         while (fgets(line, sizeof (line), fp) != NULL) {
4214                 /*
4215                  * Check for malformed database
4216                  */
4217                 if (strlen(line) == MAXTNZLEN - 1)
4218                         break;
4219                 if ((zcent = tsol_sgetzcent(line, NULL, NULL)) == NULL)
4220                         continue;
4221                 if (strcmp(zcent->zc_name, zone_name) == 0)
4222                         break;
4223                 tsol_freezcent(zcent);
4224                 zcent = NULL;
4225         }
4226         (void) fclose(fp);
4227 
4228         if (zcent == NULL) {
4229                 zerror(zlogp, B_FALSE, "zone requires a label assignment. "
4230                     "See tnzonecfg(4)");
4231         } else {
4232                 if (zlabel == NULL)
4233                         zlabel = m_label_alloc(MAC_LABEL);
4234                 /*
4235                  * Save this zone's privileges for later read-down processing
4236                  */
4237                 if ((zprivs = priv_allocset()) == NULL) {
4238                         zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
4239                         return (NULL);
4240                 } else {
4241                         priv_copyset(privs, zprivs);
4242                 }
4243         }
4244         return (zcent);
4245 }
4246 
4247 /*
4248  * Add the Trusted Extensions multi-level ports for this zone.
4249  */
4250 static void
4251 set_mlps(zlog_t *zlogp, zoneid_t zoneid, tsol_zcent_t *zcent)
4252 {
4253         tsol_mlp_t *mlp;
4254         tsol_mlpent_t tsme;
4255 
4256         if (!is_system_labeled())
4257                 return;
4258 
4259         tsme.tsme_zoneid = zoneid;
4260         tsme.tsme_flags = 0;
4261         for (mlp = zcent->zc_private_mlp; !TSOL_MLP_END(mlp); mlp++) {
4262                 tsme.tsme_mlp = *mlp;
4263                 if (tnmlp(TNDB_LOAD, &tsme) != 0) {
4264                         zerror(zlogp, B_TRUE, "cannot set zone-specific MLP "
4265                             "on %d-%d/%d", mlp->mlp_port,
4266                             mlp->mlp_port_upper, mlp->mlp_ipp);
4267                 }
4268         }
4269 
4270         tsme.tsme_flags = TSOL_MEF_SHARED;
4271         for (mlp = zcent->zc_shared_mlp; !TSOL_MLP_END(mlp); mlp++) {
4272                 tsme.tsme_mlp = *mlp;
4273                 if (tnmlp(TNDB_LOAD, &tsme) != 0) {
4274                         zerror(zlogp, B_TRUE, "cannot set shared MLP "
4275                             "on %d-%d/%d", mlp->mlp_port,
4276                             mlp->mlp_port_upper, mlp->mlp_ipp);
4277                 }
4278         }
4279 }
4280 
4281 static void
4282 remove_mlps(zlog_t *zlogp, zoneid_t zoneid)
4283 {
4284         tsol_mlpent_t tsme;
4285 
4286         if (!is_system_labeled())
4287                 return;
4288 
4289         (void) memset(&tsme, 0, sizeof (tsme));
4290         tsme.tsme_zoneid = zoneid;
4291         if (tnmlp(TNDB_FLUSH, &tsme) != 0)
4292                 zerror(zlogp, B_TRUE, "cannot flush MLPs");
4293 }
4294 
4295 int
4296 prtmount(const struct mnttab *fs, void *x)
4297 {
4298         zerror((zlog_t *)x, B_FALSE, "  %s", fs->mnt_mountp);
4299         return (0);
4300 }
4301 
4302 /*
4303  * Look for zones running on the main system that are using this root (or any
4304  * subdirectory of it).  Return B_TRUE and print an error if a conflicting zone
4305  * is found or if we can't tell.
4306  */
4307 static boolean_t
4308 duplicate_zone_root(zlog_t *zlogp, const char *rootpath)
4309 {
4310         zoneid_t *zids = NULL;
4311         uint_t nzids = 0;
4312         boolean_t retv;
4313         int rlen, zlen;
4314         char zroot[MAXPATHLEN];
4315         char zonename[ZONENAME_MAX];
4316 
4317         for (;;) {
4318                 nzids += 10;
4319                 zids = malloc(nzids * sizeof (*zids));
4320                 if (zids == NULL) {
4321                         zerror(zlogp, B_TRUE, "memory allocation failed");
4322                         return (B_TRUE);
4323                 }
4324                 if (zone_list(zids, &nzids) == 0)
4325                         break;
4326                 free(zids);
4327         }
4328         retv = B_FALSE;
4329         rlen = strlen(rootpath);
4330         while (nzids > 0) {
4331                 /*
4332                  * Ignore errors; they just mean that the zone has disappeared
4333                  * while we were busy.
4334                  */
4335                 if (zone_getattr(zids[--nzids], ZONE_ATTR_ROOT, zroot,
4336                     sizeof (zroot)) == -1)
4337                         continue;
4338                 zlen = strlen(zroot);
4339                 if (zlen > rlen)
4340                         zlen = rlen;
4341                 if (strncmp(rootpath, zroot, zlen) == 0 &&
4342                     (zroot[zlen] == '\0' || zroot[zlen] == '/') &&
4343                     (rootpath[zlen] == '\0' || rootpath[zlen] == '/')) {
4344                         if (getzonenamebyid(zids[nzids], zonename,
4345                             sizeof (zonename)) == -1)
4346                                 (void) snprintf(zonename, sizeof (zonename),
4347                                     "id %d", (int)zids[nzids]);
4348                         zerror(zlogp, B_FALSE,
4349                             "zone root %s already in use by zone %s",
4350                             rootpath, zonename);
4351                         retv = B_TRUE;
4352                         break;
4353                 }
4354         }
4355         free(zids);
4356         return (retv);
4357 }
4358 
4359 /*
4360  * Search for loopback mounts that use this same source node (same device and
4361  * inode).  Return B_TRUE if there is one or if we can't tell.
4362  */
4363 static boolean_t
4364 duplicate_reachable_path(zlog_t *zlogp, const char *rootpath)
4365 {
4366         struct stat64 rst, zst;
4367         struct mnttab *mnp;
4368 
4369         if (stat64(rootpath, &rst) == -1) {
4370                 zerror(zlogp, B_TRUE, "can't stat %s", rootpath);
4371                 return (B_TRUE);
4372         }
4373         if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
4374                 return (B_TRUE);
4375         for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max; mnp++) {
4376                 if (mnp->mnt_fstype == NULL ||
4377                     strcmp(MNTTYPE_LOFS, mnp->mnt_fstype) != 0)
4378                         continue;
4379                 /* We're looking at a loopback mount.  Stat it. */
4380                 if (mnp->mnt_special != NULL &&
4381                     stat64(mnp->mnt_special, &zst) != -1 &&
4382                     rst.st_dev == zst.st_dev && rst.st_ino == zst.st_ino) {
4383                         zerror(zlogp, B_FALSE,
4384                             "zone root %s is reachable through %s",
4385                             rootpath, mnp->mnt_mountp);
4386                         return (B_TRUE);
4387                 }
4388         }
4389         return (B_FALSE);
4390 }
4391 
4392 /*
4393  * Set memory cap and pool info for the zone's resource management
4394  * configuration.
4395  */
4396 static int
4397 setup_zone_rm(zlog_t *zlogp, char *zone_name, zoneid_t zoneid)
4398 {
4399         int res;
4400         uint64_t tmp;
4401         struct zone_mcaptab mcap;
4402         char sched[MAXNAMELEN];
4403         zone_dochandle_t handle = NULL;
4404         char pool_err[128];
4405 
4406         if ((handle = zonecfg_init_handle()) == NULL) {
4407                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
4408                 return (Z_BAD_HANDLE);
4409         }
4410 
4411         if ((res = zonecfg_get_snapshot_handle(zone_name, handle)) != Z_OK) {
4412                 zerror(zlogp, B_FALSE, "invalid configuration");
4413                 zonecfg_fini_handle(handle);
4414                 return (res);
4415         }
4416 
4417         /*
4418          * If a memory cap is configured, set the cap in the kernel using
4419          * zone_setattr() and make sure the rcapd SMF service is enabled.
4420          */
4421         if (zonecfg_getmcapent(handle, &mcap) == Z_OK) {
4422                 uint64_t num;
4423                 char smf_err[128];
4424 
4425                 num = (uint64_t)strtoull(mcap.zone_physmem_cap, NULL, 10);
4426                 if (zone_setattr(zoneid, ZONE_ATTR_PHYS_MCAP, &num, 0) == -1) {
4427                         zerror(zlogp, B_TRUE, "could not set zone memory cap");
4428                         zonecfg_fini_handle(handle);
4429                         return (Z_INVAL);
4430                 }
4431 
4432                 if (zonecfg_enable_rcapd(smf_err, sizeof (smf_err)) != Z_OK) {
4433                         zerror(zlogp, B_FALSE, "enabling system/rcap service "
4434                             "failed: %s", smf_err);
4435                         zonecfg_fini_handle(handle);
4436                         return (Z_INVAL);
4437                 }
4438         }
4439 
4440         /* Get the scheduling class set in the zone configuration. */
4441         if (zonecfg_get_sched_class(handle, sched, sizeof (sched)) == Z_OK &&
4442             strlen(sched) > 0) {
4443                 if (zone_setattr(zoneid, ZONE_ATTR_SCHED_CLASS, sched,
4444                     strlen(sched)) == -1)
4445                         zerror(zlogp, B_TRUE, "WARNING: unable to set the "
4446                             "default scheduling class");
4447 
4448         } else if (zonecfg_get_aliased_rctl(handle, ALIAS_SHARES, &tmp)
4449             == Z_OK) {
4450                 /*
4451                  * If the zone has the zone.cpu-shares rctl set then we want to
4452                  * use the Fair Share Scheduler (FSS) for processes in the
4453                  * zone.  Check what scheduling class the zone would be running
4454                  * in by default so we can print a warning and modify the class
4455                  * if we wouldn't be using FSS.
4456                  */
4457                 char class_name[PC_CLNMSZ];
4458 
4459                 if (zonecfg_get_dflt_sched_class(handle, class_name,
4460                     sizeof (class_name)) != Z_OK) {
4461                         zerror(zlogp, B_FALSE, "WARNING: unable to determine "
4462                             "the zone's scheduling class");
4463 
4464                 } else if (strcmp("FSS", class_name) != 0) {
4465                         zerror(zlogp, B_FALSE, "WARNING: The zone.cpu-shares "
4466                             "rctl is set but\nFSS is not the default "
4467                             "scheduling class for\nthis zone.  FSS will be "
4468                             "used for processes\nin the zone but to get the "
4469                             "full benefit of FSS,\nit should be the default "
4470                             "scheduling class.\nSee dispadmin(1M) for more "
4471                             "details.");
4472 
4473                         if (zone_setattr(zoneid, ZONE_ATTR_SCHED_CLASS, "FSS",
4474                             strlen("FSS")) == -1)
4475                                 zerror(zlogp, B_TRUE, "WARNING: unable to set "
4476                                     "zone scheduling class to FSS");
4477                 }
4478         }
4479 
4480         /*
4481          * The next few blocks of code attempt to set up temporary pools as
4482          * well as persistent pools.  In all cases we call the functions
4483          * unconditionally.  Within each funtion the code will check if the
4484          * zone is actually configured for a temporary pool or persistent pool
4485          * and just return if there is nothing to do.
4486          *
4487          * If we are rebooting we want to attempt to reuse any temporary pool
4488          * that was previously set up.  zonecfg_bind_tmp_pool() will do the
4489          * right thing in all cases (reuse or create) based on the current
4490          * zonecfg.
4491          */
4492         if ((res = zonecfg_bind_tmp_pool(handle, zoneid, pool_err,
4493             sizeof (pool_err))) != Z_OK) {
4494                 if (res == Z_POOL || res == Z_POOL_CREATE || res == Z_POOL_BIND)
4495                         zerror(zlogp, B_FALSE, "%s: %s\ndedicated-cpu setting "
4496                             "cannot be instantiated", zonecfg_strerror(res),
4497                             pool_err);
4498                 else
4499                         zerror(zlogp, B_FALSE, "could not bind zone to "
4500                             "temporary pool: %s", zonecfg_strerror(res));
4501                 zonecfg_fini_handle(handle);
4502                 return (Z_POOL_BIND);
4503         }
4504 
4505         /*
4506          * Check if we need to warn about poold not being enabled.
4507          */
4508         if (zonecfg_warn_poold(handle)) {
4509                 zerror(zlogp, B_FALSE, "WARNING: A range of dedicated-cpus has "
4510                     "been specified\nbut the dynamic pool service is not "
4511                     "enabled.\nThe system will not dynamically adjust the\n"
4512                     "processor allocation within the specified range\n"
4513                     "until svc:/system/pools/dynamic is enabled.\n"
4514                     "See poold(1M).");
4515         }
4516 
4517         /* The following is a warning, not an error. */
4518         if ((res = zonecfg_bind_pool(handle, zoneid, pool_err,
4519             sizeof (pool_err))) != Z_OK) {
4520                 if (res == Z_POOL_BIND)
4521                         zerror(zlogp, B_FALSE, "WARNING: unable to bind to "
4522                             "pool '%s'; using default pool.", pool_err);
4523                 else if (res == Z_POOL)
4524                         zerror(zlogp, B_FALSE, "WARNING: %s: %s",
4525                             zonecfg_strerror(res), pool_err);
4526                 else
4527                         zerror(zlogp, B_FALSE, "WARNING: %s",
4528                             zonecfg_strerror(res));
4529         }
4530 
4531         /* Update saved pool name in case it has changed */
4532         (void) zonecfg_get_poolname(handle, zone_name, pool_name,
4533             sizeof (pool_name));
4534 
4535         zonecfg_fini_handle(handle);
4536         return (Z_OK);
4537 }
4538 
4539 static void
4540 report_prop_err(zlog_t *zlogp, const char *name, const char *value, int res)
4541 {
4542         switch (res) {
4543         case Z_TOO_BIG:
4544                 zerror(zlogp, B_FALSE, "%s property value is too large.", name);
4545                 break;
4546 
4547         case Z_INVALID_PROPERTY:
4548                 zerror(zlogp, B_FALSE, "%s property value \"%s\" is not valid",
4549                     name, value);
4550                 break;
4551 
4552         default:
4553                 zerror(zlogp, B_TRUE, "fetching property %s: %d", name, res);
4554                 break;
4555         }
4556 }
4557 
4558 /*
4559  * Sets the hostid of the new zone based on its configured value.  The zone's
4560  * zone_t structure must already exist in kernel memory.  'zlogp' refers to the
4561  * log used to report errors and warnings and must be non-NULL.  'zone_namep'
4562  * is the name of the new zone and must be non-NULL.  'zoneid' is the numeric
4563  * ID of the new zone.
4564  *
4565  * This function returns zero on success and a nonzero error code on failure.
4566  */
4567 static int
4568 setup_zone_hostid(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4569 {
4570         int res;
4571         char hostidp[HW_HOSTID_LEN];
4572         unsigned int hostid;
4573 
4574         res = zonecfg_get_hostid(handle, hostidp, sizeof (hostidp));
4575 
4576         if (res == Z_BAD_PROPERTY) {
4577                 return (Z_OK);
4578         } else if (res != Z_OK) {
4579                 report_prop_err(zlogp, "hostid", hostidp, res);
4580                 return (res);
4581         }
4582 
4583         hostid = (unsigned int)strtoul(hostidp, NULL, 16);
4584         if ((res = zone_setattr(zoneid, ZONE_ATTR_HOSTID, &hostid,
4585             sizeof (hostid))) != 0) {
4586                 zerror(zlogp, B_TRUE,
4587                     "zone hostid is not valid: %s: %d", hostidp, res);
4588                 return (Z_SYSTEM);
4589         }
4590 
4591         return (res);
4592 }
4593 
4594 static int
4595 setup_zone_secflags(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4596 {
4597         psecflags_t secflags;
4598         struct zone_secflagstab tab = {0};
4599         secflagdelta_t delt;
4600         int res;
4601 
4602         res = zonecfg_lookup_secflags(handle, &tab);
4603 
4604         if ((res != Z_OK) &&
4605             /* The general defaulting code will handle this */
4606             (res != Z_NO_ENTRY) && (res != Z_BAD_PROPERTY)) {
4607                 zerror(zlogp, B_FALSE, "security-flags property is "
4608                     "invalid: %d", res);
4609                 return (res);
4610         }
4611 
4612         if (strlen(tab.zone_secflags_lower) == 0)
4613                 (void) strlcpy(tab.zone_secflags_lower, "none",
4614                     sizeof (tab.zone_secflags_lower));
4615         if (strlen(tab.zone_secflags_default) == 0)
4616                 (void) strlcpy(tab.zone_secflags_default,
4617                     tab.zone_secflags_lower,
4618                     sizeof (tab.zone_secflags_default));
4619         if (strlen(tab.zone_secflags_upper) == 0)
4620                 (void) strlcpy(tab.zone_secflags_upper, "all",
4621                     sizeof (tab.zone_secflags_upper));
4622 
4623         if (secflags_parse(NULL, tab.zone_secflags_default,
4624             &delt) == -1) {
4625                 zerror(zlogp, B_FALSE, "default security-flags: '%s'"
4626                     "are invalid", tab.zone_secflags_default);
4627                 return (Z_BAD_PROPERTY);
4628         } else if (delt.psd_ass_active != B_TRUE) {
4629                 zerror(zlogp, B_FALSE, "relative security-flags are not "
4630                     "allowed in zone configuration (default "
4631                     "security-flags: '%s')",
4632                     tab.zone_secflags_default);
4633                 return (Z_BAD_PROPERTY);
4634         } else {
4635                 secflags_copy(&secflags.psf_inherit, &delt.psd_assign);
4636                 secflags_copy(&secflags.psf_effective, &delt.psd_assign);
4637         }
4638 
4639         if (secflags_parse(NULL, tab.zone_secflags_lower,
4640             &delt) == -1) {
4641                 zerror(zlogp, B_FALSE, "lower security-flags: '%s'"
4642                     "are invalid", tab.zone_secflags_lower);
4643                 return (Z_BAD_PROPERTY);
4644         } else if (delt.psd_ass_active != B_TRUE) {
4645                 zerror(zlogp, B_FALSE, "relative security-flags are not "
4646                     "allowed in zone configuration (lower "
4647                     "security-flags: '%s')",
4648                     tab.zone_secflags_lower);
4649                 return (Z_BAD_PROPERTY);
4650         } else {
4651                 secflags_copy(&secflags.psf_lower, &delt.psd_assign);
4652         }
4653 
4654         if (secflags_parse(NULL, tab.zone_secflags_upper,
4655             &delt) == -1) {
4656                 zerror(zlogp, B_FALSE, "upper security-flags: '%s'"
4657                     "are invalid", tab.zone_secflags_upper);
4658                 return (Z_BAD_PROPERTY);
4659         } else if (delt.psd_ass_active != B_TRUE) {
4660                 zerror(zlogp, B_FALSE, "relative security-flags are not "
4661                     "allowed in zone configuration (upper "
4662                     "security-flags: '%s')",
4663                     tab.zone_secflags_upper);
4664                 return (Z_BAD_PROPERTY);
4665         } else {
4666                 secflags_copy(&secflags.psf_upper, &delt.psd_assign);
4667         }
4668 
4669         if (!psecflags_validate(&secflags)) {
4670                 zerror(zlogp, B_TRUE, "security-flags violate invariants");
4671                 return (Z_BAD_PROPERTY);
4672         }
4673 
4674         if ((res = zone_setattr(zoneid, ZONE_ATTR_SECFLAGS, &secflags,
4675             sizeof (secflags))) != 0) {
4676                 zerror(zlogp, B_TRUE,
4677                     "security-flags couldn't be set: %d", res);
4678                 return (Z_SYSTEM);
4679         }
4680 
4681         return (Z_OK);
4682 }
4683 
4684 static int
4685 setup_zone_fs_allowed(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4686 {
4687         char fsallowed[ZONE_FS_ALLOWED_MAX];
4688         char *fsallowedp = fsallowed;
4689         int len = sizeof (fsallowed);
4690         int res;
4691 
4692         res = zonecfg_get_fs_allowed(handle, fsallowed, len);
4693 
4694         if (res == Z_BAD_PROPERTY) {
4695                 /* No value, set the defaults */
4696                 (void) strlcpy(fsallowed, DFLT_FS_ALLOWED, len);
4697         } else if (res != Z_OK) {
4698                 report_prop_err(zlogp, "fs-allowed", fsallowed, res);
4699                 return (res);
4700         } else if (fsallowed[0] == '-') {
4701                 /* dropping default filesystems - use remaining list */
4702                 if (fsallowed[1] != ',')
4703                         return (Z_OK);
4704                 fsallowedp += 2;
4705                 len -= 2;
4706         } else {
4707                 /* Has a value, append the defaults */
4708                 if (strlcat(fsallowed, ",", len) >= len ||
4709                     strlcat(fsallowed, DFLT_FS_ALLOWED, len) >= len) {
4710                         report_prop_err(zlogp, "fs-allowed", fsallowed,
4711                             Z_TOO_BIG);
4712                         return (Z_TOO_BIG);
4713                 }
4714         }
4715 
4716         if (zone_setattr(zoneid, ZONE_ATTR_FS_ALLOWED, fsallowedp, len) != 0) {
4717                 zerror(zlogp, B_TRUE,
4718                     "fs-allowed couldn't be set: %s: %d", fsallowedp, res);
4719                 return (Z_SYSTEM);
4720         }
4721 
4722         return (Z_OK);
4723 }
4724 
4725 static int
4726 setup_zone_attrs(zlog_t *zlogp, char *zone_namep, zoneid_t zoneid)
4727 {
4728         zone_dochandle_t handle;
4729         int res = Z_OK;
4730 
4731         if ((handle = zonecfg_init_handle()) == NULL) {
4732                 zerror(zlogp, B_TRUE, "getting zone configuration handle");
4733                 return (Z_BAD_HANDLE);
4734         }
4735         if ((res = zonecfg_get_snapshot_handle(zone_namep, handle)) != Z_OK) {
4736                 zerror(zlogp, B_FALSE, "invalid configuration");
4737                 goto out;
4738         }
4739 
4740         if ((res = setup_zone_hostid(handle, zlogp, zoneid)) != Z_OK)
4741                 goto out;
4742 
4743         if ((res = setup_zone_fs_allowed(handle, zlogp, zoneid)) != Z_OK)
4744                 goto out;
4745 
4746         if ((res = setup_zone_secflags(handle, zlogp, zoneid)) != Z_OK)
4747                 goto out;
4748 
4749 out:
4750         zonecfg_fini_handle(handle);
4751         return (res);
4752 }
4753 
4754 zoneid_t
4755 vplat_create(zlog_t *zlogp, zone_mnt_t mount_cmd)
4756 {
4757         zoneid_t rval = -1;
4758         priv_set_t *privs;
4759         char rootpath[MAXPATHLEN];
4760         char *rctlbuf = NULL;
4761         size_t rctlbufsz = 0;
4762         char *zfsbuf = NULL;
4763         size_t zfsbufsz = 0;
4764         zoneid_t zoneid = -1;
4765         int xerr;
4766         char *kzone;
4767         FILE *fp = NULL;
4768         tsol_zcent_t *zcent = NULL;
4769         int match = 0;
4770         int doi = 0;
4771         int flags;
4772         zone_iptype_t iptype;
4773 
4774         if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
4775                 zerror(zlogp, B_TRUE, "unable to determine zone root");
4776                 return (-1);
4777         }
4778         if (zonecfg_in_alt_root())
4779                 resolve_lofs(zlogp, rootpath, sizeof (rootpath));
4780 
4781         if (vplat_get_iptype(zlogp, &iptype) < 0) {
4782                 zerror(zlogp, B_TRUE, "unable to determine ip-type");
4783                 return (-1);
4784         }
4785         switch (iptype) {
4786         case ZS_SHARED:
4787                 flags = 0;
4788                 break;
4789         case ZS_EXCLUSIVE:
4790                 flags = ZCF_NET_EXCL;
4791                 break;
4792         }
4793 
4794         if ((privs = priv_allocset()) == NULL) {
4795                 zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
4796                 return (-1);
4797         }
4798         priv_emptyset(privs);
4799         if (get_privset(zlogp, privs, mount_cmd) != 0)
4800                 goto error;
4801 
4802         if (mount_cmd == Z_MNT_BOOT &&
4803             get_rctls(zlogp, &rctlbuf, &rctlbufsz) != 0) {
4804                 zerror(zlogp, B_FALSE, "Unable to get list of rctls");
4805                 goto error;
4806         }
4807 
4808         if (get_datasets(zlogp, &zfsbuf, &zfsbufsz) != 0) {
4809                 zerror(zlogp, B_FALSE, "Unable to get list of ZFS datasets");
4810                 goto error;
4811         }
4812 
4813         if (mount_cmd == Z_MNT_BOOT && is_system_labeled()) {
4814                 zcent = get_zone_label(zlogp, privs);
4815                 if (zcent != NULL) {
4816                         match = zcent->zc_match;
4817                         doi = zcent->zc_doi;
4818                         *zlabel = zcent->zc_label;
4819                 } else {
4820                         goto error;
4821                 }
4822                 if (validate_rootds_label(zlogp, rootpath, zlabel) != 0)
4823                         goto error;
4824         }
4825 
4826         kzone = zone_name;
4827 
4828         /*
4829          * We must do this scan twice.  First, we look for zones running on the
4830          * main system that are using this root (or any subdirectory of it).
4831          * Next, we reduce to the shortest path and search for loopback mounts
4832          * that use this same source node (same device and inode).
4833          */
4834         if (duplicate_zone_root(zlogp, rootpath))
4835                 goto error;
4836         if (duplicate_reachable_path(zlogp, rootpath))
4837                 goto error;
4838 
4839         if (ALT_MOUNT(mount_cmd)) {
4840                 root_to_lu(zlogp, rootpath, sizeof (rootpath), B_TRUE);
4841 
4842                 /*
4843                  * Forge up a special root for this zone.  When a zone is
4844                  * mounted, we can't let the zone have its own root because the
4845                  * tools that will be used in this "scratch zone" need access
4846                  * to both the zone's resources and the running machine's
4847                  * executables.
4848                  *
4849                  * Note that the mkdir here also catches read-only filesystems.
4850                  */
4851                 if (mkdir(rootpath, 0755) != 0 && errno != EEXIST) {
4852                         zerror(zlogp, B_TRUE, "cannot create %s", rootpath);
4853                         goto error;
4854                 }
4855                 if (domount(zlogp, "tmpfs", "", "swap", rootpath) != 0)
4856                         goto error;
4857         }
4858 
4859         if (zonecfg_in_alt_root()) {
4860                 /*
4861                  * If we are mounting up a zone in an alternate root partition,
4862                  * then we have some additional work to do before starting the
4863                  * zone.  First, resolve the root path down so that we're not
4864                  * fooled by duplicates.  Then forge up an internal name for
4865                  * the zone.
4866                  */
4867                 if ((fp = zonecfg_open_scratch("", B_TRUE)) == NULL) {
4868                         zerror(zlogp, B_TRUE, "cannot open mapfile");
4869                         goto error;
4870                 }
4871                 if (zonecfg_lock_scratch(fp) != 0) {
4872                         zerror(zlogp, B_TRUE, "cannot lock mapfile");
4873                         goto error;
4874                 }
4875                 if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
4876                     NULL, 0) == 0) {
4877                         zerror(zlogp, B_FALSE, "scratch zone already running");
4878                         goto error;
4879                 }
4880                 /* This is the preferred name */
4881                 (void) snprintf(kernzone, sizeof (kernzone), "SUNWlu-%s",
4882                     zone_name);
4883                 srandom(getpid());
4884                 while (zonecfg_reverse_scratch(fp, kernzone, NULL, 0, NULL,
4885                     0) == 0) {
4886                         /* This is just an arbitrary name; note "." usage */
4887                         (void) snprintf(kernzone, sizeof (kernzone),
4888                             "SUNWlu.%08lX%08lX", random(), random());
4889                 }
4890                 kzone = kernzone;
4891         }
4892 
4893         xerr = 0;
4894         if ((zoneid = zone_create(kzone, rootpath, privs, rctlbuf,
4895             rctlbufsz, zfsbuf, zfsbufsz, &xerr, match, doi, zlabel,
4896             flags)) == -1) {
4897                 if (xerr == ZE_AREMOUNTS) {
4898                         if (zonecfg_find_mounts(rootpath, NULL, NULL) < 1) {
4899                                 zerror(zlogp, B_FALSE,
4900                                     "An unknown file-system is mounted on "
4901                                     "a subdirectory of %s", rootpath);
4902                         } else {
4903 
4904                                 zerror(zlogp, B_FALSE,
4905                                     "These file-systems are mounted on "
4906                                     "subdirectories of %s:", rootpath);
4907                                 (void) zonecfg_find_mounts(rootpath,
4908                                     prtmount, zlogp);
4909                         }
4910                 } else if (xerr == ZE_CHROOTED) {
4911                         zerror(zlogp, B_FALSE, "%s: "
4912                             "cannot create a zone from a chrooted "
4913                             "environment", "zone_create");
4914                 } else if (xerr == ZE_LABELINUSE) {
4915                         char zonename[ZONENAME_MAX];
4916                         (void) getzonenamebyid(getzoneidbylabel(zlabel),
4917                             zonename, ZONENAME_MAX);
4918                         zerror(zlogp, B_FALSE, "The zone label is already "
4919                             "used by the zone '%s'.", zonename);
4920                 } else {
4921                         zerror(zlogp, B_TRUE, "%s failed", "zone_create");
4922                 }
4923                 goto error;
4924         }
4925 
4926         if (zonecfg_in_alt_root() &&
4927             zonecfg_add_scratch(fp, zone_name, kernzone,
4928             zonecfg_get_root()) == -1) {
4929                 zerror(zlogp, B_TRUE, "cannot add mapfile entry");
4930                 goto error;
4931         }
4932 
4933         /*
4934          * The following actions are not performed when merely mounting a zone
4935          * for administrative use.
4936          */
4937         if (mount_cmd == Z_MNT_BOOT) {
4938                 brand_handle_t bh;
4939                 struct brand_attr attr;
4940                 char modname[MAXPATHLEN];
4941 
4942                 if (setup_zone_attrs(zlogp, zone_name, zoneid) != Z_OK)
4943                         goto error;
4944 
4945                 if ((bh = brand_open(brand_name)) == NULL) {
4946                         zerror(zlogp, B_FALSE,
4947                             "unable to determine brand name");
4948                         goto error;
4949                 }
4950 
4951                 if (!is_system_labeled() &&
4952                     (strcmp(brand_name, LABELED_BRAND_NAME) == 0)) {
4953                         brand_close(bh);
4954                         zerror(zlogp, B_FALSE,
4955                             "cannot boot labeled zone on unlabeled system");
4956                         goto error;
4957                 }
4958 
4959                 /*
4960                  * If this brand requires any kernel support, now is the time to
4961                  * get it loaded and initialized.
4962                  */
4963                 if (brand_get_modname(bh, modname, MAXPATHLEN) < 0) {
4964                         brand_close(bh);
4965                         zerror(zlogp, B_FALSE,
4966                             "unable to determine brand kernel module");
4967                         goto error;
4968                 }
4969                 brand_close(bh);
4970 
4971                 if (strlen(modname) > 0) {
4972                         (void) strlcpy(attr.ba_brandname, brand_name,
4973                             sizeof (attr.ba_brandname));
4974                         (void) strlcpy(attr.ba_modname, modname,
4975                             sizeof (attr.ba_modname));
4976                         if (zone_setattr(zoneid, ZONE_ATTR_BRAND, &attr,
4977                             sizeof (attr) != 0)) {
4978                                 zerror(zlogp, B_TRUE,
4979                                     "could not set zone brand attribute.");
4980                                 goto error;
4981                         }
4982                 }
4983 
4984                 if (setup_zone_rm(zlogp, zone_name, zoneid) != Z_OK)
4985                         goto error;
4986 
4987                 set_mlps(zlogp, zoneid, zcent);
4988         }
4989 
4990         rval = zoneid;
4991         zoneid = -1;
4992 
4993 error:
4994         if (zoneid != -1) {
4995                 (void) zone_shutdown(zoneid);
4996                 (void) zone_destroy(zoneid);
4997         }
4998         if (rctlbuf != NULL)
4999                 free(rctlbuf);
5000         priv_freeset(privs);
5001         if (fp != NULL)
5002                 zonecfg_close_scratch(fp);
5003         lofs_discard_mnttab();
5004         if (zcent != NULL)
5005                 tsol_freezcent(zcent);
5006         return (rval);
5007 }
5008 
5009 /*
5010  * Enter the zone and write a /etc/zones/index file there.  This allows
5011  * libzonecfg (and thus zoneadm) to report the UUID and potentially other zone
5012  * details from inside the zone.
5013  */
5014 static void
5015 write_index_file(zoneid_t zoneid)
5016 {
5017         FILE *zef;
5018         FILE *zet;
5019         struct zoneent *zep;
5020         pid_t child;
5021         int tmpl_fd;
5022         ctid_t ct;
5023         int fd;
5024         char uuidstr[UUID_PRINTABLE_STRING_LENGTH];
5025 
5026         /* Locate the zone entry in the global zone's index file */
5027         if ((zef = setzoneent()) == NULL)
5028                 return;
5029         while ((zep = getzoneent_private(zef)) != NULL) {
5030                 if (strcmp(zep->zone_name, zone_name) == 0)
5031                         break;
5032                 free(zep);
5033         }
5034         endzoneent(zef);
5035         if (zep == NULL)
5036                 return;
5037 
5038         if ((tmpl_fd = init_template()) == -1) {
5039                 free(zep);
5040                 return;
5041         }
5042 
5043         if ((child = fork()) == -1) {
5044                 (void) ct_tmpl_clear(tmpl_fd);
5045                 (void) close(tmpl_fd);
5046                 free(zep);
5047                 return;
5048         }
5049 
5050         /* parent waits for child to finish */
5051         if (child != 0) {
5052                 free(zep);
5053                 if (contract_latest(&ct) == -1)
5054                         ct = -1;
5055                 (void) ct_tmpl_clear(tmpl_fd);
5056                 (void) close(tmpl_fd);
5057                 (void) waitpid(child, NULL, 0);
5058                 (void) contract_abandon_id(ct);
5059                 return;
5060         }
5061 
5062         /* child enters zone and sets up index file */
5063         (void) ct_tmpl_clear(tmpl_fd);
5064         if (zone_enter(zoneid) != -1) {
5065                 (void) mkdir(ZONE_CONFIG_ROOT, ZONE_CONFIG_MODE);
5066                 (void) chown(ZONE_CONFIG_ROOT, ZONE_CONFIG_UID,
5067                     ZONE_CONFIG_GID);
5068                 fd = open(ZONE_INDEX_FILE, O_WRONLY|O_CREAT|O_TRUNC,
5069                     ZONE_INDEX_MODE);
5070                 if (fd != -1 && (zet = fdopen(fd, "w")) != NULL) {
5071                         (void) fchown(fd, ZONE_INDEX_UID, ZONE_INDEX_GID);
5072                         if (uuid_is_null(zep->zone_uuid))
5073                                 uuidstr[0] = '\0';
5074                         else
5075                                 uuid_unparse(zep->zone_uuid, uuidstr);
5076                         (void) fprintf(zet, "%s:%s:/:%s\n", zep->zone_name,
5077                             zone_state_str(zep->zone_state),
5078                             uuidstr);
5079                         (void) fclose(zet);
5080                 }
5081         }
5082         _exit(0);
5083 }
5084 
5085 int
5086 vplat_bringup(zlog_t *zlogp, zone_mnt_t mount_cmd, zoneid_t zoneid)
5087 {
5088         char zonepath[MAXPATHLEN];
5089 
5090         if (mount_cmd == Z_MNT_BOOT && validate_datasets(zlogp) != 0) {
5091                 lofs_discard_mnttab();
5092                 return (-1);
5093         }
5094 
5095         /*
5096          * Before we try to mount filesystems we need to create the
5097          * attribute backing store for /dev
5098          */
5099         if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
5100                 lofs_discard_mnttab();
5101                 return (-1);
5102         }
5103         resolve_lofs(zlogp, zonepath, sizeof (zonepath));
5104 
5105         /* Make /dev directory owned by root, grouped sys */
5106         if (make_one_dir(zlogp, zonepath, "/dev", DEFAULT_DIR_MODE,
5107             0, 3) != 0) {
5108                 lofs_discard_mnttab();
5109                 return (-1);
5110         }
5111 
5112         if (mount_filesystems(zlogp, mount_cmd) != 0) {
5113                 lofs_discard_mnttab();
5114                 return (-1);
5115         }
5116 
5117         if (mount_cmd == Z_MNT_BOOT) {
5118                 zone_iptype_t iptype;
5119 
5120                 if (vplat_get_iptype(zlogp, &iptype) < 0) {
5121                         zerror(zlogp, B_TRUE, "unable to determine ip-type");
5122                         lofs_discard_mnttab();
5123                         return (-1);
5124                 }
5125 
5126                 switch (iptype) {
5127                 case ZS_SHARED:
5128                         /* Always do this to make lo0 get configured */
5129                         if (configure_shared_network_interfaces(zlogp) != 0) {
5130                                 lofs_discard_mnttab();
5131                                 return (-1);
5132                         }
5133                         break;
5134                 case ZS_EXCLUSIVE:
5135                         if (configure_exclusive_network_interfaces(zlogp,
5136                             zoneid) !=
5137                             0) {
5138                                 lofs_discard_mnttab();
5139                                 return (-1);
5140                         }
5141                         break;
5142                 }
5143         }
5144 
5145         write_index_file(zoneid);
5146 
5147         lofs_discard_mnttab();
5148         return (0);
5149 }
5150 
5151 static int
5152 lu_root_teardown(zlog_t *zlogp)
5153 {
5154         char zroot[MAXPATHLEN];
5155 
5156         if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
5157                 zerror(zlogp, B_FALSE, "unable to determine zone root");
5158                 return (-1);
5159         }
5160         root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
5161 
5162         /*
5163          * At this point, the processes are gone, the filesystems (save the
5164          * root) are unmounted, and the zone is on death row.  But there may
5165          * still be creds floating about in the system that reference the
5166          * zone_t, and which pin down zone_rootvp causing this call to fail
5167          * with EBUSY.  Thus, we try for a little while before just giving up.
5168          * (How I wish this were not true, and umount2 just did the right
5169          * thing, or tmpfs supported MS_FORCE This is a gross hack.)
5170          */
5171         if (umount2(zroot, MS_FORCE) != 0) {
5172                 if (errno == ENOTSUP && umount2(zroot, 0) == 0)
5173                         goto unmounted;
5174                 if (errno == EBUSY) {
5175                         int tries = 10;
5176 
5177                         while (--tries >= 0) {
5178                                 (void) sleep(1);
5179                                 if (umount2(zroot, 0) == 0)
5180                                         goto unmounted;
5181                                 if (errno != EBUSY)
5182                                         break;
5183                         }
5184                 }
5185                 zerror(zlogp, B_TRUE, "unable to unmount '%s'", zroot);
5186                 return (-1);
5187         }
5188 unmounted:
5189 
5190         /*
5191          * Only zones in an alternate root environment have scratch zone
5192          * entries.
5193          */
5194         if (zonecfg_in_alt_root()) {
5195                 FILE *fp;
5196                 int retv;
5197 
5198                 if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
5199                         zerror(zlogp, B_TRUE, "cannot open mapfile");
5200                         return (-1);
5201                 }
5202                 retv = -1;
5203                 if (zonecfg_lock_scratch(fp) != 0)
5204                         zerror(zlogp, B_TRUE, "cannot lock mapfile");
5205                 else if (zonecfg_delete_scratch(fp, kernzone) != 0)
5206                         zerror(zlogp, B_TRUE, "cannot delete map entry");
5207                 else
5208                         retv = 0;
5209                 zonecfg_close_scratch(fp);
5210                 return (retv);
5211         } else {
5212                 return (0);
5213         }
5214 }
5215 
5216 int
5217 vplat_teardown(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting)
5218 {
5219         char *kzone;
5220         zoneid_t zoneid;
5221         int res;
5222         char pool_err[128];
5223         char zpath[MAXPATHLEN];
5224         char cmdbuf[MAXPATHLEN];
5225         brand_handle_t bh = NULL;
5226         dladm_status_t status;
5227         char errmsg[DLADM_STRSIZE];
5228         ushort_t flags;
5229 
5230         kzone = zone_name;
5231         if (zonecfg_in_alt_root()) {
5232                 FILE *fp;
5233 
5234                 if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
5235                         zerror(zlogp, B_TRUE, "unable to open map file");
5236                         goto error;
5237                 }
5238                 if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
5239                     kernzone, sizeof (kernzone)) != 0) {
5240                         zerror(zlogp, B_FALSE, "unable to find scratch zone");
5241                         zonecfg_close_scratch(fp);
5242                         goto error;
5243                 }
5244                 zonecfg_close_scratch(fp);
5245                 kzone = kernzone;
5246         }
5247 
5248         if ((zoneid = getzoneidbyname(kzone)) == ZONE_ID_UNDEFINED) {
5249                 if (!bringup_failure_recovery)
5250                         zerror(zlogp, B_TRUE, "unable to get zoneid");
5251                 if (unmount_cmd)
5252                         (void) lu_root_teardown(zlogp);
5253                 goto error;
5254         }
5255 
5256         if (remove_datalink_pool(zlogp, zoneid) != 0) {
5257                 zerror(zlogp, B_FALSE, "unable clear datalink pool property");
5258                 goto error;
5259         }
5260 
5261         if (remove_datalink_protect(zlogp, zoneid) != 0) {
5262                 zerror(zlogp, B_FALSE,
5263                     "unable clear datalink protect property");
5264                 goto error;
5265         }
5266 
5267         /*
5268          * The datalinks assigned to the zone will be removed from the NGZ as
5269          * part of zone_shutdown() so that we need to remove protect/pool etc.
5270          * before zone_shutdown(). Even if the shutdown itself fails, the zone
5271          * will not be able to violate any constraints applied because the
5272          * datalinks are no longer available to the zone.
5273          */
5274         if (zone_shutdown(zoneid) != 0) {
5275                 zerror(zlogp, B_TRUE, "unable to shutdown zone");
5276                 goto error;
5277         }
5278 
5279         /* Get the zonepath of this zone */
5280         if (zone_get_zonepath(zone_name, zpath, sizeof (zpath)) != Z_OK) {
5281                 zerror(zlogp, B_FALSE, "unable to determine zone path");
5282                 goto error;
5283         }
5284 
5285         /* Get a handle to the brand info for this zone */
5286         if ((bh = brand_open(brand_name)) == NULL) {
5287                 zerror(zlogp, B_FALSE, "unable to determine zone brand");
5288                 return (-1);
5289         }
5290         /*
5291          * If there is a brand 'halt' callback, execute it now to give the
5292          * brand a chance to cleanup any custom configuration.
5293          */
5294         (void) strcpy(cmdbuf, EXEC_PREFIX);
5295         if (brand_get_halt(bh, zone_name, zpath, cmdbuf + EXEC_LEN,
5296             sizeof (cmdbuf) - EXEC_LEN) < 0) {
5297                 brand_close(bh);
5298                 zerror(zlogp, B_FALSE, "unable to determine branded zone's "
5299                     "halt callback.");
5300                 goto error;
5301         }
5302         brand_close(bh);
5303 
5304         if ((strlen(cmdbuf) > EXEC_LEN) &&
5305             (do_subproc(zlogp, cmdbuf, NULL) != Z_OK)) {
5306                 zerror(zlogp, B_FALSE, "%s failed", cmdbuf);
5307                 goto error;
5308         }
5309 
5310         if (!unmount_cmd) {
5311                 zone_iptype_t iptype;
5312 
5313                 if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
5314                     sizeof (flags)) < 0) {
5315                         if (vplat_get_iptype(zlogp, &iptype) < 0) {
5316                                 zerror(zlogp, B_TRUE, "unable to determine "
5317                                     "ip-type");
5318                                 goto error;
5319                         }
5320                 } else {
5321                         if (flags & ZF_NET_EXCL)
5322                                 iptype = ZS_EXCLUSIVE;
5323                         else
5324                                 iptype = ZS_SHARED;
5325                 }
5326 
5327                 switch (iptype) {
5328                 case ZS_SHARED:
5329                         if (unconfigure_shared_network_interfaces(zlogp,
5330                             zoneid) != 0) {
5331                                 zerror(zlogp, B_FALSE, "unable to unconfigure "
5332                                     "network interfaces in zone");
5333                                 goto error;
5334                         }
5335                         break;
5336                 case ZS_EXCLUSIVE:
5337                         if (unconfigure_exclusive_network_interfaces(zlogp,
5338                             zoneid) != 0) {
5339                                 zerror(zlogp, B_FALSE, "unable to unconfigure "
5340                                     "network interfaces in zone");
5341                                 goto error;
5342                         }
5343                         status = dladm_zone_halt(dld_handle, zoneid);
5344                         if (status != DLADM_STATUS_OK) {
5345                                 zerror(zlogp, B_FALSE, "unable to notify "
5346                                     "dlmgmtd of zone halt: %s",
5347                                     dladm_status2str(status, errmsg));
5348                         }
5349                         break;
5350                 }
5351         }
5352 
5353         if (!unmount_cmd && tcp_abort_connections(zlogp, zoneid) != 0) {
5354                 zerror(zlogp, B_TRUE, "unable to abort TCP connections");
5355                 goto error;
5356         }
5357 
5358         if (unmount_filesystems(zlogp, zoneid, unmount_cmd) != 0) {
5359                 zerror(zlogp, B_FALSE,
5360                     "unable to unmount file systems in zone");
5361                 goto error;
5362         }
5363 
5364         /*
5365          * If we are rebooting then we normally don't want to destroy an
5366          * existing temporary pool at this point so that we can just reuse it
5367          * when the zone boots back up.  However, it is also possible we were
5368          * running with a temporary pool and the zone configuration has been
5369          * modified to no longer use a temporary pool.  In that case we need
5370          * to destroy the temporary pool now.  This case looks like the case
5371          * where we never had a temporary pool configured but
5372          * zonecfg_destroy_tmp_pool will do the right thing either way.
5373          */
5374         if (!unmount_cmd) {
5375                 boolean_t destroy_tmp_pool = B_TRUE;
5376 
5377                 if (rebooting) {
5378                         struct zone_psettab pset_tab;
5379                         zone_dochandle_t handle;
5380 
5381                         if ((handle = zonecfg_init_handle()) != NULL &&
5382                             zonecfg_get_handle(zone_name, handle) == Z_OK &&
5383                             zonecfg_lookup_pset(handle, &pset_tab) == Z_OK)
5384                                 destroy_tmp_pool = B_FALSE;
5385 
5386                         zonecfg_fini_handle(handle);
5387                 }
5388 
5389                 if (destroy_tmp_pool) {
5390                         if ((res = zonecfg_destroy_tmp_pool(zone_name, pool_err,
5391                             sizeof (pool_err))) != Z_OK) {
5392                                 if (res == Z_POOL)
5393                                         zerror(zlogp, B_FALSE, pool_err);
5394                         }
5395                 }
5396         }
5397 
5398         remove_mlps(zlogp, zoneid);
5399 
5400         if (zone_destroy(zoneid) != 0) {
5401                 zerror(zlogp, B_TRUE, "unable to destroy zone");
5402                 goto error;
5403         }
5404 
5405         /*
5406          * Special teardown for alternate boot environments: remove the tmpfs
5407          * root for the zone and then remove it from the map file.
5408          */
5409         if (unmount_cmd && lu_root_teardown(zlogp) != 0)
5410                 goto error;
5411 
5412         lofs_discard_mnttab();
5413         return (0);
5414 
5415 error:
5416         lofs_discard_mnttab();
5417         return (-1);
5418 }