1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2017 Kyle J. Kneitinger <kyle@kneit.in> 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 */ 27 28 #include <sys/cdefs.h> 29 __FBSDID("$FreeBSD$"); 30 31 #include <sys/param.h> 32 #include <sys/module.h> 33 #include <sys/mount.h> 34 #include <sys/stat.h> 35 #include <sys/ucred.h> 36 #include <sys/queue.h> 37 #include <sys/zfs_context.h> 38 #include <sys/mntent.h> 39 #include <sys/zfs_ioctl.h> 40 41 #include <libzutil.h> 42 #include <ctype.h> 43 #include <libgen.h> 44 #include <libzfs_core.h> 45 #include <libzfs_impl.h> 46 #include <stdio.h> 47 #include <stdlib.h> 48 #include <time.h> 49 #include <unistd.h> 50 #include <libzfsbootenv.h> 51 52 #include "be.h" 53 #include "be_impl.h" 54 55 struct promote_entry { 56 char name[BE_MAXPATHLEN]; 57 SLIST_ENTRY(promote_entry) link; 58 }; 59 60 struct be_destroy_data { 61 libbe_handle_t *lbh; 62 char target_name[BE_MAXPATHLEN]; 63 char *snapname; 64 SLIST_HEAD(, promote_entry) promotelist; 65 }; 66 67 #if SOON 68 static int be_create_child_noent(libbe_handle_t *lbh, const char *active, 69 const char *child_path); 70 static int be_create_child_cloned(libbe_handle_t *lbh, const char *active); 71 #endif 72 73 /* Arbitrary... should tune */ 74 #define BE_SNAP_SERIAL_MAX 1024 75 76 /* 77 * Iterator function for locating the rootfs amongst the children of the 78 * zfs_be_root set by loader(8). data is expected to be a libbe_handle_t *. 79 */ 80 static int 81 be_locate_rootfs(libbe_handle_t *lbh) 82 { 83 struct statfs sfs; 84 struct mnttab entry; 85 zfs_handle_t *zfs; 86 87 /* 88 * Check first if root is ZFS; if not, we'll bail on rootfs capture. 89 * Unfortunately needed because zfs_path_to_zhandle will emit to 90 * stderr if / isn't actually a ZFS filesystem, which we'd like 91 * to avoid. 92 */ 93 if (statfs("/", &sfs) == 0) { 94 statfs2mnttab(&sfs, &entry); 95 if (strcmp(entry.mnt_fstype, MNTTYPE_ZFS) != 0) 96 return (1); 97 } else 98 return (1); 99 zfs = zfs_path_to_zhandle(lbh->lzh, "/", ZFS_TYPE_FILESYSTEM); 100 if (zfs == NULL) 101 return (1); 102 103 strlcpy(lbh->rootfs, zfs_get_name(zfs), sizeof(lbh->rootfs)); 104 zfs_close(zfs); 105 return (0); 106 } 107 108 /* 109 * Initializes the libbe context to operate in the root boot environment 110 * dataset, for example, zroot/ROOT. 111 */ 112 libbe_handle_t * 113 libbe_init(const char *root) 114 { 115 char altroot[MAXPATHLEN]; 116 libbe_handle_t *lbh; 117 char *poolname, *pos; 118 int pnamelen; 119 120 lbh = NULL; 121 poolname = pos = NULL; 122 123 /* 124 * If the zfs kmod's not loaded then the later libzfs_init() will load 125 * the module for us, but that's not desirable for a couple reasons. If 126 * the module's not loaded, there's no pool imported and we're going to 127 * fail anyways. We also don't really want libbe consumers to have that 128 * kind of side-effect (module loading) in the general case. 129 */ 130 if (modfind("zfs") < 0) 131 goto err; 132 133 if ((lbh = calloc(1, sizeof(libbe_handle_t))) == NULL) 134 goto err; 135 136 if ((lbh->lzh = libzfs_init()) == NULL) 137 goto err; 138 139 /* 140 * Grab rootfs, we'll work backwards from there if an optional BE root 141 * has not been passed in. 142 */ 143 if (be_locate_rootfs(lbh) != 0) { 144 if (root == NULL) 145 goto err; 146 *lbh->rootfs = '\0'; 147 } 148 if (root == NULL) { 149 /* Strip off the final slash from rootfs to get the be root */ 150 strlcpy(lbh->root, lbh->rootfs, sizeof(lbh->root)); 151 pos = strrchr(lbh->root, '/'); 152 if (pos == NULL) 153 goto err; 154 *pos = '\0'; 155 } else 156 strlcpy(lbh->root, root, sizeof(lbh->root)); 157 158 if ((pos = strchr(lbh->root, '/')) == NULL) 159 goto err; 160 161 pnamelen = pos - lbh->root; 162 poolname = malloc(pnamelen + 1); 163 if (poolname == NULL) 164 goto err; 165 166 strlcpy(poolname, lbh->root, pnamelen + 1); 167 if ((lbh->active_phandle = zpool_open(lbh->lzh, poolname)) == NULL) 168 goto err; 169 free(poolname); 170 poolname = NULL; 171 172 if (zpool_get_prop(lbh->active_phandle, ZPOOL_PROP_BOOTFS, lbh->bootfs, 173 sizeof(lbh->bootfs), NULL, true) != 0) 174 goto err; 175 176 if (zpool_get_prop(lbh->active_phandle, ZPOOL_PROP_ALTROOT, 177 altroot, sizeof(altroot), NULL, true) == 0 && 178 strcmp(altroot, "-") != 0) 179 lbh->altroot_len = strlen(altroot); 180 181 return (lbh); 182 err: 183 if (lbh != NULL) { 184 if (lbh->active_phandle != NULL) 185 zpool_close(lbh->active_phandle); 186 if (lbh->lzh != NULL) 187 libzfs_fini(lbh->lzh); 188 free(lbh); 189 } 190 free(poolname); 191 return (NULL); 192 } 193 194 195 /* 196 * Free memory allocated by libbe_init() 197 */ 198 void 199 libbe_close(libbe_handle_t *lbh) 200 { 201 202 if (lbh->active_phandle != NULL) 203 zpool_close(lbh->active_phandle); 204 libzfs_fini(lbh->lzh); 205 free(lbh); 206 } 207 208 /* 209 * Proxy through to libzfs for the moment. 210 */ 211 void 212 be_nicenum(uint64_t num, char *buf, size_t buflen) 213 { 214 215 zfs_nicenum(num, buf, buflen); 216 } 217 218 static bool 219 be_should_promote_clones(zfs_handle_t *zfs_hdl, struct be_destroy_data *bdd) 220 { 221 char *atpos; 222 223 if (zfs_get_type(zfs_hdl) != ZFS_TYPE_SNAPSHOT) 224 return (false); 225 226 /* 227 * If we're deleting a snapshot, we need to make sure we only promote 228 * clones that are derived from one of the snapshots we're deleting, 229 * rather than that of a snapshot we're not touching. This keeps stuff 230 * in a consistent state, making sure that we don't error out unless 231 * we really need to. 232 */ 233 if (bdd->snapname == NULL) 234 return (true); 235 236 atpos = strchr(zfs_get_name(zfs_hdl), '@'); 237 return (strcmp(atpos + 1, bdd->snapname) == 0); 238 } 239 240 /* 241 * This is executed from be_promote_dependent_clones via zfs_iter_dependents, 242 * It checks if the dependent type is a snapshot then attempts to find any 243 * clones associated with it. Any clones not related to the destroy target are 244 * added to the promote list. 245 */ 246 static int 247 be_dependent_clone_cb(zfs_handle_t *zfs_hdl, void *data) 248 { 249 int err; 250 bool found; 251 const char *name; 252 struct nvlist *nvl; 253 struct nvpair *nvp; 254 struct be_destroy_data *bdd; 255 struct promote_entry *entry, *newentry; 256 257 nvp = NULL; 258 err = 0; 259 bdd = (struct be_destroy_data *)data; 260 261 if (be_should_promote_clones(zfs_hdl, bdd) && 262 (nvl = zfs_get_clones_nvl(zfs_hdl)) != NULL) { 263 while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) { 264 name = nvpair_name(nvp); 265 266 /* 267 * Skip if the clone is equal to, or a child of, the 268 * destroy target. 269 */ 270 if (strncmp(name, bdd->target_name, 271 strlen(bdd->target_name)) == 0 || 272 strstr(name, bdd->target_name) == name) { 273 continue; 274 } 275 276 found = false; 277 SLIST_FOREACH(entry, &bdd->promotelist, link) { 278 if (strcmp(entry->name, name) == 0) { 279 found = true; 280 break; 281 } 282 } 283 284 if (found) 285 continue; 286 287 newentry = malloc(sizeof(struct promote_entry)); 288 if (newentry == NULL) { 289 err = ENOMEM; 290 break; 291 } 292 293 #define BE_COPY_NAME(entry, src) \ 294 strlcpy((entry)->name, (src), sizeof((entry)->name)) 295 if (BE_COPY_NAME(newentry, name) >= 296 sizeof(newentry->name)) { 297 /* Shouldn't happen. */ 298 free(newentry); 299 err = ENAMETOOLONG; 300 break; 301 } 302 #undef BE_COPY_NAME 303 304 /* 305 * We're building up a SLIST here to make sure both that 306 * we get the order right and so that we don't 307 * inadvertently observe the wrong state by promoting 308 * datasets while we're still walking the tree. The 309 * latter can lead to situations where we promote a BE 310 * then effectively demote it again. 311 */ 312 SLIST_INSERT_HEAD(&bdd->promotelist, newentry, link); 313 } 314 nvlist_free(nvl); 315 } 316 zfs_close(zfs_hdl); 317 return (err); 318 } 319 320 /* 321 * This is called before a destroy, so that any datasets(environments) that are 322 * dependent on this one get promoted before destroying the target. 323 */ 324 static int 325 be_promote_dependent_clones(zfs_handle_t *zfs_hdl, struct be_destroy_data *bdd) 326 { 327 int err; 328 zfs_handle_t *clone; 329 struct promote_entry *entry; 330 331 snprintf(bdd->target_name, BE_MAXPATHLEN, "%s/", zfs_get_name(zfs_hdl)); 332 err = zfs_iter_dependents(zfs_hdl, true, be_dependent_clone_cb, bdd); 333 334 /* 335 * Drain the list and walk away from it if we're only deleting a 336 * snapshot. 337 */ 338 if (bdd->snapname != NULL && !SLIST_EMPTY(&bdd->promotelist)) 339 err = BE_ERR_HASCLONES; 340 while (!SLIST_EMPTY(&bdd->promotelist)) { 341 entry = SLIST_FIRST(&bdd->promotelist); 342 SLIST_REMOVE_HEAD(&bdd->promotelist, link); 343 344 #define ZFS_GRAB_CLONE() \ 345 zfs_open(bdd->lbh->lzh, entry->name, ZFS_TYPE_FILESYSTEM) 346 /* 347 * Just skip this part on error, we still want to clean up the 348 * promotion list after the first error. We'll then preserve it 349 * all the way back. 350 */ 351 if (err == 0 && (clone = ZFS_GRAB_CLONE()) != NULL) { 352 err = zfs_promote(clone); 353 if (err != 0) 354 err = BE_ERR_DESTROYMNT; 355 zfs_close(clone); 356 } 357 #undef ZFS_GRAB_CLONE 358 free(entry); 359 } 360 361 return (err); 362 } 363 364 static int 365 be_destroy_cb(zfs_handle_t *zfs_hdl, void *data) 366 { 367 char path[BE_MAXPATHLEN]; 368 struct be_destroy_data *bdd; 369 zfs_handle_t *snap; 370 int err; 371 372 bdd = (struct be_destroy_data *)data; 373 if (bdd->snapname == NULL) { 374 err = zfs_iter_children(zfs_hdl, be_destroy_cb, data); 375 if (err != 0) 376 return (err); 377 return (zfs_destroy(zfs_hdl, false)); 378 } 379 /* If we're dealing with snapshots instead, delete that one alone */ 380 err = zfs_iter_filesystems(zfs_hdl, be_destroy_cb, data); 381 if (err != 0) 382 return (err); 383 /* 384 * This part is intentionally glossing over any potential errors, 385 * because there's a lot less potential for errors when we're cleaning 386 * up snapshots rather than a full deep BE. The primary error case 387 * here being if the snapshot doesn't exist in the first place, which 388 * the caller will likely deem insignificant as long as it doesn't 389 * exist after the call. Thus, such a missing snapshot shouldn't jam 390 * up the destruction. 391 */ 392 snprintf(path, sizeof(path), "%s@%s", zfs_get_name(zfs_hdl), 393 bdd->snapname); 394 if (!zfs_dataset_exists(bdd->lbh->lzh, path, ZFS_TYPE_SNAPSHOT)) 395 return (0); 396 snap = zfs_open(bdd->lbh->lzh, path, ZFS_TYPE_SNAPSHOT); 397 if (snap != NULL) 398 zfs_destroy(snap, false); 399 return (0); 400 } 401 402 #define BE_DESTROY_WANTORIGIN (BE_DESTROY_ORIGIN | BE_DESTROY_AUTOORIGIN) 403 /* 404 * Destroy the boot environment or snapshot specified by the name 405 * parameter. Options are or'd together with the possible values: 406 * BE_DESTROY_FORCE : forces operation on mounted datasets 407 * BE_DESTROY_ORIGIN: destroy the origin snapshot as well 408 */ 409 static int 410 be_destroy_internal(libbe_handle_t *lbh, const char *name, int options, 411 bool odestroyer) 412 { 413 struct be_destroy_data bdd; 414 char origin[BE_MAXPATHLEN], path[BE_MAXPATHLEN]; 415 zfs_handle_t *fs; 416 char *snapdelim; 417 int err, force, mounted; 418 size_t rootlen; 419 420 bdd.lbh = lbh; 421 bdd.snapname = NULL; 422 SLIST_INIT(&bdd.promotelist); 423 force = options & BE_DESTROY_FORCE; 424 *origin = '\0'; 425 426 be_root_concat(lbh, name, path); 427 428 if ((snapdelim = strchr(path, '@')) == NULL) { 429 if (!zfs_dataset_exists(lbh->lzh, path, ZFS_TYPE_FILESYSTEM)) 430 return (set_error(lbh, BE_ERR_NOENT)); 431 432 if (strcmp(path, lbh->rootfs) == 0 || 433 strcmp(path, lbh->bootfs) == 0) 434 return (set_error(lbh, BE_ERR_DESTROYACT)); 435 436 fs = zfs_open(lbh->lzh, path, ZFS_TYPE_FILESYSTEM); 437 if (fs == NULL) 438 return (set_error(lbh, BE_ERR_ZFSOPEN)); 439 440 /* Don't destroy a mounted dataset unless force is specified */ 441 if ((mounted = zfs_is_mounted(fs, NULL)) != 0) { 442 if (force) { 443 zfs_unmount(fs, NULL, 0); 444 } else { 445 free(bdd.snapname); 446 return (set_error(lbh, BE_ERR_DESTROYMNT)); 447 } 448 } 449 } else { 450 /* 451 * If we're initially destroying a snapshot, origin options do 452 * not make sense. If we're destroying the origin snapshot of 453 * a BE, we want to maintain the options in case we need to 454 * fake success after failing to promote. 455 */ 456 if (!odestroyer) 457 options &= ~BE_DESTROY_WANTORIGIN; 458 if (!zfs_dataset_exists(lbh->lzh, path, ZFS_TYPE_SNAPSHOT)) 459 return (set_error(lbh, BE_ERR_NOENT)); 460 461 bdd.snapname = strdup(snapdelim + 1); 462 if (bdd.snapname == NULL) 463 return (set_error(lbh, BE_ERR_NOMEM)); 464 *snapdelim = '\0'; 465 fs = zfs_open(lbh->lzh, path, ZFS_TYPE_DATASET); 466 if (fs == NULL) { 467 free(bdd.snapname); 468 return (set_error(lbh, BE_ERR_ZFSOPEN)); 469 } 470 } 471 472 /* 473 * Whether we're destroying a BE or a single snapshot, we need to walk 474 * the tree of what we're going to destroy and promote everything in our 475 * path so that we can make it happen. 476 */ 477 if ((err = be_promote_dependent_clones(fs, &bdd)) != 0) { 478 free(bdd.snapname); 479 480 /* 481 * If we're just destroying the origin of some other dataset 482 * we were invoked to destroy, then we just ignore 483 * BE_ERR_HASCLONES and return success unless the caller wanted 484 * to force the issue. 485 */ 486 if (odestroyer && err == BE_ERR_HASCLONES && 487 (options & BE_DESTROY_AUTOORIGIN) != 0) 488 return (0); 489 return (set_error(lbh, err)); 490 } 491 492 /* 493 * This was deferred until after we promote all of the derivatives so 494 * that we grab the new origin after everything's settled down. 495 */ 496 if ((options & BE_DESTROY_WANTORIGIN) != 0 && 497 zfs_prop_get(fs, ZFS_PROP_ORIGIN, origin, sizeof(origin), 498 NULL, NULL, 0, 1) != 0 && 499 (options & BE_DESTROY_ORIGIN) != 0) 500 return (set_error(lbh, BE_ERR_NOORIGIN)); 501 502 /* 503 * If the caller wants auto-origin destruction and the origin 504 * name matches one of our automatically created snapshot names 505 * (i.e. strftime("%F-%T") with a serial at the end), then 506 * we'll set the DESTROY_ORIGIN flag and nuke it 507 * be_is_auto_snapshot_name is exported from libbe(3) so that 508 * the caller can determine if it needs to warn about the origin 509 * not being destroyed or not. 510 */ 511 if ((options & BE_DESTROY_AUTOORIGIN) != 0 && *origin != '\0' && 512 be_is_auto_snapshot_name(lbh, origin)) 513 options |= BE_DESTROY_ORIGIN; 514 515 err = be_destroy_cb(fs, &bdd); 516 zfs_close(fs); 517 free(bdd.snapname); 518 if (err != 0) { 519 /* Children are still present or the mount is referenced */ 520 if (err == EBUSY) 521 return (set_error(lbh, BE_ERR_DESTROYMNT)); 522 return (set_error(lbh, BE_ERR_UNKNOWN)); 523 } 524 525 if ((options & BE_DESTROY_ORIGIN) == 0) 526 return (0); 527 528 /* The origin can't possibly be shorter than the BE root */ 529 rootlen = strlen(lbh->root); 530 if (*origin == '\0' || strlen(origin) <= rootlen + 1) 531 return (set_error(lbh, BE_ERR_INVORIGIN)); 532 533 /* 534 * We'll be chopping off the BE root and running this back through 535 * be_destroy, so that we properly handle the origin snapshot whether 536 * it be that of a deep BE or not. 537 */ 538 if (strncmp(origin, lbh->root, rootlen) != 0 || origin[rootlen] != '/') 539 return (0); 540 541 return (be_destroy_internal(lbh, origin + rootlen + 1, 542 options & ~BE_DESTROY_ORIGIN, true)); 543 } 544 545 int 546 be_destroy(libbe_handle_t *lbh, const char *name, int options) 547 { 548 549 /* 550 * The consumer must not set both BE_DESTROY_AUTOORIGIN and 551 * BE_DESTROY_ORIGIN. Internally, we'll set the latter from the former. 552 * The latter should imply that we must succeed at destroying the 553 * origin, or complain otherwise. 554 */ 555 if ((options & BE_DESTROY_WANTORIGIN) == BE_DESTROY_WANTORIGIN) 556 return (set_error(lbh, BE_ERR_UNKNOWN)); 557 return (be_destroy_internal(lbh, name, options, false)); 558 } 559 560 static void 561 be_setup_snapshot_name(libbe_handle_t *lbh, char *buf, size_t buflen) 562 { 563 time_t rawtime; 564 int len, serial; 565 566 time(&rawtime); 567 len = strlen(buf); 568 len += strftime(buf + len, buflen - len, "@%F-%T", localtime(&rawtime)); 569 /* No room for serial... caller will do its best */ 570 if (buflen - len < 2) 571 return; 572 573 for (serial = 0; serial < BE_SNAP_SERIAL_MAX; ++serial) { 574 snprintf(buf + len, buflen - len, "-%d", serial); 575 if (!zfs_dataset_exists(lbh->lzh, buf, ZFS_TYPE_SNAPSHOT)) 576 return; 577 } 578 } 579 580 bool 581 be_is_auto_snapshot_name(libbe_handle_t *lbh __unused, const char *name) 582 { 583 const char *snap; 584 int day, hour, minute, month, second, serial, year; 585 586 if ((snap = strchr(name, '@')) == NULL) 587 return (false); 588 ++snap; 589 /* We'll grab the individual components and do some light validation. */ 590 if (sscanf(snap, "%d-%d-%d-%d:%d:%d-%d", &year, &month, &day, &hour, 591 &minute, &second, &serial) != 7) 592 return (false); 593 return (year >= 1970) && (month >= 1 && month <= 12) && 594 (day >= 1 && day <= 31) && (hour >= 0 && hour <= 23) && 595 (minute >= 0 && minute <= 59) && (second >= 0 && second <= 60) && 596 serial >= 0; 597 } 598 599 int 600 be_snapshot(libbe_handle_t *lbh, const char *source, const char *snap_name, 601 bool recursive, char *result) 602 { 603 char buf[BE_MAXPATHLEN]; 604 int err; 605 606 be_root_concat(lbh, source, buf); 607 608 if ((err = be_exists(lbh, buf)) != 0) 609 return (set_error(lbh, err)); 610 611 if (snap_name != NULL) { 612 if (strlcat(buf, "@", sizeof(buf)) >= sizeof(buf)) 613 return (set_error(lbh, BE_ERR_INVALIDNAME)); 614 615 if (strlcat(buf, snap_name, sizeof(buf)) >= sizeof(buf)) 616 return (set_error(lbh, BE_ERR_INVALIDNAME)); 617 618 if (result != NULL) 619 snprintf(result, BE_MAXPATHLEN, "%s@%s", source, 620 snap_name); 621 } else { 622 be_setup_snapshot_name(lbh, buf, sizeof(buf)); 623 624 if (result != NULL && strlcpy(result, strrchr(buf, '/') + 1, 625 sizeof(buf)) >= sizeof(buf)) 626 return (set_error(lbh, BE_ERR_INVALIDNAME)); 627 } 628 if ((err = zfs_snapshot(lbh->lzh, buf, recursive, NULL)) != 0) { 629 switch (err) { 630 case EZFS_INVALIDNAME: 631 return (set_error(lbh, BE_ERR_INVALIDNAME)); 632 633 default: 634 /* 635 * The other errors that zfs_ioc_snapshot might return 636 * shouldn't happen if we've set things up properly, so 637 * we'll gloss over them and call it UNKNOWN as it will 638 * require further triage. 639 */ 640 if (errno == ENOTSUP) 641 return (set_error(lbh, BE_ERR_NOPOOL)); 642 return (set_error(lbh, BE_ERR_UNKNOWN)); 643 } 644 } 645 646 return (BE_ERR_SUCCESS); 647 } 648 649 650 /* 651 * Create the boot environment specified by the name parameter 652 */ 653 int 654 be_create(libbe_handle_t *lbh, const char *name) 655 { 656 int err; 657 658 err = be_create_from_existing(lbh, name, be_active_path(lbh)); 659 660 return (set_error(lbh, err)); 661 } 662 663 static int 664 be_deep_clone_prop(int prop, void *cb) 665 { 666 int err; 667 struct libbe_dccb *dccb; 668 zprop_source_t src; 669 char pval[BE_MAXPATHLEN]; 670 char source[BE_MAXPATHLEN]; 671 char *val; 672 673 dccb = cb; 674 /* Skip some properties we don't want to touch */ 675 if (prop == ZFS_PROP_CANMOUNT) 676 return (ZPROP_CONT); 677 678 /* Don't copy readonly properties */ 679 if (zfs_prop_readonly(prop)) 680 return (ZPROP_CONT); 681 682 if ((err = zfs_prop_get(dccb->zhp, prop, (char *)&pval, 683 sizeof(pval), &src, (char *)&source, sizeof(source), false))) 684 /* Just continue if we fail to read a property */ 685 return (ZPROP_CONT); 686 687 /* 688 * Only copy locally defined or received properties. This continues 689 * to avoid temporary/default/local properties intentionally without 690 * breaking received datasets. 691 */ 692 if (src != ZPROP_SRC_LOCAL && src != ZPROP_SRC_RECEIVED) 693 return (ZPROP_CONT); 694 695 /* Augment mountpoint with altroot, if needed */ 696 val = pval; 697 if (prop == ZFS_PROP_MOUNTPOINT) 698 val = be_mountpoint_augmented(dccb->lbh, val); 699 700 nvlist_add_string(dccb->props, zfs_prop_to_name(prop), val); 701 702 return (ZPROP_CONT); 703 } 704 705 /* 706 * Return the corresponding boot environment path for a given 707 * dataset path, the constructed path is placed in 'result'. 708 * 709 * example: say our new boot environment name is 'bootenv' and 710 * the dataset path is 'zroot/ROOT/default/data/set'. 711 * 712 * result should produce: 'zroot/ROOT/bootenv/data/set' 713 */ 714 static int 715 be_get_path(struct libbe_deep_clone *ldc, const char *dspath, char *result, int result_size) 716 { 717 char *pos; 718 char *child_dataset; 719 720 /* match the root path for the boot environments */ 721 pos = strstr(dspath, ldc->lbh->root); 722 723 /* no match, different pools? */ 724 if (pos == NULL) 725 return (BE_ERR_BADPATH); 726 727 /* root path of the new boot environment */ 728 snprintf(result, result_size, "%s/%s", ldc->lbh->root, ldc->bename); 729 730 /* gets us to the parent dataset, the +1 consumes a trailing slash */ 731 pos += strlen(ldc->lbh->root) + 1; 732 733 /* skip the parent dataset */ 734 if ((child_dataset = strchr(pos, '/')) != NULL) 735 strlcat(result, child_dataset, result_size); 736 737 return (BE_ERR_SUCCESS); 738 } 739 740 static int 741 be_clone_cb(zfs_handle_t *ds, void *data) 742 { 743 int err; 744 char be_path[BE_MAXPATHLEN]; 745 char snap_path[BE_MAXPATHLEN]; 746 const char *dspath; 747 zfs_handle_t *snap_hdl; 748 nvlist_t *props; 749 struct libbe_deep_clone *ldc; 750 struct libbe_dccb dccb; 751 752 ldc = (struct libbe_deep_clone *)data; 753 dspath = zfs_get_name(ds); 754 755 snprintf(snap_path, sizeof(snap_path), "%s@%s", dspath, ldc->snapname); 756 757 /* construct the boot environment path from the dataset we're cloning */ 758 if (be_get_path(ldc, dspath, be_path, sizeof(be_path)) != BE_ERR_SUCCESS) 759 return (BE_ERR_UNKNOWN); 760 761 /* the dataset to be created (i.e. the boot environment) already exists */ 762 if (zfs_dataset_exists(ldc->lbh->lzh, be_path, ZFS_TYPE_DATASET)) 763 return (BE_ERR_EXISTS); 764 765 /* no snapshot found for this dataset, silently skip it */ 766 if (!zfs_dataset_exists(ldc->lbh->lzh, snap_path, ZFS_TYPE_SNAPSHOT)) 767 return (0); 768 769 if ((snap_hdl = 770 zfs_open(ldc->lbh->lzh, snap_path, ZFS_TYPE_SNAPSHOT)) == NULL) 771 return (BE_ERR_ZFSOPEN); 772 773 nvlist_alloc(&props, NV_UNIQUE_NAME, KM_SLEEP); 774 nvlist_add_string(props, "canmount", "noauto"); 775 776 dccb.lbh = ldc->lbh; 777 dccb.zhp = ds; 778 dccb.props = props; 779 if (zprop_iter(be_deep_clone_prop, &dccb, B_FALSE, B_FALSE, 780 ZFS_TYPE_FILESYSTEM) == ZPROP_INVAL) 781 return (-1); 782 783 if ((err = zfs_clone(snap_hdl, be_path, props)) != 0) 784 return (BE_ERR_ZFSCLONE); 785 786 nvlist_free(props); 787 zfs_close(snap_hdl); 788 789 if (ldc->depth_limit == -1 || ldc->depth < ldc->depth_limit) { 790 ldc->depth++; 791 err = zfs_iter_filesystems(ds, be_clone_cb, ldc); 792 ldc->depth--; 793 } 794 795 return (err); 796 } 797 798 /* 799 * Create a boot environment with a given name from a given snapshot. 800 * Snapshots can be in the format 'zroot/ROOT/default@snapshot' or 801 * 'default@snapshot'. In the latter case, 'default@snapshot' will be prepended 802 * with the root path that libbe was initailized with. 803 */ 804 static int 805 be_clone(libbe_handle_t *lbh, const char *bename, const char *snapshot, int depth) 806 { 807 int err; 808 char snap_path[BE_MAXPATHLEN]; 809 char *parentname, *snapname; 810 zfs_handle_t *parent_hdl; 811 struct libbe_deep_clone ldc; 812 813 /* ensure the boot environment name is valid */ 814 if ((err = be_validate_name(lbh, bename)) != 0) 815 return (set_error(lbh, err)); 816 817 /* 818 * prepend the boot environment root path if we're 819 * given a partial snapshot name. 820 */ 821 if ((err = be_root_concat(lbh, snapshot, snap_path)) != 0) 822 return (set_error(lbh, err)); 823 824 /* ensure the snapshot exists */ 825 if ((err = be_validate_snap(lbh, snap_path)) != 0) 826 return (set_error(lbh, err)); 827 828 /* get a copy of the snapshot path so we can disect it */ 829 if ((parentname = strdup(snap_path)) == NULL) 830 return (set_error(lbh, BE_ERR_UNKNOWN)); 831 832 /* split dataset name from snapshot name */ 833 snapname = strchr(parentname, '@'); 834 if (snapname == NULL) { 835 free(parentname); 836 return (set_error(lbh, BE_ERR_UNKNOWN)); 837 } 838 *snapname = '\0'; 839 snapname++; 840 841 /* set-up the boot environment */ 842 ldc.lbh = lbh; 843 ldc.bename = bename; 844 ldc.snapname = snapname; 845 ldc.depth = 0; 846 ldc.depth_limit = depth; 847 848 /* the boot environment will be cloned from this dataset */ 849 parent_hdl = zfs_open(lbh->lzh, parentname, ZFS_TYPE_DATASET); 850 851 /* create the boot environment */ 852 err = be_clone_cb(parent_hdl, &ldc); 853 854 free(parentname); 855 return (set_error(lbh, err)); 856 } 857 858 /* 859 * Create a boot environment from pre-existing snapshot, specifying a depth. 860 */ 861 int be_create_depth(libbe_handle_t *lbh, const char *bename, 862 const char *snap, int depth) 863 { 864 return (be_clone(lbh, bename, snap, depth)); 865 } 866 867 /* 868 * Create the boot environment from pre-existing snapshot 869 */ 870 int 871 be_create_from_existing_snap(libbe_handle_t *lbh, const char *bename, 872 const char *snap) 873 { 874 return (be_clone(lbh, bename, snap, -1)); 875 } 876 877 878 /* 879 * Create a boot environment from an existing boot environment 880 */ 881 int 882 be_create_from_existing(libbe_handle_t *lbh, const char *bename, const char *old) 883 { 884 int err; 885 char snap[BE_MAXPATHLEN]; 886 887 if ((err = be_snapshot(lbh, old, NULL, true, snap)) != 0) 888 return (set_error(lbh, err)); 889 890 err = be_clone(lbh, bename, snap, -1); 891 892 return (set_error(lbh, err)); 893 } 894 895 896 /* 897 * Verifies that a snapshot has a valid name, exists, and has a mountpoint of 898 * '/'. Returns BE_ERR_SUCCESS (0), upon success, or the relevant BE_ERR_* upon 899 * failure. Does not set the internal library error state. 900 */ 901 int 902 be_validate_snap(libbe_handle_t *lbh, const char *snap_name) 903 { 904 905 if (strlen(snap_name) >= BE_MAXPATHLEN) 906 return (BE_ERR_PATHLEN); 907 908 if (!zfs_name_valid(snap_name, ZFS_TYPE_SNAPSHOT)) 909 return (BE_ERR_INVALIDNAME); 910 911 if (!zfs_dataset_exists(lbh->lzh, snap_name, 912 ZFS_TYPE_SNAPSHOT)) 913 return (BE_ERR_NOENT); 914 915 return (BE_ERR_SUCCESS); 916 } 917 918 919 /* 920 * Idempotently appends the name argument to the root boot environment path 921 * and copies the resulting string into the result buffer (which is assumed 922 * to be at least BE_MAXPATHLEN characters long. Returns BE_ERR_SUCCESS upon 923 * success, BE_ERR_PATHLEN if the resulting path is longer than BE_MAXPATHLEN, 924 * or BE_ERR_INVALIDNAME if the name is a path that does not begin with 925 * zfs_be_root. Does not set internal library error state. 926 */ 927 int 928 be_root_concat(libbe_handle_t *lbh, const char *name, char *result) 929 { 930 size_t name_len, root_len; 931 932 name_len = strlen(name); 933 root_len = strlen(lbh->root); 934 935 /* Act idempotently; return be name if it is already a full path */ 936 if (strrchr(name, '/') != NULL) { 937 if (strstr(name, lbh->root) != name) 938 return (BE_ERR_INVALIDNAME); 939 940 if (name_len >= BE_MAXPATHLEN) 941 return (BE_ERR_PATHLEN); 942 943 strlcpy(result, name, BE_MAXPATHLEN); 944 return (BE_ERR_SUCCESS); 945 } else if (name_len + root_len + 1 < BE_MAXPATHLEN) { 946 snprintf(result, BE_MAXPATHLEN, "%s/%s", lbh->root, 947 name); 948 return (BE_ERR_SUCCESS); 949 } 950 951 return (BE_ERR_PATHLEN); 952 } 953 954 955 /* 956 * Verifies the validity of a boot environment name (A-Za-z0-9-_.). Returns 957 * BE_ERR_SUCCESS (0) if name is valid, otherwise returns BE_ERR_INVALIDNAME 958 * or BE_ERR_PATHLEN. 959 * Does not set internal library error state. 960 */ 961 int 962 be_validate_name(libbe_handle_t *lbh, const char *name) 963 { 964 965 /* 966 * Impose the additional restriction that the entire dataset name must 967 * not exceed the maximum length of a dataset, i.e. MAXNAMELEN. 968 */ 969 if (strlen(lbh->root) + 1 + strlen(name) > MAXNAMELEN) 970 return (BE_ERR_PATHLEN); 971 972 if (!zfs_name_valid(name, ZFS_TYPE_DATASET)) 973 return (BE_ERR_INVALIDNAME); 974 975 /* 976 * ZFS allows spaces in boot environment names, but the kernel can't 977 * handle booting from such a dataset right now. vfs.root.mountfrom 978 * is defined to be a space-separated list, and there's no protocol for 979 * escaping whitespace in the path component of a dev:path spec. So 980 * while loader can handle this situation alright, it can't safely pass 981 * it on to mountroot. 982 */ 983 if (strchr(name, ' ') != NULL) 984 return (BE_ERR_INVALIDNAME); 985 986 return (BE_ERR_SUCCESS); 987 } 988 989 990 /* 991 * usage 992 */ 993 int 994 be_rename(libbe_handle_t *lbh, const char *old, const char *new) 995 { 996 char full_old[BE_MAXPATHLEN]; 997 char full_new[BE_MAXPATHLEN]; 998 zfs_handle_t *zfs_hdl; 999 int err; 1000 1001 /* 1002 * be_validate_name is documented not to set error state, so we should 1003 * do so here. 1004 */ 1005 if ((err = be_validate_name(lbh, new)) != 0) 1006 return (set_error(lbh, err)); 1007 if ((err = be_root_concat(lbh, old, full_old)) != 0) 1008 return (set_error(lbh, err)); 1009 if ((err = be_root_concat(lbh, new, full_new)) != 0) 1010 return (set_error(lbh, err)); 1011 1012 if (!zfs_dataset_exists(lbh->lzh, full_old, ZFS_TYPE_DATASET)) 1013 return (set_error(lbh, BE_ERR_NOENT)); 1014 1015 if (zfs_dataset_exists(lbh->lzh, full_new, ZFS_TYPE_DATASET)) 1016 return (set_error(lbh, BE_ERR_EXISTS)); 1017 1018 if ((zfs_hdl = zfs_open(lbh->lzh, full_old, 1019 ZFS_TYPE_FILESYSTEM)) == NULL) 1020 return (set_error(lbh, BE_ERR_ZFSOPEN)); 1021 1022 /* recurse, nounmount, forceunmount */ 1023 struct renameflags flags = { 1024 .nounmount = 1, 1025 }; 1026 err = zfs_rename(zfs_hdl, full_new, flags); 1027 1028 zfs_close(zfs_hdl); 1029 if (err != 0) 1030 return (set_error(lbh, BE_ERR_UNKNOWN)); 1031 return (0); 1032 } 1033 1034 1035 int 1036 be_export(libbe_handle_t *lbh, const char *bootenv, int fd) 1037 { 1038 char snap_name[BE_MAXPATHLEN]; 1039 char buf[BE_MAXPATHLEN]; 1040 zfs_handle_t *zfs; 1041 sendflags_t flags = { 0 }; 1042 int err; 1043 1044 if ((err = be_snapshot(lbh, bootenv, NULL, true, snap_name)) != 0) 1045 /* Use the error set by be_snapshot */ 1046 return (err); 1047 1048 be_root_concat(lbh, snap_name, buf); 1049 1050 if ((zfs = zfs_open(lbh->lzh, buf, ZFS_TYPE_DATASET)) == NULL) 1051 return (set_error(lbh, BE_ERR_ZFSOPEN)); 1052 1053 err = zfs_send_one(zfs, NULL, fd, &flags, /* redactbook */ NULL); 1054 zfs_close(zfs); 1055 1056 return (err); 1057 } 1058 1059 1060 int 1061 be_import(libbe_handle_t *lbh, const char *bootenv, int fd) 1062 { 1063 char buf[BE_MAXPATHLEN]; 1064 nvlist_t *props; 1065 zfs_handle_t *zfs; 1066 recvflags_t flags = { .nomount = 1 }; 1067 int err; 1068 1069 be_root_concat(lbh, bootenv, buf); 1070 1071 if ((err = zfs_receive(lbh->lzh, buf, NULL, &flags, fd, NULL)) != 0) { 1072 switch (err) { 1073 case EINVAL: 1074 return (set_error(lbh, BE_ERR_NOORIGIN)); 1075 case ENOENT: 1076 return (set_error(lbh, BE_ERR_NOENT)); 1077 case EIO: 1078 return (set_error(lbh, BE_ERR_IO)); 1079 default: 1080 return (set_error(lbh, BE_ERR_UNKNOWN)); 1081 } 1082 } 1083 1084 if ((zfs = zfs_open(lbh->lzh, buf, ZFS_TYPE_FILESYSTEM)) == NULL) 1085 return (set_error(lbh, BE_ERR_ZFSOPEN)); 1086 1087 nvlist_alloc(&props, NV_UNIQUE_NAME, KM_SLEEP); 1088 nvlist_add_string(props, "canmount", "noauto"); 1089 nvlist_add_string(props, "mountpoint", "none"); 1090 1091 err = zfs_prop_set_list(zfs, props); 1092 nvlist_free(props); 1093 1094 zfs_close(zfs); 1095 1096 if (err != 0) 1097 return (set_error(lbh, BE_ERR_UNKNOWN)); 1098 1099 return (0); 1100 } 1101 1102 #if SOON 1103 static int 1104 be_create_child_noent(libbe_handle_t *lbh, const char *active, 1105 const char *child_path) 1106 { 1107 nvlist_t *props; 1108 zfs_handle_t *zfs; 1109 int err; 1110 1111 nvlist_alloc(&props, NV_UNIQUE_NAME, KM_SLEEP); 1112 nvlist_add_string(props, "canmount", "noauto"); 1113 nvlist_add_string(props, "mountpoint", child_path); 1114 1115 /* Create */ 1116 if ((err = zfs_create(lbh->lzh, active, ZFS_TYPE_DATASET, 1117 props)) != 0) { 1118 switch (err) { 1119 case EZFS_EXISTS: 1120 return (set_error(lbh, BE_ERR_EXISTS)); 1121 case EZFS_NOENT: 1122 return (set_error(lbh, BE_ERR_NOENT)); 1123 case EZFS_BADTYPE: 1124 case EZFS_BADVERSION: 1125 return (set_error(lbh, BE_ERR_NOPOOL)); 1126 case EZFS_BADPROP: 1127 default: 1128 /* We set something up wrong, probably... */ 1129 return (set_error(lbh, BE_ERR_UNKNOWN)); 1130 } 1131 } 1132 nvlist_free(props); 1133 1134 if ((zfs = zfs_open(lbh->lzh, active, ZFS_TYPE_DATASET)) == NULL) 1135 return (set_error(lbh, BE_ERR_ZFSOPEN)); 1136 1137 /* Set props */ 1138 if ((err = zfs_prop_set(zfs, "canmount", "noauto")) != 0) { 1139 zfs_close(zfs); 1140 /* 1141 * Similar to other cases, this shouldn't fail unless we've 1142 * done something wrong. This is a new dataset that shouldn't 1143 * have been mounted anywhere between creation and now. 1144 */ 1145 if (err == EZFS_NOMEM) 1146 return (set_error(lbh, BE_ERR_NOMEM)); 1147 return (set_error(lbh, BE_ERR_UNKNOWN)); 1148 } 1149 zfs_close(zfs); 1150 return (BE_ERR_SUCCESS); 1151 } 1152 1153 static int 1154 be_create_child_cloned(libbe_handle_t *lbh, const char *active) 1155 { 1156 char buf[BE_MAXPATHLEN], tmp[BE_MAXPATHLEN];; 1157 zfs_handle_t *zfs; 1158 int err; 1159 1160 /* XXX TODO ? */ 1161 1162 /* 1163 * Establish if the existing path is a zfs dataset or just 1164 * the subdirectory of one 1165 */ 1166 strlcpy(tmp, "tmp/be_snap.XXXXX", sizeof(tmp)); 1167 if (mktemp(tmp) == NULL) 1168 return (set_error(lbh, BE_ERR_UNKNOWN)); 1169 1170 be_root_concat(lbh, tmp, buf); 1171 printf("Here %s?\n", buf); 1172 if ((err = zfs_snapshot(lbh->lzh, buf, false, NULL)) != 0) { 1173 switch (err) { 1174 case EZFS_INVALIDNAME: 1175 return (set_error(lbh, BE_ERR_INVALIDNAME)); 1176 1177 default: 1178 /* 1179 * The other errors that zfs_ioc_snapshot might return 1180 * shouldn't happen if we've set things up properly, so 1181 * we'll gloss over them and call it UNKNOWN as it will 1182 * require further triage. 1183 */ 1184 if (errno == ENOTSUP) 1185 return (set_error(lbh, BE_ERR_NOPOOL)); 1186 return (set_error(lbh, BE_ERR_UNKNOWN)); 1187 } 1188 } 1189 1190 /* Clone */ 1191 if ((zfs = zfs_open(lbh->lzh, buf, ZFS_TYPE_SNAPSHOT)) == NULL) 1192 return (BE_ERR_ZFSOPEN); 1193 1194 if ((err = zfs_clone(zfs, active, NULL)) != 0) 1195 /* XXX TODO correct error */ 1196 return (set_error(lbh, BE_ERR_UNKNOWN)); 1197 1198 /* set props */ 1199 zfs_close(zfs); 1200 return (BE_ERR_SUCCESS); 1201 } 1202 1203 int 1204 be_add_child(libbe_handle_t *lbh, const char *child_path, bool cp_if_exists) 1205 { 1206 struct stat sb; 1207 char active[BE_MAXPATHLEN], buf[BE_MAXPATHLEN]; 1208 nvlist_t *props; 1209 const char *s; 1210 1211 /* Require absolute paths */ 1212 if (*child_path != '/') 1213 return (set_error(lbh, BE_ERR_BADPATH)); 1214 1215 strlcpy(active, be_active_path(lbh), BE_MAXPATHLEN); 1216 strcpy(buf, active); 1217 1218 /* Create non-mountable parent dataset(s) */ 1219 s = child_path; 1220 for (char *p; (p = strchr(s+1, '/')) != NULL; s = p) { 1221 size_t len = p - s; 1222 strncat(buf, s, len); 1223 1224 nvlist_alloc(&props, NV_UNIQUE_NAME, KM_SLEEP); 1225 nvlist_add_string(props, "canmount", "off"); 1226 nvlist_add_string(props, "mountpoint", "none"); 1227 zfs_create(lbh->lzh, buf, ZFS_TYPE_DATASET, props); 1228 nvlist_free(props); 1229 } 1230 1231 /* Path does not exist as a descendent of / yet */ 1232 if (strlcat(active, child_path, BE_MAXPATHLEN) >= BE_MAXPATHLEN) 1233 return (set_error(lbh, BE_ERR_PATHLEN)); 1234 1235 if (stat(child_path, &sb) != 0) { 1236 /* Verify that error is ENOENT */ 1237 if (errno != ENOENT) 1238 return (set_error(lbh, BE_ERR_UNKNOWN)); 1239 return (be_create_child_noent(lbh, active, child_path)); 1240 } else if (cp_if_exists) 1241 /* Path is already a descendent of / and should be copied */ 1242 return (be_create_child_cloned(lbh, active)); 1243 return (set_error(lbh, BE_ERR_EXISTS)); 1244 } 1245 #endif /* SOON */ 1246 1247 /* 1248 * Deactivate old BE dataset; currently just sets canmount=noauto or 1249 * resets boot once configuration. 1250 */ 1251 int 1252 be_deactivate(libbe_handle_t *lbh, const char *ds, bool temporary) 1253 { 1254 zfs_handle_t *zfs; 1255 1256 if (temporary) { 1257 return (lzbe_set_boot_device( 1258 zpool_get_name(lbh->active_phandle), lzbe_add, NULL)); 1259 } 1260 1261 if ((zfs = zfs_open(lbh->lzh, ds, ZFS_TYPE_DATASET)) == NULL) 1262 return (1); 1263 if (zfs_prop_set(zfs, "canmount", "noauto") != 0) 1264 return (1); 1265 zfs_close(zfs); 1266 return (0); 1267 } 1268 1269 static int 1270 be_zfs_promote_cb(zfs_handle_t *zhp, void *data) 1271 { 1272 char origin[BE_MAXPATHLEN]; 1273 bool *found_origin = (bool *)data; 1274 int err; 1275 1276 if (zfs_prop_get(zhp, ZFS_PROP_ORIGIN, origin, sizeof(origin), 1277 NULL, NULL, 0, true) == 0) { 1278 *found_origin = true; 1279 err = zfs_promote(zhp); 1280 if (err) 1281 return (err); 1282 } 1283 1284 return (zfs_iter_filesystems(zhp, be_zfs_promote_cb, data)); 1285 } 1286 1287 static int 1288 be_zfs_promote(zfs_handle_t *zhp, bool *found_origin) 1289 { 1290 *found_origin = false; 1291 return (be_zfs_promote_cb(zhp, (void *)found_origin)); 1292 } 1293 1294 int 1295 be_activate(libbe_handle_t *lbh, const char *bootenv, bool temporary) 1296 { 1297 char be_path[BE_MAXPATHLEN]; 1298 zfs_handle_t *zhp; 1299 int err; 1300 bool found_origin; 1301 1302 be_root_concat(lbh, bootenv, be_path); 1303 1304 /* Note: be_exists fails if mountpoint is not / */ 1305 if ((err = be_exists(lbh, be_path)) != 0) 1306 return (set_error(lbh, err)); 1307 1308 if (temporary) { 1309 return (lzbe_set_boot_device( 1310 zpool_get_name(lbh->active_phandle), lzbe_add, be_path)); 1311 } else { 1312 if (strncmp(lbh->bootfs, "-", 1) != 0 && 1313 be_deactivate(lbh, lbh->bootfs, false) != 0) 1314 return (-1); 1315 1316 /* Obtain bootenv zpool */ 1317 err = zpool_set_prop(lbh->active_phandle, "bootfs", be_path); 1318 if (err) 1319 return (-1); 1320 1321 for (;;) { 1322 zhp = zfs_open(lbh->lzh, be_path, ZFS_TYPE_FILESYSTEM); 1323 if (zhp == NULL) 1324 return (-1); 1325 1326 err = be_zfs_promote(zhp, &found_origin); 1327 1328 zfs_close(zhp); 1329 if (!found_origin) 1330 break; 1331 if (err) 1332 return (err); 1333 } 1334 1335 if (err) 1336 return (-1); 1337 } 1338 1339 return (BE_ERR_SUCCESS); 1340 } 1341