1#!/bin/ksh 2# 3# CDDL HEADER START 4# 5# The contents of this file are subject to the terms of the 6# Common Development and Distribution License (the "License"). 7# You may not use this file except in compliance with the License. 8# 9# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10# or http://www.opensolaris.org/os/licensing. 11# See the License for the specific language governing permissions 12# and limitations under the License. 13# 14# When distributing Covered Code, include this CDDL HEADER in each 15# file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16# If applicable, add the following below this CDDL HEADER, with the 17# fields enclosed by brackets "[]" replaced with your own identifying 18# information: Portions Copyright [yyyy] [name of copyright owner] 19# 20# CDDL HEADER END 21# 22# Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved. 23# Copyright 2014 Garrett D'Amore 24# 25# 26 27# This script provides a simple GUI for managing labeled zones. 28# It provides contextual menus which provide appropriate choices. 29# It must be run in the global zone as root. 30 31# These arguments are accepted, and will result in non-interactive 32# (text-only) mode: 33# 34# txzonemgr [-c | -d[f]] 35# 36# -c create default zones 37# -d destroy all zones; prompts for confirmation unless 38# the -f flag is also specified 39# -f force 40# 41 42# DISP - use GUI (otherwise use non-interactive mode) 43DISP=1 44# CREATEDEF - make default zones (non-interactive) 45CREATEDEF=0 46# DESTROYZONES - tear down all zones (non-interactive) 47DESTROYZONES=0 48# FORCE - force 49FORCE=0 50 51NSCD_PER_LABEL=0 52NSCD_INDICATOR=/var/tsol/doors/nscd_per_label 53if [ -f $NSCD_INDICATOR ] ; then 54 NSCD_PER_LABEL=1 55fi 56 57myname=$(basename $0) 58 59TXTMP=/tmp/txzonemgr 60TNRHTP=/etc/security/tsol/tnrhtp 61TNRHDB=/etc/security/tsol/tnrhdb 62TNZONECFG=/etc/security/tsol/tnzonecfg 63PUBZONE=public 64INTZONE=internal 65 66PATH=/usr/bin:/usr/sbin:/usr/lib export PATH 67title="Labeled Zone Manager 2.1" 68 69msg_defzones=$(gettext "Create default zones using default settings?") 70msg_confirmkill=$(gettext "OK to destroy all zones?") 71msg_continue=$(gettext "(exit to resume $(basename $0) when ready)") 72msg_getlabel=$(gettext "Select a label for the") 73msg_getremote=$(gettext "Select a remote host or network from the list below:") 74msg_getnet=$(gettext "Select a network configuration for the") 75msg_getzone=$(gettext "Select a zone from the list below: 76(select global for zone creation and shared settings)") 77msg_getcmd=$(gettext "Select a command from the list below:") 78msg_inuse=$(gettext "That label is already assigned\nto the") 79msg_getmin=$(gettext "Select the minimum network label for the") 80msg_getmax=$(gettext "Select the maximum network label for the") 81msg_badip=$(gettext " is not a valid IP address") 82 83 84process_options() 85{ 86 typeset opt optlist 87 88 optlist='cdf' 89 90 while getopts ":$optlist" opt 91 do 92 case $opt in 93 c) CREATEDEF=1 94 DISP=0 95 ;; 96 d) DESTROYZONES=1 97 DISP=0 98 ;; 99 f) FORCE=1 100 ;; 101 *) gettext "invalid option -$OPTARG\n" 102 usage 103 return 2 104 ;; 105 esac 106 done 107 108 if [ $CREATEDEF -eq 1 -a $DESTROYZONES -eq 1 ] ; then 109 gettext "cannot combine options -c and -d\n" 110 usage 111 return 2 112 fi 113 if [ $CREATEDEF -eq 1 -a $FORCE -eq 1 ] ; then 114 gettext "option -f not allowed with -c\n" 115 usage 116 return 2 117 fi 118 if [ $FORCE -eq 1 -a $CREATEDEF -eq 0 -a $DESTROYZONES -eq 0 ] ; then 119 gettext "option -f specified without any other options\n" 120 usage 121 return 2 122 fi 123 124 shift $((OPTIND - 1)) 125 if [ "x$1" != "x" ] ; then 126 usage 127 return 2 128 fi 129 130 return 0 131} 132 133usage() { 134 gettext "usage: $myname [-c | -d[f]]\n" 135} 136 137consoleCheck() { 138 if [ $zonename != global ] ; then 139 zconsole=$(pgrep -f "zlogin -C $zonename") 140 if [ $? != 0 ] ; then 141 console="Zone Console...\n" 142 fi 143 fi 144} 145 146labelCheck() { 147 hexlabel=$(grep "^$zonename:" $TNZONECFG|cut -d : -f2); 148 if [[ $hexlabel ]] ; then 149 label= 150 if [ $zonename = global ] ; then 151 template="admin_low" 152 addcipsohost="Add Multilevel Access to Remote Host...\n" 153 removecipsohost="Remove Multilevel Access to Remote Host...\n" 154 setmlps="Configure Multilevel Ports...\n" 155 else 156 template=${zonename}_unlab 157 addcipsohost= 158 removecipsohost= 159 setmlps= 160 161 net=$(zonecfg -z $zonename info net) 162 if [[ -n $net ]] ; then 163 setmlps="Configure Multilevel Ports...\n" 164 elif [ $zonestate = configured ] ; then 165 addnet="Configure Network Interfaces...\n" 166 fi 167 fi 168 addremotehost="Add Single-level Access to Remote Host...\n" 169 remotes=$(grep -v "^#" $TNRHDB|grep $template) 170 if [ $? = 0 ] ; then 171 removeremotehost="Remove Single-level Access to Remote Host...\n" 172 else 173 removeremotehost= 174 fi 175 else 176 label="Select Label...\n" 177 addremotehost= 178 removeremotehost= 179 addcipsohost= 180 removecipsohost= 181 setmlps= 182 fi 183} 184 185cloneCheck() { 186 set -A zonelist 187 integer clone_cnt=0 188 for p in $(zoneadm list -ip) ; do 189 z=$(echo "$p"|cut -d : -f2) 190 s=$(echo "$p"|cut -d : -f3) 191 if [ $z = $zonename ] ; then 192 continue 193 elif [ $s = "installed" ] ; then 194 zonelist[clone_cnt]=$z 195 clone_cnt+=1 196 fi 197 done 198 if [ $clone_cnt -gt 0 ] ; then 199 clone="Clone...\n"; \ 200 fi 201} 202 203relabelCheck() { 204 macstate=$(zonecfg -z $zonename info|grep win_mac_write) 205 if [[ -n $macstate ]] ; then 206 permitrelabel="Deny Relabeling\n" 207 else 208 permitrelabel="Permit Relabeling\n" 209 fi 210} 211 212autobootCheck() { 213 bootmode=$(zonecfg -z $zonename info autoboot) 214 if [[ $bootmode == 'autoboot: true' ]] ; then 215 autoboot="Set Manual Booting\n" 216 else 217 autoboot="Set Automatic Booting\n" 218 fi 219} 220 221newZone() { 222 if [[ ! -n $zonename ]] ; then 223 zonename=$(zenity --entry \ 224 --title="$title" \ 225 --width=330 \ 226 --entry-text="" \ 227 --text="Enter Zone Name: ") 228 229 if [[ ! -n $zonename ]] ; then 230 zonename=global 231 return 232 fi 233 fi 234 zonecfg -z $zonename "create -t SUNWtsoldef;\ 235 set zonepath=/zone/$zonename" 236} 237 238removeZoneBEs() { 239 delopt=$* 240 241 zfs list -H $ZDSET/$zonename 1>/dev/null 2>&1 242 if [ $? = 0 ] ; then 243 for zbe in $(zfs list -rHo name $ZDSET/$zonename|grep ROOT/zbe) ; do 244 zfs destroy $delopt $zbe 245 done 246 fi 247} 248 249updateTemplate () { 250 if [ $hostType = cipso ] ; then 251 template=${zonename}_cipso 252 deflabel= 253 else 254 template=${zonename}_unlab 255 deflabel="def_label=${hexlabel};" 256 fi 257 258 tnzone=$(grep "^${template}:" $TNRHTP 2>/dev/null) 259 if [ $? -eq 0 ] ; then 260 sed -e "/^${template}/d" $TNRHTP > $TXTMP/tnrhtp.$$ 2>/dev/null 261 mv $TXTMP/tnrhtp.$$ $TNRHTP 262 fi 263 print "${template}:host_type=${hostType};doi=1;min_sl=${minlabel};max_sl=${maxlabel};$deflabel" >> $TNRHTP 264 tnctl -t $template 265} 266 267setTNdata () { 268 tnzline="$zonename:${hexlabel}:0::" 269 grep "^$tnzline" $TNZONECFG 1>/dev/null 2>&1 270 if [ $? -eq 1 ] ; then 271 print "$tnzline" >> $TNZONECFG 272 fi 273 274 # 275 # Add matching entries in tnrhtp if necessary 276 # 277 minlabel=admin_low 278 maxlabel=admin_high 279 hostType=cipso 280 updateTemplate 281 282 hostType=unlabeled 283 updateTemplate 284} 285 286selectLabel() { 287 hexlabel=$(tgnome-selectlabel \ 288 --title="$title" \ 289 --text="$msg_getlabel $zonename zone:" \ 290 --min="${DEFAULTLABEL}" \ 291 --default="${DEFAULTLABEL}" \ 292 --max=$(chk_encodings -X) \ 293 --accredcheck=yes \ 294 --mode=sensitivity \ 295 --format=internal) 296 if [ $? = 0 ] ; then 297 x=$(grep -i :{$hexlabel}: $TNZONECFG) 298 if [ $? = 0 ] ; then 299 z=$(print $x|cut -d : -f1) 300 x=$(zenity --error \ 301 --title="$title" \ 302 --text="$msg_inuse $z zone.") 303 else 304 setTNdata 305 fi 306 fi 307} 308 309getLabelRange() { 310 deflabel=$(hextoalabel $hexlabel) 311 minlabel=$(tgnome-selectlabel \ 312 --title="$title" \ 313 --text="$msg_getmin $zonename zone:" \ 314 --min="${DEFAULTLABEL}" \ 315 --max="$deflabel" \ 316 --default="$hexlabel" \ 317 --accredcheck=no \ 318 --mode=sensitivity \ 319 --format=internal) 320 [ $? != 0 ] && return 321 322 maxlabel=$(tgnome-selectlabel \ 323 --title="$title" \ 324 --text="$msg_getmax $zonename zone:" \ 325 --min="$deflabel" \ 326 --max=$(chk_encodings -X) \ 327 --default="$hexlabel" \ 328 --accredcheck=no \ 329 --mode=sensitivity \ 330 --format=internal) 331 [ $? != 0 ] && return 332 333 hostType=cipso 334 updateTemplate 335} 336 337 338encryptionValues() { 339 echo $(zfs get 2>&1 | grep encryption | sed -e s/^.*YES// -e s/\|//g) 340} 341 342getPassphrase() { 343 pass1=$(zenity --entry --title="$title" --text="Enter passphrase:" \ 344 --width=330 --hide-text) 345 pass2=$(zenity --entry --title="$title" --text="Re-enter passphrase:" \ 346 --width=330 --hide-text) 347 if [[ "$pass1" != "$pass2" ]]; then 348 zenity --error --title="$title" \ 349 --text="Passphrases do not match" 350 return "" 351 fi 352 file=$(mktemp) 353 echo "$pass1" > $file 354 echo "$file" 355} 356 357createZDSET() { 358 options=$1 359 pool=${2%%/*} 360 361 # First check if ZFS encrytption support is available 362 pversion=$(zpool list -H -o version $pool) 363 cversion=$(zpool upgrade -v | grep Crypto | awk '{ print $1 }') 364 if (( cversion == 0 || pversion < cversion )); then 365 zfs create $options $ZDSET 366 return 367 fi 368 369 encryption=$(zenity --list --title="$title" --height=320 \ 370 --text="Select cipher for encryption of all labels:" \ 371 --column="encryption" $(encryptionValues)) 372 373 if [[ $? != 0 || $encryption == "off" ]]; then 374 zfs create $options $ZDSET 375 return 376 fi 377 378 format=$(zenity --list --title="$title" \ 379 --text "Select encryption key source:" \ 380 --column="Key format and location" \ 381 "Passphrase" "Generate Key in file") 382 [ $? != 0 ] && exit 383 384 if [[ $format == "Passphrase" ]]; then 385 file=$(getPassphrase) 386 if [[ $file == "" ]]; then 387 exit 388 fi 389 keysource="passphrase,file://$file" 390 removefile=1; 391 elif [[ $format == "Generate Key in file" ]]; then 392 file=$(zenity --file-selection \ 393 --title="$title: Location of key file" \ 394 --save --confirm-overwrite) 395 [ $? != 0 ] && exit 396 if [[ $encryption == "on" ]]; then 397 keylen=128 398 else 399 t=${encryption#aes-} && keylen=${t%%-*} 400 fi 401 pktool genkey keystore=file keytype=aes \ 402 keylen=$keylen outkey=$file 403 keysource="raw,file:///$file" 404 fi 405 406 options="$options -o encryption=$encryption -o keysource=$keysource" 407 zfs create $options $ZDSET 408 if (( removefile == 1 )); then 409 zfs set keysource=passphrase,prompt $ZDSET 410 rm $file 411 fi 412} 413 414 415initialize() { 416 zonepath=$(zoneadm -z $zonename list -p|cut -d : -f4) 417 ZONE_ETC_DIR=$zonepath/root/etc 418 SYSIDCFG=${ZONE_ETC_DIR}/sysidcfg 419 420 if [ -f /var/ldap/ldap_client_file ] ; then 421 ldapaddress=$(ldapclient list | \ 422 grep "^NS_LDAP_SERVERS" | cut -d " " -f2) 423 print "name_service=LDAP {" > ${SYSIDCFG} 424 domain=$(domainname) 425 print "domain_name=$domain" >> ${SYSIDCFG} 426 profName=$(ldapclient list | \ 427 grep "^NS_LDAP_PROFILE" | cut -d " " -f2) 428 proxyPwd=$(ldapclient list | \ 429 grep "^NS_LDAP_BINDPASSWD" | cut -d " " -f2) 430 proxyDN=$(ldapclient list | \ 431 grep "^NS_LDAP_BINDDN" | cut -d " " -f 2) 432 if [ "$proxyDN" ] ; then 433 print "proxy_dn=\"$proxyDN\"" >> ${SYSIDCFG} 434 print "proxy_password=\"$proxyPwd\"" >> ${SYSIDCFG} 435 fi 436 print "profile=$profName" >> ${SYSIDCFG} 437 print "profile_server=$ldapaddress }" >> ${SYSIDCFG} 438 cp /etc/nsswitch.conf $ZONE_ETC_DIR/nsswitch.ldap 439 else 440 print "name_service=NONE" > ${SYSIDCFG} 441 fi 442 print "security_policy=NONE" >> ${SYSIDCFG} 443 locale=$(locale|grep LANG | cut -d "=" -f2) 444 if [[ -z $locale ]] ; then 445 locale="C" 446 fi 447 print "system_locale=$locale" >> ${SYSIDCFG} 448 timezone=$(grep "^TZ" /etc/default/init|cut -d "=" -f2) 449 print "timezone=$timezone" >> ${SYSIDCFG} 450 print "terminal=vt100" >> ${SYSIDCFG} 451 rootpwd=$(grep "^root:" /etc/shadow|cut -d : -f2) 452 453# There are two problems with setting the root password: 454# The zone's shadow file may be read-only 455# The password contains unparsable characters 456# so the following line is commented out until this is resolved. 457 458 #print "root_password=$rootpwd" >> ${SYSIDCFG} 459 print "nfs4_domain=dynamic" >> ${SYSIDCFG} 460 print "network_interface=PRIMARY {" >> ${SYSIDCFG} 461 462 net=$(zonecfg -z $zonename info net) 463 ipType=$(zonecfg -z $zonename info ip-type|cut -d" " -f2) 464 if [ $ipType = exclusive ] ; then 465 hostname=$(zenity --entry \ 466 --title="$title" \ 467 --width=330 \ 468 --text="${zonename}0: Enter Hostname or dhcp: ") 469 [ $? != 0 ] && return 470 471 if [ $hostname = dhcp ] ; then 472 print "dhcp" >> ${SYSIDCFG} 473 else 474 print "hostname=$hostname" >> ${SYSIDCFG} 475 ipaddr=$(getent hosts $hostname|cut -f1) 476 if [ $? != 0 ] ; then 477 ipaddr=$(zenity --entry \ 478 --title="$title" \ 479 --text="$nic: Enter IP address: " \ 480 --entry-text a.b.c.d) 481 [ $? != 0 ] && return 482 483 validateIPaddr 484 if [[ -z $ipaddr ]] ; then 485 return 486 fi 487 fi 488 print "ip_address=$ipaddr" >> ${SYSIDCFG} 489 getNetmask 490 print "netmask=$nm" >> ${SYSIDCFG} 491 print "default_route=none" >> ${SYSIDCFG} 492 template=${zonename}_cipso 493 cidr=32 494 updateTnrhdb 495 fi 496 elif [[ -n $net ]] ; then 497 hostname=$(hostname) 498 hostname=$(zenity --entry \ 499 --title="$title" \ 500 --width=330 \ 501 --text="Enter Hostname: " \ 502 --entry-text $hostname) 503 [ $? != 0 ] && return 504 505 print "hostname=$hostname" >> ${SYSIDCFG} 506 ipaddr=$(getent hosts $hostname|cut -f1) 507 if [ $? = 0 ] ; then 508 print "ip_address=$ipaddr" >> ${SYSIDCFG} 509 fi 510 else 511 getAllZoneNICs 512 for i in ${aznics[*]} ; do 513 ipaddr=$(ifconfig $i|grep inet|cut -d " " -f2) 514 done 515 print "hostname=$(hostname)" >> ${SYSIDCFG} 516 print "ip_address=$ipaddr" >> ${SYSIDCFG} 517 fi 518 519 print "protocol_ipv6=no }" >> ${SYSIDCFG} 520 cp /etc/default/nfs ${ZONE_ETC_DIR}/default/nfs 521 touch ${ZONE_ETC_DIR}/.NFS4inst_state.domain 522} 523 524clone() { 525 image=$1 526 if [[ -z $image ]] ; then 527 msg_clone=$(gettext "Clone the $zonename zone using a 528snapshot of one of the following halted zones:") 529 image=$(zenity --list \ 530 --title="$title" \ 531 --text="$msg_clone" \ 532 --height=300 \ 533 --width=330 \ 534 --column="Installed Zones" ${zonelist[*]}) 535 fi 536 537 if [[ -n $image ]] ; then 538 removeZoneBEs 539 zoneadm -z $zonename clone $image 540 541 if [ $NSCD_PER_LABEL = 0 ] ; then 542 sharePasswd $zonename 543 else 544 unsharePasswd $zonename 545 fi 546 547 ipType=$(zonecfg -z $zonename info ip-type|cut -d" " -f2) 548 if [ $ipType = exclusive ] ; then 549 zoneadm -z $zonename ready 550 zonepath=$(zoneadm -z $zonename list -p|cut -d : -f4) 551 sys-unconfig -R $zonepath/root 2>/dev/null 552 initialize 553 zoneadm -z $zonename halt 554 fi 555 fi 556} 557 558install() { 559 removeZoneBEs 560 if [ $DISP -eq 0 ] ; then 561 gettext "installing zone $zonename ...\n" 562 zoneadm -z $zonename install 563 else 564 # sleep is needed here to avoid occasional timing 565 # problem with gnome-terminal display... 566 sleep 2 567 gnome-terminal \ 568 --title="$title: Installing $zonename zone" \ 569 --command "zoneadm -z $zonename install" \ 570 --disable-factory \ 571 --hide-menubar 572 fi 573 574 zonestate=$(zoneadm -z $zonename list -p | cut -d : -f 3) 575 if [ $zonestate != installed ] ; then 576 gettext "error installing zone $zonename.\n" 577 return 1 578 fi 579 580 if [ $NSCD_PER_LABEL = 0 ] ; then 581 sharePasswd $zonename 582 else 583 unsharePasswd $zonename 584 fi 585 586 zoneadm -z $zonename ready 587 zonestate=$(zoneadm -z $zonename list -p | cut -d : -f 3) 588 if [ $zonestate != ready ] ; then 589 gettext "error making zone $zonename ready.\n" 590 return 1 591 fi 592 593 initialize 594 zoneadm -z $zonename halt 595} 596 597delete() { 598 delopt=$* 599 600 # if there is an entry for this zone in tnzonecfg, remove it 601 # before deleting the zone. 602 603 tnzone=$(grep "^$zonename:" $TNZONECFG 2>/dev/null) 604 if [ -n "${tnzone}" ] ; then 605 sed -e "/^$zonename:/d" $TNZONECFG > \ 606 $TXTMP/tnzonefg.$$ 2>/dev/null 607 mv $TXTMP/tnzonefg.$$ $TNZONECFG 608 fi 609 610 for tnzone in $(grep ":${zonename}_unlab" $TNRHDB 2>/dev/null) ; do 611 tnctl -dh "$tnzone" 612 sed -e "/:${zonename}_unlab/d" $TNRHDB > \ 613 $TXTMP/tnrhdb.$$ 2>/dev/null 614 mv $TXTMP/tnrhdb.$$ $TNRHDB 615 done 616 617 for tnzone in $(grep "^${zonename}_unlab:" $TNRHTP 2>/dev/null) ; do 618 tnctl -dt ${zonename}_unlab 619 sed -e "/^${zonename}_unlab:/d" $TNRHTP > \ 620 $TXTMP/tnrhtp.$$ 2>/dev/null 621 mv $TXTMP/tnrhtp.$$ $TNRHTP 622 done 623 624 for tnzone in $(grep ":${zonename}_cipso" $TNRHDB 2>/dev/null) ; do 625 tnctl -dh "$tnzone" 626 sed -e "/:${zonename}_cipso/d" $TNRHDB > \ 627 $TXTMP/tnrhdb.$$ 2>/dev/null 628 mv $TXTMP/tnrhdb.$$ $TNRHDB 629 done 630 631 for tnzone in $(grep "^${zonename}_cipso:" $TNRHTP 2>/dev/null) ; do 632 tnctl -dt ${zonename}_cipso 633 sed -e "/^${zonename}_cipso:/d" $TNRHTP > \ 634 $TXTMP/tnrhtp.$$ 2>/dev/null 635 mv $TXTMP/tnrhtp.$$ $TNRHTP 636 done 637 638 zonecfg -z $zonename delete -F 639 640 removeZoneBEs $delopt 641 for snap in $(zfs list -Ho name -t snapshot|grep "\@${zonename}_snap") ; do 642 zfs destroy -R $snap 643 done 644} 645 646validateIPaddr () { 647 OLDIFS=$IFS 648 IFS=. 649 integer octet_cnt=0 650 integer dummy 651 set -A octets $ipaddr 652 IFS=$OLDIFS 653 if [ ${#octets[*]} == 4 ] ; then 654 while (( octet_cnt < ${#octets[*]} )); do 655 dummy=${octets[octet_cnt]} 656 if [ $dummy = ${octets[octet_cnt]} ] ; then 657 if (( dummy >= 0 && \ 658 dummy < 256 )) ; then 659 octet_cnt+=1 660 continue 661 fi 662 else 663 x=$(zenity --error \ 664 --title="$title" \ 665 --text="$ipaddr $msg_badip") 666 ipaddr= 667 return 668 fi 669 done 670 else 671 x=$(zenity --error \ 672 --title="$title" \ 673 --text="$ipaddr $msg_badip") 674 ipaddr= 675 fi 676} 677 678getAllZoneNICs(){ 679 integer count=0 680 for i in $(ifconfig -a4|grep "^[a-z].*:") 681 do 682 print "$i" |grep "^[a-z].*:" >/dev/null 2>&1 683 [ $? -eq 1 ] && continue 684 685 i=${i%:} # Remove colon after interface name 686 for j in $(ifconfig $i) 687 do 688 case $j in 689 all-zones) 690 aznics[count]=$i 691 count+=1 692 ;; 693 esac 694 done 695 done 696} 697 698getNetmask() { 699 cidr= 700 nm=$(zenity --entry \ 701 --title="$title" \ 702 --width=330 \ 703 --text="$ipaddr: Enter netmask: " \ 704 --entry-text 255.255.255.0) 705 [ $? != 0 ] && return; 706 707 cidr=$(perl -e 'use Socket; print unpack("%32b*",inet_aton($ARGV[0])), "\n";' $nm) 708} 709 710addNet() { 711 getIPaddr 712 if [[ -z $ipaddr ]] ; then 713 return; 714 fi 715 getNetmask 716 if [[ -z $cidr ]] ; then 717 return; 718 fi 719 zonecfg -z $zonename "add net; \ 720 set address=${ipaddr}/${cidr}; \ 721 set physical=$nic; \ 722 end" 723 template=${zonename}_cipso 724 cidr=32 725 updateTnrhdb 726} 727 728getAttrs() { 729 zone=global 730 type=ignore 731 for j in $(ifconfig $nic) 732 do 733 case $j in 734 inet) type=$j;; 735 zone) type=$j;; 736 all-zones) zone=all-zones;; 737 flags*) flags=$j;; 738 *) case $type in 739 inet) ipaddr=$j ;; 740 zone) zone=$j ;; 741 *) continue ;; 742 esac; 743 type=ignore;; 744 esac 745 done 746 if [[ $flags == ~(E).UP, ]] ; then 747 updown=Up 748 else 749 updown=Down 750 fi 751 if [[ $nic == ~(E).: ]] ; then 752 linktype=logical 753 else 754 vnic=$(dladm show-vnic -po link $nic 2>/dev/null) 755 if [[ -n $vnic ]] ; then 756 linktype=virtual 757 else 758 linktype=physical 759 fi 760 fi 761 if [ $ipaddr != 0.0.0.0 ] ; then 762 x=$(grep "^${ipaddr}[^0-9]" $TNRHDB) 763 if [ $? = 1 ] ; then 764 template=cipso 765 cidr=32 766 updateTnrhdb 767 else 768 template=$(print "$x"|cut -d : -f2) 769 fi 770 else 771 template="..." 772 ipaddr="..." 773 fi 774} 775deleteTnrhdbEntry() { 776 remote=$(grep "^${ipaddr}[^0-9]" $TNRHDB) 777 if [ $? = 0 ] ; then 778 ip=$(print $remote|cut -d "/" -f1) 779 if [[ $remote == ~(E)./ ]] ; then 780 pr=$(print $remote|cut -d "/" -f2) 781 remote="$ip\\/$pr" 782 fi 783 sed -e "/^${remote}/d" $TNRHDB > /tmp/tnrhdb.$$ 2>/dev/null 784 mv /tmp/tnrhdb.$$ $TNRHDB 785 fi 786} 787 788updateTnrhdb() { 789 deleteTnrhdbEntry 790 if [[ -n $cidr ]] ; then 791 print "${ipaddr}/$cidr:$template" >> $TNRHDB 792 tnctl -h ${ipaddr}/$cidr:$template 793 else 794 print "${ipaddr}:$template" >> $TNRHDB 795 tnctl -h ${ipaddr}:$template 796 fi 797} 798 799getIPaddr() { 800 hostname=$(zenity --entry \ 801 --title="$title" \ 802 --width=330 \ 803 --text="$nic: Enter Hostname: ") 804 805 [ $? != 0 ] && return 806 807 ipaddr=$(getent hosts $hostname|cut -f1) 808 if [[ -z $ipaddr ]] ; then 809 ipaddr=$(zenity --entry \ 810 --title="$title" \ 811 --text="$nic: Enter IP address: " \ 812 --entry-text a.b.c.d) 813 [ $? != 0 ] && return 814 validateIPaddr 815 fi 816 817} 818 819addHost() { 820 # Update hosts 821 if [[ -z $ipaddr ]] ; then 822 return; 823 fi 824 grep "^${ipaddr}[^0-9]" /etc/inet/hosts >/dev/null 825 if [ $? -eq 1 ] ; then 826 print "$ipaddr\t$hostname" >> /etc/inet/hosts 827 fi 828 829 template=cipso 830 cidr=32 831 updateTnrhdb 832 833 ifconfig $nic $ipaddr netmask + broadcast + 834 # 835 # TODO: better integration with nwam 836 # TODO: get/set netmask for IP address 837 # 838 print $hostname > /etc/hostname.$nic 839} 840 841createInterface() { 842 msg=$(ifconfig $nic addif 0.0.0.0) 843 $(zenity --info \ 844 --title="$title" \ 845 --text="$msg" ) 846 nic=$(print "$msg"|cut -d" " -f5) 847 848} 849 850createVNIC() { 851 if [ $zonename != global ] ; then 852 vnicname=${zonename}0 853 else 854 vnicname=$(zenity --entry \ 855 --title="$title" \ 856 --width=330 \ 857 --entry-text="" \ 858 --text="Enter VNIC Name: ") 859 860 if [[ ! -n $vnicname ]] ; then 861 return 862 fi 863 fi 864 x=$(dladm show-vnic|grep "^$vnicname " ) 865 if [[ ! -n $x ]] ; then 866 dladm create-vnic -l $nic $vnicname 867 fi 868 if [ $zonename = global ] ; then 869 ifconfig $vnicname plumb 870 else 871 zonecfg -z $zonename "add net; \ 872 set physical=$vnicname; \ 873 end" 874 fi 875 nic=$vnicname 876} 877 878shareInterface() { 879 # 880 # TODO: better integration with nwam 881 # 882 ifconfig $nic all-zones;\ 883 if_file=/etc/hostname.$nic 884 sed q | sed -e "s/$/ all-zones/" < $if_file >$TXTMP/txnetmgr.$$ 885 mv $TXTMP/txnetmgr.$$ $if_file 886} 887 888unshareInterface() { 889 # 890 # TODO: better integration with nwam 891 # 892 ifconfig $nic -zone;\ 893 if_file=/etc/hostname.$nic 894 sed q | sed -e "s/all-zones/ /" < $if_file >$TXTMP/txnetmgr.$$ 895 mv $TXTMP/txnetmgr.$$ $if_file 896} 897 898addTnrhdb() { 899 ipaddr=$(zenity --entry \ 900 --title="$title" \ 901 --width=330 \ 902 --text="Zone:$zonename. Enter IP address of remote host or network: " \ 903 --entry-text a.b.c.d) 904 [ $? != 0 ] && return 905 validateIPaddr 906 if [[ -z $ipaddr ]] ; then 907 return; 908 fi 909 if [ ${octets[3]} = 0 ] ; then 910 nic="$ipaddr" 911 getNetmask 912 if [[ -z $cidr ]] ; then 913 return; 914 fi 915 else 916 cidr=32 917 fi 918 print "${ipaddr}/$cidr:$template" > $TXTMP/tnrhdb_new.$$ 919 x=$(tnchkdb -h $TXTMP/tnrhdb_new.$$ 2>$TXTMP/syntax_error.$$) 920 if [ $? = 0 ] ; then 921 updateTnrhdb 922 else 923 syntax=$(cat $TXTMP/syntax_error.$$) 924 x=$(zenity --error \ 925 --title="$title" \ 926 --text="$syntax") 927 fi 928 rm $TXTMP/tnrhdb_new.$$ 929 rm $TXTMP/syntax_error.$$ 930} 931 932removeTnrhdb() { 933 while (( 1 )) do 934 remotes=$(grep "^[^#][0-9.]" $TNRHDB|grep ":$template"|cut -d : -f1-2|tr : " ") 935 if [ $template = cipso ] ; then 936 templateHeading="from All Zones": 937 else 938 templateHeading="from this Zone": 939 fi 940 if [[ -n $remotes ]] ; then 941 ipaddr=$(zenity --list \ 942 --title="$title" \ 943 --text="$msg_getremote" \ 944 --height=250 \ 945 --width=300 \ 946 --column="Remove Access to:" \ 947 --column="$templateHeading" \ 948 $remotes) 949 950 if [[ -n $ipaddr ]] ; then 951 deleteTnrhdbEntry 952 tnctl -dh ${ip}:$template 953 else 954 return 955 fi 956 else 957 return 958 fi 959 done 960} 961 962setMLPs() { 963 tnzone=$(grep "^$zonename:" $TNZONECFG 2>/dev/null) 964 zoneMLPs=:$(print "$tnzone"|cut -d : -f4) 965 sharedMLPs=:$(print "$tnzone"|cut -d : -f5) 966 attrs="Private Interfaces$zoneMLPs\nShared Interfaces$sharedMLPs" 967 ports=$(print "$attrs"|zenity --list \ 968 --title="$title" \ 969 --height=200 \ 970 --width=450 \ 971 --text="Zone: $zonename\nClick once to select, twice to edit.\nShift-click to select both rows." \ 972 --column="Multilevel Ports (example: 80-81/tcp;111/udp;)" \ 973 --editable \ 974 --multiple 975 ) 976 977 if [[ -z $ports ]] ; then 978 return 979 fi 980 981 # getopts needs another a blank and another dash 982 ports=--$(print "$ports"|sed 's/ //g'|sed 's/|/ --/g'|sed 's/Interfaces:/ :/g') 983 984 OPTIND=1 985 while getopts "z:(Private)s:(Shared)" opt $ports ; do 986 case $opt in 987 z) zoneMLPs=$OPTARG ;; 988 s) sharedMLPs=$OPTARG ;; 989 esac 990 done 991 992 sed -e "/^$zonename:*/d" $TNZONECFG > $TXTMP/tnzonecfg.$$ 2>/dev/null 993 tnzone=$(print "$tnzone"|cut -d : -f1-3) 994 echo "${tnzone}${zoneMLPs}${sharedMLPs}" >> $TXTMP/tnzonecfg.$$ 995 996 x=$(tnchkdb -z $TXTMP/tnzonecfg.$$ 2>$TXTMP/syntax_error.$$) 997 998 if [ $? = 0 ] ; then 999 mv $TXTMP/tnzonecfg.$$ $TNZONECFG 1000 zenity --info \ 1001 --title="$title" \ 1002 --text="Multilevel ports for the $zonename zone\nwill be interpreted on next reboot." 1003 if [ $zonename != global ] ; then 1004 getLabelRange 1005 fi 1006 else 1007 syntax=$(cat $TXTMP/syntax_error.$$) 1008 x=$(zenity --error \ 1009 --title="$title" \ 1010 --text="$syntax") 1011 rm $TXTMP/tnzonecfg.$$ 1012 fi 1013 rm $TXTMP/syntax_error.$$ 1014} 1015 1016enableAuthentication() { 1017 integer file_cnt=0 1018 1019 zonepath=$(zoneadm -z $1 list -p|cut -d : -f4) 1020 ZONE_ETC_DIR=$zonepath/root/etc 1021 1022 # If the zone's shadow file was previously read-only 1023 # there may be no root password entry for this zone. 1024 # If so, replace the root password entry with the global zone's. 1025 1026 entry=$(grep ^root:: $ZONE_ETC_DIR/shadow) 1027 if [ $? -eq 0 ] ; then 1028 grep ^root: /etc/shadow > $TXTMP/shadow.$$ 1029 sed -e "/^root::/d" $ZONE_ETC_DIR/shadow >> \ 1030 $TXTMP/shadow.$$ 2>/dev/null 1031 mv $TXTMP/shadow.$$ $ZONE_ETC_DIR/shadow 1032 chmod 400 $ZONE_ETC_DIR/shadow 1033 fi 1034 1035 if [ $LOGNAME = "root" ]; then 1036 return 1037 fi 1038 1039 file[0]="passwd" 1040 file[1]="shadow" 1041 file[2]="user_attr" 1042 # 1043 # Add the user who assumed the root role to each installed zone 1044 # 1045 while (( file_cnt < ${#file[*]} )); do 1046 exists=$(grep "^${LOGNAME}:" \ 1047 $ZONE_ETC_DIR/${file[file_cnt]} >/dev/null) 1048 if [ $? -ne 0 ] ; then 1049 entry=$(grep "^${LOGNAME}:" \ 1050 /etc/${file[file_cnt]}) 1051 if [ $? -eq 0 ] ; then 1052 print "$entry" >> \ 1053 $ZONE_ETC_DIR/${file[file_cnt]} 1054 fi 1055 fi 1056 file_cnt+=1 1057 done 1058 chmod 400 $ZONE_ETC_DIR/shadow 1059} 1060 1061unsharePasswd() { 1062 zonecfg -z $1 remove fs dir=/etc/passwd >/dev/null 2>&1 | grep -v such 1063 zonecfg -z $1 remove fs dir=/etc/shadow >/dev/null 2>&1 | grep -v such 1064 zoneadm -z $1 ready >/dev/null 2>&1 1065 if [ $? -eq 0 ] ; then 1066 enableAuthentication $1 1067 zoneadm -z $1 halt >/dev/null 2>&1 1068 else 1069 echo Skipping $1 1070 fi 1071} 1072 1073sharePasswd() { 1074 passwd=$(zonecfg -z $1 info|grep /etc/passwd) 1075 if [ $? -eq 1 ] ; then 1076 zonecfg -z $1 "add fs; \ 1077 set special=/etc/passwd; \ 1078 set dir=/etc/passwd; \ 1079 set type=lofs; \ 1080 add options ro; \ 1081 end; \ 1082 add fs; \ 1083 set special=/etc/shadow; \ 1084 set dir=/etc/shadow; \ 1085 set type=lofs; \ 1086 add options ro; \ 1087 end" 1088 fi 1089 zoneadm -z $1 halt >/dev/null 2>&1 1090} 1091 1092# This routine is a toggle -- if we find it configured for global nscd, 1093# change to nscd-per-label and vice-versa. 1094# 1095# The user was presented with only the choice to CHANGE the existing 1096# configuration. 1097 1098manageNscd() { 1099 if [ $NSCD_PER_LABEL -eq 0 ] ; then 1100 # this MUST be a regular file for svc-nscd to detect 1101 touch $NSCD_INDICATOR 1102 NSCD_OPT="Unconfigure per-zone name service" 1103 NSCD_PER_LABEL=1 1104 for i in $(zoneadm list -i | grep -v global) ; do 1105 zoneadm -z $i halt >/dev/null 2>&1 1106 unsharePasswd $i 1107 done 1108 else 1109 rm -f $NSCD_INDICATOR 1110 NSCD_OPT="Configure per-zone name service" 1111 NSCD_PER_LABEL=0 1112 for i in $(zoneadm list -i | grep -v global) ; do 1113 zoneadm -z $i halt >/dev/null 2>&1 1114 sharePasswd $i 1115 done 1116 fi 1117} 1118 1119manageZoneNets () { 1120 ncmds[0]="Only use all-zones interfaces" 1121 ncmds[1]="Add a logical interface" 1122 ncmds[2]="Add a virtual interface (VNIC)" 1123 1124 stacks[0]="Shared Stack" 1125 stacks[1]="Exclusive Stack" 1126 1127 getAllZoneNICs 1128 netOps[0]="1\n${ncmds[0]}\nShared Stack\n${aznics[*]}" 1129 1130 integer nic_cnt=0 1131 integer netOp_cnt=2 1132 1133 set -A nics $(dladm show-phys|grep -v LINK|cut -f1 -d " ") 1134 1135 while (( nic_cnt < ${#nics[*]} )); do 1136 netOps[netOp_cnt - 1]="\n$netOp_cnt\n${ncmds[1]}\n${stacks[0]}\n${nics[nic_cnt]}" 1137 netOp_cnt+=1 1138 netOps[netOp_cnt - 1]="\n$netOp_cnt\n${ncmds[2]}\n${stacks[1]}\n${nics[nic_cnt]}" 1139 netOp_cnt+=1 1140 nic_cnt+=1 1141 done 1142 1143 netOp=$(print "${netOps[*]}"|zenity --list \ 1144 --title="$title" \ 1145 --text="$msg_getnet $zonename zone:" \ 1146 --height=300 \ 1147 --width=500 \ 1148 --column="#" \ 1149 --column="Network Configuration " \ 1150 --column="IP Type" \ 1151 --column="Available Interfaces" \ 1152 --hide-column=1 1153 ) 1154 1155 # User picked cancel or no selection 1156 if [[ -z $netOp ]] ; then 1157 return 1158 fi 1159 1160 # All-zones is the default, so just return 1161 if [ $netOp = 1 ] ; then 1162 return 1163 fi 1164 1165 cmd=$(print "${netOps[$netOp - 1]}"|tr '\n' ';' |cut -d';' -f 3) 1166 nic=$(print "${netOps[$netOp - 1]}"|tr '\n' ';' |cut -d';' -f 5) 1167 case $cmd in 1168 ${ncmds[1]} ) 1169 addNet; 1170 ;; 1171 ${ncmds[2]} ) 1172 zonecfg -z $zonename set ip-type=exclusive 1173 createVNIC 1174 ;; 1175 esac 1176} 1177 1178manageInterface () { 1179 while (( 1 )) do 1180 getAttrs 1181 1182 # Clear list of commands 1183 1184 share= 1185 setipaddr= 1186 newlogical= 1187 newvnic= 1188 unplumb= 1189 bringup= 1190 bringdown= 1191 1192 if [ $updown = Down ] ; then 1193 bringup="Bring Up\n" 1194 else 1195 bringdown="Bring Down\n" 1196 fi 1197 1198 case $linktype in 1199 physical ) 1200 newlogical="Create Logical Interface...\n"; 1201 newvnic="Create Virtual Interface (VNIC)...\n"; 1202 ;; 1203 logical ) 1204 unplumb="Remove Logical Interface\n" 1205 ;; 1206 virtual ) 1207 newlogical="Create Logical Interface...\n"; 1208 unplumb="Remove Virtual Interface\n" ; 1209 ;; 1210 esac 1211 1212 if [ $ipaddr = "..." ] ; then 1213 setipaddr="Set IP address...\n" 1214 elif [ $zone != all-zones ] ; then 1215 share="Share with Shared-IP Zones\n" 1216 else 1217 share="Remove from Shared-IP Zones\n" 1218 fi 1219 1220 command=$(print ""\ 1221 $share \ 1222 $setipaddr \ 1223 $newlogical \ 1224 $newvnic \ 1225 $unplumb \ 1226 $bringup \ 1227 $bringdown \ 1228 | zenity --list \ 1229 --title="$title" \ 1230 --text="Select a command from the list below:" \ 1231 --height=300 \ 1232 --column "Interface: $nic" ) 1233 1234 case $command in 1235 " Create Logical Interface...") 1236 createInterface;; 1237 " Create Virtual Interface (VNIC)...") 1238 createVNIC ;; 1239 " Set IP address...") 1240 getIPaddr 1241 addHost;; 1242 " Share with Shared-IP Zones") 1243 shareInterface;; 1244 " Remove from Shared-IP Zones") 1245 unshareInterface;; 1246 " Remove Logical Interface") 1247 ifconfig $nic unplumb 1248 rm -f /etc/hostname.$nic 1249 return;; 1250 " Remove Virtual Interface") 1251 ifconfig $nic unplumb 1252 dladm delete-vnic $nic 1253 rm -f /etc/hostname.$nic 1254 return;; 1255 " Bring Up") 1256 ifconfig $nic up;; 1257 " Bring Down") 1258 ifconfig $nic down;; 1259 *) return;; 1260 esac 1261 done 1262} 1263 1264sharePrimaryNic() { 1265 set -A ip $(getent hosts $(cat /etc/nodename)) 1266 for i in $(ifconfig -au4|grep "^[a-z].*:" |grep -v LOOPBACK) 1267 do 1268 print "$i" |grep "^[a-z].*:" >/dev/null 2>&1 1269 [ $? -eq 1 ] && continue 1270 1271 nic=${i%:} # Remove colon after interface name 1272 getAttrs 1273 if [ ${ip[0]} = $ipaddr ]; then 1274 shareInterface 1275 break 1276 fi 1277 done 1278} 1279 1280manageNets() { 1281 while (( 1 )) do 1282 attrs= 1283 for i in $(ifconfig -a4|grep "^[a-z].*:" |grep -v LOOPBACK) 1284 do 1285 print "$i" |grep "^[a-z].*:" >/dev/null 2>&1 1286 [ $? -eq 1 ] && continue 1287 1288 nic=${i%:} # Remove colon after interface name 1289 getAttrs 1290 attrs="$nic $linktype $zone $ipaddr $template $updown $attrs" 1291 done 1292 1293 nic=$(zenity --list \ 1294 --title="$title" \ 1295 --text="Select an interface from the list below:" \ 1296 --height=300 \ 1297 --width=500 \ 1298 --column="Interface" \ 1299 --column="Type" \ 1300 --column="Zone Name" \ 1301 --column="IP Address" \ 1302 --column="Template" \ 1303 --column="State" \ 1304 $attrs) 1305 1306 if [[ -z $nic ]] ; then 1307 return 1308 fi 1309 manageInterface 1310 done 1311} 1312 1313createLDAPclient() { 1314 ldaptitle="$title: Create LDAP Client" 1315 ldapdomain=$(zenity --entry \ 1316 --width=400 \ 1317 --title="$ldaptitle" \ 1318 --text="Enter Domain Name: ") 1319 if [[ -n $ldapdomain ]] ; then 1320 ldapserver=$(zenity --entry \ 1321 --width=400 \ 1322 --title="$ldaptitle" \ 1323 --text="Enter Hostname of LDAP Server: ") 1324 else 1325 return 1326 fi 1327 if [[ -n $ldapserver ]] ; then 1328 ldapserveraddr=$(zenity --entry \ 1329 --width=400 \ 1330 --title="$ldaptitle" \ 1331 --text="Enter IP adddress of LDAP Server $ldapserver: ") 1332 else 1333 return 1334 fi 1335 ldappassword="" 1336 while [[ -z ${ldappassword} || "x$ldappassword" != "x$ldappasswordconfirm" ]] ; do 1337 ldappassword=$(zenity --entry \ 1338 --width=400 \ 1339 --title="$ldaptitle" \ 1340 --hide-text \ 1341 --text="Enter LDAP Proxy Password:") 1342 ldappasswordconfirm=$(zenity --entry \ 1343 --width=400 \ 1344 --title="$ldaptitle" \ 1345 --hide-text \ 1346 --text="Confirm LDAP Proxy Password:") 1347 done 1348 ldapprofile=$(zenity --entry \ 1349 --width=400 \ 1350 --title="$ldaptitle" \ 1351 --text="Enter LDAP Profile Name: ") 1352 whatnext=$(zenity --list \ 1353 --width=400 \ 1354 --height=250 \ 1355 --title="$ldaptitle" \ 1356 --text="Proceed to create LDAP Client?" \ 1357 --column=Parameter --column=Value \ 1358 "Domain Name" "$ldapdomain" \ 1359 "Hostname" "$ldapserver" \ 1360 "IP Address" "$ldapserveraddr" \ 1361 "Password" "$(print "$ldappassword" | sed 's/./*/g')" \ 1362 "Profile" "$ldapprofile") 1363 [ $? != 0 ] && return 1364 1365 grep "^${ldapserveraddr}[^0-9]" /etc/hosts > /dev/null 1366 if [ $? -eq 1 ] ; then 1367 print "$ldapserveraddr $ldapserver" >> /etc/hosts 1368 fi 1369 1370 grep "${ldapserver}:" $TNRHDB > /dev/null 1371 if [ $? -eq 1 ] ; then 1372 print "# ${ldapserver} - ldap server" \ 1373 >> $TNRHDB 1374 print "${ldapserveraddr}:cipso" \ 1375 >> $TNRHDB 1376 tnctl -h "${ldapserveraddr}:cipso" 1377 fi 1378 1379 proxyDN=$(print $ldapdomain|awk -F"." \ 1380 "{ ORS = \"\" } { for (i = 1; i < NF; i++) print \"dc=\"\\\$i\",\" }{ print \"dc=\"\\\$NF }") 1381 1382 zenity --info \ 1383 --title="$ldaptitle" \ 1384 --width=500 \ 1385 --text="global zone will be LDAP client of $ldapserver" 1386 1387 ldapout=$TXTMP/ldapclient.$$ 1388 1389 ldapclient init -a profileName="$ldapprofile" \ 1390 -a domainName="$ldapdomain" \ 1391 -a proxyDN"=cn=proxyagent,ou=profile,$proxyDN" \ 1392 -a proxyPassword="$ldappassword" \ 1393 "$ldapserveraddr" >$ldapout 2>&1 1394 1395 if [ $? -eq 0 ] ; then 1396 ldapstatus=Success 1397 else 1398 ldapstatus=Error 1399 fi 1400 1401 zenity --text-info \ 1402 --width=700 \ 1403 --height=300 \ 1404 --title="$ldaptitle: $ldapstatus" \ 1405 --filename=$ldapout 1406 1407 rm -f $ldapout 1408 1409 1410} 1411 1412tearDownZones() { 1413 if [ $DISP -eq 0 ] ; then 1414 if [ $FORCE -eq 0 ] ; then 1415 gettext "OK to destroy all zones [y|N]? " 1416 read ans 1417 printf "%s\n" "$ans" \ 1418 | /usr/bin/grep -Eq "$(locale yesexpr)" 1419 if [ $? -ne 0 ] ; then 1420 gettext "canceled.\n" 1421 return 1 1422 fi 1423 fi 1424 gettext "destroying all zones ...\n" 1425 else 1426 killall=$(zenity --question \ 1427 --title="$title" \ 1428 --width=330 \ 1429 --text="$msg_confirmkill") 1430 if [[ $? != 0 ]]; then 1431 return 1432 fi 1433 fi 1434 1435 for p in $(zoneadm list -cp|grep -v global:) ; do 1436 zonename=$(echo "$p"|cut -d : -f2) 1437 if [ $DISP -eq 0 ] ; then 1438 gettext "destroying zone $zonename ...\n" 1439 fi 1440 zoneadm -z $zonename halt 1>/dev/null 2>&1 1441 zoneadm -z $zonename uninstall -F 1>/dev/null 2>&1 1442 delete -rRf 1443 done 1444 zonename=global 1445} 1446 1447createDefaultZones() { 1448 # If GUI display is not used, skip the dialog 1449 if [ $DISP -eq 0 ] ; then 1450 createDefaultPublic 1451 if [ $? -ne 0 ] ; then 1452 return 1 1453 fi 1454 createDefaultInternal 1455 return 1456 fi 1457 1458 msg_choose1=$(gettext "Choose one:") 1459 defpub=$(gettext "$PUBZONE zone only") 1460 defboth=$(gettext "$PUBZONE and $INTZONE zones") 1461 defskip=$(gettext "Main Menu...") 1462 command=$(echo ""\ 1463 "$defpub\n" \ 1464 "$defboth\n" \ 1465 "$defskip\n" \ 1466 | zenity --list \ 1467 --title="$title" \ 1468 --text="$msg_defzones" \ 1469 --column="$msg_choose1" \ 1470 --height=400 \ 1471 --width=330 ) 1472 1473 case $command in 1474 " $defpub") 1475 createDefaultPublic ;; 1476 1477 " $defboth") 1478 createDefaultPublic 1479 if [ $? -ne 0 ] ; then 1480 return 1 1481 fi 1482 createDefaultInternal ;; 1483 1484 *) 1485 return;; 1486 esac 1487} 1488 1489createDefaultPublic() { 1490 zonename=$PUBZONE 1491 if [ $DISP -eq 0 ] ; then 1492 gettext "creating default $zonename zone ...\n" 1493 fi 1494 newZone 1495 zone_cnt+=1 1496 hexlabel=$DEFAULTLABEL 1497 setTNdata 1498 sharePrimaryNic 1499 1500 install 1501 if [ $? -ne 0 ] ; then 1502 return 1 1503 fi 1504 1505 if [ $DISP -eq 0 ] ; then 1506 gettext "booting zone $zonename ...\n" 1507 zoneadm -z $zonename boot 1508 else 1509 zoneadm -z $zonename boot & 1510 gnome-terminal \ 1511 --disable-factory \ 1512 --title="Zone Console: $zonename $msg_continue" \ 1513 --command "zlogin -C $zonename" 1514 fi 1515} 1516 1517createDefaultInternal() { 1518 zoneadm -z $PUBZONE halt 1519 1520 zonename=snapshot 1521 newZone 1522 zone_cnt+=1 1523 zonecfg -z $zonename set autoboot=false 1524 1525 clone $PUBZONE 1526 zoneadm -z $PUBZONE boot & 1527 1528 zonename=$INTZONE 1529 if [ $DISP -eq 0 ] ; then 1530 gettext "creating default $zonename zone ...\n" 1531 fi 1532 newZone 1533 zone_cnt+=1 1534 1535 hexlabel=$INTLABEL 1536 x=$(grep -i :{$hexlabel}: $TNZONECFG) 1537 if [ $? = 0 ] ; then 1538 z=$(print $x|cut -d : -f1) 1539 echo "$msg_inuse $z zone." 1540 else 1541 setTNdata 1542 fi 1543 1544 clone snapshot 1545 if [ $DISP -eq 0 ] ; then 1546 gettext "booting zone $zonename ...\n" 1547 else 1548 gnome-terminal \ 1549 --title="Zone Console: $zonename" \ 1550 --command "zlogin -C $zonename" & 1551 fi 1552 zoneadm -z $zonename boot & 1553} 1554 1555selectZone() { 1556 set -A zonelist "global\nrunning\nADMIN_HIGH" 1557 integer zone_cnt=1 1558 1559 for p in $(zoneadm list -cp|grep -v global:) ; do 1560 zone_cnt+=1 1561 done 1562 if [ $zone_cnt == 1 ] ; then 1563 createDefaultZones 1564 fi 1565 if [ $zone_cnt == 1 ] ; then 1566 zonename=global 1567 singleZone 1568 return 1569 fi 1570 1571 zone_cnt=1 1572 for p in $(zoneadm list -cp|grep -v global:) ; do 1573 zonename=$(echo "$p"|cut -d : -f2) 1574 state=$(echo "$p"|cut -d : -f3) 1575 hexlabel=$(grep "^$zonename:" $TNZONECFG|cut -d : -f2) 1576 if [[ $hexlabel ]] ; then 1577 curlabel=$(hextoalabel $hexlabel) 1578 else 1579 curlabel=... 1580 fi 1581 zonelist[zone_cnt]="\n$zonename\n$state\n$curlabel" 1582 zone_cnt+=1 1583 done 1584 zonename=$(print "${zonelist[*]}"|zenity --list \ 1585 --title="$title" \ 1586 --text="$msg_getzone" \ 1587 --height=300 \ 1588 --width=500 \ 1589 --column="Zone Name" \ 1590 --column="Status" \ 1591 --column="Sensitivity Label" \ 1592 ) 1593 1594 # if the menu choice was a zonename, pop up zone menu 1595 if [[ -n $zonename ]] ; then 1596 singleZone 1597 else 1598 exit 1599 fi 1600} 1601 1602# Loop for single-zone menu 1603singleZone() { 1604 1605 while (( 1 )) do 1606 # Clear list of commands 1607 1608 console= 1609 label= 1610 start= 1611 reboot= 1612 stop= 1613 clone= 1614 install= 1615 ready= 1616 uninstall= 1617 autoboot= 1618 delete= 1619 deletenet= 1620 permitrelabel= 1621 1622 if [ $zone_cnt -gt 1 ] ; then 1623 killZones="Destroy all zones...\n" 1624 xit="Select another zone..." 1625 else 1626 killZones= 1627 xit="Exit" 1628 fi 1629 if [ $zonename = global ] ; then 1630 ldapClient="Create LDAP Client...\n" 1631 nscdOpt="$NSCD_OPT\n" 1632 createZone="Create a new zone...\n" 1633 addnet="Configure Network Interfaces...\n" 1634 else 1635 ldapClient= 1636 nscdOpt= 1637 createZone= 1638 addnet= 1639 killZones= 1640 fi 1641 1642 zonestate=$(zoneadm -z $zonename list -p | cut -d : -f 3) 1643 1644 consoleCheck; 1645 labelCheck; 1646 delay=0 1647 1648 if [ $zonename != global ] ; then 1649 case $zonestate in 1650 running) 1651 ready="Ready\n" 1652 reboot="Reboot\n" 1653 stop="Halt\n" 1654 ;; 1655 ready) 1656 start="Boot\n" 1657 stop="Halt\n" 1658 ;; 1659 installed) 1660 if [[ -z $label ]] ; then 1661 ready="Ready\n" 1662 start="Boot\n" 1663 fi 1664 uninstall="Uninstall\n" 1665 relabelCheck 1666 autobootCheck 1667 ;; 1668 configured) 1669 install="Install...\n" 1670 cloneCheck 1671 delete="Delete\n" 1672 console= 1673 ;; 1674 incomplete) 1675 uninstall="Uninstall\n" 1676 ;; 1677 *) 1678 ;; 1679 esac 1680 fi 1681 1682 command=$(echo ""\ 1683 $createZone \ 1684 $console \ 1685 $label \ 1686 $start \ 1687 $reboot \ 1688 $stop \ 1689 $clone \ 1690 $install \ 1691 $ready \ 1692 $uninstall \ 1693 $delete \ 1694 $addnet \ 1695 $deletenet \ 1696 $addremotehost \ 1697 $addcipsohost \ 1698 $removeremotehost \ 1699 $removecipsohost \ 1700 $setmlps \ 1701 $permitrelabel \ 1702 $autoboot \ 1703 $ldapClient \ 1704 $nscdOpt \ 1705 $killZones \ 1706 $xit \ 1707 | zenity --list \ 1708 --title="$title" \ 1709 --text="$msg_getcmd" \ 1710 --height=400 \ 1711 --width=330 \ 1712 --column "Zone: $zonename Status: $zonestate" ) 1713 1714 case $command in 1715 " Create a new zone...") 1716 zonename= 1717 newZone ;; 1718 1719 " Zone Console...") 1720 delay=2 1721 gnome-terminal \ 1722 --title="Zone Console: $zonename" \ 1723 --command "zlogin -C $zonename" & ;; 1724 1725 " Select Label...") 1726 selectLabel;; 1727 1728 " Ready") 1729 zoneadm -z $zonename ready ;; 1730 1731 " Boot") 1732 zoneadm -z $zonename boot ;; 1733 1734 " Halt") 1735 zoneadm -z $zonename halt ;; 1736 1737 " Reboot") 1738 zoneadm -z $zonename reboot ;; 1739 1740 " Install...") 1741 install;; 1742 1743 " Clone...") 1744 clone ;; 1745 1746 " Uninstall") 1747 zoneadm -z $zonename uninstall -F;; 1748 1749 " Delete") 1750 delete 1751 return ;; 1752 1753 " Configure Network Interfaces...") 1754 if [ $zonename = global ] ; then 1755 manageNets 1756 else 1757 manageZoneNets 1758 fi;; 1759 1760 " Add Single-level Access to Remote Host...") 1761 addTnrhdb ;; 1762 1763 " Add Multilevel Access to Remote Host...") 1764 template=cipso 1765 addTnrhdb ;; 1766 1767 " Remove Single-level Access to Remote Host...") 1768 removeTnrhdb ;; 1769 1770 " Remove Multilevel Access to Remote Host...") 1771 template=cipso 1772 removeTnrhdb ;; 1773 1774 " Configure Multilevel Ports...") 1775 setMLPs;; 1776 1777 " Permit Relabeling") 1778 zonecfg -z $zonename set limitpriv=default,\ 1779win_mac_read,win_mac_write,win_selection,win_dac_read,win_dac_write,\ 1780file_downgrade_sl,file_upgrade_sl,sys_trans_label ;; 1781 1782 " Deny Relabeling") 1783 zonecfg -z $zonename set limitpriv=default ;; 1784 1785 " Set Automatic Booting") 1786 zonecfg -z $zonename set autoboot=true ;; 1787 1788 " Set Manual Booting") 1789 zonecfg -z $zonename set autoboot=false ;; 1790 1791 " Create LDAP Client...") 1792 createLDAPclient ;; 1793 1794 " Configure per-zone name service") 1795 manageNscd ;; 1796 1797 " Unconfigure per-zone name service") 1798 manageNscd ;; 1799 1800 " Destroy all zones...") 1801 tearDownZones 1802 return ;; 1803 1804 *) 1805 if [ $zone_cnt == 1 ] ; then 1806 exit 1807 else 1808 return 1809 fi;; 1810 esac 1811 sleep $delay; 1812 done 1813} 1814 1815# Main loop for top-level window 1816# 1817 1818/usr/bin/plabel $$ 1>/dev/null 2>&1 1819if [ $? != 0 ] ; then 1820 gettext "$0 : Trusted Extensions must be enabled.\n" 1821 exit 1 1822fi 1823 1824myzone=$(/sbin/zonename) 1825if [ $myzone != "global" ] ; then 1826 gettext "$0 : must be in global zone to run.\n" 1827 exit 1 1828fi 1829 1830 1831process_options "$@" || exit 1832 1833mkdir $TXTMP 2>/dev/null 1834deflabel=$(chk_encodings -a|grep "Default User Sensitivity"|\ 1835 sed 's/= /=/'|sed 's/"/'''/g|cut -d"=" -f2) 1836DEFAULTLABEL=$(atohexlabel ${deflabel}) 1837intlabel=$(chk_encodings -a|grep "Default User Clearance"|\ 1838 sed 's/= /=/'|sed 's/"/'''/g|cut -d"=" -f2) 1839INTLABEL=$(atohexlabel -c "${intlabel}") 1840 1841# are there any zfs pools? 1842ZDSET=none 1843zpool iostat 1>/dev/null 2>&1 1844if [ $? = 0 ] ; then 1845 # is there a zfs pool named "zone"? 1846 zpool list -H zone 1>/dev/null 2>&1 1847 if [ $? = 0 ] ; then 1848 # yes 1849 ZDSET=zone 1850 else 1851 # no, but is there a root pool? 1852 rootfs=$(df -n / | awk '{print $3}') 1853 if [ $rootfs = "zfs" ] ; then 1854 # yes, use it 1855 ZDSET=$(zfs list -Ho name / | cut -d/ -f 1)/zones 1856 zfs list -H $ZDSET 1>/dev/null 2>&1 1857 if [ $? = 1 ] ; then 1858 createZDSET "-o mountpoint=/zone" $ZDSET 1859 fi 1860 fi 1861 fi 1862fi 1863 1864if [ $DISP -eq 0 ] ; then 1865 gettext "non-interactive mode ...\n" 1866 1867 if [ $DESTROYZONES -eq 1 ] ; then 1868 tearDownZones 1869 fi 1870 1871 if [ $CREATEDEF -eq 1 ] ; then 1872 if [[ $(zoneadm list -c) == global ]] ; then 1873 createDefaultZones 1874 else 1875 gettext "cannot create default zones because there are existing zones.\n" 1876 fi 1877 fi 1878 1879 exit 1880fi 1881 1882if [ $NSCD_PER_LABEL -eq 0 ] ; then 1883 NSCD_OPT="Configure per-zone name service" 1884else 1885 NSCD_OPT="Unconfigure per-zone name service" 1886fi 1887 1888 1889while (( 1 )) do 1890 selectZone 1891done 1892