17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5ee519a1fSgjelinek * Common Development and Distribution License (the "License"). 6ee519a1fSgjelinek * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217e362f58Scomay 227c478bd9Sstevel@tonic-gate /* 23ad02e316Sbatschul * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved. 243c7284bdSAlexander Eremin * Copyright 2014 Nexenta Systems, Inc. All rights reserved. 259a686fbcSPaul Dagnelie * Copyright (c) 2015 by Delphix. All rights reserved. 267c478bd9Sstevel@tonic-gate */ 277c478bd9Sstevel@tonic-gate 287c478bd9Sstevel@tonic-gate /* 297c478bd9Sstevel@tonic-gate * zoneadm is a command interpreter for zone administration. It is all in 307c478bd9Sstevel@tonic-gate * C (i.e., no lex/yacc), and all the argument passing is argc/argv based. 317c478bd9Sstevel@tonic-gate * main() calls parse_and_run() which calls cmd_match(), then invokes the 327c478bd9Sstevel@tonic-gate * appropriate command's handler function. The rest of the program is the 337c478bd9Sstevel@tonic-gate * handler functions and their helper functions. 347c478bd9Sstevel@tonic-gate * 357c478bd9Sstevel@tonic-gate * Some of the helper functions are used largely to simplify I18N: reducing 367c478bd9Sstevel@tonic-gate * the need for translation notes. This is particularly true of many of 377c478bd9Sstevel@tonic-gate * the zerror() calls: doing e.g. zerror(gettext("%s failed"), "foo") rather 387c478bd9Sstevel@tonic-gate * than zerror(gettext("foo failed")) with a translation note indicating 397c478bd9Sstevel@tonic-gate * that "foo" need not be translated. 407c478bd9Sstevel@tonic-gate */ 417c478bd9Sstevel@tonic-gate 427c478bd9Sstevel@tonic-gate #include <stdio.h> 437c478bd9Sstevel@tonic-gate #include <errno.h> 447c478bd9Sstevel@tonic-gate #include <unistd.h> 457c478bd9Sstevel@tonic-gate #include <signal.h> 467c478bd9Sstevel@tonic-gate #include <stdarg.h> 477c478bd9Sstevel@tonic-gate #include <ctype.h> 487c478bd9Sstevel@tonic-gate #include <stdlib.h> 497c478bd9Sstevel@tonic-gate #include <string.h> 507c478bd9Sstevel@tonic-gate #include <wait.h> 517c478bd9Sstevel@tonic-gate #include <zone.h> 527c478bd9Sstevel@tonic-gate #include <priv.h> 537c478bd9Sstevel@tonic-gate #include <locale.h> 547c478bd9Sstevel@tonic-gate #include <libintl.h> 557c478bd9Sstevel@tonic-gate #include <libzonecfg.h> 567c478bd9Sstevel@tonic-gate #include <bsm/adt.h> 579acbbeafSnn35248 #include <sys/brand.h> 587c478bd9Sstevel@tonic-gate #include <sys/param.h> 597c478bd9Sstevel@tonic-gate #include <sys/types.h> 607c478bd9Sstevel@tonic-gate #include <sys/stat.h> 617c478bd9Sstevel@tonic-gate #include <sys/statvfs.h> 627c478bd9Sstevel@tonic-gate #include <assert.h> 637c478bd9Sstevel@tonic-gate #include <sys/sockio.h> 647c478bd9Sstevel@tonic-gate #include <sys/mntent.h> 657c478bd9Sstevel@tonic-gate #include <limits.h> 660b5de56dSgjelinek #include <dirent.h> 67555afedfScarlsonj #include <uuid/uuid.h> 687c478bd9Sstevel@tonic-gate #include <fcntl.h> 697c478bd9Sstevel@tonic-gate #include <door.h> 707c478bd9Sstevel@tonic-gate #include <macros.h> 717c478bd9Sstevel@tonic-gate #include <libgen.h> 72865e09a4Sgjelinek #include <fnmatch.h> 73e7f3c547Sgjelinek #include <sys/modctl.h> 749acbbeafSnn35248 #include <libbrand.h> 750209230bSgjelinek #include <libscf.h> 767ef01d19Sgjelinek #include <procfs.h> 77d9e728a2Sgjelinek #include <strings.h> 787c478bd9Sstevel@tonic-gate #include <pool.h> 797c478bd9Sstevel@tonic-gate #include <sys/pool.h> 800209230bSgjelinek #include <sys/priocntl.h> 810209230bSgjelinek #include <sys/fsspriocntl.h> 822b24ab6bSSebastien Roy #include <libdladm.h> 832b24ab6bSSebastien Roy #include <libdllink.h> 84cb8a054bSGlenn Faden #include <pwd.h> 85cb8a054bSGlenn Faden #include <auth_list.h> 86cb8a054bSGlenn Faden #include <auth_attr.h> 87cb8a054bSGlenn Faden #include <secdb.h> 887c478bd9Sstevel@tonic-gate 890b5de56dSgjelinek #include "zoneadm.h" 900b5de56dSgjelinek 917c478bd9Sstevel@tonic-gate #define MAXARGS 8 92cb8a054bSGlenn Faden #define SOURCE_ZONE (CMD_MAX + 1) 937c478bd9Sstevel@tonic-gate 947c478bd9Sstevel@tonic-gate /* Reflects kernel zone entries */ 957c478bd9Sstevel@tonic-gate typedef struct zone_entry { 967c478bd9Sstevel@tonic-gate zoneid_t zid; 977c478bd9Sstevel@tonic-gate char zname[ZONENAME_MAX]; 987c478bd9Sstevel@tonic-gate char *zstate_str; 997c478bd9Sstevel@tonic-gate zone_state_t zstate_num; 1009acbbeafSnn35248 char zbrand[MAXNAMELEN]; 1017c478bd9Sstevel@tonic-gate char zroot[MAXPATHLEN]; 102555afedfScarlsonj char zuuid[UUID_PRINTABLE_STRING_LENGTH]; 103f4b3ec61Sdh155122 zone_iptype_t ziptype; 1047c478bd9Sstevel@tonic-gate } zone_entry_t; 1057c478bd9Sstevel@tonic-gate 10684561e8cStd153743 #define CLUSTER_BRAND_NAME "cluster" 10784561e8cStd153743 1087c478bd9Sstevel@tonic-gate static zone_entry_t *zents; 1097c478bd9Sstevel@tonic-gate static size_t nzents; 1107c478bd9Sstevel@tonic-gate 1111390a385Sgjelinek #define LOOPBACK_IF "lo0" 1121390a385Sgjelinek #define SOCKET_AF(af) (((af) == AF_UNSPEC) ? AF_INET : (af)) 1131390a385Sgjelinek 1141390a385Sgjelinek struct net_if { 1151390a385Sgjelinek char *name; 1161390a385Sgjelinek int af; 1171390a385Sgjelinek }; 1181390a385Sgjelinek 1197c478bd9Sstevel@tonic-gate /* 0755 is the default directory mode. */ 1207c478bd9Sstevel@tonic-gate #define DEFAULT_DIR_MODE \ 1217c478bd9Sstevel@tonic-gate (S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH) 1227c478bd9Sstevel@tonic-gate 1237c478bd9Sstevel@tonic-gate struct cmd { 1247c478bd9Sstevel@tonic-gate uint_t cmd_num; /* command number */ 1257c478bd9Sstevel@tonic-gate char *cmd_name; /* command name */ 1267c478bd9Sstevel@tonic-gate char *short_usage; /* short form help */ 1277c478bd9Sstevel@tonic-gate int (*handler)(int argc, char *argv[]); /* function to call */ 1287c478bd9Sstevel@tonic-gate 1297c478bd9Sstevel@tonic-gate }; 1307c478bd9Sstevel@tonic-gate 1317c478bd9Sstevel@tonic-gate #define SHELP_HELP "help" 1323f2f09c1Sdp #define SHELP_BOOT "boot [-- boot_arguments]" 1337c478bd9Sstevel@tonic-gate #define SHELP_HALT "halt" 1347c478bd9Sstevel@tonic-gate #define SHELP_READY "ready" 1353c7284bdSAlexander Eremin #define SHELP_SHUTDOWN "shutdown [-r [-- boot_arguments]]" 1363f2f09c1Sdp #define SHELP_REBOOT "reboot [-- boot_arguments]" 137*0222d5acSRyan England #define SHELP_LIST "list [-cinpv]" 1387c478bd9Sstevel@tonic-gate #define SHELP_VERIFY "verify" 139ad02e316Sbatschul #define SHELP_INSTALL "install [brand-specific args]" 140ff17c8bfSgjelinek #define SHELP_UNINSTALL "uninstall [-F] [brand-specific args]" 141ff17c8bfSgjelinek #define SHELP_CLONE "clone [-m method] [-s <ZFS snapshot>] "\ 142ff17c8bfSgjelinek "[brand-specific args] zonename" 143865e09a4Sgjelinek #define SHELP_MOVE "move zonepath" 144ff17c8bfSgjelinek #define SHELP_DETACH "detach [-n] [brand-specific args]" 145ff17c8bfSgjelinek #define SHELP_ATTACH "attach [-F] [-n <path>] [brand-specific args]" 146555afedfScarlsonj #define SHELP_MARK "mark incomplete" 1477c478bd9Sstevel@tonic-gate 1489acbbeafSnn35248 #define EXEC_PREFIX "exec " 1499acbbeafSnn35248 #define EXEC_LEN (strlen(EXEC_PREFIX)) 1509acbbeafSnn35248 #define RMCOMMAND "/usr/bin/rm -rf" 1519acbbeafSnn35248 1529acbbeafSnn35248 static int cleanup_zonepath(char *, boolean_t); 1539acbbeafSnn35248 154f4b3ec61Sdh155122 1557c478bd9Sstevel@tonic-gate static int help_func(int argc, char *argv[]); 1567c478bd9Sstevel@tonic-gate static int ready_func(int argc, char *argv[]); 1577c478bd9Sstevel@tonic-gate static int boot_func(int argc, char *argv[]); 1583c7284bdSAlexander Eremin static int shutdown_func(int argc, char *argv[]); 1597c478bd9Sstevel@tonic-gate static int halt_func(int argc, char *argv[]); 1607c478bd9Sstevel@tonic-gate static int reboot_func(int argc, char *argv[]); 1617c478bd9Sstevel@tonic-gate static int list_func(int argc, char *argv[]); 1627c478bd9Sstevel@tonic-gate static int verify_func(int argc, char *argv[]); 1637c478bd9Sstevel@tonic-gate static int install_func(int argc, char *argv[]); 1647c478bd9Sstevel@tonic-gate static int uninstall_func(int argc, char *argv[]); 165108322fbScarlsonj static int mount_func(int argc, char *argv[]); 166108322fbScarlsonj static int unmount_func(int argc, char *argv[]); 167865e09a4Sgjelinek static int clone_func(int argc, char *argv[]); 168865e09a4Sgjelinek static int move_func(int argc, char *argv[]); 169ee519a1fSgjelinek static int detach_func(int argc, char *argv[]); 170ee519a1fSgjelinek static int attach_func(int argc, char *argv[]); 171555afedfScarlsonj static int mark_func(int argc, char *argv[]); 1720209230bSgjelinek static int apply_func(int argc, char *argv[]); 173fbbfbc6eSjv227347 static int sysboot_func(int argc, char *argv[]); 1747c478bd9Sstevel@tonic-gate static int sanity_check(char *zone, int cmd_num, boolean_t running, 1759acbbeafSnn35248 boolean_t unsafe_when_running, boolean_t force); 1767c478bd9Sstevel@tonic-gate static int cmd_match(char *cmd); 177ce28b40eSzt129084 static int verify_details(int, char *argv[]); 178ce28b40eSzt129084 static int verify_brand(zone_dochandle_t, int, char *argv[]); 179ce28b40eSzt129084 static int invoke_brand_handler(int, char *argv[]); 1807c478bd9Sstevel@tonic-gate 1817c478bd9Sstevel@tonic-gate static struct cmd cmdtab[] = { 1827c478bd9Sstevel@tonic-gate { CMD_HELP, "help", SHELP_HELP, help_func }, 1837c478bd9Sstevel@tonic-gate { CMD_BOOT, "boot", SHELP_BOOT, boot_func }, 1847c478bd9Sstevel@tonic-gate { CMD_HALT, "halt", SHELP_HALT, halt_func }, 1857c478bd9Sstevel@tonic-gate { CMD_READY, "ready", SHELP_READY, ready_func }, 1863c7284bdSAlexander Eremin { CMD_SHUTDOWN, "shutdown", SHELP_SHUTDOWN, shutdown_func }, 1877c478bd9Sstevel@tonic-gate { CMD_REBOOT, "reboot", SHELP_REBOOT, reboot_func }, 1887c478bd9Sstevel@tonic-gate { CMD_LIST, "list", SHELP_LIST, list_func }, 1897c478bd9Sstevel@tonic-gate { CMD_VERIFY, "verify", SHELP_VERIFY, verify_func }, 1907c478bd9Sstevel@tonic-gate { CMD_INSTALL, "install", SHELP_INSTALL, install_func }, 1917c478bd9Sstevel@tonic-gate { CMD_UNINSTALL, "uninstall", SHELP_UNINSTALL, 192108322fbScarlsonj uninstall_func }, 193865e09a4Sgjelinek /* mount and unmount are private commands for admin/install */ 194108322fbScarlsonj { CMD_MOUNT, "mount", NULL, mount_func }, 195865e09a4Sgjelinek { CMD_UNMOUNT, "unmount", NULL, unmount_func }, 196865e09a4Sgjelinek { CMD_CLONE, "clone", SHELP_CLONE, clone_func }, 197ee519a1fSgjelinek { CMD_MOVE, "move", SHELP_MOVE, move_func }, 198ee519a1fSgjelinek { CMD_DETACH, "detach", SHELP_DETACH, detach_func }, 199555afedfScarlsonj { CMD_ATTACH, "attach", SHELP_ATTACH, attach_func }, 2000209230bSgjelinek { CMD_MARK, "mark", SHELP_MARK, mark_func }, 201fbbfbc6eSjv227347 { CMD_APPLY, "apply", NULL, apply_func }, 202fbbfbc6eSjv227347 { CMD_SYSBOOT, "sysboot", NULL, sysboot_func } 2037c478bd9Sstevel@tonic-gate }; 2047c478bd9Sstevel@tonic-gate 2057c478bd9Sstevel@tonic-gate /* global variables */ 2067c478bd9Sstevel@tonic-gate 2077c478bd9Sstevel@tonic-gate /* set early in main(), never modified thereafter, used all over the place */ 2087c478bd9Sstevel@tonic-gate static char *execname; 2099acbbeafSnn35248 static char target_brand[MAXNAMELEN]; 210e5816e35SEdward Pilatowicz static char default_brand[MAXPATHLEN]; 2117c478bd9Sstevel@tonic-gate static char *locale; 2120b5de56dSgjelinek char *target_zone; 213555afedfScarlsonj static char *target_uuid; 214cb8a054bSGlenn Faden char *username; 2157c478bd9Sstevel@tonic-gate 2160b5de56dSgjelinek char * 2177c478bd9Sstevel@tonic-gate cmd_to_str(int cmd_num) 2187c478bd9Sstevel@tonic-gate { 2197c478bd9Sstevel@tonic-gate assert(cmd_num >= CMD_MIN && cmd_num <= CMD_MAX); 2207c478bd9Sstevel@tonic-gate return (cmdtab[cmd_num].cmd_name); 2217c478bd9Sstevel@tonic-gate } 2227c478bd9Sstevel@tonic-gate 2237c478bd9Sstevel@tonic-gate /* This is a separate function because of gettext() wrapping. */ 2247c478bd9Sstevel@tonic-gate static char * 2257c478bd9Sstevel@tonic-gate long_help(int cmd_num) 2267c478bd9Sstevel@tonic-gate { 2277e362f58Scomay assert(cmd_num >= CMD_MIN && cmd_num <= CMD_MAX); 2287c478bd9Sstevel@tonic-gate switch (cmd_num) { 2297c478bd9Sstevel@tonic-gate case CMD_HELP: 2307c478bd9Sstevel@tonic-gate return (gettext("Print usage message.")); 2317c478bd9Sstevel@tonic-gate case CMD_BOOT: 2323f2f09c1Sdp return (gettext("Activates (boots) specified zone. See " 2333f2f09c1Sdp "zoneadm(1m) for valid boot\n\targuments.")); 2347c478bd9Sstevel@tonic-gate case CMD_HALT: 2359e518655Sgjelinek return (gettext("Halts specified zone, bypassing shutdown " 2369e518655Sgjelinek "scripts and removing runtime\n\tresources of the zone.")); 2377c478bd9Sstevel@tonic-gate case CMD_READY: 2389e518655Sgjelinek return (gettext("Prepares a zone for running applications but " 2399e518655Sgjelinek "does not start any user\n\tprocesses in the zone.")); 2403c7284bdSAlexander Eremin case CMD_SHUTDOWN: 2413c7284bdSAlexander Eremin return (gettext("Gracefully shutdown the zone or reboot if " 2423c7284bdSAlexander Eremin "the '-r' option is specified.\n\t" 2433c7284bdSAlexander Eremin "See zoneadm(1m) for valid boot arguments.")); 2447c478bd9Sstevel@tonic-gate case CMD_REBOOT: 2459e518655Sgjelinek return (gettext("Restarts the zone (equivalent to a halt / " 2463f2f09c1Sdp "boot sequence).\n\tFails if the zone is not active. " 2473f2f09c1Sdp "See zoneadm(1m) for valid boot\n\targuments.")); 2487c478bd9Sstevel@tonic-gate case CMD_LIST: 2497c478bd9Sstevel@tonic-gate return (gettext("Lists the current zones, or a " 2507c478bd9Sstevel@tonic-gate "specific zone if indicated. By default,\n\tall " 2517c478bd9Sstevel@tonic-gate "running zones are listed, though this can be " 2527c478bd9Sstevel@tonic-gate "expanded to all\n\tinstalled zones with the -i " 2537c478bd9Sstevel@tonic-gate "option or all configured zones with the\n\t-c " 254555afedfScarlsonj "option. When used with the general -z <zone> and/or -u " 255555afedfScarlsonj "<uuid-match>\n\toptions, lists only the specified " 256555afedfScarlsonj "matching zone, but lists it\n\tregardless of its state, " 257*0222d5acSRyan England "and the -i, -c, and -n options are disallowed. The\n\t-v " 258555afedfScarlsonj "option can be used to display verbose information: zone " 259555afedfScarlsonj "name, id,\n\tcurrent state, root directory and options. " 260555afedfScarlsonj "The -p option can be used\n\tto request machine-parsable " 261555afedfScarlsonj "output. The -v and -p options are mutually\n\texclusive." 262555afedfScarlsonj " If neither -v nor -p is used, just the zone name is " 263555afedfScarlsonj "listed.")); 2647c478bd9Sstevel@tonic-gate case CMD_VERIFY: 2657c478bd9Sstevel@tonic-gate return (gettext("Check to make sure the configuration " 2667c478bd9Sstevel@tonic-gate "can safely be instantiated\n\ton the machine: " 2677c478bd9Sstevel@tonic-gate "physical network interfaces exist, etc.")); 2687c478bd9Sstevel@tonic-gate case CMD_INSTALL: 2690b5de56dSgjelinek return (gettext("Install the configuration on to the system. " 270ad02e316Sbatschul "All arguments are passed to the brand installation " 271ff17c8bfSgjelinek "function;\n\tsee brands(5) for more information.")); 2727c478bd9Sstevel@tonic-gate case CMD_UNINSTALL: 2739e518655Sgjelinek return (gettext("Uninstall the configuration from the system. " 274ff17c8bfSgjelinek "The -F flag can be used\n\tto force the action. All " 275ff17c8bfSgjelinek "other arguments are passed to the brand\n\tuninstall " 276ff17c8bfSgjelinek "function; see brands(5) for more information.")); 277865e09a4Sgjelinek case CMD_CLONE: 2780b5de56dSgjelinek return (gettext("Clone the installation of another zone. " 2790b5de56dSgjelinek "The -m option can be used to\n\tspecify 'copy' which " 2800b5de56dSgjelinek "forces a copy of the source zone. The -s option\n\t" 2810b5de56dSgjelinek "can be used to specify the name of a ZFS snapshot " 2820b5de56dSgjelinek "that was taken from\n\ta previous clone command. The " 2830b5de56dSgjelinek "snapshot will be used as the source\n\tinstead of " 284ff17c8bfSgjelinek "creating a new ZFS snapshot. All other arguments are " 285ff17c8bfSgjelinek "passed\n\tto the brand clone function; see " 286ff17c8bfSgjelinek "brands(5) for more information.")); 287865e09a4Sgjelinek case CMD_MOVE: 288865e09a4Sgjelinek return (gettext("Move the zone to a new zonepath.")); 2899e518655Sgjelinek case CMD_DETACH: 2909e518655Sgjelinek return (gettext("Detach the zone from the system. The zone " 2919e518655Sgjelinek "state is changed to\n\t'configured' (but the files under " 2929e518655Sgjelinek "the zonepath are untouched).\n\tThe zone can subsequently " 2939e518655Sgjelinek "be attached, or can be moved to another\n\tsystem and " 2948cd327d5Sgjelinek "attached there. The -n option can be used to specify\n\t" 2958cd327d5Sgjelinek "'no-execute' mode. When -n is used, the information " 2968cd327d5Sgjelinek "needed to attach\n\tthe zone is sent to standard output " 297ff17c8bfSgjelinek "but the zone is not actually\n\tdetached. All other " 298ff17c8bfSgjelinek "arguments are passed to the brand detach function;\n\tsee " 299ff17c8bfSgjelinek "brands(5) for more information.")); 3009e518655Sgjelinek case CMD_ATTACH: 3019e518655Sgjelinek return (gettext("Attach the zone to the system. The zone " 3029e518655Sgjelinek "state must be 'configured'\n\tprior to attach; upon " 3039e518655Sgjelinek "successful completion, the zone state will be\n\t" 3049e518655Sgjelinek "'installed'. The system software on the current " 3059e518655Sgjelinek "system must be\n\tcompatible with the software on the " 306ff17c8bfSgjelinek "zone's original system.\n\tSpecify -F " 3076cfd72c6Sgjelinek "to force the attach and skip software compatibility " 3086cfd72c6Sgjelinek "tests.\n\tThe -n option can be used to specify " 3096cfd72c6Sgjelinek "'no-execute' mode. When -n is\n\tused, the information " 3106cfd72c6Sgjelinek "needed to attach the zone is read from the\n\tspecified " 3116cfd72c6Sgjelinek "path and the configuration is only validated. The path " 312ff17c8bfSgjelinek "can\n\tbe '-' to specify standard input. The -F and -n " 313ff17c8bfSgjelinek "options are mutually\n\texclusive. All other arguments " 314ff17c8bfSgjelinek "are passed to the brand attach\n\tfunction; see " 315ff17c8bfSgjelinek "brands(5) for more information.")); 316555afedfScarlsonj case CMD_MARK: 317555afedfScarlsonj return (gettext("Set the state of the zone. This can be used " 318555afedfScarlsonj "to force the zone\n\tstate to 'incomplete' " 319555afedfScarlsonj "administratively if some activity has rendered\n\tthe " 320555afedfScarlsonj "zone permanently unusable. The only valid state that " 321555afedfScarlsonj "may be\n\tspecified is 'incomplete'.")); 322108322fbScarlsonj default: 323108322fbScarlsonj return (""); 3247c478bd9Sstevel@tonic-gate } 3257c478bd9Sstevel@tonic-gate /* NOTREACHED */ 3267e362f58Scomay return (NULL); 3277c478bd9Sstevel@tonic-gate } 3287c478bd9Sstevel@tonic-gate 3297c478bd9Sstevel@tonic-gate /* 3307c478bd9Sstevel@tonic-gate * Called with explicit B_TRUE when help is explicitly requested, B_FALSE for 3317c478bd9Sstevel@tonic-gate * unexpected errors. 3327c478bd9Sstevel@tonic-gate */ 3337c478bd9Sstevel@tonic-gate 3347c478bd9Sstevel@tonic-gate static int 3357c478bd9Sstevel@tonic-gate usage(boolean_t explicit) 3367c478bd9Sstevel@tonic-gate { 3377c478bd9Sstevel@tonic-gate int i; 3387c478bd9Sstevel@tonic-gate FILE *fd = explicit ? stdout : stderr; 3397c478bd9Sstevel@tonic-gate 3407c478bd9Sstevel@tonic-gate (void) fprintf(fd, "%s:\t%s help\n", gettext("usage"), execname); 341555afedfScarlsonj (void) fprintf(fd, "\t%s [-z <zone>] [-u <uuid-match>] list\n", 342555afedfScarlsonj execname); 343555afedfScarlsonj (void) fprintf(fd, "\t%s {-z <zone>|-u <uuid-match>} <%s>\n", execname, 3447c478bd9Sstevel@tonic-gate gettext("subcommand")); 3457c478bd9Sstevel@tonic-gate (void) fprintf(fd, "\n%s:\n\n", gettext("Subcommands")); 3467c478bd9Sstevel@tonic-gate for (i = CMD_MIN; i <= CMD_MAX; i++) { 347108322fbScarlsonj if (cmdtab[i].short_usage == NULL) 348108322fbScarlsonj continue; 3497c478bd9Sstevel@tonic-gate (void) fprintf(fd, "%s\n", cmdtab[i].short_usage); 3507c478bd9Sstevel@tonic-gate if (explicit) 3517c478bd9Sstevel@tonic-gate (void) fprintf(fd, "\t%s\n\n", long_help(i)); 3527c478bd9Sstevel@tonic-gate } 3537c478bd9Sstevel@tonic-gate if (!explicit) 3547c478bd9Sstevel@tonic-gate (void) fputs("\n", fd); 3557c478bd9Sstevel@tonic-gate return (Z_USAGE); 3567c478bd9Sstevel@tonic-gate } 3577c478bd9Sstevel@tonic-gate 3587c478bd9Sstevel@tonic-gate static void 3597c478bd9Sstevel@tonic-gate sub_usage(char *short_usage, int cmd_num) 3607c478bd9Sstevel@tonic-gate { 3617c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "%s:\t%s\n", gettext("usage"), short_usage); 3627c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "\t%s\n", long_help(cmd_num)); 3637c478bd9Sstevel@tonic-gate } 3647c478bd9Sstevel@tonic-gate 3657c478bd9Sstevel@tonic-gate /* 3667c478bd9Sstevel@tonic-gate * zperror() is like perror(3c) except that this also prints the executable 3677c478bd9Sstevel@tonic-gate * name at the start of the message, and takes a boolean indicating whether 3687c478bd9Sstevel@tonic-gate * to call libc'c strerror() or that from libzonecfg. 3697c478bd9Sstevel@tonic-gate */ 3707c478bd9Sstevel@tonic-gate 3710b5de56dSgjelinek void 3727c478bd9Sstevel@tonic-gate zperror(const char *str, boolean_t zonecfg_error) 3737c478bd9Sstevel@tonic-gate { 3747c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "%s: %s: %s\n", execname, str, 3757c478bd9Sstevel@tonic-gate zonecfg_error ? zonecfg_strerror(errno) : strerror(errno)); 3767c478bd9Sstevel@tonic-gate } 3777c478bd9Sstevel@tonic-gate 3787c478bd9Sstevel@tonic-gate /* 3797c478bd9Sstevel@tonic-gate * zperror2() is very similar to zperror() above, except it also prints a 3807c478bd9Sstevel@tonic-gate * supplied zone name after the executable. 3817c478bd9Sstevel@tonic-gate * 3827c478bd9Sstevel@tonic-gate * All current consumers of this function want libzonecfg's strerror() rather 3837c478bd9Sstevel@tonic-gate * than libc's; if this ever changes, this function can be made more generic 3847c478bd9Sstevel@tonic-gate * like zperror() above. 3857c478bd9Sstevel@tonic-gate */ 3867c478bd9Sstevel@tonic-gate 3870b5de56dSgjelinek void 3887c478bd9Sstevel@tonic-gate zperror2(const char *zone, const char *str) 3897c478bd9Sstevel@tonic-gate { 3907c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "%s: %s: %s: %s\n", execname, zone, str, 3917c478bd9Sstevel@tonic-gate zonecfg_strerror(errno)); 3927c478bd9Sstevel@tonic-gate } 3937c478bd9Sstevel@tonic-gate 3947c478bd9Sstevel@tonic-gate /* PRINTFLIKE1 */ 3950b5de56dSgjelinek void 3967c478bd9Sstevel@tonic-gate zerror(const char *fmt, ...) 3977c478bd9Sstevel@tonic-gate { 3987c478bd9Sstevel@tonic-gate va_list alist; 3997c478bd9Sstevel@tonic-gate 4007c478bd9Sstevel@tonic-gate va_start(alist, fmt); 4017c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "%s: ", execname); 4027c478bd9Sstevel@tonic-gate if (target_zone != NULL) 4037c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "zone '%s': ", target_zone); 4047c478bd9Sstevel@tonic-gate (void) vfprintf(stderr, fmt, alist); 4057c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "\n"); 4067c478bd9Sstevel@tonic-gate va_end(alist); 4077c478bd9Sstevel@tonic-gate } 4087c478bd9Sstevel@tonic-gate 4097c478bd9Sstevel@tonic-gate static void * 4107c478bd9Sstevel@tonic-gate safe_calloc(size_t nelem, size_t elsize) 4117c478bd9Sstevel@tonic-gate { 4127c478bd9Sstevel@tonic-gate void *r = calloc(nelem, elsize); 4137c478bd9Sstevel@tonic-gate 4147c478bd9Sstevel@tonic-gate if (r == NULL) { 4157c478bd9Sstevel@tonic-gate zerror(gettext("failed to allocate %lu bytes: %s"), 4167c478bd9Sstevel@tonic-gate (ulong_t)nelem * elsize, strerror(errno)); 4177c478bd9Sstevel@tonic-gate exit(Z_ERR); 4187c478bd9Sstevel@tonic-gate } 4197c478bd9Sstevel@tonic-gate return (r); 4207c478bd9Sstevel@tonic-gate } 4217c478bd9Sstevel@tonic-gate 4227c478bd9Sstevel@tonic-gate static void 4237c478bd9Sstevel@tonic-gate zone_print(zone_entry_t *zent, boolean_t verbose, boolean_t parsable) 4247c478bd9Sstevel@tonic-gate { 4257c478bd9Sstevel@tonic-gate static boolean_t firsttime = B_TRUE; 426f4b3ec61Sdh155122 char *ip_type_str; 427f4b3ec61Sdh155122 4282766118bS /* Skip a zone that shutdown while we were collecting data. */ 4292766118bS if (zent->zname[0] == '\0') 4302766118bS return; 4312766118bS 432f4b3ec61Sdh155122 if (zent->ziptype == ZS_EXCLUSIVE) 433f4b3ec61Sdh155122 ip_type_str = "excl"; 434f4b3ec61Sdh155122 else 435f4b3ec61Sdh155122 ip_type_str = "shared"; 4367c478bd9Sstevel@tonic-gate 4377c478bd9Sstevel@tonic-gate assert(!(verbose && parsable)); 4387c478bd9Sstevel@tonic-gate if (firsttime && verbose) { 4397c478bd9Sstevel@tonic-gate firsttime = B_FALSE; 440f4b3ec61Sdh155122 (void) printf("%*s %-16s %-10s %-30s %-8s %-6s\n", 441f4b3ec61Sdh155122 ZONEID_WIDTH, "ID", "NAME", "STATUS", "PATH", "BRAND", 442f4b3ec61Sdh155122 "IP"); 4437c478bd9Sstevel@tonic-gate } 4447c478bd9Sstevel@tonic-gate if (!verbose) { 445555afedfScarlsonj char *cp, *clim; 446555afedfScarlsonj 4477c478bd9Sstevel@tonic-gate if (!parsable) { 4487c478bd9Sstevel@tonic-gate (void) printf("%s\n", zent->zname); 4497c478bd9Sstevel@tonic-gate return; 4507c478bd9Sstevel@tonic-gate } 4517c478bd9Sstevel@tonic-gate if (zent->zid == ZONE_ID_UNDEFINED) 4527c478bd9Sstevel@tonic-gate (void) printf("-"); 4537c478bd9Sstevel@tonic-gate else 4547c478bd9Sstevel@tonic-gate (void) printf("%lu", zent->zid); 455555afedfScarlsonj (void) printf(":%s:%s:", zent->zname, zent->zstate_str); 456555afedfScarlsonj cp = zent->zroot; 457555afedfScarlsonj while ((clim = strchr(cp, ':')) != NULL) { 458555afedfScarlsonj (void) printf("%.*s\\:", clim - cp, cp); 459555afedfScarlsonj cp = clim + 1; 460555afedfScarlsonj } 461f4b3ec61Sdh155122 (void) printf("%s:%s:%s:%s\n", cp, zent->zuuid, zent->zbrand, 462f4b3ec61Sdh155122 ip_type_str); 4637c478bd9Sstevel@tonic-gate return; 4647c478bd9Sstevel@tonic-gate } 4657c478bd9Sstevel@tonic-gate if (zent->zstate_str != NULL) { 4667c478bd9Sstevel@tonic-gate if (zent->zid == ZONE_ID_UNDEFINED) 4677c478bd9Sstevel@tonic-gate (void) printf("%*s", ZONEID_WIDTH, "-"); 4687c478bd9Sstevel@tonic-gate else 4697c478bd9Sstevel@tonic-gate (void) printf("%*lu", ZONEID_WIDTH, zent->zid); 470f4b3ec61Sdh155122 (void) printf(" %-16s %-10s %-30s %-8s %-6s\n", zent->zname, 471f4b3ec61Sdh155122 zent->zstate_str, zent->zroot, zent->zbrand, ip_type_str); 4727c478bd9Sstevel@tonic-gate } 4737c478bd9Sstevel@tonic-gate } 4747c478bd9Sstevel@tonic-gate 4757c478bd9Sstevel@tonic-gate static int 476108322fbScarlsonj lookup_zone_info(const char *zone_name, zoneid_t zid, zone_entry_t *zent) 4777c478bd9Sstevel@tonic-gate { 47845916cd2Sjpk char root[MAXPATHLEN], *cp; 4797c478bd9Sstevel@tonic-gate int err; 480555afedfScarlsonj uuid_t uuid; 4812766118bS zone_dochandle_t handle; 4827c478bd9Sstevel@tonic-gate 4837c478bd9Sstevel@tonic-gate (void) strlcpy(zent->zname, zone_name, sizeof (zent->zname)); 4847c478bd9Sstevel@tonic-gate (void) strlcpy(zent->zroot, "???", sizeof (zent->zroot)); 4859acbbeafSnn35248 (void) strlcpy(zent->zbrand, "???", sizeof (zent->zbrand)); 4867c478bd9Sstevel@tonic-gate zent->zstate_str = "???"; 4877c478bd9Sstevel@tonic-gate 488108322fbScarlsonj zent->zid = zid; 4897c478bd9Sstevel@tonic-gate 490555afedfScarlsonj if (zonecfg_get_uuid(zone_name, uuid) == Z_OK && 491555afedfScarlsonj !uuid_is_null(uuid)) 492555afedfScarlsonj uuid_unparse(uuid, zent->zuuid); 493555afedfScarlsonj else 494555afedfScarlsonj zent->zuuid[0] = '\0'; 495555afedfScarlsonj 49645916cd2Sjpk /* 49745916cd2Sjpk * For labeled zones which query the zone path of lower-level 49845916cd2Sjpk * zones, the path needs to be adjusted to drop the final 49945916cd2Sjpk * "/root" component. This adjusted path is then useful 50045916cd2Sjpk * for reading down any exported directories from the 50145916cd2Sjpk * lower-level zone. 50245916cd2Sjpk */ 50345916cd2Sjpk if (is_system_labeled() && zent->zid != ZONE_ID_UNDEFINED) { 50445916cd2Sjpk if (zone_getattr(zent->zid, ZONE_ATTR_ROOT, zent->zroot, 50545916cd2Sjpk sizeof (zent->zroot)) == -1) { 50645916cd2Sjpk zperror2(zent->zname, 50745916cd2Sjpk gettext("could not get zone path.")); 50845916cd2Sjpk return (Z_ERR); 50945916cd2Sjpk } 51045916cd2Sjpk cp = zent->zroot + strlen(zent->zroot) - 5; 51145916cd2Sjpk if (cp > zent->zroot && strcmp(cp, "/root") == 0) 51245916cd2Sjpk *cp = 0; 51345916cd2Sjpk } else { 51445916cd2Sjpk if ((err = zone_get_zonepath(zent->zname, root, 51545916cd2Sjpk sizeof (root))) != Z_OK) { 5167c478bd9Sstevel@tonic-gate errno = err; 51745916cd2Sjpk zperror2(zent->zname, 51845916cd2Sjpk gettext("could not get zone path.")); 5197c478bd9Sstevel@tonic-gate return (Z_ERR); 5207c478bd9Sstevel@tonic-gate } 5217c478bd9Sstevel@tonic-gate (void) strlcpy(zent->zroot, root, sizeof (zent->zroot)); 52245916cd2Sjpk } 5237c478bd9Sstevel@tonic-gate 5247c478bd9Sstevel@tonic-gate if ((err = zone_get_state(zent->zname, &zent->zstate_num)) != Z_OK) { 5257c478bd9Sstevel@tonic-gate errno = err; 5267c478bd9Sstevel@tonic-gate zperror2(zent->zname, gettext("could not get state")); 5277c478bd9Sstevel@tonic-gate return (Z_ERR); 5287c478bd9Sstevel@tonic-gate } 5297c478bd9Sstevel@tonic-gate zent->zstate_str = zone_state_str(zent->zstate_num); 530bafa7067Snn35248 531bafa7067Snn35248 /* 532bafa7067Snn35248 * A zone's brand is only available in the .xml file describing it, 533bafa7067Snn35248 * which is only visible to the global zone. This causes 534bafa7067Snn35248 * zone_get_brand() to fail when called from within a non-global 535bafa7067Snn35248 * zone. Fortunately we only do this on labeled systems, where we 536bafa7067Snn35248 * know all zones are native. 537bafa7067Snn35248 */ 538bafa7067Snn35248 if (getzoneid() != GLOBAL_ZONEID) { 539bafa7067Snn35248 assert(is_system_labeled() != 0); 540e5816e35SEdward Pilatowicz (void) strlcpy(zent->zbrand, default_brand, 541bafa7067Snn35248 sizeof (zent->zbrand)); 542bafa7067Snn35248 } else if (zone_get_brand(zent->zname, zent->zbrand, 5439acbbeafSnn35248 sizeof (zent->zbrand)) != Z_OK) { 5449acbbeafSnn35248 zperror2(zent->zname, gettext("could not get brand name")); 5459acbbeafSnn35248 return (Z_ERR); 5469acbbeafSnn35248 } 5477c478bd9Sstevel@tonic-gate 548f4b3ec61Sdh155122 /* 549f4b3ec61Sdh155122 * Get ip type of the zone. 550f4b3ec61Sdh155122 * Note for global zone, ZS_SHARED is set always. 551f4b3ec61Sdh155122 */ 552f4b3ec61Sdh155122 if (zid == GLOBAL_ZONEID) { 553f4b3ec61Sdh155122 zent->ziptype = ZS_SHARED; 5542766118bS return (Z_OK); 5552766118bS } 556f4b3ec61Sdh155122 5572766118bS /* 5582766118bS * There is a race condition where the zone could boot while 5592766118bS * we're walking the index file. In this case the zone state 5602766118bS * could be seen as running from the call above, but the zoneid 5612766118bS * would be undefined. 5622766118bS * 5632766118bS * There is also a race condition where the zone could shutdown after 5642766118bS * we got its running state above. This is also not an error and 5652766118bS * we fall back to getting the ziptype from the zone configuration. 5662766118bS */ 5672766118bS if (zent->zstate_num == ZONE_STATE_RUNNING && 5682766118bS zid != ZONE_ID_UNDEFINED) { 569f4b3ec61Sdh155122 ushort_t flags; 570f4b3ec61Sdh155122 571f4b3ec61Sdh155122 if (zone_getattr(zid, ZONE_ATTR_FLAGS, &flags, 5722766118bS sizeof (flags)) >= 0) { 573f4b3ec61Sdh155122 if (flags & ZF_NET_EXCL) 574f4b3ec61Sdh155122 zent->ziptype = ZS_EXCLUSIVE; 575f4b3ec61Sdh155122 else 576f4b3ec61Sdh155122 zent->ziptype = ZS_SHARED; 5772766118bS return (Z_OK); 5782766118bS } 5792766118bS } 580f4b3ec61Sdh155122 581f4b3ec61Sdh155122 if ((handle = zonecfg_init_handle()) == NULL) { 5822766118bS zperror2(zent->zname, gettext("could not init handle")); 583f4b3ec61Sdh155122 return (Z_ERR); 584f4b3ec61Sdh155122 } 5852766118bS if ((err = zonecfg_get_handle(zent->zname, handle)) != Z_OK) { 5862766118bS zperror2(zent->zname, gettext("could not get handle")); 587f4b3ec61Sdh155122 zonecfg_fini_handle(handle); 588f4b3ec61Sdh155122 return (Z_ERR); 589f4b3ec61Sdh155122 } 590f4b3ec61Sdh155122 5912766118bS if ((err = zonecfg_get_iptype(handle, &zent->ziptype)) != Z_OK) { 5922766118bS zperror2(zent->zname, gettext("could not get ip-type")); 593f4b3ec61Sdh155122 zonecfg_fini_handle(handle); 594f4b3ec61Sdh155122 return (Z_ERR); 595f4b3ec61Sdh155122 } 596f4b3ec61Sdh155122 zonecfg_fini_handle(handle); 597f4b3ec61Sdh155122 5987c478bd9Sstevel@tonic-gate return (Z_OK); 5997c478bd9Sstevel@tonic-gate } 6007c478bd9Sstevel@tonic-gate 6017c478bd9Sstevel@tonic-gate /* 6027c478bd9Sstevel@tonic-gate * fetch_zents() calls zone_list(2) to find out how many zones are running 6037c478bd9Sstevel@tonic-gate * (which is stored in the global nzents), then calls zone_list(2) again 6047c478bd9Sstevel@tonic-gate * to fetch the list of running zones (stored in the global zents). This 6057c478bd9Sstevel@tonic-gate * function may be called multiple times, so if zents is already set, we 6067c478bd9Sstevel@tonic-gate * return immediately to save work. 6072766118bS * 6082766118bS * Note that the data about running zones can change while this function 6092766118bS * is running, so its possible that the list of zones will have empty slots 6102766118bS * at the end. 6117c478bd9Sstevel@tonic-gate */ 6127c478bd9Sstevel@tonic-gate 6137c478bd9Sstevel@tonic-gate static int 614108322fbScarlsonj fetch_zents(void) 6157c478bd9Sstevel@tonic-gate { 6167c478bd9Sstevel@tonic-gate zoneid_t *zids = NULL; 6177c478bd9Sstevel@tonic-gate uint_t nzents_saved; 618108322fbScarlsonj int i, retv; 619108322fbScarlsonj FILE *fp; 620108322fbScarlsonj boolean_t inaltroot; 621108322fbScarlsonj zone_entry_t *zentp; 622c8845d44SSusan Kamm-Worrell const char *altroot; 6237c478bd9Sstevel@tonic-gate 6247c478bd9Sstevel@tonic-gate if (nzents > 0) 6257c478bd9Sstevel@tonic-gate return (Z_OK); 6267c478bd9Sstevel@tonic-gate 6277c478bd9Sstevel@tonic-gate if (zone_list(NULL, &nzents) != 0) { 6287c478bd9Sstevel@tonic-gate zperror(gettext("failed to get zoneid list"), B_FALSE); 6297c478bd9Sstevel@tonic-gate return (Z_ERR); 6307c478bd9Sstevel@tonic-gate } 6317c478bd9Sstevel@tonic-gate 6327c478bd9Sstevel@tonic-gate again: 6337c478bd9Sstevel@tonic-gate if (nzents == 0) 6347c478bd9Sstevel@tonic-gate return (Z_OK); 6357c478bd9Sstevel@tonic-gate 6367c478bd9Sstevel@tonic-gate zids = safe_calloc(nzents, sizeof (zoneid_t)); 6377c478bd9Sstevel@tonic-gate nzents_saved = nzents; 6387c478bd9Sstevel@tonic-gate 6397c478bd9Sstevel@tonic-gate if (zone_list(zids, &nzents) != 0) { 6407c478bd9Sstevel@tonic-gate zperror(gettext("failed to get zone list"), B_FALSE); 6417c478bd9Sstevel@tonic-gate free(zids); 6427c478bd9Sstevel@tonic-gate return (Z_ERR); 6437c478bd9Sstevel@tonic-gate } 6447c478bd9Sstevel@tonic-gate if (nzents != nzents_saved) { 6457c478bd9Sstevel@tonic-gate /* list changed, try again */ 6467c478bd9Sstevel@tonic-gate free(zids); 6477c478bd9Sstevel@tonic-gate goto again; 6487c478bd9Sstevel@tonic-gate } 6497c478bd9Sstevel@tonic-gate 6507c478bd9Sstevel@tonic-gate zents = safe_calloc(nzents, sizeof (zone_entry_t)); 6517c478bd9Sstevel@tonic-gate 652108322fbScarlsonj inaltroot = zonecfg_in_alt_root(); 653c8845d44SSusan Kamm-Worrell if (inaltroot) { 654108322fbScarlsonj fp = zonecfg_open_scratch("", B_FALSE); 655c8845d44SSusan Kamm-Worrell altroot = zonecfg_get_root(); 656c8845d44SSusan Kamm-Worrell } else { 657108322fbScarlsonj fp = NULL; 658c8845d44SSusan Kamm-Worrell } 659108322fbScarlsonj zentp = zents; 660108322fbScarlsonj retv = Z_OK; 6617c478bd9Sstevel@tonic-gate for (i = 0; i < nzents; i++) { 6627c478bd9Sstevel@tonic-gate char name[ZONENAME_MAX]; 663108322fbScarlsonj char altname[ZONENAME_MAX]; 664c8845d44SSusan Kamm-Worrell char rev_altroot[MAXPATHLEN]; 6657c478bd9Sstevel@tonic-gate 666108322fbScarlsonj if (getzonenamebyid(zids[i], name, sizeof (name)) < 0) { 6672766118bS /* 6682766118bS * There is a race condition where the zone may have 6692766118bS * shutdown since we retrieved the number of running 6702766118bS * zones above. This is not an error, there will be 6712766118bS * an empty slot at the end of the list. 6722766118bS */ 673108322fbScarlsonj continue; 6747c478bd9Sstevel@tonic-gate } 675108322fbScarlsonj if (zonecfg_is_scratch(name)) { 676108322fbScarlsonj /* Ignore scratch zones by default */ 677108322fbScarlsonj if (!inaltroot) 678108322fbScarlsonj continue; 679108322fbScarlsonj if (fp == NULL || 680108322fbScarlsonj zonecfg_reverse_scratch(fp, name, altname, 681c8845d44SSusan Kamm-Worrell sizeof (altname), rev_altroot, 682c8845d44SSusan Kamm-Worrell sizeof (rev_altroot)) == -1) { 6835ee84fbdSgjelinek zerror(gettext("could not resolve scratch " 684108322fbScarlsonj "zone %s"), name); 685108322fbScarlsonj retv = Z_ERR; 686108322fbScarlsonj continue; 687108322fbScarlsonj } 688c8845d44SSusan Kamm-Worrell /* Ignore zones in other alternate roots */ 689c8845d44SSusan Kamm-Worrell if (strcmp(rev_altroot, altroot) != 0) 690c8845d44SSusan Kamm-Worrell continue; 691108322fbScarlsonj (void) strcpy(name, altname); 692108322fbScarlsonj } else { 693108322fbScarlsonj /* Ignore non-scratch when in an alternate root */ 694108322fbScarlsonj if (inaltroot && strcmp(name, GLOBAL_ZONENAME) != 0) 695108322fbScarlsonj continue; 696108322fbScarlsonj } 697108322fbScarlsonj if (lookup_zone_info(name, zids[i], zentp) != Z_OK) { 6982766118bS /* 6992766118bS * There is a race condition where the zone may have 7002766118bS * shutdown since we retrieved the number of running 7012766118bS * zones above. This is not an error, there will be 7022766118bS * an empty slot at the end of the list. 7032766118bS */ 704108322fbScarlsonj continue; 705108322fbScarlsonj } 706108322fbScarlsonj zentp++; 707108322fbScarlsonj } 708108322fbScarlsonj nzents = zentp - zents; 709108322fbScarlsonj if (fp != NULL) 710108322fbScarlsonj zonecfg_close_scratch(fp); 7117c478bd9Sstevel@tonic-gate 7127c478bd9Sstevel@tonic-gate free(zids); 713108322fbScarlsonj return (retv); 7147c478bd9Sstevel@tonic-gate } 7157c478bd9Sstevel@tonic-gate 716108322fbScarlsonj static int 717*0222d5acSRyan England zone_print_list(zone_state_t min_state, boolean_t verbose, boolean_t parsable, 718*0222d5acSRyan England boolean_t exclude_global) 7197c478bd9Sstevel@tonic-gate { 7207c478bd9Sstevel@tonic-gate int i; 7217c478bd9Sstevel@tonic-gate zone_entry_t zent; 7227c478bd9Sstevel@tonic-gate FILE *cookie; 7237c478bd9Sstevel@tonic-gate char *name; 7247c478bd9Sstevel@tonic-gate 7257c478bd9Sstevel@tonic-gate /* 7267c478bd9Sstevel@tonic-gate * First get the list of running zones from the kernel and print them. 7277c478bd9Sstevel@tonic-gate * If that is all we need, then return. 7287c478bd9Sstevel@tonic-gate */ 729108322fbScarlsonj if ((i = fetch_zents()) != Z_OK) { 7307c478bd9Sstevel@tonic-gate /* 7317c478bd9Sstevel@tonic-gate * No need for error messages; fetch_zents() has already taken 7327c478bd9Sstevel@tonic-gate * care of this. 7337c478bd9Sstevel@tonic-gate */ 734108322fbScarlsonj return (i); 7357c478bd9Sstevel@tonic-gate } 736*0222d5acSRyan England for (i = 0; i < nzents; i++) { 737*0222d5acSRyan England if (exclude_global && zents[i].zid == GLOBAL_ZONEID) 738*0222d5acSRyan England continue; 7397c478bd9Sstevel@tonic-gate zone_print(&zents[i], verbose, parsable); 740*0222d5acSRyan England } 7417c478bd9Sstevel@tonic-gate if (min_state >= ZONE_STATE_RUNNING) 742108322fbScarlsonj return (Z_OK); 7437c478bd9Sstevel@tonic-gate /* 7447c478bd9Sstevel@tonic-gate * Next, get the full list of zones from the configuration, skipping 7457c478bd9Sstevel@tonic-gate * any we have already printed. 7467c478bd9Sstevel@tonic-gate */ 7477c478bd9Sstevel@tonic-gate cookie = setzoneent(); 7487c478bd9Sstevel@tonic-gate while ((name = getzoneent(cookie)) != NULL) { 7497c478bd9Sstevel@tonic-gate for (i = 0; i < nzents; i++) { 7507c478bd9Sstevel@tonic-gate if (strcmp(zents[i].zname, name) == 0) 7517c478bd9Sstevel@tonic-gate break; 7527c478bd9Sstevel@tonic-gate } 7537c478bd9Sstevel@tonic-gate if (i < nzents) { 7547c478bd9Sstevel@tonic-gate free(name); 7557c478bd9Sstevel@tonic-gate continue; 7567c478bd9Sstevel@tonic-gate } 757108322fbScarlsonj if (lookup_zone_info(name, ZONE_ID_UNDEFINED, &zent) != Z_OK) { 7587c478bd9Sstevel@tonic-gate free(name); 7597c478bd9Sstevel@tonic-gate continue; 7607c478bd9Sstevel@tonic-gate } 7617c478bd9Sstevel@tonic-gate free(name); 7627c478bd9Sstevel@tonic-gate if (zent.zstate_num >= min_state) 7637c478bd9Sstevel@tonic-gate zone_print(&zent, verbose, parsable); 7647c478bd9Sstevel@tonic-gate } 7657c478bd9Sstevel@tonic-gate endzoneent(cookie); 766108322fbScarlsonj return (Z_OK); 7677c478bd9Sstevel@tonic-gate } 7687c478bd9Sstevel@tonic-gate 769c9f134eaSjv227347 /* 770c9f134eaSjv227347 * Retrieve a zone entry by name. Returns NULL if no such zone exists. 771c9f134eaSjv227347 */ 7727c478bd9Sstevel@tonic-gate static zone_entry_t * 773c9f134eaSjv227347 lookup_running_zone(const char *str) 7747c478bd9Sstevel@tonic-gate { 7757c478bd9Sstevel@tonic-gate int i; 7767c478bd9Sstevel@tonic-gate 7777c478bd9Sstevel@tonic-gate if (fetch_zents() != Z_OK) 7787c478bd9Sstevel@tonic-gate return (NULL); 7797c478bd9Sstevel@tonic-gate 7807c478bd9Sstevel@tonic-gate for (i = 0; i < nzents; i++) { 7817c478bd9Sstevel@tonic-gate if (strcmp(str, zents[i].zname) == 0) 7827c478bd9Sstevel@tonic-gate return (&zents[i]); 7837c478bd9Sstevel@tonic-gate } 7847c478bd9Sstevel@tonic-gate return (NULL); 7857c478bd9Sstevel@tonic-gate } 7867c478bd9Sstevel@tonic-gate 7877c478bd9Sstevel@tonic-gate /* 7887c478bd9Sstevel@tonic-gate * Check a bit in a mode_t: if on is B_TRUE, that bit should be on; if 7897c478bd9Sstevel@tonic-gate * B_FALSE, it should be off. Return B_TRUE if the mode is bad (incorrect). 7907c478bd9Sstevel@tonic-gate */ 7917c478bd9Sstevel@tonic-gate static boolean_t 7927c478bd9Sstevel@tonic-gate bad_mode_bit(mode_t mode, mode_t bit, boolean_t on, char *file) 7937c478bd9Sstevel@tonic-gate { 7947c478bd9Sstevel@tonic-gate char *str; 7957c478bd9Sstevel@tonic-gate 7967c478bd9Sstevel@tonic-gate assert(bit == S_IRUSR || bit == S_IWUSR || bit == S_IXUSR || 7977c478bd9Sstevel@tonic-gate bit == S_IRGRP || bit == S_IWGRP || bit == S_IXGRP || 7987c478bd9Sstevel@tonic-gate bit == S_IROTH || bit == S_IWOTH || bit == S_IXOTH); 7997c478bd9Sstevel@tonic-gate /* 8007c478bd9Sstevel@tonic-gate * TRANSLATION_NOTE 8017c478bd9Sstevel@tonic-gate * The strings below will be used as part of a larger message, 8027c478bd9Sstevel@tonic-gate * either: 8037c478bd9Sstevel@tonic-gate * (file name) must be (owner|group|world) (read|writ|execut)able 8047c478bd9Sstevel@tonic-gate * or 8057c478bd9Sstevel@tonic-gate * (file name) must not be (owner|group|world) (read|writ|execut)able 8067c478bd9Sstevel@tonic-gate */ 8077c478bd9Sstevel@tonic-gate switch (bit) { 8087c478bd9Sstevel@tonic-gate case S_IRUSR: 8097c478bd9Sstevel@tonic-gate str = gettext("owner readable"); 8107c478bd9Sstevel@tonic-gate break; 8117c478bd9Sstevel@tonic-gate case S_IWUSR: 8127c478bd9Sstevel@tonic-gate str = gettext("owner writable"); 8137c478bd9Sstevel@tonic-gate break; 8147c478bd9Sstevel@tonic-gate case S_IXUSR: 8157c478bd9Sstevel@tonic-gate str = gettext("owner executable"); 8167c478bd9Sstevel@tonic-gate break; 8177c478bd9Sstevel@tonic-gate case S_IRGRP: 8187c478bd9Sstevel@tonic-gate str = gettext("group readable"); 8197c478bd9Sstevel@tonic-gate break; 8207c478bd9Sstevel@tonic-gate case S_IWGRP: 8217c478bd9Sstevel@tonic-gate str = gettext("group writable"); 8227c478bd9Sstevel@tonic-gate break; 8237c478bd9Sstevel@tonic-gate case S_IXGRP: 8247c478bd9Sstevel@tonic-gate str = gettext("group executable"); 8257c478bd9Sstevel@tonic-gate break; 8267c478bd9Sstevel@tonic-gate case S_IROTH: 8277c478bd9Sstevel@tonic-gate str = gettext("world readable"); 8287c478bd9Sstevel@tonic-gate break; 8297c478bd9Sstevel@tonic-gate case S_IWOTH: 8307c478bd9Sstevel@tonic-gate str = gettext("world writable"); 8317c478bd9Sstevel@tonic-gate break; 8327c478bd9Sstevel@tonic-gate case S_IXOTH: 8337c478bd9Sstevel@tonic-gate str = gettext("world executable"); 8347c478bd9Sstevel@tonic-gate break; 8357c478bd9Sstevel@tonic-gate } 8367c478bd9Sstevel@tonic-gate if ((mode & bit) == (on ? 0 : bit)) { 8377c478bd9Sstevel@tonic-gate /* 8387c478bd9Sstevel@tonic-gate * TRANSLATION_NOTE 8397c478bd9Sstevel@tonic-gate * The first parameter below is a file name; the second 8407c478bd9Sstevel@tonic-gate * is one of the "(owner|group|world) (read|writ|execut)able" 8417c478bd9Sstevel@tonic-gate * strings from above. 8427c478bd9Sstevel@tonic-gate */ 8437c478bd9Sstevel@tonic-gate /* 8447c478bd9Sstevel@tonic-gate * The code below could be simplified but not in a way 8457c478bd9Sstevel@tonic-gate * that would easily translate to non-English locales. 8467c478bd9Sstevel@tonic-gate */ 8477c478bd9Sstevel@tonic-gate if (on) { 8487c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s must be %s.\n"), 8497c478bd9Sstevel@tonic-gate file, str); 8507c478bd9Sstevel@tonic-gate } else { 8517c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s must not be %s.\n"), 8527c478bd9Sstevel@tonic-gate file, str); 8537c478bd9Sstevel@tonic-gate } 8547c478bd9Sstevel@tonic-gate return (B_TRUE); 8557c478bd9Sstevel@tonic-gate } 8567c478bd9Sstevel@tonic-gate return (B_FALSE); 8577c478bd9Sstevel@tonic-gate } 8587c478bd9Sstevel@tonic-gate 8597c478bd9Sstevel@tonic-gate /* 8607c478bd9Sstevel@tonic-gate * We want to make sure that no zone has its zone path as a child node 8617c478bd9Sstevel@tonic-gate * (in the directory sense) of any other. We do that by comparing this 8627c478bd9Sstevel@tonic-gate * zone's path to the path of all other (non-global) zones. The comparison 8637c478bd9Sstevel@tonic-gate * in each case is simple: add '/' to the end of the path, then do a 8647c478bd9Sstevel@tonic-gate * strncmp() of the two paths, using the length of the shorter one. 8657c478bd9Sstevel@tonic-gate */ 8667c478bd9Sstevel@tonic-gate 8677c478bd9Sstevel@tonic-gate static int 8687c478bd9Sstevel@tonic-gate crosscheck_zonepaths(char *path) 8697c478bd9Sstevel@tonic-gate { 8707c478bd9Sstevel@tonic-gate char rpath[MAXPATHLEN]; /* resolved path */ 8717c478bd9Sstevel@tonic-gate char path_copy[MAXPATHLEN]; /* copy of original path */ 8727c478bd9Sstevel@tonic-gate char rpath_copy[MAXPATHLEN]; /* copy of original rpath */ 8737c478bd9Sstevel@tonic-gate struct zoneent *ze; 8747c478bd9Sstevel@tonic-gate int res, err; 8757c478bd9Sstevel@tonic-gate FILE *cookie; 8767c478bd9Sstevel@tonic-gate 8777c478bd9Sstevel@tonic-gate cookie = setzoneent(); 8787c478bd9Sstevel@tonic-gate while ((ze = getzoneent_private(cookie)) != NULL) { 8797c478bd9Sstevel@tonic-gate /* Skip zones which are not installed. */ 8807c478bd9Sstevel@tonic-gate if (ze->zone_state < ZONE_STATE_INSTALLED) { 8817c478bd9Sstevel@tonic-gate free(ze); 8827c478bd9Sstevel@tonic-gate continue; 8837c478bd9Sstevel@tonic-gate } 8847c478bd9Sstevel@tonic-gate /* Skip the global zone and the current target zone. */ 8857c478bd9Sstevel@tonic-gate if (strcmp(ze->zone_name, GLOBAL_ZONENAME) == 0 || 8867c478bd9Sstevel@tonic-gate strcmp(ze->zone_name, target_zone) == 0) { 8877c478bd9Sstevel@tonic-gate free(ze); 8887c478bd9Sstevel@tonic-gate continue; 8897c478bd9Sstevel@tonic-gate } 8907c478bd9Sstevel@tonic-gate if (strlen(ze->zone_path) == 0) { 8917c478bd9Sstevel@tonic-gate /* old index file without path, fall back */ 8927c478bd9Sstevel@tonic-gate if ((err = zone_get_zonepath(ze->zone_name, 8937c478bd9Sstevel@tonic-gate ze->zone_path, sizeof (ze->zone_path))) != Z_OK) { 8947c478bd9Sstevel@tonic-gate errno = err; 8957c478bd9Sstevel@tonic-gate zperror2(ze->zone_name, 8967c478bd9Sstevel@tonic-gate gettext("could not get zone path")); 8977c478bd9Sstevel@tonic-gate free(ze); 8987c478bd9Sstevel@tonic-gate continue; 8997c478bd9Sstevel@tonic-gate } 9007c478bd9Sstevel@tonic-gate } 901108322fbScarlsonj (void) snprintf(path_copy, sizeof (path_copy), "%s%s", 902108322fbScarlsonj zonecfg_get_root(), ze->zone_path); 903108322fbScarlsonj res = resolvepath(path_copy, rpath, sizeof (rpath)); 9047c478bd9Sstevel@tonic-gate if (res == -1) { 9057c478bd9Sstevel@tonic-gate if (errno != ENOENT) { 906108322fbScarlsonj zperror(path_copy, B_FALSE); 9077c478bd9Sstevel@tonic-gate free(ze); 9087c478bd9Sstevel@tonic-gate return (Z_ERR); 9097c478bd9Sstevel@tonic-gate } 9107c478bd9Sstevel@tonic-gate (void) printf(gettext("WARNING: zone %s is installed, " 9117c478bd9Sstevel@tonic-gate "but its %s %s does not exist.\n"), ze->zone_name, 912108322fbScarlsonj "zonepath", path_copy); 9137c478bd9Sstevel@tonic-gate free(ze); 9147c478bd9Sstevel@tonic-gate continue; 9157c478bd9Sstevel@tonic-gate } 9167c478bd9Sstevel@tonic-gate rpath[res] = '\0'; 9177c478bd9Sstevel@tonic-gate (void) snprintf(path_copy, sizeof (path_copy), "%s/", path); 9187c478bd9Sstevel@tonic-gate (void) snprintf(rpath_copy, sizeof (rpath_copy), "%s/", rpath); 9197c478bd9Sstevel@tonic-gate if (strncmp(path_copy, rpath_copy, 9207c478bd9Sstevel@tonic-gate min(strlen(path_copy), strlen(rpath_copy))) == 0) { 9215ee84fbdSgjelinek /* 9225ee84fbdSgjelinek * TRANSLATION_NOTE 9235ee84fbdSgjelinek * zonepath is a literal that should not be translated. 9245ee84fbdSgjelinek */ 9257c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s zonepath (%s) and " 9267c478bd9Sstevel@tonic-gate "%s zonepath (%s) overlap.\n"), 9277c478bd9Sstevel@tonic-gate target_zone, path, ze->zone_name, rpath); 9287c478bd9Sstevel@tonic-gate free(ze); 9297c478bd9Sstevel@tonic-gate return (Z_ERR); 9307c478bd9Sstevel@tonic-gate } 9317c478bd9Sstevel@tonic-gate free(ze); 9327c478bd9Sstevel@tonic-gate } 9337c478bd9Sstevel@tonic-gate endzoneent(cookie); 9347c478bd9Sstevel@tonic-gate return (Z_OK); 9357c478bd9Sstevel@tonic-gate } 9367c478bd9Sstevel@tonic-gate 9377c478bd9Sstevel@tonic-gate static int 9387c478bd9Sstevel@tonic-gate validate_zonepath(char *path, int cmd_num) 9397c478bd9Sstevel@tonic-gate { 9407c478bd9Sstevel@tonic-gate int res; /* result of last library/system call */ 9417c478bd9Sstevel@tonic-gate boolean_t err = B_FALSE; /* have we run into an error? */ 9427c478bd9Sstevel@tonic-gate struct stat stbuf; 9433f2f09c1Sdp struct statvfs64 vfsbuf; 9447c478bd9Sstevel@tonic-gate char rpath[MAXPATHLEN]; /* resolved path */ 9457c478bd9Sstevel@tonic-gate char ppath[MAXPATHLEN]; /* parent path */ 9467c478bd9Sstevel@tonic-gate char rppath[MAXPATHLEN]; /* resolved parent path */ 9477c478bd9Sstevel@tonic-gate char rootpath[MAXPATHLEN]; /* root path */ 9487c478bd9Sstevel@tonic-gate zone_state_t state; 9497c478bd9Sstevel@tonic-gate 9507c478bd9Sstevel@tonic-gate if (path[0] != '/') { 9517c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 9527c478bd9Sstevel@tonic-gate gettext("%s is not an absolute path.\n"), path); 9537c478bd9Sstevel@tonic-gate return (Z_ERR); 9547c478bd9Sstevel@tonic-gate } 9557c478bd9Sstevel@tonic-gate if ((res = resolvepath(path, rpath, sizeof (rpath))) == -1) { 9567c478bd9Sstevel@tonic-gate if ((errno != ENOENT) || 957865e09a4Sgjelinek (cmd_num != CMD_VERIFY && cmd_num != CMD_INSTALL && 958865e09a4Sgjelinek cmd_num != CMD_CLONE && cmd_num != CMD_MOVE)) { 9597c478bd9Sstevel@tonic-gate zperror(path, B_FALSE); 9607c478bd9Sstevel@tonic-gate return (Z_ERR); 9617c478bd9Sstevel@tonic-gate } 9627c478bd9Sstevel@tonic-gate if (cmd_num == CMD_VERIFY) { 9635ee84fbdSgjelinek /* 9645ee84fbdSgjelinek * TRANSLATION_NOTE 9655ee84fbdSgjelinek * zoneadm is a literal that should not be translated. 9665ee84fbdSgjelinek */ 9677c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("WARNING: %s does not " 9685ee84fbdSgjelinek "exist, so it could not be verified.\nWhen " 9695ee84fbdSgjelinek "'zoneadm %s' is run, '%s' will try to create\n%s, " 9705ee84fbdSgjelinek "and '%s' will be tried again,\nbut the '%s' may " 9715ee84fbdSgjelinek "fail if:\nthe parent directory of %s is group- or " 9725ee84fbdSgjelinek "other-writable\nor\n%s overlaps with any other " 9737c478bd9Sstevel@tonic-gate "installed zones.\n"), path, 9747c478bd9Sstevel@tonic-gate cmd_to_str(CMD_INSTALL), cmd_to_str(CMD_INSTALL), 9757c478bd9Sstevel@tonic-gate path, cmd_to_str(CMD_VERIFY), 9767c478bd9Sstevel@tonic-gate cmd_to_str(CMD_VERIFY), path, path); 9777c478bd9Sstevel@tonic-gate return (Z_OK); 9787c478bd9Sstevel@tonic-gate } 9797c478bd9Sstevel@tonic-gate /* 9807c478bd9Sstevel@tonic-gate * The zonepath is supposed to be mode 700 but its 9817c478bd9Sstevel@tonic-gate * parent(s) 755. So use 755 on the mkdirp() then 9827c478bd9Sstevel@tonic-gate * chmod() the zonepath itself to 700. 9837c478bd9Sstevel@tonic-gate */ 9847c478bd9Sstevel@tonic-gate if (mkdirp(path, DEFAULT_DIR_MODE) < 0) { 9857c478bd9Sstevel@tonic-gate zperror(path, B_FALSE); 9867c478bd9Sstevel@tonic-gate return (Z_ERR); 9877c478bd9Sstevel@tonic-gate } 9887c478bd9Sstevel@tonic-gate /* 9897c478bd9Sstevel@tonic-gate * If the chmod() fails, report the error, but might 9907c478bd9Sstevel@tonic-gate * as well continue the verify procedure. 9917c478bd9Sstevel@tonic-gate */ 9927c478bd9Sstevel@tonic-gate if (chmod(path, S_IRWXU) != 0) 9937c478bd9Sstevel@tonic-gate zperror(path, B_FALSE); 9947c478bd9Sstevel@tonic-gate /* 9957c478bd9Sstevel@tonic-gate * Since the mkdir() succeeded, we should not have to 9967c478bd9Sstevel@tonic-gate * worry about a subsequent ENOENT, thus this should 9977c478bd9Sstevel@tonic-gate * only recurse once. 9987c478bd9Sstevel@tonic-gate */ 999865e09a4Sgjelinek return (validate_zonepath(path, cmd_num)); 10007c478bd9Sstevel@tonic-gate } 10017c478bd9Sstevel@tonic-gate rpath[res] = '\0'; 10027c478bd9Sstevel@tonic-gate if (strcmp(path, rpath) != 0) { 10037c478bd9Sstevel@tonic-gate errno = Z_RESOLVED_PATH; 10047c478bd9Sstevel@tonic-gate zperror(path, B_TRUE); 10057c478bd9Sstevel@tonic-gate return (Z_ERR); 10067c478bd9Sstevel@tonic-gate } 10077c478bd9Sstevel@tonic-gate if ((res = stat(rpath, &stbuf)) != 0) { 10087c478bd9Sstevel@tonic-gate zperror(rpath, B_FALSE); 10097c478bd9Sstevel@tonic-gate return (Z_ERR); 10107c478bd9Sstevel@tonic-gate } 10117c478bd9Sstevel@tonic-gate if (!S_ISDIR(stbuf.st_mode)) { 10127c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s is not a directory.\n"), 10137c478bd9Sstevel@tonic-gate rpath); 10147c478bd9Sstevel@tonic-gate return (Z_ERR); 10157c478bd9Sstevel@tonic-gate } 10164fceebdfSblakej if (strcmp(stbuf.st_fstype, MNTTYPE_TMPFS) == 0) { 10177c478bd9Sstevel@tonic-gate (void) printf(gettext("WARNING: %s is on a temporary " 10180b5de56dSgjelinek "file system.\n"), rpath); 10197c478bd9Sstevel@tonic-gate } 10207c478bd9Sstevel@tonic-gate if (crosscheck_zonepaths(rpath) != Z_OK) 10217c478bd9Sstevel@tonic-gate return (Z_ERR); 10227c478bd9Sstevel@tonic-gate /* 10237c478bd9Sstevel@tonic-gate * Try to collect and report as many minor errors as possible 10247c478bd9Sstevel@tonic-gate * before returning, so the user can learn everything that needs 10257c478bd9Sstevel@tonic-gate * to be fixed up front. 10267c478bd9Sstevel@tonic-gate */ 10277c478bd9Sstevel@tonic-gate if (stbuf.st_uid != 0) { 10287c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s is not owned by root.\n"), 10297c478bd9Sstevel@tonic-gate rpath); 10307c478bd9Sstevel@tonic-gate err = B_TRUE; 1031b6831eafSAlexander Eremin 1032b6831eafSAlexander Eremin /* Try to change owner */ 1033b6831eafSAlexander Eremin if (cmd_num != CMD_VERIFY) { 1034b6831eafSAlexander Eremin (void) fprintf(stderr, gettext("%s: changing owner " 1035b6831eafSAlexander Eremin "to root.\n"), rpath); 1036b6831eafSAlexander Eremin if (chown(rpath, 0, -1) != 0) { 1037b6831eafSAlexander Eremin zperror(rpath, B_FALSE); 1038b6831eafSAlexander Eremin return (Z_ERR); 1039b6831eafSAlexander Eremin } else { 1040b6831eafSAlexander Eremin err = B_FALSE; 1041b6831eafSAlexander Eremin } 1042b6831eafSAlexander Eremin } 10437c478bd9Sstevel@tonic-gate } 10447c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IRUSR, B_TRUE, rpath); 10457c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IWUSR, B_TRUE, rpath); 10467c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IXUSR, B_TRUE, rpath); 10477c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IRGRP, B_FALSE, rpath); 10487c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IWGRP, B_FALSE, rpath); 10497c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IXGRP, B_FALSE, rpath); 10507c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IROTH, B_FALSE, rpath); 10517c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IWOTH, B_FALSE, rpath); 10527c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IXOTH, B_FALSE, rpath); 10537c478bd9Sstevel@tonic-gate 1054b6831eafSAlexander Eremin /* If the group perms are wrong, fix them */ 1055b6831eafSAlexander Eremin if (err && (cmd_num != CMD_VERIFY)) { 1056b6831eafSAlexander Eremin (void) fprintf(stderr, gettext("%s: changing permissions " 1057b6831eafSAlexander Eremin "to 0700.\n"), rpath); 1058b6831eafSAlexander Eremin if (chmod(rpath, S_IRWXU) != 0) { 1059b6831eafSAlexander Eremin zperror(path, B_FALSE); 1060b6831eafSAlexander Eremin } else { 1061b6831eafSAlexander Eremin err = B_FALSE; 1062b6831eafSAlexander Eremin } 1063b6831eafSAlexander Eremin } 1064b6831eafSAlexander Eremin 10657c478bd9Sstevel@tonic-gate (void) snprintf(ppath, sizeof (ppath), "%s/..", path); 10667c478bd9Sstevel@tonic-gate if ((res = resolvepath(ppath, rppath, sizeof (rppath))) == -1) { 10677c478bd9Sstevel@tonic-gate zperror(ppath, B_FALSE); 10687c478bd9Sstevel@tonic-gate return (Z_ERR); 10697c478bd9Sstevel@tonic-gate } 10707c478bd9Sstevel@tonic-gate rppath[res] = '\0'; 10717c478bd9Sstevel@tonic-gate if ((res = stat(rppath, &stbuf)) != 0) { 10727c478bd9Sstevel@tonic-gate zperror(rppath, B_FALSE); 10737c478bd9Sstevel@tonic-gate return (Z_ERR); 10747c478bd9Sstevel@tonic-gate } 10757c478bd9Sstevel@tonic-gate /* theoretically impossible */ 10767c478bd9Sstevel@tonic-gate if (!S_ISDIR(stbuf.st_mode)) { 10777c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s is not a directory.\n"), 10787c478bd9Sstevel@tonic-gate rppath); 10797c478bd9Sstevel@tonic-gate return (Z_ERR); 10807c478bd9Sstevel@tonic-gate } 10817c478bd9Sstevel@tonic-gate if (stbuf.st_uid != 0) { 10827c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s is not owned by root.\n"), 10837c478bd9Sstevel@tonic-gate rppath); 10847c478bd9Sstevel@tonic-gate err = B_TRUE; 10857c478bd9Sstevel@tonic-gate } 10867c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IRUSR, B_TRUE, rppath); 10877c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IWUSR, B_TRUE, rppath); 10887c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IXUSR, B_TRUE, rppath); 10897c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IWGRP, B_FALSE, rppath); 10907c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IWOTH, B_FALSE, rppath); 10917c478bd9Sstevel@tonic-gate if (strcmp(rpath, rppath) == 0) { 10927c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s is its own parent.\n"), 10937c478bd9Sstevel@tonic-gate rppath); 10947c478bd9Sstevel@tonic-gate err = B_TRUE; 10957c478bd9Sstevel@tonic-gate } 10967c478bd9Sstevel@tonic-gate 10973f2f09c1Sdp if (statvfs64(rpath, &vfsbuf) != 0) { 10987c478bd9Sstevel@tonic-gate zperror(rpath, B_FALSE); 10997c478bd9Sstevel@tonic-gate return (Z_ERR); 11007c478bd9Sstevel@tonic-gate } 1101b5abaf04Sgjelinek if (strcmp(vfsbuf.f_basetype, MNTTYPE_NFS) == 0) { 11025ee84fbdSgjelinek /* 11035ee84fbdSgjelinek * TRANSLATION_NOTE 11045ee84fbdSgjelinek * Zonepath and NFS are literals that should not be translated. 11055ee84fbdSgjelinek */ 11065ee84fbdSgjelinek (void) fprintf(stderr, gettext("Zonepath %s is on an NFS " 11070b5de56dSgjelinek "mounted file system.\n" 11080b5de56dSgjelinek "\tA local file system must be used.\n"), rpath); 1109b5abaf04Sgjelinek return (Z_ERR); 1110b5abaf04Sgjelinek } 1111b5abaf04Sgjelinek if (vfsbuf.f_flag & ST_NOSUID) { 11125ee84fbdSgjelinek /* 11135ee84fbdSgjelinek * TRANSLATION_NOTE 11145ee84fbdSgjelinek * Zonepath and nosuid are literals that should not be 11155ee84fbdSgjelinek * translated. 11165ee84fbdSgjelinek */ 1117b5abaf04Sgjelinek (void) fprintf(stderr, gettext("Zonepath %s is on a nosuid " 11180b5de56dSgjelinek "file system.\n"), rpath); 11197c478bd9Sstevel@tonic-gate return (Z_ERR); 11207c478bd9Sstevel@tonic-gate } 11217c478bd9Sstevel@tonic-gate 11227c478bd9Sstevel@tonic-gate if ((res = zone_get_state(target_zone, &state)) != Z_OK) { 11237c478bd9Sstevel@tonic-gate errno = res; 11247c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not get state")); 11257c478bd9Sstevel@tonic-gate return (Z_ERR); 11267c478bd9Sstevel@tonic-gate } 11277c478bd9Sstevel@tonic-gate /* 11287c478bd9Sstevel@tonic-gate * The existence of the root path is only bad in the configured state, 11297c478bd9Sstevel@tonic-gate * as it is *supposed* to be there at the installed and later states. 1130ee519a1fSgjelinek * However, the root path is expected to be there if the zone is 1131ee519a1fSgjelinek * detached. 11327c478bd9Sstevel@tonic-gate * State/command mismatches are caught earlier in verify_details(). 11337c478bd9Sstevel@tonic-gate */ 1134ee519a1fSgjelinek if (state == ZONE_STATE_CONFIGURED && cmd_num != CMD_ATTACH) { 11357c478bd9Sstevel@tonic-gate if (snprintf(rootpath, sizeof (rootpath), "%s/root", rpath) >= 11367c478bd9Sstevel@tonic-gate sizeof (rootpath)) { 11375ee84fbdSgjelinek /* 11385ee84fbdSgjelinek * TRANSLATION_NOTE 11395ee84fbdSgjelinek * Zonepath is a literal that should not be translated. 11405ee84fbdSgjelinek */ 11417c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 11427c478bd9Sstevel@tonic-gate gettext("Zonepath %s is too long.\n"), rpath); 11437c478bd9Sstevel@tonic-gate return (Z_ERR); 11447c478bd9Sstevel@tonic-gate } 11457c478bd9Sstevel@tonic-gate if ((res = stat(rootpath, &stbuf)) == 0) { 1146c4a45622S if (zonecfg_detached(rpath)) { 1147ee519a1fSgjelinek (void) fprintf(stderr, 1148ee519a1fSgjelinek gettext("Cannot %s detached " 1149ee519a1fSgjelinek "zone.\nUse attach or remove %s " 1150ee519a1fSgjelinek "directory.\n"), cmd_to_str(cmd_num), 1151ee519a1fSgjelinek rpath); 11527c478bd9Sstevel@tonic-gate return (Z_ERR); 11537c478bd9Sstevel@tonic-gate } 1154c4a45622S 1155c4a45622S /* Not detached, check if it really looks ok. */ 1156c4a45622S 1157c4a45622S if (!S_ISDIR(stbuf.st_mode)) { 1158c4a45622S (void) fprintf(stderr, gettext("%s is not a " 1159c4a45622S "directory.\n"), rootpath); 1160c4a45622S return (Z_ERR); 1161c4a45622S } 1162c4a45622S 1163c4a45622S if (stbuf.st_uid != 0) { 1164c4a45622S (void) fprintf(stderr, gettext("%s is not " 1165c4a45622S "owned by root.\n"), rootpath); 1166c4a45622S return (Z_ERR); 1167c4a45622S } 1168c4a45622S 1169c4a45622S if ((stbuf.st_mode & 0777) != 0755) { 1170c4a45622S (void) fprintf(stderr, gettext("%s mode is not " 1171c4a45622S "0755.\n"), rootpath); 1172c4a45622S return (Z_ERR); 1173c4a45622S } 1174c4a45622S } 11757c478bd9Sstevel@tonic-gate } 11767c478bd9Sstevel@tonic-gate 11777c478bd9Sstevel@tonic-gate return (err ? Z_ERR : Z_OK); 11787c478bd9Sstevel@tonic-gate } 11797c478bd9Sstevel@tonic-gate 11807c478bd9Sstevel@tonic-gate static int 1181ce28b40eSzt129084 invoke_brand_handler(int cmd_num, char *argv[]) 1182ce28b40eSzt129084 { 1183ce28b40eSzt129084 zone_dochandle_t handle; 1184ce28b40eSzt129084 int err; 1185ce28b40eSzt129084 1186ce28b40eSzt129084 if ((handle = zonecfg_init_handle()) == NULL) { 1187ce28b40eSzt129084 zperror(cmd_to_str(cmd_num), B_TRUE); 1188ce28b40eSzt129084 return (Z_ERR); 1189ce28b40eSzt129084 } 1190ce28b40eSzt129084 if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) { 1191ce28b40eSzt129084 errno = err; 1192ce28b40eSzt129084 zperror(cmd_to_str(cmd_num), B_TRUE); 1193ce28b40eSzt129084 zonecfg_fini_handle(handle); 1194ce28b40eSzt129084 return (Z_ERR); 1195ce28b40eSzt129084 } 1196ce28b40eSzt129084 if (verify_brand(handle, cmd_num, argv) != Z_OK) { 1197ce28b40eSzt129084 zonecfg_fini_handle(handle); 1198ce28b40eSzt129084 return (Z_ERR); 1199ce28b40eSzt129084 } 1200ce28b40eSzt129084 zonecfg_fini_handle(handle); 1201ce28b40eSzt129084 return (Z_OK); 1202ce28b40eSzt129084 } 1203ce28b40eSzt129084 1204ce28b40eSzt129084 static int 12057c478bd9Sstevel@tonic-gate ready_func(int argc, char *argv[]) 12067c478bd9Sstevel@tonic-gate { 12077c478bd9Sstevel@tonic-gate zone_cmd_arg_t zarg; 12087c478bd9Sstevel@tonic-gate int arg; 12097c478bd9Sstevel@tonic-gate 1210108322fbScarlsonj if (zonecfg_in_alt_root()) { 1211108322fbScarlsonj zerror(gettext("cannot ready zone in alternate root")); 1212108322fbScarlsonj return (Z_ERR); 1213108322fbScarlsonj } 1214108322fbScarlsonj 12157c478bd9Sstevel@tonic-gate optind = 0; 12167c478bd9Sstevel@tonic-gate if ((arg = getopt(argc, argv, "?")) != EOF) { 12177c478bd9Sstevel@tonic-gate switch (arg) { 12187c478bd9Sstevel@tonic-gate case '?': 12197c478bd9Sstevel@tonic-gate sub_usage(SHELP_READY, CMD_READY); 12207c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 12217c478bd9Sstevel@tonic-gate default: 12227c478bd9Sstevel@tonic-gate sub_usage(SHELP_READY, CMD_READY); 12237c478bd9Sstevel@tonic-gate return (Z_USAGE); 12247c478bd9Sstevel@tonic-gate } 12257c478bd9Sstevel@tonic-gate } 12267c478bd9Sstevel@tonic-gate if (argc > optind) { 12277c478bd9Sstevel@tonic-gate sub_usage(SHELP_READY, CMD_READY); 12287c478bd9Sstevel@tonic-gate return (Z_USAGE); 12297c478bd9Sstevel@tonic-gate } 12309acbbeafSnn35248 if (sanity_check(target_zone, CMD_READY, B_FALSE, B_FALSE, B_FALSE) 12319acbbeafSnn35248 != Z_OK) 12327c478bd9Sstevel@tonic-gate return (Z_ERR); 1233ce28b40eSzt129084 if (verify_details(CMD_READY, argv) != Z_OK) 12347c478bd9Sstevel@tonic-gate return (Z_ERR); 12357c478bd9Sstevel@tonic-gate 12367c478bd9Sstevel@tonic-gate zarg.cmd = Z_READY; 1237ff17c8bfSgjelinek if (zonecfg_call_zoneadmd(target_zone, &zarg, locale, B_TRUE) != 0) { 12387c478bd9Sstevel@tonic-gate zerror(gettext("call to %s failed"), "zoneadmd"); 12397c478bd9Sstevel@tonic-gate return (Z_ERR); 12407c478bd9Sstevel@tonic-gate } 12417c478bd9Sstevel@tonic-gate return (Z_OK); 12427c478bd9Sstevel@tonic-gate } 12437c478bd9Sstevel@tonic-gate 12447c478bd9Sstevel@tonic-gate static int 12457c478bd9Sstevel@tonic-gate boot_func(int argc, char *argv[]) 12467c478bd9Sstevel@tonic-gate { 12477c478bd9Sstevel@tonic-gate zone_cmd_arg_t zarg; 12489acbbeafSnn35248 boolean_t force = B_FALSE; 12497c478bd9Sstevel@tonic-gate int arg; 12507c478bd9Sstevel@tonic-gate 1251108322fbScarlsonj if (zonecfg_in_alt_root()) { 1252108322fbScarlsonj zerror(gettext("cannot boot zone in alternate root")); 1253108322fbScarlsonj return (Z_ERR); 1254108322fbScarlsonj } 1255108322fbScarlsonj 12567c478bd9Sstevel@tonic-gate zarg.bootbuf[0] = '\0'; 12577c478bd9Sstevel@tonic-gate 12587c478bd9Sstevel@tonic-gate /* 12593f2f09c1Sdp * The following getopt processes arguments to zone boot; that 12603f2f09c1Sdp * is to say, the [here] portion of the argument string: 12613f2f09c1Sdp * 12623f2f09c1Sdp * zoneadm -z myzone boot [here] -- -v -m verbose 12633f2f09c1Sdp * 12643f2f09c1Sdp * Where [here] can either be nothing, -? (in which case we bail 12659acbbeafSnn35248 * and print usage), -f (a private option to indicate that the 12669acbbeafSnn35248 * boot operation should be 'forced'), or -s. Support for -s is 12679acbbeafSnn35248 * vestigal and obsolete, but is retained because it was a 12689acbbeafSnn35248 * documented interface and there are known consumers including 12699acbbeafSnn35248 * admin/install; the proper way to specify boot arguments like -s 12709acbbeafSnn35248 * is: 12713f2f09c1Sdp * 12723f2f09c1Sdp * zoneadm -z myzone boot -- -s -v -m verbose. 12737c478bd9Sstevel@tonic-gate */ 12747c478bd9Sstevel@tonic-gate optind = 0; 12759acbbeafSnn35248 while ((arg = getopt(argc, argv, "?fs")) != EOF) { 12767c478bd9Sstevel@tonic-gate switch (arg) { 12777c478bd9Sstevel@tonic-gate case '?': 12787c478bd9Sstevel@tonic-gate sub_usage(SHELP_BOOT, CMD_BOOT); 12797c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 12807c478bd9Sstevel@tonic-gate case 's': 12817c478bd9Sstevel@tonic-gate (void) strlcpy(zarg.bootbuf, "-s", 12827c478bd9Sstevel@tonic-gate sizeof (zarg.bootbuf)); 12837c478bd9Sstevel@tonic-gate break; 12849acbbeafSnn35248 case 'f': 12859acbbeafSnn35248 force = B_TRUE; 12869acbbeafSnn35248 break; 12877c478bd9Sstevel@tonic-gate default: 12887c478bd9Sstevel@tonic-gate sub_usage(SHELP_BOOT, CMD_BOOT); 12897c478bd9Sstevel@tonic-gate return (Z_USAGE); 12907c478bd9Sstevel@tonic-gate } 12917c478bd9Sstevel@tonic-gate } 12923f2f09c1Sdp 12933f2f09c1Sdp for (; optind < argc; optind++) { 12943f2f09c1Sdp if (strlcat(zarg.bootbuf, argv[optind], 12953f2f09c1Sdp sizeof (zarg.bootbuf)) >= sizeof (zarg.bootbuf)) { 12963f2f09c1Sdp zerror(gettext("Boot argument list too long")); 12973f2f09c1Sdp return (Z_ERR); 12987c478bd9Sstevel@tonic-gate } 12993f2f09c1Sdp if (optind < argc - 1) 13003f2f09c1Sdp if (strlcat(zarg.bootbuf, " ", sizeof (zarg.bootbuf)) >= 13013f2f09c1Sdp sizeof (zarg.bootbuf)) { 13023f2f09c1Sdp zerror(gettext("Boot argument list too long")); 13033f2f09c1Sdp return (Z_ERR); 13043f2f09c1Sdp } 13053f2f09c1Sdp } 13069acbbeafSnn35248 if (sanity_check(target_zone, CMD_BOOT, B_FALSE, B_FALSE, force) 13079acbbeafSnn35248 != Z_OK) 13087c478bd9Sstevel@tonic-gate return (Z_ERR); 1309ce28b40eSzt129084 if (verify_details(CMD_BOOT, argv) != Z_OK) 13107c478bd9Sstevel@tonic-gate return (Z_ERR); 13119acbbeafSnn35248 zarg.cmd = force ? Z_FORCEBOOT : Z_BOOT; 1312ff17c8bfSgjelinek if (zonecfg_call_zoneadmd(target_zone, &zarg, locale, B_TRUE) != 0) { 13137c478bd9Sstevel@tonic-gate zerror(gettext("call to %s failed"), "zoneadmd"); 13147c478bd9Sstevel@tonic-gate return (Z_ERR); 13157c478bd9Sstevel@tonic-gate } 13160209230bSgjelinek 13177c478bd9Sstevel@tonic-gate return (Z_OK); 13187c478bd9Sstevel@tonic-gate } 13197c478bd9Sstevel@tonic-gate 13207c478bd9Sstevel@tonic-gate static void 13217c478bd9Sstevel@tonic-gate fake_up_local_zone(zoneid_t zid, zone_entry_t *zeptr) 13227c478bd9Sstevel@tonic-gate { 13237c478bd9Sstevel@tonic-gate ssize_t result; 1324555afedfScarlsonj uuid_t uuid; 1325555afedfScarlsonj FILE *fp; 1326f4b3ec61Sdh155122 ushort_t flags; 1327555afedfScarlsonj 1328555afedfScarlsonj (void) memset(zeptr, 0, sizeof (*zeptr)); 13297c478bd9Sstevel@tonic-gate 13307c478bd9Sstevel@tonic-gate zeptr->zid = zid; 1331555afedfScarlsonj 13327c478bd9Sstevel@tonic-gate /* 13337c478bd9Sstevel@tonic-gate * Since we're looking up our own (non-global) zone name, 13347c478bd9Sstevel@tonic-gate * we can be assured that it will succeed. 13357c478bd9Sstevel@tonic-gate */ 13367c478bd9Sstevel@tonic-gate result = getzonenamebyid(zid, zeptr->zname, sizeof (zeptr->zname)); 13377c478bd9Sstevel@tonic-gate assert(result >= 0); 1338555afedfScarlsonj if (zonecfg_is_scratch(zeptr->zname) && 1339555afedfScarlsonj (fp = zonecfg_open_scratch("", B_FALSE)) != NULL) { 1340555afedfScarlsonj (void) zonecfg_reverse_scratch(fp, zeptr->zname, zeptr->zname, 1341555afedfScarlsonj sizeof (zeptr->zname), NULL, 0); 1342555afedfScarlsonj zonecfg_close_scratch(fp); 1343555afedfScarlsonj } 1344555afedfScarlsonj 1345555afedfScarlsonj if (is_system_labeled()) { 134645916cd2Sjpk (void) zone_getattr(zid, ZONE_ATTR_ROOT, zeptr->zroot, 134745916cd2Sjpk sizeof (zeptr->zroot)); 13489acbbeafSnn35248 (void) strlcpy(zeptr->zbrand, NATIVE_BRAND_NAME, 13499acbbeafSnn35248 sizeof (zeptr->zbrand)); 1350555afedfScarlsonj } else { 1351555afedfScarlsonj (void) strlcpy(zeptr->zroot, "/", sizeof (zeptr->zroot)); 13529acbbeafSnn35248 (void) zone_getattr(zid, ZONE_ATTR_BRAND, zeptr->zbrand, 13539acbbeafSnn35248 sizeof (zeptr->zbrand)); 135445916cd2Sjpk } 1355555afedfScarlsonj 13567c478bd9Sstevel@tonic-gate zeptr->zstate_str = "running"; 1357555afedfScarlsonj if (zonecfg_get_uuid(zeptr->zname, uuid) == Z_OK && 1358555afedfScarlsonj !uuid_is_null(uuid)) 1359555afedfScarlsonj uuid_unparse(uuid, zeptr->zuuid); 1360f4b3ec61Sdh155122 1361f4b3ec61Sdh155122 if (zone_getattr(zid, ZONE_ATTR_FLAGS, &flags, sizeof (flags)) < 0) { 1362f4b3ec61Sdh155122 zperror2(zeptr->zname, gettext("could not get zone flags")); 1363f4b3ec61Sdh155122 exit(Z_ERR); 1364f4b3ec61Sdh155122 } 1365f4b3ec61Sdh155122 if (flags & ZF_NET_EXCL) 1366f4b3ec61Sdh155122 zeptr->ziptype = ZS_EXCLUSIVE; 1367f4b3ec61Sdh155122 else 1368f4b3ec61Sdh155122 zeptr->ziptype = ZS_SHARED; 13697c478bd9Sstevel@tonic-gate } 13707c478bd9Sstevel@tonic-gate 13717c478bd9Sstevel@tonic-gate static int 13727c478bd9Sstevel@tonic-gate list_func(int argc, char *argv[]) 13737c478bd9Sstevel@tonic-gate { 13747c478bd9Sstevel@tonic-gate zone_entry_t *zentp, zent; 1375108322fbScarlsonj int arg, retv; 1376*0222d5acSRyan England boolean_t output = B_FALSE, verbose = B_FALSE, parsable = B_FALSE, 1377*0222d5acSRyan England exclude_global = B_FALSE; 13787c478bd9Sstevel@tonic-gate zone_state_t min_state = ZONE_STATE_RUNNING; 13797c478bd9Sstevel@tonic-gate zoneid_t zone_id = getzoneid(); 13807c478bd9Sstevel@tonic-gate 13817c478bd9Sstevel@tonic-gate if (target_zone == NULL) { 13827c478bd9Sstevel@tonic-gate /* all zones: default view to running but allow override */ 13837c478bd9Sstevel@tonic-gate optind = 0; 1384*0222d5acSRyan England while ((arg = getopt(argc, argv, "?cinpv")) != EOF) { 13857c478bd9Sstevel@tonic-gate switch (arg) { 13867c478bd9Sstevel@tonic-gate case '?': 13877c478bd9Sstevel@tonic-gate sub_usage(SHELP_LIST, CMD_LIST); 13887c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 1389475d78a4Sjonb /* 1390475d78a4Sjonb * The 'i' and 'c' options are not mutually 1391475d78a4Sjonb * exclusive so if 'c' is given, then min_state 1392475d78a4Sjonb * is set to 0 (ZONE_STATE_CONFIGURED) which is 1393475d78a4Sjonb * the lowest possible state. If 'i' is given, 1394475d78a4Sjonb * then min_state is set to be the lowest state 1395475d78a4Sjonb * so far. 1396475d78a4Sjonb */ 13977c478bd9Sstevel@tonic-gate case 'c': 13987c478bd9Sstevel@tonic-gate min_state = ZONE_STATE_CONFIGURED; 13997c478bd9Sstevel@tonic-gate break; 14007c478bd9Sstevel@tonic-gate case 'i': 1401475d78a4Sjonb min_state = min(ZONE_STATE_INSTALLED, 1402475d78a4Sjonb min_state); 1403475d78a4Sjonb 14047c478bd9Sstevel@tonic-gate break; 1405*0222d5acSRyan England case 'n': 1406*0222d5acSRyan England exclude_global = B_TRUE; 1407*0222d5acSRyan England break; 14087c478bd9Sstevel@tonic-gate case 'p': 14097c478bd9Sstevel@tonic-gate parsable = B_TRUE; 14107c478bd9Sstevel@tonic-gate break; 14117c478bd9Sstevel@tonic-gate case 'v': 14127c478bd9Sstevel@tonic-gate verbose = B_TRUE; 14137c478bd9Sstevel@tonic-gate break; 14147c478bd9Sstevel@tonic-gate default: 14157c478bd9Sstevel@tonic-gate sub_usage(SHELP_LIST, CMD_LIST); 14167c478bd9Sstevel@tonic-gate return (Z_USAGE); 14177c478bd9Sstevel@tonic-gate } 14187c478bd9Sstevel@tonic-gate } 14197c478bd9Sstevel@tonic-gate if (parsable && verbose) { 14207c478bd9Sstevel@tonic-gate zerror(gettext("%s -p and -v are mutually exclusive."), 14217c478bd9Sstevel@tonic-gate cmd_to_str(CMD_LIST)); 14227c478bd9Sstevel@tonic-gate return (Z_ERR); 14237c478bd9Sstevel@tonic-gate } 142445916cd2Sjpk if (zone_id == GLOBAL_ZONEID || is_system_labeled()) { 1425*0222d5acSRyan England retv = zone_print_list(min_state, verbose, parsable, 1426*0222d5acSRyan England exclude_global); 14277c478bd9Sstevel@tonic-gate } else { 14287c478bd9Sstevel@tonic-gate fake_up_local_zone(zone_id, &zent); 14299acbbeafSnn35248 retv = Z_OK; 14307c478bd9Sstevel@tonic-gate zone_print(&zent, verbose, parsable); 14317c478bd9Sstevel@tonic-gate } 1432108322fbScarlsonj return (retv); 14337c478bd9Sstevel@tonic-gate } 14347c478bd9Sstevel@tonic-gate 14357c478bd9Sstevel@tonic-gate /* 1436*0222d5acSRyan England * Specific target zone: disallow -i/-c/-n suboptions. 14377c478bd9Sstevel@tonic-gate */ 14387c478bd9Sstevel@tonic-gate optind = 0; 14397c478bd9Sstevel@tonic-gate while ((arg = getopt(argc, argv, "?pv")) != EOF) { 14407c478bd9Sstevel@tonic-gate switch (arg) { 14417c478bd9Sstevel@tonic-gate case '?': 14427c478bd9Sstevel@tonic-gate sub_usage(SHELP_LIST, CMD_LIST); 14437c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 14447c478bd9Sstevel@tonic-gate case 'p': 14457c478bd9Sstevel@tonic-gate parsable = B_TRUE; 14467c478bd9Sstevel@tonic-gate break; 14477c478bd9Sstevel@tonic-gate case 'v': 14487c478bd9Sstevel@tonic-gate verbose = B_TRUE; 14497c478bd9Sstevel@tonic-gate break; 14507c478bd9Sstevel@tonic-gate default: 14517c478bd9Sstevel@tonic-gate sub_usage(SHELP_LIST, CMD_LIST); 14527c478bd9Sstevel@tonic-gate return (Z_USAGE); 14537c478bd9Sstevel@tonic-gate } 14547c478bd9Sstevel@tonic-gate } 14557c478bd9Sstevel@tonic-gate if (parsable && verbose) { 14567c478bd9Sstevel@tonic-gate zerror(gettext("%s -p and -v are mutually exclusive."), 14577c478bd9Sstevel@tonic-gate cmd_to_str(CMD_LIST)); 14587c478bd9Sstevel@tonic-gate return (Z_ERR); 14597c478bd9Sstevel@tonic-gate } 14607c478bd9Sstevel@tonic-gate if (argc > optind) { 14617c478bd9Sstevel@tonic-gate sub_usage(SHELP_LIST, CMD_LIST); 14627c478bd9Sstevel@tonic-gate return (Z_USAGE); 14637c478bd9Sstevel@tonic-gate } 14642ec67e04Sgjelinek if (zone_id != GLOBAL_ZONEID && !is_system_labeled()) { 14657c478bd9Sstevel@tonic-gate fake_up_local_zone(zone_id, &zent); 14667c478bd9Sstevel@tonic-gate /* 14677c478bd9Sstevel@tonic-gate * main() will issue a Z_NO_ZONE error if it cannot get an 14687c478bd9Sstevel@tonic-gate * id for target_zone, which in a non-global zone should 14697c478bd9Sstevel@tonic-gate * happen for any zone name except `zonename`. Thus we 14707c478bd9Sstevel@tonic-gate * assert() that here but don't otherwise check. 14717c478bd9Sstevel@tonic-gate */ 14727c478bd9Sstevel@tonic-gate assert(strcmp(zent.zname, target_zone) == 0); 14737c478bd9Sstevel@tonic-gate zone_print(&zent, verbose, parsable); 14747c478bd9Sstevel@tonic-gate output = B_TRUE; 14757c478bd9Sstevel@tonic-gate } else if ((zentp = lookup_running_zone(target_zone)) != NULL) { 14767c478bd9Sstevel@tonic-gate zone_print(zentp, verbose, parsable); 14777c478bd9Sstevel@tonic-gate output = B_TRUE; 1478108322fbScarlsonj } else if (lookup_zone_info(target_zone, ZONE_ID_UNDEFINED, 1479108322fbScarlsonj &zent) == Z_OK) { 14807c478bd9Sstevel@tonic-gate zone_print(&zent, verbose, parsable); 14817c478bd9Sstevel@tonic-gate output = B_TRUE; 14827c478bd9Sstevel@tonic-gate } 1483ce28b40eSzt129084 1484ce28b40eSzt129084 /* 1485ce28b40eSzt129084 * Invoke brand-specific handler. Note that we do this 1486db628066Sgjelinek * only if we're in the global zone, and target_zone is specified 1487db628066Sgjelinek * and it is not the global zone. 1488ce28b40eSzt129084 */ 1489db628066Sgjelinek if (zone_id == GLOBAL_ZONEID && target_zone != NULL && 1490db628066Sgjelinek strcmp(target_zone, GLOBAL_ZONENAME) != 0) 1491ce28b40eSzt129084 if (invoke_brand_handler(CMD_LIST, argv) != Z_OK) 1492ce28b40eSzt129084 return (Z_ERR); 1493ce28b40eSzt129084 14947c478bd9Sstevel@tonic-gate return (output ? Z_OK : Z_ERR); 14957c478bd9Sstevel@tonic-gate } 14967c478bd9Sstevel@tonic-gate 1497ff17c8bfSgjelinek int 1498c75cc341S do_subproc(char *cmdbuf) 14999acbbeafSnn35248 { 15009acbbeafSnn35248 void (*saveint)(int); 15019acbbeafSnn35248 void (*saveterm)(int); 15029acbbeafSnn35248 void (*savequit)(int); 15039acbbeafSnn35248 void (*savehup)(int); 15049acbbeafSnn35248 int pid, child, status; 15059acbbeafSnn35248 15069acbbeafSnn35248 if ((child = vfork()) == 0) { 15079acbbeafSnn35248 (void) execl("/bin/sh", "sh", "-c", cmdbuf, (char *)NULL); 15089acbbeafSnn35248 } 15099acbbeafSnn35248 15109acbbeafSnn35248 if (child == -1) 15119acbbeafSnn35248 return (-1); 15129acbbeafSnn35248 15139acbbeafSnn35248 saveint = sigset(SIGINT, SIG_IGN); 15149acbbeafSnn35248 saveterm = sigset(SIGTERM, SIG_IGN); 15159acbbeafSnn35248 savequit = sigset(SIGQUIT, SIG_IGN); 15169acbbeafSnn35248 savehup = sigset(SIGHUP, SIG_IGN); 15179acbbeafSnn35248 15189acbbeafSnn35248 while ((pid = waitpid(child, &status, 0)) != child && pid != -1) 15199acbbeafSnn35248 ; 15209acbbeafSnn35248 15219acbbeafSnn35248 (void) sigset(SIGINT, saveint); 15229acbbeafSnn35248 (void) sigset(SIGTERM, saveterm); 15239acbbeafSnn35248 (void) sigset(SIGQUIT, savequit); 15249acbbeafSnn35248 (void) sigset(SIGHUP, savehup); 15259acbbeafSnn35248 15269acbbeafSnn35248 return (pid == -1 ? -1 : status); 15279acbbeafSnn35248 } 15289acbbeafSnn35248 1529ff17c8bfSgjelinek int 15309acbbeafSnn35248 subproc_status(const char *cmd, int status, boolean_t verbose_failure) 15317c478bd9Sstevel@tonic-gate { 15327c478bd9Sstevel@tonic-gate if (WIFEXITED(status)) { 15337c478bd9Sstevel@tonic-gate int exit_code = WEXITSTATUS(status); 15347c478bd9Sstevel@tonic-gate 15359acbbeafSnn35248 if ((verbose_failure) && (exit_code != ZONE_SUBPROC_OK)) 15367c478bd9Sstevel@tonic-gate zerror(gettext("'%s' failed with exit code %d."), cmd, 15377c478bd9Sstevel@tonic-gate exit_code); 15389acbbeafSnn35248 15399acbbeafSnn35248 return (exit_code); 15407c478bd9Sstevel@tonic-gate } else if (WIFSIGNALED(status)) { 15417c478bd9Sstevel@tonic-gate int signal = WTERMSIG(status); 15427c478bd9Sstevel@tonic-gate char sigstr[SIG2STR_MAX]; 15437c478bd9Sstevel@tonic-gate 15447c478bd9Sstevel@tonic-gate if (sig2str(signal, sigstr) == 0) { 15457c478bd9Sstevel@tonic-gate zerror(gettext("'%s' terminated by signal SIG%s."), cmd, 15467c478bd9Sstevel@tonic-gate sigstr); 15477c478bd9Sstevel@tonic-gate } else { 15487c478bd9Sstevel@tonic-gate zerror(gettext("'%s' terminated by an unknown signal."), 15497c478bd9Sstevel@tonic-gate cmd); 15507c478bd9Sstevel@tonic-gate } 15517c478bd9Sstevel@tonic-gate } else { 15527c478bd9Sstevel@tonic-gate zerror(gettext("'%s' failed for unknown reasons."), cmd); 15537c478bd9Sstevel@tonic-gate } 15549acbbeafSnn35248 15559acbbeafSnn35248 /* 15569acbbeafSnn35248 * Assume a subprocess that died due to a signal or an unknown error 15579acbbeafSnn35248 * should be considered an exit code of ZONE_SUBPROC_FATAL, as the 15589acbbeafSnn35248 * user will likely need to do some manual cleanup. 15599acbbeafSnn35248 */ 15609acbbeafSnn35248 return (ZONE_SUBPROC_FATAL); 15617c478bd9Sstevel@tonic-gate } 15627c478bd9Sstevel@tonic-gate 1563cb8a054bSGlenn Faden static int 1564cb8a054bSGlenn Faden auth_check(char *user, char *zone, int cmd_num) 1565cb8a054bSGlenn Faden { 1566cb8a054bSGlenn Faden char authname[MAXAUTHS]; 1567cb8a054bSGlenn Faden 1568cb8a054bSGlenn Faden switch (cmd_num) { 1569cb8a054bSGlenn Faden case CMD_LIST: 1570cb8a054bSGlenn Faden case CMD_HELP: 1571cb8a054bSGlenn Faden return (Z_OK); 1572cb8a054bSGlenn Faden case SOURCE_ZONE: 1573cb8a054bSGlenn Faden (void) strlcpy(authname, ZONE_CLONEFROM_AUTH, MAXAUTHS); 1574cb8a054bSGlenn Faden break; 1575cb8a054bSGlenn Faden case CMD_BOOT: 1576cb8a054bSGlenn Faden case CMD_HALT: 1577cb8a054bSGlenn Faden case CMD_READY: 15783c7284bdSAlexander Eremin case CMD_SHUTDOWN: 1579cb8a054bSGlenn Faden case CMD_REBOOT: 1580cb8a054bSGlenn Faden case CMD_SYSBOOT: 1581cb8a054bSGlenn Faden case CMD_VERIFY: 1582cb8a054bSGlenn Faden case CMD_INSTALL: 1583cb8a054bSGlenn Faden case CMD_UNINSTALL: 1584cb8a054bSGlenn Faden case CMD_MOUNT: 1585cb8a054bSGlenn Faden case CMD_UNMOUNT: 1586cb8a054bSGlenn Faden case CMD_CLONE: 1587cb8a054bSGlenn Faden case CMD_MOVE: 1588cb8a054bSGlenn Faden case CMD_DETACH: 1589cb8a054bSGlenn Faden case CMD_ATTACH: 1590cb8a054bSGlenn Faden case CMD_MARK: 1591cb8a054bSGlenn Faden case CMD_APPLY: 1592cb8a054bSGlenn Faden default: 1593cb8a054bSGlenn Faden (void) strlcpy(authname, ZONE_MANAGE_AUTH, MAXAUTHS); 1594cb8a054bSGlenn Faden break; 1595cb8a054bSGlenn Faden } 1596cb8a054bSGlenn Faden (void) strlcat(authname, KV_OBJECT, MAXAUTHS); 1597cb8a054bSGlenn Faden (void) strlcat(authname, zone, MAXAUTHS); 1598cb8a054bSGlenn Faden if (chkauthattr(authname, user) == 0) { 1599cb8a054bSGlenn Faden return (Z_ERR); 1600cb8a054bSGlenn Faden } else { 1601cb8a054bSGlenn Faden /* 1602cb8a054bSGlenn Faden * Some subcommands, e.g. install, run subcommands, 1603cb8a054bSGlenn Faden * e.g. sysidcfg, that require a real uid of root, 1604cb8a054bSGlenn Faden * so switch to root, here. 1605cb8a054bSGlenn Faden */ 1606cb8a054bSGlenn Faden if (setuid(0) == -1) { 1607cb8a054bSGlenn Faden zperror(gettext("insufficient privilege"), B_TRUE); 1608cb8a054bSGlenn Faden return (Z_ERR); 1609cb8a054bSGlenn Faden } 1610cb8a054bSGlenn Faden return (Z_OK); 1611cb8a054bSGlenn Faden } 1612cb8a054bSGlenn Faden } 1613cb8a054bSGlenn Faden 16147c478bd9Sstevel@tonic-gate /* 16157c478bd9Sstevel@tonic-gate * Various sanity checks; make sure: 16167c478bd9Sstevel@tonic-gate * 1. We're in the global zone. 16177c478bd9Sstevel@tonic-gate * 2. The calling user has sufficient privilege. 16187c478bd9Sstevel@tonic-gate * 3. The target zone is neither the global zone nor anything starting with 16197c478bd9Sstevel@tonic-gate * "SUNW". 16207c478bd9Sstevel@tonic-gate * 4a. If we're looking for a 'not running' (i.e., configured or installed) 16217c478bd9Sstevel@tonic-gate * zone, the name service knows about it. 16227c478bd9Sstevel@tonic-gate * 4b. For some operations which expect a zone not to be running, that it is 16237c478bd9Sstevel@tonic-gate * not already running (or ready). 16247c478bd9Sstevel@tonic-gate */ 16257c478bd9Sstevel@tonic-gate static int 16267c478bd9Sstevel@tonic-gate sanity_check(char *zone, int cmd_num, boolean_t running, 16279acbbeafSnn35248 boolean_t unsafe_when_running, boolean_t force) 16287c478bd9Sstevel@tonic-gate { 16297c478bd9Sstevel@tonic-gate zone_entry_t *zent; 16307c478bd9Sstevel@tonic-gate priv_set_t *privset; 16319acbbeafSnn35248 zone_state_t state, min_state; 1632108322fbScarlsonj char kernzone[ZONENAME_MAX]; 1633108322fbScarlsonj FILE *fp; 16347c478bd9Sstevel@tonic-gate 16357c478bd9Sstevel@tonic-gate if (getzoneid() != GLOBAL_ZONEID) { 1636ffbafc53Scomay switch (cmd_num) { 1637ffbafc53Scomay case CMD_HALT: 1638ffbafc53Scomay zerror(gettext("use %s to %s this zone."), "halt(1M)", 16397c478bd9Sstevel@tonic-gate cmd_to_str(cmd_num)); 1640ffbafc53Scomay break; 16413c7284bdSAlexander Eremin case CMD_SHUTDOWN: 16423c7284bdSAlexander Eremin zerror(gettext("use %s to %s this zone."), 16433c7284bdSAlexander Eremin "shutdown(1M)", cmd_to_str(cmd_num)); 16443c7284bdSAlexander Eremin break; 1645ffbafc53Scomay case CMD_REBOOT: 1646ffbafc53Scomay zerror(gettext("use %s to %s this zone."), 1647ffbafc53Scomay "reboot(1M)", cmd_to_str(cmd_num)); 1648ffbafc53Scomay break; 1649ffbafc53Scomay default: 1650ffbafc53Scomay zerror(gettext("must be in the global zone to %s a " 1651ffbafc53Scomay "zone."), cmd_to_str(cmd_num)); 1652ffbafc53Scomay break; 1653ffbafc53Scomay } 16547c478bd9Sstevel@tonic-gate return (Z_ERR); 16557c478bd9Sstevel@tonic-gate } 16567c478bd9Sstevel@tonic-gate 16577c478bd9Sstevel@tonic-gate if ((privset = priv_allocset()) == NULL) { 16587c478bd9Sstevel@tonic-gate zerror(gettext("%s failed"), "priv_allocset"); 16597c478bd9Sstevel@tonic-gate return (Z_ERR); 16607c478bd9Sstevel@tonic-gate } 16617c478bd9Sstevel@tonic-gate 16627c478bd9Sstevel@tonic-gate if (getppriv(PRIV_EFFECTIVE, privset) != 0) { 16637c478bd9Sstevel@tonic-gate zerror(gettext("%s failed"), "getppriv"); 16647c478bd9Sstevel@tonic-gate priv_freeset(privset); 16657c478bd9Sstevel@tonic-gate return (Z_ERR); 16667c478bd9Sstevel@tonic-gate } 16677c478bd9Sstevel@tonic-gate 16687c478bd9Sstevel@tonic-gate if (priv_isfullset(privset) == B_FALSE) { 16697c478bd9Sstevel@tonic-gate zerror(gettext("only a privileged user may %s a zone."), 16707c478bd9Sstevel@tonic-gate cmd_to_str(cmd_num)); 16717c478bd9Sstevel@tonic-gate priv_freeset(privset); 16727c478bd9Sstevel@tonic-gate return (Z_ERR); 16737c478bd9Sstevel@tonic-gate } 16747c478bd9Sstevel@tonic-gate priv_freeset(privset); 16757c478bd9Sstevel@tonic-gate 16767c478bd9Sstevel@tonic-gate if (zone == NULL) { 16777c478bd9Sstevel@tonic-gate zerror(gettext("no zone specified")); 16787c478bd9Sstevel@tonic-gate return (Z_ERR); 16797c478bd9Sstevel@tonic-gate } 16807c478bd9Sstevel@tonic-gate 1681cb8a054bSGlenn Faden if (auth_check(username, zone, cmd_num) == Z_ERR) { 1682cb8a054bSGlenn Faden zerror(gettext("User %s is not authorized to %s this zone."), 1683cb8a054bSGlenn Faden username, cmd_to_str(cmd_num)); 1684cb8a054bSGlenn Faden return (Z_ERR); 1685cb8a054bSGlenn Faden } 1686cb8a054bSGlenn Faden 16877c478bd9Sstevel@tonic-gate if (strcmp(zone, GLOBAL_ZONENAME) == 0) { 16887c478bd9Sstevel@tonic-gate zerror(gettext("%s operation is invalid for the global zone."), 16897c478bd9Sstevel@tonic-gate cmd_to_str(cmd_num)); 16907c478bd9Sstevel@tonic-gate return (Z_ERR); 16917c478bd9Sstevel@tonic-gate } 16927c478bd9Sstevel@tonic-gate 16937c478bd9Sstevel@tonic-gate if (strncmp(zone, "SUNW", 4) == 0) { 16947c478bd9Sstevel@tonic-gate zerror(gettext("%s operation is invalid for zones starting " 16957c478bd9Sstevel@tonic-gate "with SUNW."), cmd_to_str(cmd_num)); 16967c478bd9Sstevel@tonic-gate return (Z_ERR); 16977c478bd9Sstevel@tonic-gate } 16987c478bd9Sstevel@tonic-gate 1699108322fbScarlsonj if (!zonecfg_in_alt_root()) { 1700108322fbScarlsonj zent = lookup_running_zone(zone); 1701108322fbScarlsonj } else if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) { 1702108322fbScarlsonj zent = NULL; 1703108322fbScarlsonj } else { 1704108322fbScarlsonj if (zonecfg_find_scratch(fp, zone, zonecfg_get_root(), 1705108322fbScarlsonj kernzone, sizeof (kernzone)) == 0) 1706108322fbScarlsonj zent = lookup_running_zone(kernzone); 1707108322fbScarlsonj else 1708108322fbScarlsonj zent = NULL; 1709108322fbScarlsonj zonecfg_close_scratch(fp); 1710108322fbScarlsonj } 1711108322fbScarlsonj 17127c478bd9Sstevel@tonic-gate /* 17137c478bd9Sstevel@tonic-gate * Look up from the kernel for 'running' zones. 17147c478bd9Sstevel@tonic-gate */ 17159acbbeafSnn35248 if (running && !force) { 17167c478bd9Sstevel@tonic-gate if (zent == NULL) { 17177c478bd9Sstevel@tonic-gate zerror(gettext("not running")); 17187c478bd9Sstevel@tonic-gate return (Z_ERR); 17197c478bd9Sstevel@tonic-gate } 17207c478bd9Sstevel@tonic-gate } else { 17217c478bd9Sstevel@tonic-gate int err; 17227c478bd9Sstevel@tonic-gate 17237c478bd9Sstevel@tonic-gate if (unsafe_when_running && zent != NULL) { 17247c478bd9Sstevel@tonic-gate /* check whether the zone is ready or running */ 17257c478bd9Sstevel@tonic-gate if ((err = zone_get_state(zent->zname, 17267c478bd9Sstevel@tonic-gate &zent->zstate_num)) != Z_OK) { 17277c478bd9Sstevel@tonic-gate errno = err; 17287c478bd9Sstevel@tonic-gate zperror2(zent->zname, 17297c478bd9Sstevel@tonic-gate gettext("could not get state")); 17307c478bd9Sstevel@tonic-gate /* can't tell, so hedge */ 17317c478bd9Sstevel@tonic-gate zent->zstate_str = "ready/running"; 17327c478bd9Sstevel@tonic-gate } else { 17337c478bd9Sstevel@tonic-gate zent->zstate_str = 17347c478bd9Sstevel@tonic-gate zone_state_str(zent->zstate_num); 17357c478bd9Sstevel@tonic-gate } 17367c478bd9Sstevel@tonic-gate zerror(gettext("%s operation is invalid for %s zones."), 17377c478bd9Sstevel@tonic-gate cmd_to_str(cmd_num), zent->zstate_str); 17387c478bd9Sstevel@tonic-gate return (Z_ERR); 17397c478bd9Sstevel@tonic-gate } 17407c478bd9Sstevel@tonic-gate if ((err = zone_get_state(zone, &state)) != Z_OK) { 17417c478bd9Sstevel@tonic-gate errno = err; 17427c478bd9Sstevel@tonic-gate zperror2(zone, gettext("could not get state")); 17437c478bd9Sstevel@tonic-gate return (Z_ERR); 17447c478bd9Sstevel@tonic-gate } 17457c478bd9Sstevel@tonic-gate switch (cmd_num) { 17467c478bd9Sstevel@tonic-gate case CMD_UNINSTALL: 17477c478bd9Sstevel@tonic-gate if (state == ZONE_STATE_CONFIGURED) { 17487c478bd9Sstevel@tonic-gate zerror(gettext("is already in state '%s'."), 17497c478bd9Sstevel@tonic-gate zone_state_str(ZONE_STATE_CONFIGURED)); 17507c478bd9Sstevel@tonic-gate return (Z_ERR); 17517c478bd9Sstevel@tonic-gate } 17527c478bd9Sstevel@tonic-gate break; 1753ee519a1fSgjelinek case CMD_ATTACH: 1754edfa49ffS if (state == ZONE_STATE_INSTALLED) { 1755edfa49ffS zerror(gettext("is already %s."), 1756edfa49ffS zone_state_str(ZONE_STATE_INSTALLED)); 1757edfa49ffS return (Z_ERR); 1758edfa49ffS } else if (state == ZONE_STATE_INCOMPLETE && !force) { 1759edfa49ffS zerror(gettext("zone is %s; %s required."), 1760edfa49ffS zone_state_str(ZONE_STATE_INCOMPLETE), 1761edfa49ffS cmd_to_str(CMD_UNINSTALL)); 1762edfa49ffS return (Z_ERR); 1763edfa49ffS } 1764edfa49ffS break; 1765865e09a4Sgjelinek case CMD_CLONE: 17667c478bd9Sstevel@tonic-gate case CMD_INSTALL: 17677c478bd9Sstevel@tonic-gate if (state == ZONE_STATE_INSTALLED) { 17687c478bd9Sstevel@tonic-gate zerror(gettext("is already %s."), 17697c478bd9Sstevel@tonic-gate zone_state_str(ZONE_STATE_INSTALLED)); 17707c478bd9Sstevel@tonic-gate return (Z_ERR); 17717c478bd9Sstevel@tonic-gate } else if (state == ZONE_STATE_INCOMPLETE) { 17727c478bd9Sstevel@tonic-gate zerror(gettext("zone is %s; %s required."), 17737c478bd9Sstevel@tonic-gate zone_state_str(ZONE_STATE_INCOMPLETE), 17747c478bd9Sstevel@tonic-gate cmd_to_str(CMD_UNINSTALL)); 17757c478bd9Sstevel@tonic-gate return (Z_ERR); 17767c478bd9Sstevel@tonic-gate } 17777c478bd9Sstevel@tonic-gate break; 1778ee519a1fSgjelinek case CMD_DETACH: 1779865e09a4Sgjelinek case CMD_MOVE: 17807c478bd9Sstevel@tonic-gate case CMD_READY: 17817c478bd9Sstevel@tonic-gate case CMD_BOOT: 1782108322fbScarlsonj case CMD_MOUNT: 1783555afedfScarlsonj case CMD_MARK: 17849acbbeafSnn35248 if ((cmd_num == CMD_BOOT || cmd_num == CMD_MOUNT) && 17859acbbeafSnn35248 force) 17869acbbeafSnn35248 min_state = ZONE_STATE_INCOMPLETE; 1787edfa49ffS else if (cmd_num == CMD_MARK) 1788edfa49ffS min_state = ZONE_STATE_CONFIGURED; 17899acbbeafSnn35248 else 17909acbbeafSnn35248 min_state = ZONE_STATE_INSTALLED; 17919acbbeafSnn35248 17929acbbeafSnn35248 if (state < min_state) { 17937c478bd9Sstevel@tonic-gate zerror(gettext("must be %s before %s."), 17949acbbeafSnn35248 zone_state_str(min_state), 17957c478bd9Sstevel@tonic-gate cmd_to_str(cmd_num)); 17967c478bd9Sstevel@tonic-gate return (Z_ERR); 17977c478bd9Sstevel@tonic-gate } 17987c478bd9Sstevel@tonic-gate break; 17997c478bd9Sstevel@tonic-gate case CMD_VERIFY: 18007c478bd9Sstevel@tonic-gate if (state == ZONE_STATE_INCOMPLETE) { 18017c478bd9Sstevel@tonic-gate zerror(gettext("zone is %s; %s required."), 18027c478bd9Sstevel@tonic-gate zone_state_str(ZONE_STATE_INCOMPLETE), 18037c478bd9Sstevel@tonic-gate cmd_to_str(CMD_UNINSTALL)); 18047c478bd9Sstevel@tonic-gate return (Z_ERR); 18057c478bd9Sstevel@tonic-gate } 18067c478bd9Sstevel@tonic-gate break; 1807108322fbScarlsonj case CMD_UNMOUNT: 1808108322fbScarlsonj if (state != ZONE_STATE_MOUNTED) { 1809108322fbScarlsonj zerror(gettext("must be %s before %s."), 1810108322fbScarlsonj zone_state_str(ZONE_STATE_MOUNTED), 1811108322fbScarlsonj cmd_to_str(cmd_num)); 1812108322fbScarlsonj return (Z_ERR); 1813108322fbScarlsonj } 1814108322fbScarlsonj break; 1815fbbfbc6eSjv227347 case CMD_SYSBOOT: 1816fbbfbc6eSjv227347 if (state != ZONE_STATE_INSTALLED) { 1817fbbfbc6eSjv227347 zerror(gettext("%s operation is invalid for %s " 1818fbbfbc6eSjv227347 "zones."), cmd_to_str(cmd_num), 1819fbbfbc6eSjv227347 zone_state_str(state)); 1820fbbfbc6eSjv227347 return (Z_ERR); 1821fbbfbc6eSjv227347 } 1822fbbfbc6eSjv227347 break; 18237c478bd9Sstevel@tonic-gate } 18247c478bd9Sstevel@tonic-gate } 18257c478bd9Sstevel@tonic-gate return (Z_OK); 18267c478bd9Sstevel@tonic-gate } 18277c478bd9Sstevel@tonic-gate 18287c478bd9Sstevel@tonic-gate static int 18297c478bd9Sstevel@tonic-gate halt_func(int argc, char *argv[]) 18307c478bd9Sstevel@tonic-gate { 18317c478bd9Sstevel@tonic-gate zone_cmd_arg_t zarg; 18327c478bd9Sstevel@tonic-gate int arg; 18337c478bd9Sstevel@tonic-gate 1834108322fbScarlsonj if (zonecfg_in_alt_root()) { 1835108322fbScarlsonj zerror(gettext("cannot halt zone in alternate root")); 1836108322fbScarlsonj return (Z_ERR); 1837108322fbScarlsonj } 1838108322fbScarlsonj 18397c478bd9Sstevel@tonic-gate optind = 0; 18407c478bd9Sstevel@tonic-gate if ((arg = getopt(argc, argv, "?")) != EOF) { 18417c478bd9Sstevel@tonic-gate switch (arg) { 18427c478bd9Sstevel@tonic-gate case '?': 18437c478bd9Sstevel@tonic-gate sub_usage(SHELP_HALT, CMD_HALT); 18447c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 18457c478bd9Sstevel@tonic-gate default: 18467c478bd9Sstevel@tonic-gate sub_usage(SHELP_HALT, CMD_HALT); 18477c478bd9Sstevel@tonic-gate return (Z_USAGE); 18487c478bd9Sstevel@tonic-gate } 18497c478bd9Sstevel@tonic-gate } 18507c478bd9Sstevel@tonic-gate if (argc > optind) { 18517c478bd9Sstevel@tonic-gate sub_usage(SHELP_HALT, CMD_HALT); 18527c478bd9Sstevel@tonic-gate return (Z_USAGE); 18537c478bd9Sstevel@tonic-gate } 18547c478bd9Sstevel@tonic-gate /* 18557c478bd9Sstevel@tonic-gate * zoneadmd should be the one to decide whether or not to proceed, 18567c478bd9Sstevel@tonic-gate * so even though it seems that the fourth parameter below should 18577c478bd9Sstevel@tonic-gate * perhaps be B_TRUE, it really shouldn't be. 18587c478bd9Sstevel@tonic-gate */ 18599acbbeafSnn35248 if (sanity_check(target_zone, CMD_HALT, B_FALSE, B_FALSE, B_FALSE) 18609acbbeafSnn35248 != Z_OK) 18617c478bd9Sstevel@tonic-gate return (Z_ERR); 18627c478bd9Sstevel@tonic-gate 1863ce28b40eSzt129084 /* 1864ce28b40eSzt129084 * Invoke brand-specific handler. 1865ce28b40eSzt129084 */ 1866ce28b40eSzt129084 if (invoke_brand_handler(CMD_HALT, argv) != Z_OK) 1867ce28b40eSzt129084 return (Z_ERR); 1868ce28b40eSzt129084 18697c478bd9Sstevel@tonic-gate zarg.cmd = Z_HALT; 1870ff17c8bfSgjelinek return ((zonecfg_call_zoneadmd(target_zone, &zarg, locale, 1871ff17c8bfSgjelinek B_TRUE) == 0) ? Z_OK : Z_ERR); 18727c478bd9Sstevel@tonic-gate } 18737c478bd9Sstevel@tonic-gate 18747c478bd9Sstevel@tonic-gate static int 18753c7284bdSAlexander Eremin shutdown_func(int argc, char *argv[]) 18763c7284bdSAlexander Eremin { 18773c7284bdSAlexander Eremin zone_cmd_arg_t zarg; 18783c7284bdSAlexander Eremin int arg; 18793c7284bdSAlexander Eremin boolean_t reboot = B_FALSE; 18803c7284bdSAlexander Eremin 18813c7284bdSAlexander Eremin zarg.cmd = Z_SHUTDOWN; 18823c7284bdSAlexander Eremin 18833c7284bdSAlexander Eremin if (zonecfg_in_alt_root()) { 18843c7284bdSAlexander Eremin zerror(gettext("cannot shut down zone in alternate root")); 18853c7284bdSAlexander Eremin return (Z_ERR); 18863c7284bdSAlexander Eremin } 18873c7284bdSAlexander Eremin 18883c7284bdSAlexander Eremin optind = 0; 18893c7284bdSAlexander Eremin while ((arg = getopt(argc, argv, "?r")) != EOF) { 18903c7284bdSAlexander Eremin switch (arg) { 18913c7284bdSAlexander Eremin case '?': 18923c7284bdSAlexander Eremin sub_usage(SHELP_SHUTDOWN, CMD_SHUTDOWN); 18933c7284bdSAlexander Eremin return (optopt == '?' ? Z_OK : Z_USAGE); 18943c7284bdSAlexander Eremin case 'r': 18953c7284bdSAlexander Eremin reboot = B_TRUE; 18963c7284bdSAlexander Eremin break; 18973c7284bdSAlexander Eremin default: 18983c7284bdSAlexander Eremin sub_usage(SHELP_SHUTDOWN, CMD_SHUTDOWN); 18993c7284bdSAlexander Eremin return (Z_USAGE); 19003c7284bdSAlexander Eremin } 19013c7284bdSAlexander Eremin } 19023c7284bdSAlexander Eremin 19033c7284bdSAlexander Eremin zarg.bootbuf[0] = '\0'; 19043c7284bdSAlexander Eremin for (; optind < argc; optind++) { 19053c7284bdSAlexander Eremin if (strlcat(zarg.bootbuf, argv[optind], 19063c7284bdSAlexander Eremin sizeof (zarg.bootbuf)) >= sizeof (zarg.bootbuf)) { 19073c7284bdSAlexander Eremin zerror(gettext("Boot argument list too long")); 19083c7284bdSAlexander Eremin return (Z_ERR); 19093c7284bdSAlexander Eremin } 19103c7284bdSAlexander Eremin if (optind < argc - 1) 19113c7284bdSAlexander Eremin if (strlcat(zarg.bootbuf, " ", sizeof (zarg.bootbuf)) >= 19123c7284bdSAlexander Eremin sizeof (zarg.bootbuf)) { 19133c7284bdSAlexander Eremin zerror(gettext("Boot argument list too long")); 19143c7284bdSAlexander Eremin return (Z_ERR); 19153c7284bdSAlexander Eremin } 19163c7284bdSAlexander Eremin } 19173c7284bdSAlexander Eremin 19183c7284bdSAlexander Eremin /* 19193c7284bdSAlexander Eremin * zoneadmd should be the one to decide whether or not to proceed, 19203c7284bdSAlexander Eremin * so even though it seems that the third parameter below should 19213c7284bdSAlexander Eremin * perhaps be B_TRUE, it really shouldn't be. 19223c7284bdSAlexander Eremin */ 19233c7284bdSAlexander Eremin if (sanity_check(target_zone, CMD_SHUTDOWN, B_TRUE, B_FALSE, B_FALSE) 19243c7284bdSAlexander Eremin != Z_OK) 19253c7284bdSAlexander Eremin return (Z_ERR); 19263c7284bdSAlexander Eremin 19273c7284bdSAlexander Eremin if (zonecfg_call_zoneadmd(target_zone, &zarg, locale, B_TRUE) != Z_OK) 19283c7284bdSAlexander Eremin return (Z_ERR); 19293c7284bdSAlexander Eremin 19303c7284bdSAlexander Eremin if (reboot) { 19313c7284bdSAlexander Eremin if (sanity_check(target_zone, CMD_BOOT, B_FALSE, B_FALSE, 19323c7284bdSAlexander Eremin B_FALSE) != Z_OK) 19333c7284bdSAlexander Eremin return (Z_ERR); 19343c7284bdSAlexander Eremin 19353c7284bdSAlexander Eremin zarg.cmd = Z_BOOT; 19363c7284bdSAlexander Eremin if (zonecfg_call_zoneadmd(target_zone, &zarg, locale, 19373c7284bdSAlexander Eremin B_TRUE) != Z_OK) 19383c7284bdSAlexander Eremin return (Z_ERR); 19393c7284bdSAlexander Eremin } 19403c7284bdSAlexander Eremin return (Z_OK); 19413c7284bdSAlexander Eremin } 19423c7284bdSAlexander Eremin 19433c7284bdSAlexander Eremin static int 19447c478bd9Sstevel@tonic-gate reboot_func(int argc, char *argv[]) 19457c478bd9Sstevel@tonic-gate { 19467c478bd9Sstevel@tonic-gate zone_cmd_arg_t zarg; 19477c478bd9Sstevel@tonic-gate int arg; 19487c478bd9Sstevel@tonic-gate 1949108322fbScarlsonj if (zonecfg_in_alt_root()) { 1950108322fbScarlsonj zerror(gettext("cannot reboot zone in alternate root")); 1951108322fbScarlsonj return (Z_ERR); 1952108322fbScarlsonj } 1953108322fbScarlsonj 19547c478bd9Sstevel@tonic-gate optind = 0; 19557c478bd9Sstevel@tonic-gate if ((arg = getopt(argc, argv, "?")) != EOF) { 19567c478bd9Sstevel@tonic-gate switch (arg) { 19577c478bd9Sstevel@tonic-gate case '?': 19587c478bd9Sstevel@tonic-gate sub_usage(SHELP_REBOOT, CMD_REBOOT); 19597c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 19607c478bd9Sstevel@tonic-gate default: 19617c478bd9Sstevel@tonic-gate sub_usage(SHELP_REBOOT, CMD_REBOOT); 19627c478bd9Sstevel@tonic-gate return (Z_USAGE); 19637c478bd9Sstevel@tonic-gate } 19647c478bd9Sstevel@tonic-gate } 19653f2f09c1Sdp 19663f2f09c1Sdp zarg.bootbuf[0] = '\0'; 19673f2f09c1Sdp for (; optind < argc; optind++) { 19683f2f09c1Sdp if (strlcat(zarg.bootbuf, argv[optind], 19693f2f09c1Sdp sizeof (zarg.bootbuf)) >= sizeof (zarg.bootbuf)) { 19703f2f09c1Sdp zerror(gettext("Boot argument list too long")); 19713f2f09c1Sdp return (Z_ERR); 19727c478bd9Sstevel@tonic-gate } 19733f2f09c1Sdp if (optind < argc - 1) 19743f2f09c1Sdp if (strlcat(zarg.bootbuf, " ", sizeof (zarg.bootbuf)) >= 19753f2f09c1Sdp sizeof (zarg.bootbuf)) { 19763f2f09c1Sdp zerror(gettext("Boot argument list too long")); 19773f2f09c1Sdp return (Z_ERR); 19783f2f09c1Sdp } 19793f2f09c1Sdp } 19803f2f09c1Sdp 19813f2f09c1Sdp 19827c478bd9Sstevel@tonic-gate /* 19837c478bd9Sstevel@tonic-gate * zoneadmd should be the one to decide whether or not to proceed, 19847c478bd9Sstevel@tonic-gate * so even though it seems that the fourth parameter below should 19857c478bd9Sstevel@tonic-gate * perhaps be B_TRUE, it really shouldn't be. 19867c478bd9Sstevel@tonic-gate */ 19879acbbeafSnn35248 if (sanity_check(target_zone, CMD_REBOOT, B_TRUE, B_FALSE, B_FALSE) 19889acbbeafSnn35248 != Z_OK) 19897c478bd9Sstevel@tonic-gate return (Z_ERR); 1990ce28b40eSzt129084 if (verify_details(CMD_REBOOT, argv) != Z_OK) 1991b5abaf04Sgjelinek return (Z_ERR); 19927c478bd9Sstevel@tonic-gate 19937c478bd9Sstevel@tonic-gate zarg.cmd = Z_REBOOT; 1994ff17c8bfSgjelinek return ((zonecfg_call_zoneadmd(target_zone, &zarg, locale, B_TRUE) == 0) 1995ff17c8bfSgjelinek ? Z_OK : Z_ERR); 1996ff17c8bfSgjelinek } 1997ff17c8bfSgjelinek 1998ff17c8bfSgjelinek static int 1999ff17c8bfSgjelinek get_hook(brand_handle_t bh, char *cmd, size_t len, int (*bp)(brand_handle_t, 2000ff17c8bfSgjelinek const char *, const char *, char *, size_t), char *zonename, char *zonepath) 2001ff17c8bfSgjelinek { 2002ff17c8bfSgjelinek if (strlcpy(cmd, EXEC_PREFIX, len) >= len) 2003ff17c8bfSgjelinek return (Z_ERR); 2004ff17c8bfSgjelinek 2005ff17c8bfSgjelinek if (bp(bh, zonename, zonepath, cmd + EXEC_LEN, len - EXEC_LEN) != 0) 2006ff17c8bfSgjelinek return (Z_ERR); 2007ff17c8bfSgjelinek 2008ff17c8bfSgjelinek if (strlen(cmd) <= EXEC_LEN) 2009ff17c8bfSgjelinek cmd[0] = '\0'; 2010ff17c8bfSgjelinek 2011ff17c8bfSgjelinek return (Z_OK); 20127c478bd9Sstevel@tonic-gate } 20137c478bd9Sstevel@tonic-gate 20147c478bd9Sstevel@tonic-gate static int 2015ce28b40eSzt129084 verify_brand(zone_dochandle_t handle, int cmd_num, char *argv[]) 20169acbbeafSnn35248 { 20179acbbeafSnn35248 char cmdbuf[MAXPATHLEN]; 20189acbbeafSnn35248 int err; 20199acbbeafSnn35248 char zonepath[MAXPATHLEN]; 2020123807fbSedp brand_handle_t bh = NULL; 2021ce28b40eSzt129084 int status, i; 20229acbbeafSnn35248 20239acbbeafSnn35248 /* 20249acbbeafSnn35248 * Fetch the verify command from the brand configuration. 20259acbbeafSnn35248 * "exec" the command so that the returned status is that of 20269acbbeafSnn35248 * the command and not the shell. 20279acbbeafSnn35248 */ 2028ff17c8bfSgjelinek if (handle == NULL) { 2029ff17c8bfSgjelinek (void) strlcpy(zonepath, "-", sizeof (zonepath)); 2030ff17c8bfSgjelinek } else if ((err = zonecfg_get_zonepath(handle, zonepath, 2031ff17c8bfSgjelinek sizeof (zonepath))) != Z_OK) { 20329acbbeafSnn35248 errno = err; 2033ce28b40eSzt129084 zperror(cmd_to_str(cmd_num), B_TRUE); 20349acbbeafSnn35248 return (Z_ERR); 20359acbbeafSnn35248 } 2036123807fbSedp if ((bh = brand_open(target_brand)) == NULL) { 20379acbbeafSnn35248 zerror(gettext("missing or invalid brand")); 20389acbbeafSnn35248 return (Z_ERR); 20399acbbeafSnn35248 } 20409acbbeafSnn35248 20419acbbeafSnn35248 /* 20429acbbeafSnn35248 * If the brand has its own verification routine, execute it now. 2043ce28b40eSzt129084 * The verification routine validates the intended zoneadm 2044ce28b40eSzt129084 * operation for the specific brand. The zoneadm subcommand and 2045ce28b40eSzt129084 * all its arguments are passed to the routine. 20469acbbeafSnn35248 */ 2047ff17c8bfSgjelinek err = get_hook(bh, cmdbuf, sizeof (cmdbuf), brand_get_verify_adm, 2048ff17c8bfSgjelinek target_zone, zonepath); 2049123807fbSedp brand_close(bh); 2050ff17c8bfSgjelinek if (err != Z_OK) 2051ce28b40eSzt129084 return (Z_BRAND_ERROR); 2052ff17c8bfSgjelinek if (cmdbuf[0] == '\0') 2053ce28b40eSzt129084 return (Z_OK); 2054ce28b40eSzt129084 2055ce28b40eSzt129084 if (strlcat(cmdbuf, cmd_to_str(cmd_num), 2056ce28b40eSzt129084 sizeof (cmdbuf)) >= sizeof (cmdbuf)) 2057ce28b40eSzt129084 return (Z_ERR); 2058ce28b40eSzt129084 2059ce28b40eSzt129084 /* Build the argv string */ 2060ce28b40eSzt129084 i = 0; 2061ce28b40eSzt129084 while (argv[i] != NULL) { 2062ce28b40eSzt129084 if ((strlcat(cmdbuf, " ", 2063ce28b40eSzt129084 sizeof (cmdbuf)) >= sizeof (cmdbuf)) || 2064ce28b40eSzt129084 (strlcat(cmdbuf, argv[i++], 2065ce28b40eSzt129084 sizeof (cmdbuf)) >= sizeof (cmdbuf))) 2066ce28b40eSzt129084 return (Z_ERR); 2067ce28b40eSzt129084 } 2068ce28b40eSzt129084 2069d9e728a2Sgjelinek status = do_subproc(cmdbuf); 20709acbbeafSnn35248 err = subproc_status(gettext("brand-specific verification"), 20719acbbeafSnn35248 status, B_FALSE); 20729acbbeafSnn35248 2073ce28b40eSzt129084 return ((err == ZONE_SUBPROC_OK) ? Z_OK : Z_BRAND_ERROR); 20749acbbeafSnn35248 } 20759acbbeafSnn35248 20769acbbeafSnn35248 static int 20777c478bd9Sstevel@tonic-gate verify_rctls(zone_dochandle_t handle) 20787c478bd9Sstevel@tonic-gate { 20797c478bd9Sstevel@tonic-gate struct zone_rctltab rctltab; 20807c478bd9Sstevel@tonic-gate size_t rbs = rctlblk_size(); 20817c478bd9Sstevel@tonic-gate rctlblk_t *rctlblk; 20827c478bd9Sstevel@tonic-gate int error = Z_INVAL; 20837c478bd9Sstevel@tonic-gate 20847c478bd9Sstevel@tonic-gate if ((rctlblk = malloc(rbs)) == NULL) { 20857c478bd9Sstevel@tonic-gate zerror(gettext("failed to allocate %lu bytes: %s"), rbs, 20867c478bd9Sstevel@tonic-gate strerror(errno)); 20877c478bd9Sstevel@tonic-gate return (Z_NOMEM); 20887c478bd9Sstevel@tonic-gate } 20897c478bd9Sstevel@tonic-gate 20907c478bd9Sstevel@tonic-gate if (zonecfg_setrctlent(handle) != Z_OK) { 20917c478bd9Sstevel@tonic-gate zerror(gettext("zonecfg_setrctlent failed")); 20927c478bd9Sstevel@tonic-gate free(rctlblk); 20937c478bd9Sstevel@tonic-gate return (error); 20947c478bd9Sstevel@tonic-gate } 20957c478bd9Sstevel@tonic-gate 20967c478bd9Sstevel@tonic-gate rctltab.zone_rctl_valptr = NULL; 20977c478bd9Sstevel@tonic-gate while (zonecfg_getrctlent(handle, &rctltab) == Z_OK) { 20987c478bd9Sstevel@tonic-gate struct zone_rctlvaltab *rctlval; 20997c478bd9Sstevel@tonic-gate const char *name = rctltab.zone_rctl_name; 21007c478bd9Sstevel@tonic-gate 21017c478bd9Sstevel@tonic-gate if (!zonecfg_is_rctl(name)) { 21027c478bd9Sstevel@tonic-gate zerror(gettext("WARNING: Ignoring unrecognized rctl " 21037c478bd9Sstevel@tonic-gate "'%s'."), name); 21047c478bd9Sstevel@tonic-gate zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr); 21057c478bd9Sstevel@tonic-gate rctltab.zone_rctl_valptr = NULL; 21067c478bd9Sstevel@tonic-gate continue; 21077c478bd9Sstevel@tonic-gate } 21087c478bd9Sstevel@tonic-gate 21097c478bd9Sstevel@tonic-gate for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL; 21107c478bd9Sstevel@tonic-gate rctlval = rctlval->zone_rctlval_next) { 21117c478bd9Sstevel@tonic-gate if (zonecfg_construct_rctlblk(rctlval, rctlblk) 21127c478bd9Sstevel@tonic-gate != Z_OK) { 21137c478bd9Sstevel@tonic-gate zerror(gettext("invalid rctl value: " 21147c478bd9Sstevel@tonic-gate "(priv=%s,limit=%s,action%s)"), 21157c478bd9Sstevel@tonic-gate rctlval->zone_rctlval_priv, 21167c478bd9Sstevel@tonic-gate rctlval->zone_rctlval_limit, 21177c478bd9Sstevel@tonic-gate rctlval->zone_rctlval_action); 21187c478bd9Sstevel@tonic-gate goto out; 21197c478bd9Sstevel@tonic-gate } 21207c478bd9Sstevel@tonic-gate if (!zonecfg_valid_rctl(name, rctlblk)) { 21217c478bd9Sstevel@tonic-gate zerror(gettext("(priv=%s,limit=%s,action=%s) " 21227c478bd9Sstevel@tonic-gate "is not a valid value for rctl '%s'"), 21237c478bd9Sstevel@tonic-gate rctlval->zone_rctlval_priv, 21247c478bd9Sstevel@tonic-gate rctlval->zone_rctlval_limit, 21257c478bd9Sstevel@tonic-gate rctlval->zone_rctlval_action, 21267c478bd9Sstevel@tonic-gate name); 21277c478bd9Sstevel@tonic-gate goto out; 21287c478bd9Sstevel@tonic-gate } 21297c478bd9Sstevel@tonic-gate } 21307c478bd9Sstevel@tonic-gate zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr); 21317c478bd9Sstevel@tonic-gate } 21327c478bd9Sstevel@tonic-gate rctltab.zone_rctl_valptr = NULL; 21337c478bd9Sstevel@tonic-gate error = Z_OK; 21347c478bd9Sstevel@tonic-gate out: 21357c478bd9Sstevel@tonic-gate zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr); 21367c478bd9Sstevel@tonic-gate (void) zonecfg_endrctlent(handle); 21377c478bd9Sstevel@tonic-gate free(rctlblk); 21387c478bd9Sstevel@tonic-gate return (error); 21397c478bd9Sstevel@tonic-gate } 21407c478bd9Sstevel@tonic-gate 21417c478bd9Sstevel@tonic-gate static int 21427c478bd9Sstevel@tonic-gate verify_pool(zone_dochandle_t handle) 21437c478bd9Sstevel@tonic-gate { 21447c478bd9Sstevel@tonic-gate char poolname[MAXPATHLEN]; 21457c478bd9Sstevel@tonic-gate pool_conf_t *poolconf; 21467c478bd9Sstevel@tonic-gate pool_t *pool; 21477c478bd9Sstevel@tonic-gate int status; 21487c478bd9Sstevel@tonic-gate int error; 21497c478bd9Sstevel@tonic-gate 21507c478bd9Sstevel@tonic-gate /* 21517c478bd9Sstevel@tonic-gate * This ends up being very similar to the check done in zoneadmd. 21527c478bd9Sstevel@tonic-gate */ 21537c478bd9Sstevel@tonic-gate error = zonecfg_get_pool(handle, poolname, sizeof (poolname)); 21547c478bd9Sstevel@tonic-gate if (error == Z_NO_ENTRY || (error == Z_OK && strlen(poolname) == 0)) { 21557c478bd9Sstevel@tonic-gate /* 21567c478bd9Sstevel@tonic-gate * No pool specified. 21577c478bd9Sstevel@tonic-gate */ 21587c478bd9Sstevel@tonic-gate return (0); 21597c478bd9Sstevel@tonic-gate } 21607c478bd9Sstevel@tonic-gate if (error != Z_OK) { 21617c478bd9Sstevel@tonic-gate zperror(gettext("Unable to retrieve pool name from " 21627c478bd9Sstevel@tonic-gate "configuration"), B_TRUE); 21637c478bd9Sstevel@tonic-gate return (error); 21647c478bd9Sstevel@tonic-gate } 21657c478bd9Sstevel@tonic-gate /* 21667c478bd9Sstevel@tonic-gate * Don't do anything if pools aren't enabled. 21677c478bd9Sstevel@tonic-gate */ 21687c478bd9Sstevel@tonic-gate if (pool_get_status(&status) != PO_SUCCESS || status != POOL_ENABLED) { 21697c478bd9Sstevel@tonic-gate zerror(gettext("WARNING: pools facility not active; " 21707c478bd9Sstevel@tonic-gate "zone will not be bound to pool '%s'."), poolname); 21717c478bd9Sstevel@tonic-gate return (Z_OK); 21727c478bd9Sstevel@tonic-gate } 21737c478bd9Sstevel@tonic-gate /* 21747c478bd9Sstevel@tonic-gate * Try to provide a sane error message if the requested pool doesn't 21757c478bd9Sstevel@tonic-gate * exist. It isn't clear that pools-related failures should 21767c478bd9Sstevel@tonic-gate * necessarily translate to a failure to verify the zone configuration, 21777c478bd9Sstevel@tonic-gate * hence they are not considered errors. 21787c478bd9Sstevel@tonic-gate */ 21797c478bd9Sstevel@tonic-gate if ((poolconf = pool_conf_alloc()) == NULL) { 21807c478bd9Sstevel@tonic-gate zerror(gettext("WARNING: pool_conf_alloc failed; " 21817c478bd9Sstevel@tonic-gate "using default pool")); 21827c478bd9Sstevel@tonic-gate return (Z_OK); 21837c478bd9Sstevel@tonic-gate } 21847c478bd9Sstevel@tonic-gate if (pool_conf_open(poolconf, pool_dynamic_location(), PO_RDONLY) != 21857c478bd9Sstevel@tonic-gate PO_SUCCESS) { 21867c478bd9Sstevel@tonic-gate zerror(gettext("WARNING: pool_conf_open failed; " 21877c478bd9Sstevel@tonic-gate "using default pool")); 21887c478bd9Sstevel@tonic-gate pool_conf_free(poolconf); 21897c478bd9Sstevel@tonic-gate return (Z_OK); 21907c478bd9Sstevel@tonic-gate } 21917c478bd9Sstevel@tonic-gate pool = pool_get_pool(poolconf, poolname); 21927c478bd9Sstevel@tonic-gate (void) pool_conf_close(poolconf); 21937c478bd9Sstevel@tonic-gate pool_conf_free(poolconf); 21947c478bd9Sstevel@tonic-gate if (pool == NULL) { 21957c478bd9Sstevel@tonic-gate zerror(gettext("WARNING: pool '%s' not found. " 21967c478bd9Sstevel@tonic-gate "using default pool"), poolname); 21977c478bd9Sstevel@tonic-gate } 21987c478bd9Sstevel@tonic-gate 21997c478bd9Sstevel@tonic-gate return (Z_OK); 22007c478bd9Sstevel@tonic-gate } 22017c478bd9Sstevel@tonic-gate 220220c8013fSlling /* 220320c8013fSlling * Verify that the special device/file system exists and is valid. 220420c8013fSlling */ 220520c8013fSlling static int 220620c8013fSlling verify_fs_special(struct zone_fstab *fstab) 220720c8013fSlling { 220893239addSjohnlev struct stat64 st; 220920c8013fSlling 22106cc813faSgjelinek /* 22116cc813faSgjelinek * This validation is really intended for standard zone administration. 22126cc813faSgjelinek * If we are in a mini-root or some other upgrade situation where 22136cc813faSgjelinek * we are using the scratch zone, just by-pass this. 22146cc813faSgjelinek */ 22156cc813faSgjelinek if (zonecfg_in_alt_root()) 22166cc813faSgjelinek return (Z_OK); 22176cc813faSgjelinek 221820c8013fSlling if (strcmp(fstab->zone_fs_type, MNTTYPE_ZFS) == 0) 221920c8013fSlling return (verify_fs_zfs(fstab)); 222020c8013fSlling 222193239addSjohnlev if (stat64(fstab->zone_fs_special, &st) != 0) { 22225c358068Slling (void) fprintf(stderr, gettext("could not verify fs " 222320c8013fSlling "%s: could not access %s: %s\n"), fstab->zone_fs_dir, 222420c8013fSlling fstab->zone_fs_special, strerror(errno)); 222520c8013fSlling return (Z_ERR); 222620c8013fSlling } 222720c8013fSlling 222820c8013fSlling if (strcmp(st.st_fstype, MNTTYPE_NFS) == 0) { 222920c8013fSlling /* 223020c8013fSlling * TRANSLATION_NOTE 223120c8013fSlling * fs and NFS are literals that should 223220c8013fSlling * not be translated. 223320c8013fSlling */ 223420c8013fSlling (void) fprintf(stderr, gettext("cannot verify " 22350b5de56dSgjelinek "fs %s: NFS mounted file system.\n" 22360b5de56dSgjelinek "\tA local file system must be used.\n"), 223720c8013fSlling fstab->zone_fs_special); 223820c8013fSlling return (Z_ERR); 223920c8013fSlling } 224020c8013fSlling 224120c8013fSlling return (Z_OK); 224220c8013fSlling } 224320c8013fSlling 2244b5abaf04Sgjelinek static int 224593239addSjohnlev isregfile(const char *path) 224693239addSjohnlev { 224793239addSjohnlev struct stat64 st; 224893239addSjohnlev 224993239addSjohnlev if (stat64(path, &st) == -1) 225093239addSjohnlev return (-1); 225193239addSjohnlev 225293239addSjohnlev return (S_ISREG(st.st_mode)); 225393239addSjohnlev } 225493239addSjohnlev 225593239addSjohnlev static int 22567c478bd9Sstevel@tonic-gate verify_filesystems(zone_dochandle_t handle) 22577c478bd9Sstevel@tonic-gate { 22587c478bd9Sstevel@tonic-gate int return_code = Z_OK; 22597c478bd9Sstevel@tonic-gate struct zone_fstab fstab; 22607c478bd9Sstevel@tonic-gate char cmdbuf[MAXPATHLEN]; 22617c478bd9Sstevel@tonic-gate struct stat st; 22627c478bd9Sstevel@tonic-gate 22637c478bd9Sstevel@tonic-gate /* 22647c478bd9Sstevel@tonic-gate * Since the actual mount point is not known until the dependent mounts 22657c478bd9Sstevel@tonic-gate * are performed, we don't attempt any path validation here: that will 22667c478bd9Sstevel@tonic-gate * happen later when zoneadmd actually does the mounts. 22677c478bd9Sstevel@tonic-gate */ 22687c478bd9Sstevel@tonic-gate if (zonecfg_setfsent(handle) != Z_OK) { 22690b5de56dSgjelinek (void) fprintf(stderr, gettext("could not verify file systems: " 22707c478bd9Sstevel@tonic-gate "unable to enumerate mounts\n")); 22717c478bd9Sstevel@tonic-gate return (Z_ERR); 22727c478bd9Sstevel@tonic-gate } 22737c478bd9Sstevel@tonic-gate while (zonecfg_getfsent(handle, &fstab) == Z_OK) { 22747c478bd9Sstevel@tonic-gate if (!zonecfg_valid_fs_type(fstab.zone_fs_type)) { 22757c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("cannot verify fs %s: " 22767c478bd9Sstevel@tonic-gate "type %s is not allowed.\n"), fstab.zone_fs_dir, 22777c478bd9Sstevel@tonic-gate fstab.zone_fs_type); 22787c478bd9Sstevel@tonic-gate return_code = Z_ERR; 22797c478bd9Sstevel@tonic-gate goto next_fs; 22807c478bd9Sstevel@tonic-gate } 22817c478bd9Sstevel@tonic-gate /* 22827c478bd9Sstevel@tonic-gate * Verify /usr/lib/fs/<fstype>/mount exists. 22837c478bd9Sstevel@tonic-gate */ 22847c478bd9Sstevel@tonic-gate if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/mount", 22857c478bd9Sstevel@tonic-gate fstab.zone_fs_type) > sizeof (cmdbuf)) { 22867c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("cannot verify fs %s: " 22877c478bd9Sstevel@tonic-gate "type %s is too long.\n"), fstab.zone_fs_dir, 22887c478bd9Sstevel@tonic-gate fstab.zone_fs_type); 22897c478bd9Sstevel@tonic-gate return_code = Z_ERR; 22907c478bd9Sstevel@tonic-gate goto next_fs; 22917c478bd9Sstevel@tonic-gate } 22927c478bd9Sstevel@tonic-gate if (stat(cmdbuf, &st) != 0) { 22935ee84fbdSgjelinek (void) fprintf(stderr, gettext("could not verify fs " 22945ee84fbdSgjelinek "%s: could not access %s: %s\n"), fstab.zone_fs_dir, 22957c478bd9Sstevel@tonic-gate cmdbuf, strerror(errno)); 22967c478bd9Sstevel@tonic-gate return_code = Z_ERR; 22977c478bd9Sstevel@tonic-gate goto next_fs; 22987c478bd9Sstevel@tonic-gate } 22997c478bd9Sstevel@tonic-gate if (!S_ISREG(st.st_mode)) { 23005ee84fbdSgjelinek (void) fprintf(stderr, gettext("could not verify fs " 23015ee84fbdSgjelinek "%s: %s is not a regular file\n"), 23025ee84fbdSgjelinek fstab.zone_fs_dir, cmdbuf); 23037c478bd9Sstevel@tonic-gate return_code = Z_ERR; 23047c478bd9Sstevel@tonic-gate goto next_fs; 23057c478bd9Sstevel@tonic-gate } 23067c478bd9Sstevel@tonic-gate /* 230793239addSjohnlev * If zone_fs_raw is set, verify that there's an fsck 230893239addSjohnlev * binary for it. If zone_fs_raw is not set, and it's 230993239addSjohnlev * not a regular file (lofi mount), and there's an fsck 231093239addSjohnlev * binary for it, complain. 23117c478bd9Sstevel@tonic-gate */ 23127c478bd9Sstevel@tonic-gate if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/fsck", 23137c478bd9Sstevel@tonic-gate fstab.zone_fs_type) > sizeof (cmdbuf)) { 23147c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("cannot verify fs %s: " 23157c478bd9Sstevel@tonic-gate "type %s is too long.\n"), fstab.zone_fs_dir, 23167c478bd9Sstevel@tonic-gate fstab.zone_fs_type); 23177c478bd9Sstevel@tonic-gate return_code = Z_ERR; 23187c478bd9Sstevel@tonic-gate goto next_fs; 23197c478bd9Sstevel@tonic-gate } 23207c478bd9Sstevel@tonic-gate if (fstab.zone_fs_raw[0] != '\0' && 23217c478bd9Sstevel@tonic-gate (stat(cmdbuf, &st) != 0 || !S_ISREG(st.st_mode))) { 23227c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("cannot verify fs %s: " 23237c478bd9Sstevel@tonic-gate "'raw' device specified but " 23247c478bd9Sstevel@tonic-gate "no fsck executable exists for %s\n"), 23257c478bd9Sstevel@tonic-gate fstab.zone_fs_dir, fstab.zone_fs_type); 23267c478bd9Sstevel@tonic-gate return_code = Z_ERR; 23277c478bd9Sstevel@tonic-gate goto next_fs; 232893239addSjohnlev } else if (fstab.zone_fs_raw[0] == '\0' && 232993239addSjohnlev stat(cmdbuf, &st) == 0 && 233093239addSjohnlev isregfile(fstab.zone_fs_special) != 1) { 233193239addSjohnlev (void) fprintf(stderr, gettext("could not verify fs " 233293239addSjohnlev "%s: must specify 'raw' device for %s " 233393239addSjohnlev "file systems\n"), 233493239addSjohnlev fstab.zone_fs_dir, fstab.zone_fs_type); 233593239addSjohnlev return_code = Z_ERR; 233693239addSjohnlev goto next_fs; 23377c478bd9Sstevel@tonic-gate } 233820c8013fSlling 233920c8013fSlling /* Verify fs_special. */ 234020c8013fSlling if ((return_code = verify_fs_special(&fstab)) != Z_OK) 2341b5abaf04Sgjelinek goto next_fs; 234220c8013fSlling 234320c8013fSlling /* Verify fs_raw. */ 2344b5abaf04Sgjelinek if (fstab.zone_fs_raw[0] != '\0' && 2345b5abaf04Sgjelinek stat(fstab.zone_fs_raw, &st) != 0) { 23465ee84fbdSgjelinek /* 23475ee84fbdSgjelinek * TRANSLATION_NOTE 23485ee84fbdSgjelinek * fs is a literal that should not be translated. 23495ee84fbdSgjelinek */ 23505ee84fbdSgjelinek (void) fprintf(stderr, gettext("could not verify fs " 23515ee84fbdSgjelinek "%s: could not access %s: %s\n"), fstab.zone_fs_dir, 2352b5abaf04Sgjelinek fstab.zone_fs_raw, strerror(errno)); 2353b5abaf04Sgjelinek return_code = Z_ERR; 2354b5abaf04Sgjelinek goto next_fs; 2355b5abaf04Sgjelinek } 23567c478bd9Sstevel@tonic-gate next_fs: 23577c478bd9Sstevel@tonic-gate zonecfg_free_fs_option_list(fstab.zone_fs_options); 23587c478bd9Sstevel@tonic-gate } 23597c478bd9Sstevel@tonic-gate (void) zonecfg_endfsent(handle); 23607c478bd9Sstevel@tonic-gate 23617c478bd9Sstevel@tonic-gate return (return_code); 23627c478bd9Sstevel@tonic-gate } 23637c478bd9Sstevel@tonic-gate 23647c478bd9Sstevel@tonic-gate static int 2365ffbafc53Scomay verify_limitpriv(zone_dochandle_t handle) 2366ffbafc53Scomay { 2367ffbafc53Scomay char *privname = NULL; 2368ffbafc53Scomay int err; 2369ffbafc53Scomay priv_set_t *privs; 2370ffbafc53Scomay 2371ffbafc53Scomay if ((privs = priv_allocset()) == NULL) { 2372ffbafc53Scomay zperror(gettext("failed to allocate privilege set"), B_FALSE); 2373ffbafc53Scomay return (Z_NOMEM); 2374ffbafc53Scomay } 2375ffbafc53Scomay err = zonecfg_get_privset(handle, privs, &privname); 2376ffbafc53Scomay switch (err) { 2377ffbafc53Scomay case Z_OK: 2378ffbafc53Scomay break; 2379ffbafc53Scomay case Z_PRIV_PROHIBITED: 2380ffbafc53Scomay (void) fprintf(stderr, gettext("privilege \"%s\" is not " 2381ffbafc53Scomay "permitted within the zone's privilege set\n"), privname); 2382ffbafc53Scomay break; 2383ffbafc53Scomay case Z_PRIV_REQUIRED: 2384ffbafc53Scomay (void) fprintf(stderr, gettext("required privilege \"%s\" is " 2385ffbafc53Scomay "missing from the zone's privilege set\n"), privname); 2386ffbafc53Scomay break; 2387ffbafc53Scomay case Z_PRIV_UNKNOWN: 2388ffbafc53Scomay (void) fprintf(stderr, gettext("unknown privilege \"%s\" " 2389ffbafc53Scomay "specified in the zone's privilege set\n"), privname); 2390ffbafc53Scomay break; 2391ffbafc53Scomay default: 2392ffbafc53Scomay zperror( 2393ffbafc53Scomay gettext("failed to determine the zone's privilege set"), 2394ffbafc53Scomay B_TRUE); 2395ffbafc53Scomay break; 2396ffbafc53Scomay } 2397ffbafc53Scomay free(privname); 2398ffbafc53Scomay priv_freeset(privs); 2399ffbafc53Scomay return (err); 2400ffbafc53Scomay } 2401ffbafc53Scomay 24021390a385Sgjelinek static void 24031390a385Sgjelinek free_local_netifs(int if_cnt, struct net_if **if_list) 24041390a385Sgjelinek { 24051390a385Sgjelinek int i; 24061390a385Sgjelinek 24071390a385Sgjelinek for (i = 0; i < if_cnt; i++) { 24081390a385Sgjelinek free(if_list[i]->name); 24091390a385Sgjelinek free(if_list[i]); 24101390a385Sgjelinek } 24111390a385Sgjelinek free(if_list); 24121390a385Sgjelinek } 24131390a385Sgjelinek 24141390a385Sgjelinek /* 24151390a385Sgjelinek * Get a list of the network interfaces, along with their address families, 24161390a385Sgjelinek * that are plumbed in the global zone. See if_tcp(7p) for a description 24171390a385Sgjelinek * of the ioctls used here. 24181390a385Sgjelinek */ 24191390a385Sgjelinek static int 24201390a385Sgjelinek get_local_netifs(int *if_cnt, struct net_if ***if_list) 24211390a385Sgjelinek { 24221390a385Sgjelinek int s; 24231390a385Sgjelinek int i; 24241390a385Sgjelinek int res = Z_OK; 24251390a385Sgjelinek int space_needed; 24261390a385Sgjelinek int cnt = 0; 24271390a385Sgjelinek struct lifnum if_num; 24281390a385Sgjelinek struct lifconf if_conf; 24291390a385Sgjelinek struct lifreq *if_reqp; 24301390a385Sgjelinek char *if_buf; 24311390a385Sgjelinek struct net_if **local_ifs = NULL; 24321390a385Sgjelinek 24331390a385Sgjelinek *if_cnt = 0; 24341390a385Sgjelinek *if_list = NULL; 24351390a385Sgjelinek 24361390a385Sgjelinek if ((s = socket(SOCKET_AF(AF_INET), SOCK_DGRAM, 0)) < 0) 24371390a385Sgjelinek return (Z_ERR); 24381390a385Sgjelinek 24391390a385Sgjelinek /* 24401390a385Sgjelinek * Come back here in the unlikely event that the number of interfaces 24411390a385Sgjelinek * increases between the time we get the count and the time we do the 24421390a385Sgjelinek * SIOCGLIFCONF ioctl. 24431390a385Sgjelinek */ 24441390a385Sgjelinek retry: 24451390a385Sgjelinek /* Get the number of interfaces. */ 24461390a385Sgjelinek if_num.lifn_family = AF_UNSPEC; 24471390a385Sgjelinek if_num.lifn_flags = LIFC_NOXMIT; 24481390a385Sgjelinek if (ioctl(s, SIOCGLIFNUM, &if_num) < 0) { 24491390a385Sgjelinek (void) close(s); 24501390a385Sgjelinek return (Z_ERR); 24511390a385Sgjelinek } 24521390a385Sgjelinek 24531390a385Sgjelinek /* Get the interface configuration list. */ 24541390a385Sgjelinek space_needed = if_num.lifn_count * sizeof (struct lifreq); 24551390a385Sgjelinek if ((if_buf = malloc(space_needed)) == NULL) { 24561390a385Sgjelinek (void) close(s); 24571390a385Sgjelinek return (Z_ERR); 24581390a385Sgjelinek } 24591390a385Sgjelinek if_conf.lifc_family = AF_UNSPEC; 24601390a385Sgjelinek if_conf.lifc_flags = LIFC_NOXMIT; 24611390a385Sgjelinek if_conf.lifc_len = space_needed; 24621390a385Sgjelinek if_conf.lifc_buf = if_buf; 24631390a385Sgjelinek if (ioctl(s, SIOCGLIFCONF, &if_conf) < 0) { 24641390a385Sgjelinek free(if_buf); 24651390a385Sgjelinek /* 24661390a385Sgjelinek * SIOCGLIFCONF returns EINVAL if the buffer we passed in is 24671390a385Sgjelinek * too small. In this case go back and get the new if cnt. 24681390a385Sgjelinek */ 24691390a385Sgjelinek if (errno == EINVAL) 24701390a385Sgjelinek goto retry; 24711390a385Sgjelinek 24721390a385Sgjelinek (void) close(s); 24731390a385Sgjelinek return (Z_ERR); 24741390a385Sgjelinek } 24751390a385Sgjelinek (void) close(s); 24761390a385Sgjelinek 24771390a385Sgjelinek /* Get the name and address family for each interface. */ 24781390a385Sgjelinek if_reqp = if_conf.lifc_req; 24791390a385Sgjelinek for (i = 0; i < (if_conf.lifc_len / sizeof (struct lifreq)); i++) { 24801390a385Sgjelinek struct net_if **p; 24811390a385Sgjelinek struct lifreq req; 24821390a385Sgjelinek 24831390a385Sgjelinek if (strcmp(LOOPBACK_IF, if_reqp->lifr_name) == 0) { 24841390a385Sgjelinek if_reqp++; 24851390a385Sgjelinek continue; 24861390a385Sgjelinek } 24871390a385Sgjelinek 24881390a385Sgjelinek if ((s = socket(SOCKET_AF(if_reqp->lifr_addr.ss_family), 24891390a385Sgjelinek SOCK_DGRAM, 0)) == -1) { 24901390a385Sgjelinek res = Z_ERR; 24911390a385Sgjelinek break; 24921390a385Sgjelinek } 24931390a385Sgjelinek 24941390a385Sgjelinek (void) strncpy(req.lifr_name, if_reqp->lifr_name, 24951390a385Sgjelinek sizeof (req.lifr_name)); 24961390a385Sgjelinek if (ioctl(s, SIOCGLIFADDR, &req) < 0) { 24971390a385Sgjelinek (void) close(s); 24981390a385Sgjelinek if_reqp++; 24991390a385Sgjelinek continue; 25001390a385Sgjelinek } 25011390a385Sgjelinek 25021390a385Sgjelinek if ((p = (struct net_if **)realloc(local_ifs, 25031390a385Sgjelinek sizeof (struct net_if *) * (cnt + 1))) == NULL) { 25041390a385Sgjelinek res = Z_ERR; 25051390a385Sgjelinek break; 25061390a385Sgjelinek } 25071390a385Sgjelinek local_ifs = p; 25081390a385Sgjelinek 25091390a385Sgjelinek if ((local_ifs[cnt] = malloc(sizeof (struct net_if))) == NULL) { 25101390a385Sgjelinek res = Z_ERR; 25111390a385Sgjelinek break; 25121390a385Sgjelinek } 25131390a385Sgjelinek 25141390a385Sgjelinek if ((local_ifs[cnt]->name = strdup(if_reqp->lifr_name)) 25151390a385Sgjelinek == NULL) { 25161390a385Sgjelinek free(local_ifs[cnt]); 25171390a385Sgjelinek res = Z_ERR; 25181390a385Sgjelinek break; 25191390a385Sgjelinek } 25201390a385Sgjelinek local_ifs[cnt]->af = req.lifr_addr.ss_family; 25211390a385Sgjelinek cnt++; 25221390a385Sgjelinek 25231390a385Sgjelinek (void) close(s); 25241390a385Sgjelinek if_reqp++; 25251390a385Sgjelinek } 25261390a385Sgjelinek 25271390a385Sgjelinek free(if_buf); 25281390a385Sgjelinek 25291390a385Sgjelinek if (res != Z_OK) { 25301390a385Sgjelinek free_local_netifs(cnt, local_ifs); 25311390a385Sgjelinek } else { 25321390a385Sgjelinek *if_cnt = cnt; 25331390a385Sgjelinek *if_list = local_ifs; 25341390a385Sgjelinek } 25351390a385Sgjelinek 25361390a385Sgjelinek return (res); 25371390a385Sgjelinek } 25381390a385Sgjelinek 25391390a385Sgjelinek static char * 25401390a385Sgjelinek af2str(int af) 25411390a385Sgjelinek { 25421390a385Sgjelinek switch (af) { 25431390a385Sgjelinek case AF_INET: 25441390a385Sgjelinek return ("IPv4"); 25451390a385Sgjelinek case AF_INET6: 25461390a385Sgjelinek return ("IPv6"); 25471390a385Sgjelinek default: 25481390a385Sgjelinek return ("Unknown"); 25491390a385Sgjelinek } 25501390a385Sgjelinek } 25511390a385Sgjelinek 25521390a385Sgjelinek /* 25531390a385Sgjelinek * Cross check the network interface name and address family with the 25541390a385Sgjelinek * interfaces that are set up in the global zone so that we can print the 25551390a385Sgjelinek * appropriate error message. 25561390a385Sgjelinek */ 25571390a385Sgjelinek static void 25581390a385Sgjelinek print_net_err(char *phys, char *addr, int af, char *msg) 25591390a385Sgjelinek { 25601390a385Sgjelinek int i; 25611390a385Sgjelinek int local_if_cnt = 0; 25621390a385Sgjelinek struct net_if **local_ifs = NULL; 25631390a385Sgjelinek boolean_t found_if = B_FALSE; 25641390a385Sgjelinek boolean_t found_af = B_FALSE; 25651390a385Sgjelinek 25661390a385Sgjelinek if (get_local_netifs(&local_if_cnt, &local_ifs) != Z_OK) { 25671390a385Sgjelinek (void) fprintf(stderr, 25681390a385Sgjelinek gettext("could not verify %s %s=%s %s=%s\n\t%s\n"), 25691390a385Sgjelinek "net", "address", addr, "physical", phys, msg); 25701390a385Sgjelinek return; 25711390a385Sgjelinek } 25721390a385Sgjelinek 25731390a385Sgjelinek for (i = 0; i < local_if_cnt; i++) { 25741390a385Sgjelinek if (strcmp(phys, local_ifs[i]->name) == 0) { 25751390a385Sgjelinek found_if = B_TRUE; 25761390a385Sgjelinek if (af == local_ifs[i]->af) { 25771390a385Sgjelinek found_af = B_TRUE; 25781390a385Sgjelinek break; 25791390a385Sgjelinek } 25801390a385Sgjelinek } 25811390a385Sgjelinek } 25821390a385Sgjelinek 25831390a385Sgjelinek free_local_netifs(local_if_cnt, local_ifs); 25841390a385Sgjelinek 25851390a385Sgjelinek if (!found_if) { 25861390a385Sgjelinek (void) fprintf(stderr, 25871390a385Sgjelinek gettext("could not verify %s %s=%s\n\t" 25881390a385Sgjelinek "network interface %s is not plumbed in the global zone\n"), 25891390a385Sgjelinek "net", "physical", phys, phys); 25901390a385Sgjelinek return; 25911390a385Sgjelinek } 25921390a385Sgjelinek 25931390a385Sgjelinek /* 25941390a385Sgjelinek * Print this error if we were unable to find the address family 25951390a385Sgjelinek * for this interface. If the af variable is not initialized to 25961390a385Sgjelinek * to something meaningful by the caller (not AF_UNSPEC) then we 25971390a385Sgjelinek * also skip this message since it wouldn't be informative. 25981390a385Sgjelinek */ 25991390a385Sgjelinek if (!found_af && af != AF_UNSPEC) { 26001390a385Sgjelinek (void) fprintf(stderr, 26011390a385Sgjelinek gettext("could not verify %s %s=%s %s=%s\n\tthe %s address " 2602f4b3ec61Sdh155122 "family is not configured on this network interface in " 2603f4b3ec61Sdh155122 "the\n\tglobal zone\n"), 26041390a385Sgjelinek "net", "address", addr, "physical", phys, af2str(af)); 26051390a385Sgjelinek return; 26061390a385Sgjelinek } 26071390a385Sgjelinek 26081390a385Sgjelinek (void) fprintf(stderr, 26091390a385Sgjelinek gettext("could not verify %s %s=%s %s=%s\n\t%s\n"), 26101390a385Sgjelinek "net", "address", addr, "physical", phys, msg); 26111390a385Sgjelinek } 26121390a385Sgjelinek 2613ffbafc53Scomay static int 2614ce28b40eSzt129084 verify_handle(int cmd_num, zone_dochandle_t handle, char *argv[]) 26157c478bd9Sstevel@tonic-gate { 26167c478bd9Sstevel@tonic-gate struct zone_nwiftab nwiftab; 26177c478bd9Sstevel@tonic-gate int return_code = Z_OK; 26187c478bd9Sstevel@tonic-gate int err; 2619108322fbScarlsonj boolean_t in_alt_root; 2620f4b3ec61Sdh155122 zone_iptype_t iptype; 26212b24ab6bSSebastien Roy dladm_handle_t dh; 26222b24ab6bSSebastien Roy dladm_status_t status; 26232b24ab6bSSebastien Roy datalink_id_t linkid; 26242b24ab6bSSebastien Roy char errmsg[DLADM_STRSIZE]; 26257c478bd9Sstevel@tonic-gate 2626108322fbScarlsonj in_alt_root = zonecfg_in_alt_root(); 2627108322fbScarlsonj if (in_alt_root) 2628108322fbScarlsonj goto no_net; 2629108322fbScarlsonj 2630f4b3ec61Sdh155122 if ((err = zonecfg_get_iptype(handle, &iptype)) != Z_OK) { 2631f4b3ec61Sdh155122 errno = err; 2632f4b3ec61Sdh155122 zperror(cmd_to_str(cmd_num), B_TRUE); 2633f4b3ec61Sdh155122 zonecfg_fini_handle(handle); 2634f4b3ec61Sdh155122 return (Z_ERR); 2635f4b3ec61Sdh155122 } 26367c478bd9Sstevel@tonic-gate if ((err = zonecfg_setnwifent(handle)) != Z_OK) { 26377c478bd9Sstevel@tonic-gate errno = err; 26387c478bd9Sstevel@tonic-gate zperror(cmd_to_str(cmd_num), B_TRUE); 26397c478bd9Sstevel@tonic-gate zonecfg_fini_handle(handle); 26407c478bd9Sstevel@tonic-gate return (Z_ERR); 26417c478bd9Sstevel@tonic-gate } 26427c478bd9Sstevel@tonic-gate while (zonecfg_getnwifent(handle, &nwiftab) == Z_OK) { 26437c478bd9Sstevel@tonic-gate struct lifreq lifr; 26441390a385Sgjelinek sa_family_t af = AF_UNSPEC; 2645f4b3ec61Sdh155122 char dl_owner_zname[ZONENAME_MAX]; 2646f4b3ec61Sdh155122 zoneid_t dl_owner_zid; 2647f4b3ec61Sdh155122 zoneid_t target_zid; 2648f4b3ec61Sdh155122 int res; 26497c478bd9Sstevel@tonic-gate 26507c478bd9Sstevel@tonic-gate /* skip any loopback interfaces */ 26517c478bd9Sstevel@tonic-gate if (strcmp(nwiftab.zone_nwif_physical, "lo0") == 0) 26527c478bd9Sstevel@tonic-gate continue; 2653f4b3ec61Sdh155122 switch (iptype) { 2654f4b3ec61Sdh155122 case ZS_SHARED: 2655f4b3ec61Sdh155122 if ((res = zonecfg_valid_net_address( 2656f4b3ec61Sdh155122 nwiftab.zone_nwif_address, &lifr)) != Z_OK) { 26571390a385Sgjelinek print_net_err(nwiftab.zone_nwif_physical, 26581390a385Sgjelinek nwiftab.zone_nwif_address, af, 26591390a385Sgjelinek zonecfg_strerror(res)); 26607c478bd9Sstevel@tonic-gate return_code = Z_ERR; 26617c478bd9Sstevel@tonic-gate continue; 26627c478bd9Sstevel@tonic-gate } 26637c478bd9Sstevel@tonic-gate af = lifr.lifr_addr.ss_family; 2664f4b3ec61Sdh155122 if (!zonecfg_ifname_exists(af, 2665f4b3ec61Sdh155122 nwiftab.zone_nwif_physical)) { 266622321485Svp157776 /* 2667f4b3ec61Sdh155122 * The interface failed to come up. We continue 2668f4b3ec61Sdh155122 * on anyway for the sake of consistency: a 2669f4b3ec61Sdh155122 * zone is not shut down if the interface fails 2670f4b3ec61Sdh155122 * any time after boot, nor does the global zone 2671f4b3ec61Sdh155122 * fail to boot if an interface fails. 267222321485Svp157776 */ 267322321485Svp157776 (void) fprintf(stderr, 2674f4b3ec61Sdh155122 gettext("WARNING: skipping network " 2675f4b3ec61Sdh155122 "interface '%s' which may not be " 2676f4b3ec61Sdh155122 "present/plumbed in the global " 2677f4b3ec61Sdh155122 "zone.\n"), 267822321485Svp157776 nwiftab.zone_nwif_physical); 26797c478bd9Sstevel@tonic-gate } 2680f4b3ec61Sdh155122 break; 2681f4b3ec61Sdh155122 case ZS_EXCLUSIVE: 2682f4b3ec61Sdh155122 /* Warning if it exists for either IPv4 or IPv6 */ 2683f4b3ec61Sdh155122 2684f4b3ec61Sdh155122 if (zonecfg_ifname_exists(AF_INET, 2685f4b3ec61Sdh155122 nwiftab.zone_nwif_physical) || 2686f4b3ec61Sdh155122 zonecfg_ifname_exists(AF_INET6, 2687f4b3ec61Sdh155122 nwiftab.zone_nwif_physical)) { 2688f4b3ec61Sdh155122 (void) fprintf(stderr, 2689f4b3ec61Sdh155122 gettext("WARNING: skipping network " 2690f4b3ec61Sdh155122 "interface '%s' which is used in the " 2691f4b3ec61Sdh155122 "global zone.\n"), 2692f4b3ec61Sdh155122 nwiftab.zone_nwif_physical); 2693f4b3ec61Sdh155122 break; 2694f4b3ec61Sdh155122 } 2695948f2876Sss150715 2696f4b3ec61Sdh155122 /* 26972b24ab6bSSebastien Roy * Verify that the datalink exists and that it isn't 26982b24ab6bSSebastien Roy * already assigned to a zone. 2699f4b3ec61Sdh155122 */ 27002b24ab6bSSebastien Roy if ((status = dladm_open(&dh)) == DLADM_STATUS_OK) { 27012b24ab6bSSebastien Roy status = dladm_name2info(dh, 27022b24ab6bSSebastien Roy nwiftab.zone_nwif_physical, &linkid, NULL, 27032b24ab6bSSebastien Roy NULL, NULL); 27042b24ab6bSSebastien Roy dladm_close(dh); 27052b24ab6bSSebastien Roy } 27062b24ab6bSSebastien Roy if (status != DLADM_STATUS_OK) { 2707f4b3ec61Sdh155122 (void) fprintf(stderr, 2708f4b3ec61Sdh155122 gettext("WARNING: skipping network " 27092b24ab6bSSebastien Roy "interface '%s': %s\n"), 2710948f2876Sss150715 nwiftab.zone_nwif_physical, 27112b24ab6bSSebastien Roy dladm_status2str(status, errmsg)); 2712f4b3ec61Sdh155122 break; 2713f4b3ec61Sdh155122 } 2714f4b3ec61Sdh155122 dl_owner_zid = ALL_ZONES; 27152b24ab6bSSebastien Roy if (zone_check_datalink(&dl_owner_zid, linkid) != 0) 2716f4b3ec61Sdh155122 break; 2717f4b3ec61Sdh155122 2718f4b3ec61Sdh155122 /* 2719f4b3ec61Sdh155122 * If the zone being verified is 2720f4b3ec61Sdh155122 * running and owns the interface 2721f4b3ec61Sdh155122 */ 2722f4b3ec61Sdh155122 target_zid = getzoneidbyname(target_zone); 2723f4b3ec61Sdh155122 if (target_zid == dl_owner_zid) 2724f4b3ec61Sdh155122 break; 2725f4b3ec61Sdh155122 2726f4b3ec61Sdh155122 /* Zone id match failed, use name to check */ 2727f4b3ec61Sdh155122 if (getzonenamebyid(dl_owner_zid, dl_owner_zname, 2728f4b3ec61Sdh155122 ZONENAME_MAX) < 0) { 2729f4b3ec61Sdh155122 /* No name, show ID instead */ 2730f4b3ec61Sdh155122 (void) snprintf(dl_owner_zname, ZONENAME_MAX, 2731f4b3ec61Sdh155122 "<%d>", dl_owner_zid); 2732f4b3ec61Sdh155122 } else if (strcmp(dl_owner_zname, target_zone) == 0) 2733f4b3ec61Sdh155122 break; 2734f4b3ec61Sdh155122 2735f4b3ec61Sdh155122 /* 2736f4b3ec61Sdh155122 * Note here we only report a warning that 2737f4b3ec61Sdh155122 * the interface is already in use by another 2738f4b3ec61Sdh155122 * running zone, and the verify process just 2739f4b3ec61Sdh155122 * goes on, if the interface is still in use 2740f4b3ec61Sdh155122 * when this zone really boots up, zoneadmd 2741f4b3ec61Sdh155122 * will find it. If the name of the zone which 2742f4b3ec61Sdh155122 * owns this interface cannot be determined, 2743f4b3ec61Sdh155122 * then it is not possible to determine if there 2744f4b3ec61Sdh155122 * is a conflict so just report it as a warning. 2745f4b3ec61Sdh155122 */ 2746f4b3ec61Sdh155122 (void) fprintf(stderr, 2747f4b3ec61Sdh155122 gettext("WARNING: skipping network interface " 2748f4b3ec61Sdh155122 "'%s' which is used by the non-global zone " 2749f4b3ec61Sdh155122 "'%s'.\n"), nwiftab.zone_nwif_physical, 2750f4b3ec61Sdh155122 dl_owner_zname); 2751f4b3ec61Sdh155122 break; 2752f4b3ec61Sdh155122 } 27537c478bd9Sstevel@tonic-gate } 27547c478bd9Sstevel@tonic-gate (void) zonecfg_endnwifent(handle); 2755108322fbScarlsonj no_net: 27567c478bd9Sstevel@tonic-gate 2757e7f3c547Sgjelinek /* verify that lofs has not been excluded from the kernel */ 27588cd327d5Sgjelinek if (!(cmd_num == CMD_DETACH || cmd_num == CMD_ATTACH || 27598cd327d5Sgjelinek cmd_num == CMD_MOVE || cmd_num == CMD_CLONE) && 27608cd327d5Sgjelinek modctl(MODLOAD, 1, "fs/lofs", NULL) != 0) { 2761e7f3c547Sgjelinek if (errno == ENXIO) 2762e7f3c547Sgjelinek (void) fprintf(stderr, gettext("could not verify " 2763e7f3c547Sgjelinek "lofs(7FS): possibly excluded in /etc/system\n")); 2764e7f3c547Sgjelinek else 2765e7f3c547Sgjelinek (void) fprintf(stderr, gettext("could not verify " 2766e7f3c547Sgjelinek "lofs(7FS): %s\n"), strerror(errno)); 2767e7f3c547Sgjelinek return_code = Z_ERR; 2768e7f3c547Sgjelinek } 2769e7f3c547Sgjelinek 27707c478bd9Sstevel@tonic-gate if (verify_filesystems(handle) != Z_OK) 27717c478bd9Sstevel@tonic-gate return_code = Z_ERR; 2772108322fbScarlsonj if (!in_alt_root && verify_rctls(handle) != Z_OK) 27737c478bd9Sstevel@tonic-gate return_code = Z_ERR; 2774108322fbScarlsonj if (!in_alt_root && verify_pool(handle) != Z_OK) 27757c478bd9Sstevel@tonic-gate return_code = Z_ERR; 2776ce28b40eSzt129084 if (!in_alt_root && verify_brand(handle, cmd_num, argv) != Z_OK) 27779acbbeafSnn35248 return_code = Z_ERR; 2778fa9e4066Sahrens if (!in_alt_root && verify_datasets(handle) != Z_OK) 2779fa9e4066Sahrens return_code = Z_ERR; 2780ffbafc53Scomay 2781ffbafc53Scomay /* 2782ffbafc53Scomay * As the "mount" command is used for patching/upgrading of zones 2783ffbafc53Scomay * or other maintenance processes, the zone's privilege set is not 2784ffbafc53Scomay * checked in this case. Instead, the default, safe set of 2785ffbafc53Scomay * privileges will be used when this zone is created in the 2786ffbafc53Scomay * kernel. 2787ffbafc53Scomay */ 2788ffbafc53Scomay if (!in_alt_root && cmd_num != CMD_MOUNT && 2789ffbafc53Scomay verify_limitpriv(handle) != Z_OK) 2790ffbafc53Scomay return_code = Z_ERR; 27918cd327d5Sgjelinek 27928cd327d5Sgjelinek return (return_code); 27938cd327d5Sgjelinek } 27948cd327d5Sgjelinek 27958cd327d5Sgjelinek static int 2796ce28b40eSzt129084 verify_details(int cmd_num, char *argv[]) 27978cd327d5Sgjelinek { 27988cd327d5Sgjelinek zone_dochandle_t handle; 27998cd327d5Sgjelinek char zonepath[MAXPATHLEN], checkpath[MAXPATHLEN]; 28008cd327d5Sgjelinek int return_code = Z_OK; 28018cd327d5Sgjelinek int err; 28028cd327d5Sgjelinek 28038cd327d5Sgjelinek if ((handle = zonecfg_init_handle()) == NULL) { 28048cd327d5Sgjelinek zperror(cmd_to_str(cmd_num), B_TRUE); 28058cd327d5Sgjelinek return (Z_ERR); 28068cd327d5Sgjelinek } 28078cd327d5Sgjelinek if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) { 28088cd327d5Sgjelinek errno = err; 28098cd327d5Sgjelinek zperror(cmd_to_str(cmd_num), B_TRUE); 28108cd327d5Sgjelinek zonecfg_fini_handle(handle); 28118cd327d5Sgjelinek return (Z_ERR); 28128cd327d5Sgjelinek } 28138cd327d5Sgjelinek if ((err = zonecfg_get_zonepath(handle, zonepath, sizeof (zonepath))) != 28148cd327d5Sgjelinek Z_OK) { 28158cd327d5Sgjelinek errno = err; 28168cd327d5Sgjelinek zperror(cmd_to_str(cmd_num), B_TRUE); 28178cd327d5Sgjelinek zonecfg_fini_handle(handle); 28188cd327d5Sgjelinek return (Z_ERR); 28198cd327d5Sgjelinek } 28208cd327d5Sgjelinek /* 28218cd327d5Sgjelinek * zonecfg_get_zonepath() gets its data from the XML repository. 28228cd327d5Sgjelinek * Verify this against the index file, which is checked first by 28238cd327d5Sgjelinek * zone_get_zonepath(). If they don't match, bail out. 28248cd327d5Sgjelinek */ 28258cd327d5Sgjelinek if ((err = zone_get_zonepath(target_zone, checkpath, 28268cd327d5Sgjelinek sizeof (checkpath))) != Z_OK) { 28278cd327d5Sgjelinek errno = err; 28288cd327d5Sgjelinek zperror2(target_zone, gettext("could not get zone path")); 2829e767a340Sgjelinek zonecfg_fini_handle(handle); 28308cd327d5Sgjelinek return (Z_ERR); 28318cd327d5Sgjelinek } 28328cd327d5Sgjelinek if (strcmp(zonepath, checkpath) != 0) { 28338cd327d5Sgjelinek /* 28348cd327d5Sgjelinek * TRANSLATION_NOTE 28358cd327d5Sgjelinek * XML and zonepath are literals that should not be translated. 28368cd327d5Sgjelinek */ 28378cd327d5Sgjelinek (void) fprintf(stderr, gettext("The XML repository has " 28388cd327d5Sgjelinek "zonepath '%s',\nbut the index file has zonepath '%s'.\n" 28398cd327d5Sgjelinek "These must match, so fix the incorrect entry.\n"), 28408cd327d5Sgjelinek zonepath, checkpath); 2841e767a340Sgjelinek zonecfg_fini_handle(handle); 28428cd327d5Sgjelinek return (Z_ERR); 28438cd327d5Sgjelinek } 2844ca733e25S if (cmd_num != CMD_ATTACH && 2845ca733e25S validate_zonepath(zonepath, cmd_num) != Z_OK) { 28468cd327d5Sgjelinek (void) fprintf(stderr, gettext("could not verify zonepath %s " 28478cd327d5Sgjelinek "because of the above errors.\n"), zonepath); 28488cd327d5Sgjelinek return_code = Z_ERR; 28498cd327d5Sgjelinek } 28508cd327d5Sgjelinek 2851ce28b40eSzt129084 if (verify_handle(cmd_num, handle, argv) != Z_OK) 28528cd327d5Sgjelinek return_code = Z_ERR; 28538cd327d5Sgjelinek 28547c478bd9Sstevel@tonic-gate zonecfg_fini_handle(handle); 28557c478bd9Sstevel@tonic-gate if (return_code == Z_ERR) 28567c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 28577c478bd9Sstevel@tonic-gate gettext("%s: zone %s failed to verify\n"), 28587c478bd9Sstevel@tonic-gate execname, target_zone); 28597c478bd9Sstevel@tonic-gate return (return_code); 28607c478bd9Sstevel@tonic-gate } 28617c478bd9Sstevel@tonic-gate 28627c478bd9Sstevel@tonic-gate static int 28637c478bd9Sstevel@tonic-gate verify_func(int argc, char *argv[]) 28647c478bd9Sstevel@tonic-gate { 28657c478bd9Sstevel@tonic-gate int arg; 28667c478bd9Sstevel@tonic-gate 28677c478bd9Sstevel@tonic-gate optind = 0; 28687c478bd9Sstevel@tonic-gate if ((arg = getopt(argc, argv, "?")) != EOF) { 28697c478bd9Sstevel@tonic-gate switch (arg) { 28707c478bd9Sstevel@tonic-gate case '?': 28717c478bd9Sstevel@tonic-gate sub_usage(SHELP_VERIFY, CMD_VERIFY); 28727c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 28737c478bd9Sstevel@tonic-gate default: 28747c478bd9Sstevel@tonic-gate sub_usage(SHELP_VERIFY, CMD_VERIFY); 28757c478bd9Sstevel@tonic-gate return (Z_USAGE); 28767c478bd9Sstevel@tonic-gate } 28777c478bd9Sstevel@tonic-gate } 28787c478bd9Sstevel@tonic-gate if (argc > optind) { 28797c478bd9Sstevel@tonic-gate sub_usage(SHELP_VERIFY, CMD_VERIFY); 28807c478bd9Sstevel@tonic-gate return (Z_USAGE); 28817c478bd9Sstevel@tonic-gate } 28829acbbeafSnn35248 if (sanity_check(target_zone, CMD_VERIFY, B_FALSE, B_FALSE, B_FALSE) 28839acbbeafSnn35248 != Z_OK) 28847c478bd9Sstevel@tonic-gate return (Z_ERR); 2885ce28b40eSzt129084 return (verify_details(CMD_VERIFY, argv)); 28867c478bd9Sstevel@tonic-gate } 28877c478bd9Sstevel@tonic-gate 28889acbbeafSnn35248 static int 2889ff17c8bfSgjelinek addoptions(char *buf, char *argv[], size_t len) 2890ff17c8bfSgjelinek { 2891ff17c8bfSgjelinek int i = 0; 2892ff17c8bfSgjelinek 2893ff17c8bfSgjelinek if (buf[0] == '\0') 2894ff17c8bfSgjelinek return (Z_OK); 2895ff17c8bfSgjelinek 2896ff17c8bfSgjelinek while (argv[i] != NULL) { 2897ff17c8bfSgjelinek if (strlcat(buf, " ", len) >= len || 2898ff17c8bfSgjelinek strlcat(buf, argv[i++], len) >= len) { 2899ff17c8bfSgjelinek zerror("Command line too long"); 2900ff17c8bfSgjelinek return (Z_ERR); 2901ff17c8bfSgjelinek } 2902ff17c8bfSgjelinek } 2903ff17c8bfSgjelinek 2904ff17c8bfSgjelinek return (Z_OK); 2905ff17c8bfSgjelinek } 2906ff17c8bfSgjelinek 2907ff17c8bfSgjelinek static int 29089acbbeafSnn35248 addopt(char *buf, int opt, char *optarg, size_t bufsize) 29099acbbeafSnn35248 { 29109acbbeafSnn35248 char optstring[4]; 29119acbbeafSnn35248 29129acbbeafSnn35248 if (opt > 0) 29139acbbeafSnn35248 (void) sprintf(optstring, " -%c", opt); 29149acbbeafSnn35248 else 29159acbbeafSnn35248 (void) strcpy(optstring, " "); 29169acbbeafSnn35248 29179acbbeafSnn35248 if ((strlcat(buf, optstring, bufsize) > bufsize)) 29189acbbeafSnn35248 return (Z_ERR); 2919ff17c8bfSgjelinek 29209acbbeafSnn35248 if ((optarg != NULL) && (strlcat(buf, optarg, bufsize) > bufsize)) 29219acbbeafSnn35248 return (Z_ERR); 2922ff17c8bfSgjelinek 29239acbbeafSnn35248 return (Z_OK); 29249acbbeafSnn35248 } 29257c478bd9Sstevel@tonic-gate 2926ff17c8bfSgjelinek /* ARGSUSED */ 29277c478bd9Sstevel@tonic-gate static int 29287c478bd9Sstevel@tonic-gate install_func(int argc, char *argv[]) 29297c478bd9Sstevel@tonic-gate { 29309acbbeafSnn35248 char cmdbuf[MAXPATHLEN]; 29311100f00dSgjelinek char postcmdbuf[MAXPATHLEN]; 29327c478bd9Sstevel@tonic-gate int lockfd; 29339acbbeafSnn35248 int arg, err, subproc_err; 29347c478bd9Sstevel@tonic-gate char zonepath[MAXPATHLEN]; 2935123807fbSedp brand_handle_t bh = NULL; 29367c478bd9Sstevel@tonic-gate int status; 29371100f00dSgjelinek boolean_t do_postinstall = B_FALSE; 2938ff17c8bfSgjelinek boolean_t brand_help = B_FALSE; 29399acbbeafSnn35248 char opts[128]; 29409acbbeafSnn35248 29419acbbeafSnn35248 if (target_zone == NULL) { 29429acbbeafSnn35248 sub_usage(SHELP_INSTALL, CMD_INSTALL); 29439acbbeafSnn35248 return (Z_USAGE); 29449acbbeafSnn35248 } 29457c478bd9Sstevel@tonic-gate 2946108322fbScarlsonj if (zonecfg_in_alt_root()) { 2947108322fbScarlsonj zerror(gettext("cannot install zone in alternate root")); 2948108322fbScarlsonj return (Z_ERR); 2949108322fbScarlsonj } 2950108322fbScarlsonj 29519acbbeafSnn35248 if ((err = zone_get_zonepath(target_zone, zonepath, 29529acbbeafSnn35248 sizeof (zonepath))) != Z_OK) { 29539acbbeafSnn35248 errno = err; 29549acbbeafSnn35248 zperror2(target_zone, gettext("could not get zone path")); 29559acbbeafSnn35248 return (Z_ERR); 29569acbbeafSnn35248 } 29579acbbeafSnn35248 29589acbbeafSnn35248 /* Fetch the install command from the brand configuration. */ 2959123807fbSedp if ((bh = brand_open(target_brand)) == NULL) { 29609acbbeafSnn35248 zerror(gettext("missing or invalid brand")); 29619acbbeafSnn35248 return (Z_ERR); 29629acbbeafSnn35248 } 29639acbbeafSnn35248 2964ff17c8bfSgjelinek if (get_hook(bh, cmdbuf, sizeof (cmdbuf), brand_get_install, 2965ff17c8bfSgjelinek target_zone, zonepath) != Z_OK) { 29669acbbeafSnn35248 zerror("invalid brand configuration: missing install resource"); 2967123807fbSedp brand_close(bh); 29689acbbeafSnn35248 return (Z_ERR); 29699acbbeafSnn35248 } 29709acbbeafSnn35248 2971ff17c8bfSgjelinek if (get_hook(bh, postcmdbuf, sizeof (postcmdbuf), brand_get_postinstall, 2972ff17c8bfSgjelinek target_zone, zonepath) != Z_OK) { 29731100f00dSgjelinek zerror("invalid brand configuration: missing postinstall " 29741100f00dSgjelinek "resource"); 29751100f00dSgjelinek brand_close(bh); 29761100f00dSgjelinek return (Z_ERR); 29771100f00dSgjelinek } 29781100f00dSgjelinek 2979ff17c8bfSgjelinek if (postcmdbuf[0] != '\0') 2980ff17c8bfSgjelinek do_postinstall = B_TRUE; 2981ff17c8bfSgjelinek 29829acbbeafSnn35248 (void) strcpy(opts, "?x:"); 29839acbbeafSnn35248 /* 29849acbbeafSnn35248 * Fetch the list of recognized command-line options from 29859acbbeafSnn35248 * the brand configuration file. 29869acbbeafSnn35248 */ 2987123807fbSedp if (brand_get_installopts(bh, opts + strlen(opts), 29889acbbeafSnn35248 sizeof (opts) - strlen(opts)) != 0) { 29899acbbeafSnn35248 zerror("invalid brand configuration: missing " 29909acbbeafSnn35248 "install options resource"); 2991123807fbSedp brand_close(bh); 29929acbbeafSnn35248 return (Z_ERR); 29939acbbeafSnn35248 } 2994ff17c8bfSgjelinek 2995123807fbSedp brand_close(bh); 29969acbbeafSnn35248 2997ff17c8bfSgjelinek if (cmdbuf[0] == '\0') { 2998ff17c8bfSgjelinek zerror("Missing brand install command"); 2999ff17c8bfSgjelinek return (Z_ERR); 3000ff17c8bfSgjelinek } 3001ff17c8bfSgjelinek 3002ff17c8bfSgjelinek /* Check the argv string for args we handle internally */ 30037c478bd9Sstevel@tonic-gate optind = 0; 3004ff17c8bfSgjelinek opterr = 0; 30059acbbeafSnn35248 while ((arg = getopt(argc, argv, opts)) != EOF) { 30067c478bd9Sstevel@tonic-gate switch (arg) { 30077c478bd9Sstevel@tonic-gate case '?': 3008ff17c8bfSgjelinek if (optopt == '?') { 30097c478bd9Sstevel@tonic-gate sub_usage(SHELP_INSTALL, CMD_INSTALL); 3010ff17c8bfSgjelinek brand_help = B_TRUE; 30110b5de56dSgjelinek } 3012ff17c8bfSgjelinek /* Ignore unknown options - may be brand specific. */ 30130b5de56dSgjelinek break; 30147c478bd9Sstevel@tonic-gate default: 3015ff17c8bfSgjelinek /* Ignore unknown options - may be brand specific. */ 3016ff17c8bfSgjelinek break; 30177c478bd9Sstevel@tonic-gate } 30189acbbeafSnn35248 30199acbbeafSnn35248 /* 3020ff17c8bfSgjelinek * Append the option to the command line passed to the 3021ff17c8bfSgjelinek * brand-specific install and postinstall routines. 30229acbbeafSnn35248 */ 3023ff17c8bfSgjelinek if (addopt(cmdbuf, optopt, optarg, sizeof (cmdbuf)) != Z_OK) { 30249acbbeafSnn35248 zerror("Install command line too long"); 30259acbbeafSnn35248 return (Z_ERR); 30267c478bd9Sstevel@tonic-gate } 3027ff17c8bfSgjelinek if (addopt(postcmdbuf, optopt, optarg, sizeof (postcmdbuf)) 3028ff17c8bfSgjelinek != Z_OK) { 30291100f00dSgjelinek zerror("Post-Install command line too long"); 30301100f00dSgjelinek return (Z_ERR); 30311100f00dSgjelinek } 30329acbbeafSnn35248 } 30339acbbeafSnn35248 30349acbbeafSnn35248 for (; optind < argc; optind++) { 3035ff17c8bfSgjelinek if (addopt(cmdbuf, 0, argv[optind], sizeof (cmdbuf)) != Z_OK) { 30369acbbeafSnn35248 zerror("Install command line too long"); 30379acbbeafSnn35248 return (Z_ERR); 30389acbbeafSnn35248 } 3039ff17c8bfSgjelinek 3040ff17c8bfSgjelinek if (addopt(postcmdbuf, 0, argv[optind], sizeof (postcmdbuf)) 3041ff17c8bfSgjelinek != Z_OK) { 30421100f00dSgjelinek zerror("Post-Install command line too long"); 30431100f00dSgjelinek return (Z_ERR); 30441100f00dSgjelinek } 30459acbbeafSnn35248 } 30469acbbeafSnn35248 3047ff17c8bfSgjelinek if (!brand_help) { 3048ff17c8bfSgjelinek if (sanity_check(target_zone, CMD_INSTALL, B_FALSE, B_TRUE, 3049ff17c8bfSgjelinek B_FALSE) != Z_OK) 30507c478bd9Sstevel@tonic-gate return (Z_ERR); 3051ce28b40eSzt129084 if (verify_details(CMD_INSTALL, argv) != Z_OK) 30527c478bd9Sstevel@tonic-gate return (Z_ERR); 30537c478bd9Sstevel@tonic-gate 3054ff17c8bfSgjelinek if (zonecfg_grab_lock_file(target_zone, &lockfd) != Z_OK) { 3055ff17c8bfSgjelinek zerror(gettext("another %s may have an operation in " 3056ff17c8bfSgjelinek "progress."), "zoneadm"); 30577c478bd9Sstevel@tonic-gate return (Z_ERR); 30587c478bd9Sstevel@tonic-gate } 30597c478bd9Sstevel@tonic-gate err = zone_set_state(target_zone, ZONE_STATE_INCOMPLETE); 30607c478bd9Sstevel@tonic-gate if (err != Z_OK) { 30617c478bd9Sstevel@tonic-gate errno = err; 30627c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not set state")); 30637c478bd9Sstevel@tonic-gate goto done; 30647c478bd9Sstevel@tonic-gate } 30657c478bd9Sstevel@tonic-gate 30669acbbeafSnn35248 create_zfs_zonepath(zonepath); 30677c478bd9Sstevel@tonic-gate } 30687c478bd9Sstevel@tonic-gate 3069c75cc341S status = do_subproc(cmdbuf); 30709acbbeafSnn35248 if ((subproc_err = 30719acbbeafSnn35248 subproc_status(gettext("brand-specific installation"), status, 30729acbbeafSnn35248 B_FALSE)) != ZONE_SUBPROC_OK) { 3073ff17c8bfSgjelinek if (subproc_err == ZONE_SUBPROC_USAGE && !brand_help) { 3074ff17c8bfSgjelinek sub_usage(SHELP_INSTALL, CMD_INSTALL); 3075ff17c8bfSgjelinek zonecfg_release_lock_file(target_zone, lockfd); 3076ff17c8bfSgjelinek return (Z_ERR); 3077ff17c8bfSgjelinek } 3078ad02e316Sbatschul errno = subproc_err; 30799acbbeafSnn35248 err = Z_ERR; 30807c478bd9Sstevel@tonic-gate goto done; 30819acbbeafSnn35248 } 30827c478bd9Sstevel@tonic-gate 3083ff17c8bfSgjelinek if (brand_help) 3084ff17c8bfSgjelinek return (Z_OK); 3085ff17c8bfSgjelinek 30867c478bd9Sstevel@tonic-gate if ((err = zone_set_state(target_zone, ZONE_STATE_INSTALLED)) != Z_OK) { 30877c478bd9Sstevel@tonic-gate errno = err; 30887c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not set state")); 30897c478bd9Sstevel@tonic-gate goto done; 30907c478bd9Sstevel@tonic-gate } 30917c478bd9Sstevel@tonic-gate 30921100f00dSgjelinek if (do_postinstall) { 30931100f00dSgjelinek status = do_subproc(postcmdbuf); 30941100f00dSgjelinek 30951100f00dSgjelinek if ((subproc_err = 30961100f00dSgjelinek subproc_status(gettext("brand-specific post-install"), 30971100f00dSgjelinek status, B_FALSE)) != ZONE_SUBPROC_OK) { 3098ad02e316Sbatschul errno = subproc_err; 30991100f00dSgjelinek err = Z_ERR; 31001100f00dSgjelinek (void) zone_set_state(target_zone, 31011100f00dSgjelinek ZONE_STATE_INCOMPLETE); 31021100f00dSgjelinek } 31031100f00dSgjelinek } 31041100f00dSgjelinek 31057c478bd9Sstevel@tonic-gate done: 31069acbbeafSnn35248 /* 3107ff17c8bfSgjelinek * If the install script exited with ZONE_SUBPROC_NOTCOMPLETE, try to 3108ff17c8bfSgjelinek * clean up the zone and leave the zone in the CONFIGURED state so that 3109ff17c8bfSgjelinek * another install can be attempted without requiring an uninstall 3110ff17c8bfSgjelinek * first. 31119acbbeafSnn35248 */ 3112ff17c8bfSgjelinek if (subproc_err == ZONE_SUBPROC_NOTCOMPLETE) { 3113ad02e316Sbatschul int temp_err; 3114ad02e316Sbatschul 3115ad02e316Sbatschul if ((temp_err = cleanup_zonepath(zonepath, B_FALSE)) != Z_OK) { 3116ad02e316Sbatschul errno = err = temp_err; 31179acbbeafSnn35248 zperror2(target_zone, 31189acbbeafSnn35248 gettext("cleaning up zonepath failed")); 3119ad02e316Sbatschul } else if ((temp_err = zone_set_state(target_zone, 31209acbbeafSnn35248 ZONE_STATE_CONFIGURED)) != Z_OK) { 3121ad02e316Sbatschul errno = err = temp_err; 31229acbbeafSnn35248 zperror2(target_zone, gettext("could not set state")); 31239acbbeafSnn35248 } 31249acbbeafSnn35248 } 31259acbbeafSnn35248 3126ff17c8bfSgjelinek if (!brand_help) 3127ff17c8bfSgjelinek zonecfg_release_lock_file(target_zone, lockfd); 31287c478bd9Sstevel@tonic-gate return ((err == Z_OK) ? Z_OK : Z_ERR); 31297c478bd9Sstevel@tonic-gate } 31307c478bd9Sstevel@tonic-gate 3131865e09a4Sgjelinek static void 3132865e09a4Sgjelinek warn_dev_match(zone_dochandle_t s_handle, char *source_zone, 3133865e09a4Sgjelinek zone_dochandle_t t_handle, char *target_zone) 3134865e09a4Sgjelinek { 3135865e09a4Sgjelinek int err; 3136865e09a4Sgjelinek struct zone_devtab s_devtab; 3137865e09a4Sgjelinek struct zone_devtab t_devtab; 3138865e09a4Sgjelinek 3139865e09a4Sgjelinek if ((err = zonecfg_setdevent(t_handle)) != Z_OK) { 3140865e09a4Sgjelinek errno = err; 3141865e09a4Sgjelinek zperror2(target_zone, gettext("could not enumerate devices")); 3142865e09a4Sgjelinek return; 3143865e09a4Sgjelinek } 3144865e09a4Sgjelinek 3145865e09a4Sgjelinek while (zonecfg_getdevent(t_handle, &t_devtab) == Z_OK) { 3146865e09a4Sgjelinek if ((err = zonecfg_setdevent(s_handle)) != Z_OK) { 3147865e09a4Sgjelinek errno = err; 3148865e09a4Sgjelinek zperror2(source_zone, 3149865e09a4Sgjelinek gettext("could not enumerate devices")); 3150865e09a4Sgjelinek (void) zonecfg_enddevent(t_handle); 3151865e09a4Sgjelinek return; 3152865e09a4Sgjelinek } 3153865e09a4Sgjelinek 3154865e09a4Sgjelinek while (zonecfg_getdevent(s_handle, &s_devtab) == Z_OK) { 3155865e09a4Sgjelinek /* 3156865e09a4Sgjelinek * Use fnmatch to catch the case where wildcards 3157865e09a4Sgjelinek * were used in one zone and the other has an 3158865e09a4Sgjelinek * explicit entry (e.g. /dev/dsk/c0t0d0s6 vs. 3159865e09a4Sgjelinek * /dev/\*dsk/c0t0d0s6). 3160865e09a4Sgjelinek */ 3161865e09a4Sgjelinek if (fnmatch(t_devtab.zone_dev_match, 3162865e09a4Sgjelinek s_devtab.zone_dev_match, FNM_PATHNAME) == 0 || 3163865e09a4Sgjelinek fnmatch(s_devtab.zone_dev_match, 3164865e09a4Sgjelinek t_devtab.zone_dev_match, FNM_PATHNAME) == 0) { 3165865e09a4Sgjelinek (void) fprintf(stderr, 3166865e09a4Sgjelinek gettext("WARNING: device '%s' " 3167865e09a4Sgjelinek "is configured in both zones.\n"), 3168865e09a4Sgjelinek t_devtab.zone_dev_match); 3169865e09a4Sgjelinek break; 3170865e09a4Sgjelinek } 3171865e09a4Sgjelinek } 3172865e09a4Sgjelinek (void) zonecfg_enddevent(s_handle); 3173865e09a4Sgjelinek } 3174865e09a4Sgjelinek 3175865e09a4Sgjelinek (void) zonecfg_enddevent(t_handle); 3176865e09a4Sgjelinek } 3177865e09a4Sgjelinek 3178865e09a4Sgjelinek /* 3179865e09a4Sgjelinek * Check if the specified mount option (opt) is contained within the 3180865e09a4Sgjelinek * options string. 3181865e09a4Sgjelinek */ 3182865e09a4Sgjelinek static boolean_t 3183865e09a4Sgjelinek opt_match(char *opt, char *options) 3184865e09a4Sgjelinek { 3185865e09a4Sgjelinek char *p; 3186865e09a4Sgjelinek char *lastp; 3187865e09a4Sgjelinek 3188865e09a4Sgjelinek if ((p = strtok_r(options, ",", &lastp)) != NULL) { 3189865e09a4Sgjelinek if (strcmp(p, opt) == 0) 3190865e09a4Sgjelinek return (B_TRUE); 3191865e09a4Sgjelinek while ((p = strtok_r(NULL, ",", &lastp)) != NULL) { 3192865e09a4Sgjelinek if (strcmp(p, opt) == 0) 3193865e09a4Sgjelinek return (B_TRUE); 3194865e09a4Sgjelinek } 3195865e09a4Sgjelinek } 3196865e09a4Sgjelinek 3197865e09a4Sgjelinek return (B_FALSE); 3198865e09a4Sgjelinek } 3199865e09a4Sgjelinek 32000b5de56dSgjelinek #define RW_LOFS "WARNING: read-write lofs file system on '%s' is configured " \ 3201865e09a4Sgjelinek "in both zones.\n" 3202865e09a4Sgjelinek 3203865e09a4Sgjelinek static void 3204865e09a4Sgjelinek print_fs_warnings(struct zone_fstab *s_fstab, struct zone_fstab *t_fstab) 3205865e09a4Sgjelinek { 3206865e09a4Sgjelinek /* 3207865e09a4Sgjelinek * It is ok to have shared lofs mounted fs but we want to warn if 3208865e09a4Sgjelinek * either is rw since this will effect the other zone. 3209865e09a4Sgjelinek */ 3210865e09a4Sgjelinek if (strcmp(t_fstab->zone_fs_type, "lofs") == 0) { 3211865e09a4Sgjelinek zone_fsopt_t *optp; 3212865e09a4Sgjelinek 3213865e09a4Sgjelinek /* The default is rw so no options means rw */ 3214865e09a4Sgjelinek if (t_fstab->zone_fs_options == NULL || 3215865e09a4Sgjelinek s_fstab->zone_fs_options == NULL) { 3216865e09a4Sgjelinek (void) fprintf(stderr, gettext(RW_LOFS), 3217865e09a4Sgjelinek t_fstab->zone_fs_special); 3218865e09a4Sgjelinek return; 3219865e09a4Sgjelinek } 3220865e09a4Sgjelinek 3221865e09a4Sgjelinek for (optp = s_fstab->zone_fs_options; optp != NULL; 3222865e09a4Sgjelinek optp = optp->zone_fsopt_next) { 3223865e09a4Sgjelinek if (opt_match("rw", optp->zone_fsopt_opt)) { 3224865e09a4Sgjelinek (void) fprintf(stderr, gettext(RW_LOFS), 3225865e09a4Sgjelinek s_fstab->zone_fs_special); 3226865e09a4Sgjelinek return; 3227865e09a4Sgjelinek } 3228865e09a4Sgjelinek } 3229865e09a4Sgjelinek 3230865e09a4Sgjelinek for (optp = t_fstab->zone_fs_options; optp != NULL; 3231865e09a4Sgjelinek optp = optp->zone_fsopt_next) { 3232865e09a4Sgjelinek if (opt_match("rw", optp->zone_fsopt_opt)) { 3233865e09a4Sgjelinek (void) fprintf(stderr, gettext(RW_LOFS), 3234865e09a4Sgjelinek t_fstab->zone_fs_special); 3235865e09a4Sgjelinek return; 3236865e09a4Sgjelinek } 3237865e09a4Sgjelinek } 3238865e09a4Sgjelinek 3239865e09a4Sgjelinek return; 3240865e09a4Sgjelinek } 3241865e09a4Sgjelinek 3242865e09a4Sgjelinek /* 3243865e09a4Sgjelinek * TRANSLATION_NOTE 32440b5de56dSgjelinek * The first variable is the file system type and the second is 32450b5de56dSgjelinek * the file system special device. For example, 32460b5de56dSgjelinek * WARNING: ufs file system on '/dev/dsk/c0t0d0s0' ... 3247865e09a4Sgjelinek */ 32480b5de56dSgjelinek (void) fprintf(stderr, gettext("WARNING: %s file system on '%s' " 3249865e09a4Sgjelinek "is configured in both zones.\n"), t_fstab->zone_fs_type, 3250865e09a4Sgjelinek t_fstab->zone_fs_special); 3251865e09a4Sgjelinek } 3252865e09a4Sgjelinek 3253865e09a4Sgjelinek static void 3254865e09a4Sgjelinek warn_fs_match(zone_dochandle_t s_handle, char *source_zone, 3255865e09a4Sgjelinek zone_dochandle_t t_handle, char *target_zone) 3256865e09a4Sgjelinek { 3257865e09a4Sgjelinek int err; 3258865e09a4Sgjelinek struct zone_fstab s_fstab; 3259865e09a4Sgjelinek struct zone_fstab t_fstab; 3260865e09a4Sgjelinek 3261865e09a4Sgjelinek if ((err = zonecfg_setfsent(t_handle)) != Z_OK) { 3262865e09a4Sgjelinek errno = err; 3263865e09a4Sgjelinek zperror2(target_zone, 32640b5de56dSgjelinek gettext("could not enumerate file systems")); 3265865e09a4Sgjelinek return; 3266865e09a4Sgjelinek } 3267865e09a4Sgjelinek 3268865e09a4Sgjelinek while (zonecfg_getfsent(t_handle, &t_fstab) == Z_OK) { 3269865e09a4Sgjelinek if ((err = zonecfg_setfsent(s_handle)) != Z_OK) { 3270865e09a4Sgjelinek errno = err; 3271865e09a4Sgjelinek zperror2(source_zone, 32720b5de56dSgjelinek gettext("could not enumerate file systems")); 3273865e09a4Sgjelinek (void) zonecfg_endfsent(t_handle); 3274865e09a4Sgjelinek return; 3275865e09a4Sgjelinek } 3276865e09a4Sgjelinek 3277865e09a4Sgjelinek while (zonecfg_getfsent(s_handle, &s_fstab) == Z_OK) { 3278865e09a4Sgjelinek if (strcmp(t_fstab.zone_fs_special, 3279865e09a4Sgjelinek s_fstab.zone_fs_special) == 0) { 3280865e09a4Sgjelinek print_fs_warnings(&s_fstab, &t_fstab); 3281865e09a4Sgjelinek break; 3282865e09a4Sgjelinek } 3283865e09a4Sgjelinek } 3284865e09a4Sgjelinek (void) zonecfg_endfsent(s_handle); 3285865e09a4Sgjelinek } 3286865e09a4Sgjelinek 3287865e09a4Sgjelinek (void) zonecfg_endfsent(t_handle); 3288865e09a4Sgjelinek } 3289865e09a4Sgjelinek 3290865e09a4Sgjelinek /* 3291865e09a4Sgjelinek * We don't catch the case where you used the same IP address but 3292865e09a4Sgjelinek * it is not an exact string match. For example, 192.9.0.128 vs. 192.09.0.128. 3293865e09a4Sgjelinek * However, we're not going to worry about that but we will check for 3294865e09a4Sgjelinek * a possible netmask on one of the addresses (e.g. 10.0.0.1 and 10.0.0.1/24) 3295865e09a4Sgjelinek * and handle that case as a match. 3296865e09a4Sgjelinek */ 3297865e09a4Sgjelinek static void 3298865e09a4Sgjelinek warn_ip_match(zone_dochandle_t s_handle, char *source_zone, 3299865e09a4Sgjelinek zone_dochandle_t t_handle, char *target_zone) 3300865e09a4Sgjelinek { 3301865e09a4Sgjelinek int err; 3302865e09a4Sgjelinek struct zone_nwiftab s_nwiftab; 3303865e09a4Sgjelinek struct zone_nwiftab t_nwiftab; 3304865e09a4Sgjelinek 3305865e09a4Sgjelinek if ((err = zonecfg_setnwifent(t_handle)) != Z_OK) { 3306865e09a4Sgjelinek errno = err; 3307865e09a4Sgjelinek zperror2(target_zone, 3308865e09a4Sgjelinek gettext("could not enumerate network interfaces")); 3309865e09a4Sgjelinek return; 3310865e09a4Sgjelinek } 3311865e09a4Sgjelinek 3312865e09a4Sgjelinek while (zonecfg_getnwifent(t_handle, &t_nwiftab) == Z_OK) { 3313865e09a4Sgjelinek char *p; 3314865e09a4Sgjelinek 3315865e09a4Sgjelinek /* remove an (optional) netmask from the address */ 3316865e09a4Sgjelinek if ((p = strchr(t_nwiftab.zone_nwif_address, '/')) != NULL) 3317865e09a4Sgjelinek *p = '\0'; 3318865e09a4Sgjelinek 3319865e09a4Sgjelinek if ((err = zonecfg_setnwifent(s_handle)) != Z_OK) { 3320865e09a4Sgjelinek errno = err; 3321865e09a4Sgjelinek zperror2(source_zone, 3322865e09a4Sgjelinek gettext("could not enumerate network interfaces")); 3323865e09a4Sgjelinek (void) zonecfg_endnwifent(t_handle); 3324865e09a4Sgjelinek return; 3325865e09a4Sgjelinek } 3326865e09a4Sgjelinek 3327865e09a4Sgjelinek while (zonecfg_getnwifent(s_handle, &s_nwiftab) == Z_OK) { 3328865e09a4Sgjelinek /* remove an (optional) netmask from the address */ 3329865e09a4Sgjelinek if ((p = strchr(s_nwiftab.zone_nwif_address, '/')) 3330865e09a4Sgjelinek != NULL) 3331865e09a4Sgjelinek *p = '\0'; 3332865e09a4Sgjelinek 3333f4b3ec61Sdh155122 /* For exclusive-IP zones, address is not specified. */ 3334f4b3ec61Sdh155122 if (strlen(s_nwiftab.zone_nwif_address) == 0) 3335f4b3ec61Sdh155122 continue; 3336f4b3ec61Sdh155122 3337865e09a4Sgjelinek if (strcmp(t_nwiftab.zone_nwif_address, 3338865e09a4Sgjelinek s_nwiftab.zone_nwif_address) == 0) { 3339865e09a4Sgjelinek (void) fprintf(stderr, 3340865e09a4Sgjelinek gettext("WARNING: network address '%s' " 3341865e09a4Sgjelinek "is configured in both zones.\n"), 3342865e09a4Sgjelinek t_nwiftab.zone_nwif_address); 3343865e09a4Sgjelinek break; 3344865e09a4Sgjelinek } 3345865e09a4Sgjelinek } 3346865e09a4Sgjelinek (void) zonecfg_endnwifent(s_handle); 3347865e09a4Sgjelinek } 3348865e09a4Sgjelinek 3349865e09a4Sgjelinek (void) zonecfg_endnwifent(t_handle); 3350865e09a4Sgjelinek } 3351865e09a4Sgjelinek 3352865e09a4Sgjelinek static void 33539acbbeafSnn35248 warn_dataset_match(zone_dochandle_t s_handle, char *source, 33549acbbeafSnn35248 zone_dochandle_t t_handle, char *target) 3355865e09a4Sgjelinek { 3356865e09a4Sgjelinek int err; 3357865e09a4Sgjelinek struct zone_dstab s_dstab; 3358865e09a4Sgjelinek struct zone_dstab t_dstab; 3359865e09a4Sgjelinek 3360865e09a4Sgjelinek if ((err = zonecfg_setdsent(t_handle)) != Z_OK) { 3361865e09a4Sgjelinek errno = err; 33629acbbeafSnn35248 zperror2(target, gettext("could not enumerate datasets")); 3363865e09a4Sgjelinek return; 3364865e09a4Sgjelinek } 3365865e09a4Sgjelinek 3366865e09a4Sgjelinek while (zonecfg_getdsent(t_handle, &t_dstab) == Z_OK) { 3367865e09a4Sgjelinek if ((err = zonecfg_setdsent(s_handle)) != Z_OK) { 3368865e09a4Sgjelinek errno = err; 33699acbbeafSnn35248 zperror2(source, 3370865e09a4Sgjelinek gettext("could not enumerate datasets")); 3371865e09a4Sgjelinek (void) zonecfg_enddsent(t_handle); 3372865e09a4Sgjelinek return; 3373865e09a4Sgjelinek } 3374865e09a4Sgjelinek 3375865e09a4Sgjelinek while (zonecfg_getdsent(s_handle, &s_dstab) == Z_OK) { 3376865e09a4Sgjelinek if (strcmp(t_dstab.zone_dataset_name, 3377865e09a4Sgjelinek s_dstab.zone_dataset_name) == 0) { 33789acbbeafSnn35248 target_zone = source; 33799acbbeafSnn35248 zerror(gettext("WARNING: dataset '%s' " 3380865e09a4Sgjelinek "is configured in both zones.\n"), 3381865e09a4Sgjelinek t_dstab.zone_dataset_name); 3382865e09a4Sgjelinek break; 3383865e09a4Sgjelinek } 3384865e09a4Sgjelinek } 3385865e09a4Sgjelinek (void) zonecfg_enddsent(s_handle); 3386865e09a4Sgjelinek } 3387865e09a4Sgjelinek 3388865e09a4Sgjelinek (void) zonecfg_enddsent(t_handle); 3389865e09a4Sgjelinek } 3390865e09a4Sgjelinek 33919acbbeafSnn35248 /* 33929acbbeafSnn35248 * Check that the clone and its source have the same brand type. 33939acbbeafSnn35248 */ 33949acbbeafSnn35248 static int 33959acbbeafSnn35248 valid_brand_clone(char *source_zone, char *target_zone) 33969acbbeafSnn35248 { 3397123807fbSedp brand_handle_t bh; 33989acbbeafSnn35248 char source_brand[MAXNAMELEN]; 33999acbbeafSnn35248 34009acbbeafSnn35248 if ((zone_get_brand(source_zone, source_brand, 34019acbbeafSnn35248 sizeof (source_brand))) != Z_OK) { 34029acbbeafSnn35248 (void) fprintf(stderr, "%s: zone '%s': %s\n", 34039acbbeafSnn35248 execname, source_zone, gettext("missing or invalid brand")); 34049acbbeafSnn35248 return (Z_ERR); 34059acbbeafSnn35248 } 34069acbbeafSnn35248 3407ad02e316Sbatschul if (strcmp(source_brand, target_brand) != 0) { 34089acbbeafSnn35248 (void) fprintf(stderr, 34099acbbeafSnn35248 gettext("%s: Zones '%s' and '%s' have different brand " 34109acbbeafSnn35248 "types.\n"), execname, source_zone, target_zone); 34119acbbeafSnn35248 return (Z_ERR); 34129acbbeafSnn35248 } 34139acbbeafSnn35248 3414123807fbSedp if ((bh = brand_open(target_brand)) == NULL) { 34159acbbeafSnn35248 zerror(gettext("missing or invalid brand")); 34169acbbeafSnn35248 return (Z_ERR); 34179acbbeafSnn35248 } 3418123807fbSedp brand_close(bh); 34199acbbeafSnn35248 return (Z_OK); 34209acbbeafSnn35248 } 34219acbbeafSnn35248 3422865e09a4Sgjelinek static int 3423865e09a4Sgjelinek validate_clone(char *source_zone, char *target_zone) 3424865e09a4Sgjelinek { 3425865e09a4Sgjelinek int err = Z_OK; 3426865e09a4Sgjelinek zone_dochandle_t s_handle; 3427865e09a4Sgjelinek zone_dochandle_t t_handle; 3428865e09a4Sgjelinek 3429865e09a4Sgjelinek if ((t_handle = zonecfg_init_handle()) == NULL) { 3430865e09a4Sgjelinek zperror(cmd_to_str(CMD_CLONE), B_TRUE); 3431865e09a4Sgjelinek return (Z_ERR); 3432865e09a4Sgjelinek } 3433865e09a4Sgjelinek if ((err = zonecfg_get_handle(target_zone, t_handle)) != Z_OK) { 3434865e09a4Sgjelinek errno = err; 3435865e09a4Sgjelinek zperror(cmd_to_str(CMD_CLONE), B_TRUE); 3436865e09a4Sgjelinek zonecfg_fini_handle(t_handle); 3437865e09a4Sgjelinek return (Z_ERR); 3438865e09a4Sgjelinek } 3439865e09a4Sgjelinek 3440865e09a4Sgjelinek if ((s_handle = zonecfg_init_handle()) == NULL) { 3441865e09a4Sgjelinek zperror(cmd_to_str(CMD_CLONE), B_TRUE); 3442865e09a4Sgjelinek zonecfg_fini_handle(t_handle); 3443865e09a4Sgjelinek return (Z_ERR); 3444865e09a4Sgjelinek } 3445865e09a4Sgjelinek if ((err = zonecfg_get_handle(source_zone, s_handle)) != Z_OK) { 3446865e09a4Sgjelinek errno = err; 3447865e09a4Sgjelinek zperror(cmd_to_str(CMD_CLONE), B_TRUE); 3448865e09a4Sgjelinek goto done; 3449865e09a4Sgjelinek } 3450865e09a4Sgjelinek 34519acbbeafSnn35248 /* verify new zone has same brand type */ 34529acbbeafSnn35248 err = valid_brand_clone(source_zone, target_zone); 34539acbbeafSnn35248 if (err != Z_OK) 34549acbbeafSnn35248 goto done; 34559acbbeafSnn35248 3456865e09a4Sgjelinek /* warn about imported fs's which are the same */ 3457865e09a4Sgjelinek warn_fs_match(s_handle, source_zone, t_handle, target_zone); 3458865e09a4Sgjelinek 3459865e09a4Sgjelinek /* warn about imported IP addresses which are the same */ 3460865e09a4Sgjelinek warn_ip_match(s_handle, source_zone, t_handle, target_zone); 3461865e09a4Sgjelinek 3462865e09a4Sgjelinek /* warn about imported devices which are the same */ 3463865e09a4Sgjelinek warn_dev_match(s_handle, source_zone, t_handle, target_zone); 3464865e09a4Sgjelinek 3465865e09a4Sgjelinek /* warn about imported datasets which are the same */ 3466865e09a4Sgjelinek warn_dataset_match(s_handle, source_zone, t_handle, target_zone); 3467865e09a4Sgjelinek 3468865e09a4Sgjelinek done: 3469865e09a4Sgjelinek zonecfg_fini_handle(t_handle); 3470865e09a4Sgjelinek zonecfg_fini_handle(s_handle); 3471865e09a4Sgjelinek 3472865e09a4Sgjelinek return ((err == Z_OK) ? Z_OK : Z_ERR); 3473865e09a4Sgjelinek } 3474865e09a4Sgjelinek 3475865e09a4Sgjelinek static int 3476865e09a4Sgjelinek copy_zone(char *src, char *dst) 3477865e09a4Sgjelinek { 3478865e09a4Sgjelinek boolean_t out_null = B_FALSE; 3479865e09a4Sgjelinek int status; 3480865e09a4Sgjelinek char *outfile; 3481865e09a4Sgjelinek char cmdbuf[MAXPATHLEN * 2 + 128]; 3482865e09a4Sgjelinek 3483865e09a4Sgjelinek if ((outfile = tempnam("/var/log", "zone")) == NULL) { 3484865e09a4Sgjelinek outfile = "/dev/null"; 3485865e09a4Sgjelinek out_null = B_TRUE; 3486865e09a4Sgjelinek } 3487865e09a4Sgjelinek 34880b5de56dSgjelinek /* 34890b5de56dSgjelinek * Use find to get the list of files to copy. We need to skip 34900b5de56dSgjelinek * files of type "socket" since cpio can't handle those but that 34910b5de56dSgjelinek * should be ok since the app will recreate the socket when it runs. 34920b5de56dSgjelinek * We also need to filter out anything under the .zfs subdir. Since 34930b5de56dSgjelinek * find is running depth-first, we need the extra egrep to filter .zfs. 34940b5de56dSgjelinek */ 3495865e09a4Sgjelinek (void) snprintf(cmdbuf, sizeof (cmdbuf), 34960b5de56dSgjelinek "cd %s && /usr/bin/find . -type s -prune -o -depth -print | " 349707b574eeSgjelinek "/usr/bin/egrep -v '^\\./\\.zfs$|^\\./\\.zfs/' | " 3498865e09a4Sgjelinek "/usr/bin/cpio -pdmuP@ %s > %s 2>&1", 3499865e09a4Sgjelinek src, dst, outfile); 3500865e09a4Sgjelinek 3501865e09a4Sgjelinek status = do_subproc(cmdbuf); 3502865e09a4Sgjelinek 35039acbbeafSnn35248 if (subproc_status("copy", status, B_TRUE) != ZONE_SUBPROC_OK) { 3504865e09a4Sgjelinek if (!out_null) 3505865e09a4Sgjelinek (void) fprintf(stderr, gettext("\nThe copy failed.\n" 3506865e09a4Sgjelinek "More information can be found in %s\n"), outfile); 35079acbbeafSnn35248 return (Z_ERR); 3508865e09a4Sgjelinek } 3509865e09a4Sgjelinek 3510865e09a4Sgjelinek if (!out_null) 3511865e09a4Sgjelinek (void) unlink(outfile); 3512865e09a4Sgjelinek 3513865e09a4Sgjelinek return (Z_OK); 3514865e09a4Sgjelinek } 3515865e09a4Sgjelinek 3516865e09a4Sgjelinek /* ARGSUSED */ 35170094b373Sjv227347 int 35189a686fbcSPaul Dagnelie zfm_print(const struct mnttab *p, void *r) 35199a686fbcSPaul Dagnelie { 35200094b373Sjv227347 zerror(" %s\n", p->mnt_mountp); 3521865e09a4Sgjelinek return (0); 3522865e09a4Sgjelinek } 3523865e09a4Sgjelinek 35240b5de56dSgjelinek int 35250b5de56dSgjelinek clone_copy(char *source_zonepath, char *zonepath) 35260b5de56dSgjelinek { 35270b5de56dSgjelinek int err; 35280b5de56dSgjelinek 35290b5de56dSgjelinek /* Don't clone the zone if anything is still mounted there */ 35300b5de56dSgjelinek if (zonecfg_find_mounts(source_zonepath, NULL, NULL)) { 35310b5de56dSgjelinek zerror(gettext("These file systems are mounted on " 35320b5de56dSgjelinek "subdirectories of %s.\n"), source_zonepath); 35330b5de56dSgjelinek (void) zonecfg_find_mounts(source_zonepath, zfm_print, NULL); 35340b5de56dSgjelinek return (Z_ERR); 35350b5de56dSgjelinek } 35360b5de56dSgjelinek 35370b5de56dSgjelinek /* 35380b5de56dSgjelinek * Attempt to create a ZFS fs for the zonepath. As usual, we don't 35390b5de56dSgjelinek * care if this works or not since we always have the default behavior 35400b5de56dSgjelinek * of a simple directory for the zonepath. 35410b5de56dSgjelinek */ 35420b5de56dSgjelinek create_zfs_zonepath(zonepath); 35430b5de56dSgjelinek 35440b5de56dSgjelinek (void) printf(gettext("Copying %s..."), source_zonepath); 35450b5de56dSgjelinek (void) fflush(stdout); 35460b5de56dSgjelinek 35470b5de56dSgjelinek err = copy_zone(source_zonepath, zonepath); 35480b5de56dSgjelinek 35490b5de56dSgjelinek (void) printf("\n"); 35500b5de56dSgjelinek 35510b5de56dSgjelinek return (err); 35520b5de56dSgjelinek } 35530b5de56dSgjelinek 3554865e09a4Sgjelinek static int 3555865e09a4Sgjelinek clone_func(int argc, char *argv[]) 3556865e09a4Sgjelinek { 3557865e09a4Sgjelinek char *source_zone = NULL; 3558865e09a4Sgjelinek int lockfd; 3559865e09a4Sgjelinek int err, arg; 3560865e09a4Sgjelinek char zonepath[MAXPATHLEN]; 3561865e09a4Sgjelinek char source_zonepath[MAXPATHLEN]; 3562865e09a4Sgjelinek zone_state_t state; 3563865e09a4Sgjelinek zone_entry_t *zent; 35640b5de56dSgjelinek char *method = NULL; 35650b5de56dSgjelinek char *snapshot = NULL; 3566ff17c8bfSgjelinek char cmdbuf[MAXPATHLEN]; 3567ff17c8bfSgjelinek char postcmdbuf[MAXPATHLEN]; 3568ff17c8bfSgjelinek char presnapbuf[MAXPATHLEN]; 3569ff17c8bfSgjelinek char postsnapbuf[MAXPATHLEN]; 3570ff17c8bfSgjelinek char validsnapbuf[MAXPATHLEN]; 3571ff17c8bfSgjelinek brand_handle_t bh = NULL; 3572ff17c8bfSgjelinek int status; 3573ff17c8bfSgjelinek boolean_t brand_help = B_FALSE; 3574865e09a4Sgjelinek 3575865e09a4Sgjelinek if (zonecfg_in_alt_root()) { 3576865e09a4Sgjelinek zerror(gettext("cannot clone zone in alternate root")); 3577865e09a4Sgjelinek return (Z_ERR); 3578865e09a4Sgjelinek } 3579865e09a4Sgjelinek 3580ff17c8bfSgjelinek /* Check the argv string for args we handle internally */ 3581865e09a4Sgjelinek optind = 0; 3582ff17c8bfSgjelinek opterr = 0; 3583ff17c8bfSgjelinek while ((arg = getopt(argc, argv, "?m:s:")) != EOF) { 3584865e09a4Sgjelinek switch (arg) { 3585865e09a4Sgjelinek case '?': 3586ff17c8bfSgjelinek if (optopt == '?') { 3587865e09a4Sgjelinek sub_usage(SHELP_CLONE, CMD_CLONE); 3588ff17c8bfSgjelinek brand_help = B_TRUE; 3589ff17c8bfSgjelinek } 3590ff17c8bfSgjelinek /* Ignore unknown options - may be brand specific. */ 3591ff17c8bfSgjelinek break; 3592865e09a4Sgjelinek case 'm': 3593865e09a4Sgjelinek method = optarg; 3594865e09a4Sgjelinek break; 35950b5de56dSgjelinek case 's': 35960b5de56dSgjelinek snapshot = optarg; 35970b5de56dSgjelinek break; 3598865e09a4Sgjelinek default: 3599ff17c8bfSgjelinek /* Ignore unknown options - may be brand specific. */ 3600ff17c8bfSgjelinek break; 3601ff17c8bfSgjelinek } 3602ff17c8bfSgjelinek } 3603ff17c8bfSgjelinek 3604ff17c8bfSgjelinek if (argc != (optind + 1)) { 3605865e09a4Sgjelinek sub_usage(SHELP_CLONE, CMD_CLONE); 3606865e09a4Sgjelinek return (Z_USAGE); 3607865e09a4Sgjelinek } 3608ff17c8bfSgjelinek 3609865e09a4Sgjelinek source_zone = argv[optind]; 3610ff17c8bfSgjelinek 3611ff17c8bfSgjelinek if (!brand_help) { 3612ff17c8bfSgjelinek if (sanity_check(target_zone, CMD_CLONE, B_FALSE, B_TRUE, 3613ff17c8bfSgjelinek B_FALSE) != Z_OK) 3614865e09a4Sgjelinek return (Z_ERR); 3615ce28b40eSzt129084 if (verify_details(CMD_CLONE, argv) != Z_OK) 3616865e09a4Sgjelinek return (Z_ERR); 3617865e09a4Sgjelinek 3618865e09a4Sgjelinek /* 3619865e09a4Sgjelinek * We also need to do some extra validation on the source zone. 3620865e09a4Sgjelinek */ 3621865e09a4Sgjelinek if (strcmp(source_zone, GLOBAL_ZONENAME) == 0) { 3622ff17c8bfSgjelinek zerror(gettext("%s operation is invalid for the " 3623ff17c8bfSgjelinek "global zone."), cmd_to_str(CMD_CLONE)); 3624865e09a4Sgjelinek return (Z_ERR); 3625865e09a4Sgjelinek } 3626865e09a4Sgjelinek 3627865e09a4Sgjelinek if (strncmp(source_zone, "SUNW", 4) == 0) { 3628ff17c8bfSgjelinek zerror(gettext("%s operation is invalid for zones " 3629ff17c8bfSgjelinek "starting with SUNW."), cmd_to_str(CMD_CLONE)); 3630865e09a4Sgjelinek return (Z_ERR); 3631865e09a4Sgjelinek } 3632865e09a4Sgjelinek 3633cb8a054bSGlenn Faden if (auth_check(username, source_zone, SOURCE_ZONE) == Z_ERR) { 3634cb8a054bSGlenn Faden zerror(gettext("%s operation is invalid because " 3635cb8a054bSGlenn Faden "user is not authorized to read source zone."), 3636cb8a054bSGlenn Faden cmd_to_str(CMD_CLONE)); 3637cb8a054bSGlenn Faden return (Z_ERR); 3638cb8a054bSGlenn Faden } 3639cb8a054bSGlenn Faden 3640865e09a4Sgjelinek zent = lookup_running_zone(source_zone); 3641865e09a4Sgjelinek if (zent != NULL) { 3642865e09a4Sgjelinek /* check whether the zone is ready or running */ 3643ff17c8bfSgjelinek if ((err = zone_get_state(zent->zname, 3644ff17c8bfSgjelinek &zent->zstate_num)) != Z_OK) { 3645865e09a4Sgjelinek errno = err; 3646ff17c8bfSgjelinek zperror2(zent->zname, gettext("could not get " 3647ff17c8bfSgjelinek "state")); 3648865e09a4Sgjelinek /* can't tell, so hedge */ 3649865e09a4Sgjelinek zent->zstate_str = "ready/running"; 3650865e09a4Sgjelinek } else { 3651ff17c8bfSgjelinek zent->zstate_str = 3652ff17c8bfSgjelinek zone_state_str(zent->zstate_num); 3653865e09a4Sgjelinek } 3654865e09a4Sgjelinek zerror(gettext("%s operation is invalid for %s zones."), 3655865e09a4Sgjelinek cmd_to_str(CMD_CLONE), zent->zstate_str); 3656865e09a4Sgjelinek return (Z_ERR); 3657865e09a4Sgjelinek } 3658865e09a4Sgjelinek 3659865e09a4Sgjelinek if ((err = zone_get_state(source_zone, &state)) != Z_OK) { 3660865e09a4Sgjelinek errno = err; 3661865e09a4Sgjelinek zperror2(source_zone, gettext("could not get state")); 3662865e09a4Sgjelinek return (Z_ERR); 3663865e09a4Sgjelinek } 3664865e09a4Sgjelinek if (state != ZONE_STATE_INSTALLED) { 3665865e09a4Sgjelinek (void) fprintf(stderr, 3666865e09a4Sgjelinek gettext("%s: zone %s is %s; %s is required.\n"), 3667865e09a4Sgjelinek execname, source_zone, zone_state_str(state), 3668865e09a4Sgjelinek zone_state_str(ZONE_STATE_INSTALLED)); 3669865e09a4Sgjelinek return (Z_ERR); 3670865e09a4Sgjelinek } 3671865e09a4Sgjelinek 3672865e09a4Sgjelinek /* 3673865e09a4Sgjelinek * The source zone checks out ok, continue with the clone. 3674865e09a4Sgjelinek */ 3675865e09a4Sgjelinek 3676865e09a4Sgjelinek if (validate_clone(source_zone, target_zone) != Z_OK) 3677865e09a4Sgjelinek return (Z_ERR); 3678865e09a4Sgjelinek 3679ff17c8bfSgjelinek if (zonecfg_grab_lock_file(target_zone, &lockfd) != Z_OK) { 3680ff17c8bfSgjelinek zerror(gettext("another %s may have an operation in " 3681ff17c8bfSgjelinek "progress."), "zoneadm"); 3682865e09a4Sgjelinek return (Z_ERR); 3683865e09a4Sgjelinek } 3684ff17c8bfSgjelinek } 3685865e09a4Sgjelinek 3686865e09a4Sgjelinek if ((err = zone_get_zonepath(source_zone, source_zonepath, 3687865e09a4Sgjelinek sizeof (source_zonepath))) != Z_OK) { 3688865e09a4Sgjelinek errno = err; 3689865e09a4Sgjelinek zperror2(source_zone, gettext("could not get zone path")); 3690865e09a4Sgjelinek goto done; 3691865e09a4Sgjelinek } 3692865e09a4Sgjelinek 3693865e09a4Sgjelinek if ((err = zone_get_zonepath(target_zone, zonepath, sizeof (zonepath))) 3694865e09a4Sgjelinek != Z_OK) { 3695865e09a4Sgjelinek errno = err; 3696865e09a4Sgjelinek zperror2(target_zone, gettext("could not get zone path")); 3697865e09a4Sgjelinek goto done; 3698865e09a4Sgjelinek } 3699865e09a4Sgjelinek 3700ff17c8bfSgjelinek /* 3701ff17c8bfSgjelinek * Fetch the clone and postclone hooks from the brand configuration. 3702ff17c8bfSgjelinek */ 3703ff17c8bfSgjelinek if ((bh = brand_open(target_brand)) == NULL) { 3704ff17c8bfSgjelinek zerror(gettext("missing or invalid brand")); 3705ff17c8bfSgjelinek err = Z_ERR; 3706ff17c8bfSgjelinek goto done; 3707ff17c8bfSgjelinek } 3708ff17c8bfSgjelinek 3709ff17c8bfSgjelinek if (get_hook(bh, cmdbuf, sizeof (cmdbuf), brand_get_clone, target_zone, 3710ff17c8bfSgjelinek zonepath) != Z_OK) { 3711ff17c8bfSgjelinek zerror("invalid brand configuration: missing clone resource"); 3712ff17c8bfSgjelinek brand_close(bh); 3713ff17c8bfSgjelinek err = Z_ERR; 3714ff17c8bfSgjelinek goto done; 3715ff17c8bfSgjelinek } 3716ff17c8bfSgjelinek 3717ff17c8bfSgjelinek if (get_hook(bh, postcmdbuf, sizeof (postcmdbuf), brand_get_postclone, 3718ff17c8bfSgjelinek target_zone, zonepath) != Z_OK) { 3719ff17c8bfSgjelinek zerror("invalid brand configuration: missing postclone " 3720ff17c8bfSgjelinek "resource"); 3721ff17c8bfSgjelinek brand_close(bh); 3722ff17c8bfSgjelinek err = Z_ERR; 3723ff17c8bfSgjelinek goto done; 3724ff17c8bfSgjelinek } 3725ff17c8bfSgjelinek 3726ff17c8bfSgjelinek if (get_hook(bh, presnapbuf, sizeof (presnapbuf), brand_get_presnap, 3727ff17c8bfSgjelinek source_zone, source_zonepath) != Z_OK) { 3728ff17c8bfSgjelinek zerror("invalid brand configuration: missing presnap " 3729ff17c8bfSgjelinek "resource"); 3730ff17c8bfSgjelinek brand_close(bh); 3731ff17c8bfSgjelinek err = Z_ERR; 3732ff17c8bfSgjelinek goto done; 3733ff17c8bfSgjelinek } 3734ff17c8bfSgjelinek 3735ff17c8bfSgjelinek if (get_hook(bh, postsnapbuf, sizeof (postsnapbuf), brand_get_postsnap, 3736ff17c8bfSgjelinek source_zone, source_zonepath) != Z_OK) { 3737ff17c8bfSgjelinek zerror("invalid brand configuration: missing postsnap " 3738ff17c8bfSgjelinek "resource"); 3739ff17c8bfSgjelinek brand_close(bh); 3740ff17c8bfSgjelinek err = Z_ERR; 3741ff17c8bfSgjelinek goto done; 3742ff17c8bfSgjelinek } 3743ff17c8bfSgjelinek 3744ff17c8bfSgjelinek if (get_hook(bh, validsnapbuf, sizeof (validsnapbuf), 3745ff17c8bfSgjelinek brand_get_validatesnap, target_zone, zonepath) != Z_OK) { 3746ff17c8bfSgjelinek zerror("invalid brand configuration: missing validatesnap " 3747ff17c8bfSgjelinek "resource"); 3748ff17c8bfSgjelinek brand_close(bh); 3749ff17c8bfSgjelinek err = Z_ERR; 3750ff17c8bfSgjelinek goto done; 3751ff17c8bfSgjelinek } 3752ff17c8bfSgjelinek brand_close(bh); 3753ff17c8bfSgjelinek 3754ff17c8bfSgjelinek /* Append all options to clone hook. */ 3755ff17c8bfSgjelinek if (addoptions(cmdbuf, argv, sizeof (cmdbuf)) != Z_OK) { 3756ff17c8bfSgjelinek err = Z_ERR; 3757ff17c8bfSgjelinek goto done; 3758ff17c8bfSgjelinek } 3759ff17c8bfSgjelinek 3760ff17c8bfSgjelinek /* Append all options to postclone hook. */ 3761ff17c8bfSgjelinek if (addoptions(postcmdbuf, argv, sizeof (postcmdbuf)) != Z_OK) { 3762ff17c8bfSgjelinek err = Z_ERR; 3763ff17c8bfSgjelinek goto done; 3764ff17c8bfSgjelinek } 3765ff17c8bfSgjelinek 3766ff17c8bfSgjelinek if (!brand_help) { 3767865e09a4Sgjelinek if ((err = zone_set_state(target_zone, ZONE_STATE_INCOMPLETE)) 3768865e09a4Sgjelinek != Z_OK) { 3769865e09a4Sgjelinek errno = err; 3770865e09a4Sgjelinek zperror2(target_zone, gettext("could not set state")); 3771865e09a4Sgjelinek goto done; 3772865e09a4Sgjelinek } 3773ff17c8bfSgjelinek } 3774ff17c8bfSgjelinek 3775ff17c8bfSgjelinek /* 3776ff17c8bfSgjelinek * The clone hook is optional. If it exists, use the hook for 3777ff17c8bfSgjelinek * cloning, otherwise use the built-in clone support 3778ff17c8bfSgjelinek */ 3779ff17c8bfSgjelinek if (cmdbuf[0] != '\0') { 3780ff17c8bfSgjelinek /* Run the clone hook */ 3781c75cc341S status = do_subproc(cmdbuf); 3782ff17c8bfSgjelinek if ((status = subproc_status(gettext("brand-specific clone"), 3783ff17c8bfSgjelinek status, B_FALSE)) != ZONE_SUBPROC_OK) { 3784ff17c8bfSgjelinek if (status == ZONE_SUBPROC_USAGE && !brand_help) 3785ff17c8bfSgjelinek sub_usage(SHELP_CLONE, CMD_CLONE); 3786ff17c8bfSgjelinek err = Z_ERR; 3787ff17c8bfSgjelinek goto done; 3788ff17c8bfSgjelinek } 3789ff17c8bfSgjelinek 3790ff17c8bfSgjelinek if (brand_help) 3791ff17c8bfSgjelinek return (Z_OK); 3792ff17c8bfSgjelinek 3793ff17c8bfSgjelinek } else { 3794ff17c8bfSgjelinek /* If just help, we're done since there is no brand help. */ 3795ff17c8bfSgjelinek if (brand_help) 3796ff17c8bfSgjelinek return (Z_OK); 3797ff17c8bfSgjelinek 3798ff17c8bfSgjelinek /* Run the built-in clone support. */ 3799ff17c8bfSgjelinek 3800ff17c8bfSgjelinek /* The only explicit built-in method is "copy". */ 3801ff17c8bfSgjelinek if (method != NULL && strcmp(method, "copy") != 0) { 3802ff17c8bfSgjelinek sub_usage(SHELP_CLONE, CMD_CLONE); 3803ff17c8bfSgjelinek err = Z_USAGE; 3804ff17c8bfSgjelinek goto done; 3805ff17c8bfSgjelinek } 3806865e09a4Sgjelinek 38070b5de56dSgjelinek if (snapshot != NULL) { 3808ff17c8bfSgjelinek err = clone_snapshot_zfs(snapshot, zonepath, 3809ff17c8bfSgjelinek validsnapbuf); 38100b5de56dSgjelinek } else { 38110b5de56dSgjelinek /* 3812ff17c8bfSgjelinek * We always copy the clone unless the source is ZFS 3813ff17c8bfSgjelinek * and a ZFS clone worked. We fallback to copying if 3814ff17c8bfSgjelinek * the ZFS clone fails for some reason. 38150b5de56dSgjelinek */ 38160b5de56dSgjelinek err = Z_ERR; 38170b5de56dSgjelinek if (method == NULL && is_zonepath_zfs(source_zonepath)) 3818ff17c8bfSgjelinek err = clone_zfs(source_zonepath, zonepath, 3819ff17c8bfSgjelinek presnapbuf, postsnapbuf); 3820865e09a4Sgjelinek 38215cd08338Sgjelinek if (err != Z_OK) 38220b5de56dSgjelinek err = clone_copy(source_zonepath, zonepath); 38230b5de56dSgjelinek } 3824ff17c8bfSgjelinek } 3825865e09a4Sgjelinek 3826ff17c8bfSgjelinek if (err == Z_OK && postcmdbuf[0] != '\0') { 3827ff17c8bfSgjelinek status = do_subproc(postcmdbuf); 3828ff17c8bfSgjelinek if ((err = subproc_status("postclone", status, B_FALSE)) 3829ff17c8bfSgjelinek != ZONE_SUBPROC_OK) { 3830ff17c8bfSgjelinek zerror(gettext("post-clone configuration failed.")); 3831ff17c8bfSgjelinek err = Z_ERR; 3832ff17c8bfSgjelinek } 3833ff17c8bfSgjelinek } 3834865e09a4Sgjelinek 3835865e09a4Sgjelinek done: 38369acbbeafSnn35248 /* 38379acbbeafSnn35248 * If everything went well, we mark the zone as installed. 38389acbbeafSnn35248 */ 38399acbbeafSnn35248 if (err == Z_OK) { 38409acbbeafSnn35248 err = zone_set_state(target_zone, ZONE_STATE_INSTALLED); 38419acbbeafSnn35248 if (err != Z_OK) { 38429acbbeafSnn35248 errno = err; 38439acbbeafSnn35248 zperror2(target_zone, gettext("could not set state")); 38449acbbeafSnn35248 } 38459acbbeafSnn35248 } 3846ff17c8bfSgjelinek if (!brand_help) 3847ff17c8bfSgjelinek zonecfg_release_lock_file(target_zone, lockfd); 3848865e09a4Sgjelinek return ((err == Z_OK) ? Z_OK : Z_ERR); 3849865e09a4Sgjelinek } 3850865e09a4Sgjelinek 385107b574eeSgjelinek /* 38520b5de56dSgjelinek * Used when removing a zonepath after uninstalling or cleaning up after 38530b5de56dSgjelinek * the move subcommand. This handles a zonepath that has non-standard 38540b5de56dSgjelinek * contents so that we will only cleanup the stuff we know about and leave 38550b5de56dSgjelinek * any user data alone. 385607b574eeSgjelinek * 38570b5de56dSgjelinek * If the "all" parameter is true then we should remove the whole zonepath 38580b5de56dSgjelinek * even if it has non-standard files/directories in it. This can be used when 38590b5de56dSgjelinek * we need to cleanup after moving the zonepath across file systems. 38600b5de56dSgjelinek * 38610b5de56dSgjelinek * We "exec" the RMCOMMAND so that the returned status is that of RMCOMMAND 38620b5de56dSgjelinek * and not the shell. 386307b574eeSgjelinek */ 386407b574eeSgjelinek static int 38650b5de56dSgjelinek cleanup_zonepath(char *zonepath, boolean_t all) 386607b574eeSgjelinek { 386707b574eeSgjelinek int status; 38680b5de56dSgjelinek int i; 38690b5de56dSgjelinek boolean_t non_std = B_FALSE; 38700b5de56dSgjelinek struct dirent *dp; 38710b5de56dSgjelinek DIR *dirp; 3872d9e728a2Sgjelinek /* 3873d9e728a2Sgjelinek * The SUNWattached.xml file is expected since it might 3874d9e728a2Sgjelinek * exist if the zone was force-attached after a 3875d9e728a2Sgjelinek * migration. 3876d9e728a2Sgjelinek */ 3877d9e728a2Sgjelinek char *std_entries[] = {"dev", "lu", "root", 3878d9e728a2Sgjelinek "SUNWattached.xml", NULL}; 38790b5de56dSgjelinek /* (MAXPATHLEN * 3) is for the 3 std_entries dirs */ 38800b5de56dSgjelinek char cmdbuf[sizeof (RMCOMMAND) + (MAXPATHLEN * 3) + 64]; 388107b574eeSgjelinek 388207b574eeSgjelinek /* 38830b5de56dSgjelinek * We shouldn't need these checks but lets be paranoid since we 38840b5de56dSgjelinek * could blow away the whole system here if we got the wrong zonepath. 388507b574eeSgjelinek */ 38860b5de56dSgjelinek if (*zonepath == NULL || strcmp(zonepath, "/") == 0) { 38870b5de56dSgjelinek (void) fprintf(stderr, "invalid zonepath '%s'\n", zonepath); 38880b5de56dSgjelinek return (Z_INVAL); 38890b5de56dSgjelinek } 38900b5de56dSgjelinek 389107b574eeSgjelinek /* 38920b5de56dSgjelinek * If the dirpath is already gone (maybe it was manually removed) then 38930b5de56dSgjelinek * we just return Z_OK so that the cleanup is successful. 389407b574eeSgjelinek */ 38950b5de56dSgjelinek if ((dirp = opendir(zonepath)) == NULL) 38960b5de56dSgjelinek return (Z_OK); 38970b5de56dSgjelinek 38980b5de56dSgjelinek /* 38990b5de56dSgjelinek * Look through the zonepath directory to see if there are any 39000b5de56dSgjelinek * non-standard files/dirs. Also skip .zfs since that might be 39010b5de56dSgjelinek * there but we'll handle ZFS file systems as a special case. 39020b5de56dSgjelinek */ 39030b5de56dSgjelinek while ((dp = readdir(dirp)) != NULL) { 39040b5de56dSgjelinek if (strcmp(dp->d_name, ".") == 0 || 39050b5de56dSgjelinek strcmp(dp->d_name, "..") == 0 || 39060b5de56dSgjelinek strcmp(dp->d_name, ".zfs") == 0) 39070b5de56dSgjelinek continue; 39080b5de56dSgjelinek 39090b5de56dSgjelinek for (i = 0; std_entries[i] != NULL; i++) 39100b5de56dSgjelinek if (strcmp(dp->d_name, std_entries[i]) == 0) 39110b5de56dSgjelinek break; 39120b5de56dSgjelinek 39130b5de56dSgjelinek if (std_entries[i] == NULL) 39140b5de56dSgjelinek non_std = B_TRUE; 39150b5de56dSgjelinek } 39160b5de56dSgjelinek (void) closedir(dirp); 39170b5de56dSgjelinek 39180b5de56dSgjelinek if (!all && non_std) { 39190b5de56dSgjelinek /* 39200b5de56dSgjelinek * There are extra, non-standard directories/files in the 39210b5de56dSgjelinek * zonepath so we don't want to remove the zonepath. We 39220b5de56dSgjelinek * just want to remove the standard directories and leave 39230b5de56dSgjelinek * the user data alone. 39240b5de56dSgjelinek */ 39250b5de56dSgjelinek (void) snprintf(cmdbuf, sizeof (cmdbuf), "exec " RMCOMMAND); 39260b5de56dSgjelinek 39270b5de56dSgjelinek for (i = 0; std_entries[i] != NULL; i++) { 39280b5de56dSgjelinek char tmpbuf[MAXPATHLEN]; 39290b5de56dSgjelinek 39300b5de56dSgjelinek if (snprintf(tmpbuf, sizeof (tmpbuf), " %s/%s", 39310b5de56dSgjelinek zonepath, std_entries[i]) >= sizeof (tmpbuf) || 39320b5de56dSgjelinek strlcat(cmdbuf, tmpbuf, sizeof (cmdbuf)) >= 39330b5de56dSgjelinek sizeof (cmdbuf)) { 39340b5de56dSgjelinek (void) fprintf(stderr, 39350b5de56dSgjelinek gettext("path is too long\n")); 39360b5de56dSgjelinek return (Z_INVAL); 39370b5de56dSgjelinek } 393807b574eeSgjelinek } 393907b574eeSgjelinek 394007b574eeSgjelinek status = do_subproc(cmdbuf); 394107b574eeSgjelinek 39420b5de56dSgjelinek (void) fprintf(stderr, gettext("WARNING: Unable to completely " 39430b5de56dSgjelinek "remove %s\nbecause it contains additional user data. " 39440b5de56dSgjelinek "Only the standard directory\nentries have been " 39450b5de56dSgjelinek "removed.\n"), 39460b5de56dSgjelinek zonepath); 394707b574eeSgjelinek 39489acbbeafSnn35248 return ((subproc_status(RMCOMMAND, status, B_TRUE) == 39499acbbeafSnn35248 ZONE_SUBPROC_OK) ? Z_OK : Z_ERR); 39500b5de56dSgjelinek } 39510b5de56dSgjelinek 39520b5de56dSgjelinek /* 39530b5de56dSgjelinek * There is nothing unexpected in the zonepath, try to get rid of the 39540b5de56dSgjelinek * whole zonepath directory. 39550b5de56dSgjelinek * 39560b5de56dSgjelinek * If the zonepath is its own zfs file system, try to destroy the 39570b5de56dSgjelinek * file system. If that fails for some reason (e.g. it has clones) 39580b5de56dSgjelinek * then we'll just remove the contents of the zonepath. 39590b5de56dSgjelinek */ 39600b5de56dSgjelinek if (is_zonepath_zfs(zonepath)) { 39610b5de56dSgjelinek if (destroy_zfs(zonepath) == Z_OK) 39620b5de56dSgjelinek return (Z_OK); 39630b5de56dSgjelinek (void) snprintf(cmdbuf, sizeof (cmdbuf), "exec " RMCOMMAND 39640b5de56dSgjelinek " %s/*", zonepath); 39650b5de56dSgjelinek status = do_subproc(cmdbuf); 39669acbbeafSnn35248 return ((subproc_status(RMCOMMAND, status, B_TRUE) == 39679acbbeafSnn35248 ZONE_SUBPROC_OK) ? Z_OK : Z_ERR); 39680b5de56dSgjelinek } 39690b5de56dSgjelinek 39700b5de56dSgjelinek (void) snprintf(cmdbuf, sizeof (cmdbuf), "exec " RMCOMMAND " %s", 39710b5de56dSgjelinek zonepath); 39720b5de56dSgjelinek status = do_subproc(cmdbuf); 39739acbbeafSnn35248 39749acbbeafSnn35248 return ((subproc_status(RMCOMMAND, status, B_TRUE) == ZONE_SUBPROC_OK) 39759acbbeafSnn35248 ? Z_OK : Z_ERR); 397607b574eeSgjelinek } 397707b574eeSgjelinek 3978865e09a4Sgjelinek static int 3979865e09a4Sgjelinek move_func(int argc, char *argv[]) 3980865e09a4Sgjelinek { 3981865e09a4Sgjelinek char *new_zonepath = NULL; 3982865e09a4Sgjelinek int lockfd; 3983865e09a4Sgjelinek int err, arg; 3984865e09a4Sgjelinek char zonepath[MAXPATHLEN]; 3985865e09a4Sgjelinek zone_dochandle_t handle; 3986865e09a4Sgjelinek boolean_t fast; 39870b5de56dSgjelinek boolean_t is_zfs = B_FALSE; 39880094b373Sjv227347 boolean_t root_fs_mounted = B_FALSE; 39890b5de56dSgjelinek struct dirent *dp; 39900b5de56dSgjelinek DIR *dirp; 39910b5de56dSgjelinek boolean_t empty = B_TRUE; 3992865e09a4Sgjelinek boolean_t revert; 3993865e09a4Sgjelinek struct stat zonepath_buf; 3994865e09a4Sgjelinek struct stat new_zonepath_buf; 39950094b373Sjv227347 zone_mounts_t mounts; 3996865e09a4Sgjelinek 3997865e09a4Sgjelinek if (zonecfg_in_alt_root()) { 3998865e09a4Sgjelinek zerror(gettext("cannot move zone in alternate root")); 3999865e09a4Sgjelinek return (Z_ERR); 4000865e09a4Sgjelinek } 4001865e09a4Sgjelinek 4002865e09a4Sgjelinek optind = 0; 4003865e09a4Sgjelinek if ((arg = getopt(argc, argv, "?")) != EOF) { 4004865e09a4Sgjelinek switch (arg) { 4005865e09a4Sgjelinek case '?': 4006865e09a4Sgjelinek sub_usage(SHELP_MOVE, CMD_MOVE); 4007865e09a4Sgjelinek return (optopt == '?' ? Z_OK : Z_USAGE); 4008865e09a4Sgjelinek default: 4009865e09a4Sgjelinek sub_usage(SHELP_MOVE, CMD_MOVE); 4010865e09a4Sgjelinek return (Z_USAGE); 4011865e09a4Sgjelinek } 4012865e09a4Sgjelinek } 4013865e09a4Sgjelinek if (argc != (optind + 1)) { 4014865e09a4Sgjelinek sub_usage(SHELP_MOVE, CMD_MOVE); 4015865e09a4Sgjelinek return (Z_USAGE); 4016865e09a4Sgjelinek } 4017865e09a4Sgjelinek new_zonepath = argv[optind]; 40189acbbeafSnn35248 if (sanity_check(target_zone, CMD_MOVE, B_FALSE, B_TRUE, B_FALSE) 40199acbbeafSnn35248 != Z_OK) 4020865e09a4Sgjelinek return (Z_ERR); 4021ce28b40eSzt129084 if (verify_details(CMD_MOVE, argv) != Z_OK) 4022865e09a4Sgjelinek return (Z_ERR); 4023865e09a4Sgjelinek 4024865e09a4Sgjelinek /* 4025865e09a4Sgjelinek * Check out the new zonepath. This has the side effect of creating 4026865e09a4Sgjelinek * a directory for the new zonepath. We depend on this later when we 40270b5de56dSgjelinek * stat to see if we are doing a cross file system move or not. 4028865e09a4Sgjelinek */ 4029865e09a4Sgjelinek if (validate_zonepath(new_zonepath, CMD_MOVE) != Z_OK) 4030865e09a4Sgjelinek return (Z_ERR); 4031865e09a4Sgjelinek 4032865e09a4Sgjelinek if ((err = zone_get_zonepath(target_zone, zonepath, sizeof (zonepath))) 4033865e09a4Sgjelinek != Z_OK) { 4034865e09a4Sgjelinek errno = err; 4035865e09a4Sgjelinek zperror2(target_zone, gettext("could not get zone path")); 4036865e09a4Sgjelinek return (Z_ERR); 4037865e09a4Sgjelinek } 4038865e09a4Sgjelinek 4039865e09a4Sgjelinek if (stat(zonepath, &zonepath_buf) == -1) { 4040865e09a4Sgjelinek zperror(gettext("could not stat zone path"), B_FALSE); 4041865e09a4Sgjelinek return (Z_ERR); 4042865e09a4Sgjelinek } 4043865e09a4Sgjelinek 4044865e09a4Sgjelinek if (stat(new_zonepath, &new_zonepath_buf) == -1) { 4045865e09a4Sgjelinek zperror(gettext("could not stat new zone path"), B_FALSE); 4046865e09a4Sgjelinek return (Z_ERR); 4047865e09a4Sgjelinek } 4048865e09a4Sgjelinek 40490b5de56dSgjelinek /* 40500b5de56dSgjelinek * Check if the destination directory is empty. 40510b5de56dSgjelinek */ 40520b5de56dSgjelinek if ((dirp = opendir(new_zonepath)) == NULL) { 40530b5de56dSgjelinek zperror(gettext("could not open new zone path"), B_FALSE); 40540b5de56dSgjelinek return (Z_ERR); 40550b5de56dSgjelinek } 40560b5de56dSgjelinek while ((dp = readdir(dirp)) != (struct dirent *)0) { 40570b5de56dSgjelinek if (strcmp(dp->d_name, ".") == 0 || 40580b5de56dSgjelinek strcmp(dp->d_name, "..") == 0) 40590b5de56dSgjelinek continue; 40600b5de56dSgjelinek empty = B_FALSE; 40610b5de56dSgjelinek break; 40620b5de56dSgjelinek } 40630b5de56dSgjelinek (void) closedir(dirp); 40640b5de56dSgjelinek 40650b5de56dSgjelinek /* Error if there is anything in the destination directory. */ 40660b5de56dSgjelinek if (!empty) { 40670b5de56dSgjelinek (void) fprintf(stderr, gettext("could not move zone to %s: " 40680b5de56dSgjelinek "directory not empty\n"), new_zonepath); 40690b5de56dSgjelinek return (Z_ERR); 40700b5de56dSgjelinek } 40710b5de56dSgjelinek 40720094b373Sjv227347 /* 40730094b373Sjv227347 * Collect information about mounts within the zone's zonepath. 40740094b373Sjv227347 * Overlay mounts on the zone's root directory are erroneous. 40750094b373Sjv227347 * Bail if we encounter any unexpected mounts. 40760094b373Sjv227347 */ 40770094b373Sjv227347 if (zone_mounts_init(&mounts, zonepath) != 0) 4078865e09a4Sgjelinek return (Z_ERR); 40790094b373Sjv227347 if (mounts.num_root_overlay_mounts != 0) { 40800094b373Sjv227347 zerror(gettext("%d overlay mount(s) detected on %s/root."), 40810094b373Sjv227347 mounts.num_root_overlay_mounts, zonepath); 40820094b373Sjv227347 goto err_and_mounts_destroy; 4083865e09a4Sgjelinek } 40840094b373Sjv227347 if (mounts.num_unexpected_mounts != 0) 40850094b373Sjv227347 goto err_and_mounts_destroy; 4086865e09a4Sgjelinek 4087865e09a4Sgjelinek /* 4088865e09a4Sgjelinek * Check if we are moving in the same file system and can do a fast 4089865e09a4Sgjelinek * move or if we are crossing file systems and have to copy the data. 4090865e09a4Sgjelinek */ 4091865e09a4Sgjelinek fast = (zonepath_buf.st_dev == new_zonepath_buf.st_dev); 4092865e09a4Sgjelinek 4093865e09a4Sgjelinek if ((handle = zonecfg_init_handle()) == NULL) { 4094865e09a4Sgjelinek zperror(cmd_to_str(CMD_MOVE), B_TRUE); 40950094b373Sjv227347 goto err_and_mounts_destroy; 4096865e09a4Sgjelinek } 4097865e09a4Sgjelinek 4098865e09a4Sgjelinek if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) { 4099865e09a4Sgjelinek errno = err; 4100865e09a4Sgjelinek zperror(cmd_to_str(CMD_MOVE), B_TRUE); 41010094b373Sjv227347 goto err_and_fini_handle; 4102865e09a4Sgjelinek } 4103865e09a4Sgjelinek 4104ff17c8bfSgjelinek if (zonecfg_grab_lock_file(target_zone, &lockfd) != Z_OK) { 4105865e09a4Sgjelinek zerror(gettext("another %s may have an operation in progress."), 4106865e09a4Sgjelinek "zoneadm"); 41070094b373Sjv227347 goto err_and_fini_handle; 4108865e09a4Sgjelinek } 4109865e09a4Sgjelinek 4110865e09a4Sgjelinek /* 41110094b373Sjv227347 * Unmount the zone's root filesystem before we move the zone's 41120094b373Sjv227347 * zonepath. 41130094b373Sjv227347 */ 41140094b373Sjv227347 if (zone_unmount_rootfs(&mounts, zonepath, B_FALSE) != 0) 41150094b373Sjv227347 goto err_and_rele_lockfile; 41160094b373Sjv227347 41170094b373Sjv227347 /* 41180b5de56dSgjelinek * We're making some file system changes now so we have to clean up 41190b5de56dSgjelinek * the file system before we are done. This will either clean up the 4120865e09a4Sgjelinek * new zonepath if the zonecfg update failed or it will clean up the 4121865e09a4Sgjelinek * old zonepath if everything is ok. 4122865e09a4Sgjelinek */ 4123865e09a4Sgjelinek revert = B_TRUE; 4124865e09a4Sgjelinek 41250b5de56dSgjelinek if (is_zonepath_zfs(zonepath) && 41260b5de56dSgjelinek move_zfs(zonepath, new_zonepath) != Z_ERR) { 41270b5de56dSgjelinek is_zfs = B_TRUE; 41280b5de56dSgjelinek 41290b5de56dSgjelinek } else if (fast) { 4130865e09a4Sgjelinek /* same file system, use rename for a quick move */ 4131865e09a4Sgjelinek 4132865e09a4Sgjelinek /* 4133865e09a4Sgjelinek * Remove the new_zonepath directory that got created above 4134865e09a4Sgjelinek * during the validation. It gets in the way of the rename. 4135865e09a4Sgjelinek */ 4136865e09a4Sgjelinek if (rmdir(new_zonepath) != 0) { 4137865e09a4Sgjelinek zperror(gettext("could not rmdir new zone path"), 4138865e09a4Sgjelinek B_FALSE); 41390094b373Sjv227347 (void) zone_mount_rootfs(&mounts, zonepath); 41400094b373Sjv227347 goto err_and_rele_lockfile; 4141865e09a4Sgjelinek } 4142865e09a4Sgjelinek 4143865e09a4Sgjelinek if (rename(zonepath, new_zonepath) != 0) { 4144865e09a4Sgjelinek /* 4145865e09a4Sgjelinek * If this fails we don't need to do all of the 4146865e09a4Sgjelinek * cleanup that happens for the rest of the code 4147865e09a4Sgjelinek * so just return from this error. 4148865e09a4Sgjelinek */ 4149865e09a4Sgjelinek zperror(gettext("could not move zone"), B_FALSE); 41500094b373Sjv227347 (void) zone_mount_rootfs(&mounts, zonepath); 41510094b373Sjv227347 goto err_and_rele_lockfile; 4152865e09a4Sgjelinek } 4153865e09a4Sgjelinek 4154865e09a4Sgjelinek } else { 41550b5de56dSgjelinek /* 41560b5de56dSgjelinek * Attempt to create a ZFS fs for the new zonepath. As usual, 41570b5de56dSgjelinek * we don't care if this works or not since we always have the 41580b5de56dSgjelinek * default behavior of a simple directory for the zonepath. 41590b5de56dSgjelinek */ 41600b5de56dSgjelinek create_zfs_zonepath(new_zonepath); 41610b5de56dSgjelinek 4162865e09a4Sgjelinek (void) printf(gettext( 41630b5de56dSgjelinek "Moving across file systems; copying zonepath %s..."), 4164865e09a4Sgjelinek zonepath); 4165865e09a4Sgjelinek (void) fflush(stdout); 4166865e09a4Sgjelinek 4167865e09a4Sgjelinek err = copy_zone(zonepath, new_zonepath); 4168865e09a4Sgjelinek 4169865e09a4Sgjelinek (void) printf("\n"); 4170865e09a4Sgjelinek if (err != Z_OK) 4171865e09a4Sgjelinek goto done; 4172865e09a4Sgjelinek } 4173865e09a4Sgjelinek 41740094b373Sjv227347 /* 41750094b373Sjv227347 * Mount the zone's root filesystem in the new zonepath if there was 41760094b373Sjv227347 * a root mount prior to the move. 41770094b373Sjv227347 */ 41780094b373Sjv227347 if (zone_mount_rootfs(&mounts, new_zonepath) != 0) { 41790094b373Sjv227347 err = Z_ERR; 41800094b373Sjv227347 goto done; 41810094b373Sjv227347 } 41820094b373Sjv227347 root_fs_mounted = B_TRUE; 41830094b373Sjv227347 4184865e09a4Sgjelinek if ((err = zonecfg_set_zonepath(handle, new_zonepath)) != Z_OK) { 4185865e09a4Sgjelinek errno = err; 4186865e09a4Sgjelinek zperror(gettext("could not set new zonepath"), B_TRUE); 4187865e09a4Sgjelinek goto done; 4188865e09a4Sgjelinek } 4189865e09a4Sgjelinek 4190865e09a4Sgjelinek if ((err = zonecfg_save(handle)) != Z_OK) { 4191865e09a4Sgjelinek errno = err; 4192865e09a4Sgjelinek zperror(gettext("zonecfg save failed"), B_TRUE); 4193865e09a4Sgjelinek goto done; 4194865e09a4Sgjelinek } 4195865e09a4Sgjelinek 4196865e09a4Sgjelinek revert = B_FALSE; 4197865e09a4Sgjelinek 4198865e09a4Sgjelinek done: 4199865e09a4Sgjelinek zonecfg_fini_handle(handle); 4200ff17c8bfSgjelinek zonecfg_release_lock_file(target_zone, lockfd); 4201865e09a4Sgjelinek 4202865e09a4Sgjelinek /* 42030b5de56dSgjelinek * Clean up the file system based on how things went. We either 4204865e09a4Sgjelinek * clean up the new zonepath if the operation failed for some reason 4205865e09a4Sgjelinek * or we clean up the old zonepath if everything is ok. 4206865e09a4Sgjelinek */ 4207865e09a4Sgjelinek if (revert) { 42080094b373Sjv227347 /* 42090094b373Sjv227347 * Check for the unlikely scenario in which the zone's 42100094b373Sjv227347 * zonepath and its root file system moved but libzonecfg 42110094b373Sjv227347 * couldn't save the new zonepath to the zone's configuration 42120094b373Sjv227347 * file. The mounted root filesystem must be unmounted before 42130094b373Sjv227347 * zoneadm restores the zone's zonepath. 42140094b373Sjv227347 */ 42150094b373Sjv227347 if (root_fs_mounted && zone_unmount_rootfs(&mounts, 42160094b373Sjv227347 new_zonepath, B_TRUE) != 0) { 42170094b373Sjv227347 /* 42180094b373Sjv227347 * We can't forcibly unmount the zone's root file system 42190094b373Sjv227347 * from the new zonepath. Bail! 42200094b373Sjv227347 */ 42210094b373Sjv227347 zerror(gettext("fatal error: cannot unmount %s/root\n"), 42220094b373Sjv227347 new_zonepath); 42230094b373Sjv227347 goto err_and_mounts_destroy; 42240094b373Sjv227347 } 42250094b373Sjv227347 4226865e09a4Sgjelinek /* The zonecfg update failed, cleanup the new zonepath. */ 42270b5de56dSgjelinek if (is_zfs) { 42280b5de56dSgjelinek if (move_zfs(new_zonepath, zonepath) == Z_ERR) { 42290b5de56dSgjelinek (void) fprintf(stderr, gettext("could not " 42300b5de56dSgjelinek "restore zonepath, the zfs mountpoint is " 42310b5de56dSgjelinek "set as:\n%s\n"), new_zonepath); 42320b5de56dSgjelinek /* 42330b5de56dSgjelinek * err is already != Z_OK since we're reverting 42340b5de56dSgjelinek */ 42350094b373Sjv227347 } else { 42360094b373Sjv227347 (void) zone_mount_rootfs(&mounts, zonepath); 42370b5de56dSgjelinek } 42380b5de56dSgjelinek } else if (fast) { 4239865e09a4Sgjelinek if (rename(new_zonepath, zonepath) != 0) { 4240865e09a4Sgjelinek zperror(gettext("could not restore zonepath"), 4241865e09a4Sgjelinek B_FALSE); 4242865e09a4Sgjelinek /* 4243865e09a4Sgjelinek * err is already != Z_OK since we're reverting 4244865e09a4Sgjelinek */ 42450094b373Sjv227347 } else { 42460094b373Sjv227347 (void) zone_mount_rootfs(&mounts, zonepath); 4247865e09a4Sgjelinek } 4248865e09a4Sgjelinek } else { 4249865e09a4Sgjelinek (void) printf(gettext("Cleaning up zonepath %s..."), 4250865e09a4Sgjelinek new_zonepath); 4251865e09a4Sgjelinek (void) fflush(stdout); 42520b5de56dSgjelinek err = cleanup_zonepath(new_zonepath, B_TRUE); 4253865e09a4Sgjelinek (void) printf("\n"); 4254865e09a4Sgjelinek 425507b574eeSgjelinek if (err != Z_OK) { 4256865e09a4Sgjelinek errno = err; 4257865e09a4Sgjelinek zperror(gettext("could not remove new " 4258865e09a4Sgjelinek "zonepath"), B_TRUE); 4259865e09a4Sgjelinek } else { 4260865e09a4Sgjelinek /* 4261865e09a4Sgjelinek * Because we're reverting we know the mainline 4262865e09a4Sgjelinek * code failed but we just reused the err 4263865e09a4Sgjelinek * variable so we reset it back to Z_ERR. 4264865e09a4Sgjelinek */ 4265865e09a4Sgjelinek err = Z_ERR; 4266865e09a4Sgjelinek } 4267865e09a4Sgjelinek 42680094b373Sjv227347 (void) zone_mount_rootfs(&mounts, zonepath); 42690094b373Sjv227347 } 4270865e09a4Sgjelinek } else { 4271865e09a4Sgjelinek /* The move was successful, cleanup the old zonepath. */ 42720b5de56dSgjelinek if (!is_zfs && !fast) { 4273865e09a4Sgjelinek (void) printf( 4274865e09a4Sgjelinek gettext("Cleaning up zonepath %s..."), zonepath); 4275865e09a4Sgjelinek (void) fflush(stdout); 42760b5de56dSgjelinek err = cleanup_zonepath(zonepath, B_TRUE); 4277865e09a4Sgjelinek (void) printf("\n"); 4278865e09a4Sgjelinek 427907b574eeSgjelinek if (err != Z_OK) { 4280865e09a4Sgjelinek errno = err; 4281865e09a4Sgjelinek zperror(gettext("could not remove zonepath"), 4282865e09a4Sgjelinek B_TRUE); 4283865e09a4Sgjelinek } 4284865e09a4Sgjelinek } 4285865e09a4Sgjelinek } 4286865e09a4Sgjelinek 42870094b373Sjv227347 zone_mounts_destroy(&mounts); 4288865e09a4Sgjelinek return ((err == Z_OK) ? Z_OK : Z_ERR); 42890094b373Sjv227347 42900094b373Sjv227347 err_and_rele_lockfile: 42910094b373Sjv227347 zonecfg_release_lock_file(target_zone, lockfd); 42920094b373Sjv227347 err_and_fini_handle: 42930094b373Sjv227347 zonecfg_fini_handle(handle); 42940094b373Sjv227347 err_and_mounts_destroy: 42950094b373Sjv227347 zone_mounts_destroy(&mounts); 42960094b373Sjv227347 return (Z_ERR); 4297865e09a4Sgjelinek } 4298865e09a4Sgjelinek 4299ff17c8bfSgjelinek /* ARGSUSED */ 4300ee519a1fSgjelinek static int 4301ee519a1fSgjelinek detach_func(int argc, char *argv[]) 4302ee519a1fSgjelinek { 430371443f5aS int lockfd = -1; 4304ee519a1fSgjelinek int err, arg; 4305ee519a1fSgjelinek char zonepath[MAXPATHLEN]; 430637774979Sgjelinek char cmdbuf[MAXPATHLEN]; 4307ff17c8bfSgjelinek char precmdbuf[MAXPATHLEN]; 43088cd327d5Sgjelinek boolean_t execute = B_TRUE; 4309ff17c8bfSgjelinek boolean_t brand_help = B_FALSE; 431037774979Sgjelinek brand_handle_t bh = NULL; 4311ff17c8bfSgjelinek int status; 4312ee519a1fSgjelinek 4313ee519a1fSgjelinek if (zonecfg_in_alt_root()) { 4314ee519a1fSgjelinek zerror(gettext("cannot detach zone in alternate root")); 4315ee519a1fSgjelinek return (Z_ERR); 4316ee519a1fSgjelinek } 4317ee519a1fSgjelinek 4318ff17c8bfSgjelinek /* Check the argv string for args we handle internally */ 4319ee519a1fSgjelinek optind = 0; 4320ff17c8bfSgjelinek opterr = 0; 4321ff17c8bfSgjelinek while ((arg = getopt(argc, argv, "?n")) != EOF) { 4322ee519a1fSgjelinek switch (arg) { 4323ee519a1fSgjelinek case '?': 4324ff17c8bfSgjelinek if (optopt == '?') { 4325ee519a1fSgjelinek sub_usage(SHELP_DETACH, CMD_DETACH); 4326ff17c8bfSgjelinek brand_help = B_TRUE; 4327ff17c8bfSgjelinek } 4328ff17c8bfSgjelinek /* Ignore unknown options - may be brand specific. */ 4329ff17c8bfSgjelinek break; 43308cd327d5Sgjelinek case 'n': 43318cd327d5Sgjelinek execute = B_FALSE; 43328cd327d5Sgjelinek break; 4333ee519a1fSgjelinek default: 4334ff17c8bfSgjelinek /* Ignore unknown options - may be brand specific. */ 4335ff17c8bfSgjelinek break; 4336ee519a1fSgjelinek } 4337ee519a1fSgjelinek } 43389acbbeafSnn35248 4339ff17c8bfSgjelinek if (brand_help) 4340ff17c8bfSgjelinek execute = B_FALSE; 4341ff17c8bfSgjelinek 43428cd327d5Sgjelinek if (execute) { 43439acbbeafSnn35248 if (sanity_check(target_zone, CMD_DETACH, B_FALSE, B_TRUE, 43449acbbeafSnn35248 B_FALSE) != Z_OK) 4345ee519a1fSgjelinek return (Z_ERR); 4346ce28b40eSzt129084 if (verify_details(CMD_DETACH, argv) != Z_OK) 4347ee519a1fSgjelinek return (Z_ERR); 43488cd327d5Sgjelinek } else { 43498cd327d5Sgjelinek /* 43508cd327d5Sgjelinek * We want a dry-run to work for a non-privileged user so we 43518cd327d5Sgjelinek * only do minimal validation. 43528cd327d5Sgjelinek */ 43538cd327d5Sgjelinek if (target_zone == NULL) { 43548cd327d5Sgjelinek zerror(gettext("no zone specified")); 43558cd327d5Sgjelinek return (Z_ERR); 43568cd327d5Sgjelinek } 43578cd327d5Sgjelinek 43588cd327d5Sgjelinek if (strcmp(target_zone, GLOBAL_ZONENAME) == 0) { 43598cd327d5Sgjelinek zerror(gettext("%s operation is invalid for the " 43608cd327d5Sgjelinek "global zone."), cmd_to_str(CMD_DETACH)); 43618cd327d5Sgjelinek return (Z_ERR); 43628cd327d5Sgjelinek } 43638cd327d5Sgjelinek } 4364ee519a1fSgjelinek 4365ee519a1fSgjelinek if ((err = zone_get_zonepath(target_zone, zonepath, sizeof (zonepath))) 4366ee519a1fSgjelinek != Z_OK) { 4367ee519a1fSgjelinek errno = err; 4368ee519a1fSgjelinek zperror2(target_zone, gettext("could not get zone path")); 4369ee519a1fSgjelinek return (Z_ERR); 4370ee519a1fSgjelinek } 4371ee519a1fSgjelinek 4372ff17c8bfSgjelinek /* Fetch the detach and predetach hooks from the brand configuration. */ 437337774979Sgjelinek if ((bh = brand_open(target_brand)) == NULL) { 437437774979Sgjelinek zerror(gettext("missing or invalid brand")); 437537774979Sgjelinek return (Z_ERR); 437637774979Sgjelinek } 437737774979Sgjelinek 4378ff17c8bfSgjelinek if (get_hook(bh, cmdbuf, sizeof (cmdbuf), brand_get_detach, target_zone, 4379ff17c8bfSgjelinek zonepath) != Z_OK) { 4380ff17c8bfSgjelinek zerror("invalid brand configuration: missing detach resource"); 4381ff17c8bfSgjelinek brand_close(bh); 4382ff17c8bfSgjelinek return (Z_ERR); 4383ff17c8bfSgjelinek } 4384ff17c8bfSgjelinek 4385ff17c8bfSgjelinek if (get_hook(bh, precmdbuf, sizeof (precmdbuf), brand_get_predetach, 4386ff17c8bfSgjelinek target_zone, zonepath) != Z_OK) { 438737774979Sgjelinek zerror("invalid brand configuration: missing predetach " 438837774979Sgjelinek "resource"); 438937774979Sgjelinek brand_close(bh); 439037774979Sgjelinek return (Z_ERR); 439137774979Sgjelinek } 439237774979Sgjelinek brand_close(bh); 439337774979Sgjelinek 4394ff17c8bfSgjelinek /* Append all options to predetach hook. */ 4395ff17c8bfSgjelinek if (addoptions(precmdbuf, argv, sizeof (precmdbuf)) != Z_OK) 439637774979Sgjelinek return (Z_ERR); 439737774979Sgjelinek 4398ff17c8bfSgjelinek /* Append all options to detach hook. */ 4399ff17c8bfSgjelinek if (addoptions(cmdbuf, argv, sizeof (cmdbuf)) != Z_OK) 440037774979Sgjelinek return (Z_ERR); 440137774979Sgjelinek 4402ff17c8bfSgjelinek if (execute && zonecfg_grab_lock_file(target_zone, &lockfd) != Z_OK) { 4403ee519a1fSgjelinek zerror(gettext("another %s may have an operation in progress."), 4404ee519a1fSgjelinek "zoneadm"); 4405ee519a1fSgjelinek return (Z_ERR); 4406ee519a1fSgjelinek } 4407ee519a1fSgjelinek 4408ff17c8bfSgjelinek /* If we have a brand predetach hook, run it. */ 4409ff17c8bfSgjelinek if (!brand_help && precmdbuf[0] != '\0') { 4410ff17c8bfSgjelinek status = do_subproc(precmdbuf); 4411ff17c8bfSgjelinek if (subproc_status(gettext("brand-specific predetach"), 4412ff17c8bfSgjelinek status, B_FALSE) != ZONE_SUBPROC_OK) { 4413ff17c8bfSgjelinek 441471443f5aS if (execute) { 441571443f5aS assert(lockfd >= 0); 4416ff17c8bfSgjelinek zonecfg_release_lock_file(target_zone, lockfd); 441771443f5aS lockfd = -1; 441871443f5aS } 441971443f5aS 442071443f5aS assert(lockfd == -1); 4421ff17c8bfSgjelinek return (Z_ERR); 4422ff17c8bfSgjelinek } 4423ff17c8bfSgjelinek } 4424ff17c8bfSgjelinek 4425ff17c8bfSgjelinek if (cmdbuf[0] != '\0') { 4426ff17c8bfSgjelinek /* Run the detach hook */ 4427c75cc341S status = do_subproc(cmdbuf); 4428ff17c8bfSgjelinek if ((status = subproc_status(gettext("brand-specific detach"), 4429ff17c8bfSgjelinek status, B_FALSE)) != ZONE_SUBPROC_OK) { 4430ff17c8bfSgjelinek if (status == ZONE_SUBPROC_USAGE && !brand_help) 4431ff17c8bfSgjelinek sub_usage(SHELP_DETACH, CMD_DETACH); 4432ff17c8bfSgjelinek 443371443f5aS if (execute) { 443471443f5aS assert(lockfd >= 0); 4435ff17c8bfSgjelinek zonecfg_release_lock_file(target_zone, lockfd); 443671443f5aS lockfd = -1; 443771443f5aS } 4438ff17c8bfSgjelinek 443971443f5aS assert(lockfd == -1); 4440ff17c8bfSgjelinek return (Z_ERR); 4441ff17c8bfSgjelinek } 4442ff17c8bfSgjelinek 4443ff17c8bfSgjelinek } else { 444471443f5aS zone_dochandle_t handle; 444571443f5aS 4446ff17c8bfSgjelinek /* If just help, we're done since there is no brand help. */ 444771443f5aS if (brand_help) { 444871443f5aS assert(lockfd == -1); 4449ff17c8bfSgjelinek return (Z_OK); 445071443f5aS } 4451ff17c8bfSgjelinek 4452ff17c8bfSgjelinek /* 4453ff17c8bfSgjelinek * Run the built-in detach support. Just generate a simple 4454ff17c8bfSgjelinek * zone definition XML file and detach. 4455ff17c8bfSgjelinek */ 4456ff17c8bfSgjelinek 4457ff17c8bfSgjelinek /* Don't detach the zone if anything is still mounted there */ 4458ff17c8bfSgjelinek if (execute && zonecfg_find_mounts(zonepath, NULL, NULL)) { 4459ff17c8bfSgjelinek (void) fprintf(stderr, gettext("These file systems are " 4460ff17c8bfSgjelinek "mounted on subdirectories of %s.\n"), zonepath); 4461ff17c8bfSgjelinek (void) zonecfg_find_mounts(zonepath, zfm_print, NULL); 4462ff17c8bfSgjelinek err = ZONE_SUBPROC_NOTCOMPLETE; 4463ff17c8bfSgjelinek goto done; 4464ff17c8bfSgjelinek } 4465ff17c8bfSgjelinek 4466ff17c8bfSgjelinek if ((handle = zonecfg_init_handle()) == NULL) { 4467ff17c8bfSgjelinek zperror(cmd_to_str(CMD_DETACH), B_TRUE); 4468ff17c8bfSgjelinek err = ZONE_SUBPROC_NOTCOMPLETE; 4469ff17c8bfSgjelinek goto done; 4470ff17c8bfSgjelinek } 4471ff17c8bfSgjelinek 4472ff17c8bfSgjelinek if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) { 4473ee519a1fSgjelinek errno = err; 4474ff17c8bfSgjelinek zperror(cmd_to_str(CMD_DETACH), B_TRUE); 4475ff17c8bfSgjelinek 447671443f5aS } else if ((err = zonecfg_detach_save(handle, 4477ff17c8bfSgjelinek (execute ? 0 : ZONE_DRY_RUN))) != Z_OK) { 4478ff17c8bfSgjelinek errno = err; 4479ff17c8bfSgjelinek zperror(gettext("saving the detach manifest failed"), 4480ee519a1fSgjelinek B_TRUE); 4481ee519a1fSgjelinek } 4482ee519a1fSgjelinek 4483ff17c8bfSgjelinek zonecfg_fini_handle(handle); 448471443f5aS if (err != Z_OK) 448571443f5aS goto done; 4486ee519a1fSgjelinek } 4487ee519a1fSgjelinek 44888cd327d5Sgjelinek /* 44898cd327d5Sgjelinek * Set the zone state back to configured unless we are running with the 44908cd327d5Sgjelinek * no-execute option. 44918cd327d5Sgjelinek */ 44928cd327d5Sgjelinek if (execute && (err = zone_set_state(target_zone, 44938cd327d5Sgjelinek ZONE_STATE_CONFIGURED)) != Z_OK) { 4494ee519a1fSgjelinek errno = err; 4495ee519a1fSgjelinek zperror(gettext("could not reset state"), B_TRUE); 4496ee519a1fSgjelinek } 4497ee519a1fSgjelinek 4498ee519a1fSgjelinek done: 449971443f5aS if (execute) { 450071443f5aS assert(lockfd >= 0); 4501ff17c8bfSgjelinek zonecfg_release_lock_file(target_zone, lockfd); 450271443f5aS lockfd = -1; 450371443f5aS } 4504ee519a1fSgjelinek 450571443f5aS assert(lockfd == -1); 4506ee519a1fSgjelinek return ((err == Z_OK) ? Z_OK : Z_ERR); 4507ee519a1fSgjelinek } 4508ee519a1fSgjelinek 4509ee519a1fSgjelinek /* 4510ff17c8bfSgjelinek * Determine the brand when doing a dry-run attach. The zone does not have to 4511ff17c8bfSgjelinek * exist, so we have to read the incoming manifest to determine the zone's 4512ff17c8bfSgjelinek * brand. 4513ff17c8bfSgjelinek * 4514ff17c8bfSgjelinek * Because the manifest has to be processed twice; once to determine the brand 4515ff17c8bfSgjelinek * and once to do the brand-specific attach logic, we always read it into a tmp 4516ff17c8bfSgjelinek * file. This handles the manifest coming from stdin or a regular file. The 4517ff17c8bfSgjelinek * tmpname parameter returns the name of the temporary file that the manifest 4518ff17c8bfSgjelinek * was read into. 4519ee519a1fSgjelinek */ 4520ee519a1fSgjelinek static int 4521ff17c8bfSgjelinek dryrun_get_brand(char *manifest_path, char *tmpname, int size) 45228cd327d5Sgjelinek { 45238cd327d5Sgjelinek int fd; 45248cd327d5Sgjelinek int err; 4525ff17c8bfSgjelinek int res = Z_OK; 45268cd327d5Sgjelinek zone_dochandle_t local_handle; 45278cd327d5Sgjelinek zone_dochandle_t rem_handle = NULL; 4528ff17c8bfSgjelinek int len; 4529ff17c8bfSgjelinek int ofd; 4530ff17c8bfSgjelinek char buf[512]; 45318cd327d5Sgjelinek 45328cd327d5Sgjelinek if (strcmp(manifest_path, "-") == 0) { 4533ff17c8bfSgjelinek fd = STDIN_FILENO; 4534ff17c8bfSgjelinek } else { 4535ff17c8bfSgjelinek if ((fd = open(manifest_path, O_RDONLY)) < 0) { 4536ff17c8bfSgjelinek if (getcwd(buf, sizeof (buf)) == NULL) 4537ff17c8bfSgjelinek (void) strlcpy(buf, "/", sizeof (buf)); 4538ff17c8bfSgjelinek zerror(gettext("could not open manifest path %s%s: %s"), 4539ff17c8bfSgjelinek (*manifest_path == '/' ? "" : buf), manifest_path, 4540ff17c8bfSgjelinek strerror(errno)); 4541ff17c8bfSgjelinek return (Z_ERR); 4542ff17c8bfSgjelinek } 4543ff17c8bfSgjelinek } 4544ff17c8bfSgjelinek 4545ff17c8bfSgjelinek (void) snprintf(tmpname, size, "/var/run/zone.%d", getpid()); 4546ff17c8bfSgjelinek 4547ff17c8bfSgjelinek if ((ofd = open(tmpname, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR)) < 0) { 4548ff17c8bfSgjelinek zperror(gettext("could not save manifest"), B_FALSE); 4549ff17c8bfSgjelinek (void) close(fd); 4550ff17c8bfSgjelinek return (Z_ERR); 4551ff17c8bfSgjelinek } 4552ff17c8bfSgjelinek 4553ff17c8bfSgjelinek while ((len = read(fd, buf, sizeof (buf))) > 0) { 4554ff17c8bfSgjelinek if (write(ofd, buf, len) == -1) { 4555ff17c8bfSgjelinek zperror(gettext("could not save manifest"), B_FALSE); 4556ff17c8bfSgjelinek (void) close(ofd); 4557ff17c8bfSgjelinek (void) close(fd); 4558ff17c8bfSgjelinek return (Z_ERR); 4559ff17c8bfSgjelinek } 4560ff17c8bfSgjelinek } 4561ff17c8bfSgjelinek 4562ff17c8bfSgjelinek if (close(ofd) != 0) { 4563ff17c8bfSgjelinek zperror(gettext("could not save manifest"), B_FALSE); 4564ff17c8bfSgjelinek (void) close(fd); 4565ff17c8bfSgjelinek return (Z_ERR); 4566ff17c8bfSgjelinek } 4567ff17c8bfSgjelinek 4568ff17c8bfSgjelinek (void) close(fd); 4569ff17c8bfSgjelinek 4570ff17c8bfSgjelinek if ((fd = open(tmpname, O_RDONLY)) < 0) { 45718cd327d5Sgjelinek zperror(gettext("could not open manifest path"), B_FALSE); 45728cd327d5Sgjelinek return (Z_ERR); 45738cd327d5Sgjelinek } 45748cd327d5Sgjelinek 45758cd327d5Sgjelinek if ((local_handle = zonecfg_init_handle()) == NULL) { 45768cd327d5Sgjelinek zperror(cmd_to_str(CMD_ATTACH), B_TRUE); 45778cd327d5Sgjelinek res = Z_ERR; 45788cd327d5Sgjelinek goto done; 45798cd327d5Sgjelinek } 45808cd327d5Sgjelinek 45818cd327d5Sgjelinek if ((rem_handle = zonecfg_init_handle()) == NULL) { 45828cd327d5Sgjelinek zperror(cmd_to_str(CMD_ATTACH), B_TRUE); 45838cd327d5Sgjelinek res = Z_ERR; 45848cd327d5Sgjelinek goto done; 45858cd327d5Sgjelinek } 45868cd327d5Sgjelinek 45878cd327d5Sgjelinek if ((err = zonecfg_attach_manifest(fd, local_handle, rem_handle)) 45888cd327d5Sgjelinek != Z_OK) { 45898cd327d5Sgjelinek res = Z_ERR; 4590d9e728a2Sgjelinek 4591d9e728a2Sgjelinek if (err == Z_INVALID_DOCUMENT) { 4592d9e728a2Sgjelinek struct stat st; 4593d9e728a2Sgjelinek char buf[6]; 4594d9e728a2Sgjelinek 4595d9e728a2Sgjelinek if (strcmp(manifest_path, "-") == 0) { 4596d9e728a2Sgjelinek zerror(gettext("Input is not a valid XML " 4597d9e728a2Sgjelinek "file")); 4598d9e728a2Sgjelinek goto done; 4599d9e728a2Sgjelinek } 4600d9e728a2Sgjelinek 4601d9e728a2Sgjelinek if (fstat(fd, &st) == -1 || !S_ISREG(st.st_mode)) { 4602d9e728a2Sgjelinek zerror(gettext("%s is not an XML file"), 4603d9e728a2Sgjelinek manifest_path); 4604d9e728a2Sgjelinek goto done; 4605d9e728a2Sgjelinek } 4606d9e728a2Sgjelinek 4607d9e728a2Sgjelinek bzero(buf, sizeof (buf)); 4608d9e728a2Sgjelinek (void) lseek(fd, 0L, SEEK_SET); 4609d9e728a2Sgjelinek if (read(fd, buf, sizeof (buf) - 1) < 0 || 4610d9e728a2Sgjelinek strncmp(buf, "<?xml", 5) != 0) 4611d9e728a2Sgjelinek zerror(gettext("%s is not an XML file"), 4612d9e728a2Sgjelinek manifest_path); 4613d9e728a2Sgjelinek else 4614d9e728a2Sgjelinek zerror(gettext("Cannot attach to an earlier " 4615d9e728a2Sgjelinek "release of the operating system")); 4616d9e728a2Sgjelinek } else { 4617d9e728a2Sgjelinek zperror(cmd_to_str(CMD_ATTACH), B_TRUE); 4618d9e728a2Sgjelinek } 46198cd327d5Sgjelinek goto done; 46208cd327d5Sgjelinek } 46218cd327d5Sgjelinek 4622ff17c8bfSgjelinek /* Retrieve remote handle brand type. */ 4623e2482d1aSgjelinek if (zonecfg_get_brand(rem_handle, target_brand, sizeof (target_brand)) 4624e2482d1aSgjelinek != Z_OK) { 4625e2482d1aSgjelinek zerror(gettext("missing or invalid brand")); 4626e2482d1aSgjelinek exit(Z_ERR); 4627e2482d1aSgjelinek } 46288cd327d5Sgjelinek 46298cd327d5Sgjelinek done: 46308cd327d5Sgjelinek zonecfg_fini_handle(local_handle); 46318cd327d5Sgjelinek zonecfg_fini_handle(rem_handle); 4632ff17c8bfSgjelinek (void) close(fd); 46338cd327d5Sgjelinek 46348cd327d5Sgjelinek return ((res == Z_OK) ? Z_OK : Z_ERR); 46358cd327d5Sgjelinek } 46368cd327d5Sgjelinek 46376cfd72c6Sgjelinek /* ARGSUSED */ 4638ee519a1fSgjelinek static int 4639ee519a1fSgjelinek attach_func(int argc, char *argv[]) 4640ee519a1fSgjelinek { 464171443f5aS int lockfd = -1; 4642ee519a1fSgjelinek int err, arg; 4643ee519a1fSgjelinek boolean_t force = B_FALSE; 4644ee519a1fSgjelinek zone_dochandle_t handle; 4645ee519a1fSgjelinek char zonepath[MAXPATHLEN]; 464637774979Sgjelinek char cmdbuf[MAXPATHLEN]; 4647ff17c8bfSgjelinek char postcmdbuf[MAXPATHLEN]; 46488cd327d5Sgjelinek boolean_t execute = B_TRUE; 4649ff17c8bfSgjelinek boolean_t brand_help = B_FALSE; 46508cd327d5Sgjelinek char *manifest_path; 4651ff17c8bfSgjelinek char tmpmanifest[80]; 4652ff17c8bfSgjelinek int manifest_pos; 465337774979Sgjelinek brand_handle_t bh = NULL; 4654ff17c8bfSgjelinek int status; 4655edfa49ffS int last_index = 0; 4656edfa49ffS int offset; 4657edfa49ffS char *up; 4658edfa49ffS boolean_t forced_update = B_FALSE; 4659ee519a1fSgjelinek 4660ee519a1fSgjelinek if (zonecfg_in_alt_root()) { 4661ee519a1fSgjelinek zerror(gettext("cannot attach zone in alternate root")); 4662ee519a1fSgjelinek return (Z_ERR); 4663ee519a1fSgjelinek } 4664ee519a1fSgjelinek 4665ff17c8bfSgjelinek /* Check the argv string for args we handle internally */ 4666ee519a1fSgjelinek optind = 0; 4667ff17c8bfSgjelinek opterr = 0; 4668edfa49ffS while ((arg = getopt(argc, argv, "?Fn:U")) != EOF) { 4669ee519a1fSgjelinek switch (arg) { 4670ee519a1fSgjelinek case '?': 4671ff17c8bfSgjelinek if (optopt == '?') { 4672ee519a1fSgjelinek sub_usage(SHELP_ATTACH, CMD_ATTACH); 4673ff17c8bfSgjelinek brand_help = B_TRUE; 4674ff17c8bfSgjelinek } 4675ff17c8bfSgjelinek /* Ignore unknown options - may be brand specific. */ 4676ff17c8bfSgjelinek break; 4677ee519a1fSgjelinek case 'F': 4678ee519a1fSgjelinek force = B_TRUE; 4679ee519a1fSgjelinek break; 46808cd327d5Sgjelinek case 'n': 46818cd327d5Sgjelinek execute = B_FALSE; 46828cd327d5Sgjelinek manifest_path = optarg; 4683ff17c8bfSgjelinek manifest_pos = optind - 1; 46846cfd72c6Sgjelinek break; 4685edfa49ffS case 'U': 4686edfa49ffS /* 4687edfa49ffS * Undocumented 'force update' option for p2v update on 4688edfa49ffS * attach when zone is in the incomplete state. Change 4689edfa49ffS * the option back to 'u' and set forced_update flag. 4690edfa49ffS */ 4691edfa49ffS if (optind == last_index) 4692edfa49ffS offset = optind; 4693edfa49ffS else 4694edfa49ffS offset = optind - 1; 4695edfa49ffS if ((up = index(argv[offset], 'U')) != NULL) 4696edfa49ffS *up = 'u'; 4697edfa49ffS forced_update = B_TRUE; 4698edfa49ffS break; 4699ee519a1fSgjelinek default: 4700ff17c8bfSgjelinek /* Ignore unknown options - may be brand specific. */ 4701ff17c8bfSgjelinek break; 4702ee519a1fSgjelinek } 4703edfa49ffS last_index = optind; 4704ee519a1fSgjelinek } 47058cd327d5Sgjelinek 4706ff17c8bfSgjelinek if (brand_help) { 4707ff17c8bfSgjelinek force = B_FALSE; 4708ff17c8bfSgjelinek execute = B_TRUE; 4709ff17c8bfSgjelinek } 4710ff17c8bfSgjelinek 4711ff17c8bfSgjelinek /* dry-run and force flags are mutually exclusive */ 4712ff17c8bfSgjelinek if (!execute && force) { 4713ff17c8bfSgjelinek zerror(gettext("-F and -n flags are mutually exclusive")); 47146cfd72c6Sgjelinek return (Z_ERR); 47156cfd72c6Sgjelinek } 47166cfd72c6Sgjelinek 47178cd327d5Sgjelinek /* 4718ff17c8bfSgjelinek * If the no-execute option was specified, we don't do validation and 4719ff17c8bfSgjelinek * need to figure out the brand, since there is no zone required to be 47208cd327d5Sgjelinek * configured for this option. 47218cd327d5Sgjelinek */ 4722ff17c8bfSgjelinek if (execute) { 4723ff17c8bfSgjelinek if (!brand_help) { 4724ff17c8bfSgjelinek if (sanity_check(target_zone, CMD_ATTACH, B_FALSE, 4725edfa49ffS B_TRUE, forced_update) != Z_OK) 4726ee519a1fSgjelinek return (Z_ERR); 4727ce28b40eSzt129084 if (verify_details(CMD_ATTACH, argv) != Z_OK) 4728ee519a1fSgjelinek return (Z_ERR); 4729ff17c8bfSgjelinek } 4730ee519a1fSgjelinek 4731ff17c8bfSgjelinek if ((err = zone_get_zonepath(target_zone, zonepath, 4732ff17c8bfSgjelinek sizeof (zonepath))) != Z_OK) { 4733ee519a1fSgjelinek errno = err; 4734ff17c8bfSgjelinek zperror2(target_zone, 4735ff17c8bfSgjelinek gettext("could not get zone path")); 4736ee519a1fSgjelinek return (Z_ERR); 4737ee519a1fSgjelinek } 4738ff17c8bfSgjelinek } else { 4739ff17c8bfSgjelinek if (dryrun_get_brand(manifest_path, tmpmanifest, 4740ff17c8bfSgjelinek sizeof (tmpmanifest)) != Z_OK) 4741ff17c8bfSgjelinek return (Z_ERR); 4742ff17c8bfSgjelinek 4743ff17c8bfSgjelinek argv[manifest_pos] = tmpmanifest; 4744ff17c8bfSgjelinek target_zone = "-"; 4745ff17c8bfSgjelinek (void) strlcpy(zonepath, "-", sizeof (zonepath)); 4746ff17c8bfSgjelinek 4747ff17c8bfSgjelinek /* Run the brand's verify_adm hook. */ 4748ff17c8bfSgjelinek if (verify_brand(NULL, CMD_ATTACH, argv) != Z_OK) 4749ff17c8bfSgjelinek return (Z_ERR); 4750ff17c8bfSgjelinek } 4751ff17c8bfSgjelinek 4752ff17c8bfSgjelinek /* 4753ff17c8bfSgjelinek * Fetch the attach and postattach hooks from the brand configuration. 4754ff17c8bfSgjelinek */ 475537774979Sgjelinek if ((bh = brand_open(target_brand)) == NULL) { 475637774979Sgjelinek zerror(gettext("missing or invalid brand")); 475737774979Sgjelinek return (Z_ERR); 475837774979Sgjelinek } 475937774979Sgjelinek 4760ff17c8bfSgjelinek if (get_hook(bh, cmdbuf, sizeof (cmdbuf), brand_get_attach, target_zone, 4761ff17c8bfSgjelinek zonepath) != Z_OK) { 4762ff17c8bfSgjelinek zerror("invalid brand configuration: missing attach resource"); 4763ff17c8bfSgjelinek brand_close(bh); 4764ff17c8bfSgjelinek return (Z_ERR); 4765ff17c8bfSgjelinek } 4766ff17c8bfSgjelinek 4767ff17c8bfSgjelinek if (get_hook(bh, postcmdbuf, sizeof (postcmdbuf), brand_get_postattach, 4768ff17c8bfSgjelinek target_zone, zonepath) != Z_OK) { 476937774979Sgjelinek zerror("invalid brand configuration: missing postattach " 477037774979Sgjelinek "resource"); 477137774979Sgjelinek brand_close(bh); 477237774979Sgjelinek return (Z_ERR); 477337774979Sgjelinek } 477437774979Sgjelinek brand_close(bh); 477537774979Sgjelinek 4776ff17c8bfSgjelinek /* Append all options to attach hook. */ 4777ff17c8bfSgjelinek if (addoptions(cmdbuf, argv, sizeof (cmdbuf)) != Z_OK) 477837774979Sgjelinek return (Z_ERR); 477937774979Sgjelinek 4780ff17c8bfSgjelinek /* Append all options to postattach hook. */ 4781ff17c8bfSgjelinek if (addoptions(postcmdbuf, argv, sizeof (postcmdbuf)) != Z_OK) 4782ff17c8bfSgjelinek return (Z_ERR); 4783ff17c8bfSgjelinek 4784ff17c8bfSgjelinek if (execute && !brand_help) { 4785ff17c8bfSgjelinek if (zonecfg_grab_lock_file(target_zone, &lockfd) != Z_OK) { 4786ff17c8bfSgjelinek zerror(gettext("another %s may have an operation in " 4787ff17c8bfSgjelinek "progress."), "zoneadm"); 4788ee519a1fSgjelinek return (Z_ERR); 4789ee519a1fSgjelinek } 4790ff17c8bfSgjelinek } 4791ee519a1fSgjelinek 479271443f5aS if (!force) { 479371443f5aS /* 479471443f5aS * Not a force-attach, so we need to actually do the work. 479571443f5aS */ 4796ff17c8bfSgjelinek if (cmdbuf[0] != '\0') { 4797ff17c8bfSgjelinek /* Run the attach hook */ 4798edfa49ffS status = do_subproc(cmdbuf); 479971443f5aS if ((status = subproc_status(gettext("brand-specific " 480071443f5aS "attach"), status, B_FALSE)) != ZONE_SUBPROC_OK) { 4801ff17c8bfSgjelinek if (status == ZONE_SUBPROC_USAGE && !brand_help) 4802ff17c8bfSgjelinek sub_usage(SHELP_ATTACH, CMD_ATTACH); 4803ff17c8bfSgjelinek 480471443f5aS if (execute && !brand_help) { 4805edfa49ffS assert(zonecfg_lock_file_held(&lockfd)); 480671443f5aS zonecfg_release_lock_file(target_zone, 480771443f5aS lockfd); 480871443f5aS lockfd = -1; 4809ee519a1fSgjelinek } 4810ee519a1fSgjelinek 481171443f5aS assert(lockfd == -1); 481271443f5aS return (Z_ERR); 481371443f5aS } 4814ee519a1fSgjelinek } 4815ee519a1fSgjelinek 48169acbbeafSnn35248 /* 4817ff17c8bfSgjelinek * Else run the built-in attach support. 4818ff17c8bfSgjelinek * This is a no-op since there is nothing to validate. 48199acbbeafSnn35248 */ 4820ff17c8bfSgjelinek 4821ff17c8bfSgjelinek /* If dry-run or help, then we're done. */ 4822ff17c8bfSgjelinek if (!execute || brand_help) { 4823ff17c8bfSgjelinek if (!execute) 4824ff17c8bfSgjelinek (void) unlink(tmpmanifest); 482571443f5aS assert(lockfd == -1); 4826ff17c8bfSgjelinek return (Z_OK); 48279acbbeafSnn35248 } 482871443f5aS } 48299acbbeafSnn35248 4830ca733e25S /* Now we can validate that the zonepath exists. */ 4831ca733e25S if (validate_zonepath(zonepath, CMD_ATTACH) != Z_OK) { 4832ca733e25S (void) fprintf(stderr, gettext("could not verify zonepath %s " 4833ca733e25S "because of the above errors.\n"), zonepath); 4834ca733e25S 4835ca733e25S assert(zonecfg_lock_file_held(&lockfd)); 4836ca733e25S zonecfg_release_lock_file(target_zone, lockfd); 4837ca733e25S return (Z_ERR); 4838ca733e25S } 4839ca733e25S 484071443f5aS if ((handle = zonecfg_init_handle()) == NULL) { 484171443f5aS zperror(cmd_to_str(CMD_ATTACH), B_TRUE); 484271443f5aS err = Z_ERR; 484371443f5aS } else if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) { 484471443f5aS errno = err; 484571443f5aS zperror(cmd_to_str(CMD_ATTACH), B_TRUE); 484671443f5aS zonecfg_fini_handle(handle); 484771443f5aS } else { 4848ee519a1fSgjelinek zonecfg_rm_detached(handle, force); 484971443f5aS zonecfg_fini_handle(handle); 485071443f5aS } 4851ee519a1fSgjelinek 485271443f5aS if (err == Z_OK && 485371443f5aS (err = zone_set_state(target_zone, ZONE_STATE_INSTALLED)) != Z_OK) { 4854ee519a1fSgjelinek errno = err; 4855ee519a1fSgjelinek zperror(gettext("could not reset state"), B_TRUE); 4856ee519a1fSgjelinek } 4857ee519a1fSgjelinek 4858edfa49ffS assert(zonecfg_lock_file_held(&lockfd)); 4859ff17c8bfSgjelinek zonecfg_release_lock_file(target_zone, lockfd); 486071443f5aS lockfd = -1; 4861ee519a1fSgjelinek 486237774979Sgjelinek /* If we have a brand postattach hook, run it. */ 4863ff17c8bfSgjelinek if (err == Z_OK && !force && postcmdbuf[0] != '\0') { 4864ff17c8bfSgjelinek status = do_subproc(postcmdbuf); 486537774979Sgjelinek if (subproc_status(gettext("brand-specific postattach"), 486637774979Sgjelinek status, B_FALSE) != ZONE_SUBPROC_OK) { 486737774979Sgjelinek if ((err = zone_set_state(target_zone, 486837774979Sgjelinek ZONE_STATE_CONFIGURED)) != Z_OK) { 486937774979Sgjelinek errno = err; 487037774979Sgjelinek zperror(gettext("could not reset state"), 487137774979Sgjelinek B_TRUE); 487237774979Sgjelinek } 487337774979Sgjelinek } 487437774979Sgjelinek } 487537774979Sgjelinek 487671443f5aS assert(lockfd == -1); 4877ee519a1fSgjelinek return ((err == Z_OK) ? Z_OK : Z_ERR); 4878ee519a1fSgjelinek } 4879ee519a1fSgjelinek 4880865e09a4Sgjelinek /* 48817c478bd9Sstevel@tonic-gate * On input, TRUE => yes, FALSE => no. 48827c478bd9Sstevel@tonic-gate * On return, TRUE => 1, FALSE => 0, could not ask => -1. 48837c478bd9Sstevel@tonic-gate */ 48847c478bd9Sstevel@tonic-gate 48857c478bd9Sstevel@tonic-gate static int 48867c478bd9Sstevel@tonic-gate ask_yesno(boolean_t default_answer, const char *question) 48877c478bd9Sstevel@tonic-gate { 48887c478bd9Sstevel@tonic-gate char line[64]; /* should be large enough to answer yes or no */ 48897c478bd9Sstevel@tonic-gate 48907c478bd9Sstevel@tonic-gate if (!isatty(STDIN_FILENO)) 48917c478bd9Sstevel@tonic-gate return (-1); 48927c478bd9Sstevel@tonic-gate for (;;) { 48937c478bd9Sstevel@tonic-gate (void) printf("%s (%s)? ", question, 48947c478bd9Sstevel@tonic-gate default_answer ? "[y]/n" : "y/[n]"); 48957c478bd9Sstevel@tonic-gate if (fgets(line, sizeof (line), stdin) == NULL || 48967c478bd9Sstevel@tonic-gate line[0] == '\n') 48977c478bd9Sstevel@tonic-gate return (default_answer ? 1 : 0); 48987c478bd9Sstevel@tonic-gate if (tolower(line[0]) == 'y') 48997c478bd9Sstevel@tonic-gate return (1); 49007c478bd9Sstevel@tonic-gate if (tolower(line[0]) == 'n') 49017c478bd9Sstevel@tonic-gate return (0); 49027c478bd9Sstevel@tonic-gate } 49037c478bd9Sstevel@tonic-gate } 49047c478bd9Sstevel@tonic-gate 4905ff17c8bfSgjelinek /* ARGSUSED */ 49067c478bd9Sstevel@tonic-gate static int 49077c478bd9Sstevel@tonic-gate uninstall_func(int argc, char *argv[]) 49087c478bd9Sstevel@tonic-gate { 49097c478bd9Sstevel@tonic-gate char line[ZONENAME_MAX + 128]; /* Enough for "Are you sure ..." */ 49100b5de56dSgjelinek char rootpath[MAXPATHLEN], zonepath[MAXPATHLEN]; 491137774979Sgjelinek char cmdbuf[MAXPATHLEN]; 4912ff17c8bfSgjelinek char precmdbuf[MAXPATHLEN]; 49137c478bd9Sstevel@tonic-gate boolean_t force = B_FALSE; 49147c478bd9Sstevel@tonic-gate int lockfd, answer; 49157c478bd9Sstevel@tonic-gate int err, arg; 4916ff17c8bfSgjelinek boolean_t brand_help = B_FALSE; 491737774979Sgjelinek brand_handle_t bh = NULL; 4918ff17c8bfSgjelinek int status; 49197c478bd9Sstevel@tonic-gate 4920108322fbScarlsonj if (zonecfg_in_alt_root()) { 4921108322fbScarlsonj zerror(gettext("cannot uninstall zone in alternate root")); 4922108322fbScarlsonj return (Z_ERR); 4923108322fbScarlsonj } 4924108322fbScarlsonj 4925ff17c8bfSgjelinek /* Check the argv string for args we handle internally */ 49267c478bd9Sstevel@tonic-gate optind = 0; 4927ff17c8bfSgjelinek opterr = 0; 49287c478bd9Sstevel@tonic-gate while ((arg = getopt(argc, argv, "?F")) != EOF) { 49297c478bd9Sstevel@tonic-gate switch (arg) { 49307c478bd9Sstevel@tonic-gate case '?': 4931ff17c8bfSgjelinek if (optopt == '?') { 49327c478bd9Sstevel@tonic-gate sub_usage(SHELP_UNINSTALL, CMD_UNINSTALL); 4933ff17c8bfSgjelinek brand_help = B_TRUE; 4934ff17c8bfSgjelinek } 4935ff17c8bfSgjelinek /* Ignore unknown options - may be brand specific. */ 4936ff17c8bfSgjelinek break; 49377c478bd9Sstevel@tonic-gate case 'F': 49387c478bd9Sstevel@tonic-gate force = B_TRUE; 49397c478bd9Sstevel@tonic-gate break; 49407c478bd9Sstevel@tonic-gate default: 4941ff17c8bfSgjelinek /* Ignore unknown options - may be brand specific. */ 4942ff17c8bfSgjelinek break; 49437c478bd9Sstevel@tonic-gate } 49447c478bd9Sstevel@tonic-gate } 49457c478bd9Sstevel@tonic-gate 4946ff17c8bfSgjelinek if (!brand_help) { 4947ff17c8bfSgjelinek if (sanity_check(target_zone, CMD_UNINSTALL, B_FALSE, B_TRUE, 4948ff17c8bfSgjelinek B_FALSE) != Z_OK) 49497c478bd9Sstevel@tonic-gate return (Z_ERR); 49507c478bd9Sstevel@tonic-gate 4951ce28b40eSzt129084 /* 4952ce28b40eSzt129084 * Invoke brand-specific handler. 4953ce28b40eSzt129084 */ 4954ce28b40eSzt129084 if (invoke_brand_handler(CMD_UNINSTALL, argv) != Z_OK) 4955ce28b40eSzt129084 return (Z_ERR); 4956ce28b40eSzt129084 49577c478bd9Sstevel@tonic-gate if (!force) { 49587c478bd9Sstevel@tonic-gate (void) snprintf(line, sizeof (line), 49597c478bd9Sstevel@tonic-gate gettext("Are you sure you want to %s zone %s"), 49607c478bd9Sstevel@tonic-gate cmd_to_str(CMD_UNINSTALL), target_zone); 49617c478bd9Sstevel@tonic-gate if ((answer = ask_yesno(B_FALSE, line)) == 0) { 49627c478bd9Sstevel@tonic-gate return (Z_OK); 49637c478bd9Sstevel@tonic-gate } else if (answer == -1) { 49647c478bd9Sstevel@tonic-gate zerror(gettext("Input not from terminal and -F " 49657c478bd9Sstevel@tonic-gate "not specified: %s not done."), 49667c478bd9Sstevel@tonic-gate cmd_to_str(CMD_UNINSTALL)); 49677c478bd9Sstevel@tonic-gate return (Z_ERR); 49687c478bd9Sstevel@tonic-gate } 49697c478bd9Sstevel@tonic-gate } 4970ff17c8bfSgjelinek } 49717c478bd9Sstevel@tonic-gate 49720b5de56dSgjelinek if ((err = zone_get_zonepath(target_zone, zonepath, 49730b5de56dSgjelinek sizeof (zonepath))) != Z_OK) { 49747c478bd9Sstevel@tonic-gate errno = err; 49757c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not get zone path")); 49767c478bd9Sstevel@tonic-gate return (Z_ERR); 49777c478bd9Sstevel@tonic-gate } 4978ff17c8bfSgjelinek 4979ff17c8bfSgjelinek /* 4980ff17c8bfSgjelinek * Fetch the uninstall and preuninstall hooks from the brand 4981ff17c8bfSgjelinek * configuration. 4982ff17c8bfSgjelinek */ 4983ff17c8bfSgjelinek if ((bh = brand_open(target_brand)) == NULL) { 4984ff17c8bfSgjelinek zerror(gettext("missing or invalid brand")); 4985ff17c8bfSgjelinek return (Z_ERR); 4986ff17c8bfSgjelinek } 4987ff17c8bfSgjelinek 4988ff17c8bfSgjelinek if (get_hook(bh, cmdbuf, sizeof (cmdbuf), brand_get_uninstall, 4989ff17c8bfSgjelinek target_zone, zonepath) != Z_OK) { 4990ff17c8bfSgjelinek zerror("invalid brand configuration: missing uninstall " 4991ff17c8bfSgjelinek "resource"); 4992ff17c8bfSgjelinek brand_close(bh); 4993ff17c8bfSgjelinek return (Z_ERR); 4994ff17c8bfSgjelinek } 4995ff17c8bfSgjelinek 4996ff17c8bfSgjelinek if (get_hook(bh, precmdbuf, sizeof (precmdbuf), brand_get_preuninstall, 4997ff17c8bfSgjelinek target_zone, zonepath) != Z_OK) { 4998ff17c8bfSgjelinek zerror("invalid brand configuration: missing preuninstall " 4999ff17c8bfSgjelinek "resource"); 5000ff17c8bfSgjelinek brand_close(bh); 5001ff17c8bfSgjelinek return (Z_ERR); 5002ff17c8bfSgjelinek } 5003ff17c8bfSgjelinek brand_close(bh); 5004ff17c8bfSgjelinek 5005ff17c8bfSgjelinek /* Append all options to preuninstall hook. */ 5006ff17c8bfSgjelinek if (addoptions(precmdbuf, argv, sizeof (precmdbuf)) != Z_OK) 5007ff17c8bfSgjelinek return (Z_ERR); 5008ff17c8bfSgjelinek 5009ff17c8bfSgjelinek /* Append all options to uninstall hook. */ 5010ff17c8bfSgjelinek if (addoptions(cmdbuf, argv, sizeof (cmdbuf)) != Z_OK) 5011ff17c8bfSgjelinek return (Z_ERR); 5012ff17c8bfSgjelinek 5013ff17c8bfSgjelinek if (!brand_help) { 50147c478bd9Sstevel@tonic-gate if ((err = zone_get_rootpath(target_zone, rootpath, 50157c478bd9Sstevel@tonic-gate sizeof (rootpath))) != Z_OK) { 50167c478bd9Sstevel@tonic-gate errno = err; 5017ff17c8bfSgjelinek zperror2(target_zone, gettext("could not get root " 5018ff17c8bfSgjelinek "path")); 50197c478bd9Sstevel@tonic-gate return (Z_ERR); 50207c478bd9Sstevel@tonic-gate } 50217c478bd9Sstevel@tonic-gate 50227c478bd9Sstevel@tonic-gate /* 5023ff17c8bfSgjelinek * If there seems to be a zoneadmd running for this zone, call 5024ff17c8bfSgjelinek * it to tell it that an uninstall is happening; if all goes 5025ff17c8bfSgjelinek * well it will then shut itself down. 50267c478bd9Sstevel@tonic-gate */ 5027ff17c8bfSgjelinek if (zonecfg_ping_zoneadmd(target_zone) == Z_OK) { 50287c478bd9Sstevel@tonic-gate zone_cmd_arg_t zarg; 50297c478bd9Sstevel@tonic-gate zarg.cmd = Z_NOTE_UNINSTALLING; 5030ff17c8bfSgjelinek /* we don't care too much if this fails, just plow on */ 5031ff17c8bfSgjelinek (void) zonecfg_call_zoneadmd(target_zone, &zarg, locale, 5032ff17c8bfSgjelinek B_TRUE); 50337c478bd9Sstevel@tonic-gate } 50347c478bd9Sstevel@tonic-gate 5035ff17c8bfSgjelinek if (zonecfg_grab_lock_file(target_zone, &lockfd) != Z_OK) { 5036ff17c8bfSgjelinek zerror(gettext("another %s may have an operation in " 5037ff17c8bfSgjelinek "progress."), "zoneadm"); 50387c478bd9Sstevel@tonic-gate return (Z_ERR); 50397c478bd9Sstevel@tonic-gate } 50407c478bd9Sstevel@tonic-gate 50417c478bd9Sstevel@tonic-gate /* Don't uninstall the zone if anything is mounted there */ 50427c478bd9Sstevel@tonic-gate err = zonecfg_find_mounts(rootpath, NULL, NULL); 50437c478bd9Sstevel@tonic-gate if (err) { 50440b5de56dSgjelinek zerror(gettext("These file systems are mounted on " 50457c478bd9Sstevel@tonic-gate "subdirectories of %s.\n"), rootpath); 50467c478bd9Sstevel@tonic-gate (void) zonecfg_find_mounts(rootpath, zfm_print, NULL); 5047ff17c8bfSgjelinek zonecfg_release_lock_file(target_zone, lockfd); 50487c478bd9Sstevel@tonic-gate return (Z_ERR); 50497c478bd9Sstevel@tonic-gate } 505037774979Sgjelinek } 505137774979Sgjelinek 5052ff17c8bfSgjelinek /* If we have a brand preuninstall hook, run it. */ 5053ff17c8bfSgjelinek if (!brand_help && precmdbuf[0] != '\0') { 5054ab5dfd5eS status = do_subproc(precmdbuf); 505537774979Sgjelinek if (subproc_status(gettext("brand-specific preuninstall"), 505637774979Sgjelinek status, B_FALSE) != ZONE_SUBPROC_OK) { 5057ff17c8bfSgjelinek zonecfg_release_lock_file(target_zone, lockfd); 505837774979Sgjelinek return (Z_ERR); 505937774979Sgjelinek } 506037774979Sgjelinek } 506137774979Sgjelinek 5062ff17c8bfSgjelinek if (!brand_help) { 50637c478bd9Sstevel@tonic-gate err = zone_set_state(target_zone, ZONE_STATE_INCOMPLETE); 50647c478bd9Sstevel@tonic-gate if (err != Z_OK) { 50657c478bd9Sstevel@tonic-gate errno = err; 50667c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not set state")); 50677c478bd9Sstevel@tonic-gate goto bad; 50687c478bd9Sstevel@tonic-gate } 5069ff17c8bfSgjelinek } 50707c478bd9Sstevel@tonic-gate 5071ff17c8bfSgjelinek /* 5072ff17c8bfSgjelinek * If there is a brand uninstall hook, use it, otherwise use the 5073ff17c8bfSgjelinek * built-in uninstall code. 5074ff17c8bfSgjelinek */ 5075ff17c8bfSgjelinek if (cmdbuf[0] != '\0') { 5076ff17c8bfSgjelinek /* Run the uninstall hook */ 5077c75cc341S status = do_subproc(cmdbuf); 5078ff17c8bfSgjelinek if ((status = subproc_status(gettext("brand-specific " 5079ff17c8bfSgjelinek "uninstall"), status, B_FALSE)) != ZONE_SUBPROC_OK) { 5080ff17c8bfSgjelinek if (status == ZONE_SUBPROC_USAGE && !brand_help) 5081ff17c8bfSgjelinek sub_usage(SHELP_UNINSTALL, CMD_UNINSTALL); 5082ff17c8bfSgjelinek if (!brand_help) 5083ff17c8bfSgjelinek zonecfg_release_lock_file(target_zone, lockfd); 5084ff17c8bfSgjelinek return (Z_ERR); 5085ff17c8bfSgjelinek } 5086ff17c8bfSgjelinek 5087ff17c8bfSgjelinek if (brand_help) 5088ff17c8bfSgjelinek return (Z_OK); 5089ff17c8bfSgjelinek } else { 5090ff17c8bfSgjelinek /* If just help, we're done since there is no brand help. */ 5091ff17c8bfSgjelinek if (brand_help) 5092ff17c8bfSgjelinek return (Z_OK); 5093ff17c8bfSgjelinek 5094ff17c8bfSgjelinek /* Run the built-in uninstall support. */ 50950b5de56dSgjelinek if ((err = cleanup_zonepath(zonepath, B_FALSE)) != Z_OK) { 50960b5de56dSgjelinek errno = err; 5097ff17c8bfSgjelinek zperror2(target_zone, gettext("cleaning up zonepath " 5098ff17c8bfSgjelinek "failed")); 50997c478bd9Sstevel@tonic-gate goto bad; 51000b5de56dSgjelinek } 5101ff17c8bfSgjelinek } 51020b5de56dSgjelinek 51037c478bd9Sstevel@tonic-gate err = zone_set_state(target_zone, ZONE_STATE_CONFIGURED); 51047c478bd9Sstevel@tonic-gate if (err != Z_OK) { 51057c478bd9Sstevel@tonic-gate errno = err; 51067c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not reset state")); 51077c478bd9Sstevel@tonic-gate } 51087c478bd9Sstevel@tonic-gate bad: 5109ff17c8bfSgjelinek zonecfg_release_lock_file(target_zone, lockfd); 51107c478bd9Sstevel@tonic-gate return (err); 51117c478bd9Sstevel@tonic-gate } 51127c478bd9Sstevel@tonic-gate 5113108322fbScarlsonj /* ARGSUSED */ 5114108322fbScarlsonj static int 5115108322fbScarlsonj mount_func(int argc, char *argv[]) 5116108322fbScarlsonj { 5117108322fbScarlsonj zone_cmd_arg_t zarg; 51189acbbeafSnn35248 boolean_t force = B_FALSE; 51199acbbeafSnn35248 int arg; 5120108322fbScarlsonj 51219acbbeafSnn35248 /* 51229acbbeafSnn35248 * The only supported subargument to the "mount" subcommand is 51239acbbeafSnn35248 * "-f", which forces us to mount a zone in the INCOMPLETE state. 51249acbbeafSnn35248 */ 51259acbbeafSnn35248 optind = 0; 51269acbbeafSnn35248 if ((arg = getopt(argc, argv, "f")) != EOF) { 51279acbbeafSnn35248 switch (arg) { 51289acbbeafSnn35248 case 'f': 51299acbbeafSnn35248 force = B_TRUE; 51309acbbeafSnn35248 break; 51319acbbeafSnn35248 default: 5132108322fbScarlsonj return (Z_USAGE); 51339acbbeafSnn35248 } 51349acbbeafSnn35248 } 51359acbbeafSnn35248 if (argc > optind) 51369acbbeafSnn35248 return (Z_USAGE); 51379acbbeafSnn35248 51389acbbeafSnn35248 if (sanity_check(target_zone, CMD_MOUNT, B_FALSE, B_FALSE, force) 51399acbbeafSnn35248 != Z_OK) 5140108322fbScarlsonj return (Z_ERR); 5141ce28b40eSzt129084 if (verify_details(CMD_MOUNT, argv) != Z_OK) 5142108322fbScarlsonj return (Z_ERR); 5143108322fbScarlsonj 51449acbbeafSnn35248 zarg.cmd = force ? Z_FORCEMOUNT : Z_MOUNT; 51456cfd72c6Sgjelinek zarg.bootbuf[0] = '\0'; 5146ff17c8bfSgjelinek if (zonecfg_call_zoneadmd(target_zone, &zarg, locale, B_TRUE) != 0) { 5147108322fbScarlsonj zerror(gettext("call to %s failed"), "zoneadmd"); 5148108322fbScarlsonj return (Z_ERR); 5149108322fbScarlsonj } 5150108322fbScarlsonj return (Z_OK); 5151108322fbScarlsonj } 5152108322fbScarlsonj 5153108322fbScarlsonj /* ARGSUSED */ 5154108322fbScarlsonj static int 5155108322fbScarlsonj unmount_func(int argc, char *argv[]) 5156108322fbScarlsonj { 5157108322fbScarlsonj zone_cmd_arg_t zarg; 5158108322fbScarlsonj 5159108322fbScarlsonj if (argc > 0) 5160108322fbScarlsonj return (Z_USAGE); 51619acbbeafSnn35248 if (sanity_check(target_zone, CMD_UNMOUNT, B_FALSE, B_FALSE, B_FALSE) 51629acbbeafSnn35248 != Z_OK) 5163108322fbScarlsonj return (Z_ERR); 5164108322fbScarlsonj 5165108322fbScarlsonj zarg.cmd = Z_UNMOUNT; 5166ff17c8bfSgjelinek if (zonecfg_call_zoneadmd(target_zone, &zarg, locale, B_TRUE) != 0) { 5167108322fbScarlsonj zerror(gettext("call to %s failed"), "zoneadmd"); 5168108322fbScarlsonj return (Z_ERR); 5169108322fbScarlsonj } 5170108322fbScarlsonj return (Z_OK); 5171108322fbScarlsonj } 5172108322fbScarlsonj 51737c478bd9Sstevel@tonic-gate static int 5174555afedfScarlsonj mark_func(int argc, char *argv[]) 5175555afedfScarlsonj { 5176555afedfScarlsonj int err, lockfd; 5177edfa49ffS int arg; 5178edfa49ffS boolean_t force = B_FALSE; 5179edfa49ffS int state; 5180555afedfScarlsonj 5181edfa49ffS optind = 0; 5182edfa49ffS opterr = 0; 5183edfa49ffS while ((arg = getopt(argc, argv, "F")) != EOF) { 5184edfa49ffS switch (arg) { 5185edfa49ffS case 'F': 5186edfa49ffS force = B_TRUE; 5187edfa49ffS break; 5188edfa49ffS default: 5189555afedfScarlsonj return (Z_USAGE); 5190edfa49ffS } 5191edfa49ffS } 5192edfa49ffS 5193edfa49ffS if (argc != (optind + 1)) 5194edfa49ffS return (Z_USAGE); 5195edfa49ffS 5196edfa49ffS if (strcmp(argv[optind], "configured") == 0) 5197edfa49ffS state = ZONE_STATE_CONFIGURED; 5198edfa49ffS else if (strcmp(argv[optind], "incomplete") == 0) 5199edfa49ffS state = ZONE_STATE_INCOMPLETE; 5200edfa49ffS else if (strcmp(argv[optind], "installed") == 0) 5201edfa49ffS state = ZONE_STATE_INSTALLED; 5202edfa49ffS else 5203edfa49ffS return (Z_USAGE); 5204edfa49ffS 5205edfa49ffS if (state != ZONE_STATE_INCOMPLETE && !force) 5206edfa49ffS return (Z_USAGE); 5207edfa49ffS 5208edfa49ffS if (sanity_check(target_zone, CMD_MARK, B_FALSE, B_TRUE, B_FALSE) 52099acbbeafSnn35248 != Z_OK) 5210555afedfScarlsonj return (Z_ERR); 5211555afedfScarlsonj 5212ce28b40eSzt129084 /* 5213ce28b40eSzt129084 * Invoke brand-specific handler. 5214ce28b40eSzt129084 */ 5215ce28b40eSzt129084 if (invoke_brand_handler(CMD_MARK, argv) != Z_OK) 5216ce28b40eSzt129084 return (Z_ERR); 5217ce28b40eSzt129084 5218ff17c8bfSgjelinek if (zonecfg_grab_lock_file(target_zone, &lockfd) != Z_OK) { 5219555afedfScarlsonj zerror(gettext("another %s may have an operation in progress."), 5220555afedfScarlsonj "zoneadm"); 5221555afedfScarlsonj return (Z_ERR); 5222555afedfScarlsonj } 5223555afedfScarlsonj 5224edfa49ffS err = zone_set_state(target_zone, state); 5225555afedfScarlsonj if (err != Z_OK) { 5226555afedfScarlsonj errno = err; 5227555afedfScarlsonj zperror2(target_zone, gettext("could not set state")); 5228555afedfScarlsonj } 5229ff17c8bfSgjelinek zonecfg_release_lock_file(target_zone, lockfd); 5230555afedfScarlsonj 5231555afedfScarlsonj return (err); 5232555afedfScarlsonj } 5233555afedfScarlsonj 52340209230bSgjelinek /* 52350209230bSgjelinek * Check what scheduling class we're running under and print a warning if 52360209230bSgjelinek * we're not using FSS. 52370209230bSgjelinek */ 52380209230bSgjelinek static int 52390209230bSgjelinek check_sched_fss(zone_dochandle_t handle) 52400209230bSgjelinek { 52410209230bSgjelinek char class_name[PC_CLNMSZ]; 52420209230bSgjelinek 52430209230bSgjelinek if (zonecfg_get_dflt_sched_class(handle, class_name, 52440209230bSgjelinek sizeof (class_name)) != Z_OK) { 52450209230bSgjelinek zerror(gettext("WARNING: unable to determine the zone's " 52460209230bSgjelinek "scheduling class")); 52470209230bSgjelinek } else if (strcmp("FSS", class_name) != 0) { 52480209230bSgjelinek zerror(gettext("WARNING: The zone.cpu-shares rctl is set but\n" 52490209230bSgjelinek "FSS is not the default scheduling class for this zone. " 52500209230bSgjelinek "FSS will be\nused for processes in the zone but to get " 52510209230bSgjelinek "the full benefit of FSS,\nit should be the default " 52520209230bSgjelinek "scheduling class. See dispadmin(1M) for\nmore details.")); 52530209230bSgjelinek return (Z_SYSTEM); 52540209230bSgjelinek } 52550209230bSgjelinek 52560209230bSgjelinek return (Z_OK); 52570209230bSgjelinek } 52580209230bSgjelinek 52590209230bSgjelinek static int 52600209230bSgjelinek check_cpu_shares_sched(zone_dochandle_t handle) 52610209230bSgjelinek { 52620209230bSgjelinek int err; 52630209230bSgjelinek int res = Z_OK; 52640209230bSgjelinek struct zone_rctltab rctl; 52650209230bSgjelinek 52660209230bSgjelinek if ((err = zonecfg_setrctlent(handle)) != Z_OK) { 52670209230bSgjelinek errno = err; 52680209230bSgjelinek zperror(cmd_to_str(CMD_APPLY), B_TRUE); 52690209230bSgjelinek return (err); 52700209230bSgjelinek } 52710209230bSgjelinek 52720209230bSgjelinek while (zonecfg_getrctlent(handle, &rctl) == Z_OK) { 52730209230bSgjelinek if (strcmp(rctl.zone_rctl_name, "zone.cpu-shares") == 0) { 52740209230bSgjelinek if (check_sched_fss(handle) != Z_OK) 52750209230bSgjelinek res = Z_SYSTEM; 52760209230bSgjelinek break; 52770209230bSgjelinek } 52780209230bSgjelinek } 52790209230bSgjelinek 52800209230bSgjelinek (void) zonecfg_endrctlent(handle); 52810209230bSgjelinek 52820209230bSgjelinek return (res); 52830209230bSgjelinek } 52840209230bSgjelinek 52850209230bSgjelinek /* 52867ef01d19Sgjelinek * Check if there is a mix of processes running in different pools within the 52877ef01d19Sgjelinek * zone. This is currently only going to be called for the global zone from 52887ef01d19Sgjelinek * apply_func but that could be generalized in the future. 52897ef01d19Sgjelinek */ 52907ef01d19Sgjelinek static boolean_t 52917ef01d19Sgjelinek mixed_pools(zoneid_t zoneid) 52927ef01d19Sgjelinek { 52937ef01d19Sgjelinek DIR *dirp; 52947ef01d19Sgjelinek dirent_t *dent; 52957ef01d19Sgjelinek boolean_t mixed = B_FALSE; 52967ef01d19Sgjelinek boolean_t poolid_set = B_FALSE; 52977ef01d19Sgjelinek poolid_t last_poolid = 0; 52987ef01d19Sgjelinek 52997ef01d19Sgjelinek if ((dirp = opendir("/proc")) == NULL) { 53007ef01d19Sgjelinek zerror(gettext("could not open /proc")); 53017ef01d19Sgjelinek return (B_FALSE); 53027ef01d19Sgjelinek } 53037ef01d19Sgjelinek 53047ef01d19Sgjelinek while ((dent = readdir(dirp)) != NULL) { 53057ef01d19Sgjelinek int procfd; 53067ef01d19Sgjelinek psinfo_t ps; 53077ef01d19Sgjelinek char procpath[MAXPATHLEN]; 53087ef01d19Sgjelinek 53097ef01d19Sgjelinek if (dent->d_name[0] == '.') 53107ef01d19Sgjelinek continue; 53117ef01d19Sgjelinek 53127ef01d19Sgjelinek (void) snprintf(procpath, sizeof (procpath), "/proc/%s/psinfo", 53137ef01d19Sgjelinek dent->d_name); 53147ef01d19Sgjelinek 53157ef01d19Sgjelinek if ((procfd = open(procpath, O_RDONLY)) == -1) 53167ef01d19Sgjelinek continue; 53177ef01d19Sgjelinek 53187ef01d19Sgjelinek if (read(procfd, &ps, sizeof (ps)) == sizeof (psinfo_t)) { 53197ef01d19Sgjelinek /* skip processes in other zones and system processes */ 53207ef01d19Sgjelinek if (zoneid != ps.pr_zoneid || ps.pr_flag & SSYS) { 53217ef01d19Sgjelinek (void) close(procfd); 53227ef01d19Sgjelinek continue; 53237ef01d19Sgjelinek } 53247ef01d19Sgjelinek 53257ef01d19Sgjelinek if (poolid_set) { 53267ef01d19Sgjelinek if (ps.pr_poolid != last_poolid) 53277ef01d19Sgjelinek mixed = B_TRUE; 53287ef01d19Sgjelinek } else { 53297ef01d19Sgjelinek last_poolid = ps.pr_poolid; 53307ef01d19Sgjelinek poolid_set = B_TRUE; 53317ef01d19Sgjelinek } 53327ef01d19Sgjelinek } 53337ef01d19Sgjelinek 53347ef01d19Sgjelinek (void) close(procfd); 53357ef01d19Sgjelinek 53367ef01d19Sgjelinek if (mixed) 53377ef01d19Sgjelinek break; 53387ef01d19Sgjelinek } 53397ef01d19Sgjelinek 53407ef01d19Sgjelinek (void) closedir(dirp); 53417ef01d19Sgjelinek 53427ef01d19Sgjelinek return (mixed); 53437ef01d19Sgjelinek } 53447ef01d19Sgjelinek 53457ef01d19Sgjelinek /* 53467ef01d19Sgjelinek * Check if a persistent or temporary pool is configured for the zone. 53477ef01d19Sgjelinek * This is currently only going to be called for the global zone from 53487ef01d19Sgjelinek * apply_func but that could be generalized in the future. 53497ef01d19Sgjelinek */ 53507ef01d19Sgjelinek static boolean_t 53517ef01d19Sgjelinek pool_configured(zone_dochandle_t handle) 53527ef01d19Sgjelinek { 53537ef01d19Sgjelinek int err1, err2; 53547ef01d19Sgjelinek struct zone_psettab pset_tab; 53557ef01d19Sgjelinek char poolname[MAXPATHLEN]; 53567ef01d19Sgjelinek 53577ef01d19Sgjelinek err1 = zonecfg_lookup_pset(handle, &pset_tab); 53587ef01d19Sgjelinek err2 = zonecfg_get_pool(handle, poolname, sizeof (poolname)); 53597ef01d19Sgjelinek 53607ef01d19Sgjelinek if (err1 == Z_NO_ENTRY && 53617ef01d19Sgjelinek (err2 == Z_NO_ENTRY || (err2 == Z_OK && strlen(poolname) == 0))) 53627ef01d19Sgjelinek return (B_FALSE); 53637ef01d19Sgjelinek 53647ef01d19Sgjelinek return (B_TRUE); 53657ef01d19Sgjelinek } 53667ef01d19Sgjelinek 53677ef01d19Sgjelinek /* 53680209230bSgjelinek * This is an undocumented interface which is currently only used to apply 53690209230bSgjelinek * the global zone resource management settings when the system boots. 53700209230bSgjelinek * This function does not yet properly handle updating a running system so 53710209230bSgjelinek * any projects running in the zone would be trashed if this function 53720209230bSgjelinek * were to run after the zone had booted. It also does not reset any 53730209230bSgjelinek * rctl settings that were removed from zonecfg. There is still work to be 53740209230bSgjelinek * done before we can properly support dynamically updating the resource 53750209230bSgjelinek * management settings for a running zone (global or non-global). Thus, this 53760209230bSgjelinek * functionality is undocumented for now. 53770209230bSgjelinek */ 53780209230bSgjelinek /* ARGSUSED */ 53790209230bSgjelinek static int 53800209230bSgjelinek apply_func(int argc, char *argv[]) 53810209230bSgjelinek { 53820209230bSgjelinek int err; 53830209230bSgjelinek int res = Z_OK; 53840209230bSgjelinek priv_set_t *privset; 53850209230bSgjelinek zoneid_t zoneid; 53860209230bSgjelinek zone_dochandle_t handle; 53870209230bSgjelinek struct zone_mcaptab mcap; 53880209230bSgjelinek char pool_err[128]; 53890209230bSgjelinek 53900209230bSgjelinek zoneid = getzoneid(); 53910209230bSgjelinek 53920209230bSgjelinek if (zonecfg_in_alt_root() || zoneid != GLOBAL_ZONEID || 53930209230bSgjelinek target_zone == NULL || strcmp(target_zone, GLOBAL_ZONENAME) != 0) 53940209230bSgjelinek return (usage(B_FALSE)); 53950209230bSgjelinek 53960209230bSgjelinek if ((privset = priv_allocset()) == NULL) { 53970209230bSgjelinek zerror(gettext("%s failed"), "priv_allocset"); 53980209230bSgjelinek return (Z_ERR); 53990209230bSgjelinek } 54000209230bSgjelinek 54010209230bSgjelinek if (getppriv(PRIV_EFFECTIVE, privset) != 0) { 54020209230bSgjelinek zerror(gettext("%s failed"), "getppriv"); 54030209230bSgjelinek priv_freeset(privset); 54040209230bSgjelinek return (Z_ERR); 54050209230bSgjelinek } 54060209230bSgjelinek 54070209230bSgjelinek if (priv_isfullset(privset) == B_FALSE) { 54080209230bSgjelinek (void) usage(B_FALSE); 54090209230bSgjelinek priv_freeset(privset); 54100209230bSgjelinek return (Z_ERR); 54110209230bSgjelinek } 54120209230bSgjelinek priv_freeset(privset); 54130209230bSgjelinek 54140209230bSgjelinek if ((handle = zonecfg_init_handle()) == NULL) { 54150209230bSgjelinek zperror(cmd_to_str(CMD_APPLY), B_TRUE); 54160209230bSgjelinek return (Z_ERR); 54170209230bSgjelinek } 54180209230bSgjelinek 54190209230bSgjelinek if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) { 54200209230bSgjelinek errno = err; 54210209230bSgjelinek zperror(cmd_to_str(CMD_APPLY), B_TRUE); 54220209230bSgjelinek zonecfg_fini_handle(handle); 54230209230bSgjelinek return (Z_ERR); 54240209230bSgjelinek } 54250209230bSgjelinek 54260209230bSgjelinek /* specific error msgs are printed within apply_rctls */ 54270209230bSgjelinek if ((err = zonecfg_apply_rctls(target_zone, handle)) != Z_OK) { 54280209230bSgjelinek errno = err; 54290209230bSgjelinek zperror(cmd_to_str(CMD_APPLY), B_TRUE); 54300209230bSgjelinek res = Z_ERR; 54310209230bSgjelinek } 54320209230bSgjelinek 54330209230bSgjelinek if ((err = check_cpu_shares_sched(handle)) != Z_OK) 54340209230bSgjelinek res = Z_ERR; 54350209230bSgjelinek 54367ef01d19Sgjelinek if (pool_configured(handle)) { 54377ef01d19Sgjelinek if (mixed_pools(zoneid)) { 54387ef01d19Sgjelinek zerror(gettext("Zone is using multiple resource " 54397ef01d19Sgjelinek "pools. The pool\nconfiguration cannot be " 54407ef01d19Sgjelinek "applied without rebooting.")); 54417ef01d19Sgjelinek res = Z_ERR; 54427ef01d19Sgjelinek } else { 54437ef01d19Sgjelinek 54440209230bSgjelinek /* 54457ef01d19Sgjelinek * The next two blocks of code attempt to set up 54467ef01d19Sgjelinek * temporary pools as well as persistent pools. In 54477ef01d19Sgjelinek * both cases we call the functions unconditionally. 54487ef01d19Sgjelinek * Within each funtion the code will check if the zone 54497ef01d19Sgjelinek * is actually configured for a temporary pool or 54507ef01d19Sgjelinek * persistent pool and just return if there is nothing 54517ef01d19Sgjelinek * to do. 54520209230bSgjelinek */ 54537ef01d19Sgjelinek if ((err = zonecfg_bind_tmp_pool(handle, zoneid, 54547ef01d19Sgjelinek pool_err, sizeof (pool_err))) != Z_OK) { 54557ef01d19Sgjelinek if (err == Z_POOL || err == Z_POOL_CREATE || 54567ef01d19Sgjelinek err == Z_POOL_BIND) 54577ef01d19Sgjelinek zerror("%s: %s", zonecfg_strerror(err), 54587ef01d19Sgjelinek pool_err); 54590209230bSgjelinek else 54607ef01d19Sgjelinek zerror(gettext("could not bind zone to " 54617ef01d19Sgjelinek "temporary pool: %s"), 54627ef01d19Sgjelinek zonecfg_strerror(err)); 54630209230bSgjelinek res = Z_ERR; 54640209230bSgjelinek } 54650209230bSgjelinek 54660209230bSgjelinek if ((err = zonecfg_bind_pool(handle, zoneid, pool_err, 54670209230bSgjelinek sizeof (pool_err))) != Z_OK) { 54680209230bSgjelinek if (err == Z_POOL || err == Z_POOL_BIND) 54697ef01d19Sgjelinek zerror("%s: %s", zonecfg_strerror(err), 54707ef01d19Sgjelinek pool_err); 54710209230bSgjelinek else 54720209230bSgjelinek zerror("%s", zonecfg_strerror(err)); 54730209230bSgjelinek } 54747ef01d19Sgjelinek } 54757ef01d19Sgjelinek } 54760209230bSgjelinek 54770209230bSgjelinek /* 54780209230bSgjelinek * If a memory cap is configured, set the cap in the kernel using 54790209230bSgjelinek * zone_setattr() and make sure the rcapd SMF service is enabled. 54800209230bSgjelinek */ 54810209230bSgjelinek if (zonecfg_getmcapent(handle, &mcap) == Z_OK) { 54820209230bSgjelinek uint64_t num; 54830209230bSgjelinek char smf_err[128]; 54840209230bSgjelinek 54850209230bSgjelinek num = (uint64_t)strtoll(mcap.zone_physmem_cap, NULL, 10); 54860209230bSgjelinek if (zone_setattr(zoneid, ZONE_ATTR_PHYS_MCAP, &num, 0) == -1) { 54870209230bSgjelinek zerror(gettext("could not set zone memory cap")); 54880209230bSgjelinek res = Z_ERR; 54890209230bSgjelinek } 54900209230bSgjelinek 54910209230bSgjelinek if (zonecfg_enable_rcapd(smf_err, sizeof (smf_err)) != Z_OK) { 54920209230bSgjelinek zerror(gettext("enabling system/rcap service failed: " 54930209230bSgjelinek "%s"), smf_err); 54940209230bSgjelinek res = Z_ERR; 54950209230bSgjelinek } 54960209230bSgjelinek } 54970209230bSgjelinek 54980209230bSgjelinek zonecfg_fini_handle(handle); 54990209230bSgjelinek 55000209230bSgjelinek return (res); 55010209230bSgjelinek } 55020209230bSgjelinek 5503fbbfbc6eSjv227347 /* 5504fbbfbc6eSjv227347 * This is an undocumented interface that is invoked by the zones SMF service 5505fbbfbc6eSjv227347 * for installed zones that won't automatically boot. 5506fbbfbc6eSjv227347 */ 5507fbbfbc6eSjv227347 /* ARGSUSED */ 5508fbbfbc6eSjv227347 static int 5509fbbfbc6eSjv227347 sysboot_func(int argc, char *argv[]) 5510fbbfbc6eSjv227347 { 5511fbbfbc6eSjv227347 int err; 5512fbbfbc6eSjv227347 zone_dochandle_t zone_handle; 5513fbbfbc6eSjv227347 brand_handle_t brand_handle; 5514fbbfbc6eSjv227347 char cmdbuf[MAXPATHLEN]; 5515fbbfbc6eSjv227347 char zonepath[MAXPATHLEN]; 5516fbbfbc6eSjv227347 5517fbbfbc6eSjv227347 /* 5518fbbfbc6eSjv227347 * This subcommand can only be executed in the global zone on non-global 5519fbbfbc6eSjv227347 * zones. 5520fbbfbc6eSjv227347 */ 5521fbbfbc6eSjv227347 if (zonecfg_in_alt_root()) 5522fbbfbc6eSjv227347 return (usage(B_FALSE)); 5523fbbfbc6eSjv227347 if (sanity_check(target_zone, CMD_SYSBOOT, B_FALSE, B_TRUE, B_FALSE) != 5524fbbfbc6eSjv227347 Z_OK) 5525fbbfbc6eSjv227347 return (Z_ERR); 5526fbbfbc6eSjv227347 5527fbbfbc6eSjv227347 /* 5528fbbfbc6eSjv227347 * Fetch the sysboot hook from the target zone's brand. 5529fbbfbc6eSjv227347 */ 5530fbbfbc6eSjv227347 if ((zone_handle = zonecfg_init_handle()) == NULL) { 5531fbbfbc6eSjv227347 zperror(cmd_to_str(CMD_SYSBOOT), B_TRUE); 5532fbbfbc6eSjv227347 return (Z_ERR); 5533fbbfbc6eSjv227347 } 5534fbbfbc6eSjv227347 if ((err = zonecfg_get_handle(target_zone, zone_handle)) != Z_OK) { 5535fbbfbc6eSjv227347 errno = err; 5536fbbfbc6eSjv227347 zperror(cmd_to_str(CMD_SYSBOOT), B_TRUE); 5537fbbfbc6eSjv227347 zonecfg_fini_handle(zone_handle); 5538fbbfbc6eSjv227347 return (Z_ERR); 5539fbbfbc6eSjv227347 } 5540fbbfbc6eSjv227347 if ((err = zonecfg_get_zonepath(zone_handle, zonepath, 5541fbbfbc6eSjv227347 sizeof (zonepath))) != Z_OK) { 5542fbbfbc6eSjv227347 errno = err; 5543fbbfbc6eSjv227347 zperror(cmd_to_str(CMD_SYSBOOT), B_TRUE); 5544fbbfbc6eSjv227347 zonecfg_fini_handle(zone_handle); 5545fbbfbc6eSjv227347 return (Z_ERR); 5546fbbfbc6eSjv227347 } 5547fbbfbc6eSjv227347 if ((brand_handle = brand_open(target_brand)) == NULL) { 5548fbbfbc6eSjv227347 zerror(gettext("missing or invalid brand during %s operation: " 5549fbbfbc6eSjv227347 "%s"), cmd_to_str(CMD_SYSBOOT), target_brand); 5550fbbfbc6eSjv227347 zonecfg_fini_handle(zone_handle); 5551fbbfbc6eSjv227347 return (Z_ERR); 5552fbbfbc6eSjv227347 } 5553fbbfbc6eSjv227347 err = get_hook(brand_handle, cmdbuf, sizeof (cmdbuf), brand_get_sysboot, 5554fbbfbc6eSjv227347 target_zone, zonepath); 5555fbbfbc6eSjv227347 brand_close(brand_handle); 5556fbbfbc6eSjv227347 zonecfg_fini_handle(zone_handle); 5557fbbfbc6eSjv227347 if (err != Z_OK) { 5558fbbfbc6eSjv227347 zerror(gettext("unable to get brand hook from brand %s for %s " 5559fbbfbc6eSjv227347 "operation"), target_brand, cmd_to_str(CMD_SYSBOOT)); 5560fbbfbc6eSjv227347 return (Z_ERR); 5561fbbfbc6eSjv227347 } 5562fbbfbc6eSjv227347 5563fbbfbc6eSjv227347 /* 5564fbbfbc6eSjv227347 * If the hook wasn't defined (which is OK), then indicate success and 5565fbbfbc6eSjv227347 * return. Otherwise, execute the hook. 5566fbbfbc6eSjv227347 */ 5567fbbfbc6eSjv227347 if (cmdbuf[0] != '\0') 5568fbbfbc6eSjv227347 return ((subproc_status(gettext("brand sysboot operation"), 5569fbbfbc6eSjv227347 do_subproc(cmdbuf), B_FALSE) == ZONE_SUBPROC_OK) ? Z_OK : 5570fbbfbc6eSjv227347 Z_BRAND_ERROR); 5571fbbfbc6eSjv227347 return (Z_OK); 5572fbbfbc6eSjv227347 } 5573fbbfbc6eSjv227347 5574555afedfScarlsonj static int 55757c478bd9Sstevel@tonic-gate help_func(int argc, char *argv[]) 55767c478bd9Sstevel@tonic-gate { 55777c478bd9Sstevel@tonic-gate int arg, cmd_num; 55787c478bd9Sstevel@tonic-gate 55797c478bd9Sstevel@tonic-gate if (argc == 0) { 55807c478bd9Sstevel@tonic-gate (void) usage(B_TRUE); 55817c478bd9Sstevel@tonic-gate return (Z_OK); 55827c478bd9Sstevel@tonic-gate } 55837c478bd9Sstevel@tonic-gate optind = 0; 55847c478bd9Sstevel@tonic-gate if ((arg = getopt(argc, argv, "?")) != EOF) { 55857c478bd9Sstevel@tonic-gate switch (arg) { 55867c478bd9Sstevel@tonic-gate case '?': 55877c478bd9Sstevel@tonic-gate sub_usage(SHELP_HELP, CMD_HELP); 55887c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 55897c478bd9Sstevel@tonic-gate default: 55907c478bd9Sstevel@tonic-gate sub_usage(SHELP_HELP, CMD_HELP); 55917c478bd9Sstevel@tonic-gate return (Z_USAGE); 55927c478bd9Sstevel@tonic-gate } 55937c478bd9Sstevel@tonic-gate } 55947c478bd9Sstevel@tonic-gate while (optind < argc) { 5595394a25e2Scarlsonj /* Private commands have NULL short_usage; omit them */ 5596394a25e2Scarlsonj if ((cmd_num = cmd_match(argv[optind])) < 0 || 5597394a25e2Scarlsonj cmdtab[cmd_num].short_usage == NULL) { 55987c478bd9Sstevel@tonic-gate sub_usage(SHELP_HELP, CMD_HELP); 55997c478bd9Sstevel@tonic-gate return (Z_USAGE); 56007c478bd9Sstevel@tonic-gate } 56017c478bd9Sstevel@tonic-gate sub_usage(cmdtab[cmd_num].short_usage, cmd_num); 56027c478bd9Sstevel@tonic-gate optind++; 56037c478bd9Sstevel@tonic-gate } 56047c478bd9Sstevel@tonic-gate return (Z_OK); 56057c478bd9Sstevel@tonic-gate } 56067c478bd9Sstevel@tonic-gate 56077c478bd9Sstevel@tonic-gate /* 56087c478bd9Sstevel@tonic-gate * Returns: CMD_MIN thru CMD_MAX on success, -1 on error 56097c478bd9Sstevel@tonic-gate */ 56107c478bd9Sstevel@tonic-gate 56117c478bd9Sstevel@tonic-gate static int 56127c478bd9Sstevel@tonic-gate cmd_match(char *cmd) 56137c478bd9Sstevel@tonic-gate { 56147c478bd9Sstevel@tonic-gate int i; 56157c478bd9Sstevel@tonic-gate 56167c478bd9Sstevel@tonic-gate for (i = CMD_MIN; i <= CMD_MAX; i++) { 56177c478bd9Sstevel@tonic-gate /* return only if there is an exact match */ 56187c478bd9Sstevel@tonic-gate if (strcmp(cmd, cmdtab[i].cmd_name) == 0) 56197c478bd9Sstevel@tonic-gate return (cmdtab[i].cmd_num); 56207c478bd9Sstevel@tonic-gate } 56217c478bd9Sstevel@tonic-gate return (-1); 56227c478bd9Sstevel@tonic-gate } 56237c478bd9Sstevel@tonic-gate 56247c478bd9Sstevel@tonic-gate static int 56257c478bd9Sstevel@tonic-gate parse_and_run(int argc, char *argv[]) 56267c478bd9Sstevel@tonic-gate { 56277c478bd9Sstevel@tonic-gate int i = cmd_match(argv[0]); 56287c478bd9Sstevel@tonic-gate 56297c478bd9Sstevel@tonic-gate if (i < 0) 56307c478bd9Sstevel@tonic-gate return (usage(B_FALSE)); 56317c478bd9Sstevel@tonic-gate return (cmdtab[i].handler(argc - 1, &(argv[1]))); 56327c478bd9Sstevel@tonic-gate } 56337c478bd9Sstevel@tonic-gate 56347c478bd9Sstevel@tonic-gate static char * 56357c478bd9Sstevel@tonic-gate get_execbasename(char *execfullname) 56367c478bd9Sstevel@tonic-gate { 56377c478bd9Sstevel@tonic-gate char *last_slash, *execbasename; 56387c478bd9Sstevel@tonic-gate 56397c478bd9Sstevel@tonic-gate /* guard against '/' at end of command invocation */ 56407c478bd9Sstevel@tonic-gate for (;;) { 56417c478bd9Sstevel@tonic-gate last_slash = strrchr(execfullname, '/'); 56427c478bd9Sstevel@tonic-gate if (last_slash == NULL) { 56437c478bd9Sstevel@tonic-gate execbasename = execfullname; 56447c478bd9Sstevel@tonic-gate break; 56457c478bd9Sstevel@tonic-gate } else { 56467c478bd9Sstevel@tonic-gate execbasename = last_slash + 1; 56477c478bd9Sstevel@tonic-gate if (*execbasename == '\0') { 56487c478bd9Sstevel@tonic-gate *last_slash = '\0'; 56497c478bd9Sstevel@tonic-gate continue; 56507c478bd9Sstevel@tonic-gate } 56517c478bd9Sstevel@tonic-gate break; 56527c478bd9Sstevel@tonic-gate } 56537c478bd9Sstevel@tonic-gate } 56547c478bd9Sstevel@tonic-gate return (execbasename); 56557c478bd9Sstevel@tonic-gate } 56567c478bd9Sstevel@tonic-gate 5657cb8a054bSGlenn Faden static char * 5658cb8a054bSGlenn Faden get_username() 5659cb8a054bSGlenn Faden { 5660cb8a054bSGlenn Faden uid_t uid; 5661cb8a054bSGlenn Faden struct passwd *nptr; 5662cb8a054bSGlenn Faden 5663cb8a054bSGlenn Faden 5664cb8a054bSGlenn Faden /* 5665cb8a054bSGlenn Faden * Authorizations are checked to restrict access based on the 5666cb8a054bSGlenn Faden * requested operation and zone name, It is assumed that the 5667cb8a054bSGlenn Faden * program is running with all privileges, but that the real 5668cb8a054bSGlenn Faden * user ID is that of the user or role on whose behalf we are 5669cb8a054bSGlenn Faden * operating. So we start by getting the username that will be 5670cb8a054bSGlenn Faden * used for subsequent authorization checks. 5671cb8a054bSGlenn Faden */ 5672cb8a054bSGlenn Faden 5673cb8a054bSGlenn Faden uid = getuid(); 5674cb8a054bSGlenn Faden if ((nptr = getpwuid(uid)) == NULL) { 5675cb8a054bSGlenn Faden zerror(gettext("could not get user name.")); 5676cb8a054bSGlenn Faden exit(Z_ERR); 5677cb8a054bSGlenn Faden } 5678cb8a054bSGlenn Faden return (nptr->pw_name); 5679cb8a054bSGlenn Faden } 5680cb8a054bSGlenn Faden 56817c478bd9Sstevel@tonic-gate int 56827c478bd9Sstevel@tonic-gate main(int argc, char **argv) 56837c478bd9Sstevel@tonic-gate { 56847c478bd9Sstevel@tonic-gate int arg; 56857c478bd9Sstevel@tonic-gate zoneid_t zid; 5686108322fbScarlsonj struct stat st; 56879acbbeafSnn35248 char *zone_lock_env; 56889acbbeafSnn35248 int err; 56897c478bd9Sstevel@tonic-gate 56907c478bd9Sstevel@tonic-gate if ((locale = setlocale(LC_ALL, "")) == NULL) 56917c478bd9Sstevel@tonic-gate locale = "C"; 56927c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 56937c478bd9Sstevel@tonic-gate setbuf(stdout, NULL); 56947c478bd9Sstevel@tonic-gate (void) sigset(SIGHUP, SIG_IGN); 56957c478bd9Sstevel@tonic-gate execname = get_execbasename(argv[0]); 5696cb8a054bSGlenn Faden username = get_username(); 56977c478bd9Sstevel@tonic-gate target_zone = NULL; 56987c478bd9Sstevel@tonic-gate if (chdir("/") != 0) { 56997c478bd9Sstevel@tonic-gate zerror(gettext("could not change directory to /.")); 57007c478bd9Sstevel@tonic-gate exit(Z_ERR); 57017c478bd9Sstevel@tonic-gate } 5702cb8a054bSGlenn Faden 5703d0e4f536SSudheer A /* 5704d0e4f536SSudheer A * Use the default system mask rather than anything that may have been 5705d0e4f536SSudheer A * set by the caller. 5706d0e4f536SSudheer A */ 5707d0e4f536SSudheer A (void) umask(CMASK); 57087c478bd9Sstevel@tonic-gate 570999653d4eSeschrock if (init_zfs() != Z_OK) 571099653d4eSeschrock exit(Z_ERR); 571199653d4eSeschrock 5712555afedfScarlsonj while ((arg = getopt(argc, argv, "?u:z:R:")) != EOF) { 57137c478bd9Sstevel@tonic-gate switch (arg) { 57147c478bd9Sstevel@tonic-gate case '?': 57157c478bd9Sstevel@tonic-gate return (usage(B_TRUE)); 5716555afedfScarlsonj case 'u': 5717555afedfScarlsonj target_uuid = optarg; 5718555afedfScarlsonj break; 57197c478bd9Sstevel@tonic-gate case 'z': 57207c478bd9Sstevel@tonic-gate target_zone = optarg; 57217c478bd9Sstevel@tonic-gate break; 5722108322fbScarlsonj case 'R': /* private option for admin/install use */ 5723108322fbScarlsonj if (*optarg != '/') { 5724108322fbScarlsonj zerror(gettext("root path must be absolute.")); 5725108322fbScarlsonj exit(Z_ERR); 5726108322fbScarlsonj } 5727108322fbScarlsonj if (stat(optarg, &st) == -1 || !S_ISDIR(st.st_mode)) { 5728108322fbScarlsonj zerror( 5729108322fbScarlsonj gettext("root path must be a directory.")); 5730108322fbScarlsonj exit(Z_ERR); 5731108322fbScarlsonj } 5732108322fbScarlsonj zonecfg_set_root(optarg); 5733108322fbScarlsonj break; 57347c478bd9Sstevel@tonic-gate default: 57357c478bd9Sstevel@tonic-gate return (usage(B_FALSE)); 57367c478bd9Sstevel@tonic-gate } 57377c478bd9Sstevel@tonic-gate } 57387c478bd9Sstevel@tonic-gate 57397c478bd9Sstevel@tonic-gate if (optind >= argc) 57407c478bd9Sstevel@tonic-gate return (usage(B_FALSE)); 5741555afedfScarlsonj 5742555afedfScarlsonj if (target_uuid != NULL && *target_uuid != '\0') { 5743555afedfScarlsonj uuid_t uuid; 5744555afedfScarlsonj static char newtarget[ZONENAME_MAX]; 5745555afedfScarlsonj 5746555afedfScarlsonj if (uuid_parse(target_uuid, uuid) == -1) { 5747555afedfScarlsonj zerror(gettext("illegal UUID value specified")); 5748555afedfScarlsonj exit(Z_ERR); 5749555afedfScarlsonj } 5750555afedfScarlsonj if (zonecfg_get_name_by_uuid(uuid, newtarget, 5751555afedfScarlsonj sizeof (newtarget)) == Z_OK) 5752555afedfScarlsonj target_zone = newtarget; 5753555afedfScarlsonj } 5754555afedfScarlsonj 57557c478bd9Sstevel@tonic-gate if (target_zone != NULL && zone_get_id(target_zone, &zid) != 0) { 57567c478bd9Sstevel@tonic-gate errno = Z_NO_ZONE; 57577c478bd9Sstevel@tonic-gate zperror(target_zone, B_TRUE); 57587c478bd9Sstevel@tonic-gate exit(Z_ERR); 57597c478bd9Sstevel@tonic-gate } 57609acbbeafSnn35248 57619acbbeafSnn35248 /* 57629acbbeafSnn35248 * See if we have inherited the right to manipulate this zone from 57639acbbeafSnn35248 * a zoneadm instance in our ancestry. If so, set zone_lock_cnt to 57649acbbeafSnn35248 * indicate it. If not, make that explicit in our environment. 57659acbbeafSnn35248 */ 5766ff17c8bfSgjelinek zonecfg_init_lock_file(target_zone, &zone_lock_env); 57679acbbeafSnn35248 5768e5816e35SEdward Pilatowicz /* Figure out what the system's default brand is */ 5769e5816e35SEdward Pilatowicz if (zonecfg_default_brand(default_brand, 5770e5816e35SEdward Pilatowicz sizeof (default_brand)) != Z_OK) { 5771e5816e35SEdward Pilatowicz zerror(gettext("unable to determine default brand")); 5772e5816e35SEdward Pilatowicz return (Z_ERR); 5773e5816e35SEdward Pilatowicz } 5774e5816e35SEdward Pilatowicz 57759acbbeafSnn35248 /* 57769acbbeafSnn35248 * If we are going to be operating on a single zone, retrieve its 57779acbbeafSnn35248 * brand type and determine whether it is native or not. 57789acbbeafSnn35248 */ 57799acbbeafSnn35248 if ((target_zone != NULL) && 57802ad45a84Sjv227347 (strcmp(target_zone, GLOBAL_ZONENAME) != 0)) { 57819acbbeafSnn35248 if (zone_get_brand(target_zone, target_brand, 57829acbbeafSnn35248 sizeof (target_brand)) != Z_OK) { 57839acbbeafSnn35248 zerror(gettext("missing or invalid brand")); 57849acbbeafSnn35248 exit(Z_ERR); 57859acbbeafSnn35248 } 578662868012SSteve Lawrence /* 578762868012SSteve Lawrence * In the alternate root environment, the only supported 578862868012SSteve Lawrence * operations are mount and unmount. In this case, just treat 578962868012SSteve Lawrence * the zone as native if it is cluster. Cluster zones can be 579062868012SSteve Lawrence * native for the purpose of LU or upgrade, and the cluster 579162868012SSteve Lawrence * brand may not exist in the miniroot (such as in net install 579262868012SSteve Lawrence * upgrade). 579362868012SSteve Lawrence */ 579462868012SSteve Lawrence if (strcmp(target_brand, CLUSTER_BRAND_NAME) == 0) { 579562868012SSteve Lawrence if (zonecfg_in_alt_root()) { 5796e5816e35SEdward Pilatowicz (void) strlcpy(target_brand, default_brand, 579762868012SSteve Lawrence sizeof (target_brand)); 579862868012SSteve Lawrence } 579962868012SSteve Lawrence } 58009acbbeafSnn35248 } 58019acbbeafSnn35248 58029acbbeafSnn35248 err = parse_and_run(argc - optind, &argv[optind]); 58039acbbeafSnn35248 58049acbbeafSnn35248 return (err); 58057c478bd9Sstevel@tonic-gate } 5806