17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5ee519a1fSgjelinek * Common Development and Distribution License (the "License"). 6ee519a1fSgjelinek * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217e362f58Scomay 227c478bd9Sstevel@tonic-gate /* 237ef01d19Sgjelinek * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 247c478bd9Sstevel@tonic-gate * Use is subject to license terms. 257c478bd9Sstevel@tonic-gate */ 267c478bd9Sstevel@tonic-gate 277c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 287c478bd9Sstevel@tonic-gate 297c478bd9Sstevel@tonic-gate /* 307c478bd9Sstevel@tonic-gate * zoneadm is a command interpreter for zone administration. It is all in 317c478bd9Sstevel@tonic-gate * C (i.e., no lex/yacc), and all the argument passing is argc/argv based. 327c478bd9Sstevel@tonic-gate * main() calls parse_and_run() which calls cmd_match(), then invokes the 337c478bd9Sstevel@tonic-gate * appropriate command's handler function. The rest of the program is the 347c478bd9Sstevel@tonic-gate * handler functions and their helper functions. 357c478bd9Sstevel@tonic-gate * 367c478bd9Sstevel@tonic-gate * Some of the helper functions are used largely to simplify I18N: reducing 377c478bd9Sstevel@tonic-gate * the need for translation notes. This is particularly true of many of 387c478bd9Sstevel@tonic-gate * the zerror() calls: doing e.g. zerror(gettext("%s failed"), "foo") rather 397c478bd9Sstevel@tonic-gate * than zerror(gettext("foo failed")) with a translation note indicating 407c478bd9Sstevel@tonic-gate * that "foo" need not be translated. 417c478bd9Sstevel@tonic-gate */ 427c478bd9Sstevel@tonic-gate 437c478bd9Sstevel@tonic-gate #include <stdio.h> 447c478bd9Sstevel@tonic-gate #include <errno.h> 457c478bd9Sstevel@tonic-gate #include <unistd.h> 467c478bd9Sstevel@tonic-gate #include <signal.h> 477c478bd9Sstevel@tonic-gate #include <stdarg.h> 487c478bd9Sstevel@tonic-gate #include <ctype.h> 497c478bd9Sstevel@tonic-gate #include <stdlib.h> 507c478bd9Sstevel@tonic-gate #include <string.h> 517c478bd9Sstevel@tonic-gate #include <wait.h> 527c478bd9Sstevel@tonic-gate #include <zone.h> 537c478bd9Sstevel@tonic-gate #include <priv.h> 547c478bd9Sstevel@tonic-gate #include <locale.h> 557c478bd9Sstevel@tonic-gate #include <libintl.h> 567c478bd9Sstevel@tonic-gate #include <libzonecfg.h> 577c478bd9Sstevel@tonic-gate #include <bsm/adt.h> 589acbbeafSnn35248 #include <sys/brand.h> 597c478bd9Sstevel@tonic-gate #include <sys/param.h> 607c478bd9Sstevel@tonic-gate #include <sys/types.h> 617c478bd9Sstevel@tonic-gate #include <sys/stat.h> 627c478bd9Sstevel@tonic-gate #include <sys/statvfs.h> 637c478bd9Sstevel@tonic-gate #include <assert.h> 647c478bd9Sstevel@tonic-gate #include <sys/sockio.h> 657c478bd9Sstevel@tonic-gate #include <sys/mntent.h> 667c478bd9Sstevel@tonic-gate #include <limits.h> 670b5de56dSgjelinek #include <dirent.h> 68555afedfScarlsonj #include <uuid/uuid.h> 697c478bd9Sstevel@tonic-gate 707c478bd9Sstevel@tonic-gate #include <fcntl.h> 717c478bd9Sstevel@tonic-gate #include <door.h> 727c478bd9Sstevel@tonic-gate #include <macros.h> 737c478bd9Sstevel@tonic-gate #include <libgen.h> 74865e09a4Sgjelinek #include <fnmatch.h> 75e7f3c547Sgjelinek #include <sys/modctl.h> 769acbbeafSnn35248 #include <libbrand.h> 770209230bSgjelinek #include <libscf.h> 787ef01d19Sgjelinek #include <procfs.h> 79d9e728a2Sgjelinek #include <strings.h> 807c478bd9Sstevel@tonic-gate 817c478bd9Sstevel@tonic-gate #include <pool.h> 827c478bd9Sstevel@tonic-gate #include <sys/pool.h> 830209230bSgjelinek #include <sys/priocntl.h> 840209230bSgjelinek #include <sys/fsspriocntl.h> 857c478bd9Sstevel@tonic-gate 860b5de56dSgjelinek #include "zoneadm.h" 870b5de56dSgjelinek 887c478bd9Sstevel@tonic-gate #define MAXARGS 8 897c478bd9Sstevel@tonic-gate 907c478bd9Sstevel@tonic-gate /* Reflects kernel zone entries */ 917c478bd9Sstevel@tonic-gate typedef struct zone_entry { 927c478bd9Sstevel@tonic-gate zoneid_t zid; 937c478bd9Sstevel@tonic-gate char zname[ZONENAME_MAX]; 947c478bd9Sstevel@tonic-gate char *zstate_str; 957c478bd9Sstevel@tonic-gate zone_state_t zstate_num; 969acbbeafSnn35248 char zbrand[MAXNAMELEN]; 977c478bd9Sstevel@tonic-gate char zroot[MAXPATHLEN]; 98555afedfScarlsonj char zuuid[UUID_PRINTABLE_STRING_LENGTH]; 99f4b3ec61Sdh155122 zone_iptype_t ziptype; 1007c478bd9Sstevel@tonic-gate } zone_entry_t; 1017c478bd9Sstevel@tonic-gate 102*84561e8cStd153743 #define CLUSTER_BRAND_NAME "cluster" 103*84561e8cStd153743 1047c478bd9Sstevel@tonic-gate static zone_entry_t *zents; 1057c478bd9Sstevel@tonic-gate static size_t nzents; 1069acbbeafSnn35248 static boolean_t is_native_zone = B_TRUE; 107*84561e8cStd153743 static boolean_t is_cluster_zone = B_FALSE; 1087c478bd9Sstevel@tonic-gate 1091390a385Sgjelinek #define LOOPBACK_IF "lo0" 1101390a385Sgjelinek #define SOCKET_AF(af) (((af) == AF_UNSPEC) ? AF_INET : (af)) 1111390a385Sgjelinek 1121390a385Sgjelinek struct net_if { 1131390a385Sgjelinek char *name; 1141390a385Sgjelinek int af; 1151390a385Sgjelinek }; 1161390a385Sgjelinek 1177c478bd9Sstevel@tonic-gate /* 0755 is the default directory mode. */ 1187c478bd9Sstevel@tonic-gate #define DEFAULT_DIR_MODE \ 1197c478bd9Sstevel@tonic-gate (S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH) 1207c478bd9Sstevel@tonic-gate 1217c478bd9Sstevel@tonic-gate struct cmd { 1227c478bd9Sstevel@tonic-gate uint_t cmd_num; /* command number */ 1237c478bd9Sstevel@tonic-gate char *cmd_name; /* command name */ 1247c478bd9Sstevel@tonic-gate char *short_usage; /* short form help */ 1257c478bd9Sstevel@tonic-gate int (*handler)(int argc, char *argv[]); /* function to call */ 1267c478bd9Sstevel@tonic-gate 1277c478bd9Sstevel@tonic-gate }; 1287c478bd9Sstevel@tonic-gate 1297c478bd9Sstevel@tonic-gate #define SHELP_HELP "help" 1303f2f09c1Sdp #define SHELP_BOOT "boot [-- boot_arguments]" 1317c478bd9Sstevel@tonic-gate #define SHELP_HALT "halt" 1327c478bd9Sstevel@tonic-gate #define SHELP_READY "ready" 1333f2f09c1Sdp #define SHELP_REBOOT "reboot [-- boot_arguments]" 1347c478bd9Sstevel@tonic-gate #define SHELP_LIST "list [-cipv]" 1357c478bd9Sstevel@tonic-gate #define SHELP_VERIFY "verify" 1369acbbeafSnn35248 #define SHELP_INSTALL "install [-x nodataset] [brand-specific args]" 1377c478bd9Sstevel@tonic-gate #define SHELP_UNINSTALL "uninstall [-F]" 1380b5de56dSgjelinek #define SHELP_CLONE "clone [-m method] [-s <ZFS snapshot>] zonename" 139865e09a4Sgjelinek #define SHELP_MOVE "move zonepath" 1408cd327d5Sgjelinek #define SHELP_DETACH "detach [-n]" 1418cd327d5Sgjelinek #define SHELP_ATTACH "attach [-F] [-n <path>]" 142555afedfScarlsonj #define SHELP_MARK "mark incomplete" 1437c478bd9Sstevel@tonic-gate 1449acbbeafSnn35248 #define EXEC_PREFIX "exec " 1459acbbeafSnn35248 #define EXEC_LEN (strlen(EXEC_PREFIX)) 1469acbbeafSnn35248 #define RMCOMMAND "/usr/bin/rm -rf" 1479acbbeafSnn35248 1489acbbeafSnn35248 static int cleanup_zonepath(char *, boolean_t); 1499acbbeafSnn35248 150f4b3ec61Sdh155122 extern int ifname_open(char *); 151f4b3ec61Sdh155122 1527c478bd9Sstevel@tonic-gate static int help_func(int argc, char *argv[]); 1537c478bd9Sstevel@tonic-gate static int ready_func(int argc, char *argv[]); 1547c478bd9Sstevel@tonic-gate static int boot_func(int argc, char *argv[]); 1557c478bd9Sstevel@tonic-gate static int halt_func(int argc, char *argv[]); 1567c478bd9Sstevel@tonic-gate static int reboot_func(int argc, char *argv[]); 1577c478bd9Sstevel@tonic-gate static int list_func(int argc, char *argv[]); 1587c478bd9Sstevel@tonic-gate static int verify_func(int argc, char *argv[]); 1597c478bd9Sstevel@tonic-gate static int install_func(int argc, char *argv[]); 1607c478bd9Sstevel@tonic-gate static int uninstall_func(int argc, char *argv[]); 161108322fbScarlsonj static int mount_func(int argc, char *argv[]); 162108322fbScarlsonj static int unmount_func(int argc, char *argv[]); 163865e09a4Sgjelinek static int clone_func(int argc, char *argv[]); 164865e09a4Sgjelinek static int move_func(int argc, char *argv[]); 165ee519a1fSgjelinek static int detach_func(int argc, char *argv[]); 166ee519a1fSgjelinek static int attach_func(int argc, char *argv[]); 167555afedfScarlsonj static int mark_func(int argc, char *argv[]); 1680209230bSgjelinek static int apply_func(int argc, char *argv[]); 1697c478bd9Sstevel@tonic-gate static int sanity_check(char *zone, int cmd_num, boolean_t running, 1709acbbeafSnn35248 boolean_t unsafe_when_running, boolean_t force); 1717c478bd9Sstevel@tonic-gate static int cmd_match(char *cmd); 172ce28b40eSzt129084 static int verify_details(int, char *argv[]); 173ce28b40eSzt129084 static int verify_brand(zone_dochandle_t, int, char *argv[]); 174ce28b40eSzt129084 static int invoke_brand_handler(int, char *argv[]); 1757c478bd9Sstevel@tonic-gate 1767c478bd9Sstevel@tonic-gate static struct cmd cmdtab[] = { 1777c478bd9Sstevel@tonic-gate { CMD_HELP, "help", SHELP_HELP, help_func }, 1787c478bd9Sstevel@tonic-gate { CMD_BOOT, "boot", SHELP_BOOT, boot_func }, 1797c478bd9Sstevel@tonic-gate { CMD_HALT, "halt", SHELP_HALT, halt_func }, 1807c478bd9Sstevel@tonic-gate { CMD_READY, "ready", SHELP_READY, ready_func }, 1817c478bd9Sstevel@tonic-gate { CMD_REBOOT, "reboot", SHELP_REBOOT, reboot_func }, 1827c478bd9Sstevel@tonic-gate { CMD_LIST, "list", SHELP_LIST, list_func }, 1837c478bd9Sstevel@tonic-gate { CMD_VERIFY, "verify", SHELP_VERIFY, verify_func }, 1847c478bd9Sstevel@tonic-gate { CMD_INSTALL, "install", SHELP_INSTALL, install_func }, 1857c478bd9Sstevel@tonic-gate { CMD_UNINSTALL, "uninstall", SHELP_UNINSTALL, 186108322fbScarlsonj uninstall_func }, 187865e09a4Sgjelinek /* mount and unmount are private commands for admin/install */ 188108322fbScarlsonj { CMD_MOUNT, "mount", NULL, mount_func }, 189865e09a4Sgjelinek { CMD_UNMOUNT, "unmount", NULL, unmount_func }, 190865e09a4Sgjelinek { CMD_CLONE, "clone", SHELP_CLONE, clone_func }, 191ee519a1fSgjelinek { CMD_MOVE, "move", SHELP_MOVE, move_func }, 192ee519a1fSgjelinek { CMD_DETACH, "detach", SHELP_DETACH, detach_func }, 193555afedfScarlsonj { CMD_ATTACH, "attach", SHELP_ATTACH, attach_func }, 1940209230bSgjelinek { CMD_MARK, "mark", SHELP_MARK, mark_func }, 1950209230bSgjelinek { CMD_APPLY, "apply", NULL, apply_func } 1967c478bd9Sstevel@tonic-gate }; 1977c478bd9Sstevel@tonic-gate 1987c478bd9Sstevel@tonic-gate /* global variables */ 1997c478bd9Sstevel@tonic-gate 2007c478bd9Sstevel@tonic-gate /* set early in main(), never modified thereafter, used all over the place */ 2017c478bd9Sstevel@tonic-gate static char *execname; 2029acbbeafSnn35248 static char target_brand[MAXNAMELEN]; 2037c478bd9Sstevel@tonic-gate static char *locale; 2040b5de56dSgjelinek char *target_zone; 205555afedfScarlsonj static char *target_uuid; 2067c478bd9Sstevel@tonic-gate 2077c478bd9Sstevel@tonic-gate /* used in do_subproc() and signal handler */ 2087c478bd9Sstevel@tonic-gate static volatile boolean_t child_killed; 2099acbbeafSnn35248 static int do_subproc_cnt = 0; 2109acbbeafSnn35248 2119acbbeafSnn35248 /* 2129acbbeafSnn35248 * Used to indicate whether this zoneadm instance has another zoneadm 2139acbbeafSnn35248 * instance in its ancestry. 2149acbbeafSnn35248 */ 2159acbbeafSnn35248 static boolean_t zoneadm_is_nested = B_FALSE; 2169acbbeafSnn35248 2179acbbeafSnn35248 /* used to track nested zone-lock operations */ 2189acbbeafSnn35248 static int zone_lock_cnt = 0; 2199acbbeafSnn35248 2209acbbeafSnn35248 /* used to communicate lock status to children */ 2219acbbeafSnn35248 #define LOCK_ENV_VAR "_ZONEADM_LOCK_HELD" 2229acbbeafSnn35248 static char zoneadm_lock_held[] = LOCK_ENV_VAR"=1"; 2239acbbeafSnn35248 static char zoneadm_lock_not_held[] = LOCK_ENV_VAR"=0"; 2247c478bd9Sstevel@tonic-gate 2250b5de56dSgjelinek char * 2267c478bd9Sstevel@tonic-gate cmd_to_str(int cmd_num) 2277c478bd9Sstevel@tonic-gate { 2287c478bd9Sstevel@tonic-gate assert(cmd_num >= CMD_MIN && cmd_num <= CMD_MAX); 2297c478bd9Sstevel@tonic-gate return (cmdtab[cmd_num].cmd_name); 2307c478bd9Sstevel@tonic-gate } 2317c478bd9Sstevel@tonic-gate 2327c478bd9Sstevel@tonic-gate /* This is a separate function because of gettext() wrapping. */ 2337c478bd9Sstevel@tonic-gate static char * 2347c478bd9Sstevel@tonic-gate long_help(int cmd_num) 2357c478bd9Sstevel@tonic-gate { 2367e362f58Scomay assert(cmd_num >= CMD_MIN && cmd_num <= CMD_MAX); 2377c478bd9Sstevel@tonic-gate switch (cmd_num) { 2387c478bd9Sstevel@tonic-gate case CMD_HELP: 2397c478bd9Sstevel@tonic-gate return (gettext("Print usage message.")); 2407c478bd9Sstevel@tonic-gate case CMD_BOOT: 2413f2f09c1Sdp return (gettext("Activates (boots) specified zone. See " 2423f2f09c1Sdp "zoneadm(1m) for valid boot\n\targuments.")); 2437c478bd9Sstevel@tonic-gate case CMD_HALT: 2449e518655Sgjelinek return (gettext("Halts specified zone, bypassing shutdown " 2459e518655Sgjelinek "scripts and removing runtime\n\tresources of the zone.")); 2467c478bd9Sstevel@tonic-gate case CMD_READY: 2479e518655Sgjelinek return (gettext("Prepares a zone for running applications but " 2489e518655Sgjelinek "does not start any user\n\tprocesses in the zone.")); 2497c478bd9Sstevel@tonic-gate case CMD_REBOOT: 2509e518655Sgjelinek return (gettext("Restarts the zone (equivalent to a halt / " 2513f2f09c1Sdp "boot sequence).\n\tFails if the zone is not active. " 2523f2f09c1Sdp "See zoneadm(1m) for valid boot\n\targuments.")); 2537c478bd9Sstevel@tonic-gate case CMD_LIST: 2547c478bd9Sstevel@tonic-gate return (gettext("Lists the current zones, or a " 2557c478bd9Sstevel@tonic-gate "specific zone if indicated. By default,\n\tall " 2567c478bd9Sstevel@tonic-gate "running zones are listed, though this can be " 2577c478bd9Sstevel@tonic-gate "expanded to all\n\tinstalled zones with the -i " 2587c478bd9Sstevel@tonic-gate "option or all configured zones with the\n\t-c " 259555afedfScarlsonj "option. When used with the general -z <zone> and/or -u " 260555afedfScarlsonj "<uuid-match>\n\toptions, lists only the specified " 261555afedfScarlsonj "matching zone, but lists it\n\tregardless of its state, " 262555afedfScarlsonj "and the -i and -c options are disallowed. The\n\t-v " 263555afedfScarlsonj "option can be used to display verbose information: zone " 264555afedfScarlsonj "name, id,\n\tcurrent state, root directory and options. " 265555afedfScarlsonj "The -p option can be used\n\tto request machine-parsable " 266555afedfScarlsonj "output. The -v and -p options are mutually\n\texclusive." 267555afedfScarlsonj " If neither -v nor -p is used, just the zone name is " 268555afedfScarlsonj "listed.")); 2697c478bd9Sstevel@tonic-gate case CMD_VERIFY: 2707c478bd9Sstevel@tonic-gate return (gettext("Check to make sure the configuration " 2717c478bd9Sstevel@tonic-gate "can safely be instantiated\n\ton the machine: " 2727c478bd9Sstevel@tonic-gate "physical network interfaces exist, etc.")); 2737c478bd9Sstevel@tonic-gate case CMD_INSTALL: 2740b5de56dSgjelinek return (gettext("Install the configuration on to the system. " 2750b5de56dSgjelinek "The -x nodataset option\n\tcan be used to prevent the " 2760b5de56dSgjelinek "creation of a new ZFS file system for the\n\tzone " 2779acbbeafSnn35248 "(assuming the zonepath is within a ZFS file system).\n\t" 2789acbbeafSnn35248 "All other arguments are passed to the brand installation " 2799acbbeafSnn35248 "function;\n\tsee brand(4) for more information.")); 2807c478bd9Sstevel@tonic-gate case CMD_UNINSTALL: 2819e518655Sgjelinek return (gettext("Uninstall the configuration from the system. " 2829e518655Sgjelinek "The -F flag can be used\n\tto force the action.")); 283865e09a4Sgjelinek case CMD_CLONE: 2840b5de56dSgjelinek return (gettext("Clone the installation of another zone. " 2850b5de56dSgjelinek "The -m option can be used to\n\tspecify 'copy' which " 2860b5de56dSgjelinek "forces a copy of the source zone. The -s option\n\t" 2870b5de56dSgjelinek "can be used to specify the name of a ZFS snapshot " 2880b5de56dSgjelinek "that was taken from\n\ta previous clone command. The " 2890b5de56dSgjelinek "snapshot will be used as the source\n\tinstead of " 2900b5de56dSgjelinek "creating a new ZFS snapshot.")); 291865e09a4Sgjelinek case CMD_MOVE: 292865e09a4Sgjelinek return (gettext("Move the zone to a new zonepath.")); 2939e518655Sgjelinek case CMD_DETACH: 2949e518655Sgjelinek return (gettext("Detach the zone from the system. The zone " 2959e518655Sgjelinek "state is changed to\n\t'configured' (but the files under " 2969e518655Sgjelinek "the zonepath are untouched).\n\tThe zone can subsequently " 2979e518655Sgjelinek "be attached, or can be moved to another\n\tsystem and " 2988cd327d5Sgjelinek "attached there. The -n option can be used to specify\n\t" 2998cd327d5Sgjelinek "'no-execute' mode. When -n is used, the information " 3008cd327d5Sgjelinek "needed to attach\n\tthe zone is sent to standard output " 3018cd327d5Sgjelinek "but the zone is not actually\n\tdetached.")); 3029e518655Sgjelinek case CMD_ATTACH: 3039e518655Sgjelinek return (gettext("Attach the zone to the system. The zone " 3049e518655Sgjelinek "state must be 'configured'\n\tprior to attach; upon " 3059e518655Sgjelinek "successful completion, the zone state will be\n\t" 3069e518655Sgjelinek "'installed'. The system software on the current " 3079e518655Sgjelinek "system must be\n\tcompatible with the software on the " 3089e518655Sgjelinek "zone's original system.\n\tSpecify -F to force the attach " 3098cd327d5Sgjelinek "and skip software compatibility tests.\n\tThe -n option " 3108cd327d5Sgjelinek "can be used to specify 'no-execute' mode. When -n is\n\t" 3118cd327d5Sgjelinek "used, the information needed to attach the zone is read " 3128cd327d5Sgjelinek "from the\n\tspecified path and the configuration is only " 3138cd327d5Sgjelinek "validated. The path can\n\tbe '-' to specify standard " 3148cd327d5Sgjelinek "input.")); 315555afedfScarlsonj case CMD_MARK: 316555afedfScarlsonj return (gettext("Set the state of the zone. This can be used " 317555afedfScarlsonj "to force the zone\n\tstate to 'incomplete' " 318555afedfScarlsonj "administratively if some activity has rendered\n\tthe " 319555afedfScarlsonj "zone permanently unusable. The only valid state that " 320555afedfScarlsonj "may be\n\tspecified is 'incomplete'.")); 321108322fbScarlsonj default: 322108322fbScarlsonj return (""); 3237c478bd9Sstevel@tonic-gate } 3247c478bd9Sstevel@tonic-gate /* NOTREACHED */ 3257e362f58Scomay return (NULL); 3267c478bd9Sstevel@tonic-gate } 3277c478bd9Sstevel@tonic-gate 3287c478bd9Sstevel@tonic-gate /* 3297c478bd9Sstevel@tonic-gate * Called with explicit B_TRUE when help is explicitly requested, B_FALSE for 3307c478bd9Sstevel@tonic-gate * unexpected errors. 3317c478bd9Sstevel@tonic-gate */ 3327c478bd9Sstevel@tonic-gate 3337c478bd9Sstevel@tonic-gate static int 3347c478bd9Sstevel@tonic-gate usage(boolean_t explicit) 3357c478bd9Sstevel@tonic-gate { 3367c478bd9Sstevel@tonic-gate int i; 3377c478bd9Sstevel@tonic-gate FILE *fd = explicit ? stdout : stderr; 3387c478bd9Sstevel@tonic-gate 3397c478bd9Sstevel@tonic-gate (void) fprintf(fd, "%s:\t%s help\n", gettext("usage"), execname); 340555afedfScarlsonj (void) fprintf(fd, "\t%s [-z <zone>] [-u <uuid-match>] list\n", 341555afedfScarlsonj execname); 342555afedfScarlsonj (void) fprintf(fd, "\t%s {-z <zone>|-u <uuid-match>} <%s>\n", execname, 3437c478bd9Sstevel@tonic-gate gettext("subcommand")); 3447c478bd9Sstevel@tonic-gate (void) fprintf(fd, "\n%s:\n\n", gettext("Subcommands")); 3457c478bd9Sstevel@tonic-gate for (i = CMD_MIN; i <= CMD_MAX; i++) { 346108322fbScarlsonj if (cmdtab[i].short_usage == NULL) 347108322fbScarlsonj continue; 3487c478bd9Sstevel@tonic-gate (void) fprintf(fd, "%s\n", cmdtab[i].short_usage); 3497c478bd9Sstevel@tonic-gate if (explicit) 3507c478bd9Sstevel@tonic-gate (void) fprintf(fd, "\t%s\n\n", long_help(i)); 3517c478bd9Sstevel@tonic-gate } 3527c478bd9Sstevel@tonic-gate if (!explicit) 3537c478bd9Sstevel@tonic-gate (void) fputs("\n", fd); 3547c478bd9Sstevel@tonic-gate return (Z_USAGE); 3557c478bd9Sstevel@tonic-gate } 3567c478bd9Sstevel@tonic-gate 3577c478bd9Sstevel@tonic-gate static void 3587c478bd9Sstevel@tonic-gate sub_usage(char *short_usage, int cmd_num) 3597c478bd9Sstevel@tonic-gate { 3607c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "%s:\t%s\n", gettext("usage"), short_usage); 3617c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "\t%s\n", long_help(cmd_num)); 3627c478bd9Sstevel@tonic-gate } 3637c478bd9Sstevel@tonic-gate 3647c478bd9Sstevel@tonic-gate /* 3657c478bd9Sstevel@tonic-gate * zperror() is like perror(3c) except that this also prints the executable 3667c478bd9Sstevel@tonic-gate * name at the start of the message, and takes a boolean indicating whether 3677c478bd9Sstevel@tonic-gate * to call libc'c strerror() or that from libzonecfg. 3687c478bd9Sstevel@tonic-gate */ 3697c478bd9Sstevel@tonic-gate 3700b5de56dSgjelinek void 3717c478bd9Sstevel@tonic-gate zperror(const char *str, boolean_t zonecfg_error) 3727c478bd9Sstevel@tonic-gate { 3737c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "%s: %s: %s\n", execname, str, 3747c478bd9Sstevel@tonic-gate zonecfg_error ? zonecfg_strerror(errno) : strerror(errno)); 3757c478bd9Sstevel@tonic-gate } 3767c478bd9Sstevel@tonic-gate 3777c478bd9Sstevel@tonic-gate /* 3787c478bd9Sstevel@tonic-gate * zperror2() is very similar to zperror() above, except it also prints a 3797c478bd9Sstevel@tonic-gate * supplied zone name after the executable. 3807c478bd9Sstevel@tonic-gate * 3817c478bd9Sstevel@tonic-gate * All current consumers of this function want libzonecfg's strerror() rather 3827c478bd9Sstevel@tonic-gate * than libc's; if this ever changes, this function can be made more generic 3837c478bd9Sstevel@tonic-gate * like zperror() above. 3847c478bd9Sstevel@tonic-gate */ 3857c478bd9Sstevel@tonic-gate 3860b5de56dSgjelinek void 3877c478bd9Sstevel@tonic-gate zperror2(const char *zone, const char *str) 3887c478bd9Sstevel@tonic-gate { 3897c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "%s: %s: %s: %s\n", execname, zone, str, 3907c478bd9Sstevel@tonic-gate zonecfg_strerror(errno)); 3917c478bd9Sstevel@tonic-gate } 3927c478bd9Sstevel@tonic-gate 3937c478bd9Sstevel@tonic-gate /* PRINTFLIKE1 */ 3940b5de56dSgjelinek void 3957c478bd9Sstevel@tonic-gate zerror(const char *fmt, ...) 3967c478bd9Sstevel@tonic-gate { 3977c478bd9Sstevel@tonic-gate va_list alist; 3987c478bd9Sstevel@tonic-gate 3997c478bd9Sstevel@tonic-gate va_start(alist, fmt); 4007c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "%s: ", execname); 4017c478bd9Sstevel@tonic-gate if (target_zone != NULL) 4027c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "zone '%s': ", target_zone); 4037c478bd9Sstevel@tonic-gate (void) vfprintf(stderr, fmt, alist); 4047c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "\n"); 4057c478bd9Sstevel@tonic-gate va_end(alist); 4067c478bd9Sstevel@tonic-gate } 4077c478bd9Sstevel@tonic-gate 4087c478bd9Sstevel@tonic-gate static void * 4097c478bd9Sstevel@tonic-gate safe_calloc(size_t nelem, size_t elsize) 4107c478bd9Sstevel@tonic-gate { 4117c478bd9Sstevel@tonic-gate void *r = calloc(nelem, elsize); 4127c478bd9Sstevel@tonic-gate 4137c478bd9Sstevel@tonic-gate if (r == NULL) { 4147c478bd9Sstevel@tonic-gate zerror(gettext("failed to allocate %lu bytes: %s"), 4157c478bd9Sstevel@tonic-gate (ulong_t)nelem * elsize, strerror(errno)); 4167c478bd9Sstevel@tonic-gate exit(Z_ERR); 4177c478bd9Sstevel@tonic-gate } 4187c478bd9Sstevel@tonic-gate return (r); 4197c478bd9Sstevel@tonic-gate } 4207c478bd9Sstevel@tonic-gate 4217c478bd9Sstevel@tonic-gate static void 4227c478bd9Sstevel@tonic-gate zone_print(zone_entry_t *zent, boolean_t verbose, boolean_t parsable) 4237c478bd9Sstevel@tonic-gate { 4247c478bd9Sstevel@tonic-gate static boolean_t firsttime = B_TRUE; 425f4b3ec61Sdh155122 char *ip_type_str; 426f4b3ec61Sdh155122 427f4b3ec61Sdh155122 if (zent->ziptype == ZS_EXCLUSIVE) 428f4b3ec61Sdh155122 ip_type_str = "excl"; 429f4b3ec61Sdh155122 else 430f4b3ec61Sdh155122 ip_type_str = "shared"; 4317c478bd9Sstevel@tonic-gate 4327c478bd9Sstevel@tonic-gate assert(!(verbose && parsable)); 4337c478bd9Sstevel@tonic-gate if (firsttime && verbose) { 4347c478bd9Sstevel@tonic-gate firsttime = B_FALSE; 435f4b3ec61Sdh155122 (void) printf("%*s %-16s %-10s %-30s %-8s %-6s\n", 436f4b3ec61Sdh155122 ZONEID_WIDTH, "ID", "NAME", "STATUS", "PATH", "BRAND", 437f4b3ec61Sdh155122 "IP"); 4387c478bd9Sstevel@tonic-gate } 4397c478bd9Sstevel@tonic-gate if (!verbose) { 440555afedfScarlsonj char *cp, *clim; 441555afedfScarlsonj 4427c478bd9Sstevel@tonic-gate if (!parsable) { 4437c478bd9Sstevel@tonic-gate (void) printf("%s\n", zent->zname); 4447c478bd9Sstevel@tonic-gate return; 4457c478bd9Sstevel@tonic-gate } 4467c478bd9Sstevel@tonic-gate if (zent->zid == ZONE_ID_UNDEFINED) 4477c478bd9Sstevel@tonic-gate (void) printf("-"); 4487c478bd9Sstevel@tonic-gate else 4497c478bd9Sstevel@tonic-gate (void) printf("%lu", zent->zid); 450555afedfScarlsonj (void) printf(":%s:%s:", zent->zname, zent->zstate_str); 451555afedfScarlsonj cp = zent->zroot; 452555afedfScarlsonj while ((clim = strchr(cp, ':')) != NULL) { 453555afedfScarlsonj (void) printf("%.*s\\:", clim - cp, cp); 454555afedfScarlsonj cp = clim + 1; 455555afedfScarlsonj } 456f4b3ec61Sdh155122 (void) printf("%s:%s:%s:%s\n", cp, zent->zuuid, zent->zbrand, 457f4b3ec61Sdh155122 ip_type_str); 4587c478bd9Sstevel@tonic-gate return; 4597c478bd9Sstevel@tonic-gate } 4607c478bd9Sstevel@tonic-gate if (zent->zstate_str != NULL) { 4617c478bd9Sstevel@tonic-gate if (zent->zid == ZONE_ID_UNDEFINED) 4627c478bd9Sstevel@tonic-gate (void) printf("%*s", ZONEID_WIDTH, "-"); 4637c478bd9Sstevel@tonic-gate else 4647c478bd9Sstevel@tonic-gate (void) printf("%*lu", ZONEID_WIDTH, zent->zid); 465f4b3ec61Sdh155122 (void) printf(" %-16s %-10s %-30s %-8s %-6s\n", zent->zname, 466f4b3ec61Sdh155122 zent->zstate_str, zent->zroot, zent->zbrand, ip_type_str); 4677c478bd9Sstevel@tonic-gate } 4687c478bd9Sstevel@tonic-gate } 4697c478bd9Sstevel@tonic-gate 4707c478bd9Sstevel@tonic-gate static int 471108322fbScarlsonj lookup_zone_info(const char *zone_name, zoneid_t zid, zone_entry_t *zent) 4727c478bd9Sstevel@tonic-gate { 47345916cd2Sjpk char root[MAXPATHLEN], *cp; 4747c478bd9Sstevel@tonic-gate int err; 475555afedfScarlsonj uuid_t uuid; 4767c478bd9Sstevel@tonic-gate 4777c478bd9Sstevel@tonic-gate (void) strlcpy(zent->zname, zone_name, sizeof (zent->zname)); 4787c478bd9Sstevel@tonic-gate (void) strlcpy(zent->zroot, "???", sizeof (zent->zroot)); 4799acbbeafSnn35248 (void) strlcpy(zent->zbrand, "???", sizeof (zent->zbrand)); 4807c478bd9Sstevel@tonic-gate zent->zstate_str = "???"; 4817c478bd9Sstevel@tonic-gate 482108322fbScarlsonj zent->zid = zid; 4837c478bd9Sstevel@tonic-gate 484555afedfScarlsonj if (zonecfg_get_uuid(zone_name, uuid) == Z_OK && 485555afedfScarlsonj !uuid_is_null(uuid)) 486555afedfScarlsonj uuid_unparse(uuid, zent->zuuid); 487555afedfScarlsonj else 488555afedfScarlsonj zent->zuuid[0] = '\0'; 489555afedfScarlsonj 49045916cd2Sjpk /* 49145916cd2Sjpk * For labeled zones which query the zone path of lower-level 49245916cd2Sjpk * zones, the path needs to be adjusted to drop the final 49345916cd2Sjpk * "/root" component. This adjusted path is then useful 49445916cd2Sjpk * for reading down any exported directories from the 49545916cd2Sjpk * lower-level zone. 49645916cd2Sjpk */ 49745916cd2Sjpk if (is_system_labeled() && zent->zid != ZONE_ID_UNDEFINED) { 49845916cd2Sjpk if (zone_getattr(zent->zid, ZONE_ATTR_ROOT, zent->zroot, 49945916cd2Sjpk sizeof (zent->zroot)) == -1) { 50045916cd2Sjpk zperror2(zent->zname, 50145916cd2Sjpk gettext("could not get zone path.")); 50245916cd2Sjpk return (Z_ERR); 50345916cd2Sjpk } 50445916cd2Sjpk cp = zent->zroot + strlen(zent->zroot) - 5; 50545916cd2Sjpk if (cp > zent->zroot && strcmp(cp, "/root") == 0) 50645916cd2Sjpk *cp = 0; 50745916cd2Sjpk } else { 50845916cd2Sjpk if ((err = zone_get_zonepath(zent->zname, root, 50945916cd2Sjpk sizeof (root))) != Z_OK) { 5107c478bd9Sstevel@tonic-gate errno = err; 51145916cd2Sjpk zperror2(zent->zname, 51245916cd2Sjpk gettext("could not get zone path.")); 5137c478bd9Sstevel@tonic-gate return (Z_ERR); 5147c478bd9Sstevel@tonic-gate } 5157c478bd9Sstevel@tonic-gate (void) strlcpy(zent->zroot, root, sizeof (zent->zroot)); 51645916cd2Sjpk } 5177c478bd9Sstevel@tonic-gate 5187c478bd9Sstevel@tonic-gate if ((err = zone_get_state(zent->zname, &zent->zstate_num)) != Z_OK) { 5197c478bd9Sstevel@tonic-gate errno = err; 5207c478bd9Sstevel@tonic-gate zperror2(zent->zname, gettext("could not get state")); 5217c478bd9Sstevel@tonic-gate return (Z_ERR); 5227c478bd9Sstevel@tonic-gate } 5237c478bd9Sstevel@tonic-gate zent->zstate_str = zone_state_str(zent->zstate_num); 524bafa7067Snn35248 525bafa7067Snn35248 /* 526bafa7067Snn35248 * A zone's brand is only available in the .xml file describing it, 527bafa7067Snn35248 * which is only visible to the global zone. This causes 528bafa7067Snn35248 * zone_get_brand() to fail when called from within a non-global 529bafa7067Snn35248 * zone. Fortunately we only do this on labeled systems, where we 530bafa7067Snn35248 * know all zones are native. 531bafa7067Snn35248 */ 532bafa7067Snn35248 if (getzoneid() != GLOBAL_ZONEID) { 533bafa7067Snn35248 assert(is_system_labeled() != 0); 534bafa7067Snn35248 (void) strlcpy(zent->zbrand, NATIVE_BRAND_NAME, 535bafa7067Snn35248 sizeof (zent->zbrand)); 536bafa7067Snn35248 } else if (zone_get_brand(zent->zname, zent->zbrand, 5379acbbeafSnn35248 sizeof (zent->zbrand)) != Z_OK) { 5389acbbeafSnn35248 zperror2(zent->zname, gettext("could not get brand name")); 5399acbbeafSnn35248 return (Z_ERR); 5409acbbeafSnn35248 } 5417c478bd9Sstevel@tonic-gate 542f4b3ec61Sdh155122 /* 543f4b3ec61Sdh155122 * Get ip type of the zone. 544f4b3ec61Sdh155122 * Note for global zone, ZS_SHARED is set always. 545f4b3ec61Sdh155122 */ 546f4b3ec61Sdh155122 if (zid == GLOBAL_ZONEID) { 547f4b3ec61Sdh155122 zent->ziptype = ZS_SHARED; 548f4b3ec61Sdh155122 } else { 549f4b3ec61Sdh155122 550f4b3ec61Sdh155122 if (zent->zstate_num == ZONE_STATE_RUNNING) { 551f4b3ec61Sdh155122 ushort_t flags; 552f4b3ec61Sdh155122 553f4b3ec61Sdh155122 if (zone_getattr(zid, ZONE_ATTR_FLAGS, &flags, 554f4b3ec61Sdh155122 sizeof (flags)) < 0) { 555f4b3ec61Sdh155122 zperror2(zent->zname, 556f4b3ec61Sdh155122 gettext("could not get zone flags")); 557f4b3ec61Sdh155122 return (Z_ERR); 558f4b3ec61Sdh155122 } 559f4b3ec61Sdh155122 if (flags & ZF_NET_EXCL) 560f4b3ec61Sdh155122 zent->ziptype = ZS_EXCLUSIVE; 561f4b3ec61Sdh155122 else 562f4b3ec61Sdh155122 zent->ziptype = ZS_SHARED; 563f4b3ec61Sdh155122 } else { 564f4b3ec61Sdh155122 zone_dochandle_t handle; 565f4b3ec61Sdh155122 566f4b3ec61Sdh155122 if ((handle = zonecfg_init_handle()) == NULL) { 567f4b3ec61Sdh155122 zperror2(zent->zname, 568f4b3ec61Sdh155122 gettext("could not init handle")); 569f4b3ec61Sdh155122 return (Z_ERR); 570f4b3ec61Sdh155122 } 571f4b3ec61Sdh155122 if ((err = zonecfg_get_handle(zent->zname, handle)) 572f4b3ec61Sdh155122 != Z_OK) { 573f4b3ec61Sdh155122 zperror2(zent->zname, 574f4b3ec61Sdh155122 gettext("could not get handle")); 575f4b3ec61Sdh155122 zonecfg_fini_handle(handle); 576f4b3ec61Sdh155122 return (Z_ERR); 577f4b3ec61Sdh155122 } 578f4b3ec61Sdh155122 579f4b3ec61Sdh155122 if ((err = zonecfg_get_iptype(handle, &zent->ziptype)) 580f4b3ec61Sdh155122 != Z_OK) { 581f4b3ec61Sdh155122 zperror2(zent->zname, 582f4b3ec61Sdh155122 gettext("could not get ip-type")); 583f4b3ec61Sdh155122 zonecfg_fini_handle(handle); 584f4b3ec61Sdh155122 return (Z_ERR); 585f4b3ec61Sdh155122 } 586f4b3ec61Sdh155122 zonecfg_fini_handle(handle); 587f4b3ec61Sdh155122 } 588f4b3ec61Sdh155122 } 589f4b3ec61Sdh155122 5907c478bd9Sstevel@tonic-gate return (Z_OK); 5917c478bd9Sstevel@tonic-gate } 5927c478bd9Sstevel@tonic-gate 5937c478bd9Sstevel@tonic-gate /* 5947c478bd9Sstevel@tonic-gate * fetch_zents() calls zone_list(2) to find out how many zones are running 5957c478bd9Sstevel@tonic-gate * (which is stored in the global nzents), then calls zone_list(2) again 5967c478bd9Sstevel@tonic-gate * to fetch the list of running zones (stored in the global zents). This 5977c478bd9Sstevel@tonic-gate * function may be called multiple times, so if zents is already set, we 5987c478bd9Sstevel@tonic-gate * return immediately to save work. 5997c478bd9Sstevel@tonic-gate */ 6007c478bd9Sstevel@tonic-gate 6017c478bd9Sstevel@tonic-gate static int 602108322fbScarlsonj fetch_zents(void) 6037c478bd9Sstevel@tonic-gate { 6047c478bd9Sstevel@tonic-gate zoneid_t *zids = NULL; 6057c478bd9Sstevel@tonic-gate uint_t nzents_saved; 606108322fbScarlsonj int i, retv; 607108322fbScarlsonj FILE *fp; 608108322fbScarlsonj boolean_t inaltroot; 609108322fbScarlsonj zone_entry_t *zentp; 6107c478bd9Sstevel@tonic-gate 6117c478bd9Sstevel@tonic-gate if (nzents > 0) 6127c478bd9Sstevel@tonic-gate return (Z_OK); 6137c478bd9Sstevel@tonic-gate 6147c478bd9Sstevel@tonic-gate if (zone_list(NULL, &nzents) != 0) { 6157c478bd9Sstevel@tonic-gate zperror(gettext("failed to get zoneid list"), B_FALSE); 6167c478bd9Sstevel@tonic-gate return (Z_ERR); 6177c478bd9Sstevel@tonic-gate } 6187c478bd9Sstevel@tonic-gate 6197c478bd9Sstevel@tonic-gate again: 6207c478bd9Sstevel@tonic-gate if (nzents == 0) 6217c478bd9Sstevel@tonic-gate return (Z_OK); 6227c478bd9Sstevel@tonic-gate 6237c478bd9Sstevel@tonic-gate zids = safe_calloc(nzents, sizeof (zoneid_t)); 6247c478bd9Sstevel@tonic-gate nzents_saved = nzents; 6257c478bd9Sstevel@tonic-gate 6267c478bd9Sstevel@tonic-gate if (zone_list(zids, &nzents) != 0) { 6277c478bd9Sstevel@tonic-gate zperror(gettext("failed to get zone list"), B_FALSE); 6287c478bd9Sstevel@tonic-gate free(zids); 6297c478bd9Sstevel@tonic-gate return (Z_ERR); 6307c478bd9Sstevel@tonic-gate } 6317c478bd9Sstevel@tonic-gate if (nzents != nzents_saved) { 6327c478bd9Sstevel@tonic-gate /* list changed, try again */ 6337c478bd9Sstevel@tonic-gate free(zids); 6347c478bd9Sstevel@tonic-gate goto again; 6357c478bd9Sstevel@tonic-gate } 6367c478bd9Sstevel@tonic-gate 6377c478bd9Sstevel@tonic-gate zents = safe_calloc(nzents, sizeof (zone_entry_t)); 6387c478bd9Sstevel@tonic-gate 639108322fbScarlsonj inaltroot = zonecfg_in_alt_root(); 640108322fbScarlsonj if (inaltroot) 641108322fbScarlsonj fp = zonecfg_open_scratch("", B_FALSE); 642108322fbScarlsonj else 643108322fbScarlsonj fp = NULL; 644108322fbScarlsonj zentp = zents; 645108322fbScarlsonj retv = Z_OK; 6467c478bd9Sstevel@tonic-gate for (i = 0; i < nzents; i++) { 6477c478bd9Sstevel@tonic-gate char name[ZONENAME_MAX]; 648108322fbScarlsonj char altname[ZONENAME_MAX]; 6497c478bd9Sstevel@tonic-gate 650108322fbScarlsonj if (getzonenamebyid(zids[i], name, sizeof (name)) < 0) { 6517c478bd9Sstevel@tonic-gate zperror(gettext("failed to get zone name"), B_FALSE); 652108322fbScarlsonj retv = Z_ERR; 653108322fbScarlsonj continue; 6547c478bd9Sstevel@tonic-gate } 655108322fbScarlsonj if (zonecfg_is_scratch(name)) { 656108322fbScarlsonj /* Ignore scratch zones by default */ 657108322fbScarlsonj if (!inaltroot) 658108322fbScarlsonj continue; 659108322fbScarlsonj if (fp == NULL || 660108322fbScarlsonj zonecfg_reverse_scratch(fp, name, altname, 661108322fbScarlsonj sizeof (altname), NULL, 0) == -1) { 6625ee84fbdSgjelinek zerror(gettext("could not resolve scratch " 663108322fbScarlsonj "zone %s"), name); 664108322fbScarlsonj retv = Z_ERR; 665108322fbScarlsonj continue; 666108322fbScarlsonj } 667108322fbScarlsonj (void) strcpy(name, altname); 668108322fbScarlsonj } else { 669108322fbScarlsonj /* Ignore non-scratch when in an alternate root */ 670108322fbScarlsonj if (inaltroot && strcmp(name, GLOBAL_ZONENAME) != 0) 671108322fbScarlsonj continue; 672108322fbScarlsonj } 673108322fbScarlsonj if (lookup_zone_info(name, zids[i], zentp) != Z_OK) { 674108322fbScarlsonj zerror(gettext("failed to get zone data")); 675108322fbScarlsonj retv = Z_ERR; 676108322fbScarlsonj continue; 677108322fbScarlsonj } 678108322fbScarlsonj zentp++; 679108322fbScarlsonj } 680108322fbScarlsonj nzents = zentp - zents; 681108322fbScarlsonj if (fp != NULL) 682108322fbScarlsonj zonecfg_close_scratch(fp); 6837c478bd9Sstevel@tonic-gate 6847c478bd9Sstevel@tonic-gate free(zids); 685108322fbScarlsonj return (retv); 6867c478bd9Sstevel@tonic-gate } 6877c478bd9Sstevel@tonic-gate 688108322fbScarlsonj static int 6897c478bd9Sstevel@tonic-gate zone_print_list(zone_state_t min_state, boolean_t verbose, boolean_t parsable) 6907c478bd9Sstevel@tonic-gate { 6917c478bd9Sstevel@tonic-gate int i; 6927c478bd9Sstevel@tonic-gate zone_entry_t zent; 6937c478bd9Sstevel@tonic-gate FILE *cookie; 6947c478bd9Sstevel@tonic-gate char *name; 6957c478bd9Sstevel@tonic-gate 6967c478bd9Sstevel@tonic-gate /* 6977c478bd9Sstevel@tonic-gate * First get the list of running zones from the kernel and print them. 6987c478bd9Sstevel@tonic-gate * If that is all we need, then return. 6997c478bd9Sstevel@tonic-gate */ 700108322fbScarlsonj if ((i = fetch_zents()) != Z_OK) { 7017c478bd9Sstevel@tonic-gate /* 7027c478bd9Sstevel@tonic-gate * No need for error messages; fetch_zents() has already taken 7037c478bd9Sstevel@tonic-gate * care of this. 7047c478bd9Sstevel@tonic-gate */ 705108322fbScarlsonj return (i); 7067c478bd9Sstevel@tonic-gate } 707108322fbScarlsonj for (i = 0; i < nzents; i++) 7087c478bd9Sstevel@tonic-gate zone_print(&zents[i], verbose, parsable); 7097c478bd9Sstevel@tonic-gate if (min_state >= ZONE_STATE_RUNNING) 710108322fbScarlsonj return (Z_OK); 7117c478bd9Sstevel@tonic-gate /* 7127c478bd9Sstevel@tonic-gate * Next, get the full list of zones from the configuration, skipping 7137c478bd9Sstevel@tonic-gate * any we have already printed. 7147c478bd9Sstevel@tonic-gate */ 7157c478bd9Sstevel@tonic-gate cookie = setzoneent(); 7167c478bd9Sstevel@tonic-gate while ((name = getzoneent(cookie)) != NULL) { 7177c478bd9Sstevel@tonic-gate for (i = 0; i < nzents; i++) { 7187c478bd9Sstevel@tonic-gate if (strcmp(zents[i].zname, name) == 0) 7197c478bd9Sstevel@tonic-gate break; 7207c478bd9Sstevel@tonic-gate } 7217c478bd9Sstevel@tonic-gate if (i < nzents) { 7227c478bd9Sstevel@tonic-gate free(name); 7237c478bd9Sstevel@tonic-gate continue; 7247c478bd9Sstevel@tonic-gate } 725108322fbScarlsonj if (lookup_zone_info(name, ZONE_ID_UNDEFINED, &zent) != Z_OK) { 7267c478bd9Sstevel@tonic-gate free(name); 7277c478bd9Sstevel@tonic-gate continue; 7287c478bd9Sstevel@tonic-gate } 7297c478bd9Sstevel@tonic-gate free(name); 7307c478bd9Sstevel@tonic-gate if (zent.zstate_num >= min_state) 7317c478bd9Sstevel@tonic-gate zone_print(&zent, verbose, parsable); 7327c478bd9Sstevel@tonic-gate } 7337c478bd9Sstevel@tonic-gate endzoneent(cookie); 734108322fbScarlsonj return (Z_OK); 7357c478bd9Sstevel@tonic-gate } 7367c478bd9Sstevel@tonic-gate 7377c478bd9Sstevel@tonic-gate static zone_entry_t * 7387c478bd9Sstevel@tonic-gate lookup_running_zone(char *str) 7397c478bd9Sstevel@tonic-gate { 7407c478bd9Sstevel@tonic-gate zoneid_t zoneid; 7417c478bd9Sstevel@tonic-gate char *cp; 7427c478bd9Sstevel@tonic-gate int i; 7437c478bd9Sstevel@tonic-gate 7447c478bd9Sstevel@tonic-gate if (fetch_zents() != Z_OK) 7457c478bd9Sstevel@tonic-gate return (NULL); 7467c478bd9Sstevel@tonic-gate 7477c478bd9Sstevel@tonic-gate for (i = 0; i < nzents; i++) { 7487c478bd9Sstevel@tonic-gate if (strcmp(str, zents[i].zname) == 0) 7497c478bd9Sstevel@tonic-gate return (&zents[i]); 7507c478bd9Sstevel@tonic-gate } 7517c478bd9Sstevel@tonic-gate errno = 0; 7527c478bd9Sstevel@tonic-gate zoneid = strtol(str, &cp, 0); 7537c478bd9Sstevel@tonic-gate if (zoneid < MIN_ZONEID || zoneid > MAX_ZONEID || 7547c478bd9Sstevel@tonic-gate errno != 0 || *cp != '\0') 7557c478bd9Sstevel@tonic-gate return (NULL); 7567c478bd9Sstevel@tonic-gate for (i = 0; i < nzents; i++) { 7577c478bd9Sstevel@tonic-gate if (zoneid == zents[i].zid) 7587c478bd9Sstevel@tonic-gate return (&zents[i]); 7597c478bd9Sstevel@tonic-gate } 7607c478bd9Sstevel@tonic-gate return (NULL); 7617c478bd9Sstevel@tonic-gate } 7627c478bd9Sstevel@tonic-gate 7637c478bd9Sstevel@tonic-gate /* 7647c478bd9Sstevel@tonic-gate * Check a bit in a mode_t: if on is B_TRUE, that bit should be on; if 7657c478bd9Sstevel@tonic-gate * B_FALSE, it should be off. Return B_TRUE if the mode is bad (incorrect). 7667c478bd9Sstevel@tonic-gate */ 7677c478bd9Sstevel@tonic-gate static boolean_t 7687c478bd9Sstevel@tonic-gate bad_mode_bit(mode_t mode, mode_t bit, boolean_t on, char *file) 7697c478bd9Sstevel@tonic-gate { 7707c478bd9Sstevel@tonic-gate char *str; 7717c478bd9Sstevel@tonic-gate 7727c478bd9Sstevel@tonic-gate assert(bit == S_IRUSR || bit == S_IWUSR || bit == S_IXUSR || 7737c478bd9Sstevel@tonic-gate bit == S_IRGRP || bit == S_IWGRP || bit == S_IXGRP || 7747c478bd9Sstevel@tonic-gate bit == S_IROTH || bit == S_IWOTH || bit == S_IXOTH); 7757c478bd9Sstevel@tonic-gate /* 7767c478bd9Sstevel@tonic-gate * TRANSLATION_NOTE 7777c478bd9Sstevel@tonic-gate * The strings below will be used as part of a larger message, 7787c478bd9Sstevel@tonic-gate * either: 7797c478bd9Sstevel@tonic-gate * (file name) must be (owner|group|world) (read|writ|execut)able 7807c478bd9Sstevel@tonic-gate * or 7817c478bd9Sstevel@tonic-gate * (file name) must not be (owner|group|world) (read|writ|execut)able 7827c478bd9Sstevel@tonic-gate */ 7837c478bd9Sstevel@tonic-gate switch (bit) { 7847c478bd9Sstevel@tonic-gate case S_IRUSR: 7857c478bd9Sstevel@tonic-gate str = gettext("owner readable"); 7867c478bd9Sstevel@tonic-gate break; 7877c478bd9Sstevel@tonic-gate case S_IWUSR: 7887c478bd9Sstevel@tonic-gate str = gettext("owner writable"); 7897c478bd9Sstevel@tonic-gate break; 7907c478bd9Sstevel@tonic-gate case S_IXUSR: 7917c478bd9Sstevel@tonic-gate str = gettext("owner executable"); 7927c478bd9Sstevel@tonic-gate break; 7937c478bd9Sstevel@tonic-gate case S_IRGRP: 7947c478bd9Sstevel@tonic-gate str = gettext("group readable"); 7957c478bd9Sstevel@tonic-gate break; 7967c478bd9Sstevel@tonic-gate case S_IWGRP: 7977c478bd9Sstevel@tonic-gate str = gettext("group writable"); 7987c478bd9Sstevel@tonic-gate break; 7997c478bd9Sstevel@tonic-gate case S_IXGRP: 8007c478bd9Sstevel@tonic-gate str = gettext("group executable"); 8017c478bd9Sstevel@tonic-gate break; 8027c478bd9Sstevel@tonic-gate case S_IROTH: 8037c478bd9Sstevel@tonic-gate str = gettext("world readable"); 8047c478bd9Sstevel@tonic-gate break; 8057c478bd9Sstevel@tonic-gate case S_IWOTH: 8067c478bd9Sstevel@tonic-gate str = gettext("world writable"); 8077c478bd9Sstevel@tonic-gate break; 8087c478bd9Sstevel@tonic-gate case S_IXOTH: 8097c478bd9Sstevel@tonic-gate str = gettext("world executable"); 8107c478bd9Sstevel@tonic-gate break; 8117c478bd9Sstevel@tonic-gate } 8127c478bd9Sstevel@tonic-gate if ((mode & bit) == (on ? 0 : bit)) { 8137c478bd9Sstevel@tonic-gate /* 8147c478bd9Sstevel@tonic-gate * TRANSLATION_NOTE 8157c478bd9Sstevel@tonic-gate * The first parameter below is a file name; the second 8167c478bd9Sstevel@tonic-gate * is one of the "(owner|group|world) (read|writ|execut)able" 8177c478bd9Sstevel@tonic-gate * strings from above. 8187c478bd9Sstevel@tonic-gate */ 8197c478bd9Sstevel@tonic-gate /* 8207c478bd9Sstevel@tonic-gate * The code below could be simplified but not in a way 8217c478bd9Sstevel@tonic-gate * that would easily translate to non-English locales. 8227c478bd9Sstevel@tonic-gate */ 8237c478bd9Sstevel@tonic-gate if (on) { 8247c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s must be %s.\n"), 8257c478bd9Sstevel@tonic-gate file, str); 8267c478bd9Sstevel@tonic-gate } else { 8277c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s must not be %s.\n"), 8287c478bd9Sstevel@tonic-gate file, str); 8297c478bd9Sstevel@tonic-gate } 8307c478bd9Sstevel@tonic-gate return (B_TRUE); 8317c478bd9Sstevel@tonic-gate } 8327c478bd9Sstevel@tonic-gate return (B_FALSE); 8337c478bd9Sstevel@tonic-gate } 8347c478bd9Sstevel@tonic-gate 8357c478bd9Sstevel@tonic-gate /* 8367c478bd9Sstevel@tonic-gate * We want to make sure that no zone has its zone path as a child node 8377c478bd9Sstevel@tonic-gate * (in the directory sense) of any other. We do that by comparing this 8387c478bd9Sstevel@tonic-gate * zone's path to the path of all other (non-global) zones. The comparison 8397c478bd9Sstevel@tonic-gate * in each case is simple: add '/' to the end of the path, then do a 8407c478bd9Sstevel@tonic-gate * strncmp() of the two paths, using the length of the shorter one. 8417c478bd9Sstevel@tonic-gate */ 8427c478bd9Sstevel@tonic-gate 8437c478bd9Sstevel@tonic-gate static int 8447c478bd9Sstevel@tonic-gate crosscheck_zonepaths(char *path) 8457c478bd9Sstevel@tonic-gate { 8467c478bd9Sstevel@tonic-gate char rpath[MAXPATHLEN]; /* resolved path */ 8477c478bd9Sstevel@tonic-gate char path_copy[MAXPATHLEN]; /* copy of original path */ 8487c478bd9Sstevel@tonic-gate char rpath_copy[MAXPATHLEN]; /* copy of original rpath */ 8497c478bd9Sstevel@tonic-gate struct zoneent *ze; 8507c478bd9Sstevel@tonic-gate int res, err; 8517c478bd9Sstevel@tonic-gate FILE *cookie; 8527c478bd9Sstevel@tonic-gate 8537c478bd9Sstevel@tonic-gate cookie = setzoneent(); 8547c478bd9Sstevel@tonic-gate while ((ze = getzoneent_private(cookie)) != NULL) { 8557c478bd9Sstevel@tonic-gate /* Skip zones which are not installed. */ 8567c478bd9Sstevel@tonic-gate if (ze->zone_state < ZONE_STATE_INSTALLED) { 8577c478bd9Sstevel@tonic-gate free(ze); 8587c478bd9Sstevel@tonic-gate continue; 8597c478bd9Sstevel@tonic-gate } 8607c478bd9Sstevel@tonic-gate /* Skip the global zone and the current target zone. */ 8617c478bd9Sstevel@tonic-gate if (strcmp(ze->zone_name, GLOBAL_ZONENAME) == 0 || 8627c478bd9Sstevel@tonic-gate strcmp(ze->zone_name, target_zone) == 0) { 8637c478bd9Sstevel@tonic-gate free(ze); 8647c478bd9Sstevel@tonic-gate continue; 8657c478bd9Sstevel@tonic-gate } 8667c478bd9Sstevel@tonic-gate if (strlen(ze->zone_path) == 0) { 8677c478bd9Sstevel@tonic-gate /* old index file without path, fall back */ 8687c478bd9Sstevel@tonic-gate if ((err = zone_get_zonepath(ze->zone_name, 8697c478bd9Sstevel@tonic-gate ze->zone_path, sizeof (ze->zone_path))) != Z_OK) { 8707c478bd9Sstevel@tonic-gate errno = err; 8717c478bd9Sstevel@tonic-gate zperror2(ze->zone_name, 8727c478bd9Sstevel@tonic-gate gettext("could not get zone path")); 8737c478bd9Sstevel@tonic-gate free(ze); 8747c478bd9Sstevel@tonic-gate continue; 8757c478bd9Sstevel@tonic-gate } 8767c478bd9Sstevel@tonic-gate } 877108322fbScarlsonj (void) snprintf(path_copy, sizeof (path_copy), "%s%s", 878108322fbScarlsonj zonecfg_get_root(), ze->zone_path); 879108322fbScarlsonj res = resolvepath(path_copy, rpath, sizeof (rpath)); 8807c478bd9Sstevel@tonic-gate if (res == -1) { 8817c478bd9Sstevel@tonic-gate if (errno != ENOENT) { 882108322fbScarlsonj zperror(path_copy, B_FALSE); 8837c478bd9Sstevel@tonic-gate free(ze); 8847c478bd9Sstevel@tonic-gate return (Z_ERR); 8857c478bd9Sstevel@tonic-gate } 8867c478bd9Sstevel@tonic-gate (void) printf(gettext("WARNING: zone %s is installed, " 8877c478bd9Sstevel@tonic-gate "but its %s %s does not exist.\n"), ze->zone_name, 888108322fbScarlsonj "zonepath", path_copy); 8897c478bd9Sstevel@tonic-gate free(ze); 8907c478bd9Sstevel@tonic-gate continue; 8917c478bd9Sstevel@tonic-gate } 8927c478bd9Sstevel@tonic-gate rpath[res] = '\0'; 8937c478bd9Sstevel@tonic-gate (void) snprintf(path_copy, sizeof (path_copy), "%s/", path); 8947c478bd9Sstevel@tonic-gate (void) snprintf(rpath_copy, sizeof (rpath_copy), "%s/", rpath); 8957c478bd9Sstevel@tonic-gate if (strncmp(path_copy, rpath_copy, 8967c478bd9Sstevel@tonic-gate min(strlen(path_copy), strlen(rpath_copy))) == 0) { 8975ee84fbdSgjelinek /* 8985ee84fbdSgjelinek * TRANSLATION_NOTE 8995ee84fbdSgjelinek * zonepath is a literal that should not be translated. 9005ee84fbdSgjelinek */ 9017c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s zonepath (%s) and " 9027c478bd9Sstevel@tonic-gate "%s zonepath (%s) overlap.\n"), 9037c478bd9Sstevel@tonic-gate target_zone, path, ze->zone_name, rpath); 9047c478bd9Sstevel@tonic-gate free(ze); 9057c478bd9Sstevel@tonic-gate return (Z_ERR); 9067c478bd9Sstevel@tonic-gate } 9077c478bd9Sstevel@tonic-gate free(ze); 9087c478bd9Sstevel@tonic-gate } 9097c478bd9Sstevel@tonic-gate endzoneent(cookie); 9107c478bd9Sstevel@tonic-gate return (Z_OK); 9117c478bd9Sstevel@tonic-gate } 9127c478bd9Sstevel@tonic-gate 9137c478bd9Sstevel@tonic-gate static int 9147c478bd9Sstevel@tonic-gate validate_zonepath(char *path, int cmd_num) 9157c478bd9Sstevel@tonic-gate { 9167c478bd9Sstevel@tonic-gate int res; /* result of last library/system call */ 9177c478bd9Sstevel@tonic-gate boolean_t err = B_FALSE; /* have we run into an error? */ 9187c478bd9Sstevel@tonic-gate struct stat stbuf; 9193f2f09c1Sdp struct statvfs64 vfsbuf; 9207c478bd9Sstevel@tonic-gate char rpath[MAXPATHLEN]; /* resolved path */ 9217c478bd9Sstevel@tonic-gate char ppath[MAXPATHLEN]; /* parent path */ 9227c478bd9Sstevel@tonic-gate char rppath[MAXPATHLEN]; /* resolved parent path */ 9237c478bd9Sstevel@tonic-gate char rootpath[MAXPATHLEN]; /* root path */ 9247c478bd9Sstevel@tonic-gate zone_state_t state; 9257c478bd9Sstevel@tonic-gate 9267c478bd9Sstevel@tonic-gate if (path[0] != '/') { 9277c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 9287c478bd9Sstevel@tonic-gate gettext("%s is not an absolute path.\n"), path); 9297c478bd9Sstevel@tonic-gate return (Z_ERR); 9307c478bd9Sstevel@tonic-gate } 9317c478bd9Sstevel@tonic-gate if ((res = resolvepath(path, rpath, sizeof (rpath))) == -1) { 9327c478bd9Sstevel@tonic-gate if ((errno != ENOENT) || 933865e09a4Sgjelinek (cmd_num != CMD_VERIFY && cmd_num != CMD_INSTALL && 934865e09a4Sgjelinek cmd_num != CMD_CLONE && cmd_num != CMD_MOVE)) { 9357c478bd9Sstevel@tonic-gate zperror(path, B_FALSE); 9367c478bd9Sstevel@tonic-gate return (Z_ERR); 9377c478bd9Sstevel@tonic-gate } 9387c478bd9Sstevel@tonic-gate if (cmd_num == CMD_VERIFY) { 9395ee84fbdSgjelinek /* 9405ee84fbdSgjelinek * TRANSLATION_NOTE 9415ee84fbdSgjelinek * zoneadm is a literal that should not be translated. 9425ee84fbdSgjelinek */ 9437c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("WARNING: %s does not " 9445ee84fbdSgjelinek "exist, so it could not be verified.\nWhen " 9455ee84fbdSgjelinek "'zoneadm %s' is run, '%s' will try to create\n%s, " 9465ee84fbdSgjelinek "and '%s' will be tried again,\nbut the '%s' may " 9475ee84fbdSgjelinek "fail if:\nthe parent directory of %s is group- or " 9485ee84fbdSgjelinek "other-writable\nor\n%s overlaps with any other " 9497c478bd9Sstevel@tonic-gate "installed zones.\n"), path, 9507c478bd9Sstevel@tonic-gate cmd_to_str(CMD_INSTALL), cmd_to_str(CMD_INSTALL), 9517c478bd9Sstevel@tonic-gate path, cmd_to_str(CMD_VERIFY), 9527c478bd9Sstevel@tonic-gate cmd_to_str(CMD_VERIFY), path, path); 9537c478bd9Sstevel@tonic-gate return (Z_OK); 9547c478bd9Sstevel@tonic-gate } 9557c478bd9Sstevel@tonic-gate /* 9567c478bd9Sstevel@tonic-gate * The zonepath is supposed to be mode 700 but its 9577c478bd9Sstevel@tonic-gate * parent(s) 755. So use 755 on the mkdirp() then 9587c478bd9Sstevel@tonic-gate * chmod() the zonepath itself to 700. 9597c478bd9Sstevel@tonic-gate */ 9607c478bd9Sstevel@tonic-gate if (mkdirp(path, DEFAULT_DIR_MODE) < 0) { 9617c478bd9Sstevel@tonic-gate zperror(path, B_FALSE); 9627c478bd9Sstevel@tonic-gate return (Z_ERR); 9637c478bd9Sstevel@tonic-gate } 9647c478bd9Sstevel@tonic-gate /* 9657c478bd9Sstevel@tonic-gate * If the chmod() fails, report the error, but might 9667c478bd9Sstevel@tonic-gate * as well continue the verify procedure. 9677c478bd9Sstevel@tonic-gate */ 9687c478bd9Sstevel@tonic-gate if (chmod(path, S_IRWXU) != 0) 9697c478bd9Sstevel@tonic-gate zperror(path, B_FALSE); 9707c478bd9Sstevel@tonic-gate /* 9717c478bd9Sstevel@tonic-gate * Since the mkdir() succeeded, we should not have to 9727c478bd9Sstevel@tonic-gate * worry about a subsequent ENOENT, thus this should 9737c478bd9Sstevel@tonic-gate * only recurse once. 9747c478bd9Sstevel@tonic-gate */ 975865e09a4Sgjelinek return (validate_zonepath(path, cmd_num)); 9767c478bd9Sstevel@tonic-gate } 9777c478bd9Sstevel@tonic-gate rpath[res] = '\0'; 9787c478bd9Sstevel@tonic-gate if (strcmp(path, rpath) != 0) { 9797c478bd9Sstevel@tonic-gate errno = Z_RESOLVED_PATH; 9807c478bd9Sstevel@tonic-gate zperror(path, B_TRUE); 9817c478bd9Sstevel@tonic-gate return (Z_ERR); 9827c478bd9Sstevel@tonic-gate } 9837c478bd9Sstevel@tonic-gate if ((res = stat(rpath, &stbuf)) != 0) { 9847c478bd9Sstevel@tonic-gate zperror(rpath, B_FALSE); 9857c478bd9Sstevel@tonic-gate return (Z_ERR); 9867c478bd9Sstevel@tonic-gate } 9877c478bd9Sstevel@tonic-gate if (!S_ISDIR(stbuf.st_mode)) { 9887c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s is not a directory.\n"), 9897c478bd9Sstevel@tonic-gate rpath); 9907c478bd9Sstevel@tonic-gate return (Z_ERR); 9917c478bd9Sstevel@tonic-gate } 9924fceebdfSblakej if (strcmp(stbuf.st_fstype, MNTTYPE_TMPFS) == 0) { 9937c478bd9Sstevel@tonic-gate (void) printf(gettext("WARNING: %s is on a temporary " 9940b5de56dSgjelinek "file system.\n"), rpath); 9957c478bd9Sstevel@tonic-gate } 9967c478bd9Sstevel@tonic-gate if (crosscheck_zonepaths(rpath) != Z_OK) 9977c478bd9Sstevel@tonic-gate return (Z_ERR); 9987c478bd9Sstevel@tonic-gate /* 9997c478bd9Sstevel@tonic-gate * Try to collect and report as many minor errors as possible 10007c478bd9Sstevel@tonic-gate * before returning, so the user can learn everything that needs 10017c478bd9Sstevel@tonic-gate * to be fixed up front. 10027c478bd9Sstevel@tonic-gate */ 10037c478bd9Sstevel@tonic-gate if (stbuf.st_uid != 0) { 10047c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s is not owned by root.\n"), 10057c478bd9Sstevel@tonic-gate rpath); 10067c478bd9Sstevel@tonic-gate err = B_TRUE; 10077c478bd9Sstevel@tonic-gate } 10087c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IRUSR, B_TRUE, rpath); 10097c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IWUSR, B_TRUE, rpath); 10107c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IXUSR, B_TRUE, rpath); 10117c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IRGRP, B_FALSE, rpath); 10127c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IWGRP, B_FALSE, rpath); 10137c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IXGRP, B_FALSE, rpath); 10147c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IROTH, B_FALSE, rpath); 10157c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IWOTH, B_FALSE, rpath); 10167c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IXOTH, B_FALSE, rpath); 10177c478bd9Sstevel@tonic-gate 10187c478bd9Sstevel@tonic-gate (void) snprintf(ppath, sizeof (ppath), "%s/..", path); 10197c478bd9Sstevel@tonic-gate if ((res = resolvepath(ppath, rppath, sizeof (rppath))) == -1) { 10207c478bd9Sstevel@tonic-gate zperror(ppath, B_FALSE); 10217c478bd9Sstevel@tonic-gate return (Z_ERR); 10227c478bd9Sstevel@tonic-gate } 10237c478bd9Sstevel@tonic-gate rppath[res] = '\0'; 10247c478bd9Sstevel@tonic-gate if ((res = stat(rppath, &stbuf)) != 0) { 10257c478bd9Sstevel@tonic-gate zperror(rppath, B_FALSE); 10267c478bd9Sstevel@tonic-gate return (Z_ERR); 10277c478bd9Sstevel@tonic-gate } 10287c478bd9Sstevel@tonic-gate /* theoretically impossible */ 10297c478bd9Sstevel@tonic-gate if (!S_ISDIR(stbuf.st_mode)) { 10307c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s is not a directory.\n"), 10317c478bd9Sstevel@tonic-gate rppath); 10327c478bd9Sstevel@tonic-gate return (Z_ERR); 10337c478bd9Sstevel@tonic-gate } 10347c478bd9Sstevel@tonic-gate if (stbuf.st_uid != 0) { 10357c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s is not owned by root.\n"), 10367c478bd9Sstevel@tonic-gate rppath); 10377c478bd9Sstevel@tonic-gate err = B_TRUE; 10387c478bd9Sstevel@tonic-gate } 10397c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IRUSR, B_TRUE, rppath); 10407c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IWUSR, B_TRUE, rppath); 10417c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IXUSR, B_TRUE, rppath); 10427c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IWGRP, B_FALSE, rppath); 10437c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IWOTH, B_FALSE, rppath); 10447c478bd9Sstevel@tonic-gate if (strcmp(rpath, rppath) == 0) { 10457c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s is its own parent.\n"), 10467c478bd9Sstevel@tonic-gate rppath); 10477c478bd9Sstevel@tonic-gate err = B_TRUE; 10487c478bd9Sstevel@tonic-gate } 10497c478bd9Sstevel@tonic-gate 10503f2f09c1Sdp if (statvfs64(rpath, &vfsbuf) != 0) { 10517c478bd9Sstevel@tonic-gate zperror(rpath, B_FALSE); 10527c478bd9Sstevel@tonic-gate return (Z_ERR); 10537c478bd9Sstevel@tonic-gate } 1054b5abaf04Sgjelinek if (strcmp(vfsbuf.f_basetype, MNTTYPE_NFS) == 0) { 10555ee84fbdSgjelinek /* 10565ee84fbdSgjelinek * TRANSLATION_NOTE 10575ee84fbdSgjelinek * Zonepath and NFS are literals that should not be translated. 10585ee84fbdSgjelinek */ 10595ee84fbdSgjelinek (void) fprintf(stderr, gettext("Zonepath %s is on an NFS " 10600b5de56dSgjelinek "mounted file system.\n" 10610b5de56dSgjelinek "\tA local file system must be used.\n"), rpath); 1062b5abaf04Sgjelinek return (Z_ERR); 1063b5abaf04Sgjelinek } 1064b5abaf04Sgjelinek if (vfsbuf.f_flag & ST_NOSUID) { 10655ee84fbdSgjelinek /* 10665ee84fbdSgjelinek * TRANSLATION_NOTE 10675ee84fbdSgjelinek * Zonepath and nosuid are literals that should not be 10685ee84fbdSgjelinek * translated. 10695ee84fbdSgjelinek */ 1070b5abaf04Sgjelinek (void) fprintf(stderr, gettext("Zonepath %s is on a nosuid " 10710b5de56dSgjelinek "file system.\n"), rpath); 10727c478bd9Sstevel@tonic-gate return (Z_ERR); 10737c478bd9Sstevel@tonic-gate } 10747c478bd9Sstevel@tonic-gate 10757c478bd9Sstevel@tonic-gate if ((res = zone_get_state(target_zone, &state)) != Z_OK) { 10767c478bd9Sstevel@tonic-gate errno = res; 10777c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not get state")); 10787c478bd9Sstevel@tonic-gate return (Z_ERR); 10797c478bd9Sstevel@tonic-gate } 10807c478bd9Sstevel@tonic-gate /* 10817c478bd9Sstevel@tonic-gate * The existence of the root path is only bad in the configured state, 10827c478bd9Sstevel@tonic-gate * as it is *supposed* to be there at the installed and later states. 1083ee519a1fSgjelinek * However, the root path is expected to be there if the zone is 1084ee519a1fSgjelinek * detached. 10857c478bd9Sstevel@tonic-gate * State/command mismatches are caught earlier in verify_details(). 10867c478bd9Sstevel@tonic-gate */ 1087ee519a1fSgjelinek if (state == ZONE_STATE_CONFIGURED && cmd_num != CMD_ATTACH) { 10887c478bd9Sstevel@tonic-gate if (snprintf(rootpath, sizeof (rootpath), "%s/root", rpath) >= 10897c478bd9Sstevel@tonic-gate sizeof (rootpath)) { 10905ee84fbdSgjelinek /* 10915ee84fbdSgjelinek * TRANSLATION_NOTE 10925ee84fbdSgjelinek * Zonepath is a literal that should not be translated. 10935ee84fbdSgjelinek */ 10947c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 10957c478bd9Sstevel@tonic-gate gettext("Zonepath %s is too long.\n"), rpath); 10967c478bd9Sstevel@tonic-gate return (Z_ERR); 10977c478bd9Sstevel@tonic-gate } 10987c478bd9Sstevel@tonic-gate if ((res = stat(rootpath, &stbuf)) == 0) { 1099ee519a1fSgjelinek if (zonecfg_detached(rpath)) 1100ee519a1fSgjelinek (void) fprintf(stderr, 1101ee519a1fSgjelinek gettext("Cannot %s detached " 1102ee519a1fSgjelinek "zone.\nUse attach or remove %s " 1103ee519a1fSgjelinek "directory.\n"), cmd_to_str(cmd_num), 1104ee519a1fSgjelinek rpath); 1105ee519a1fSgjelinek else 1106ee519a1fSgjelinek (void) fprintf(stderr, 1107ee519a1fSgjelinek gettext("Rootpath %s exists; " 1108ee519a1fSgjelinek "remove or move aside prior to %s.\n"), 1109ee519a1fSgjelinek rootpath, cmd_to_str(cmd_num)); 11107c478bd9Sstevel@tonic-gate return (Z_ERR); 11117c478bd9Sstevel@tonic-gate } 11127c478bd9Sstevel@tonic-gate } 11137c478bd9Sstevel@tonic-gate 11147c478bd9Sstevel@tonic-gate return (err ? Z_ERR : Z_OK); 11157c478bd9Sstevel@tonic-gate } 11167c478bd9Sstevel@tonic-gate 11179acbbeafSnn35248 /* 11189acbbeafSnn35248 * The following two routines implement a simple locking mechanism to 11199acbbeafSnn35248 * ensure that only one instance of zoneadm at a time is able to manipulate 11209acbbeafSnn35248 * a given zone. The lock is built on top of an fcntl(2) lock of 11219acbbeafSnn35248 * [<altroot>]/var/run/zones/<zonename>.zoneadm.lock. If a zoneadm instance 11229acbbeafSnn35248 * can grab that lock, it is allowed to manipulate the zone. 11239acbbeafSnn35248 * 11249acbbeafSnn35248 * Since zoneadm may call external applications which in turn invoke 11259acbbeafSnn35248 * zoneadm again, we introduce the notion of "lock inheritance". Any 11269acbbeafSnn35248 * instance of zoneadm that has another instance in its ancestry is assumed 11279acbbeafSnn35248 * to be acting on behalf of the original zoneadm, and is thus allowed to 11289acbbeafSnn35248 * manipulate its zone. 11299acbbeafSnn35248 * 11309acbbeafSnn35248 * This inheritance is implemented via the _ZONEADM_LOCK_HELD environment 11319acbbeafSnn35248 * variable. When zoneadm is granted a lock on its zone, this environment 11329acbbeafSnn35248 * variable is set to 1. When it releases the lock, the variable is set to 11339acbbeafSnn35248 * 0. Since a child process inherits its parent's environment, checking 11349acbbeafSnn35248 * the state of this variable indicates whether or not any ancestor owns 11359acbbeafSnn35248 * the lock. 11369acbbeafSnn35248 */ 11377c478bd9Sstevel@tonic-gate static void 11387c478bd9Sstevel@tonic-gate release_lock_file(int lockfd) 11397c478bd9Sstevel@tonic-gate { 11409acbbeafSnn35248 /* 11419acbbeafSnn35248 * If we are cleaning up from a failed attempt to lock the zone for 11429acbbeafSnn35248 * the first time, we might have a zone_lock_cnt of 0. In that 11439acbbeafSnn35248 * error case, we don't want to do anything but close the lock 11449acbbeafSnn35248 * file. 11459acbbeafSnn35248 */ 11469acbbeafSnn35248 assert(zone_lock_cnt >= 0); 11479acbbeafSnn35248 if (zone_lock_cnt > 0) { 11489acbbeafSnn35248 assert(getenv(LOCK_ENV_VAR) != NULL); 11499acbbeafSnn35248 assert(atoi(getenv(LOCK_ENV_VAR)) == 1); 11509acbbeafSnn35248 if (--zone_lock_cnt > 0) { 11519acbbeafSnn35248 assert(lockfd == -1); 11529acbbeafSnn35248 return; 11539acbbeafSnn35248 } 11549acbbeafSnn35248 if (putenv(zoneadm_lock_not_held) != 0) { 11559acbbeafSnn35248 zperror(target_zone, B_TRUE); 11569acbbeafSnn35248 exit(Z_ERR); 11579acbbeafSnn35248 } 11589acbbeafSnn35248 } 11599acbbeafSnn35248 assert(lockfd >= 0); 11607c478bd9Sstevel@tonic-gate (void) close(lockfd); 11617c478bd9Sstevel@tonic-gate } 11627c478bd9Sstevel@tonic-gate 11637c478bd9Sstevel@tonic-gate static int 11647c478bd9Sstevel@tonic-gate grab_lock_file(const char *zone_name, int *lockfd) 11657c478bd9Sstevel@tonic-gate { 11667c478bd9Sstevel@tonic-gate char pathbuf[PATH_MAX]; 11677c478bd9Sstevel@tonic-gate struct flock flock; 11687c478bd9Sstevel@tonic-gate 11699acbbeafSnn35248 /* 11709acbbeafSnn35248 * If we already have the lock, we can skip this expensive song 11719acbbeafSnn35248 * and dance. 11729acbbeafSnn35248 */ 11739acbbeafSnn35248 if (zone_lock_cnt > 0) { 11749acbbeafSnn35248 zone_lock_cnt++; 11759acbbeafSnn35248 *lockfd = -1; 11769acbbeafSnn35248 return (Z_OK); 11779acbbeafSnn35248 } 11789acbbeafSnn35248 assert(getenv(LOCK_ENV_VAR) != NULL); 11799acbbeafSnn35248 assert(atoi(getenv(LOCK_ENV_VAR)) == 0); 11809acbbeafSnn35248 1181108322fbScarlsonj if (snprintf(pathbuf, sizeof (pathbuf), "%s%s", zonecfg_get_root(), 1182108322fbScarlsonj ZONES_TMPDIR) >= sizeof (pathbuf)) { 1183108322fbScarlsonj zerror(gettext("alternate root path is too long")); 1184108322fbScarlsonj return (Z_ERR); 1185108322fbScarlsonj } 1186108322fbScarlsonj if (mkdir(pathbuf, S_IRWXU) < 0 && errno != EEXIST) { 1187108322fbScarlsonj zerror(gettext("could not mkdir %s: %s"), pathbuf, 11887c478bd9Sstevel@tonic-gate strerror(errno)); 11897c478bd9Sstevel@tonic-gate return (Z_ERR); 11907c478bd9Sstevel@tonic-gate } 1191108322fbScarlsonj (void) chmod(pathbuf, S_IRWXU); 11927c478bd9Sstevel@tonic-gate 11937c478bd9Sstevel@tonic-gate /* 11947c478bd9Sstevel@tonic-gate * One of these lock files is created for each zone (when needed). 11957c478bd9Sstevel@tonic-gate * The lock files are not cleaned up (except on system reboot), 11967c478bd9Sstevel@tonic-gate * but since there is only one per zone, there is no resource 11977c478bd9Sstevel@tonic-gate * starvation issue. 11987c478bd9Sstevel@tonic-gate */ 1199108322fbScarlsonj if (snprintf(pathbuf, sizeof (pathbuf), "%s%s/%s.zoneadm.lock", 1200108322fbScarlsonj zonecfg_get_root(), ZONES_TMPDIR, zone_name) >= sizeof (pathbuf)) { 1201108322fbScarlsonj zerror(gettext("alternate root path is too long")); 1202108322fbScarlsonj return (Z_ERR); 1203108322fbScarlsonj } 12047c478bd9Sstevel@tonic-gate if ((*lockfd = open(pathbuf, O_RDWR|O_CREAT, S_IRUSR|S_IWUSR)) < 0) { 12057c478bd9Sstevel@tonic-gate zerror(gettext("could not open %s: %s"), pathbuf, 12067c478bd9Sstevel@tonic-gate strerror(errno)); 12077c478bd9Sstevel@tonic-gate return (Z_ERR); 12087c478bd9Sstevel@tonic-gate } 12097c478bd9Sstevel@tonic-gate /* 12107c478bd9Sstevel@tonic-gate * Lock the file to synchronize with other zoneadmds 12117c478bd9Sstevel@tonic-gate */ 12127c478bd9Sstevel@tonic-gate flock.l_type = F_WRLCK; 12137c478bd9Sstevel@tonic-gate flock.l_whence = SEEK_SET; 12147c478bd9Sstevel@tonic-gate flock.l_start = (off_t)0; 12157c478bd9Sstevel@tonic-gate flock.l_len = (off_t)0; 12169acbbeafSnn35248 if ((fcntl(*lockfd, F_SETLKW, &flock) < 0) || 12179acbbeafSnn35248 (putenv(zoneadm_lock_held) != 0)) { 12187c478bd9Sstevel@tonic-gate zerror(gettext("unable to lock %s: %s"), pathbuf, 12197c478bd9Sstevel@tonic-gate strerror(errno)); 12207c478bd9Sstevel@tonic-gate release_lock_file(*lockfd); 12217c478bd9Sstevel@tonic-gate return (Z_ERR); 12227c478bd9Sstevel@tonic-gate } 12239acbbeafSnn35248 zone_lock_cnt = 1; 12247c478bd9Sstevel@tonic-gate return (Z_OK); 12257c478bd9Sstevel@tonic-gate } 12267c478bd9Sstevel@tonic-gate 1227108322fbScarlsonj static boolean_t 12287c478bd9Sstevel@tonic-gate get_doorname(const char *zone_name, char *buffer) 12297c478bd9Sstevel@tonic-gate { 1230108322fbScarlsonj return (snprintf(buffer, PATH_MAX, "%s" ZONE_DOOR_PATH, 1231108322fbScarlsonj zonecfg_get_root(), zone_name) < PATH_MAX); 12327c478bd9Sstevel@tonic-gate } 12337c478bd9Sstevel@tonic-gate 12347c478bd9Sstevel@tonic-gate /* 12357c478bd9Sstevel@tonic-gate * system daemons are not audited. For the global zone, this occurs 12367c478bd9Sstevel@tonic-gate * "naturally" since init is started with the default audit 12377c478bd9Sstevel@tonic-gate * characteristics. Since zoneadmd is a system daemon and it starts 12387c478bd9Sstevel@tonic-gate * init for a zone, it is necessary to clear out the audit 12397c478bd9Sstevel@tonic-gate * characteristics inherited from whomever started zoneadmd. This is 12407c478bd9Sstevel@tonic-gate * indicated by the audit id, which is set from the ruid parameter of 12417c478bd9Sstevel@tonic-gate * adt_set_user(), below. 12427c478bd9Sstevel@tonic-gate */ 12437c478bd9Sstevel@tonic-gate 12447c478bd9Sstevel@tonic-gate static void 12457c478bd9Sstevel@tonic-gate prepare_audit_context() 12467c478bd9Sstevel@tonic-gate { 12477c478bd9Sstevel@tonic-gate adt_session_data_t *ah; 12487c478bd9Sstevel@tonic-gate char *failure = gettext("audit failure: %s"); 12497c478bd9Sstevel@tonic-gate 12507c478bd9Sstevel@tonic-gate if (adt_start_session(&ah, NULL, 0)) { 12517c478bd9Sstevel@tonic-gate zerror(failure, strerror(errno)); 12527c478bd9Sstevel@tonic-gate return; 12537c478bd9Sstevel@tonic-gate } 12547c478bd9Sstevel@tonic-gate if (adt_set_user(ah, ADT_NO_AUDIT, ADT_NO_AUDIT, 12557c478bd9Sstevel@tonic-gate ADT_NO_AUDIT, ADT_NO_AUDIT, NULL, ADT_NEW)) { 12567c478bd9Sstevel@tonic-gate zerror(failure, strerror(errno)); 12577c478bd9Sstevel@tonic-gate (void) adt_end_session(ah); 12587c478bd9Sstevel@tonic-gate return; 12597c478bd9Sstevel@tonic-gate } 12607c478bd9Sstevel@tonic-gate if (adt_set_proc(ah)) 12617c478bd9Sstevel@tonic-gate zerror(failure, strerror(errno)); 12627c478bd9Sstevel@tonic-gate 12637c478bd9Sstevel@tonic-gate (void) adt_end_session(ah); 12647c478bd9Sstevel@tonic-gate } 12657c478bd9Sstevel@tonic-gate 12667c478bd9Sstevel@tonic-gate static int 12677c478bd9Sstevel@tonic-gate start_zoneadmd(const char *zone_name) 12687c478bd9Sstevel@tonic-gate { 12697c478bd9Sstevel@tonic-gate char doorpath[PATH_MAX]; 12707c478bd9Sstevel@tonic-gate pid_t child_pid; 12717c478bd9Sstevel@tonic-gate int error = Z_ERR; 12727c478bd9Sstevel@tonic-gate int doorfd, lockfd; 12737c478bd9Sstevel@tonic-gate struct door_info info; 12747c478bd9Sstevel@tonic-gate 1275108322fbScarlsonj if (!get_doorname(zone_name, doorpath)) 1276108322fbScarlsonj return (Z_ERR); 12777c478bd9Sstevel@tonic-gate 12787c478bd9Sstevel@tonic-gate if (grab_lock_file(zone_name, &lockfd) != Z_OK) 12797c478bd9Sstevel@tonic-gate return (Z_ERR); 12807c478bd9Sstevel@tonic-gate 12817c478bd9Sstevel@tonic-gate /* 12827c478bd9Sstevel@tonic-gate * Now that we have the lock, re-confirm that the daemon is 12837c478bd9Sstevel@tonic-gate * *not* up and working fine. If it is still down, we have a green 12847c478bd9Sstevel@tonic-gate * light to start it. 12857c478bd9Sstevel@tonic-gate */ 12867c478bd9Sstevel@tonic-gate if ((doorfd = open(doorpath, O_RDONLY)) < 0) { 12877c478bd9Sstevel@tonic-gate if (errno != ENOENT) { 12887c478bd9Sstevel@tonic-gate zperror(doorpath, B_FALSE); 12897c478bd9Sstevel@tonic-gate goto out; 12907c478bd9Sstevel@tonic-gate } 12917c478bd9Sstevel@tonic-gate } else { 12927c478bd9Sstevel@tonic-gate if (door_info(doorfd, &info) == 0 && 12937c478bd9Sstevel@tonic-gate ((info.di_attributes & DOOR_REVOKED) == 0)) { 12947c478bd9Sstevel@tonic-gate error = Z_OK; 12957c478bd9Sstevel@tonic-gate (void) close(doorfd); 12967c478bd9Sstevel@tonic-gate goto out; 12977c478bd9Sstevel@tonic-gate } 12987c478bd9Sstevel@tonic-gate (void) close(doorfd); 12997c478bd9Sstevel@tonic-gate } 13007c478bd9Sstevel@tonic-gate 13017c478bd9Sstevel@tonic-gate if ((child_pid = fork()) == -1) { 13027c478bd9Sstevel@tonic-gate zperror(gettext("could not fork"), B_FALSE); 13037c478bd9Sstevel@tonic-gate goto out; 13047c478bd9Sstevel@tonic-gate } else if (child_pid == 0) { 1305108322fbScarlsonj const char *argv[6], **ap; 13067c478bd9Sstevel@tonic-gate 1307108322fbScarlsonj /* child process */ 13087c478bd9Sstevel@tonic-gate prepare_audit_context(); 13097c478bd9Sstevel@tonic-gate 1310108322fbScarlsonj ap = argv; 1311108322fbScarlsonj *ap++ = "zoneadmd"; 1312108322fbScarlsonj *ap++ = "-z"; 1313108322fbScarlsonj *ap++ = zone_name; 1314108322fbScarlsonj if (zonecfg_in_alt_root()) { 1315108322fbScarlsonj *ap++ = "-R"; 1316108322fbScarlsonj *ap++ = zonecfg_get_root(); 1317108322fbScarlsonj } 1318108322fbScarlsonj *ap = NULL; 1319108322fbScarlsonj 1320108322fbScarlsonj (void) execv("/usr/lib/zones/zoneadmd", (char * const *)argv); 13215ee84fbdSgjelinek /* 13225ee84fbdSgjelinek * TRANSLATION_NOTE 13235ee84fbdSgjelinek * zoneadmd is a literal that should not be translated. 13245ee84fbdSgjelinek */ 13257c478bd9Sstevel@tonic-gate zperror(gettext("could not exec zoneadmd"), B_FALSE); 13267c478bd9Sstevel@tonic-gate _exit(Z_ERR); 13277c478bd9Sstevel@tonic-gate } else { 13287c478bd9Sstevel@tonic-gate /* parent process */ 13297c478bd9Sstevel@tonic-gate pid_t retval; 13307c478bd9Sstevel@tonic-gate int pstatus = 0; 13317c478bd9Sstevel@tonic-gate 13327c478bd9Sstevel@tonic-gate do { 13337c478bd9Sstevel@tonic-gate retval = waitpid(child_pid, &pstatus, 0); 13347c478bd9Sstevel@tonic-gate } while (retval != child_pid); 13357c478bd9Sstevel@tonic-gate if (WIFSIGNALED(pstatus) || (WIFEXITED(pstatus) && 13367c478bd9Sstevel@tonic-gate WEXITSTATUS(pstatus) != 0)) { 13377c478bd9Sstevel@tonic-gate zerror(gettext("could not start %s"), "zoneadmd"); 13387c478bd9Sstevel@tonic-gate goto out; 13397c478bd9Sstevel@tonic-gate } 13407c478bd9Sstevel@tonic-gate } 13417c478bd9Sstevel@tonic-gate error = Z_OK; 13427c478bd9Sstevel@tonic-gate out: 13437c478bd9Sstevel@tonic-gate release_lock_file(lockfd); 13447c478bd9Sstevel@tonic-gate return (error); 13457c478bd9Sstevel@tonic-gate } 13467c478bd9Sstevel@tonic-gate 13477c478bd9Sstevel@tonic-gate static int 13487c478bd9Sstevel@tonic-gate ping_zoneadmd(const char *zone_name) 13497c478bd9Sstevel@tonic-gate { 13507c478bd9Sstevel@tonic-gate char doorpath[PATH_MAX]; 13517c478bd9Sstevel@tonic-gate int doorfd; 13527c478bd9Sstevel@tonic-gate struct door_info info; 13537c478bd9Sstevel@tonic-gate 1354108322fbScarlsonj if (!get_doorname(zone_name, doorpath)) 1355108322fbScarlsonj return (Z_ERR); 13567c478bd9Sstevel@tonic-gate 13577c478bd9Sstevel@tonic-gate if ((doorfd = open(doorpath, O_RDONLY)) < 0) { 13587c478bd9Sstevel@tonic-gate return (Z_ERR); 13597c478bd9Sstevel@tonic-gate } 13607c478bd9Sstevel@tonic-gate if (door_info(doorfd, &info) == 0 && 13617c478bd9Sstevel@tonic-gate ((info.di_attributes & DOOR_REVOKED) == 0)) { 13627c478bd9Sstevel@tonic-gate (void) close(doorfd); 13637c478bd9Sstevel@tonic-gate return (Z_OK); 13647c478bd9Sstevel@tonic-gate } 13657c478bd9Sstevel@tonic-gate (void) close(doorfd); 13667c478bd9Sstevel@tonic-gate return (Z_ERR); 13677c478bd9Sstevel@tonic-gate } 13687c478bd9Sstevel@tonic-gate 13697c478bd9Sstevel@tonic-gate static int 13707c478bd9Sstevel@tonic-gate call_zoneadmd(const char *zone_name, zone_cmd_arg_t *arg) 13717c478bd9Sstevel@tonic-gate { 13727c478bd9Sstevel@tonic-gate char doorpath[PATH_MAX]; 13737c478bd9Sstevel@tonic-gate int doorfd, result; 13747c478bd9Sstevel@tonic-gate door_arg_t darg; 13757c478bd9Sstevel@tonic-gate 13767c478bd9Sstevel@tonic-gate zoneid_t zoneid; 13777c478bd9Sstevel@tonic-gate uint64_t uniqid = 0; 13787c478bd9Sstevel@tonic-gate 13797c478bd9Sstevel@tonic-gate zone_cmd_rval_t *rvalp; 13807c478bd9Sstevel@tonic-gate size_t rlen; 13817c478bd9Sstevel@tonic-gate char *cp, *errbuf; 13827c478bd9Sstevel@tonic-gate 13837c478bd9Sstevel@tonic-gate rlen = getpagesize(); 13847c478bd9Sstevel@tonic-gate if ((rvalp = malloc(rlen)) == NULL) { 13857c478bd9Sstevel@tonic-gate zerror(gettext("failed to allocate %lu bytes: %s"), rlen, 13867c478bd9Sstevel@tonic-gate strerror(errno)); 13877c478bd9Sstevel@tonic-gate return (-1); 13887c478bd9Sstevel@tonic-gate } 13897c478bd9Sstevel@tonic-gate 13907c478bd9Sstevel@tonic-gate if ((zoneid = getzoneidbyname(zone_name)) != ZONE_ID_UNDEFINED) { 13917c478bd9Sstevel@tonic-gate (void) zone_getattr(zoneid, ZONE_ATTR_UNIQID, &uniqid, 13927c478bd9Sstevel@tonic-gate sizeof (uniqid)); 13937c478bd9Sstevel@tonic-gate } 13947c478bd9Sstevel@tonic-gate arg->uniqid = uniqid; 13957c478bd9Sstevel@tonic-gate (void) strlcpy(arg->locale, locale, sizeof (arg->locale)); 1396108322fbScarlsonj if (!get_doorname(zone_name, doorpath)) { 1397108322fbScarlsonj zerror(gettext("alternate root path is too long")); 1398108322fbScarlsonj free(rvalp); 1399108322fbScarlsonj return (-1); 1400108322fbScarlsonj } 14017c478bd9Sstevel@tonic-gate 14027c478bd9Sstevel@tonic-gate /* 14037c478bd9Sstevel@tonic-gate * Loop trying to start zoneadmd; if something goes seriously 14047c478bd9Sstevel@tonic-gate * wrong we break out and fail. 14057c478bd9Sstevel@tonic-gate */ 14067c478bd9Sstevel@tonic-gate for (;;) { 14077c478bd9Sstevel@tonic-gate if (start_zoneadmd(zone_name) != Z_OK) 14087c478bd9Sstevel@tonic-gate break; 14097c478bd9Sstevel@tonic-gate 14107c478bd9Sstevel@tonic-gate if ((doorfd = open(doorpath, O_RDONLY)) < 0) { 14117c478bd9Sstevel@tonic-gate zperror(gettext("failed to open zone door"), B_FALSE); 14127c478bd9Sstevel@tonic-gate break; 14137c478bd9Sstevel@tonic-gate } 14147c478bd9Sstevel@tonic-gate 14157c478bd9Sstevel@tonic-gate darg.data_ptr = (char *)arg; 14167c478bd9Sstevel@tonic-gate darg.data_size = sizeof (*arg); 14177c478bd9Sstevel@tonic-gate darg.desc_ptr = NULL; 14187c478bd9Sstevel@tonic-gate darg.desc_num = 0; 14197c478bd9Sstevel@tonic-gate darg.rbuf = (char *)rvalp; 14207c478bd9Sstevel@tonic-gate darg.rsize = rlen; 14217c478bd9Sstevel@tonic-gate if (door_call(doorfd, &darg) != 0) { 14227c478bd9Sstevel@tonic-gate (void) close(doorfd); 14237c478bd9Sstevel@tonic-gate /* 14247c478bd9Sstevel@tonic-gate * We'll get EBADF if the door has been revoked. 14257c478bd9Sstevel@tonic-gate */ 14267c478bd9Sstevel@tonic-gate if (errno != EBADF) { 14277c478bd9Sstevel@tonic-gate zperror(gettext("door_call failed"), B_FALSE); 14287c478bd9Sstevel@tonic-gate break; 14297c478bd9Sstevel@tonic-gate } 14307c478bd9Sstevel@tonic-gate continue; /* take another lap */ 14317c478bd9Sstevel@tonic-gate } 14327c478bd9Sstevel@tonic-gate (void) close(doorfd); 14337c478bd9Sstevel@tonic-gate 14347c478bd9Sstevel@tonic-gate if (darg.data_size == 0) { 14357c478bd9Sstevel@tonic-gate /* Door server is going away; kick it again. */ 14367c478bd9Sstevel@tonic-gate continue; 14377c478bd9Sstevel@tonic-gate } 14387c478bd9Sstevel@tonic-gate 14397c478bd9Sstevel@tonic-gate errbuf = rvalp->errbuf; 14407c478bd9Sstevel@tonic-gate while (*errbuf != '\0') { 14417c478bd9Sstevel@tonic-gate /* 14427c478bd9Sstevel@tonic-gate * Remove any newlines since zerror() 14437c478bd9Sstevel@tonic-gate * will append one automatically. 14447c478bd9Sstevel@tonic-gate */ 14457c478bd9Sstevel@tonic-gate cp = strchr(errbuf, '\n'); 14467c478bd9Sstevel@tonic-gate if (cp != NULL) 14477c478bd9Sstevel@tonic-gate *cp = '\0'; 14487c478bd9Sstevel@tonic-gate zerror("%s", errbuf); 14497c478bd9Sstevel@tonic-gate if (cp == NULL) 14507c478bd9Sstevel@tonic-gate break; 14517c478bd9Sstevel@tonic-gate errbuf = cp + 1; 14527c478bd9Sstevel@tonic-gate } 14537c478bd9Sstevel@tonic-gate result = rvalp->rval == 0 ? 0 : -1; 14547c478bd9Sstevel@tonic-gate free(rvalp); 14557c478bd9Sstevel@tonic-gate return (result); 14567c478bd9Sstevel@tonic-gate } 14577c478bd9Sstevel@tonic-gate 14587c478bd9Sstevel@tonic-gate free(rvalp); 14597c478bd9Sstevel@tonic-gate return (-1); 14607c478bd9Sstevel@tonic-gate } 14617c478bd9Sstevel@tonic-gate 14627c478bd9Sstevel@tonic-gate static int 1463ce28b40eSzt129084 invoke_brand_handler(int cmd_num, char *argv[]) 1464ce28b40eSzt129084 { 1465ce28b40eSzt129084 zone_dochandle_t handle; 1466ce28b40eSzt129084 int err; 1467ce28b40eSzt129084 1468ce28b40eSzt129084 if ((handle = zonecfg_init_handle()) == NULL) { 1469ce28b40eSzt129084 zperror(cmd_to_str(cmd_num), B_TRUE); 1470ce28b40eSzt129084 return (Z_ERR); 1471ce28b40eSzt129084 } 1472ce28b40eSzt129084 if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) { 1473ce28b40eSzt129084 errno = err; 1474ce28b40eSzt129084 zperror(cmd_to_str(cmd_num), B_TRUE); 1475ce28b40eSzt129084 zonecfg_fini_handle(handle); 1476ce28b40eSzt129084 return (Z_ERR); 1477ce28b40eSzt129084 } 1478ce28b40eSzt129084 if (verify_brand(handle, cmd_num, argv) != Z_OK) { 1479ce28b40eSzt129084 zonecfg_fini_handle(handle); 1480ce28b40eSzt129084 return (Z_ERR); 1481ce28b40eSzt129084 } 1482ce28b40eSzt129084 zonecfg_fini_handle(handle); 1483ce28b40eSzt129084 return (Z_OK); 1484ce28b40eSzt129084 } 1485ce28b40eSzt129084 1486ce28b40eSzt129084 static int 14877c478bd9Sstevel@tonic-gate ready_func(int argc, char *argv[]) 14887c478bd9Sstevel@tonic-gate { 14897c478bd9Sstevel@tonic-gate zone_cmd_arg_t zarg; 14907c478bd9Sstevel@tonic-gate int arg; 14917c478bd9Sstevel@tonic-gate 1492108322fbScarlsonj if (zonecfg_in_alt_root()) { 1493108322fbScarlsonj zerror(gettext("cannot ready zone in alternate root")); 1494108322fbScarlsonj return (Z_ERR); 1495108322fbScarlsonj } 1496108322fbScarlsonj 14977c478bd9Sstevel@tonic-gate optind = 0; 14987c478bd9Sstevel@tonic-gate if ((arg = getopt(argc, argv, "?")) != EOF) { 14997c478bd9Sstevel@tonic-gate switch (arg) { 15007c478bd9Sstevel@tonic-gate case '?': 15017c478bd9Sstevel@tonic-gate sub_usage(SHELP_READY, CMD_READY); 15027c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 15037c478bd9Sstevel@tonic-gate default: 15047c478bd9Sstevel@tonic-gate sub_usage(SHELP_READY, CMD_READY); 15057c478bd9Sstevel@tonic-gate return (Z_USAGE); 15067c478bd9Sstevel@tonic-gate } 15077c478bd9Sstevel@tonic-gate } 15087c478bd9Sstevel@tonic-gate if (argc > optind) { 15097c478bd9Sstevel@tonic-gate sub_usage(SHELP_READY, CMD_READY); 15107c478bd9Sstevel@tonic-gate return (Z_USAGE); 15117c478bd9Sstevel@tonic-gate } 15129acbbeafSnn35248 if (sanity_check(target_zone, CMD_READY, B_FALSE, B_FALSE, B_FALSE) 15139acbbeafSnn35248 != Z_OK) 15147c478bd9Sstevel@tonic-gate return (Z_ERR); 1515ce28b40eSzt129084 if (verify_details(CMD_READY, argv) != Z_OK) 15167c478bd9Sstevel@tonic-gate return (Z_ERR); 15177c478bd9Sstevel@tonic-gate 15187c478bd9Sstevel@tonic-gate zarg.cmd = Z_READY; 15197c478bd9Sstevel@tonic-gate if (call_zoneadmd(target_zone, &zarg) != 0) { 15207c478bd9Sstevel@tonic-gate zerror(gettext("call to %s failed"), "zoneadmd"); 15217c478bd9Sstevel@tonic-gate return (Z_ERR); 15227c478bd9Sstevel@tonic-gate } 15237c478bd9Sstevel@tonic-gate return (Z_OK); 15247c478bd9Sstevel@tonic-gate } 15257c478bd9Sstevel@tonic-gate 15267c478bd9Sstevel@tonic-gate static int 15277c478bd9Sstevel@tonic-gate boot_func(int argc, char *argv[]) 15287c478bd9Sstevel@tonic-gate { 15297c478bd9Sstevel@tonic-gate zone_cmd_arg_t zarg; 15309acbbeafSnn35248 boolean_t force = B_FALSE; 15317c478bd9Sstevel@tonic-gate int arg; 15327c478bd9Sstevel@tonic-gate 1533108322fbScarlsonj if (zonecfg_in_alt_root()) { 1534108322fbScarlsonj zerror(gettext("cannot boot zone in alternate root")); 1535108322fbScarlsonj return (Z_ERR); 1536108322fbScarlsonj } 1537108322fbScarlsonj 15387c478bd9Sstevel@tonic-gate zarg.bootbuf[0] = '\0'; 15397c478bd9Sstevel@tonic-gate 15407c478bd9Sstevel@tonic-gate /* 15413f2f09c1Sdp * The following getopt processes arguments to zone boot; that 15423f2f09c1Sdp * is to say, the [here] portion of the argument string: 15433f2f09c1Sdp * 15443f2f09c1Sdp * zoneadm -z myzone boot [here] -- -v -m verbose 15453f2f09c1Sdp * 15463f2f09c1Sdp * Where [here] can either be nothing, -? (in which case we bail 15479acbbeafSnn35248 * and print usage), -f (a private option to indicate that the 15489acbbeafSnn35248 * boot operation should be 'forced'), or -s. Support for -s is 15499acbbeafSnn35248 * vestigal and obsolete, but is retained because it was a 15509acbbeafSnn35248 * documented interface and there are known consumers including 15519acbbeafSnn35248 * admin/install; the proper way to specify boot arguments like -s 15529acbbeafSnn35248 * is: 15533f2f09c1Sdp * 15543f2f09c1Sdp * zoneadm -z myzone boot -- -s -v -m verbose. 15557c478bd9Sstevel@tonic-gate */ 15567c478bd9Sstevel@tonic-gate optind = 0; 15579acbbeafSnn35248 while ((arg = getopt(argc, argv, "?fs")) != EOF) { 15587c478bd9Sstevel@tonic-gate switch (arg) { 15597c478bd9Sstevel@tonic-gate case '?': 15607c478bd9Sstevel@tonic-gate sub_usage(SHELP_BOOT, CMD_BOOT); 15617c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 15627c478bd9Sstevel@tonic-gate case 's': 15637c478bd9Sstevel@tonic-gate (void) strlcpy(zarg.bootbuf, "-s", 15647c478bd9Sstevel@tonic-gate sizeof (zarg.bootbuf)); 15657c478bd9Sstevel@tonic-gate break; 15669acbbeafSnn35248 case 'f': 15679acbbeafSnn35248 force = B_TRUE; 15689acbbeafSnn35248 break; 15697c478bd9Sstevel@tonic-gate default: 15707c478bd9Sstevel@tonic-gate sub_usage(SHELP_BOOT, CMD_BOOT); 15717c478bd9Sstevel@tonic-gate return (Z_USAGE); 15727c478bd9Sstevel@tonic-gate } 15737c478bd9Sstevel@tonic-gate } 15743f2f09c1Sdp 15753f2f09c1Sdp for (; optind < argc; optind++) { 15763f2f09c1Sdp if (strlcat(zarg.bootbuf, argv[optind], 15773f2f09c1Sdp sizeof (zarg.bootbuf)) >= sizeof (zarg.bootbuf)) { 15783f2f09c1Sdp zerror(gettext("Boot argument list too long")); 15793f2f09c1Sdp return (Z_ERR); 15807c478bd9Sstevel@tonic-gate } 15813f2f09c1Sdp if (optind < argc - 1) 15823f2f09c1Sdp if (strlcat(zarg.bootbuf, " ", sizeof (zarg.bootbuf)) >= 15833f2f09c1Sdp sizeof (zarg.bootbuf)) { 15843f2f09c1Sdp zerror(gettext("Boot argument list too long")); 15853f2f09c1Sdp return (Z_ERR); 15863f2f09c1Sdp } 15873f2f09c1Sdp } 15889acbbeafSnn35248 if (sanity_check(target_zone, CMD_BOOT, B_FALSE, B_FALSE, force) 15899acbbeafSnn35248 != Z_OK) 15907c478bd9Sstevel@tonic-gate return (Z_ERR); 1591ce28b40eSzt129084 if (verify_details(CMD_BOOT, argv) != Z_OK) 15927c478bd9Sstevel@tonic-gate return (Z_ERR); 15939acbbeafSnn35248 zarg.cmd = force ? Z_FORCEBOOT : Z_BOOT; 15947c478bd9Sstevel@tonic-gate if (call_zoneadmd(target_zone, &zarg) != 0) { 15957c478bd9Sstevel@tonic-gate zerror(gettext("call to %s failed"), "zoneadmd"); 15967c478bd9Sstevel@tonic-gate return (Z_ERR); 15977c478bd9Sstevel@tonic-gate } 15980209230bSgjelinek 15997c478bd9Sstevel@tonic-gate return (Z_OK); 16007c478bd9Sstevel@tonic-gate } 16017c478bd9Sstevel@tonic-gate 16027c478bd9Sstevel@tonic-gate static void 16037c478bd9Sstevel@tonic-gate fake_up_local_zone(zoneid_t zid, zone_entry_t *zeptr) 16047c478bd9Sstevel@tonic-gate { 16057c478bd9Sstevel@tonic-gate ssize_t result; 1606555afedfScarlsonj uuid_t uuid; 1607555afedfScarlsonj FILE *fp; 1608f4b3ec61Sdh155122 ushort_t flags; 1609555afedfScarlsonj 1610555afedfScarlsonj (void) memset(zeptr, 0, sizeof (*zeptr)); 16117c478bd9Sstevel@tonic-gate 16127c478bd9Sstevel@tonic-gate zeptr->zid = zid; 1613555afedfScarlsonj 16147c478bd9Sstevel@tonic-gate /* 16157c478bd9Sstevel@tonic-gate * Since we're looking up our own (non-global) zone name, 16167c478bd9Sstevel@tonic-gate * we can be assured that it will succeed. 16177c478bd9Sstevel@tonic-gate */ 16187c478bd9Sstevel@tonic-gate result = getzonenamebyid(zid, zeptr->zname, sizeof (zeptr->zname)); 16197c478bd9Sstevel@tonic-gate assert(result >= 0); 1620555afedfScarlsonj if (zonecfg_is_scratch(zeptr->zname) && 1621555afedfScarlsonj (fp = zonecfg_open_scratch("", B_FALSE)) != NULL) { 1622555afedfScarlsonj (void) zonecfg_reverse_scratch(fp, zeptr->zname, zeptr->zname, 1623555afedfScarlsonj sizeof (zeptr->zname), NULL, 0); 1624555afedfScarlsonj zonecfg_close_scratch(fp); 1625555afedfScarlsonj } 1626555afedfScarlsonj 1627555afedfScarlsonj if (is_system_labeled()) { 162845916cd2Sjpk (void) zone_getattr(zid, ZONE_ATTR_ROOT, zeptr->zroot, 162945916cd2Sjpk sizeof (zeptr->zroot)); 16309acbbeafSnn35248 (void) strlcpy(zeptr->zbrand, NATIVE_BRAND_NAME, 16319acbbeafSnn35248 sizeof (zeptr->zbrand)); 1632555afedfScarlsonj } else { 1633555afedfScarlsonj (void) strlcpy(zeptr->zroot, "/", sizeof (zeptr->zroot)); 16349acbbeafSnn35248 (void) zone_getattr(zid, ZONE_ATTR_BRAND, zeptr->zbrand, 16359acbbeafSnn35248 sizeof (zeptr->zbrand)); 163645916cd2Sjpk } 1637555afedfScarlsonj 16387c478bd9Sstevel@tonic-gate zeptr->zstate_str = "running"; 1639555afedfScarlsonj if (zonecfg_get_uuid(zeptr->zname, uuid) == Z_OK && 1640555afedfScarlsonj !uuid_is_null(uuid)) 1641555afedfScarlsonj uuid_unparse(uuid, zeptr->zuuid); 1642f4b3ec61Sdh155122 1643f4b3ec61Sdh155122 if (zone_getattr(zid, ZONE_ATTR_FLAGS, &flags, sizeof (flags)) < 0) { 1644f4b3ec61Sdh155122 zperror2(zeptr->zname, gettext("could not get zone flags")); 1645f4b3ec61Sdh155122 exit(Z_ERR); 1646f4b3ec61Sdh155122 } 1647f4b3ec61Sdh155122 if (flags & ZF_NET_EXCL) 1648f4b3ec61Sdh155122 zeptr->ziptype = ZS_EXCLUSIVE; 1649f4b3ec61Sdh155122 else 1650f4b3ec61Sdh155122 zeptr->ziptype = ZS_SHARED; 16517c478bd9Sstevel@tonic-gate } 16527c478bd9Sstevel@tonic-gate 16537c478bd9Sstevel@tonic-gate static int 16547c478bd9Sstevel@tonic-gate list_func(int argc, char *argv[]) 16557c478bd9Sstevel@tonic-gate { 16567c478bd9Sstevel@tonic-gate zone_entry_t *zentp, zent; 1657108322fbScarlsonj int arg, retv; 16587c478bd9Sstevel@tonic-gate boolean_t output = B_FALSE, verbose = B_FALSE, parsable = B_FALSE; 16597c478bd9Sstevel@tonic-gate zone_state_t min_state = ZONE_STATE_RUNNING; 16607c478bd9Sstevel@tonic-gate zoneid_t zone_id = getzoneid(); 16617c478bd9Sstevel@tonic-gate 16627c478bd9Sstevel@tonic-gate if (target_zone == NULL) { 16637c478bd9Sstevel@tonic-gate /* all zones: default view to running but allow override */ 16647c478bd9Sstevel@tonic-gate optind = 0; 16657c478bd9Sstevel@tonic-gate while ((arg = getopt(argc, argv, "?cipv")) != EOF) { 16667c478bd9Sstevel@tonic-gate switch (arg) { 16677c478bd9Sstevel@tonic-gate case '?': 16687c478bd9Sstevel@tonic-gate sub_usage(SHELP_LIST, CMD_LIST); 16697c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 1670475d78a4Sjonb /* 1671475d78a4Sjonb * The 'i' and 'c' options are not mutually 1672475d78a4Sjonb * exclusive so if 'c' is given, then min_state 1673475d78a4Sjonb * is set to 0 (ZONE_STATE_CONFIGURED) which is 1674475d78a4Sjonb * the lowest possible state. If 'i' is given, 1675475d78a4Sjonb * then min_state is set to be the lowest state 1676475d78a4Sjonb * so far. 1677475d78a4Sjonb */ 16787c478bd9Sstevel@tonic-gate case 'c': 16797c478bd9Sstevel@tonic-gate min_state = ZONE_STATE_CONFIGURED; 16807c478bd9Sstevel@tonic-gate break; 16817c478bd9Sstevel@tonic-gate case 'i': 1682475d78a4Sjonb min_state = min(ZONE_STATE_INSTALLED, 1683475d78a4Sjonb min_state); 1684475d78a4Sjonb 16857c478bd9Sstevel@tonic-gate break; 16867c478bd9Sstevel@tonic-gate case 'p': 16877c478bd9Sstevel@tonic-gate parsable = B_TRUE; 16887c478bd9Sstevel@tonic-gate break; 16897c478bd9Sstevel@tonic-gate case 'v': 16907c478bd9Sstevel@tonic-gate verbose = B_TRUE; 16917c478bd9Sstevel@tonic-gate break; 16927c478bd9Sstevel@tonic-gate default: 16937c478bd9Sstevel@tonic-gate sub_usage(SHELP_LIST, CMD_LIST); 16947c478bd9Sstevel@tonic-gate return (Z_USAGE); 16957c478bd9Sstevel@tonic-gate } 16967c478bd9Sstevel@tonic-gate } 16977c478bd9Sstevel@tonic-gate if (parsable && verbose) { 16987c478bd9Sstevel@tonic-gate zerror(gettext("%s -p and -v are mutually exclusive."), 16997c478bd9Sstevel@tonic-gate cmd_to_str(CMD_LIST)); 17007c478bd9Sstevel@tonic-gate return (Z_ERR); 17017c478bd9Sstevel@tonic-gate } 170245916cd2Sjpk if (zone_id == GLOBAL_ZONEID || is_system_labeled()) { 1703108322fbScarlsonj retv = zone_print_list(min_state, verbose, parsable); 17047c478bd9Sstevel@tonic-gate } else { 17057c478bd9Sstevel@tonic-gate fake_up_local_zone(zone_id, &zent); 17069acbbeafSnn35248 retv = Z_OK; 17077c478bd9Sstevel@tonic-gate zone_print(&zent, verbose, parsable); 17087c478bd9Sstevel@tonic-gate } 1709108322fbScarlsonj return (retv); 17107c478bd9Sstevel@tonic-gate } 17117c478bd9Sstevel@tonic-gate 17127c478bd9Sstevel@tonic-gate /* 17137c478bd9Sstevel@tonic-gate * Specific target zone: disallow -i/-c suboptions. 17147c478bd9Sstevel@tonic-gate */ 17157c478bd9Sstevel@tonic-gate optind = 0; 17167c478bd9Sstevel@tonic-gate while ((arg = getopt(argc, argv, "?pv")) != EOF) { 17177c478bd9Sstevel@tonic-gate switch (arg) { 17187c478bd9Sstevel@tonic-gate case '?': 17197c478bd9Sstevel@tonic-gate sub_usage(SHELP_LIST, CMD_LIST); 17207c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 17217c478bd9Sstevel@tonic-gate case 'p': 17227c478bd9Sstevel@tonic-gate parsable = B_TRUE; 17237c478bd9Sstevel@tonic-gate break; 17247c478bd9Sstevel@tonic-gate case 'v': 17257c478bd9Sstevel@tonic-gate verbose = B_TRUE; 17267c478bd9Sstevel@tonic-gate break; 17277c478bd9Sstevel@tonic-gate default: 17287c478bd9Sstevel@tonic-gate sub_usage(SHELP_LIST, CMD_LIST); 17297c478bd9Sstevel@tonic-gate return (Z_USAGE); 17307c478bd9Sstevel@tonic-gate } 17317c478bd9Sstevel@tonic-gate } 17327c478bd9Sstevel@tonic-gate if (parsable && verbose) { 17337c478bd9Sstevel@tonic-gate zerror(gettext("%s -p and -v are mutually exclusive."), 17347c478bd9Sstevel@tonic-gate cmd_to_str(CMD_LIST)); 17357c478bd9Sstevel@tonic-gate return (Z_ERR); 17367c478bd9Sstevel@tonic-gate } 17377c478bd9Sstevel@tonic-gate if (argc > optind) { 17387c478bd9Sstevel@tonic-gate sub_usage(SHELP_LIST, CMD_LIST); 17397c478bd9Sstevel@tonic-gate return (Z_USAGE); 17407c478bd9Sstevel@tonic-gate } 17412ec67e04Sgjelinek if (zone_id != GLOBAL_ZONEID && !is_system_labeled()) { 17427c478bd9Sstevel@tonic-gate fake_up_local_zone(zone_id, &zent); 17437c478bd9Sstevel@tonic-gate /* 17447c478bd9Sstevel@tonic-gate * main() will issue a Z_NO_ZONE error if it cannot get an 17457c478bd9Sstevel@tonic-gate * id for target_zone, which in a non-global zone should 17467c478bd9Sstevel@tonic-gate * happen for any zone name except `zonename`. Thus we 17477c478bd9Sstevel@tonic-gate * assert() that here but don't otherwise check. 17487c478bd9Sstevel@tonic-gate */ 17497c478bd9Sstevel@tonic-gate assert(strcmp(zent.zname, target_zone) == 0); 17507c478bd9Sstevel@tonic-gate zone_print(&zent, verbose, parsable); 17517c478bd9Sstevel@tonic-gate output = B_TRUE; 17527c478bd9Sstevel@tonic-gate } else if ((zentp = lookup_running_zone(target_zone)) != NULL) { 17537c478bd9Sstevel@tonic-gate zone_print(zentp, verbose, parsable); 17547c478bd9Sstevel@tonic-gate output = B_TRUE; 1755108322fbScarlsonj } else if (lookup_zone_info(target_zone, ZONE_ID_UNDEFINED, 1756108322fbScarlsonj &zent) == Z_OK) { 17577c478bd9Sstevel@tonic-gate zone_print(&zent, verbose, parsable); 17587c478bd9Sstevel@tonic-gate output = B_TRUE; 17597c478bd9Sstevel@tonic-gate } 1760ce28b40eSzt129084 1761ce28b40eSzt129084 /* 1762ce28b40eSzt129084 * Invoke brand-specific handler. Note that we do this 1763db628066Sgjelinek * only if we're in the global zone, and target_zone is specified 1764db628066Sgjelinek * and it is not the global zone. 1765ce28b40eSzt129084 */ 1766db628066Sgjelinek if (zone_id == GLOBAL_ZONEID && target_zone != NULL && 1767db628066Sgjelinek strcmp(target_zone, GLOBAL_ZONENAME) != 0) 1768ce28b40eSzt129084 if (invoke_brand_handler(CMD_LIST, argv) != Z_OK) 1769ce28b40eSzt129084 return (Z_ERR); 1770ce28b40eSzt129084 17717c478bd9Sstevel@tonic-gate return (output ? Z_OK : Z_ERR); 17727c478bd9Sstevel@tonic-gate } 17737c478bd9Sstevel@tonic-gate 17747c478bd9Sstevel@tonic-gate static void 17757c478bd9Sstevel@tonic-gate sigterm(int sig) 17767c478bd9Sstevel@tonic-gate { 17777c478bd9Sstevel@tonic-gate /* 17787c478bd9Sstevel@tonic-gate * Ignore SIG{INT,TERM}, so we don't end up in an infinite loop, 17797c478bd9Sstevel@tonic-gate * then propagate the signal to our process group. 17807c478bd9Sstevel@tonic-gate */ 17819acbbeafSnn35248 assert(sig == SIGINT || sig == SIGTERM); 17827c478bd9Sstevel@tonic-gate (void) sigset(SIGINT, SIG_IGN); 17837c478bd9Sstevel@tonic-gate (void) sigset(SIGTERM, SIG_IGN); 17847c478bd9Sstevel@tonic-gate (void) kill(0, sig); 17857c478bd9Sstevel@tonic-gate child_killed = B_TRUE; 17867c478bd9Sstevel@tonic-gate } 17877c478bd9Sstevel@tonic-gate 17887c478bd9Sstevel@tonic-gate static int 17897c478bd9Sstevel@tonic-gate do_subproc(char *cmdbuf) 17907c478bd9Sstevel@tonic-gate { 17917c478bd9Sstevel@tonic-gate char inbuf[1024]; /* arbitrary large amount */ 17927c478bd9Sstevel@tonic-gate FILE *file; 17937c478bd9Sstevel@tonic-gate 17949acbbeafSnn35248 do_subproc_cnt++; 17957c478bd9Sstevel@tonic-gate child_killed = B_FALSE; 17967c478bd9Sstevel@tonic-gate /* 17977c478bd9Sstevel@tonic-gate * We use popen(3c) to launch child processes for [un]install; 17987c478bd9Sstevel@tonic-gate * this library call does not return a PID, so we have to kill 17997c478bd9Sstevel@tonic-gate * the whole process group. To avoid killing our parent, we 18007c478bd9Sstevel@tonic-gate * become a process group leader here. But doing so can wreak 18017c478bd9Sstevel@tonic-gate * havoc with reading from stdin when launched by a non-job-control 18027c478bd9Sstevel@tonic-gate * shell, so we close stdin and reopen it as /dev/null first. 18037c478bd9Sstevel@tonic-gate */ 18047c478bd9Sstevel@tonic-gate (void) close(STDIN_FILENO); 18059acbbeafSnn35248 (void) openat(STDIN_FILENO, "/dev/null", O_RDONLY); 18069acbbeafSnn35248 if (!zoneadm_is_nested) 18077c478bd9Sstevel@tonic-gate (void) setpgid(0, 0); 18087c478bd9Sstevel@tonic-gate (void) sigset(SIGINT, sigterm); 18097c478bd9Sstevel@tonic-gate (void) sigset(SIGTERM, sigterm); 18107c478bd9Sstevel@tonic-gate file = popen(cmdbuf, "r"); 18117c478bd9Sstevel@tonic-gate for (;;) { 18127c478bd9Sstevel@tonic-gate if (child_killed || fgets(inbuf, sizeof (inbuf), file) == NULL) 18137c478bd9Sstevel@tonic-gate break; 18147c478bd9Sstevel@tonic-gate (void) fputs(inbuf, stdout); 18157c478bd9Sstevel@tonic-gate } 18167c478bd9Sstevel@tonic-gate (void) sigset(SIGINT, SIG_DFL); 18177c478bd9Sstevel@tonic-gate (void) sigset(SIGTERM, SIG_DFL); 18187c478bd9Sstevel@tonic-gate return (pclose(file)); 18197c478bd9Sstevel@tonic-gate } 18207c478bd9Sstevel@tonic-gate 18217c478bd9Sstevel@tonic-gate static int 18229acbbeafSnn35248 do_subproc_interactive(char *cmdbuf) 18239acbbeafSnn35248 { 18249acbbeafSnn35248 void (*saveint)(int); 18259acbbeafSnn35248 void (*saveterm)(int); 18269acbbeafSnn35248 void (*savequit)(int); 18279acbbeafSnn35248 void (*savehup)(int); 18289acbbeafSnn35248 int pid, child, status; 18299acbbeafSnn35248 18309acbbeafSnn35248 /* 18319acbbeafSnn35248 * do_subproc() links stdin to /dev/null, which would break any 18329acbbeafSnn35248 * interactive subprocess we try to launch here. Similarly, we 18339acbbeafSnn35248 * can't have been launched as a subprocess ourselves. 18349acbbeafSnn35248 */ 18359acbbeafSnn35248 assert(do_subproc_cnt == 0 && !zoneadm_is_nested); 18369acbbeafSnn35248 18379acbbeafSnn35248 if ((child = vfork()) == 0) { 18389acbbeafSnn35248 (void) execl("/bin/sh", "sh", "-c", cmdbuf, (char *)NULL); 18399acbbeafSnn35248 } 18409acbbeafSnn35248 18419acbbeafSnn35248 if (child == -1) 18429acbbeafSnn35248 return (-1); 18439acbbeafSnn35248 18449acbbeafSnn35248 saveint = sigset(SIGINT, SIG_IGN); 18459acbbeafSnn35248 saveterm = sigset(SIGTERM, SIG_IGN); 18469acbbeafSnn35248 savequit = sigset(SIGQUIT, SIG_IGN); 18479acbbeafSnn35248 savehup = sigset(SIGHUP, SIG_IGN); 18489acbbeafSnn35248 18499acbbeafSnn35248 while ((pid = waitpid(child, &status, 0)) != child && pid != -1) 18509acbbeafSnn35248 ; 18519acbbeafSnn35248 18529acbbeafSnn35248 (void) sigset(SIGINT, saveint); 18539acbbeafSnn35248 (void) sigset(SIGTERM, saveterm); 18549acbbeafSnn35248 (void) sigset(SIGQUIT, savequit); 18559acbbeafSnn35248 (void) sigset(SIGHUP, savehup); 18569acbbeafSnn35248 18579acbbeafSnn35248 return (pid == -1 ? -1 : status); 18589acbbeafSnn35248 } 18599acbbeafSnn35248 18609acbbeafSnn35248 static int 18619acbbeafSnn35248 subproc_status(const char *cmd, int status, boolean_t verbose_failure) 18627c478bd9Sstevel@tonic-gate { 18637c478bd9Sstevel@tonic-gate if (WIFEXITED(status)) { 18647c478bd9Sstevel@tonic-gate int exit_code = WEXITSTATUS(status); 18657c478bd9Sstevel@tonic-gate 18669acbbeafSnn35248 if ((verbose_failure) && (exit_code != ZONE_SUBPROC_OK)) 18677c478bd9Sstevel@tonic-gate zerror(gettext("'%s' failed with exit code %d."), cmd, 18687c478bd9Sstevel@tonic-gate exit_code); 18699acbbeafSnn35248 18709acbbeafSnn35248 return (exit_code); 18717c478bd9Sstevel@tonic-gate } else if (WIFSIGNALED(status)) { 18727c478bd9Sstevel@tonic-gate int signal = WTERMSIG(status); 18737c478bd9Sstevel@tonic-gate char sigstr[SIG2STR_MAX]; 18747c478bd9Sstevel@tonic-gate 18757c478bd9Sstevel@tonic-gate if (sig2str(signal, sigstr) == 0) { 18767c478bd9Sstevel@tonic-gate zerror(gettext("'%s' terminated by signal SIG%s."), cmd, 18777c478bd9Sstevel@tonic-gate sigstr); 18787c478bd9Sstevel@tonic-gate } else { 18797c478bd9Sstevel@tonic-gate zerror(gettext("'%s' terminated by an unknown signal."), 18807c478bd9Sstevel@tonic-gate cmd); 18817c478bd9Sstevel@tonic-gate } 18827c478bd9Sstevel@tonic-gate } else { 18837c478bd9Sstevel@tonic-gate zerror(gettext("'%s' failed for unknown reasons."), cmd); 18847c478bd9Sstevel@tonic-gate } 18859acbbeafSnn35248 18869acbbeafSnn35248 /* 18879acbbeafSnn35248 * Assume a subprocess that died due to a signal or an unknown error 18889acbbeafSnn35248 * should be considered an exit code of ZONE_SUBPROC_FATAL, as the 18899acbbeafSnn35248 * user will likely need to do some manual cleanup. 18909acbbeafSnn35248 */ 18919acbbeafSnn35248 return (ZONE_SUBPROC_FATAL); 18927c478bd9Sstevel@tonic-gate } 18937c478bd9Sstevel@tonic-gate 18947c478bd9Sstevel@tonic-gate /* 18957c478bd9Sstevel@tonic-gate * Various sanity checks; make sure: 18967c478bd9Sstevel@tonic-gate * 1. We're in the global zone. 18977c478bd9Sstevel@tonic-gate * 2. The calling user has sufficient privilege. 18987c478bd9Sstevel@tonic-gate * 3. The target zone is neither the global zone nor anything starting with 18997c478bd9Sstevel@tonic-gate * "SUNW". 19007c478bd9Sstevel@tonic-gate * 4a. If we're looking for a 'not running' (i.e., configured or installed) 19017c478bd9Sstevel@tonic-gate * zone, the name service knows about it. 19027c478bd9Sstevel@tonic-gate * 4b. For some operations which expect a zone not to be running, that it is 19037c478bd9Sstevel@tonic-gate * not already running (or ready). 19047c478bd9Sstevel@tonic-gate */ 19057c478bd9Sstevel@tonic-gate static int 19067c478bd9Sstevel@tonic-gate sanity_check(char *zone, int cmd_num, boolean_t running, 19079acbbeafSnn35248 boolean_t unsafe_when_running, boolean_t force) 19087c478bd9Sstevel@tonic-gate { 19097c478bd9Sstevel@tonic-gate zone_entry_t *zent; 19107c478bd9Sstevel@tonic-gate priv_set_t *privset; 19119acbbeafSnn35248 zone_state_t state, min_state; 1912108322fbScarlsonj char kernzone[ZONENAME_MAX]; 1913108322fbScarlsonj FILE *fp; 19147c478bd9Sstevel@tonic-gate 19157c478bd9Sstevel@tonic-gate if (getzoneid() != GLOBAL_ZONEID) { 1916ffbafc53Scomay switch (cmd_num) { 1917ffbafc53Scomay case CMD_HALT: 1918ffbafc53Scomay zerror(gettext("use %s to %s this zone."), "halt(1M)", 19197c478bd9Sstevel@tonic-gate cmd_to_str(cmd_num)); 1920ffbafc53Scomay break; 1921ffbafc53Scomay case CMD_REBOOT: 1922ffbafc53Scomay zerror(gettext("use %s to %s this zone."), 1923ffbafc53Scomay "reboot(1M)", cmd_to_str(cmd_num)); 1924ffbafc53Scomay break; 1925ffbafc53Scomay default: 1926ffbafc53Scomay zerror(gettext("must be in the global zone to %s a " 1927ffbafc53Scomay "zone."), cmd_to_str(cmd_num)); 1928ffbafc53Scomay break; 1929ffbafc53Scomay } 19307c478bd9Sstevel@tonic-gate return (Z_ERR); 19317c478bd9Sstevel@tonic-gate } 19327c478bd9Sstevel@tonic-gate 19337c478bd9Sstevel@tonic-gate if ((privset = priv_allocset()) == NULL) { 19347c478bd9Sstevel@tonic-gate zerror(gettext("%s failed"), "priv_allocset"); 19357c478bd9Sstevel@tonic-gate return (Z_ERR); 19367c478bd9Sstevel@tonic-gate } 19377c478bd9Sstevel@tonic-gate 19387c478bd9Sstevel@tonic-gate if (getppriv(PRIV_EFFECTIVE, privset) != 0) { 19397c478bd9Sstevel@tonic-gate zerror(gettext("%s failed"), "getppriv"); 19407c478bd9Sstevel@tonic-gate priv_freeset(privset); 19417c478bd9Sstevel@tonic-gate return (Z_ERR); 19427c478bd9Sstevel@tonic-gate } 19437c478bd9Sstevel@tonic-gate 19447c478bd9Sstevel@tonic-gate if (priv_isfullset(privset) == B_FALSE) { 19457c478bd9Sstevel@tonic-gate zerror(gettext("only a privileged user may %s a zone."), 19467c478bd9Sstevel@tonic-gate cmd_to_str(cmd_num)); 19477c478bd9Sstevel@tonic-gate priv_freeset(privset); 19487c478bd9Sstevel@tonic-gate return (Z_ERR); 19497c478bd9Sstevel@tonic-gate } 19507c478bd9Sstevel@tonic-gate priv_freeset(privset); 19517c478bd9Sstevel@tonic-gate 19527c478bd9Sstevel@tonic-gate if (zone == NULL) { 19537c478bd9Sstevel@tonic-gate zerror(gettext("no zone specified")); 19547c478bd9Sstevel@tonic-gate return (Z_ERR); 19557c478bd9Sstevel@tonic-gate } 19567c478bd9Sstevel@tonic-gate 19577c478bd9Sstevel@tonic-gate if (strcmp(zone, GLOBAL_ZONENAME) == 0) { 19587c478bd9Sstevel@tonic-gate zerror(gettext("%s operation is invalid for the global zone."), 19597c478bd9Sstevel@tonic-gate cmd_to_str(cmd_num)); 19607c478bd9Sstevel@tonic-gate return (Z_ERR); 19617c478bd9Sstevel@tonic-gate } 19627c478bd9Sstevel@tonic-gate 19637c478bd9Sstevel@tonic-gate if (strncmp(zone, "SUNW", 4) == 0) { 19647c478bd9Sstevel@tonic-gate zerror(gettext("%s operation is invalid for zones starting " 19657c478bd9Sstevel@tonic-gate "with SUNW."), cmd_to_str(cmd_num)); 19667c478bd9Sstevel@tonic-gate return (Z_ERR); 19677c478bd9Sstevel@tonic-gate } 19687c478bd9Sstevel@tonic-gate 1969*84561e8cStd153743 if (!is_native_zone && !is_cluster_zone && cmd_num == CMD_MOUNT) { 19709acbbeafSnn35248 zerror(gettext("%s operation is invalid for branded zones."), 19719acbbeafSnn35248 cmd_to_str(cmd_num)); 19729acbbeafSnn35248 return (Z_ERR); 19739acbbeafSnn35248 } 19749acbbeafSnn35248 1975108322fbScarlsonj if (!zonecfg_in_alt_root()) { 1976108322fbScarlsonj zent = lookup_running_zone(zone); 1977108322fbScarlsonj } else if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) { 1978108322fbScarlsonj zent = NULL; 1979108322fbScarlsonj } else { 1980108322fbScarlsonj if (zonecfg_find_scratch(fp, zone, zonecfg_get_root(), 1981108322fbScarlsonj kernzone, sizeof (kernzone)) == 0) 1982108322fbScarlsonj zent = lookup_running_zone(kernzone); 1983108322fbScarlsonj else 1984108322fbScarlsonj zent = NULL; 1985108322fbScarlsonj zonecfg_close_scratch(fp); 1986108322fbScarlsonj } 1987108322fbScarlsonj 19887c478bd9Sstevel@tonic-gate /* 19897c478bd9Sstevel@tonic-gate * Look up from the kernel for 'running' zones. 19907c478bd9Sstevel@tonic-gate */ 19919acbbeafSnn35248 if (running && !force) { 19927c478bd9Sstevel@tonic-gate if (zent == NULL) { 19937c478bd9Sstevel@tonic-gate zerror(gettext("not running")); 19947c478bd9Sstevel@tonic-gate return (Z_ERR); 19957c478bd9Sstevel@tonic-gate } 19967c478bd9Sstevel@tonic-gate } else { 19977c478bd9Sstevel@tonic-gate int err; 19987c478bd9Sstevel@tonic-gate 19997c478bd9Sstevel@tonic-gate if (unsafe_when_running && zent != NULL) { 20007c478bd9Sstevel@tonic-gate /* check whether the zone is ready or running */ 20017c478bd9Sstevel@tonic-gate if ((err = zone_get_state(zent->zname, 20027c478bd9Sstevel@tonic-gate &zent->zstate_num)) != Z_OK) { 20037c478bd9Sstevel@tonic-gate errno = err; 20047c478bd9Sstevel@tonic-gate zperror2(zent->zname, 20057c478bd9Sstevel@tonic-gate gettext("could not get state")); 20067c478bd9Sstevel@tonic-gate /* can't tell, so hedge */ 20077c478bd9Sstevel@tonic-gate zent->zstate_str = "ready/running"; 20087c478bd9Sstevel@tonic-gate } else { 20097c478bd9Sstevel@tonic-gate zent->zstate_str = 20107c478bd9Sstevel@tonic-gate zone_state_str(zent->zstate_num); 20117c478bd9Sstevel@tonic-gate } 20127c478bd9Sstevel@tonic-gate zerror(gettext("%s operation is invalid for %s zones."), 20137c478bd9Sstevel@tonic-gate cmd_to_str(cmd_num), zent->zstate_str); 20147c478bd9Sstevel@tonic-gate return (Z_ERR); 20157c478bd9Sstevel@tonic-gate } 20167c478bd9Sstevel@tonic-gate if ((err = zone_get_state(zone, &state)) != Z_OK) { 20177c478bd9Sstevel@tonic-gate errno = err; 20187c478bd9Sstevel@tonic-gate zperror2(zone, gettext("could not get state")); 20197c478bd9Sstevel@tonic-gate return (Z_ERR); 20207c478bd9Sstevel@tonic-gate } 20217c478bd9Sstevel@tonic-gate switch (cmd_num) { 20227c478bd9Sstevel@tonic-gate case CMD_UNINSTALL: 20237c478bd9Sstevel@tonic-gate if (state == ZONE_STATE_CONFIGURED) { 20247c478bd9Sstevel@tonic-gate zerror(gettext("is already in state '%s'."), 20257c478bd9Sstevel@tonic-gate zone_state_str(ZONE_STATE_CONFIGURED)); 20267c478bd9Sstevel@tonic-gate return (Z_ERR); 20277c478bd9Sstevel@tonic-gate } 20287c478bd9Sstevel@tonic-gate break; 2029ee519a1fSgjelinek case CMD_ATTACH: 2030865e09a4Sgjelinek case CMD_CLONE: 20317c478bd9Sstevel@tonic-gate case CMD_INSTALL: 20327c478bd9Sstevel@tonic-gate if (state == ZONE_STATE_INSTALLED) { 20337c478bd9Sstevel@tonic-gate zerror(gettext("is already %s."), 20347c478bd9Sstevel@tonic-gate zone_state_str(ZONE_STATE_INSTALLED)); 20357c478bd9Sstevel@tonic-gate return (Z_ERR); 20367c478bd9Sstevel@tonic-gate } else if (state == ZONE_STATE_INCOMPLETE) { 20377c478bd9Sstevel@tonic-gate zerror(gettext("zone is %s; %s required."), 20387c478bd9Sstevel@tonic-gate zone_state_str(ZONE_STATE_INCOMPLETE), 20397c478bd9Sstevel@tonic-gate cmd_to_str(CMD_UNINSTALL)); 20407c478bd9Sstevel@tonic-gate return (Z_ERR); 20417c478bd9Sstevel@tonic-gate } 20427c478bd9Sstevel@tonic-gate break; 2043ee519a1fSgjelinek case CMD_DETACH: 2044865e09a4Sgjelinek case CMD_MOVE: 20457c478bd9Sstevel@tonic-gate case CMD_READY: 20467c478bd9Sstevel@tonic-gate case CMD_BOOT: 2047108322fbScarlsonj case CMD_MOUNT: 2048555afedfScarlsonj case CMD_MARK: 20499acbbeafSnn35248 if ((cmd_num == CMD_BOOT || cmd_num == CMD_MOUNT) && 20509acbbeafSnn35248 force) 20519acbbeafSnn35248 min_state = ZONE_STATE_INCOMPLETE; 20529acbbeafSnn35248 else 20539acbbeafSnn35248 min_state = ZONE_STATE_INSTALLED; 20549acbbeafSnn35248 20559acbbeafSnn35248 if (force && cmd_num == CMD_BOOT && is_native_zone) { 20569acbbeafSnn35248 zerror(gettext("Only branded zones may be " 20579acbbeafSnn35248 "force-booted.")); 20589acbbeafSnn35248 return (Z_ERR); 20599acbbeafSnn35248 } 20609acbbeafSnn35248 20619acbbeafSnn35248 if (state < min_state) { 20627c478bd9Sstevel@tonic-gate zerror(gettext("must be %s before %s."), 20639acbbeafSnn35248 zone_state_str(min_state), 20647c478bd9Sstevel@tonic-gate cmd_to_str(cmd_num)); 20657c478bd9Sstevel@tonic-gate return (Z_ERR); 20667c478bd9Sstevel@tonic-gate } 20677c478bd9Sstevel@tonic-gate break; 20687c478bd9Sstevel@tonic-gate case CMD_VERIFY: 20697c478bd9Sstevel@tonic-gate if (state == ZONE_STATE_INCOMPLETE) { 20707c478bd9Sstevel@tonic-gate zerror(gettext("zone is %s; %s required."), 20717c478bd9Sstevel@tonic-gate zone_state_str(ZONE_STATE_INCOMPLETE), 20727c478bd9Sstevel@tonic-gate cmd_to_str(CMD_UNINSTALL)); 20737c478bd9Sstevel@tonic-gate return (Z_ERR); 20747c478bd9Sstevel@tonic-gate } 20757c478bd9Sstevel@tonic-gate break; 2076108322fbScarlsonj case CMD_UNMOUNT: 2077108322fbScarlsonj if (state != ZONE_STATE_MOUNTED) { 2078108322fbScarlsonj zerror(gettext("must be %s before %s."), 2079108322fbScarlsonj zone_state_str(ZONE_STATE_MOUNTED), 2080108322fbScarlsonj cmd_to_str(cmd_num)); 2081108322fbScarlsonj return (Z_ERR); 2082108322fbScarlsonj } 2083108322fbScarlsonj break; 20847c478bd9Sstevel@tonic-gate } 20857c478bd9Sstevel@tonic-gate } 20867c478bd9Sstevel@tonic-gate return (Z_OK); 20877c478bd9Sstevel@tonic-gate } 20887c478bd9Sstevel@tonic-gate 20897c478bd9Sstevel@tonic-gate static int 20907c478bd9Sstevel@tonic-gate halt_func(int argc, char *argv[]) 20917c478bd9Sstevel@tonic-gate { 20927c478bd9Sstevel@tonic-gate zone_cmd_arg_t zarg; 20937c478bd9Sstevel@tonic-gate int arg; 20947c478bd9Sstevel@tonic-gate 2095108322fbScarlsonj if (zonecfg_in_alt_root()) { 2096108322fbScarlsonj zerror(gettext("cannot halt zone in alternate root")); 2097108322fbScarlsonj return (Z_ERR); 2098108322fbScarlsonj } 2099108322fbScarlsonj 21007c478bd9Sstevel@tonic-gate optind = 0; 21017c478bd9Sstevel@tonic-gate if ((arg = getopt(argc, argv, "?")) != EOF) { 21027c478bd9Sstevel@tonic-gate switch (arg) { 21037c478bd9Sstevel@tonic-gate case '?': 21047c478bd9Sstevel@tonic-gate sub_usage(SHELP_HALT, CMD_HALT); 21057c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 21067c478bd9Sstevel@tonic-gate default: 21077c478bd9Sstevel@tonic-gate sub_usage(SHELP_HALT, CMD_HALT); 21087c478bd9Sstevel@tonic-gate return (Z_USAGE); 21097c478bd9Sstevel@tonic-gate } 21107c478bd9Sstevel@tonic-gate } 21117c478bd9Sstevel@tonic-gate if (argc > optind) { 21127c478bd9Sstevel@tonic-gate sub_usage(SHELP_HALT, CMD_HALT); 21137c478bd9Sstevel@tonic-gate return (Z_USAGE); 21147c478bd9Sstevel@tonic-gate } 21157c478bd9Sstevel@tonic-gate /* 21167c478bd9Sstevel@tonic-gate * zoneadmd should be the one to decide whether or not to proceed, 21177c478bd9Sstevel@tonic-gate * so even though it seems that the fourth parameter below should 21187c478bd9Sstevel@tonic-gate * perhaps be B_TRUE, it really shouldn't be. 21197c478bd9Sstevel@tonic-gate */ 21209acbbeafSnn35248 if (sanity_check(target_zone, CMD_HALT, B_FALSE, B_FALSE, B_FALSE) 21219acbbeafSnn35248 != Z_OK) 21227c478bd9Sstevel@tonic-gate return (Z_ERR); 21237c478bd9Sstevel@tonic-gate 2124ce28b40eSzt129084 /* 2125ce28b40eSzt129084 * Invoke brand-specific handler. 2126ce28b40eSzt129084 */ 2127ce28b40eSzt129084 if (invoke_brand_handler(CMD_HALT, argv) != Z_OK) 2128ce28b40eSzt129084 return (Z_ERR); 2129ce28b40eSzt129084 21307c478bd9Sstevel@tonic-gate zarg.cmd = Z_HALT; 21317c478bd9Sstevel@tonic-gate return ((call_zoneadmd(target_zone, &zarg) == 0) ? Z_OK : Z_ERR); 21327c478bd9Sstevel@tonic-gate } 21337c478bd9Sstevel@tonic-gate 21347c478bd9Sstevel@tonic-gate static int 21357c478bd9Sstevel@tonic-gate reboot_func(int argc, char *argv[]) 21367c478bd9Sstevel@tonic-gate { 21377c478bd9Sstevel@tonic-gate zone_cmd_arg_t zarg; 21387c478bd9Sstevel@tonic-gate int arg; 21397c478bd9Sstevel@tonic-gate 2140108322fbScarlsonj if (zonecfg_in_alt_root()) { 2141108322fbScarlsonj zerror(gettext("cannot reboot zone in alternate root")); 2142108322fbScarlsonj return (Z_ERR); 2143108322fbScarlsonj } 2144108322fbScarlsonj 21457c478bd9Sstevel@tonic-gate optind = 0; 21467c478bd9Sstevel@tonic-gate if ((arg = getopt(argc, argv, "?")) != EOF) { 21477c478bd9Sstevel@tonic-gate switch (arg) { 21487c478bd9Sstevel@tonic-gate case '?': 21497c478bd9Sstevel@tonic-gate sub_usage(SHELP_REBOOT, CMD_REBOOT); 21507c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 21517c478bd9Sstevel@tonic-gate default: 21527c478bd9Sstevel@tonic-gate sub_usage(SHELP_REBOOT, CMD_REBOOT); 21537c478bd9Sstevel@tonic-gate return (Z_USAGE); 21547c478bd9Sstevel@tonic-gate } 21557c478bd9Sstevel@tonic-gate } 21563f2f09c1Sdp 21573f2f09c1Sdp zarg.bootbuf[0] = '\0'; 21583f2f09c1Sdp for (; optind < argc; optind++) { 21593f2f09c1Sdp if (strlcat(zarg.bootbuf, argv[optind], 21603f2f09c1Sdp sizeof (zarg.bootbuf)) >= sizeof (zarg.bootbuf)) { 21613f2f09c1Sdp zerror(gettext("Boot argument list too long")); 21623f2f09c1Sdp return (Z_ERR); 21637c478bd9Sstevel@tonic-gate } 21643f2f09c1Sdp if (optind < argc - 1) 21653f2f09c1Sdp if (strlcat(zarg.bootbuf, " ", sizeof (zarg.bootbuf)) >= 21663f2f09c1Sdp sizeof (zarg.bootbuf)) { 21673f2f09c1Sdp zerror(gettext("Boot argument list too long")); 21683f2f09c1Sdp return (Z_ERR); 21693f2f09c1Sdp } 21703f2f09c1Sdp } 21713f2f09c1Sdp 21723f2f09c1Sdp 21737c478bd9Sstevel@tonic-gate /* 21747c478bd9Sstevel@tonic-gate * zoneadmd should be the one to decide whether or not to proceed, 21757c478bd9Sstevel@tonic-gate * so even though it seems that the fourth parameter below should 21767c478bd9Sstevel@tonic-gate * perhaps be B_TRUE, it really shouldn't be. 21777c478bd9Sstevel@tonic-gate */ 21789acbbeafSnn35248 if (sanity_check(target_zone, CMD_REBOOT, B_TRUE, B_FALSE, B_FALSE) 21799acbbeafSnn35248 != Z_OK) 21807c478bd9Sstevel@tonic-gate return (Z_ERR); 2181ce28b40eSzt129084 if (verify_details(CMD_REBOOT, argv) != Z_OK) 2182b5abaf04Sgjelinek return (Z_ERR); 21837c478bd9Sstevel@tonic-gate 21847c478bd9Sstevel@tonic-gate zarg.cmd = Z_REBOOT; 21857c478bd9Sstevel@tonic-gate return ((call_zoneadmd(target_zone, &zarg) == 0) ? Z_OK : Z_ERR); 21867c478bd9Sstevel@tonic-gate } 21877c478bd9Sstevel@tonic-gate 21887c478bd9Sstevel@tonic-gate static int 2189ce28b40eSzt129084 verify_brand(zone_dochandle_t handle, int cmd_num, char *argv[]) 21909acbbeafSnn35248 { 21919acbbeafSnn35248 char cmdbuf[MAXPATHLEN]; 21929acbbeafSnn35248 int err; 21939acbbeafSnn35248 char zonepath[MAXPATHLEN]; 2194123807fbSedp brand_handle_t bh = NULL; 2195ce28b40eSzt129084 int status, i; 21969acbbeafSnn35248 21979acbbeafSnn35248 /* 21989acbbeafSnn35248 * Fetch the verify command from the brand configuration. 21999acbbeafSnn35248 * "exec" the command so that the returned status is that of 22009acbbeafSnn35248 * the command and not the shell. 22019acbbeafSnn35248 */ 22029acbbeafSnn35248 if ((err = zonecfg_get_zonepath(handle, zonepath, sizeof (zonepath))) != 22039acbbeafSnn35248 Z_OK) { 22049acbbeafSnn35248 errno = err; 2205ce28b40eSzt129084 zperror(cmd_to_str(cmd_num), B_TRUE); 22069acbbeafSnn35248 return (Z_ERR); 22079acbbeafSnn35248 } 2208123807fbSedp if ((bh = brand_open(target_brand)) == NULL) { 22099acbbeafSnn35248 zerror(gettext("missing or invalid brand")); 22109acbbeafSnn35248 return (Z_ERR); 22119acbbeafSnn35248 } 22129acbbeafSnn35248 22139acbbeafSnn35248 /* 22149acbbeafSnn35248 * If the brand has its own verification routine, execute it now. 2215ce28b40eSzt129084 * The verification routine validates the intended zoneadm 2216ce28b40eSzt129084 * operation for the specific brand. The zoneadm subcommand and 2217ce28b40eSzt129084 * all its arguments are passed to the routine. 22189acbbeafSnn35248 */ 22199acbbeafSnn35248 (void) strcpy(cmdbuf, EXEC_PREFIX); 2220123807fbSedp err = brand_get_verify_adm(bh, target_zone, zonepath, 22219acbbeafSnn35248 cmdbuf + EXEC_LEN, sizeof (cmdbuf) - EXEC_LEN, 0, NULL); 2222123807fbSedp brand_close(bh); 2223ce28b40eSzt129084 if (err != 0) 2224ce28b40eSzt129084 return (Z_BRAND_ERROR); 2225ce28b40eSzt129084 if (strlen(cmdbuf) <= EXEC_LEN) 2226ce28b40eSzt129084 return (Z_OK); 2227ce28b40eSzt129084 2228ce28b40eSzt129084 if (strlcat(cmdbuf, cmd_to_str(cmd_num), 2229ce28b40eSzt129084 sizeof (cmdbuf)) >= sizeof (cmdbuf)) 2230ce28b40eSzt129084 return (Z_ERR); 2231ce28b40eSzt129084 2232ce28b40eSzt129084 /* Build the argv string */ 2233ce28b40eSzt129084 i = 0; 2234ce28b40eSzt129084 while (argv[i] != NULL) { 2235ce28b40eSzt129084 if ((strlcat(cmdbuf, " ", 2236ce28b40eSzt129084 sizeof (cmdbuf)) >= sizeof (cmdbuf)) || 2237ce28b40eSzt129084 (strlcat(cmdbuf, argv[i++], 2238ce28b40eSzt129084 sizeof (cmdbuf)) >= sizeof (cmdbuf))) 2239ce28b40eSzt129084 return (Z_ERR); 2240ce28b40eSzt129084 } 2241ce28b40eSzt129084 2242d9e728a2Sgjelinek if (zoneadm_is_nested) 2243d9e728a2Sgjelinek status = do_subproc(cmdbuf); 2244d9e728a2Sgjelinek else 22459acbbeafSnn35248 status = do_subproc_interactive(cmdbuf); 22469acbbeafSnn35248 err = subproc_status(gettext("brand-specific verification"), 22479acbbeafSnn35248 status, B_FALSE); 22489acbbeafSnn35248 2249ce28b40eSzt129084 return ((err == ZONE_SUBPROC_OK) ? Z_OK : Z_BRAND_ERROR); 22509acbbeafSnn35248 } 22519acbbeafSnn35248 22529acbbeafSnn35248 static int 22537c478bd9Sstevel@tonic-gate verify_rctls(zone_dochandle_t handle) 22547c478bd9Sstevel@tonic-gate { 22557c478bd9Sstevel@tonic-gate struct zone_rctltab rctltab; 22567c478bd9Sstevel@tonic-gate size_t rbs = rctlblk_size(); 22577c478bd9Sstevel@tonic-gate rctlblk_t *rctlblk; 22587c478bd9Sstevel@tonic-gate int error = Z_INVAL; 22597c478bd9Sstevel@tonic-gate 22607c478bd9Sstevel@tonic-gate if ((rctlblk = malloc(rbs)) == NULL) { 22617c478bd9Sstevel@tonic-gate zerror(gettext("failed to allocate %lu bytes: %s"), rbs, 22627c478bd9Sstevel@tonic-gate strerror(errno)); 22637c478bd9Sstevel@tonic-gate return (Z_NOMEM); 22647c478bd9Sstevel@tonic-gate } 22657c478bd9Sstevel@tonic-gate 22667c478bd9Sstevel@tonic-gate if (zonecfg_setrctlent(handle) != Z_OK) { 22677c478bd9Sstevel@tonic-gate zerror(gettext("zonecfg_setrctlent failed")); 22687c478bd9Sstevel@tonic-gate free(rctlblk); 22697c478bd9Sstevel@tonic-gate return (error); 22707c478bd9Sstevel@tonic-gate } 22717c478bd9Sstevel@tonic-gate 22727c478bd9Sstevel@tonic-gate rctltab.zone_rctl_valptr = NULL; 22737c478bd9Sstevel@tonic-gate while (zonecfg_getrctlent(handle, &rctltab) == Z_OK) { 22747c478bd9Sstevel@tonic-gate struct zone_rctlvaltab *rctlval; 22757c478bd9Sstevel@tonic-gate const char *name = rctltab.zone_rctl_name; 22767c478bd9Sstevel@tonic-gate 22777c478bd9Sstevel@tonic-gate if (!zonecfg_is_rctl(name)) { 22787c478bd9Sstevel@tonic-gate zerror(gettext("WARNING: Ignoring unrecognized rctl " 22797c478bd9Sstevel@tonic-gate "'%s'."), name); 22807c478bd9Sstevel@tonic-gate zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr); 22817c478bd9Sstevel@tonic-gate rctltab.zone_rctl_valptr = NULL; 22827c478bd9Sstevel@tonic-gate continue; 22837c478bd9Sstevel@tonic-gate } 22847c478bd9Sstevel@tonic-gate 22857c478bd9Sstevel@tonic-gate for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL; 22867c478bd9Sstevel@tonic-gate rctlval = rctlval->zone_rctlval_next) { 22877c478bd9Sstevel@tonic-gate if (zonecfg_construct_rctlblk(rctlval, rctlblk) 22887c478bd9Sstevel@tonic-gate != Z_OK) { 22897c478bd9Sstevel@tonic-gate zerror(gettext("invalid rctl value: " 22907c478bd9Sstevel@tonic-gate "(priv=%s,limit=%s,action%s)"), 22917c478bd9Sstevel@tonic-gate rctlval->zone_rctlval_priv, 22927c478bd9Sstevel@tonic-gate rctlval->zone_rctlval_limit, 22937c478bd9Sstevel@tonic-gate rctlval->zone_rctlval_action); 22947c478bd9Sstevel@tonic-gate goto out; 22957c478bd9Sstevel@tonic-gate } 22967c478bd9Sstevel@tonic-gate if (!zonecfg_valid_rctl(name, rctlblk)) { 22977c478bd9Sstevel@tonic-gate zerror(gettext("(priv=%s,limit=%s,action=%s) " 22987c478bd9Sstevel@tonic-gate "is not a valid value for rctl '%s'"), 22997c478bd9Sstevel@tonic-gate rctlval->zone_rctlval_priv, 23007c478bd9Sstevel@tonic-gate rctlval->zone_rctlval_limit, 23017c478bd9Sstevel@tonic-gate rctlval->zone_rctlval_action, 23027c478bd9Sstevel@tonic-gate name); 23037c478bd9Sstevel@tonic-gate goto out; 23047c478bd9Sstevel@tonic-gate } 23057c478bd9Sstevel@tonic-gate } 23067c478bd9Sstevel@tonic-gate zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr); 23077c478bd9Sstevel@tonic-gate } 23087c478bd9Sstevel@tonic-gate rctltab.zone_rctl_valptr = NULL; 23097c478bd9Sstevel@tonic-gate error = Z_OK; 23107c478bd9Sstevel@tonic-gate out: 23117c478bd9Sstevel@tonic-gate zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr); 23127c478bd9Sstevel@tonic-gate (void) zonecfg_endrctlent(handle); 23137c478bd9Sstevel@tonic-gate free(rctlblk); 23147c478bd9Sstevel@tonic-gate return (error); 23157c478bd9Sstevel@tonic-gate } 23167c478bd9Sstevel@tonic-gate 23177c478bd9Sstevel@tonic-gate static int 23187c478bd9Sstevel@tonic-gate verify_pool(zone_dochandle_t handle) 23197c478bd9Sstevel@tonic-gate { 23207c478bd9Sstevel@tonic-gate char poolname[MAXPATHLEN]; 23217c478bd9Sstevel@tonic-gate pool_conf_t *poolconf; 23227c478bd9Sstevel@tonic-gate pool_t *pool; 23237c478bd9Sstevel@tonic-gate int status; 23247c478bd9Sstevel@tonic-gate int error; 23257c478bd9Sstevel@tonic-gate 23267c478bd9Sstevel@tonic-gate /* 23277c478bd9Sstevel@tonic-gate * This ends up being very similar to the check done in zoneadmd. 23287c478bd9Sstevel@tonic-gate */ 23297c478bd9Sstevel@tonic-gate error = zonecfg_get_pool(handle, poolname, sizeof (poolname)); 23307c478bd9Sstevel@tonic-gate if (error == Z_NO_ENTRY || (error == Z_OK && strlen(poolname) == 0)) { 23317c478bd9Sstevel@tonic-gate /* 23327c478bd9Sstevel@tonic-gate * No pool specified. 23337c478bd9Sstevel@tonic-gate */ 23347c478bd9Sstevel@tonic-gate return (0); 23357c478bd9Sstevel@tonic-gate } 23367c478bd9Sstevel@tonic-gate if (error != Z_OK) { 23377c478bd9Sstevel@tonic-gate zperror(gettext("Unable to retrieve pool name from " 23387c478bd9Sstevel@tonic-gate "configuration"), B_TRUE); 23397c478bd9Sstevel@tonic-gate return (error); 23407c478bd9Sstevel@tonic-gate } 23417c478bd9Sstevel@tonic-gate /* 23427c478bd9Sstevel@tonic-gate * Don't do anything if pools aren't enabled. 23437c478bd9Sstevel@tonic-gate */ 23447c478bd9Sstevel@tonic-gate if (pool_get_status(&status) != PO_SUCCESS || status != POOL_ENABLED) { 23457c478bd9Sstevel@tonic-gate zerror(gettext("WARNING: pools facility not active; " 23467c478bd9Sstevel@tonic-gate "zone will not be bound to pool '%s'."), poolname); 23477c478bd9Sstevel@tonic-gate return (Z_OK); 23487c478bd9Sstevel@tonic-gate } 23497c478bd9Sstevel@tonic-gate /* 23507c478bd9Sstevel@tonic-gate * Try to provide a sane error message if the requested pool doesn't 23517c478bd9Sstevel@tonic-gate * exist. It isn't clear that pools-related failures should 23527c478bd9Sstevel@tonic-gate * necessarily translate to a failure to verify the zone configuration, 23537c478bd9Sstevel@tonic-gate * hence they are not considered errors. 23547c478bd9Sstevel@tonic-gate */ 23557c478bd9Sstevel@tonic-gate if ((poolconf = pool_conf_alloc()) == NULL) { 23567c478bd9Sstevel@tonic-gate zerror(gettext("WARNING: pool_conf_alloc failed; " 23577c478bd9Sstevel@tonic-gate "using default pool")); 23587c478bd9Sstevel@tonic-gate return (Z_OK); 23597c478bd9Sstevel@tonic-gate } 23607c478bd9Sstevel@tonic-gate if (pool_conf_open(poolconf, pool_dynamic_location(), PO_RDONLY) != 23617c478bd9Sstevel@tonic-gate PO_SUCCESS) { 23627c478bd9Sstevel@tonic-gate zerror(gettext("WARNING: pool_conf_open failed; " 23637c478bd9Sstevel@tonic-gate "using default pool")); 23647c478bd9Sstevel@tonic-gate pool_conf_free(poolconf); 23657c478bd9Sstevel@tonic-gate return (Z_OK); 23667c478bd9Sstevel@tonic-gate } 23677c478bd9Sstevel@tonic-gate pool = pool_get_pool(poolconf, poolname); 23687c478bd9Sstevel@tonic-gate (void) pool_conf_close(poolconf); 23697c478bd9Sstevel@tonic-gate pool_conf_free(poolconf); 23707c478bd9Sstevel@tonic-gate if (pool == NULL) { 23717c478bd9Sstevel@tonic-gate zerror(gettext("WARNING: pool '%s' not found. " 23727c478bd9Sstevel@tonic-gate "using default pool"), poolname); 23737c478bd9Sstevel@tonic-gate } 23747c478bd9Sstevel@tonic-gate 23757c478bd9Sstevel@tonic-gate return (Z_OK); 23767c478bd9Sstevel@tonic-gate } 23777c478bd9Sstevel@tonic-gate 23787c478bd9Sstevel@tonic-gate static int 2379b5abaf04Sgjelinek verify_ipd(zone_dochandle_t handle) 2380b5abaf04Sgjelinek { 2381b5abaf04Sgjelinek int return_code = Z_OK; 2382b5abaf04Sgjelinek struct zone_fstab fstab; 2383b5abaf04Sgjelinek struct stat st; 2384b5abaf04Sgjelinek char specdir[MAXPATHLEN]; 2385b5abaf04Sgjelinek 2386b5abaf04Sgjelinek if (zonecfg_setipdent(handle) != Z_OK) { 23875ee84fbdSgjelinek /* 23885ee84fbdSgjelinek * TRANSLATION_NOTE 23895ee84fbdSgjelinek * inherit-pkg-dirs is a literal that should not be translated. 23905ee84fbdSgjelinek */ 23915ee84fbdSgjelinek (void) fprintf(stderr, gettext("could not verify " 2392b5abaf04Sgjelinek "inherit-pkg-dirs: unable to enumerate mounts\n")); 2393b5abaf04Sgjelinek return (Z_ERR); 2394b5abaf04Sgjelinek } 2395b5abaf04Sgjelinek while (zonecfg_getipdent(handle, &fstab) == Z_OK) { 2396b5abaf04Sgjelinek /* 2397b5abaf04Sgjelinek * Verify fs_dir exists. 2398b5abaf04Sgjelinek */ 2399b5abaf04Sgjelinek (void) snprintf(specdir, sizeof (specdir), "%s%s", 2400b5abaf04Sgjelinek zonecfg_get_root(), fstab.zone_fs_dir); 2401b5abaf04Sgjelinek if (stat(specdir, &st) != 0) { 24025ee84fbdSgjelinek /* 24035ee84fbdSgjelinek * TRANSLATION_NOTE 24045ee84fbdSgjelinek * inherit-pkg-dir is a literal that should not be 24055ee84fbdSgjelinek * translated. 24065ee84fbdSgjelinek */ 24075ee84fbdSgjelinek (void) fprintf(stderr, gettext("could not verify " 2408b5abaf04Sgjelinek "inherit-pkg-dir %s: %s\n"), 2409b5abaf04Sgjelinek fstab.zone_fs_dir, strerror(errno)); 2410b5abaf04Sgjelinek return_code = Z_ERR; 2411b5abaf04Sgjelinek } 2412b5abaf04Sgjelinek if (strcmp(st.st_fstype, MNTTYPE_NFS) == 0) { 24135ee84fbdSgjelinek /* 24145ee84fbdSgjelinek * TRANSLATION_NOTE 24155ee84fbdSgjelinek * inherit-pkg-dir and NFS are literals that should 24165ee84fbdSgjelinek * not be translated. 24175ee84fbdSgjelinek */ 2418b5abaf04Sgjelinek (void) fprintf(stderr, gettext("cannot verify " 24190b5de56dSgjelinek "inherit-pkg-dir %s: NFS mounted file system.\n" 24200b5de56dSgjelinek "\tA local file system must be used.\n"), 2421b5abaf04Sgjelinek fstab.zone_fs_dir); 2422b5abaf04Sgjelinek return_code = Z_ERR; 2423b5abaf04Sgjelinek } 2424b5abaf04Sgjelinek } 2425b5abaf04Sgjelinek (void) zonecfg_endipdent(handle); 2426b5abaf04Sgjelinek 2427b5abaf04Sgjelinek return (return_code); 2428b5abaf04Sgjelinek } 2429b5abaf04Sgjelinek 243020c8013fSlling /* 243120c8013fSlling * Verify that the special device/file system exists and is valid. 243220c8013fSlling */ 243320c8013fSlling static int 243420c8013fSlling verify_fs_special(struct zone_fstab *fstab) 243520c8013fSlling { 243620c8013fSlling struct stat st; 243720c8013fSlling 24386cc813faSgjelinek /* 24396cc813faSgjelinek * This validation is really intended for standard zone administration. 24406cc813faSgjelinek * If we are in a mini-root or some other upgrade situation where 24416cc813faSgjelinek * we are using the scratch zone, just by-pass this. 24426cc813faSgjelinek */ 24436cc813faSgjelinek if (zonecfg_in_alt_root()) 24446cc813faSgjelinek return (Z_OK); 24456cc813faSgjelinek 244620c8013fSlling if (strcmp(fstab->zone_fs_type, MNTTYPE_ZFS) == 0) 244720c8013fSlling return (verify_fs_zfs(fstab)); 244820c8013fSlling 244920c8013fSlling if (stat(fstab->zone_fs_special, &st) != 0) { 24505c358068Slling (void) fprintf(stderr, gettext("could not verify fs " 245120c8013fSlling "%s: could not access %s: %s\n"), fstab->zone_fs_dir, 245220c8013fSlling fstab->zone_fs_special, strerror(errno)); 245320c8013fSlling return (Z_ERR); 245420c8013fSlling } 245520c8013fSlling 245620c8013fSlling if (strcmp(st.st_fstype, MNTTYPE_NFS) == 0) { 245720c8013fSlling /* 245820c8013fSlling * TRANSLATION_NOTE 245920c8013fSlling * fs and NFS are literals that should 246020c8013fSlling * not be translated. 246120c8013fSlling */ 246220c8013fSlling (void) fprintf(stderr, gettext("cannot verify " 24630b5de56dSgjelinek "fs %s: NFS mounted file system.\n" 24640b5de56dSgjelinek "\tA local file system must be used.\n"), 246520c8013fSlling fstab->zone_fs_special); 246620c8013fSlling return (Z_ERR); 246720c8013fSlling } 246820c8013fSlling 246920c8013fSlling return (Z_OK); 247020c8013fSlling } 247120c8013fSlling 2472b5abaf04Sgjelinek static int 24737c478bd9Sstevel@tonic-gate verify_filesystems(zone_dochandle_t handle) 24747c478bd9Sstevel@tonic-gate { 24757c478bd9Sstevel@tonic-gate int return_code = Z_OK; 24767c478bd9Sstevel@tonic-gate struct zone_fstab fstab; 24777c478bd9Sstevel@tonic-gate char cmdbuf[MAXPATHLEN]; 24787c478bd9Sstevel@tonic-gate struct stat st; 24797c478bd9Sstevel@tonic-gate 24807c478bd9Sstevel@tonic-gate /* 24817c478bd9Sstevel@tonic-gate * No need to verify inherit-pkg-dir fs types, as their type is 24827c478bd9Sstevel@tonic-gate * implicitly lofs, which is known. Therefore, the types are only 24837c478bd9Sstevel@tonic-gate * verified for regular file systems below. 24847c478bd9Sstevel@tonic-gate * 24857c478bd9Sstevel@tonic-gate * Since the actual mount point is not known until the dependent mounts 24867c478bd9Sstevel@tonic-gate * are performed, we don't attempt any path validation here: that will 24877c478bd9Sstevel@tonic-gate * happen later when zoneadmd actually does the mounts. 24887c478bd9Sstevel@tonic-gate */ 24897c478bd9Sstevel@tonic-gate if (zonecfg_setfsent(handle) != Z_OK) { 24900b5de56dSgjelinek (void) fprintf(stderr, gettext("could not verify file systems: " 24917c478bd9Sstevel@tonic-gate "unable to enumerate mounts\n")); 24927c478bd9Sstevel@tonic-gate return (Z_ERR); 24937c478bd9Sstevel@tonic-gate } 24947c478bd9Sstevel@tonic-gate while (zonecfg_getfsent(handle, &fstab) == Z_OK) { 24957c478bd9Sstevel@tonic-gate if (!zonecfg_valid_fs_type(fstab.zone_fs_type)) { 24967c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("cannot verify fs %s: " 24977c478bd9Sstevel@tonic-gate "type %s is not allowed.\n"), fstab.zone_fs_dir, 24987c478bd9Sstevel@tonic-gate fstab.zone_fs_type); 24997c478bd9Sstevel@tonic-gate return_code = Z_ERR; 25007c478bd9Sstevel@tonic-gate goto next_fs; 25017c478bd9Sstevel@tonic-gate } 25027c478bd9Sstevel@tonic-gate /* 25037c478bd9Sstevel@tonic-gate * Verify /usr/lib/fs/<fstype>/mount exists. 25047c478bd9Sstevel@tonic-gate */ 25057c478bd9Sstevel@tonic-gate if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/mount", 25067c478bd9Sstevel@tonic-gate fstab.zone_fs_type) > sizeof (cmdbuf)) { 25077c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("cannot verify fs %s: " 25087c478bd9Sstevel@tonic-gate "type %s is too long.\n"), fstab.zone_fs_dir, 25097c478bd9Sstevel@tonic-gate fstab.zone_fs_type); 25107c478bd9Sstevel@tonic-gate return_code = Z_ERR; 25117c478bd9Sstevel@tonic-gate goto next_fs; 25127c478bd9Sstevel@tonic-gate } 25137c478bd9Sstevel@tonic-gate if (stat(cmdbuf, &st) != 0) { 25145ee84fbdSgjelinek (void) fprintf(stderr, gettext("could not verify fs " 25155ee84fbdSgjelinek "%s: could not access %s: %s\n"), fstab.zone_fs_dir, 25167c478bd9Sstevel@tonic-gate cmdbuf, strerror(errno)); 25177c478bd9Sstevel@tonic-gate return_code = Z_ERR; 25187c478bd9Sstevel@tonic-gate goto next_fs; 25197c478bd9Sstevel@tonic-gate } 25207c478bd9Sstevel@tonic-gate if (!S_ISREG(st.st_mode)) { 25215ee84fbdSgjelinek (void) fprintf(stderr, gettext("could not verify fs " 25225ee84fbdSgjelinek "%s: %s is not a regular file\n"), 25235ee84fbdSgjelinek fstab.zone_fs_dir, cmdbuf); 25247c478bd9Sstevel@tonic-gate return_code = Z_ERR; 25257c478bd9Sstevel@tonic-gate goto next_fs; 25267c478bd9Sstevel@tonic-gate } 25277c478bd9Sstevel@tonic-gate /* 25287c478bd9Sstevel@tonic-gate * Verify /usr/lib/fs/<fstype>/fsck exists iff zone_fs_raw is 25297c478bd9Sstevel@tonic-gate * set. 25307c478bd9Sstevel@tonic-gate */ 25317c478bd9Sstevel@tonic-gate if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/fsck", 25327c478bd9Sstevel@tonic-gate fstab.zone_fs_type) > sizeof (cmdbuf)) { 25337c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("cannot verify fs %s: " 25347c478bd9Sstevel@tonic-gate "type %s is too long.\n"), fstab.zone_fs_dir, 25357c478bd9Sstevel@tonic-gate fstab.zone_fs_type); 25367c478bd9Sstevel@tonic-gate return_code = Z_ERR; 25377c478bd9Sstevel@tonic-gate goto next_fs; 25387c478bd9Sstevel@tonic-gate } 25397c478bd9Sstevel@tonic-gate if (fstab.zone_fs_raw[0] == '\0' && stat(cmdbuf, &st) == 0) { 25405ee84fbdSgjelinek (void) fprintf(stderr, gettext("could not verify fs " 25415ee84fbdSgjelinek "%s: must specify 'raw' device for %s " 25420b5de56dSgjelinek "file systems\n"), 25437c478bd9Sstevel@tonic-gate fstab.zone_fs_dir, fstab.zone_fs_type); 25447c478bd9Sstevel@tonic-gate return_code = Z_ERR; 25457c478bd9Sstevel@tonic-gate goto next_fs; 25467c478bd9Sstevel@tonic-gate } 25477c478bd9Sstevel@tonic-gate if (fstab.zone_fs_raw[0] != '\0' && 25487c478bd9Sstevel@tonic-gate (stat(cmdbuf, &st) != 0 || !S_ISREG(st.st_mode))) { 25497c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("cannot verify fs %s: " 25507c478bd9Sstevel@tonic-gate "'raw' device specified but " 25517c478bd9Sstevel@tonic-gate "no fsck executable exists for %s\n"), 25527c478bd9Sstevel@tonic-gate fstab.zone_fs_dir, fstab.zone_fs_type); 25537c478bd9Sstevel@tonic-gate return_code = Z_ERR; 25547c478bd9Sstevel@tonic-gate goto next_fs; 25557c478bd9Sstevel@tonic-gate } 255620c8013fSlling 255720c8013fSlling /* Verify fs_special. */ 255820c8013fSlling if ((return_code = verify_fs_special(&fstab)) != Z_OK) 2559b5abaf04Sgjelinek goto next_fs; 256020c8013fSlling 256120c8013fSlling /* Verify fs_raw. */ 2562b5abaf04Sgjelinek if (fstab.zone_fs_raw[0] != '\0' && 2563b5abaf04Sgjelinek stat(fstab.zone_fs_raw, &st) != 0) { 25645ee84fbdSgjelinek /* 25655ee84fbdSgjelinek * TRANSLATION_NOTE 25665ee84fbdSgjelinek * fs is a literal that should not be translated. 25675ee84fbdSgjelinek */ 25685ee84fbdSgjelinek (void) fprintf(stderr, gettext("could not verify fs " 25695ee84fbdSgjelinek "%s: could not access %s: %s\n"), fstab.zone_fs_dir, 2570b5abaf04Sgjelinek fstab.zone_fs_raw, strerror(errno)); 2571b5abaf04Sgjelinek return_code = Z_ERR; 2572b5abaf04Sgjelinek goto next_fs; 2573b5abaf04Sgjelinek } 25747c478bd9Sstevel@tonic-gate next_fs: 25757c478bd9Sstevel@tonic-gate zonecfg_free_fs_option_list(fstab.zone_fs_options); 25767c478bd9Sstevel@tonic-gate } 25777c478bd9Sstevel@tonic-gate (void) zonecfg_endfsent(handle); 25787c478bd9Sstevel@tonic-gate 25797c478bd9Sstevel@tonic-gate return (return_code); 25807c478bd9Sstevel@tonic-gate } 25817c478bd9Sstevel@tonic-gate 25827c478bd9Sstevel@tonic-gate static int 2583ffbafc53Scomay verify_limitpriv(zone_dochandle_t handle) 2584ffbafc53Scomay { 2585ffbafc53Scomay char *privname = NULL; 2586ffbafc53Scomay int err; 2587ffbafc53Scomay priv_set_t *privs; 2588ffbafc53Scomay 2589ffbafc53Scomay if ((privs = priv_allocset()) == NULL) { 2590ffbafc53Scomay zperror(gettext("failed to allocate privilege set"), B_FALSE); 2591ffbafc53Scomay return (Z_NOMEM); 2592ffbafc53Scomay } 2593ffbafc53Scomay err = zonecfg_get_privset(handle, privs, &privname); 2594ffbafc53Scomay switch (err) { 2595ffbafc53Scomay case Z_OK: 2596ffbafc53Scomay break; 2597ffbafc53Scomay case Z_PRIV_PROHIBITED: 2598ffbafc53Scomay (void) fprintf(stderr, gettext("privilege \"%s\" is not " 2599ffbafc53Scomay "permitted within the zone's privilege set\n"), privname); 2600ffbafc53Scomay break; 2601ffbafc53Scomay case Z_PRIV_REQUIRED: 2602ffbafc53Scomay (void) fprintf(stderr, gettext("required privilege \"%s\" is " 2603ffbafc53Scomay "missing from the zone's privilege set\n"), privname); 2604ffbafc53Scomay break; 2605ffbafc53Scomay case Z_PRIV_UNKNOWN: 2606ffbafc53Scomay (void) fprintf(stderr, gettext("unknown privilege \"%s\" " 2607ffbafc53Scomay "specified in the zone's privilege set\n"), privname); 2608ffbafc53Scomay break; 2609ffbafc53Scomay default: 2610ffbafc53Scomay zperror( 2611ffbafc53Scomay gettext("failed to determine the zone's privilege set"), 2612ffbafc53Scomay B_TRUE); 2613ffbafc53Scomay break; 2614ffbafc53Scomay } 2615ffbafc53Scomay free(privname); 2616ffbafc53Scomay priv_freeset(privs); 2617ffbafc53Scomay return (err); 2618ffbafc53Scomay } 2619ffbafc53Scomay 26201390a385Sgjelinek static void 26211390a385Sgjelinek free_local_netifs(int if_cnt, struct net_if **if_list) 26221390a385Sgjelinek { 26231390a385Sgjelinek int i; 26241390a385Sgjelinek 26251390a385Sgjelinek for (i = 0; i < if_cnt; i++) { 26261390a385Sgjelinek free(if_list[i]->name); 26271390a385Sgjelinek free(if_list[i]); 26281390a385Sgjelinek } 26291390a385Sgjelinek free(if_list); 26301390a385Sgjelinek } 26311390a385Sgjelinek 26321390a385Sgjelinek /* 26331390a385Sgjelinek * Get a list of the network interfaces, along with their address families, 26341390a385Sgjelinek * that are plumbed in the global zone. See if_tcp(7p) for a description 26351390a385Sgjelinek * of the ioctls used here. 26361390a385Sgjelinek */ 26371390a385Sgjelinek static int 26381390a385Sgjelinek get_local_netifs(int *if_cnt, struct net_if ***if_list) 26391390a385Sgjelinek { 26401390a385Sgjelinek int s; 26411390a385Sgjelinek int i; 26421390a385Sgjelinek int res = Z_OK; 26431390a385Sgjelinek int space_needed; 26441390a385Sgjelinek int cnt = 0; 26451390a385Sgjelinek struct lifnum if_num; 26461390a385Sgjelinek struct lifconf if_conf; 26471390a385Sgjelinek struct lifreq *if_reqp; 26481390a385Sgjelinek char *if_buf; 26491390a385Sgjelinek struct net_if **local_ifs = NULL; 26501390a385Sgjelinek 26511390a385Sgjelinek *if_cnt = 0; 26521390a385Sgjelinek *if_list = NULL; 26531390a385Sgjelinek 26541390a385Sgjelinek if ((s = socket(SOCKET_AF(AF_INET), SOCK_DGRAM, 0)) < 0) 26551390a385Sgjelinek return (Z_ERR); 26561390a385Sgjelinek 26571390a385Sgjelinek /* 26581390a385Sgjelinek * Come back here in the unlikely event that the number of interfaces 26591390a385Sgjelinek * increases between the time we get the count and the time we do the 26601390a385Sgjelinek * SIOCGLIFCONF ioctl. 26611390a385Sgjelinek */ 26621390a385Sgjelinek retry: 26631390a385Sgjelinek /* Get the number of interfaces. */ 26641390a385Sgjelinek if_num.lifn_family = AF_UNSPEC; 26651390a385Sgjelinek if_num.lifn_flags = LIFC_NOXMIT; 26661390a385Sgjelinek if (ioctl(s, SIOCGLIFNUM, &if_num) < 0) { 26671390a385Sgjelinek (void) close(s); 26681390a385Sgjelinek return (Z_ERR); 26691390a385Sgjelinek } 26701390a385Sgjelinek 26711390a385Sgjelinek /* Get the interface configuration list. */ 26721390a385Sgjelinek space_needed = if_num.lifn_count * sizeof (struct lifreq); 26731390a385Sgjelinek if ((if_buf = malloc(space_needed)) == NULL) { 26741390a385Sgjelinek (void) close(s); 26751390a385Sgjelinek return (Z_ERR); 26761390a385Sgjelinek } 26771390a385Sgjelinek if_conf.lifc_family = AF_UNSPEC; 26781390a385Sgjelinek if_conf.lifc_flags = LIFC_NOXMIT; 26791390a385Sgjelinek if_conf.lifc_len = space_needed; 26801390a385Sgjelinek if_conf.lifc_buf = if_buf; 26811390a385Sgjelinek if (ioctl(s, SIOCGLIFCONF, &if_conf) < 0) { 26821390a385Sgjelinek free(if_buf); 26831390a385Sgjelinek /* 26841390a385Sgjelinek * SIOCGLIFCONF returns EINVAL if the buffer we passed in is 26851390a385Sgjelinek * too small. In this case go back and get the new if cnt. 26861390a385Sgjelinek */ 26871390a385Sgjelinek if (errno == EINVAL) 26881390a385Sgjelinek goto retry; 26891390a385Sgjelinek 26901390a385Sgjelinek (void) close(s); 26911390a385Sgjelinek return (Z_ERR); 26921390a385Sgjelinek } 26931390a385Sgjelinek (void) close(s); 26941390a385Sgjelinek 26951390a385Sgjelinek /* Get the name and address family for each interface. */ 26961390a385Sgjelinek if_reqp = if_conf.lifc_req; 26971390a385Sgjelinek for (i = 0; i < (if_conf.lifc_len / sizeof (struct lifreq)); i++) { 26981390a385Sgjelinek struct net_if **p; 26991390a385Sgjelinek struct lifreq req; 27001390a385Sgjelinek 27011390a385Sgjelinek if (strcmp(LOOPBACK_IF, if_reqp->lifr_name) == 0) { 27021390a385Sgjelinek if_reqp++; 27031390a385Sgjelinek continue; 27041390a385Sgjelinek } 27051390a385Sgjelinek 27061390a385Sgjelinek if ((s = socket(SOCKET_AF(if_reqp->lifr_addr.ss_family), 27071390a385Sgjelinek SOCK_DGRAM, 0)) == -1) { 27081390a385Sgjelinek res = Z_ERR; 27091390a385Sgjelinek break; 27101390a385Sgjelinek } 27111390a385Sgjelinek 27121390a385Sgjelinek (void) strncpy(req.lifr_name, if_reqp->lifr_name, 27131390a385Sgjelinek sizeof (req.lifr_name)); 27141390a385Sgjelinek if (ioctl(s, SIOCGLIFADDR, &req) < 0) { 27151390a385Sgjelinek (void) close(s); 27161390a385Sgjelinek if_reqp++; 27171390a385Sgjelinek continue; 27181390a385Sgjelinek } 27191390a385Sgjelinek 27201390a385Sgjelinek if ((p = (struct net_if **)realloc(local_ifs, 27211390a385Sgjelinek sizeof (struct net_if *) * (cnt + 1))) == NULL) { 27221390a385Sgjelinek res = Z_ERR; 27231390a385Sgjelinek break; 27241390a385Sgjelinek } 27251390a385Sgjelinek local_ifs = p; 27261390a385Sgjelinek 27271390a385Sgjelinek if ((local_ifs[cnt] = malloc(sizeof (struct net_if))) == NULL) { 27281390a385Sgjelinek res = Z_ERR; 27291390a385Sgjelinek break; 27301390a385Sgjelinek } 27311390a385Sgjelinek 27321390a385Sgjelinek if ((local_ifs[cnt]->name = strdup(if_reqp->lifr_name)) 27331390a385Sgjelinek == NULL) { 27341390a385Sgjelinek free(local_ifs[cnt]); 27351390a385Sgjelinek res = Z_ERR; 27361390a385Sgjelinek break; 27371390a385Sgjelinek } 27381390a385Sgjelinek local_ifs[cnt]->af = req.lifr_addr.ss_family; 27391390a385Sgjelinek cnt++; 27401390a385Sgjelinek 27411390a385Sgjelinek (void) close(s); 27421390a385Sgjelinek if_reqp++; 27431390a385Sgjelinek } 27441390a385Sgjelinek 27451390a385Sgjelinek free(if_buf); 27461390a385Sgjelinek 27471390a385Sgjelinek if (res != Z_OK) { 27481390a385Sgjelinek free_local_netifs(cnt, local_ifs); 27491390a385Sgjelinek } else { 27501390a385Sgjelinek *if_cnt = cnt; 27511390a385Sgjelinek *if_list = local_ifs; 27521390a385Sgjelinek } 27531390a385Sgjelinek 27541390a385Sgjelinek return (res); 27551390a385Sgjelinek } 27561390a385Sgjelinek 27571390a385Sgjelinek static char * 27581390a385Sgjelinek af2str(int af) 27591390a385Sgjelinek { 27601390a385Sgjelinek switch (af) { 27611390a385Sgjelinek case AF_INET: 27621390a385Sgjelinek return ("IPv4"); 27631390a385Sgjelinek case AF_INET6: 27641390a385Sgjelinek return ("IPv6"); 27651390a385Sgjelinek default: 27661390a385Sgjelinek return ("Unknown"); 27671390a385Sgjelinek } 27681390a385Sgjelinek } 27691390a385Sgjelinek 27701390a385Sgjelinek /* 27711390a385Sgjelinek * Cross check the network interface name and address family with the 27721390a385Sgjelinek * interfaces that are set up in the global zone so that we can print the 27731390a385Sgjelinek * appropriate error message. 27741390a385Sgjelinek */ 27751390a385Sgjelinek static void 27761390a385Sgjelinek print_net_err(char *phys, char *addr, int af, char *msg) 27771390a385Sgjelinek { 27781390a385Sgjelinek int i; 27791390a385Sgjelinek int local_if_cnt = 0; 27801390a385Sgjelinek struct net_if **local_ifs = NULL; 27811390a385Sgjelinek boolean_t found_if = B_FALSE; 27821390a385Sgjelinek boolean_t found_af = B_FALSE; 27831390a385Sgjelinek 27841390a385Sgjelinek if (get_local_netifs(&local_if_cnt, &local_ifs) != Z_OK) { 27851390a385Sgjelinek (void) fprintf(stderr, 27861390a385Sgjelinek gettext("could not verify %s %s=%s %s=%s\n\t%s\n"), 27871390a385Sgjelinek "net", "address", addr, "physical", phys, msg); 27881390a385Sgjelinek return; 27891390a385Sgjelinek } 27901390a385Sgjelinek 27911390a385Sgjelinek for (i = 0; i < local_if_cnt; i++) { 27921390a385Sgjelinek if (strcmp(phys, local_ifs[i]->name) == 0) { 27931390a385Sgjelinek found_if = B_TRUE; 27941390a385Sgjelinek if (af == local_ifs[i]->af) { 27951390a385Sgjelinek found_af = B_TRUE; 27961390a385Sgjelinek break; 27971390a385Sgjelinek } 27981390a385Sgjelinek } 27991390a385Sgjelinek } 28001390a385Sgjelinek 28011390a385Sgjelinek free_local_netifs(local_if_cnt, local_ifs); 28021390a385Sgjelinek 28031390a385Sgjelinek if (!found_if) { 28041390a385Sgjelinek (void) fprintf(stderr, 28051390a385Sgjelinek gettext("could not verify %s %s=%s\n\t" 28061390a385Sgjelinek "network interface %s is not plumbed in the global zone\n"), 28071390a385Sgjelinek "net", "physical", phys, phys); 28081390a385Sgjelinek return; 28091390a385Sgjelinek } 28101390a385Sgjelinek 28111390a385Sgjelinek /* 28121390a385Sgjelinek * Print this error if we were unable to find the address family 28131390a385Sgjelinek * for this interface. If the af variable is not initialized to 28141390a385Sgjelinek * to something meaningful by the caller (not AF_UNSPEC) then we 28151390a385Sgjelinek * also skip this message since it wouldn't be informative. 28161390a385Sgjelinek */ 28171390a385Sgjelinek if (!found_af && af != AF_UNSPEC) { 28181390a385Sgjelinek (void) fprintf(stderr, 28191390a385Sgjelinek gettext("could not verify %s %s=%s %s=%s\n\tthe %s address " 2820f4b3ec61Sdh155122 "family is not configured on this network interface in " 2821f4b3ec61Sdh155122 "the\n\tglobal zone\n"), 28221390a385Sgjelinek "net", "address", addr, "physical", phys, af2str(af)); 28231390a385Sgjelinek return; 28241390a385Sgjelinek } 28251390a385Sgjelinek 28261390a385Sgjelinek (void) fprintf(stderr, 28271390a385Sgjelinek gettext("could not verify %s %s=%s %s=%s\n\t%s\n"), 28281390a385Sgjelinek "net", "address", addr, "physical", phys, msg); 28291390a385Sgjelinek } 28301390a385Sgjelinek 2831ffbafc53Scomay static int 2832ce28b40eSzt129084 verify_handle(int cmd_num, zone_dochandle_t handle, char *argv[]) 28337c478bd9Sstevel@tonic-gate { 28347c478bd9Sstevel@tonic-gate struct zone_nwiftab nwiftab; 28357c478bd9Sstevel@tonic-gate int return_code = Z_OK; 28367c478bd9Sstevel@tonic-gate int err; 2837108322fbScarlsonj boolean_t in_alt_root; 2838f4b3ec61Sdh155122 zone_iptype_t iptype; 2839f4b3ec61Sdh155122 int fd; 28407c478bd9Sstevel@tonic-gate 2841108322fbScarlsonj in_alt_root = zonecfg_in_alt_root(); 2842108322fbScarlsonj if (in_alt_root) 2843108322fbScarlsonj goto no_net; 2844108322fbScarlsonj 2845f4b3ec61Sdh155122 if ((err = zonecfg_get_iptype(handle, &iptype)) != Z_OK) { 2846f4b3ec61Sdh155122 errno = err; 2847f4b3ec61Sdh155122 zperror(cmd_to_str(cmd_num), B_TRUE); 2848f4b3ec61Sdh155122 zonecfg_fini_handle(handle); 2849f4b3ec61Sdh155122 return (Z_ERR); 2850f4b3ec61Sdh155122 } 28517c478bd9Sstevel@tonic-gate if ((err = zonecfg_setnwifent(handle)) != Z_OK) { 28527c478bd9Sstevel@tonic-gate errno = err; 28537c478bd9Sstevel@tonic-gate zperror(cmd_to_str(cmd_num), B_TRUE); 28547c478bd9Sstevel@tonic-gate zonecfg_fini_handle(handle); 28557c478bd9Sstevel@tonic-gate return (Z_ERR); 28567c478bd9Sstevel@tonic-gate } 28577c478bd9Sstevel@tonic-gate while (zonecfg_getnwifent(handle, &nwiftab) == Z_OK) { 28587c478bd9Sstevel@tonic-gate struct lifreq lifr; 28591390a385Sgjelinek sa_family_t af = AF_UNSPEC; 2860f4b3ec61Sdh155122 char dl_owner_zname[ZONENAME_MAX]; 2861f4b3ec61Sdh155122 zoneid_t dl_owner_zid; 2862f4b3ec61Sdh155122 zoneid_t target_zid; 2863f4b3ec61Sdh155122 int res; 28647c478bd9Sstevel@tonic-gate 28657c478bd9Sstevel@tonic-gate /* skip any loopback interfaces */ 28667c478bd9Sstevel@tonic-gate if (strcmp(nwiftab.zone_nwif_physical, "lo0") == 0) 28677c478bd9Sstevel@tonic-gate continue; 2868f4b3ec61Sdh155122 switch (iptype) { 2869f4b3ec61Sdh155122 case ZS_SHARED: 2870f4b3ec61Sdh155122 if ((res = zonecfg_valid_net_address( 2871f4b3ec61Sdh155122 nwiftab.zone_nwif_address, &lifr)) != Z_OK) { 28721390a385Sgjelinek print_net_err(nwiftab.zone_nwif_physical, 28731390a385Sgjelinek nwiftab.zone_nwif_address, af, 28741390a385Sgjelinek zonecfg_strerror(res)); 28757c478bd9Sstevel@tonic-gate return_code = Z_ERR; 28767c478bd9Sstevel@tonic-gate continue; 28777c478bd9Sstevel@tonic-gate } 28787c478bd9Sstevel@tonic-gate af = lifr.lifr_addr.ss_family; 2879f4b3ec61Sdh155122 if (!zonecfg_ifname_exists(af, 2880f4b3ec61Sdh155122 nwiftab.zone_nwif_physical)) { 288122321485Svp157776 /* 2882f4b3ec61Sdh155122 * The interface failed to come up. We continue 2883f4b3ec61Sdh155122 * on anyway for the sake of consistency: a 2884f4b3ec61Sdh155122 * zone is not shut down if the interface fails 2885f4b3ec61Sdh155122 * any time after boot, nor does the global zone 2886f4b3ec61Sdh155122 * fail to boot if an interface fails. 288722321485Svp157776 */ 288822321485Svp157776 (void) fprintf(stderr, 2889f4b3ec61Sdh155122 gettext("WARNING: skipping network " 2890f4b3ec61Sdh155122 "interface '%s' which may not be " 2891f4b3ec61Sdh155122 "present/plumbed in the global " 2892f4b3ec61Sdh155122 "zone.\n"), 289322321485Svp157776 nwiftab.zone_nwif_physical); 28947c478bd9Sstevel@tonic-gate } 2895f4b3ec61Sdh155122 break; 2896f4b3ec61Sdh155122 case ZS_EXCLUSIVE: 2897f4b3ec61Sdh155122 /* Warning if it exists for either IPv4 or IPv6 */ 2898f4b3ec61Sdh155122 2899f4b3ec61Sdh155122 if (zonecfg_ifname_exists(AF_INET, 2900f4b3ec61Sdh155122 nwiftab.zone_nwif_physical) || 2901f4b3ec61Sdh155122 zonecfg_ifname_exists(AF_INET6, 2902f4b3ec61Sdh155122 nwiftab.zone_nwif_physical)) { 2903f4b3ec61Sdh155122 (void) fprintf(stderr, 2904f4b3ec61Sdh155122 gettext("WARNING: skipping network " 2905f4b3ec61Sdh155122 "interface '%s' which is used in the " 2906f4b3ec61Sdh155122 "global zone.\n"), 2907f4b3ec61Sdh155122 nwiftab.zone_nwif_physical); 2908f4b3ec61Sdh155122 break; 2909f4b3ec61Sdh155122 } 2910f4b3ec61Sdh155122 /* 2911f4b3ec61Sdh155122 * Verify that the physical interface can 2912f4b3ec61Sdh155122 * be opened 2913f4b3ec61Sdh155122 */ 2914f4b3ec61Sdh155122 fd = ifname_open(nwiftab.zone_nwif_physical); 2915f4b3ec61Sdh155122 if (fd == -1) { 2916f4b3ec61Sdh155122 (void) fprintf(stderr, 2917f4b3ec61Sdh155122 gettext("WARNING: skipping network " 2918f4b3ec61Sdh155122 "interface '%s' which cannot be opened.\n"), 2919f4b3ec61Sdh155122 nwiftab.zone_nwif_physical); 2920f4b3ec61Sdh155122 break; 2921f4b3ec61Sdh155122 } else { 2922f4b3ec61Sdh155122 (void) close(fd); 2923f4b3ec61Sdh155122 } 2924f4b3ec61Sdh155122 /* 2925f4b3ec61Sdh155122 * Verify whether the physical interface is already 2926f4b3ec61Sdh155122 * used by a zone. 2927f4b3ec61Sdh155122 */ 2928f4b3ec61Sdh155122 dl_owner_zid = ALL_ZONES; 2929f4b3ec61Sdh155122 if (zone_check_datalink(&dl_owner_zid, 2930f4b3ec61Sdh155122 nwiftab.zone_nwif_physical) != 0) 2931f4b3ec61Sdh155122 break; 2932f4b3ec61Sdh155122 2933f4b3ec61Sdh155122 /* 2934f4b3ec61Sdh155122 * If the zone being verified is 2935f4b3ec61Sdh155122 * running and owns the interface 2936f4b3ec61Sdh155122 */ 2937f4b3ec61Sdh155122 target_zid = getzoneidbyname(target_zone); 2938f4b3ec61Sdh155122 if (target_zid == dl_owner_zid) 2939f4b3ec61Sdh155122 break; 2940f4b3ec61Sdh155122 2941f4b3ec61Sdh155122 /* Zone id match failed, use name to check */ 2942f4b3ec61Sdh155122 if (getzonenamebyid(dl_owner_zid, dl_owner_zname, 2943f4b3ec61Sdh155122 ZONENAME_MAX) < 0) { 2944f4b3ec61Sdh155122 /* No name, show ID instead */ 2945f4b3ec61Sdh155122 (void) snprintf(dl_owner_zname, ZONENAME_MAX, 2946f4b3ec61Sdh155122 "<%d>", dl_owner_zid); 2947f4b3ec61Sdh155122 } else if (strcmp(dl_owner_zname, target_zone) == 0) 2948f4b3ec61Sdh155122 break; 2949f4b3ec61Sdh155122 2950f4b3ec61Sdh155122 /* 2951f4b3ec61Sdh155122 * Note here we only report a warning that 2952f4b3ec61Sdh155122 * the interface is already in use by another 2953f4b3ec61Sdh155122 * running zone, and the verify process just 2954f4b3ec61Sdh155122 * goes on, if the interface is still in use 2955f4b3ec61Sdh155122 * when this zone really boots up, zoneadmd 2956f4b3ec61Sdh155122 * will find it. If the name of the zone which 2957f4b3ec61Sdh155122 * owns this interface cannot be determined, 2958f4b3ec61Sdh155122 * then it is not possible to determine if there 2959f4b3ec61Sdh155122 * is a conflict so just report it as a warning. 2960f4b3ec61Sdh155122 */ 2961f4b3ec61Sdh155122 (void) fprintf(stderr, 2962f4b3ec61Sdh155122 gettext("WARNING: skipping network interface " 2963f4b3ec61Sdh155122 "'%s' which is used by the non-global zone " 2964f4b3ec61Sdh155122 "'%s'.\n"), nwiftab.zone_nwif_physical, 2965f4b3ec61Sdh155122 dl_owner_zname); 2966f4b3ec61Sdh155122 break; 2967f4b3ec61Sdh155122 } 29687c478bd9Sstevel@tonic-gate } 29697c478bd9Sstevel@tonic-gate (void) zonecfg_endnwifent(handle); 2970108322fbScarlsonj no_net: 29717c478bd9Sstevel@tonic-gate 2972e7f3c547Sgjelinek /* verify that lofs has not been excluded from the kernel */ 29738cd327d5Sgjelinek if (!(cmd_num == CMD_DETACH || cmd_num == CMD_ATTACH || 29748cd327d5Sgjelinek cmd_num == CMD_MOVE || cmd_num == CMD_CLONE) && 29758cd327d5Sgjelinek modctl(MODLOAD, 1, "fs/lofs", NULL) != 0) { 2976e7f3c547Sgjelinek if (errno == ENXIO) 2977e7f3c547Sgjelinek (void) fprintf(stderr, gettext("could not verify " 2978e7f3c547Sgjelinek "lofs(7FS): possibly excluded in /etc/system\n")); 2979e7f3c547Sgjelinek else 2980e7f3c547Sgjelinek (void) fprintf(stderr, gettext("could not verify " 2981e7f3c547Sgjelinek "lofs(7FS): %s\n"), strerror(errno)); 2982e7f3c547Sgjelinek return_code = Z_ERR; 2983e7f3c547Sgjelinek } 2984e7f3c547Sgjelinek 29857c478bd9Sstevel@tonic-gate if (verify_filesystems(handle) != Z_OK) 29867c478bd9Sstevel@tonic-gate return_code = Z_ERR; 2987b5abaf04Sgjelinek if (verify_ipd(handle) != Z_OK) 2988b5abaf04Sgjelinek return_code = Z_ERR; 2989108322fbScarlsonj if (!in_alt_root && verify_rctls(handle) != Z_OK) 29907c478bd9Sstevel@tonic-gate return_code = Z_ERR; 2991108322fbScarlsonj if (!in_alt_root && verify_pool(handle) != Z_OK) 29927c478bd9Sstevel@tonic-gate return_code = Z_ERR; 2993ce28b40eSzt129084 if (!in_alt_root && verify_brand(handle, cmd_num, argv) != Z_OK) 29949acbbeafSnn35248 return_code = Z_ERR; 2995fa9e4066Sahrens if (!in_alt_root && verify_datasets(handle) != Z_OK) 2996fa9e4066Sahrens return_code = Z_ERR; 2997ffbafc53Scomay 2998ffbafc53Scomay /* 2999ffbafc53Scomay * As the "mount" command is used for patching/upgrading of zones 3000ffbafc53Scomay * or other maintenance processes, the zone's privilege set is not 3001ffbafc53Scomay * checked in this case. Instead, the default, safe set of 3002ffbafc53Scomay * privileges will be used when this zone is created in the 3003ffbafc53Scomay * kernel. 3004ffbafc53Scomay */ 3005ffbafc53Scomay if (!in_alt_root && cmd_num != CMD_MOUNT && 3006ffbafc53Scomay verify_limitpriv(handle) != Z_OK) 3007ffbafc53Scomay return_code = Z_ERR; 30088cd327d5Sgjelinek 30098cd327d5Sgjelinek return (return_code); 30108cd327d5Sgjelinek } 30118cd327d5Sgjelinek 30128cd327d5Sgjelinek static int 3013ce28b40eSzt129084 verify_details(int cmd_num, char *argv[]) 30148cd327d5Sgjelinek { 30158cd327d5Sgjelinek zone_dochandle_t handle; 30168cd327d5Sgjelinek char zonepath[MAXPATHLEN], checkpath[MAXPATHLEN]; 30178cd327d5Sgjelinek int return_code = Z_OK; 30188cd327d5Sgjelinek int err; 30198cd327d5Sgjelinek 30208cd327d5Sgjelinek if ((handle = zonecfg_init_handle()) == NULL) { 30218cd327d5Sgjelinek zperror(cmd_to_str(cmd_num), B_TRUE); 30228cd327d5Sgjelinek return (Z_ERR); 30238cd327d5Sgjelinek } 30248cd327d5Sgjelinek if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) { 30258cd327d5Sgjelinek errno = err; 30268cd327d5Sgjelinek zperror(cmd_to_str(cmd_num), B_TRUE); 30278cd327d5Sgjelinek zonecfg_fini_handle(handle); 30288cd327d5Sgjelinek return (Z_ERR); 30298cd327d5Sgjelinek } 30308cd327d5Sgjelinek if ((err = zonecfg_get_zonepath(handle, zonepath, sizeof (zonepath))) != 30318cd327d5Sgjelinek Z_OK) { 30328cd327d5Sgjelinek errno = err; 30338cd327d5Sgjelinek zperror(cmd_to_str(cmd_num), B_TRUE); 30348cd327d5Sgjelinek zonecfg_fini_handle(handle); 30358cd327d5Sgjelinek return (Z_ERR); 30368cd327d5Sgjelinek } 30378cd327d5Sgjelinek /* 30388cd327d5Sgjelinek * zonecfg_get_zonepath() gets its data from the XML repository. 30398cd327d5Sgjelinek * Verify this against the index file, which is checked first by 30408cd327d5Sgjelinek * zone_get_zonepath(). If they don't match, bail out. 30418cd327d5Sgjelinek */ 30428cd327d5Sgjelinek if ((err = zone_get_zonepath(target_zone, checkpath, 30438cd327d5Sgjelinek sizeof (checkpath))) != Z_OK) { 30448cd327d5Sgjelinek errno = err; 30458cd327d5Sgjelinek zperror2(target_zone, gettext("could not get zone path")); 3046e767a340Sgjelinek zonecfg_fini_handle(handle); 30478cd327d5Sgjelinek return (Z_ERR); 30488cd327d5Sgjelinek } 30498cd327d5Sgjelinek if (strcmp(zonepath, checkpath) != 0) { 30508cd327d5Sgjelinek /* 30518cd327d5Sgjelinek * TRANSLATION_NOTE 30528cd327d5Sgjelinek * XML and zonepath are literals that should not be translated. 30538cd327d5Sgjelinek */ 30548cd327d5Sgjelinek (void) fprintf(stderr, gettext("The XML repository has " 30558cd327d5Sgjelinek "zonepath '%s',\nbut the index file has zonepath '%s'.\n" 30568cd327d5Sgjelinek "These must match, so fix the incorrect entry.\n"), 30578cd327d5Sgjelinek zonepath, checkpath); 3058e767a340Sgjelinek zonecfg_fini_handle(handle); 30598cd327d5Sgjelinek return (Z_ERR); 30608cd327d5Sgjelinek } 30618cd327d5Sgjelinek if (validate_zonepath(zonepath, cmd_num) != Z_OK) { 30628cd327d5Sgjelinek (void) fprintf(stderr, gettext("could not verify zonepath %s " 30638cd327d5Sgjelinek "because of the above errors.\n"), zonepath); 30648cd327d5Sgjelinek return_code = Z_ERR; 30658cd327d5Sgjelinek } 30668cd327d5Sgjelinek 3067ce28b40eSzt129084 if (verify_handle(cmd_num, handle, argv) != Z_OK) 30688cd327d5Sgjelinek return_code = Z_ERR; 30698cd327d5Sgjelinek 30707c478bd9Sstevel@tonic-gate zonecfg_fini_handle(handle); 30717c478bd9Sstevel@tonic-gate if (return_code == Z_ERR) 30727c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 30737c478bd9Sstevel@tonic-gate gettext("%s: zone %s failed to verify\n"), 30747c478bd9Sstevel@tonic-gate execname, target_zone); 30757c478bd9Sstevel@tonic-gate return (return_code); 30767c478bd9Sstevel@tonic-gate } 30777c478bd9Sstevel@tonic-gate 30787c478bd9Sstevel@tonic-gate static int 30797c478bd9Sstevel@tonic-gate verify_func(int argc, char *argv[]) 30807c478bd9Sstevel@tonic-gate { 30817c478bd9Sstevel@tonic-gate int arg; 30827c478bd9Sstevel@tonic-gate 30837c478bd9Sstevel@tonic-gate optind = 0; 30847c478bd9Sstevel@tonic-gate if ((arg = getopt(argc, argv, "?")) != EOF) { 30857c478bd9Sstevel@tonic-gate switch (arg) { 30867c478bd9Sstevel@tonic-gate case '?': 30877c478bd9Sstevel@tonic-gate sub_usage(SHELP_VERIFY, CMD_VERIFY); 30887c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 30897c478bd9Sstevel@tonic-gate default: 30907c478bd9Sstevel@tonic-gate sub_usage(SHELP_VERIFY, CMD_VERIFY); 30917c478bd9Sstevel@tonic-gate return (Z_USAGE); 30927c478bd9Sstevel@tonic-gate } 30937c478bd9Sstevel@tonic-gate } 30947c478bd9Sstevel@tonic-gate if (argc > optind) { 30957c478bd9Sstevel@tonic-gate sub_usage(SHELP_VERIFY, CMD_VERIFY); 30967c478bd9Sstevel@tonic-gate return (Z_USAGE); 30977c478bd9Sstevel@tonic-gate } 30989acbbeafSnn35248 if (sanity_check(target_zone, CMD_VERIFY, B_FALSE, B_FALSE, B_FALSE) 30999acbbeafSnn35248 != Z_OK) 31007c478bd9Sstevel@tonic-gate return (Z_ERR); 3101ce28b40eSzt129084 return (verify_details(CMD_VERIFY, argv)); 31027c478bd9Sstevel@tonic-gate } 31037c478bd9Sstevel@tonic-gate 31049acbbeafSnn35248 static int 31059acbbeafSnn35248 addopt(char *buf, int opt, char *optarg, size_t bufsize) 31069acbbeafSnn35248 { 31079acbbeafSnn35248 char optstring[4]; 31089acbbeafSnn35248 31099acbbeafSnn35248 if (opt > 0) 31109acbbeafSnn35248 (void) sprintf(optstring, " -%c", opt); 31119acbbeafSnn35248 else 31129acbbeafSnn35248 (void) strcpy(optstring, " "); 31139acbbeafSnn35248 31149acbbeafSnn35248 if ((strlcat(buf, optstring, bufsize) > bufsize)) 31159acbbeafSnn35248 return (Z_ERR); 31169acbbeafSnn35248 if ((optarg != NULL) && (strlcat(buf, optarg, bufsize) > bufsize)) 31179acbbeafSnn35248 return (Z_ERR); 31189acbbeafSnn35248 return (Z_OK); 31199acbbeafSnn35248 } 31207c478bd9Sstevel@tonic-gate 31217c478bd9Sstevel@tonic-gate static int 31227c478bd9Sstevel@tonic-gate install_func(int argc, char *argv[]) 31237c478bd9Sstevel@tonic-gate { 31249acbbeafSnn35248 char cmdbuf[MAXPATHLEN]; 31257c478bd9Sstevel@tonic-gate int lockfd; 31269acbbeafSnn35248 int arg, err, subproc_err; 31277c478bd9Sstevel@tonic-gate char zonepath[MAXPATHLEN]; 3128123807fbSedp brand_handle_t bh = NULL; 31297c478bd9Sstevel@tonic-gate int status; 31300b5de56dSgjelinek boolean_t nodataset = B_FALSE; 31319acbbeafSnn35248 char opts[128]; 31329acbbeafSnn35248 31339acbbeafSnn35248 if (target_zone == NULL) { 31349acbbeafSnn35248 sub_usage(SHELP_INSTALL, CMD_INSTALL); 31359acbbeafSnn35248 return (Z_USAGE); 31369acbbeafSnn35248 } 31377c478bd9Sstevel@tonic-gate 3138108322fbScarlsonj if (zonecfg_in_alt_root()) { 3139108322fbScarlsonj zerror(gettext("cannot install zone in alternate root")); 3140108322fbScarlsonj return (Z_ERR); 3141108322fbScarlsonj } 3142108322fbScarlsonj 31439acbbeafSnn35248 if ((err = zone_get_zonepath(target_zone, zonepath, 31449acbbeafSnn35248 sizeof (zonepath))) != Z_OK) { 31459acbbeafSnn35248 errno = err; 31469acbbeafSnn35248 zperror2(target_zone, gettext("could not get zone path")); 31479acbbeafSnn35248 return (Z_ERR); 31489acbbeafSnn35248 } 31499acbbeafSnn35248 31509acbbeafSnn35248 /* Fetch the install command from the brand configuration. */ 3151123807fbSedp if ((bh = brand_open(target_brand)) == NULL) { 31529acbbeafSnn35248 zerror(gettext("missing or invalid brand")); 31539acbbeafSnn35248 return (Z_ERR); 31549acbbeafSnn35248 } 31559acbbeafSnn35248 31569acbbeafSnn35248 (void) strcpy(cmdbuf, EXEC_PREFIX); 3157123807fbSedp if (brand_get_install(bh, target_zone, zonepath, cmdbuf + EXEC_LEN, 31589acbbeafSnn35248 sizeof (cmdbuf) - EXEC_LEN, 0, NULL) != 0) { 31599acbbeafSnn35248 zerror("invalid brand configuration: missing install resource"); 3160123807fbSedp brand_close(bh); 31619acbbeafSnn35248 return (Z_ERR); 31629acbbeafSnn35248 } 31639acbbeafSnn35248 31649acbbeafSnn35248 (void) strcpy(opts, "?x:"); 31659acbbeafSnn35248 if (!is_native_zone) { 31669acbbeafSnn35248 /* 31679acbbeafSnn35248 * Fetch the list of recognized command-line options from 31689acbbeafSnn35248 * the brand configuration file. 31699acbbeafSnn35248 */ 3170123807fbSedp if (brand_get_installopts(bh, opts + strlen(opts), 31719acbbeafSnn35248 sizeof (opts) - strlen(opts)) != 0) { 31729acbbeafSnn35248 zerror("invalid brand configuration: missing " 31739acbbeafSnn35248 "install options resource"); 3174123807fbSedp brand_close(bh); 31759acbbeafSnn35248 return (Z_ERR); 31769acbbeafSnn35248 } 31779acbbeafSnn35248 } 3178123807fbSedp brand_close(bh); 31799acbbeafSnn35248 31807c478bd9Sstevel@tonic-gate optind = 0; 31819acbbeafSnn35248 while ((arg = getopt(argc, argv, opts)) != EOF) { 31827c478bd9Sstevel@tonic-gate switch (arg) { 31837c478bd9Sstevel@tonic-gate case '?': 31847c478bd9Sstevel@tonic-gate sub_usage(SHELP_INSTALL, CMD_INSTALL); 31857c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 31860b5de56dSgjelinek case 'x': 31870b5de56dSgjelinek if (strcmp(optarg, "nodataset") != 0) { 31880b5de56dSgjelinek sub_usage(SHELP_INSTALL, CMD_INSTALL); 31890b5de56dSgjelinek return (Z_USAGE); 31900b5de56dSgjelinek } 31910b5de56dSgjelinek nodataset = B_TRUE; 31920b5de56dSgjelinek break; 31937c478bd9Sstevel@tonic-gate default: 31949acbbeafSnn35248 if (is_native_zone) { 31957c478bd9Sstevel@tonic-gate sub_usage(SHELP_INSTALL, CMD_INSTALL); 31967c478bd9Sstevel@tonic-gate return (Z_USAGE); 31977c478bd9Sstevel@tonic-gate } 31989acbbeafSnn35248 31999acbbeafSnn35248 /* 32009acbbeafSnn35248 * This option isn't for zoneadm, so append it to 32019acbbeafSnn35248 * the command line passed to the brand-specific 32029acbbeafSnn35248 * install routine. 32039acbbeafSnn35248 */ 32049acbbeafSnn35248 if (addopt(cmdbuf, optopt, optarg, 32059acbbeafSnn35248 sizeof (cmdbuf)) != Z_OK) { 32069acbbeafSnn35248 zerror("Install command line too long"); 32079acbbeafSnn35248 return (Z_ERR); 32087c478bd9Sstevel@tonic-gate } 32099acbbeafSnn35248 break; 32107c478bd9Sstevel@tonic-gate } 32119acbbeafSnn35248 } 32129acbbeafSnn35248 32139acbbeafSnn35248 if (!is_native_zone) { 32149acbbeafSnn35248 for (; optind < argc; optind++) { 32159acbbeafSnn35248 if (addopt(cmdbuf, 0, argv[optind], 32169acbbeafSnn35248 sizeof (cmdbuf)) != Z_OK) { 32179acbbeafSnn35248 zerror("Install command line too long"); 32189acbbeafSnn35248 return (Z_ERR); 32199acbbeafSnn35248 } 32209acbbeafSnn35248 } 32219acbbeafSnn35248 } 32229acbbeafSnn35248 32239acbbeafSnn35248 if (sanity_check(target_zone, CMD_INSTALL, B_FALSE, B_TRUE, B_FALSE) 32249acbbeafSnn35248 != Z_OK) 32257c478bd9Sstevel@tonic-gate return (Z_ERR); 3226ce28b40eSzt129084 if (verify_details(CMD_INSTALL, argv) != Z_OK) 32277c478bd9Sstevel@tonic-gate return (Z_ERR); 32287c478bd9Sstevel@tonic-gate 32297c478bd9Sstevel@tonic-gate if (grab_lock_file(target_zone, &lockfd) != Z_OK) { 32307c478bd9Sstevel@tonic-gate zerror(gettext("another %s may have an operation in progress."), 3231865e09a4Sgjelinek "zoneadm"); 32327c478bd9Sstevel@tonic-gate return (Z_ERR); 32337c478bd9Sstevel@tonic-gate } 32347c478bd9Sstevel@tonic-gate err = zone_set_state(target_zone, ZONE_STATE_INCOMPLETE); 32357c478bd9Sstevel@tonic-gate if (err != Z_OK) { 32367c478bd9Sstevel@tonic-gate errno = err; 32377c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not set state")); 32387c478bd9Sstevel@tonic-gate goto done; 32397c478bd9Sstevel@tonic-gate } 32407c478bd9Sstevel@tonic-gate 32419acbbeafSnn35248 if (!nodataset) 32429acbbeafSnn35248 create_zfs_zonepath(zonepath); 32439acbbeafSnn35248 32447c478bd9Sstevel@tonic-gate /* 32457c478bd9Sstevel@tonic-gate * According to the Application Packaging Developer's Guide, a 32467c478bd9Sstevel@tonic-gate * "checkinstall" script when included in a package is executed as 32477c478bd9Sstevel@tonic-gate * the user "install", if such a user exists, or by the user 32487c478bd9Sstevel@tonic-gate * "nobody". In order to support this dubious behavior, the path 32497c478bd9Sstevel@tonic-gate * to the zone being constructed is opened up during the life of 32507c478bd9Sstevel@tonic-gate * the command laying down the zone's root file system. Once this 32517c478bd9Sstevel@tonic-gate * has completed, regardless of whether it was successful, the 32527c478bd9Sstevel@tonic-gate * path to the zone is again restricted. 32537c478bd9Sstevel@tonic-gate */ 32547c478bd9Sstevel@tonic-gate if (chmod(zonepath, DEFAULT_DIR_MODE) != 0) { 32557c478bd9Sstevel@tonic-gate zperror(zonepath, B_FALSE); 32567c478bd9Sstevel@tonic-gate err = Z_ERR; 32577c478bd9Sstevel@tonic-gate goto done; 32587c478bd9Sstevel@tonic-gate } 32597c478bd9Sstevel@tonic-gate 32609acbbeafSnn35248 if (is_native_zone) 32617c478bd9Sstevel@tonic-gate status = do_subproc(cmdbuf); 32629acbbeafSnn35248 else 32639acbbeafSnn35248 status = do_subproc_interactive(cmdbuf); 32649acbbeafSnn35248 32657c478bd9Sstevel@tonic-gate if (chmod(zonepath, S_IRWXU) != 0) { 32667c478bd9Sstevel@tonic-gate zperror(zonepath, B_FALSE); 32677c478bd9Sstevel@tonic-gate err = Z_ERR; 32687c478bd9Sstevel@tonic-gate goto done; 32697c478bd9Sstevel@tonic-gate } 32709acbbeafSnn35248 if ((subproc_err = 32719acbbeafSnn35248 subproc_status(gettext("brand-specific installation"), status, 32729acbbeafSnn35248 B_FALSE)) != ZONE_SUBPROC_OK) { 32739acbbeafSnn35248 err = Z_ERR; 32747c478bd9Sstevel@tonic-gate goto done; 32759acbbeafSnn35248 } 32767c478bd9Sstevel@tonic-gate 32777c478bd9Sstevel@tonic-gate if ((err = zone_set_state(target_zone, ZONE_STATE_INSTALLED)) != Z_OK) { 32787c478bd9Sstevel@tonic-gate errno = err; 32797c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not set state")); 32807c478bd9Sstevel@tonic-gate goto done; 32817c478bd9Sstevel@tonic-gate } 32827c478bd9Sstevel@tonic-gate 32837c478bd9Sstevel@tonic-gate done: 32849acbbeafSnn35248 /* 32859acbbeafSnn35248 * If the install script exited with ZONE_SUBPROC_USAGE or 32869acbbeafSnn35248 * ZONE_SUBPROC_NOTCOMPLETE, try to clean up the zone and leave the 32879acbbeafSnn35248 * zone in the CONFIGURED state so that another install can be 32889acbbeafSnn35248 * attempted without requiring an uninstall first. 32899acbbeafSnn35248 */ 32909acbbeafSnn35248 if ((subproc_err == ZONE_SUBPROC_USAGE) || 32919acbbeafSnn35248 (subproc_err == ZONE_SUBPROC_NOTCOMPLETE)) { 32929acbbeafSnn35248 if ((err = cleanup_zonepath(zonepath, B_FALSE)) != Z_OK) { 32939acbbeafSnn35248 errno = err; 32949acbbeafSnn35248 zperror2(target_zone, 32959acbbeafSnn35248 gettext("cleaning up zonepath failed")); 32969acbbeafSnn35248 } else if ((err = zone_set_state(target_zone, 32979acbbeafSnn35248 ZONE_STATE_CONFIGURED)) != Z_OK) { 32989acbbeafSnn35248 errno = err; 32999acbbeafSnn35248 zperror2(target_zone, gettext("could not set state")); 33009acbbeafSnn35248 } 33019acbbeafSnn35248 } 33029acbbeafSnn35248 33037c478bd9Sstevel@tonic-gate release_lock_file(lockfd); 33047c478bd9Sstevel@tonic-gate return ((err == Z_OK) ? Z_OK : Z_ERR); 33057c478bd9Sstevel@tonic-gate } 33067c478bd9Sstevel@tonic-gate 33077c478bd9Sstevel@tonic-gate /* 3308865e09a4Sgjelinek * Check that the inherited pkg dirs are the same for the clone and its source. 3309865e09a4Sgjelinek * The easiest way to do that is check that the list of ipds is the same 3310865e09a4Sgjelinek * by matching each one against the other. This algorithm should be fine since 3311865e09a4Sgjelinek * the list of ipds should not be that long. 3312865e09a4Sgjelinek */ 3313865e09a4Sgjelinek static int 3314865e09a4Sgjelinek valid_ipd_clone(zone_dochandle_t s_handle, char *source_zone, 3315865e09a4Sgjelinek zone_dochandle_t t_handle, char *target_zone) 3316865e09a4Sgjelinek { 3317865e09a4Sgjelinek int err; 3318865e09a4Sgjelinek int res = Z_OK; 3319865e09a4Sgjelinek int s_cnt = 0; 3320865e09a4Sgjelinek int t_cnt = 0; 3321865e09a4Sgjelinek struct zone_fstab s_fstab; 3322865e09a4Sgjelinek struct zone_fstab t_fstab; 3323865e09a4Sgjelinek 3324865e09a4Sgjelinek /* 3325865e09a4Sgjelinek * First check the source of the clone against the target. 3326865e09a4Sgjelinek */ 3327865e09a4Sgjelinek if ((err = zonecfg_setipdent(s_handle)) != Z_OK) { 3328865e09a4Sgjelinek errno = err; 3329865e09a4Sgjelinek zperror2(source_zone, gettext("could not enumerate " 3330865e09a4Sgjelinek "inherit-pkg-dirs")); 3331865e09a4Sgjelinek return (Z_ERR); 3332865e09a4Sgjelinek } 3333865e09a4Sgjelinek 3334865e09a4Sgjelinek while (zonecfg_getipdent(s_handle, &s_fstab) == Z_OK) { 3335865e09a4Sgjelinek boolean_t match = B_FALSE; 3336865e09a4Sgjelinek 3337865e09a4Sgjelinek s_cnt++; 3338865e09a4Sgjelinek 3339865e09a4Sgjelinek if ((err = zonecfg_setipdent(t_handle)) != Z_OK) { 3340865e09a4Sgjelinek errno = err; 3341865e09a4Sgjelinek zperror2(target_zone, gettext("could not enumerate " 3342865e09a4Sgjelinek "inherit-pkg-dirs")); 3343865e09a4Sgjelinek (void) zonecfg_endipdent(s_handle); 3344865e09a4Sgjelinek return (Z_ERR); 3345865e09a4Sgjelinek } 3346865e09a4Sgjelinek 3347865e09a4Sgjelinek while (zonecfg_getipdent(t_handle, &t_fstab) == Z_OK) { 3348865e09a4Sgjelinek if (strcmp(s_fstab.zone_fs_dir, t_fstab.zone_fs_dir) 3349865e09a4Sgjelinek == 0) { 3350865e09a4Sgjelinek match = B_TRUE; 3351865e09a4Sgjelinek break; 3352865e09a4Sgjelinek } 3353865e09a4Sgjelinek } 3354865e09a4Sgjelinek (void) zonecfg_endipdent(t_handle); 3355865e09a4Sgjelinek 3356865e09a4Sgjelinek if (!match) { 3357865e09a4Sgjelinek (void) fprintf(stderr, gettext("inherit-pkg-dir " 3358865e09a4Sgjelinek "'%s' is not configured in zone %s.\n"), 3359865e09a4Sgjelinek s_fstab.zone_fs_dir, target_zone); 3360865e09a4Sgjelinek res = Z_ERR; 3361865e09a4Sgjelinek } 3362865e09a4Sgjelinek } 3363865e09a4Sgjelinek 3364865e09a4Sgjelinek (void) zonecfg_endipdent(s_handle); 3365865e09a4Sgjelinek 3366865e09a4Sgjelinek /* skip the next check if we already have errors */ 3367865e09a4Sgjelinek if (res == Z_ERR) 3368865e09a4Sgjelinek return (res); 3369865e09a4Sgjelinek 3370865e09a4Sgjelinek /* 3371865e09a4Sgjelinek * Now check the number of ipds in the target so we can verify 3372865e09a4Sgjelinek * that the source is not a subset of the target. 3373865e09a4Sgjelinek */ 3374865e09a4Sgjelinek if ((err = zonecfg_setipdent(t_handle)) != Z_OK) { 3375865e09a4Sgjelinek errno = err; 3376865e09a4Sgjelinek zperror2(target_zone, gettext("could not enumerate " 3377865e09a4Sgjelinek "inherit-pkg-dirs")); 3378865e09a4Sgjelinek return (Z_ERR); 3379865e09a4Sgjelinek } 3380865e09a4Sgjelinek 3381865e09a4Sgjelinek while (zonecfg_getipdent(t_handle, &t_fstab) == Z_OK) 3382865e09a4Sgjelinek t_cnt++; 3383865e09a4Sgjelinek 3384865e09a4Sgjelinek (void) zonecfg_endipdent(t_handle); 3385865e09a4Sgjelinek 3386865e09a4Sgjelinek if (t_cnt != s_cnt) { 3387865e09a4Sgjelinek (void) fprintf(stderr, gettext("Zone %s is configured " 3388865e09a4Sgjelinek "with inherit-pkg-dirs that are not configured in zone " 3389865e09a4Sgjelinek "%s.\n"), target_zone, source_zone); 3390865e09a4Sgjelinek res = Z_ERR; 3391865e09a4Sgjelinek } 3392865e09a4Sgjelinek 3393865e09a4Sgjelinek return (res); 3394865e09a4Sgjelinek } 3395865e09a4Sgjelinek 3396865e09a4Sgjelinek static void 3397865e09a4Sgjelinek warn_dev_match(zone_dochandle_t s_handle, char *source_zone, 3398865e09a4Sgjelinek zone_dochandle_t t_handle, char *target_zone) 3399865e09a4Sgjelinek { 3400865e09a4Sgjelinek int err; 3401865e09a4Sgjelinek struct zone_devtab s_devtab; 3402865e09a4Sgjelinek struct zone_devtab t_devtab; 3403865e09a4Sgjelinek 3404865e09a4Sgjelinek if ((err = zonecfg_setdevent(t_handle)) != Z_OK) { 3405865e09a4Sgjelinek errno = err; 3406865e09a4Sgjelinek zperror2(target_zone, gettext("could not enumerate devices")); 3407865e09a4Sgjelinek return; 3408865e09a4Sgjelinek } 3409865e09a4Sgjelinek 3410865e09a4Sgjelinek while (zonecfg_getdevent(t_handle, &t_devtab) == Z_OK) { 3411865e09a4Sgjelinek if ((err = zonecfg_setdevent(s_handle)) != Z_OK) { 3412865e09a4Sgjelinek errno = err; 3413865e09a4Sgjelinek zperror2(source_zone, 3414865e09a4Sgjelinek gettext("could not enumerate devices")); 3415865e09a4Sgjelinek (void) zonecfg_enddevent(t_handle); 3416865e09a4Sgjelinek return; 3417865e09a4Sgjelinek } 3418865e09a4Sgjelinek 3419865e09a4Sgjelinek while (zonecfg_getdevent(s_handle, &s_devtab) == Z_OK) { 3420865e09a4Sgjelinek /* 3421865e09a4Sgjelinek * Use fnmatch to catch the case where wildcards 3422865e09a4Sgjelinek * were used in one zone and the other has an 3423865e09a4Sgjelinek * explicit entry (e.g. /dev/dsk/c0t0d0s6 vs. 3424865e09a4Sgjelinek * /dev/\*dsk/c0t0d0s6). 3425865e09a4Sgjelinek */ 3426865e09a4Sgjelinek if (fnmatch(t_devtab.zone_dev_match, 3427865e09a4Sgjelinek s_devtab.zone_dev_match, FNM_PATHNAME) == 0 || 3428865e09a4Sgjelinek fnmatch(s_devtab.zone_dev_match, 3429865e09a4Sgjelinek t_devtab.zone_dev_match, FNM_PATHNAME) == 0) { 3430865e09a4Sgjelinek (void) fprintf(stderr, 3431865e09a4Sgjelinek gettext("WARNING: device '%s' " 3432865e09a4Sgjelinek "is configured in both zones.\n"), 3433865e09a4Sgjelinek t_devtab.zone_dev_match); 3434865e09a4Sgjelinek break; 3435865e09a4Sgjelinek } 3436865e09a4Sgjelinek } 3437865e09a4Sgjelinek (void) zonecfg_enddevent(s_handle); 3438865e09a4Sgjelinek } 3439865e09a4Sgjelinek 3440865e09a4Sgjelinek (void) zonecfg_enddevent(t_handle); 3441865e09a4Sgjelinek } 3442865e09a4Sgjelinek 3443865e09a4Sgjelinek /* 3444865e09a4Sgjelinek * Check if the specified mount option (opt) is contained within the 3445865e09a4Sgjelinek * options string. 3446865e09a4Sgjelinek */ 3447865e09a4Sgjelinek static boolean_t 3448865e09a4Sgjelinek opt_match(char *opt, char *options) 3449865e09a4Sgjelinek { 3450865e09a4Sgjelinek char *p; 3451865e09a4Sgjelinek char *lastp; 3452865e09a4Sgjelinek 3453865e09a4Sgjelinek if ((p = strtok_r(options, ",", &lastp)) != NULL) { 3454865e09a4Sgjelinek if (strcmp(p, opt) == 0) 3455865e09a4Sgjelinek return (B_TRUE); 3456865e09a4Sgjelinek while ((p = strtok_r(NULL, ",", &lastp)) != NULL) { 3457865e09a4Sgjelinek if (strcmp(p, opt) == 0) 3458865e09a4Sgjelinek return (B_TRUE); 3459865e09a4Sgjelinek } 3460865e09a4Sgjelinek } 3461865e09a4Sgjelinek 3462865e09a4Sgjelinek return (B_FALSE); 3463865e09a4Sgjelinek } 3464865e09a4Sgjelinek 34650b5de56dSgjelinek #define RW_LOFS "WARNING: read-write lofs file system on '%s' is configured " \ 3466865e09a4Sgjelinek "in both zones.\n" 3467865e09a4Sgjelinek 3468865e09a4Sgjelinek static void 3469865e09a4Sgjelinek print_fs_warnings(struct zone_fstab *s_fstab, struct zone_fstab *t_fstab) 3470865e09a4Sgjelinek { 3471865e09a4Sgjelinek /* 3472865e09a4Sgjelinek * It is ok to have shared lofs mounted fs but we want to warn if 3473865e09a4Sgjelinek * either is rw since this will effect the other zone. 3474865e09a4Sgjelinek */ 3475865e09a4Sgjelinek if (strcmp(t_fstab->zone_fs_type, "lofs") == 0) { 3476865e09a4Sgjelinek zone_fsopt_t *optp; 3477865e09a4Sgjelinek 3478865e09a4Sgjelinek /* The default is rw so no options means rw */ 3479865e09a4Sgjelinek if (t_fstab->zone_fs_options == NULL || 3480865e09a4Sgjelinek s_fstab->zone_fs_options == NULL) { 3481865e09a4Sgjelinek (void) fprintf(stderr, gettext(RW_LOFS), 3482865e09a4Sgjelinek t_fstab->zone_fs_special); 3483865e09a4Sgjelinek return; 3484865e09a4Sgjelinek } 3485865e09a4Sgjelinek 3486865e09a4Sgjelinek for (optp = s_fstab->zone_fs_options; optp != NULL; 3487865e09a4Sgjelinek optp = optp->zone_fsopt_next) { 3488865e09a4Sgjelinek if (opt_match("rw", optp->zone_fsopt_opt)) { 3489865e09a4Sgjelinek (void) fprintf(stderr, gettext(RW_LOFS), 3490865e09a4Sgjelinek s_fstab->zone_fs_special); 3491865e09a4Sgjelinek return; 3492865e09a4Sgjelinek } 3493865e09a4Sgjelinek } 3494865e09a4Sgjelinek 3495865e09a4Sgjelinek for (optp = t_fstab->zone_fs_options; optp != NULL; 3496865e09a4Sgjelinek optp = optp->zone_fsopt_next) { 3497865e09a4Sgjelinek if (opt_match("rw", optp->zone_fsopt_opt)) { 3498865e09a4Sgjelinek (void) fprintf(stderr, gettext(RW_LOFS), 3499865e09a4Sgjelinek t_fstab->zone_fs_special); 3500865e09a4Sgjelinek return; 3501865e09a4Sgjelinek } 3502865e09a4Sgjelinek } 3503865e09a4Sgjelinek 3504865e09a4Sgjelinek return; 3505865e09a4Sgjelinek } 3506865e09a4Sgjelinek 3507865e09a4Sgjelinek /* 3508865e09a4Sgjelinek * TRANSLATION_NOTE 35090b5de56dSgjelinek * The first variable is the file system type and the second is 35100b5de56dSgjelinek * the file system special device. For example, 35110b5de56dSgjelinek * WARNING: ufs file system on '/dev/dsk/c0t0d0s0' ... 3512865e09a4Sgjelinek */ 35130b5de56dSgjelinek (void) fprintf(stderr, gettext("WARNING: %s file system on '%s' " 3514865e09a4Sgjelinek "is configured in both zones.\n"), t_fstab->zone_fs_type, 3515865e09a4Sgjelinek t_fstab->zone_fs_special); 3516865e09a4Sgjelinek } 3517865e09a4Sgjelinek 3518865e09a4Sgjelinek static void 3519865e09a4Sgjelinek warn_fs_match(zone_dochandle_t s_handle, char *source_zone, 3520865e09a4Sgjelinek zone_dochandle_t t_handle, char *target_zone) 3521865e09a4Sgjelinek { 3522865e09a4Sgjelinek int err; 3523865e09a4Sgjelinek struct zone_fstab s_fstab; 3524865e09a4Sgjelinek struct zone_fstab t_fstab; 3525865e09a4Sgjelinek 3526865e09a4Sgjelinek if ((err = zonecfg_setfsent(t_handle)) != Z_OK) { 3527865e09a4Sgjelinek errno = err; 3528865e09a4Sgjelinek zperror2(target_zone, 35290b5de56dSgjelinek gettext("could not enumerate file systems")); 3530865e09a4Sgjelinek return; 3531865e09a4Sgjelinek } 3532865e09a4Sgjelinek 3533865e09a4Sgjelinek while (zonecfg_getfsent(t_handle, &t_fstab) == Z_OK) { 3534865e09a4Sgjelinek if ((err = zonecfg_setfsent(s_handle)) != Z_OK) { 3535865e09a4Sgjelinek errno = err; 3536865e09a4Sgjelinek zperror2(source_zone, 35370b5de56dSgjelinek gettext("could not enumerate file systems")); 3538865e09a4Sgjelinek (void) zonecfg_endfsent(t_handle); 3539865e09a4Sgjelinek return; 3540865e09a4Sgjelinek } 3541865e09a4Sgjelinek 3542865e09a4Sgjelinek while (zonecfg_getfsent(s_handle, &s_fstab) == Z_OK) { 3543865e09a4Sgjelinek if (strcmp(t_fstab.zone_fs_special, 3544865e09a4Sgjelinek s_fstab.zone_fs_special) == 0) { 3545865e09a4Sgjelinek print_fs_warnings(&s_fstab, &t_fstab); 3546865e09a4Sgjelinek break; 3547865e09a4Sgjelinek } 3548865e09a4Sgjelinek } 3549865e09a4Sgjelinek (void) zonecfg_endfsent(s_handle); 3550865e09a4Sgjelinek } 3551865e09a4Sgjelinek 3552865e09a4Sgjelinek (void) zonecfg_endfsent(t_handle); 3553865e09a4Sgjelinek } 3554865e09a4Sgjelinek 3555865e09a4Sgjelinek /* 3556865e09a4Sgjelinek * We don't catch the case where you used the same IP address but 3557865e09a4Sgjelinek * it is not an exact string match. For example, 192.9.0.128 vs. 192.09.0.128. 3558865e09a4Sgjelinek * However, we're not going to worry about that but we will check for 3559865e09a4Sgjelinek * a possible netmask on one of the addresses (e.g. 10.0.0.1 and 10.0.0.1/24) 3560865e09a4Sgjelinek * and handle that case as a match. 3561865e09a4Sgjelinek */ 3562865e09a4Sgjelinek static void 3563865e09a4Sgjelinek warn_ip_match(zone_dochandle_t s_handle, char *source_zone, 3564865e09a4Sgjelinek zone_dochandle_t t_handle, char *target_zone) 3565865e09a4Sgjelinek { 3566865e09a4Sgjelinek int err; 3567865e09a4Sgjelinek struct zone_nwiftab s_nwiftab; 3568865e09a4Sgjelinek struct zone_nwiftab t_nwiftab; 3569865e09a4Sgjelinek 3570865e09a4Sgjelinek if ((err = zonecfg_setnwifent(t_handle)) != Z_OK) { 3571865e09a4Sgjelinek errno = err; 3572865e09a4Sgjelinek zperror2(target_zone, 3573865e09a4Sgjelinek gettext("could not enumerate network interfaces")); 3574865e09a4Sgjelinek return; 3575865e09a4Sgjelinek } 3576865e09a4Sgjelinek 3577865e09a4Sgjelinek while (zonecfg_getnwifent(t_handle, &t_nwiftab) == Z_OK) { 3578865e09a4Sgjelinek char *p; 3579865e09a4Sgjelinek 3580865e09a4Sgjelinek /* remove an (optional) netmask from the address */ 3581865e09a4Sgjelinek if ((p = strchr(t_nwiftab.zone_nwif_address, '/')) != NULL) 3582865e09a4Sgjelinek *p = '\0'; 3583865e09a4Sgjelinek 3584865e09a4Sgjelinek if ((err = zonecfg_setnwifent(s_handle)) != Z_OK) { 3585865e09a4Sgjelinek errno = err; 3586865e09a4Sgjelinek zperror2(source_zone, 3587865e09a4Sgjelinek gettext("could not enumerate network interfaces")); 3588865e09a4Sgjelinek (void) zonecfg_endnwifent(t_handle); 3589865e09a4Sgjelinek return; 3590865e09a4Sgjelinek } 3591865e09a4Sgjelinek 3592865e09a4Sgjelinek while (zonecfg_getnwifent(s_handle, &s_nwiftab) == Z_OK) { 3593865e09a4Sgjelinek /* remove an (optional) netmask from the address */ 3594865e09a4Sgjelinek if ((p = strchr(s_nwiftab.zone_nwif_address, '/')) 3595865e09a4Sgjelinek != NULL) 3596865e09a4Sgjelinek *p = '\0'; 3597865e09a4Sgjelinek 3598f4b3ec61Sdh155122 /* For exclusive-IP zones, address is not specified. */ 3599f4b3ec61Sdh155122 if (strlen(s_nwiftab.zone_nwif_address) == 0) 3600f4b3ec61Sdh155122 continue; 3601f4b3ec61Sdh155122 3602865e09a4Sgjelinek if (strcmp(t_nwiftab.zone_nwif_address, 3603865e09a4Sgjelinek s_nwiftab.zone_nwif_address) == 0) { 3604865e09a4Sgjelinek (void) fprintf(stderr, 3605865e09a4Sgjelinek gettext("WARNING: network address '%s' " 3606865e09a4Sgjelinek "is configured in both zones.\n"), 3607865e09a4Sgjelinek t_nwiftab.zone_nwif_address); 3608865e09a4Sgjelinek break; 3609865e09a4Sgjelinek } 3610865e09a4Sgjelinek } 3611865e09a4Sgjelinek (void) zonecfg_endnwifent(s_handle); 3612865e09a4Sgjelinek } 3613865e09a4Sgjelinek 3614865e09a4Sgjelinek (void) zonecfg_endnwifent(t_handle); 3615865e09a4Sgjelinek } 3616865e09a4Sgjelinek 3617865e09a4Sgjelinek static void 36189acbbeafSnn35248 warn_dataset_match(zone_dochandle_t s_handle, char *source, 36199acbbeafSnn35248 zone_dochandle_t t_handle, char *target) 3620865e09a4Sgjelinek { 3621865e09a4Sgjelinek int err; 3622865e09a4Sgjelinek struct zone_dstab s_dstab; 3623865e09a4Sgjelinek struct zone_dstab t_dstab; 3624865e09a4Sgjelinek 3625865e09a4Sgjelinek if ((err = zonecfg_setdsent(t_handle)) != Z_OK) { 3626865e09a4Sgjelinek errno = err; 36279acbbeafSnn35248 zperror2(target, gettext("could not enumerate datasets")); 3628865e09a4Sgjelinek return; 3629865e09a4Sgjelinek } 3630865e09a4Sgjelinek 3631865e09a4Sgjelinek while (zonecfg_getdsent(t_handle, &t_dstab) == Z_OK) { 3632865e09a4Sgjelinek if ((err = zonecfg_setdsent(s_handle)) != Z_OK) { 3633865e09a4Sgjelinek errno = err; 36349acbbeafSnn35248 zperror2(source, 3635865e09a4Sgjelinek gettext("could not enumerate datasets")); 3636865e09a4Sgjelinek (void) zonecfg_enddsent(t_handle); 3637865e09a4Sgjelinek return; 3638865e09a4Sgjelinek } 3639865e09a4Sgjelinek 3640865e09a4Sgjelinek while (zonecfg_getdsent(s_handle, &s_dstab) == Z_OK) { 3641865e09a4Sgjelinek if (strcmp(t_dstab.zone_dataset_name, 3642865e09a4Sgjelinek s_dstab.zone_dataset_name) == 0) { 36439acbbeafSnn35248 target_zone = source; 36449acbbeafSnn35248 zerror(gettext("WARNING: dataset '%s' " 3645865e09a4Sgjelinek "is configured in both zones.\n"), 3646865e09a4Sgjelinek t_dstab.zone_dataset_name); 3647865e09a4Sgjelinek break; 3648865e09a4Sgjelinek } 3649865e09a4Sgjelinek } 3650865e09a4Sgjelinek (void) zonecfg_enddsent(s_handle); 3651865e09a4Sgjelinek } 3652865e09a4Sgjelinek 3653865e09a4Sgjelinek (void) zonecfg_enddsent(t_handle); 3654865e09a4Sgjelinek } 3655865e09a4Sgjelinek 36569acbbeafSnn35248 /* 36579acbbeafSnn35248 * Check that the clone and its source have the same brand type. 36589acbbeafSnn35248 */ 36599acbbeafSnn35248 static int 36609acbbeafSnn35248 valid_brand_clone(char *source_zone, char *target_zone) 36619acbbeafSnn35248 { 3662123807fbSedp brand_handle_t bh; 36639acbbeafSnn35248 char source_brand[MAXNAMELEN]; 36649acbbeafSnn35248 36659acbbeafSnn35248 if ((zone_get_brand(source_zone, source_brand, 36669acbbeafSnn35248 sizeof (source_brand))) != Z_OK) { 36679acbbeafSnn35248 (void) fprintf(stderr, "%s: zone '%s': %s\n", 36689acbbeafSnn35248 execname, source_zone, gettext("missing or invalid brand")); 36699acbbeafSnn35248 return (Z_ERR); 36709acbbeafSnn35248 } 36719acbbeafSnn35248 36729acbbeafSnn35248 if (strcmp(source_brand, target_brand) != NULL) { 36739acbbeafSnn35248 (void) fprintf(stderr, 36749acbbeafSnn35248 gettext("%s: Zones '%s' and '%s' have different brand " 36759acbbeafSnn35248 "types.\n"), execname, source_zone, target_zone); 36769acbbeafSnn35248 return (Z_ERR); 36779acbbeafSnn35248 } 36789acbbeafSnn35248 3679123807fbSedp if ((bh = brand_open(target_brand)) == NULL) { 36809acbbeafSnn35248 zerror(gettext("missing or invalid brand")); 36819acbbeafSnn35248 return (Z_ERR); 36829acbbeafSnn35248 } 3683123807fbSedp brand_close(bh); 36849acbbeafSnn35248 return (Z_OK); 36859acbbeafSnn35248 } 36869acbbeafSnn35248 3687865e09a4Sgjelinek static int 3688865e09a4Sgjelinek validate_clone(char *source_zone, char *target_zone) 3689865e09a4Sgjelinek { 3690865e09a4Sgjelinek int err = Z_OK; 3691865e09a4Sgjelinek zone_dochandle_t s_handle; 3692865e09a4Sgjelinek zone_dochandle_t t_handle; 3693865e09a4Sgjelinek 3694865e09a4Sgjelinek if ((t_handle = zonecfg_init_handle()) == NULL) { 3695865e09a4Sgjelinek zperror(cmd_to_str(CMD_CLONE), B_TRUE); 3696865e09a4Sgjelinek return (Z_ERR); 3697865e09a4Sgjelinek } 3698865e09a4Sgjelinek if ((err = zonecfg_get_handle(target_zone, t_handle)) != Z_OK) { 3699865e09a4Sgjelinek errno = err; 3700865e09a4Sgjelinek zperror(cmd_to_str(CMD_CLONE), B_TRUE); 3701865e09a4Sgjelinek zonecfg_fini_handle(t_handle); 3702865e09a4Sgjelinek return (Z_ERR); 3703865e09a4Sgjelinek } 3704865e09a4Sgjelinek 3705865e09a4Sgjelinek if ((s_handle = zonecfg_init_handle()) == NULL) { 3706865e09a4Sgjelinek zperror(cmd_to_str(CMD_CLONE), B_TRUE); 3707865e09a4Sgjelinek zonecfg_fini_handle(t_handle); 3708865e09a4Sgjelinek return (Z_ERR); 3709865e09a4Sgjelinek } 3710865e09a4Sgjelinek if ((err = zonecfg_get_handle(source_zone, s_handle)) != Z_OK) { 3711865e09a4Sgjelinek errno = err; 3712865e09a4Sgjelinek zperror(cmd_to_str(CMD_CLONE), B_TRUE); 3713865e09a4Sgjelinek goto done; 3714865e09a4Sgjelinek } 3715865e09a4Sgjelinek 37169acbbeafSnn35248 /* verify new zone has same brand type */ 37179acbbeafSnn35248 err = valid_brand_clone(source_zone, target_zone); 37189acbbeafSnn35248 if (err != Z_OK) 37199acbbeafSnn35248 goto done; 37209acbbeafSnn35248 3721865e09a4Sgjelinek /* verify new zone has same inherit-pkg-dirs */ 3722865e09a4Sgjelinek err = valid_ipd_clone(s_handle, source_zone, t_handle, target_zone); 3723865e09a4Sgjelinek 3724865e09a4Sgjelinek /* warn about imported fs's which are the same */ 3725865e09a4Sgjelinek warn_fs_match(s_handle, source_zone, t_handle, target_zone); 3726865e09a4Sgjelinek 3727865e09a4Sgjelinek /* warn about imported IP addresses which are the same */ 3728865e09a4Sgjelinek warn_ip_match(s_handle, source_zone, t_handle, target_zone); 3729865e09a4Sgjelinek 3730865e09a4Sgjelinek /* warn about imported devices which are the same */ 3731865e09a4Sgjelinek warn_dev_match(s_handle, source_zone, t_handle, target_zone); 3732865e09a4Sgjelinek 3733865e09a4Sgjelinek /* warn about imported datasets which are the same */ 3734865e09a4Sgjelinek warn_dataset_match(s_handle, source_zone, t_handle, target_zone); 3735865e09a4Sgjelinek 3736865e09a4Sgjelinek done: 3737865e09a4Sgjelinek zonecfg_fini_handle(t_handle); 3738865e09a4Sgjelinek zonecfg_fini_handle(s_handle); 3739865e09a4Sgjelinek 3740865e09a4Sgjelinek return ((err == Z_OK) ? Z_OK : Z_ERR); 3741865e09a4Sgjelinek } 3742865e09a4Sgjelinek 3743865e09a4Sgjelinek static int 3744865e09a4Sgjelinek copy_zone(char *src, char *dst) 3745865e09a4Sgjelinek { 3746865e09a4Sgjelinek boolean_t out_null = B_FALSE; 3747865e09a4Sgjelinek int status; 3748865e09a4Sgjelinek char *outfile; 3749865e09a4Sgjelinek char cmdbuf[MAXPATHLEN * 2 + 128]; 3750865e09a4Sgjelinek 3751865e09a4Sgjelinek if ((outfile = tempnam("/var/log", "zone")) == NULL) { 3752865e09a4Sgjelinek outfile = "/dev/null"; 3753865e09a4Sgjelinek out_null = B_TRUE; 3754865e09a4Sgjelinek } 3755865e09a4Sgjelinek 37560b5de56dSgjelinek /* 37570b5de56dSgjelinek * Use find to get the list of files to copy. We need to skip 37580b5de56dSgjelinek * files of type "socket" since cpio can't handle those but that 37590b5de56dSgjelinek * should be ok since the app will recreate the socket when it runs. 37600b5de56dSgjelinek * We also need to filter out anything under the .zfs subdir. Since 37610b5de56dSgjelinek * find is running depth-first, we need the extra egrep to filter .zfs. 37620b5de56dSgjelinek */ 3763865e09a4Sgjelinek (void) snprintf(cmdbuf, sizeof (cmdbuf), 37640b5de56dSgjelinek "cd %s && /usr/bin/find . -type s -prune -o -depth -print | " 376507b574eeSgjelinek "/usr/bin/egrep -v '^\\./\\.zfs$|^\\./\\.zfs/' | " 3766865e09a4Sgjelinek "/usr/bin/cpio -pdmuP@ %s > %s 2>&1", 3767865e09a4Sgjelinek src, dst, outfile); 3768865e09a4Sgjelinek 3769865e09a4Sgjelinek status = do_subproc(cmdbuf); 3770865e09a4Sgjelinek 37719acbbeafSnn35248 if (subproc_status("copy", status, B_TRUE) != ZONE_SUBPROC_OK) { 3772865e09a4Sgjelinek if (!out_null) 3773865e09a4Sgjelinek (void) fprintf(stderr, gettext("\nThe copy failed.\n" 3774865e09a4Sgjelinek "More information can be found in %s\n"), outfile); 37759acbbeafSnn35248 return (Z_ERR); 3776865e09a4Sgjelinek } 3777865e09a4Sgjelinek 3778865e09a4Sgjelinek if (!out_null) 3779865e09a4Sgjelinek (void) unlink(outfile); 3780865e09a4Sgjelinek 3781865e09a4Sgjelinek return (Z_OK); 3782865e09a4Sgjelinek } 3783865e09a4Sgjelinek 3784865e09a4Sgjelinek static int 37859acbbeafSnn35248 zone_postclone(char *zonepath) 3786865e09a4Sgjelinek { 37879acbbeafSnn35248 char cmdbuf[MAXPATHLEN]; 3788865e09a4Sgjelinek int status; 3789123807fbSedp brand_handle_t bh; 37909acbbeafSnn35248 int err = Z_OK; 37915cd08338Sgjelinek 37925cd08338Sgjelinek /* 37939acbbeafSnn35248 * Fetch the post-clone command, if any, from the brand 37949acbbeafSnn35248 * configuration. 379545916cd2Sjpk */ 3796123807fbSedp if ((bh = brand_open(target_brand)) == NULL) { 37979acbbeafSnn35248 zerror(gettext("missing or invalid brand")); 37985cd08338Sgjelinek return (Z_ERR); 3799865e09a4Sgjelinek } 38009acbbeafSnn35248 (void) strcpy(cmdbuf, EXEC_PREFIX); 3801123807fbSedp err = brand_get_postclone(bh, target_zone, zonepath, cmdbuf + EXEC_LEN, 38029acbbeafSnn35248 sizeof (cmdbuf) - EXEC_LEN, 0, NULL); 3803123807fbSedp brand_close(bh); 3804865e09a4Sgjelinek 38059acbbeafSnn35248 if (err == 0 && strlen(cmdbuf) > EXEC_LEN) { 38065cd08338Sgjelinek status = do_subproc(cmdbuf); 38079acbbeafSnn35248 if ((err = subproc_status("postclone", status, B_FALSE)) 38089acbbeafSnn35248 != ZONE_SUBPROC_OK) { 38099acbbeafSnn35248 zerror(gettext("post-clone configuration failed.")); 38109acbbeafSnn35248 err = Z_ERR; 38119acbbeafSnn35248 } 3812865e09a4Sgjelinek } 3813865e09a4Sgjelinek 38149acbbeafSnn35248 return (err); 38155cd08338Sgjelinek } 3816865e09a4Sgjelinek 3817865e09a4Sgjelinek /* ARGSUSED */ 38180b5de56dSgjelinek static int 3819865e09a4Sgjelinek zfm_print(const char *p, void *r) { 3820865e09a4Sgjelinek zerror(" %s\n", p); 3821865e09a4Sgjelinek return (0); 3822865e09a4Sgjelinek } 3823865e09a4Sgjelinek 38240b5de56dSgjelinek int 38250b5de56dSgjelinek clone_copy(char *source_zonepath, char *zonepath) 38260b5de56dSgjelinek { 38270b5de56dSgjelinek int err; 38280b5de56dSgjelinek 38290b5de56dSgjelinek /* Don't clone the zone if anything is still mounted there */ 38300b5de56dSgjelinek if (zonecfg_find_mounts(source_zonepath, NULL, NULL)) { 38310b5de56dSgjelinek zerror(gettext("These file systems are mounted on " 38320b5de56dSgjelinek "subdirectories of %s.\n"), source_zonepath); 38330b5de56dSgjelinek (void) zonecfg_find_mounts(source_zonepath, zfm_print, NULL); 38340b5de56dSgjelinek return (Z_ERR); 38350b5de56dSgjelinek } 38360b5de56dSgjelinek 38370b5de56dSgjelinek /* 38380b5de56dSgjelinek * Attempt to create a ZFS fs for the zonepath. As usual, we don't 38390b5de56dSgjelinek * care if this works or not since we always have the default behavior 38400b5de56dSgjelinek * of a simple directory for the zonepath. 38410b5de56dSgjelinek */ 38420b5de56dSgjelinek create_zfs_zonepath(zonepath); 38430b5de56dSgjelinek 38440b5de56dSgjelinek (void) printf(gettext("Copying %s..."), source_zonepath); 38450b5de56dSgjelinek (void) fflush(stdout); 38460b5de56dSgjelinek 38470b5de56dSgjelinek err = copy_zone(source_zonepath, zonepath); 38480b5de56dSgjelinek 38490b5de56dSgjelinek (void) printf("\n"); 38500b5de56dSgjelinek 38510b5de56dSgjelinek return (err); 38520b5de56dSgjelinek } 38530b5de56dSgjelinek 3854865e09a4Sgjelinek static int 3855865e09a4Sgjelinek clone_func(int argc, char *argv[]) 3856865e09a4Sgjelinek { 3857865e09a4Sgjelinek char *source_zone = NULL; 3858865e09a4Sgjelinek int lockfd; 3859865e09a4Sgjelinek int err, arg; 3860865e09a4Sgjelinek char zonepath[MAXPATHLEN]; 3861865e09a4Sgjelinek char source_zonepath[MAXPATHLEN]; 3862865e09a4Sgjelinek zone_state_t state; 3863865e09a4Sgjelinek zone_entry_t *zent; 38640b5de56dSgjelinek char *method = NULL; 38650b5de56dSgjelinek char *snapshot = NULL; 3866865e09a4Sgjelinek 3867865e09a4Sgjelinek if (zonecfg_in_alt_root()) { 3868865e09a4Sgjelinek zerror(gettext("cannot clone zone in alternate root")); 3869865e09a4Sgjelinek return (Z_ERR); 3870865e09a4Sgjelinek } 3871865e09a4Sgjelinek 3872865e09a4Sgjelinek optind = 0; 38730b5de56dSgjelinek if ((arg = getopt(argc, argv, "?m:s:")) != EOF) { 3874865e09a4Sgjelinek switch (arg) { 3875865e09a4Sgjelinek case '?': 3876865e09a4Sgjelinek sub_usage(SHELP_CLONE, CMD_CLONE); 3877865e09a4Sgjelinek return (optopt == '?' ? Z_OK : Z_USAGE); 3878865e09a4Sgjelinek case 'm': 3879865e09a4Sgjelinek method = optarg; 3880865e09a4Sgjelinek break; 38810b5de56dSgjelinek case 's': 38820b5de56dSgjelinek snapshot = optarg; 38830b5de56dSgjelinek break; 3884865e09a4Sgjelinek default: 3885865e09a4Sgjelinek sub_usage(SHELP_CLONE, CMD_CLONE); 3886865e09a4Sgjelinek return (Z_USAGE); 3887865e09a4Sgjelinek } 3888865e09a4Sgjelinek } 38890b5de56dSgjelinek if (argc != (optind + 1) || 38900b5de56dSgjelinek (method != NULL && strcmp(method, "copy") != 0)) { 3891865e09a4Sgjelinek sub_usage(SHELP_CLONE, CMD_CLONE); 3892865e09a4Sgjelinek return (Z_USAGE); 3893865e09a4Sgjelinek } 3894865e09a4Sgjelinek source_zone = argv[optind]; 38959acbbeafSnn35248 if (sanity_check(target_zone, CMD_CLONE, B_FALSE, B_TRUE, B_FALSE) 38969acbbeafSnn35248 != Z_OK) 3897865e09a4Sgjelinek return (Z_ERR); 3898ce28b40eSzt129084 if (verify_details(CMD_CLONE, argv) != Z_OK) 3899865e09a4Sgjelinek return (Z_ERR); 3900865e09a4Sgjelinek 3901865e09a4Sgjelinek /* 3902865e09a4Sgjelinek * We also need to do some extra validation on the source zone. 3903865e09a4Sgjelinek */ 3904865e09a4Sgjelinek if (strcmp(source_zone, GLOBAL_ZONENAME) == 0) { 3905865e09a4Sgjelinek zerror(gettext("%s operation is invalid for the global zone."), 3906865e09a4Sgjelinek cmd_to_str(CMD_CLONE)); 3907865e09a4Sgjelinek return (Z_ERR); 3908865e09a4Sgjelinek } 3909865e09a4Sgjelinek 3910865e09a4Sgjelinek if (strncmp(source_zone, "SUNW", 4) == 0) { 3911865e09a4Sgjelinek zerror(gettext("%s operation is invalid for zones starting " 3912865e09a4Sgjelinek "with SUNW."), cmd_to_str(CMD_CLONE)); 3913865e09a4Sgjelinek return (Z_ERR); 3914865e09a4Sgjelinek } 3915865e09a4Sgjelinek 3916865e09a4Sgjelinek zent = lookup_running_zone(source_zone); 3917865e09a4Sgjelinek if (zent != NULL) { 3918865e09a4Sgjelinek /* check whether the zone is ready or running */ 3919865e09a4Sgjelinek if ((err = zone_get_state(zent->zname, &zent->zstate_num)) 3920865e09a4Sgjelinek != Z_OK) { 3921865e09a4Sgjelinek errno = err; 3922865e09a4Sgjelinek zperror2(zent->zname, gettext("could not get state")); 3923865e09a4Sgjelinek /* can't tell, so hedge */ 3924865e09a4Sgjelinek zent->zstate_str = "ready/running"; 3925865e09a4Sgjelinek } else { 3926865e09a4Sgjelinek zent->zstate_str = zone_state_str(zent->zstate_num); 3927865e09a4Sgjelinek } 3928865e09a4Sgjelinek zerror(gettext("%s operation is invalid for %s zones."), 3929865e09a4Sgjelinek cmd_to_str(CMD_CLONE), zent->zstate_str); 3930865e09a4Sgjelinek return (Z_ERR); 3931865e09a4Sgjelinek } 3932865e09a4Sgjelinek 3933865e09a4Sgjelinek if ((err = zone_get_state(source_zone, &state)) != Z_OK) { 3934865e09a4Sgjelinek errno = err; 3935865e09a4Sgjelinek zperror2(source_zone, gettext("could not get state")); 3936865e09a4Sgjelinek return (Z_ERR); 3937865e09a4Sgjelinek } 3938865e09a4Sgjelinek if (state != ZONE_STATE_INSTALLED) { 3939865e09a4Sgjelinek (void) fprintf(stderr, 3940865e09a4Sgjelinek gettext("%s: zone %s is %s; %s is required.\n"), 3941865e09a4Sgjelinek execname, source_zone, zone_state_str(state), 3942865e09a4Sgjelinek zone_state_str(ZONE_STATE_INSTALLED)); 3943865e09a4Sgjelinek return (Z_ERR); 3944865e09a4Sgjelinek } 3945865e09a4Sgjelinek 3946865e09a4Sgjelinek /* 3947865e09a4Sgjelinek * The source zone checks out ok, continue with the clone. 3948865e09a4Sgjelinek */ 3949865e09a4Sgjelinek 3950865e09a4Sgjelinek if (validate_clone(source_zone, target_zone) != Z_OK) 3951865e09a4Sgjelinek return (Z_ERR); 3952865e09a4Sgjelinek 3953865e09a4Sgjelinek if (grab_lock_file(target_zone, &lockfd) != Z_OK) { 3954865e09a4Sgjelinek zerror(gettext("another %s may have an operation in progress."), 3955865e09a4Sgjelinek "zoneadm"); 3956865e09a4Sgjelinek return (Z_ERR); 3957865e09a4Sgjelinek } 3958865e09a4Sgjelinek 3959865e09a4Sgjelinek if ((err = zone_get_zonepath(source_zone, source_zonepath, 3960865e09a4Sgjelinek sizeof (source_zonepath))) != Z_OK) { 3961865e09a4Sgjelinek errno = err; 3962865e09a4Sgjelinek zperror2(source_zone, gettext("could not get zone path")); 3963865e09a4Sgjelinek goto done; 3964865e09a4Sgjelinek } 3965865e09a4Sgjelinek 3966865e09a4Sgjelinek if ((err = zone_get_zonepath(target_zone, zonepath, sizeof (zonepath))) 3967865e09a4Sgjelinek != Z_OK) { 3968865e09a4Sgjelinek errno = err; 3969865e09a4Sgjelinek zperror2(target_zone, gettext("could not get zone path")); 3970865e09a4Sgjelinek goto done; 3971865e09a4Sgjelinek } 3972865e09a4Sgjelinek 3973865e09a4Sgjelinek if ((err = zone_set_state(target_zone, ZONE_STATE_INCOMPLETE)) 3974865e09a4Sgjelinek != Z_OK) { 3975865e09a4Sgjelinek errno = err; 3976865e09a4Sgjelinek zperror2(target_zone, gettext("could not set state")); 3977865e09a4Sgjelinek goto done; 3978865e09a4Sgjelinek } 3979865e09a4Sgjelinek 39800b5de56dSgjelinek if (snapshot != NULL) { 39810b5de56dSgjelinek err = clone_snapshot_zfs(snapshot, zonepath); 39820b5de56dSgjelinek } else { 39830b5de56dSgjelinek /* 39840b5de56dSgjelinek * We always copy the clone unless the source is ZFS and a 39850b5de56dSgjelinek * ZFS clone worked. We fallback to copying if the ZFS clone 39860b5de56dSgjelinek * fails for some reason. 39870b5de56dSgjelinek */ 39880b5de56dSgjelinek err = Z_ERR; 39890b5de56dSgjelinek if (method == NULL && is_zonepath_zfs(source_zonepath)) 39900b5de56dSgjelinek err = clone_zfs(source_zone, source_zonepath, zonepath); 3991865e09a4Sgjelinek 39925cd08338Sgjelinek if (err != Z_OK) 39930b5de56dSgjelinek err = clone_copy(source_zonepath, zonepath); 39940b5de56dSgjelinek } 3995865e09a4Sgjelinek 39969acbbeafSnn35248 /* 39979acbbeafSnn35248 * Trusted Extensions requires that cloned zones use the same sysid 39989acbbeafSnn35248 * configuration, so it is not appropriate to perform any 39999acbbeafSnn35248 * post-clone reconfiguration. 40009acbbeafSnn35248 */ 40019acbbeafSnn35248 if ((err == Z_OK) && !is_system_labeled()) 40029acbbeafSnn35248 err = zone_postclone(zonepath); 4003865e09a4Sgjelinek 4004865e09a4Sgjelinek done: 40059acbbeafSnn35248 /* 40069acbbeafSnn35248 * If everything went well, we mark the zone as installed. 40079acbbeafSnn35248 */ 40089acbbeafSnn35248 if (err == Z_OK) { 40099acbbeafSnn35248 err = zone_set_state(target_zone, ZONE_STATE_INSTALLED); 40109acbbeafSnn35248 if (err != Z_OK) { 40119acbbeafSnn35248 errno = err; 40129acbbeafSnn35248 zperror2(target_zone, gettext("could not set state")); 40139acbbeafSnn35248 } 40149acbbeafSnn35248 } 4015865e09a4Sgjelinek release_lock_file(lockfd); 4016865e09a4Sgjelinek return ((err == Z_OK) ? Z_OK : Z_ERR); 4017865e09a4Sgjelinek } 4018865e09a4Sgjelinek 401907b574eeSgjelinek /* 40200b5de56dSgjelinek * Used when removing a zonepath after uninstalling or cleaning up after 40210b5de56dSgjelinek * the move subcommand. This handles a zonepath that has non-standard 40220b5de56dSgjelinek * contents so that we will only cleanup the stuff we know about and leave 40230b5de56dSgjelinek * any user data alone. 402407b574eeSgjelinek * 40250b5de56dSgjelinek * If the "all" parameter is true then we should remove the whole zonepath 40260b5de56dSgjelinek * even if it has non-standard files/directories in it. This can be used when 40270b5de56dSgjelinek * we need to cleanup after moving the zonepath across file systems. 40280b5de56dSgjelinek * 40290b5de56dSgjelinek * We "exec" the RMCOMMAND so that the returned status is that of RMCOMMAND 40300b5de56dSgjelinek * and not the shell. 403107b574eeSgjelinek */ 403207b574eeSgjelinek static int 40330b5de56dSgjelinek cleanup_zonepath(char *zonepath, boolean_t all) 403407b574eeSgjelinek { 403507b574eeSgjelinek int status; 40360b5de56dSgjelinek int i; 40370b5de56dSgjelinek boolean_t non_std = B_FALSE; 40380b5de56dSgjelinek struct dirent *dp; 40390b5de56dSgjelinek DIR *dirp; 4040d9e728a2Sgjelinek /* 4041d9e728a2Sgjelinek * The SUNWattached.xml file is expected since it might 4042d9e728a2Sgjelinek * exist if the zone was force-attached after a 4043d9e728a2Sgjelinek * migration. 4044d9e728a2Sgjelinek */ 4045d9e728a2Sgjelinek char *std_entries[] = {"dev", "lu", "root", 4046d9e728a2Sgjelinek "SUNWattached.xml", NULL}; 40470b5de56dSgjelinek /* (MAXPATHLEN * 3) is for the 3 std_entries dirs */ 40480b5de56dSgjelinek char cmdbuf[sizeof (RMCOMMAND) + (MAXPATHLEN * 3) + 64]; 404907b574eeSgjelinek 405007b574eeSgjelinek /* 40510b5de56dSgjelinek * We shouldn't need these checks but lets be paranoid since we 40520b5de56dSgjelinek * could blow away the whole system here if we got the wrong zonepath. 405307b574eeSgjelinek */ 40540b5de56dSgjelinek if (*zonepath == NULL || strcmp(zonepath, "/") == 0) { 40550b5de56dSgjelinek (void) fprintf(stderr, "invalid zonepath '%s'\n", zonepath); 40560b5de56dSgjelinek return (Z_INVAL); 40570b5de56dSgjelinek } 40580b5de56dSgjelinek 405907b574eeSgjelinek /* 40600b5de56dSgjelinek * If the dirpath is already gone (maybe it was manually removed) then 40610b5de56dSgjelinek * we just return Z_OK so that the cleanup is successful. 406207b574eeSgjelinek */ 40630b5de56dSgjelinek if ((dirp = opendir(zonepath)) == NULL) 40640b5de56dSgjelinek return (Z_OK); 40650b5de56dSgjelinek 40660b5de56dSgjelinek /* 40670b5de56dSgjelinek * Look through the zonepath directory to see if there are any 40680b5de56dSgjelinek * non-standard files/dirs. Also skip .zfs since that might be 40690b5de56dSgjelinek * there but we'll handle ZFS file systems as a special case. 40700b5de56dSgjelinek */ 40710b5de56dSgjelinek while ((dp = readdir(dirp)) != NULL) { 40720b5de56dSgjelinek if (strcmp(dp->d_name, ".") == 0 || 40730b5de56dSgjelinek strcmp(dp->d_name, "..") == 0 || 40740b5de56dSgjelinek strcmp(dp->d_name, ".zfs") == 0) 40750b5de56dSgjelinek continue; 40760b5de56dSgjelinek 40770b5de56dSgjelinek for (i = 0; std_entries[i] != NULL; i++) 40780b5de56dSgjelinek if (strcmp(dp->d_name, std_entries[i]) == 0) 40790b5de56dSgjelinek break; 40800b5de56dSgjelinek 40810b5de56dSgjelinek if (std_entries[i] == NULL) 40820b5de56dSgjelinek non_std = B_TRUE; 40830b5de56dSgjelinek } 40840b5de56dSgjelinek (void) closedir(dirp); 40850b5de56dSgjelinek 40860b5de56dSgjelinek if (!all && non_std) { 40870b5de56dSgjelinek /* 40880b5de56dSgjelinek * There are extra, non-standard directories/files in the 40890b5de56dSgjelinek * zonepath so we don't want to remove the zonepath. We 40900b5de56dSgjelinek * just want to remove the standard directories and leave 40910b5de56dSgjelinek * the user data alone. 40920b5de56dSgjelinek */ 40930b5de56dSgjelinek (void) snprintf(cmdbuf, sizeof (cmdbuf), "exec " RMCOMMAND); 40940b5de56dSgjelinek 40950b5de56dSgjelinek for (i = 0; std_entries[i] != NULL; i++) { 40960b5de56dSgjelinek char tmpbuf[MAXPATHLEN]; 40970b5de56dSgjelinek 40980b5de56dSgjelinek if (snprintf(tmpbuf, sizeof (tmpbuf), " %s/%s", 40990b5de56dSgjelinek zonepath, std_entries[i]) >= sizeof (tmpbuf) || 41000b5de56dSgjelinek strlcat(cmdbuf, tmpbuf, sizeof (cmdbuf)) >= 41010b5de56dSgjelinek sizeof (cmdbuf)) { 41020b5de56dSgjelinek (void) fprintf(stderr, 41030b5de56dSgjelinek gettext("path is too long\n")); 41040b5de56dSgjelinek return (Z_INVAL); 41050b5de56dSgjelinek } 410607b574eeSgjelinek } 410707b574eeSgjelinek 410807b574eeSgjelinek status = do_subproc(cmdbuf); 410907b574eeSgjelinek 41100b5de56dSgjelinek (void) fprintf(stderr, gettext("WARNING: Unable to completely " 41110b5de56dSgjelinek "remove %s\nbecause it contains additional user data. " 41120b5de56dSgjelinek "Only the standard directory\nentries have been " 41130b5de56dSgjelinek "removed.\n"), 41140b5de56dSgjelinek zonepath); 411507b574eeSgjelinek 41169acbbeafSnn35248 return ((subproc_status(RMCOMMAND, status, B_TRUE) == 41179acbbeafSnn35248 ZONE_SUBPROC_OK) ? Z_OK : Z_ERR); 41180b5de56dSgjelinek } 41190b5de56dSgjelinek 41200b5de56dSgjelinek /* 41210b5de56dSgjelinek * There is nothing unexpected in the zonepath, try to get rid of the 41220b5de56dSgjelinek * whole zonepath directory. 41230b5de56dSgjelinek * 41240b5de56dSgjelinek * If the zonepath is its own zfs file system, try to destroy the 41250b5de56dSgjelinek * file system. If that fails for some reason (e.g. it has clones) 41260b5de56dSgjelinek * then we'll just remove the contents of the zonepath. 41270b5de56dSgjelinek */ 41280b5de56dSgjelinek if (is_zonepath_zfs(zonepath)) { 41290b5de56dSgjelinek if (destroy_zfs(zonepath) == Z_OK) 41300b5de56dSgjelinek return (Z_OK); 41310b5de56dSgjelinek (void) snprintf(cmdbuf, sizeof (cmdbuf), "exec " RMCOMMAND 41320b5de56dSgjelinek " %s/*", zonepath); 41330b5de56dSgjelinek status = do_subproc(cmdbuf); 41349acbbeafSnn35248 return ((subproc_status(RMCOMMAND, status, B_TRUE) == 41359acbbeafSnn35248 ZONE_SUBPROC_OK) ? Z_OK : Z_ERR); 41360b5de56dSgjelinek } 41370b5de56dSgjelinek 41380b5de56dSgjelinek (void) snprintf(cmdbuf, sizeof (cmdbuf), "exec " RMCOMMAND " %s", 41390b5de56dSgjelinek zonepath); 41400b5de56dSgjelinek status = do_subproc(cmdbuf); 41419acbbeafSnn35248 41429acbbeafSnn35248 return ((subproc_status(RMCOMMAND, status, B_TRUE) == ZONE_SUBPROC_OK) 41439acbbeafSnn35248 ? Z_OK : Z_ERR); 414407b574eeSgjelinek } 414507b574eeSgjelinek 4146865e09a4Sgjelinek static int 4147865e09a4Sgjelinek move_func(int argc, char *argv[]) 4148865e09a4Sgjelinek { 4149865e09a4Sgjelinek char *new_zonepath = NULL; 4150865e09a4Sgjelinek int lockfd; 4151865e09a4Sgjelinek int err, arg; 4152865e09a4Sgjelinek char zonepath[MAXPATHLEN]; 4153865e09a4Sgjelinek zone_dochandle_t handle; 4154865e09a4Sgjelinek boolean_t fast; 41550b5de56dSgjelinek boolean_t is_zfs = B_FALSE; 41560b5de56dSgjelinek struct dirent *dp; 41570b5de56dSgjelinek DIR *dirp; 41580b5de56dSgjelinek boolean_t empty = B_TRUE; 4159865e09a4Sgjelinek boolean_t revert; 4160865e09a4Sgjelinek struct stat zonepath_buf; 4161865e09a4Sgjelinek struct stat new_zonepath_buf; 4162865e09a4Sgjelinek 4163865e09a4Sgjelinek if (zonecfg_in_alt_root()) { 4164865e09a4Sgjelinek zerror(gettext("cannot move zone in alternate root")); 4165865e09a4Sgjelinek return (Z_ERR); 4166865e09a4Sgjelinek } 4167865e09a4Sgjelinek 4168865e09a4Sgjelinek optind = 0; 4169865e09a4Sgjelinek if ((arg = getopt(argc, argv, "?")) != EOF) { 4170865e09a4Sgjelinek switch (arg) { 4171865e09a4Sgjelinek case '?': 4172865e09a4Sgjelinek sub_usage(SHELP_MOVE, CMD_MOVE); 4173865e09a4Sgjelinek return (optopt == '?' ? Z_OK : Z_USAGE); 4174865e09a4Sgjelinek default: 4175865e09a4Sgjelinek sub_usage(SHELP_MOVE, CMD_MOVE); 4176865e09a4Sgjelinek return (Z_USAGE); 4177865e09a4Sgjelinek } 4178865e09a4Sgjelinek } 4179865e09a4Sgjelinek if (argc != (optind + 1)) { 4180865e09a4Sgjelinek sub_usage(SHELP_MOVE, CMD_MOVE); 4181865e09a4Sgjelinek return (Z_USAGE); 4182865e09a4Sgjelinek } 4183865e09a4Sgjelinek new_zonepath = argv[optind]; 41849acbbeafSnn35248 if (sanity_check(target_zone, CMD_MOVE, B_FALSE, B_TRUE, B_FALSE) 41859acbbeafSnn35248 != Z_OK) 4186865e09a4Sgjelinek return (Z_ERR); 4187ce28b40eSzt129084 if (verify_details(CMD_MOVE, argv) != Z_OK) 4188865e09a4Sgjelinek return (Z_ERR); 4189865e09a4Sgjelinek 4190865e09a4Sgjelinek /* 4191865e09a4Sgjelinek * Check out the new zonepath. This has the side effect of creating 4192865e09a4Sgjelinek * a directory for the new zonepath. We depend on this later when we 41930b5de56dSgjelinek * stat to see if we are doing a cross file system move or not. 4194865e09a4Sgjelinek */ 4195865e09a4Sgjelinek if (validate_zonepath(new_zonepath, CMD_MOVE) != Z_OK) 4196865e09a4Sgjelinek return (Z_ERR); 4197865e09a4Sgjelinek 4198865e09a4Sgjelinek if ((err = zone_get_zonepath(target_zone, zonepath, sizeof (zonepath))) 4199865e09a4Sgjelinek != Z_OK) { 4200865e09a4Sgjelinek errno = err; 4201865e09a4Sgjelinek zperror2(target_zone, gettext("could not get zone path")); 4202865e09a4Sgjelinek return (Z_ERR); 4203865e09a4Sgjelinek } 4204865e09a4Sgjelinek 4205865e09a4Sgjelinek if (stat(zonepath, &zonepath_buf) == -1) { 4206865e09a4Sgjelinek zperror(gettext("could not stat zone path"), B_FALSE); 4207865e09a4Sgjelinek return (Z_ERR); 4208865e09a4Sgjelinek } 4209865e09a4Sgjelinek 4210865e09a4Sgjelinek if (stat(new_zonepath, &new_zonepath_buf) == -1) { 4211865e09a4Sgjelinek zperror(gettext("could not stat new zone path"), B_FALSE); 4212865e09a4Sgjelinek return (Z_ERR); 4213865e09a4Sgjelinek } 4214865e09a4Sgjelinek 42150b5de56dSgjelinek /* 42160b5de56dSgjelinek * Check if the destination directory is empty. 42170b5de56dSgjelinek */ 42180b5de56dSgjelinek if ((dirp = opendir(new_zonepath)) == NULL) { 42190b5de56dSgjelinek zperror(gettext("could not open new zone path"), B_FALSE); 42200b5de56dSgjelinek return (Z_ERR); 42210b5de56dSgjelinek } 42220b5de56dSgjelinek while ((dp = readdir(dirp)) != (struct dirent *)0) { 42230b5de56dSgjelinek if (strcmp(dp->d_name, ".") == 0 || 42240b5de56dSgjelinek strcmp(dp->d_name, "..") == 0) 42250b5de56dSgjelinek continue; 42260b5de56dSgjelinek empty = B_FALSE; 42270b5de56dSgjelinek break; 42280b5de56dSgjelinek } 42290b5de56dSgjelinek (void) closedir(dirp); 42300b5de56dSgjelinek 42310b5de56dSgjelinek /* Error if there is anything in the destination directory. */ 42320b5de56dSgjelinek if (!empty) { 42330b5de56dSgjelinek (void) fprintf(stderr, gettext("could not move zone to %s: " 42340b5de56dSgjelinek "directory not empty\n"), new_zonepath); 42350b5de56dSgjelinek return (Z_ERR); 42360b5de56dSgjelinek } 42370b5de56dSgjelinek 4238865e09a4Sgjelinek /* Don't move the zone if anything is still mounted there */ 4239865e09a4Sgjelinek if (zonecfg_find_mounts(zonepath, NULL, NULL)) { 42400b5de56dSgjelinek zerror(gettext("These file systems are mounted on " 4241865e09a4Sgjelinek "subdirectories of %s.\n"), zonepath); 4242865e09a4Sgjelinek (void) zonecfg_find_mounts(zonepath, zfm_print, NULL); 4243865e09a4Sgjelinek return (Z_ERR); 4244865e09a4Sgjelinek } 4245865e09a4Sgjelinek 4246865e09a4Sgjelinek /* 4247865e09a4Sgjelinek * Check if we are moving in the same file system and can do a fast 4248865e09a4Sgjelinek * move or if we are crossing file systems and have to copy the data. 4249865e09a4Sgjelinek */ 4250865e09a4Sgjelinek fast = (zonepath_buf.st_dev == new_zonepath_buf.st_dev); 4251865e09a4Sgjelinek 4252865e09a4Sgjelinek if ((handle = zonecfg_init_handle()) == NULL) { 4253865e09a4Sgjelinek zperror(cmd_to_str(CMD_MOVE), B_TRUE); 4254865e09a4Sgjelinek return (Z_ERR); 4255865e09a4Sgjelinek } 4256865e09a4Sgjelinek 4257865e09a4Sgjelinek if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) { 4258865e09a4Sgjelinek errno = err; 4259865e09a4Sgjelinek zperror(cmd_to_str(CMD_MOVE), B_TRUE); 4260865e09a4Sgjelinek zonecfg_fini_handle(handle); 4261865e09a4Sgjelinek return (Z_ERR); 4262865e09a4Sgjelinek } 4263865e09a4Sgjelinek 4264865e09a4Sgjelinek if (grab_lock_file(target_zone, &lockfd) != Z_OK) { 4265865e09a4Sgjelinek zerror(gettext("another %s may have an operation in progress."), 4266865e09a4Sgjelinek "zoneadm"); 4267865e09a4Sgjelinek zonecfg_fini_handle(handle); 4268865e09a4Sgjelinek return (Z_ERR); 4269865e09a4Sgjelinek } 4270865e09a4Sgjelinek 4271865e09a4Sgjelinek /* 42720b5de56dSgjelinek * We're making some file system changes now so we have to clean up 42730b5de56dSgjelinek * the file system before we are done. This will either clean up the 4274865e09a4Sgjelinek * new zonepath if the zonecfg update failed or it will clean up the 4275865e09a4Sgjelinek * old zonepath if everything is ok. 4276865e09a4Sgjelinek */ 4277865e09a4Sgjelinek revert = B_TRUE; 4278865e09a4Sgjelinek 42790b5de56dSgjelinek if (is_zonepath_zfs(zonepath) && 42800b5de56dSgjelinek move_zfs(zonepath, new_zonepath) != Z_ERR) { 42810b5de56dSgjelinek is_zfs = B_TRUE; 42820b5de56dSgjelinek 42830b5de56dSgjelinek } else if (fast) { 4284865e09a4Sgjelinek /* same file system, use rename for a quick move */ 4285865e09a4Sgjelinek 4286865e09a4Sgjelinek /* 4287865e09a4Sgjelinek * Remove the new_zonepath directory that got created above 4288865e09a4Sgjelinek * during the validation. It gets in the way of the rename. 4289865e09a4Sgjelinek */ 4290865e09a4Sgjelinek if (rmdir(new_zonepath) != 0) { 4291865e09a4Sgjelinek zperror(gettext("could not rmdir new zone path"), 4292865e09a4Sgjelinek B_FALSE); 4293865e09a4Sgjelinek zonecfg_fini_handle(handle); 4294865e09a4Sgjelinek release_lock_file(lockfd); 4295865e09a4Sgjelinek return (Z_ERR); 4296865e09a4Sgjelinek } 4297865e09a4Sgjelinek 4298865e09a4Sgjelinek if (rename(zonepath, new_zonepath) != 0) { 4299865e09a4Sgjelinek /* 4300865e09a4Sgjelinek * If this fails we don't need to do all of the 4301865e09a4Sgjelinek * cleanup that happens for the rest of the code 4302865e09a4Sgjelinek * so just return from this error. 4303865e09a4Sgjelinek */ 4304865e09a4Sgjelinek zperror(gettext("could not move zone"), B_FALSE); 4305865e09a4Sgjelinek zonecfg_fini_handle(handle); 4306865e09a4Sgjelinek release_lock_file(lockfd); 4307865e09a4Sgjelinek return (Z_ERR); 4308865e09a4Sgjelinek } 4309865e09a4Sgjelinek 4310865e09a4Sgjelinek } else { 43110b5de56dSgjelinek /* 43120b5de56dSgjelinek * Attempt to create a ZFS fs for the new zonepath. As usual, 43130b5de56dSgjelinek * we don't care if this works or not since we always have the 43140b5de56dSgjelinek * default behavior of a simple directory for the zonepath. 43150b5de56dSgjelinek */ 43160b5de56dSgjelinek create_zfs_zonepath(new_zonepath); 43170b5de56dSgjelinek 4318865e09a4Sgjelinek (void) printf(gettext( 43190b5de56dSgjelinek "Moving across file systems; copying zonepath %s..."), 4320865e09a4Sgjelinek zonepath); 4321865e09a4Sgjelinek (void) fflush(stdout); 4322865e09a4Sgjelinek 4323865e09a4Sgjelinek err = copy_zone(zonepath, new_zonepath); 4324865e09a4Sgjelinek 4325865e09a4Sgjelinek (void) printf("\n"); 4326865e09a4Sgjelinek if (err != Z_OK) 4327865e09a4Sgjelinek goto done; 4328865e09a4Sgjelinek } 4329865e09a4Sgjelinek 4330865e09a4Sgjelinek if ((err = zonecfg_set_zonepath(handle, new_zonepath)) != Z_OK) { 4331865e09a4Sgjelinek errno = err; 4332865e09a4Sgjelinek zperror(gettext("could not set new zonepath"), B_TRUE); 4333865e09a4Sgjelinek goto done; 4334865e09a4Sgjelinek } 4335865e09a4Sgjelinek 4336865e09a4Sgjelinek if ((err = zonecfg_save(handle)) != Z_OK) { 4337865e09a4Sgjelinek errno = err; 4338865e09a4Sgjelinek zperror(gettext("zonecfg save failed"), B_TRUE); 4339865e09a4Sgjelinek goto done; 4340865e09a4Sgjelinek } 4341865e09a4Sgjelinek 4342865e09a4Sgjelinek revert = B_FALSE; 4343865e09a4Sgjelinek 4344865e09a4Sgjelinek done: 4345865e09a4Sgjelinek zonecfg_fini_handle(handle); 4346865e09a4Sgjelinek release_lock_file(lockfd); 4347865e09a4Sgjelinek 4348865e09a4Sgjelinek /* 43490b5de56dSgjelinek * Clean up the file system based on how things went. We either 4350865e09a4Sgjelinek * clean up the new zonepath if the operation failed for some reason 4351865e09a4Sgjelinek * or we clean up the old zonepath if everything is ok. 4352865e09a4Sgjelinek */ 4353865e09a4Sgjelinek if (revert) { 4354865e09a4Sgjelinek /* The zonecfg update failed, cleanup the new zonepath. */ 43550b5de56dSgjelinek if (is_zfs) { 43560b5de56dSgjelinek if (move_zfs(new_zonepath, zonepath) == Z_ERR) { 43570b5de56dSgjelinek (void) fprintf(stderr, gettext("could not " 43580b5de56dSgjelinek "restore zonepath, the zfs mountpoint is " 43590b5de56dSgjelinek "set as:\n%s\n"), new_zonepath); 43600b5de56dSgjelinek /* 43610b5de56dSgjelinek * err is already != Z_OK since we're reverting 43620b5de56dSgjelinek */ 43630b5de56dSgjelinek } 43640b5de56dSgjelinek 43650b5de56dSgjelinek } else if (fast) { 4366865e09a4Sgjelinek if (rename(new_zonepath, zonepath) != 0) { 4367865e09a4Sgjelinek zperror(gettext("could not restore zonepath"), 4368865e09a4Sgjelinek B_FALSE); 4369865e09a4Sgjelinek /* 4370865e09a4Sgjelinek * err is already != Z_OK since we're reverting 4371865e09a4Sgjelinek */ 4372865e09a4Sgjelinek } 4373865e09a4Sgjelinek } else { 4374865e09a4Sgjelinek (void) printf(gettext("Cleaning up zonepath %s..."), 4375865e09a4Sgjelinek new_zonepath); 4376865e09a4Sgjelinek (void) fflush(stdout); 43770b5de56dSgjelinek err = cleanup_zonepath(new_zonepath, B_TRUE); 4378865e09a4Sgjelinek (void) printf("\n"); 4379865e09a4Sgjelinek 438007b574eeSgjelinek if (err != Z_OK) { 4381865e09a4Sgjelinek errno = err; 4382865e09a4Sgjelinek zperror(gettext("could not remove new " 4383865e09a4Sgjelinek "zonepath"), B_TRUE); 4384865e09a4Sgjelinek } else { 4385865e09a4Sgjelinek /* 4386865e09a4Sgjelinek * Because we're reverting we know the mainline 4387865e09a4Sgjelinek * code failed but we just reused the err 4388865e09a4Sgjelinek * variable so we reset it back to Z_ERR. 4389865e09a4Sgjelinek */ 4390865e09a4Sgjelinek err = Z_ERR; 4391865e09a4Sgjelinek } 4392865e09a4Sgjelinek } 4393865e09a4Sgjelinek 4394865e09a4Sgjelinek } else { 4395865e09a4Sgjelinek /* The move was successful, cleanup the old zonepath. */ 43960b5de56dSgjelinek if (!is_zfs && !fast) { 4397865e09a4Sgjelinek (void) printf( 4398865e09a4Sgjelinek gettext("Cleaning up zonepath %s..."), zonepath); 4399865e09a4Sgjelinek (void) fflush(stdout); 44000b5de56dSgjelinek err = cleanup_zonepath(zonepath, B_TRUE); 4401865e09a4Sgjelinek (void) printf("\n"); 4402865e09a4Sgjelinek 440307b574eeSgjelinek if (err != Z_OK) { 4404865e09a4Sgjelinek errno = err; 4405865e09a4Sgjelinek zperror(gettext("could not remove zonepath"), 4406865e09a4Sgjelinek B_TRUE); 4407865e09a4Sgjelinek } 4408865e09a4Sgjelinek } 4409865e09a4Sgjelinek } 4410865e09a4Sgjelinek 4411865e09a4Sgjelinek return ((err == Z_OK) ? Z_OK : Z_ERR); 4412865e09a4Sgjelinek } 4413865e09a4Sgjelinek 4414ee519a1fSgjelinek static int 4415ee519a1fSgjelinek detach_func(int argc, char *argv[]) 4416ee519a1fSgjelinek { 4417ee519a1fSgjelinek int lockfd; 4418ee519a1fSgjelinek int err, arg; 4419ee519a1fSgjelinek char zonepath[MAXPATHLEN]; 4420ee519a1fSgjelinek zone_dochandle_t handle; 44218cd327d5Sgjelinek boolean_t execute = B_TRUE; 4422ee519a1fSgjelinek 4423ee519a1fSgjelinek if (zonecfg_in_alt_root()) { 4424ee519a1fSgjelinek zerror(gettext("cannot detach zone in alternate root")); 4425ee519a1fSgjelinek return (Z_ERR); 4426ee519a1fSgjelinek } 4427ee519a1fSgjelinek 4428ee519a1fSgjelinek optind = 0; 44298cd327d5Sgjelinek if ((arg = getopt(argc, argv, "?n")) != EOF) { 4430ee519a1fSgjelinek switch (arg) { 4431ee519a1fSgjelinek case '?': 4432ee519a1fSgjelinek sub_usage(SHELP_DETACH, CMD_DETACH); 4433ee519a1fSgjelinek return (optopt == '?' ? Z_OK : Z_USAGE); 44348cd327d5Sgjelinek case 'n': 44358cd327d5Sgjelinek execute = B_FALSE; 44368cd327d5Sgjelinek break; 4437ee519a1fSgjelinek default: 4438ee519a1fSgjelinek sub_usage(SHELP_DETACH, CMD_DETACH); 4439ee519a1fSgjelinek return (Z_USAGE); 4440ee519a1fSgjelinek } 4441ee519a1fSgjelinek } 44429acbbeafSnn35248 44438cd327d5Sgjelinek if (execute) { 44449acbbeafSnn35248 if (sanity_check(target_zone, CMD_DETACH, B_FALSE, B_TRUE, 44459acbbeafSnn35248 B_FALSE) != Z_OK) 4446ee519a1fSgjelinek return (Z_ERR); 4447ce28b40eSzt129084 if (verify_details(CMD_DETACH, argv) != Z_OK) 4448ee519a1fSgjelinek return (Z_ERR); 44498cd327d5Sgjelinek } else { 44508cd327d5Sgjelinek /* 44518cd327d5Sgjelinek * We want a dry-run to work for a non-privileged user so we 44528cd327d5Sgjelinek * only do minimal validation. 44538cd327d5Sgjelinek */ 44548cd327d5Sgjelinek if (target_zone == NULL) { 44558cd327d5Sgjelinek zerror(gettext("no zone specified")); 44568cd327d5Sgjelinek return (Z_ERR); 44578cd327d5Sgjelinek } 44588cd327d5Sgjelinek 44598cd327d5Sgjelinek if (strcmp(target_zone, GLOBAL_ZONENAME) == 0) { 44608cd327d5Sgjelinek zerror(gettext("%s operation is invalid for the " 44618cd327d5Sgjelinek "global zone."), cmd_to_str(CMD_DETACH)); 44628cd327d5Sgjelinek return (Z_ERR); 44638cd327d5Sgjelinek } 44648cd327d5Sgjelinek } 4465ee519a1fSgjelinek 4466ee519a1fSgjelinek if ((err = zone_get_zonepath(target_zone, zonepath, sizeof (zonepath))) 4467ee519a1fSgjelinek != Z_OK) { 4468ee519a1fSgjelinek errno = err; 4469ee519a1fSgjelinek zperror2(target_zone, gettext("could not get zone path")); 4470ee519a1fSgjelinek return (Z_ERR); 4471ee519a1fSgjelinek } 4472ee519a1fSgjelinek 4473ee519a1fSgjelinek /* Don't detach the zone if anything is still mounted there */ 44748cd327d5Sgjelinek if (execute && zonecfg_find_mounts(zonepath, NULL, NULL)) { 44750b5de56dSgjelinek zerror(gettext("These file systems are mounted on " 4476ee519a1fSgjelinek "subdirectories of %s.\n"), zonepath); 4477ee519a1fSgjelinek (void) zonecfg_find_mounts(zonepath, zfm_print, NULL); 4478ee519a1fSgjelinek return (Z_ERR); 4479ee519a1fSgjelinek } 4480ee519a1fSgjelinek 4481ee519a1fSgjelinek if ((handle = zonecfg_init_handle()) == NULL) { 4482ee519a1fSgjelinek zperror(cmd_to_str(CMD_DETACH), B_TRUE); 4483ee519a1fSgjelinek return (Z_ERR); 4484ee519a1fSgjelinek } 4485ee519a1fSgjelinek 4486ee519a1fSgjelinek if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) { 4487ee519a1fSgjelinek errno = err; 4488ee519a1fSgjelinek zperror(cmd_to_str(CMD_DETACH), B_TRUE); 4489ee519a1fSgjelinek zonecfg_fini_handle(handle); 4490ee519a1fSgjelinek return (Z_ERR); 4491ee519a1fSgjelinek } 4492ee519a1fSgjelinek 44938cd327d5Sgjelinek if (execute && grab_lock_file(target_zone, &lockfd) != Z_OK) { 4494ee519a1fSgjelinek zerror(gettext("another %s may have an operation in progress."), 4495ee519a1fSgjelinek "zoneadm"); 4496ee519a1fSgjelinek zonecfg_fini_handle(handle); 4497ee519a1fSgjelinek return (Z_ERR); 4498ee519a1fSgjelinek } 4499ee519a1fSgjelinek 4500ee519a1fSgjelinek if ((err = zonecfg_get_detach_info(handle, B_TRUE)) != Z_OK) { 4501ee519a1fSgjelinek errno = err; 4502ee519a1fSgjelinek zperror(gettext("getting the detach information failed"), 4503ee519a1fSgjelinek B_TRUE); 4504ee519a1fSgjelinek goto done; 4505ee519a1fSgjelinek } 4506ee519a1fSgjelinek 45078cd327d5Sgjelinek if ((err = zonecfg_detach_save(handle, (execute ? 0 : ZONE_DRY_RUN))) 45088cd327d5Sgjelinek != Z_OK) { 4509ee519a1fSgjelinek errno = err; 4510ee519a1fSgjelinek zperror(gettext("saving the detach manifest failed"), B_TRUE); 4511ee519a1fSgjelinek goto done; 4512ee519a1fSgjelinek } 4513ee519a1fSgjelinek 45148cd327d5Sgjelinek /* 45158cd327d5Sgjelinek * Set the zone state back to configured unless we are running with the 45168cd327d5Sgjelinek * no-execute option. 45178cd327d5Sgjelinek */ 45188cd327d5Sgjelinek if (execute && (err = zone_set_state(target_zone, 45198cd327d5Sgjelinek ZONE_STATE_CONFIGURED)) != Z_OK) { 4520ee519a1fSgjelinek errno = err; 4521ee519a1fSgjelinek zperror(gettext("could not reset state"), B_TRUE); 4522ee519a1fSgjelinek } 4523ee519a1fSgjelinek 4524ee519a1fSgjelinek done: 4525ee519a1fSgjelinek zonecfg_fini_handle(handle); 45268cd327d5Sgjelinek if (execute) 4527ee519a1fSgjelinek release_lock_file(lockfd); 4528ee519a1fSgjelinek 4529ee519a1fSgjelinek return ((err == Z_OK) ? Z_OK : Z_ERR); 4530ee519a1fSgjelinek } 4531ee519a1fSgjelinek 4532ee519a1fSgjelinek /* 4533ee519a1fSgjelinek * During attach we go through and fix up the /dev entries for the zone 4534ee519a1fSgjelinek * we are attaching. In order to regenerate /dev with the correct devices, 4535ee519a1fSgjelinek * the old /dev will be removed, the zone readied (which generates a new 4536ee519a1fSgjelinek * /dev) then halted, then we use the info from the manifest to update 4537ee519a1fSgjelinek * the modes, owners, etc. on the new /dev. 4538ee519a1fSgjelinek */ 4539ee519a1fSgjelinek static int 4540ee519a1fSgjelinek dev_fix(zone_dochandle_t handle) 4541ee519a1fSgjelinek { 4542ee519a1fSgjelinek int res; 4543ee519a1fSgjelinek int err; 4544ee519a1fSgjelinek int status; 4545ee519a1fSgjelinek struct zone_devpermtab devtab; 4546ee519a1fSgjelinek zone_cmd_arg_t zarg; 4547ee519a1fSgjelinek char devpath[MAXPATHLEN]; 4548ee519a1fSgjelinek /* 6: "exec " and " " */ 4549ee519a1fSgjelinek char cmdbuf[sizeof (RMCOMMAND) + MAXPATHLEN + 6]; 4550ee519a1fSgjelinek 4551ee519a1fSgjelinek if ((res = zonecfg_get_zonepath(handle, devpath, sizeof (devpath))) 4552ee519a1fSgjelinek != Z_OK) 4553ee519a1fSgjelinek return (res); 4554ee519a1fSgjelinek 4555ee519a1fSgjelinek if (strlcat(devpath, "/dev", sizeof (devpath)) >= sizeof (devpath)) 4556ee519a1fSgjelinek return (Z_TOO_BIG); 4557ee519a1fSgjelinek 4558ee519a1fSgjelinek /* 4559ee519a1fSgjelinek * "exec" the command so that the returned status is that of 4560ee519a1fSgjelinek * RMCOMMAND and not the shell. 4561ee519a1fSgjelinek */ 45629acbbeafSnn35248 (void) snprintf(cmdbuf, sizeof (cmdbuf), EXEC_PREFIX RMCOMMAND " %s", 4563ee519a1fSgjelinek devpath); 4564ee519a1fSgjelinek status = do_subproc(cmdbuf); 45659acbbeafSnn35248 if ((err = subproc_status(RMCOMMAND, status, B_TRUE)) != 45669acbbeafSnn35248 ZONE_SUBPROC_OK) { 4567ee519a1fSgjelinek (void) fprintf(stderr, 4568ee519a1fSgjelinek gettext("could not remove existing /dev\n")); 4569ee519a1fSgjelinek return (Z_ERR); 4570ee519a1fSgjelinek } 4571ee519a1fSgjelinek 4572ee519a1fSgjelinek /* In order to ready the zone, it must be in the installed state */ 4573ee519a1fSgjelinek if ((err = zone_set_state(target_zone, ZONE_STATE_INSTALLED)) != Z_OK) { 4574ee519a1fSgjelinek errno = err; 4575ee519a1fSgjelinek zperror(gettext("could not reset state"), B_TRUE); 4576ee519a1fSgjelinek return (Z_ERR); 4577ee519a1fSgjelinek } 4578ee519a1fSgjelinek 4579ee519a1fSgjelinek /* We have to ready the zone to regen the dev tree */ 4580ee519a1fSgjelinek zarg.cmd = Z_READY; 4581ee519a1fSgjelinek if (call_zoneadmd(target_zone, &zarg) != 0) { 4582ee519a1fSgjelinek zerror(gettext("call to %s failed"), "zoneadmd"); 45830209230bSgjelinek /* attempt to restore zone to configured state */ 45840209230bSgjelinek (void) zone_set_state(target_zone, ZONE_STATE_CONFIGURED); 4585ee519a1fSgjelinek return (Z_ERR); 4586ee519a1fSgjelinek } 4587ee519a1fSgjelinek 4588ee519a1fSgjelinek zarg.cmd = Z_HALT; 4589ee519a1fSgjelinek if (call_zoneadmd(target_zone, &zarg) != 0) { 4590ee519a1fSgjelinek zerror(gettext("call to %s failed"), "zoneadmd"); 45910209230bSgjelinek /* attempt to restore zone to configured state */ 45920209230bSgjelinek (void) zone_set_state(target_zone, ZONE_STATE_CONFIGURED); 4593ee519a1fSgjelinek return (Z_ERR); 4594ee519a1fSgjelinek } 4595ee519a1fSgjelinek 45960209230bSgjelinek /* attempt to restore zone to configured state */ 45970209230bSgjelinek (void) zone_set_state(target_zone, ZONE_STATE_CONFIGURED); 45980209230bSgjelinek 4599ee519a1fSgjelinek if (zonecfg_setdevperment(handle) != Z_OK) { 4600ee519a1fSgjelinek (void) fprintf(stderr, 4601ee519a1fSgjelinek gettext("unable to enumerate device entries\n")); 4602ee519a1fSgjelinek return (Z_ERR); 4603ee519a1fSgjelinek } 4604ee519a1fSgjelinek 4605ee519a1fSgjelinek while (zonecfg_getdevperment(handle, &devtab) == Z_OK) { 4606ee519a1fSgjelinek int err; 4607ee519a1fSgjelinek 4608ee519a1fSgjelinek if ((err = zonecfg_devperms_apply(handle, 4609ee519a1fSgjelinek devtab.zone_devperm_name, devtab.zone_devperm_uid, 4610ee519a1fSgjelinek devtab.zone_devperm_gid, devtab.zone_devperm_mode, 4611ee519a1fSgjelinek devtab.zone_devperm_acl)) != Z_OK && err != Z_INVAL) 4612ee519a1fSgjelinek (void) fprintf(stderr, gettext("error updating device " 4613ee519a1fSgjelinek "%s: %s\n"), devtab.zone_devperm_name, 4614ee519a1fSgjelinek zonecfg_strerror(err)); 4615ee519a1fSgjelinek 4616ee519a1fSgjelinek free(devtab.zone_devperm_acl); 4617ee519a1fSgjelinek } 4618ee519a1fSgjelinek 4619ee519a1fSgjelinek (void) zonecfg_enddevperment(handle); 4620ee519a1fSgjelinek 4621ee519a1fSgjelinek return (Z_OK); 4622ee519a1fSgjelinek } 4623ee519a1fSgjelinek 46248cd327d5Sgjelinek /* 46258cd327d5Sgjelinek * Validate attaching a zone but don't actually do the work. The zone 46268cd327d5Sgjelinek * does not have to exist, so there is some complexity getting a new zone 46278cd327d5Sgjelinek * configuration set up so that we can perform the validation. This is 46288cd327d5Sgjelinek * handled within zonecfg_attach_manifest() which returns two handles; one 46298cd327d5Sgjelinek * for the the full configuration to validate (rem_handle) and the other 46308cd327d5Sgjelinek * (local_handle) containing only the zone configuration derived from the 46318cd327d5Sgjelinek * manifest. 46328cd327d5Sgjelinek */ 46338cd327d5Sgjelinek static int 4634ce28b40eSzt129084 dryrun_attach(char *manifest_path, char *argv[]) 46358cd327d5Sgjelinek { 46368cd327d5Sgjelinek int fd; 46378cd327d5Sgjelinek int err; 46388cd327d5Sgjelinek int res; 46398cd327d5Sgjelinek zone_dochandle_t local_handle; 46408cd327d5Sgjelinek zone_dochandle_t rem_handle = NULL; 46418cd327d5Sgjelinek 46428cd327d5Sgjelinek if (strcmp(manifest_path, "-") == 0) { 46438cd327d5Sgjelinek fd = 0; 46448cd327d5Sgjelinek } else if ((fd = open(manifest_path, O_RDONLY)) < 0) { 46458cd327d5Sgjelinek zperror(gettext("could not open manifest path"), B_FALSE); 46468cd327d5Sgjelinek return (Z_ERR); 46478cd327d5Sgjelinek } 46488cd327d5Sgjelinek 46498cd327d5Sgjelinek if ((local_handle = zonecfg_init_handle()) == NULL) { 46508cd327d5Sgjelinek zperror(cmd_to_str(CMD_ATTACH), B_TRUE); 46518cd327d5Sgjelinek res = Z_ERR; 46528cd327d5Sgjelinek goto done; 46538cd327d5Sgjelinek } 46548cd327d5Sgjelinek 46558cd327d5Sgjelinek if ((rem_handle = zonecfg_init_handle()) == NULL) { 46568cd327d5Sgjelinek zperror(cmd_to_str(CMD_ATTACH), B_TRUE); 46578cd327d5Sgjelinek res = Z_ERR; 46588cd327d5Sgjelinek goto done; 46598cd327d5Sgjelinek } 46608cd327d5Sgjelinek 46618cd327d5Sgjelinek if ((err = zonecfg_attach_manifest(fd, local_handle, rem_handle)) 46628cd327d5Sgjelinek != Z_OK) { 46638cd327d5Sgjelinek res = Z_ERR; 4664d9e728a2Sgjelinek 4665d9e728a2Sgjelinek if (err == Z_INVALID_DOCUMENT) { 4666d9e728a2Sgjelinek struct stat st; 4667d9e728a2Sgjelinek char buf[6]; 4668d9e728a2Sgjelinek 4669d9e728a2Sgjelinek if (strcmp(manifest_path, "-") == 0) { 4670d9e728a2Sgjelinek zerror(gettext("Input is not a valid XML " 4671d9e728a2Sgjelinek "file")); 4672d9e728a2Sgjelinek goto done; 4673d9e728a2Sgjelinek } 4674d9e728a2Sgjelinek 4675d9e728a2Sgjelinek if (fstat(fd, &st) == -1 || !S_ISREG(st.st_mode)) { 4676d9e728a2Sgjelinek zerror(gettext("%s is not an XML file"), 4677d9e728a2Sgjelinek manifest_path); 4678d9e728a2Sgjelinek goto done; 4679d9e728a2Sgjelinek } 4680d9e728a2Sgjelinek 4681d9e728a2Sgjelinek bzero(buf, sizeof (buf)); 4682d9e728a2Sgjelinek (void) lseek(fd, 0L, SEEK_SET); 4683d9e728a2Sgjelinek if (read(fd, buf, sizeof (buf) - 1) < 0 || 4684d9e728a2Sgjelinek strncmp(buf, "<?xml", 5) != 0) 4685d9e728a2Sgjelinek zerror(gettext("%s is not an XML file"), 4686d9e728a2Sgjelinek manifest_path); 4687d9e728a2Sgjelinek else 4688d9e728a2Sgjelinek zerror(gettext("Cannot attach to an earlier " 4689d9e728a2Sgjelinek "release of the operating system")); 4690d9e728a2Sgjelinek } else { 4691d9e728a2Sgjelinek zperror(cmd_to_str(CMD_ATTACH), B_TRUE); 4692d9e728a2Sgjelinek } 46938cd327d5Sgjelinek goto done; 46948cd327d5Sgjelinek } 46958cd327d5Sgjelinek 4696e2482d1aSgjelinek /* 4697e2482d1aSgjelinek * Retrieve remote handle brand type and determine whether it is 4698e2482d1aSgjelinek * native or not. 4699e2482d1aSgjelinek */ 4700e2482d1aSgjelinek if (zonecfg_get_brand(rem_handle, target_brand, sizeof (target_brand)) 4701e2482d1aSgjelinek != Z_OK) { 4702e2482d1aSgjelinek zerror(gettext("missing or invalid brand")); 4703e2482d1aSgjelinek exit(Z_ERR); 4704e2482d1aSgjelinek } 4705e2482d1aSgjelinek is_native_zone = (strcmp(target_brand, NATIVE_BRAND_NAME) == 0); 4706*84561e8cStd153743 is_cluster_zone = 4707*84561e8cStd153743 (strcmp(target_brand, CLUSTER_BRAND_NAME) == 0); 4708e2482d1aSgjelinek 4709ce28b40eSzt129084 res = verify_handle(CMD_ATTACH, local_handle, argv); 47108cd327d5Sgjelinek 47118cd327d5Sgjelinek /* Get the detach information for the locally defined zone. */ 47128cd327d5Sgjelinek if ((err = zonecfg_get_detach_info(local_handle, B_FALSE)) != Z_OK) { 47138cd327d5Sgjelinek errno = err; 47148cd327d5Sgjelinek zperror(gettext("getting the attach information failed"), 47158cd327d5Sgjelinek B_TRUE); 47168cd327d5Sgjelinek res = Z_ERR; 47178cd327d5Sgjelinek } else { 47188cd327d5Sgjelinek /* sw_cmp prints error msgs as necessary */ 47198cd327d5Sgjelinek if (sw_cmp(local_handle, rem_handle, SW_CMP_NONE) != Z_OK) 47208cd327d5Sgjelinek res = Z_ERR; 47218cd327d5Sgjelinek } 47228cd327d5Sgjelinek 47238cd327d5Sgjelinek done: 47248cd327d5Sgjelinek if (strcmp(manifest_path, "-") != 0) 47258cd327d5Sgjelinek (void) close(fd); 47268cd327d5Sgjelinek 47278cd327d5Sgjelinek zonecfg_fini_handle(local_handle); 47288cd327d5Sgjelinek zonecfg_fini_handle(rem_handle); 47298cd327d5Sgjelinek 47308cd327d5Sgjelinek return ((res == Z_OK) ? Z_OK : Z_ERR); 47318cd327d5Sgjelinek } 47328cd327d5Sgjelinek 4733f1adb09eSgjelinek /* 4734f1adb09eSgjelinek * Attempt to generate the information we need to make the zone look like 4735f1adb09eSgjelinek * it was properly detached by using the pkg information contained within 4736f1adb09eSgjelinek * the zone itself. 4737f1adb09eSgjelinek * 4738f1adb09eSgjelinek * We will perform a dry-run detach within the zone to generate the xml file. 4739f1adb09eSgjelinek * To do this we need to be able to get a handle on the zone so we can see 4740f1adb09eSgjelinek * how it is configured. In order to get a handle, we need a copy of the 4741f1adb09eSgjelinek * zone configuration within the zone. Since the zone's configuration is 4742f1adb09eSgjelinek * not available within the zone itself, we need to temporarily copy it into 4743f1adb09eSgjelinek * the zone. 4744f1adb09eSgjelinek * 4745f1adb09eSgjelinek * The sequence of actions we are doing is this: 4746f1adb09eSgjelinek * [set zone state to installed] 4747f1adb09eSgjelinek * [mount zone] 4748f1adb09eSgjelinek * zlogin {zone} </etc/zones/{zone}.xml 'cat >/etc/zones/{zone}.xml' 4749f1adb09eSgjelinek * zlogin {zone} 'zoneadm -z {zone} detach -n' >{zonepath}/SUNWdetached.xml 4750f1adb09eSgjelinek * zlogin {zone} 'rm -f /etc/zones/{zone}.xml' 4751f1adb09eSgjelinek * [unmount zone] 4752f1adb09eSgjelinek * [set zone state to configured] 4753f1adb09eSgjelinek * 4754f1adb09eSgjelinek * The successful result of this function is that we will have a 4755f1adb09eSgjelinek * SUNWdetached.xml file in the zonepath and we can use that to attach the zone. 4756f1adb09eSgjelinek */ 4757f1adb09eSgjelinek static boolean_t 4758f1adb09eSgjelinek gen_detach_info(char *zonepath) 4759f1adb09eSgjelinek { 4760f1adb09eSgjelinek int status; 4761f1adb09eSgjelinek boolean_t mounted = B_FALSE; 4762f1adb09eSgjelinek boolean_t res = B_FALSE; 4763f1adb09eSgjelinek char cmdbuf[2 * MAXPATHLEN]; 4764f1adb09eSgjelinek 4765f1adb09eSgjelinek /* 4766f1adb09eSgjelinek * The zone has to be installed to mount and zlogin. Temporarily set 4767f1adb09eSgjelinek * the state to 'installed'. 4768f1adb09eSgjelinek */ 4769f1adb09eSgjelinek if (zone_set_state(target_zone, ZONE_STATE_INSTALLED) != Z_OK) 4770f1adb09eSgjelinek return (B_FALSE); 4771f1adb09eSgjelinek 4772f1adb09eSgjelinek /* Mount the zone so we can zlogin. */ 4773f1adb09eSgjelinek if (mount_func(0, NULL) != Z_OK) 4774f1adb09eSgjelinek goto cleanup; 4775f1adb09eSgjelinek mounted = B_TRUE; 4776f1adb09eSgjelinek 4777f1adb09eSgjelinek /* 4778f1adb09eSgjelinek * We need to copy the zones xml configuration file into the 4779f1adb09eSgjelinek * zone so we can get a handle for the zone while running inside 4780f1adb09eSgjelinek * the zone. 4781f1adb09eSgjelinek */ 4782f1adb09eSgjelinek if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/sbin/zlogin -S %s " 4783f1adb09eSgjelinek "</etc/zones/%s.xml '/usr/bin/cat >/etc/zones/%s.xml'", 4784f1adb09eSgjelinek target_zone, target_zone, target_zone) >= sizeof (cmdbuf)) 4785f1adb09eSgjelinek goto cleanup; 4786f1adb09eSgjelinek 4787f1adb09eSgjelinek status = do_subproc_interactive(cmdbuf); 4788f1adb09eSgjelinek if (subproc_status("copy", status, B_TRUE) != ZONE_SUBPROC_OK) 4789f1adb09eSgjelinek goto cleanup; 4790f1adb09eSgjelinek 4791f1adb09eSgjelinek /* Now run the detach command within the mounted zone. */ 4792f1adb09eSgjelinek if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/sbin/zlogin -S %s " 4793f1adb09eSgjelinek "'/usr/sbin/zoneadm -z %s detach -n' >%s/SUNWdetached.xml", 4794f1adb09eSgjelinek target_zone, target_zone, zonepath) >= sizeof (cmdbuf)) 4795f1adb09eSgjelinek goto cleanup; 4796f1adb09eSgjelinek 4797f1adb09eSgjelinek status = do_subproc_interactive(cmdbuf); 4798f1adb09eSgjelinek if (subproc_status("detach", status, B_TRUE) != ZONE_SUBPROC_OK) 4799f1adb09eSgjelinek goto cleanup; 4800f1adb09eSgjelinek 4801f1adb09eSgjelinek res = B_TRUE; 4802f1adb09eSgjelinek 4803f1adb09eSgjelinek cleanup: 4804f1adb09eSgjelinek /* Cleanup from the previous actions. */ 4805f1adb09eSgjelinek if (mounted) { 4806f1adb09eSgjelinek if (snprintf(cmdbuf, sizeof (cmdbuf), 4807f1adb09eSgjelinek "/usr/sbin/zlogin -S %s '/usr/bin/rm -f /etc/zones/%s.xml'", 4808f1adb09eSgjelinek target_zone, target_zone) >= sizeof (cmdbuf)) { 4809f1adb09eSgjelinek res = B_FALSE; 4810f1adb09eSgjelinek } else { 4811f1adb09eSgjelinek status = do_subproc(cmdbuf); 4812f1adb09eSgjelinek if (subproc_status("rm", status, B_TRUE) 4813f1adb09eSgjelinek != ZONE_SUBPROC_OK) 4814f1adb09eSgjelinek res = B_FALSE; 4815f1adb09eSgjelinek } 4816f1adb09eSgjelinek 4817f1adb09eSgjelinek if (unmount_func(0, NULL) != Z_OK) 4818f1adb09eSgjelinek res = B_FALSE; 4819f1adb09eSgjelinek } 4820f1adb09eSgjelinek 4821f1adb09eSgjelinek if (zone_set_state(target_zone, ZONE_STATE_CONFIGURED) != Z_OK) 4822f1adb09eSgjelinek res = B_FALSE; 4823f1adb09eSgjelinek 4824f1adb09eSgjelinek return (res); 4825f1adb09eSgjelinek } 4826f1adb09eSgjelinek 4827ee519a1fSgjelinek static int 4828ee519a1fSgjelinek attach_func(int argc, char *argv[]) 4829ee519a1fSgjelinek { 4830ee519a1fSgjelinek int lockfd; 4831ee519a1fSgjelinek int err, arg; 4832ee519a1fSgjelinek boolean_t force = B_FALSE; 4833ee519a1fSgjelinek zone_dochandle_t handle; 4834ee519a1fSgjelinek zone_dochandle_t athandle = NULL; 4835ee519a1fSgjelinek char zonepath[MAXPATHLEN]; 48369acbbeafSnn35248 char brand[MAXNAMELEN], atbrand[MAXNAMELEN]; 48378cd327d5Sgjelinek boolean_t execute = B_TRUE; 4838f1adb09eSgjelinek boolean_t retried = B_FALSE; 48398cd327d5Sgjelinek char *manifest_path; 4840ee519a1fSgjelinek 4841ee519a1fSgjelinek if (zonecfg_in_alt_root()) { 4842ee519a1fSgjelinek zerror(gettext("cannot attach zone in alternate root")); 4843ee519a1fSgjelinek return (Z_ERR); 4844ee519a1fSgjelinek } 4845ee519a1fSgjelinek 4846ee519a1fSgjelinek optind = 0; 48478cd327d5Sgjelinek if ((arg = getopt(argc, argv, "?Fn:")) != EOF) { 4848ee519a1fSgjelinek switch (arg) { 4849ee519a1fSgjelinek case '?': 4850ee519a1fSgjelinek sub_usage(SHELP_ATTACH, CMD_ATTACH); 4851ee519a1fSgjelinek return (optopt == '?' ? Z_OK : Z_USAGE); 4852ee519a1fSgjelinek case 'F': 4853ee519a1fSgjelinek force = B_TRUE; 4854ee519a1fSgjelinek break; 48558cd327d5Sgjelinek case 'n': 48568cd327d5Sgjelinek execute = B_FALSE; 48578cd327d5Sgjelinek manifest_path = optarg; 48588cd327d5Sgjelinek break; 4859ee519a1fSgjelinek default: 4860ee519a1fSgjelinek sub_usage(SHELP_ATTACH, CMD_ATTACH); 4861ee519a1fSgjelinek return (Z_USAGE); 4862ee519a1fSgjelinek } 4863ee519a1fSgjelinek } 48648cd327d5Sgjelinek 48658cd327d5Sgjelinek /* 48668cd327d5Sgjelinek * If the no-execute option was specified, we need to branch down 48678cd327d5Sgjelinek * a completely different path since there is no zone required to be 48688cd327d5Sgjelinek * configured for this option. 48698cd327d5Sgjelinek */ 48708cd327d5Sgjelinek if (!execute) 4871ce28b40eSzt129084 return (dryrun_attach(manifest_path, argv)); 48728cd327d5Sgjelinek 48739acbbeafSnn35248 if (sanity_check(target_zone, CMD_ATTACH, B_FALSE, B_TRUE, B_FALSE) 48749acbbeafSnn35248 != Z_OK) 4875ee519a1fSgjelinek return (Z_ERR); 4876ce28b40eSzt129084 if (verify_details(CMD_ATTACH, argv) != Z_OK) 4877ee519a1fSgjelinek return (Z_ERR); 4878ee519a1fSgjelinek 4879ee519a1fSgjelinek if ((err = zone_get_zonepath(target_zone, zonepath, sizeof (zonepath))) 4880ee519a1fSgjelinek != Z_OK) { 4881ee519a1fSgjelinek errno = err; 4882ee519a1fSgjelinek zperror2(target_zone, gettext("could not get zone path")); 4883ee519a1fSgjelinek return (Z_ERR); 4884ee519a1fSgjelinek } 4885ee519a1fSgjelinek 4886ee519a1fSgjelinek if ((handle = zonecfg_init_handle()) == NULL) { 4887ee519a1fSgjelinek zperror(cmd_to_str(CMD_ATTACH), B_TRUE); 4888ee519a1fSgjelinek return (Z_ERR); 4889ee519a1fSgjelinek } 4890ee519a1fSgjelinek 4891ee519a1fSgjelinek if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) { 4892ee519a1fSgjelinek errno = err; 4893ee519a1fSgjelinek zperror(cmd_to_str(CMD_ATTACH), B_TRUE); 4894ee519a1fSgjelinek zonecfg_fini_handle(handle); 4895ee519a1fSgjelinek return (Z_ERR); 4896ee519a1fSgjelinek } 4897ee519a1fSgjelinek 4898ee519a1fSgjelinek if (grab_lock_file(target_zone, &lockfd) != Z_OK) { 4899ee519a1fSgjelinek zerror(gettext("another %s may have an operation in progress."), 4900ee519a1fSgjelinek "zoneadm"); 4901ee519a1fSgjelinek zonecfg_fini_handle(handle); 4902ee519a1fSgjelinek return (Z_ERR); 4903ee519a1fSgjelinek } 4904ee519a1fSgjelinek 4905ee519a1fSgjelinek if (force) 4906ee519a1fSgjelinek goto forced; 4907ee519a1fSgjelinek 4908ee519a1fSgjelinek if ((athandle = zonecfg_init_handle()) == NULL) { 4909ee519a1fSgjelinek zperror(cmd_to_str(CMD_ATTACH), B_TRUE); 4910ee519a1fSgjelinek goto done; 4911ee519a1fSgjelinek } 4912ee519a1fSgjelinek 4913f1adb09eSgjelinek retry: 4914ee519a1fSgjelinek if ((err = zonecfg_get_attach_handle(zonepath, target_zone, B_TRUE, 4915ee519a1fSgjelinek athandle)) != Z_OK) { 4916f1adb09eSgjelinek if (err == Z_NO_ZONE) { 4917f1adb09eSgjelinek /* 4918f1adb09eSgjelinek * Zone was not detached. Try to fall back to getting 4919f1adb09eSgjelinek * the needed information from within the zone. 4920f1adb09eSgjelinek * However, we can only try to generate the attach 4921f1adb09eSgjelinek * information for native branded zones, so fail if the 4922f1adb09eSgjelinek * zone is not native. 4923f1adb09eSgjelinek */ 4924f1adb09eSgjelinek if (!is_native_zone) { 4925f1adb09eSgjelinek zerror(gettext("Not a detached zone.")); 4926f1adb09eSgjelinek goto done; 4927f1adb09eSgjelinek } 4928f1adb09eSgjelinek 4929f1adb09eSgjelinek if (!retried) { 4930f1adb09eSgjelinek zerror(gettext("The zone was not properly " 4931f1adb09eSgjelinek "detached.\n\tAttempting to attach " 4932f1adb09eSgjelinek "anyway.")); 4933f1adb09eSgjelinek if (gen_detach_info(zonepath)) { 4934f1adb09eSgjelinek retried = B_TRUE; 4935f1adb09eSgjelinek goto retry; 4936f1adb09eSgjelinek } 4937f1adb09eSgjelinek } 4938f1adb09eSgjelinek zerror(gettext("Cannot generate the information " 4939f1adb09eSgjelinek "needed to attach this zone.")); 4940f1adb09eSgjelinek } else if (err == Z_INVALID_DOCUMENT) { 4941ee519a1fSgjelinek zerror(gettext("Cannot attach to an earlier release " 4942ee519a1fSgjelinek "of the operating system")); 4943f1adb09eSgjelinek } else { 4944ee519a1fSgjelinek zperror(cmd_to_str(CMD_ATTACH), B_TRUE); 4945f1adb09eSgjelinek } 4946ee519a1fSgjelinek goto done; 4947ee519a1fSgjelinek } 4948ee519a1fSgjelinek 4949ee519a1fSgjelinek /* Get the detach information for the locally defined zone. */ 4950ee519a1fSgjelinek if ((err = zonecfg_get_detach_info(handle, B_FALSE)) != Z_OK) { 4951ee519a1fSgjelinek errno = err; 4952ee519a1fSgjelinek zperror(gettext("getting the attach information failed"), 4953ee519a1fSgjelinek B_TRUE); 4954ee519a1fSgjelinek goto done; 4955ee519a1fSgjelinek } 4956ee519a1fSgjelinek 49579acbbeafSnn35248 /* 49589acbbeafSnn35248 * Ensure that the detached and locally defined zones are both of 49599acbbeafSnn35248 * the same brand. 49609acbbeafSnn35248 */ 49619acbbeafSnn35248 if ((zonecfg_get_brand(handle, brand, sizeof (brand)) != 0) || 49629acbbeafSnn35248 (zonecfg_get_brand(athandle, atbrand, sizeof (atbrand)) != 0)) { 49639acbbeafSnn35248 err = Z_ERR; 49649acbbeafSnn35248 zerror(gettext("missing or invalid brand")); 49659acbbeafSnn35248 goto done; 49669acbbeafSnn35248 } 49679acbbeafSnn35248 49689acbbeafSnn35248 if (strcmp(atbrand, brand) != NULL) { 49699acbbeafSnn35248 err = Z_ERR; 49709acbbeafSnn35248 zerror(gettext("Trying to attach a '%s' zone to a '%s' " 49719acbbeafSnn35248 "configuration."), atbrand, brand); 49729acbbeafSnn35248 goto done; 49739acbbeafSnn35248 } 49749acbbeafSnn35248 4975ee519a1fSgjelinek /* sw_cmp prints error msgs as necessary */ 49760b5de56dSgjelinek if ((err = sw_cmp(handle, athandle, SW_CMP_NONE)) != Z_OK) 4977ee519a1fSgjelinek goto done; 4978ee519a1fSgjelinek 4979ee519a1fSgjelinek if ((err = dev_fix(athandle)) != Z_OK) 4980ee519a1fSgjelinek goto done; 4981ee519a1fSgjelinek 4982ee519a1fSgjelinek forced: 4983ee519a1fSgjelinek 4984ee519a1fSgjelinek zonecfg_rm_detached(handle, force); 4985ee519a1fSgjelinek 4986ee519a1fSgjelinek if ((err = zone_set_state(target_zone, ZONE_STATE_INSTALLED)) != Z_OK) { 4987ee519a1fSgjelinek errno = err; 4988ee519a1fSgjelinek zperror(gettext("could not reset state"), B_TRUE); 4989ee519a1fSgjelinek } 4990ee519a1fSgjelinek 4991ee519a1fSgjelinek done: 4992ee519a1fSgjelinek zonecfg_fini_handle(handle); 4993ee519a1fSgjelinek release_lock_file(lockfd); 4994ee519a1fSgjelinek if (athandle != NULL) 4995ee519a1fSgjelinek zonecfg_fini_handle(athandle); 4996ee519a1fSgjelinek 4997ee519a1fSgjelinek return ((err == Z_OK) ? Z_OK : Z_ERR); 4998ee519a1fSgjelinek } 4999ee519a1fSgjelinek 5000865e09a4Sgjelinek /* 50017c478bd9Sstevel@tonic-gate * On input, TRUE => yes, FALSE => no. 50027c478bd9Sstevel@tonic-gate * On return, TRUE => 1, FALSE => 0, could not ask => -1. 50037c478bd9Sstevel@tonic-gate */ 50047c478bd9Sstevel@tonic-gate 50057c478bd9Sstevel@tonic-gate static int 50067c478bd9Sstevel@tonic-gate ask_yesno(boolean_t default_answer, const char *question) 50077c478bd9Sstevel@tonic-gate { 50087c478bd9Sstevel@tonic-gate char line[64]; /* should be large enough to answer yes or no */ 50097c478bd9Sstevel@tonic-gate 50107c478bd9Sstevel@tonic-gate if (!isatty(STDIN_FILENO)) 50117c478bd9Sstevel@tonic-gate return (-1); 50127c478bd9Sstevel@tonic-gate for (;;) { 50137c478bd9Sstevel@tonic-gate (void) printf("%s (%s)? ", question, 50147c478bd9Sstevel@tonic-gate default_answer ? "[y]/n" : "y/[n]"); 50157c478bd9Sstevel@tonic-gate if (fgets(line, sizeof (line), stdin) == NULL || 50167c478bd9Sstevel@tonic-gate line[0] == '\n') 50177c478bd9Sstevel@tonic-gate return (default_answer ? 1 : 0); 50187c478bd9Sstevel@tonic-gate if (tolower(line[0]) == 'y') 50197c478bd9Sstevel@tonic-gate return (1); 50207c478bd9Sstevel@tonic-gate if (tolower(line[0]) == 'n') 50217c478bd9Sstevel@tonic-gate return (0); 50227c478bd9Sstevel@tonic-gate } 50237c478bd9Sstevel@tonic-gate } 50247c478bd9Sstevel@tonic-gate 50257c478bd9Sstevel@tonic-gate static int 50267c478bd9Sstevel@tonic-gate uninstall_func(int argc, char *argv[]) 50277c478bd9Sstevel@tonic-gate { 50287c478bd9Sstevel@tonic-gate char line[ZONENAME_MAX + 128]; /* Enough for "Are you sure ..." */ 50290b5de56dSgjelinek char rootpath[MAXPATHLEN], zonepath[MAXPATHLEN]; 50307c478bd9Sstevel@tonic-gate boolean_t force = B_FALSE; 50317c478bd9Sstevel@tonic-gate int lockfd, answer; 50327c478bd9Sstevel@tonic-gate int err, arg; 50337c478bd9Sstevel@tonic-gate 5034108322fbScarlsonj if (zonecfg_in_alt_root()) { 5035108322fbScarlsonj zerror(gettext("cannot uninstall zone in alternate root")); 5036108322fbScarlsonj return (Z_ERR); 5037108322fbScarlsonj } 5038108322fbScarlsonj 50397c478bd9Sstevel@tonic-gate optind = 0; 50407c478bd9Sstevel@tonic-gate while ((arg = getopt(argc, argv, "?F")) != EOF) { 50417c478bd9Sstevel@tonic-gate switch (arg) { 50427c478bd9Sstevel@tonic-gate case '?': 50437c478bd9Sstevel@tonic-gate sub_usage(SHELP_UNINSTALL, CMD_UNINSTALL); 50447c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 50457c478bd9Sstevel@tonic-gate case 'F': 50467c478bd9Sstevel@tonic-gate force = B_TRUE; 50477c478bd9Sstevel@tonic-gate break; 50487c478bd9Sstevel@tonic-gate default: 50497c478bd9Sstevel@tonic-gate sub_usage(SHELP_UNINSTALL, CMD_UNINSTALL); 50507c478bd9Sstevel@tonic-gate return (Z_USAGE); 50517c478bd9Sstevel@tonic-gate } 50527c478bd9Sstevel@tonic-gate } 50537c478bd9Sstevel@tonic-gate if (argc > optind) { 50547c478bd9Sstevel@tonic-gate sub_usage(SHELP_UNINSTALL, CMD_UNINSTALL); 50557c478bd9Sstevel@tonic-gate return (Z_USAGE); 50567c478bd9Sstevel@tonic-gate } 50577c478bd9Sstevel@tonic-gate 50589acbbeafSnn35248 if (sanity_check(target_zone, CMD_UNINSTALL, B_FALSE, B_TRUE, B_FALSE) 50599acbbeafSnn35248 != Z_OK) 50607c478bd9Sstevel@tonic-gate return (Z_ERR); 50617c478bd9Sstevel@tonic-gate 5062ce28b40eSzt129084 /* 5063ce28b40eSzt129084 * Invoke brand-specific handler. 5064ce28b40eSzt129084 */ 5065ce28b40eSzt129084 if (invoke_brand_handler(CMD_UNINSTALL, argv) != Z_OK) 5066ce28b40eSzt129084 return (Z_ERR); 5067ce28b40eSzt129084 50687c478bd9Sstevel@tonic-gate if (!force) { 50697c478bd9Sstevel@tonic-gate (void) snprintf(line, sizeof (line), 50707c478bd9Sstevel@tonic-gate gettext("Are you sure you want to %s zone %s"), 50717c478bd9Sstevel@tonic-gate cmd_to_str(CMD_UNINSTALL), target_zone); 50727c478bd9Sstevel@tonic-gate if ((answer = ask_yesno(B_FALSE, line)) == 0) { 50737c478bd9Sstevel@tonic-gate return (Z_OK); 50747c478bd9Sstevel@tonic-gate } else if (answer == -1) { 50757c478bd9Sstevel@tonic-gate zerror(gettext("Input not from terminal and -F " 50767c478bd9Sstevel@tonic-gate "not specified: %s not done."), 50777c478bd9Sstevel@tonic-gate cmd_to_str(CMD_UNINSTALL)); 50787c478bd9Sstevel@tonic-gate return (Z_ERR); 50797c478bd9Sstevel@tonic-gate } 50807c478bd9Sstevel@tonic-gate } 50817c478bd9Sstevel@tonic-gate 50820b5de56dSgjelinek if ((err = zone_get_zonepath(target_zone, zonepath, 50830b5de56dSgjelinek sizeof (zonepath))) != Z_OK) { 50847c478bd9Sstevel@tonic-gate errno = err; 50857c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not get zone path")); 50867c478bd9Sstevel@tonic-gate return (Z_ERR); 50877c478bd9Sstevel@tonic-gate } 50887c478bd9Sstevel@tonic-gate if ((err = zone_get_rootpath(target_zone, rootpath, 50897c478bd9Sstevel@tonic-gate sizeof (rootpath))) != Z_OK) { 50907c478bd9Sstevel@tonic-gate errno = err; 50917c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not get root path")); 50927c478bd9Sstevel@tonic-gate return (Z_ERR); 50937c478bd9Sstevel@tonic-gate } 50947c478bd9Sstevel@tonic-gate 50957c478bd9Sstevel@tonic-gate /* 50967c478bd9Sstevel@tonic-gate * If there seems to be a zoneadmd running for this zone, call it 50977c478bd9Sstevel@tonic-gate * to tell it that an uninstall is happening; if all goes well it 50987c478bd9Sstevel@tonic-gate * will then shut itself down. 50997c478bd9Sstevel@tonic-gate */ 51007c478bd9Sstevel@tonic-gate if (ping_zoneadmd(target_zone) == Z_OK) { 51017c478bd9Sstevel@tonic-gate zone_cmd_arg_t zarg; 51027c478bd9Sstevel@tonic-gate zarg.cmd = Z_NOTE_UNINSTALLING; 51037c478bd9Sstevel@tonic-gate /* we don't care too much if this fails... just plow on */ 51047c478bd9Sstevel@tonic-gate (void) call_zoneadmd(target_zone, &zarg); 51057c478bd9Sstevel@tonic-gate } 51067c478bd9Sstevel@tonic-gate 51077c478bd9Sstevel@tonic-gate if (grab_lock_file(target_zone, &lockfd) != Z_OK) { 51087c478bd9Sstevel@tonic-gate zerror(gettext("another %s may have an operation in progress."), 5109865e09a4Sgjelinek "zoneadm"); 51107c478bd9Sstevel@tonic-gate return (Z_ERR); 51117c478bd9Sstevel@tonic-gate } 51127c478bd9Sstevel@tonic-gate 51137c478bd9Sstevel@tonic-gate /* Don't uninstall the zone if anything is mounted there */ 51147c478bd9Sstevel@tonic-gate err = zonecfg_find_mounts(rootpath, NULL, NULL); 51157c478bd9Sstevel@tonic-gate if (err) { 51160b5de56dSgjelinek zerror(gettext("These file systems are mounted on " 51177c478bd9Sstevel@tonic-gate "subdirectories of %s.\n"), rootpath); 51187c478bd9Sstevel@tonic-gate (void) zonecfg_find_mounts(rootpath, zfm_print, NULL); 51197c478bd9Sstevel@tonic-gate return (Z_ERR); 51207c478bd9Sstevel@tonic-gate } 51217c478bd9Sstevel@tonic-gate 51227c478bd9Sstevel@tonic-gate err = zone_set_state(target_zone, ZONE_STATE_INCOMPLETE); 51237c478bd9Sstevel@tonic-gate if (err != Z_OK) { 51247c478bd9Sstevel@tonic-gate errno = err; 51257c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not set state")); 51267c478bd9Sstevel@tonic-gate goto bad; 51277c478bd9Sstevel@tonic-gate } 51287c478bd9Sstevel@tonic-gate 51290b5de56dSgjelinek if ((err = cleanup_zonepath(zonepath, B_FALSE)) != Z_OK) { 51300b5de56dSgjelinek errno = err; 51310b5de56dSgjelinek zperror2(target_zone, gettext("cleaning up zonepath failed")); 51327c478bd9Sstevel@tonic-gate goto bad; 51330b5de56dSgjelinek } 51340b5de56dSgjelinek 51357c478bd9Sstevel@tonic-gate err = zone_set_state(target_zone, ZONE_STATE_CONFIGURED); 51367c478bd9Sstevel@tonic-gate if (err != Z_OK) { 51377c478bd9Sstevel@tonic-gate errno = err; 51387c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not reset state")); 51397c478bd9Sstevel@tonic-gate } 51407c478bd9Sstevel@tonic-gate bad: 51417c478bd9Sstevel@tonic-gate release_lock_file(lockfd); 51427c478bd9Sstevel@tonic-gate return (err); 51437c478bd9Sstevel@tonic-gate } 51447c478bd9Sstevel@tonic-gate 5145108322fbScarlsonj /* ARGSUSED */ 5146108322fbScarlsonj static int 5147108322fbScarlsonj mount_func(int argc, char *argv[]) 5148108322fbScarlsonj { 5149108322fbScarlsonj zone_cmd_arg_t zarg; 51509acbbeafSnn35248 boolean_t force = B_FALSE; 51519acbbeafSnn35248 int arg; 5152108322fbScarlsonj 51539acbbeafSnn35248 /* 51549acbbeafSnn35248 * The only supported subargument to the "mount" subcommand is 51559acbbeafSnn35248 * "-f", which forces us to mount a zone in the INCOMPLETE state. 51569acbbeafSnn35248 */ 51579acbbeafSnn35248 optind = 0; 51589acbbeafSnn35248 if ((arg = getopt(argc, argv, "f")) != EOF) { 51599acbbeafSnn35248 switch (arg) { 51609acbbeafSnn35248 case 'f': 51619acbbeafSnn35248 force = B_TRUE; 51629acbbeafSnn35248 break; 51639acbbeafSnn35248 default: 5164108322fbScarlsonj return (Z_USAGE); 51659acbbeafSnn35248 } 51669acbbeafSnn35248 } 51679acbbeafSnn35248 if (argc > optind) 51689acbbeafSnn35248 return (Z_USAGE); 51699acbbeafSnn35248 51709acbbeafSnn35248 if (sanity_check(target_zone, CMD_MOUNT, B_FALSE, B_FALSE, force) 51719acbbeafSnn35248 != Z_OK) 5172108322fbScarlsonj return (Z_ERR); 5173ce28b40eSzt129084 if (verify_details(CMD_MOUNT, argv) != Z_OK) 5174108322fbScarlsonj return (Z_ERR); 5175108322fbScarlsonj 51769acbbeafSnn35248 zarg.cmd = force ? Z_FORCEMOUNT : Z_MOUNT; 5177108322fbScarlsonj if (call_zoneadmd(target_zone, &zarg) != 0) { 5178108322fbScarlsonj zerror(gettext("call to %s failed"), "zoneadmd"); 5179108322fbScarlsonj return (Z_ERR); 5180108322fbScarlsonj } 5181108322fbScarlsonj return (Z_OK); 5182108322fbScarlsonj } 5183108322fbScarlsonj 5184108322fbScarlsonj /* ARGSUSED */ 5185108322fbScarlsonj static int 5186108322fbScarlsonj unmount_func(int argc, char *argv[]) 5187108322fbScarlsonj { 5188108322fbScarlsonj zone_cmd_arg_t zarg; 5189108322fbScarlsonj 5190108322fbScarlsonj if (argc > 0) 5191108322fbScarlsonj return (Z_USAGE); 51929acbbeafSnn35248 if (sanity_check(target_zone, CMD_UNMOUNT, B_FALSE, B_FALSE, B_FALSE) 51939acbbeafSnn35248 != Z_OK) 5194108322fbScarlsonj return (Z_ERR); 5195108322fbScarlsonj 5196108322fbScarlsonj zarg.cmd = Z_UNMOUNT; 5197108322fbScarlsonj if (call_zoneadmd(target_zone, &zarg) != 0) { 5198108322fbScarlsonj zerror(gettext("call to %s failed"), "zoneadmd"); 5199108322fbScarlsonj return (Z_ERR); 5200108322fbScarlsonj } 5201108322fbScarlsonj return (Z_OK); 5202108322fbScarlsonj } 5203108322fbScarlsonj 52047c478bd9Sstevel@tonic-gate static int 5205555afedfScarlsonj mark_func(int argc, char *argv[]) 5206555afedfScarlsonj { 5207555afedfScarlsonj int err, lockfd; 5208555afedfScarlsonj 5209555afedfScarlsonj if (argc != 1 || strcmp(argv[0], "incomplete") != 0) 5210555afedfScarlsonj return (Z_USAGE); 52119acbbeafSnn35248 if (sanity_check(target_zone, CMD_MARK, B_FALSE, B_FALSE, B_FALSE) 52129acbbeafSnn35248 != Z_OK) 5213555afedfScarlsonj return (Z_ERR); 5214555afedfScarlsonj 5215ce28b40eSzt129084 /* 5216ce28b40eSzt129084 * Invoke brand-specific handler. 5217ce28b40eSzt129084 */ 5218ce28b40eSzt129084 if (invoke_brand_handler(CMD_MARK, argv) != Z_OK) 5219ce28b40eSzt129084 return (Z_ERR); 5220ce28b40eSzt129084 5221555afedfScarlsonj if (grab_lock_file(target_zone, &lockfd) != Z_OK) { 5222555afedfScarlsonj zerror(gettext("another %s may have an operation in progress."), 5223555afedfScarlsonj "zoneadm"); 5224555afedfScarlsonj return (Z_ERR); 5225555afedfScarlsonj } 5226555afedfScarlsonj 5227555afedfScarlsonj err = zone_set_state(target_zone, ZONE_STATE_INCOMPLETE); 5228555afedfScarlsonj if (err != Z_OK) { 5229555afedfScarlsonj errno = err; 5230555afedfScarlsonj zperror2(target_zone, gettext("could not set state")); 5231555afedfScarlsonj } 5232555afedfScarlsonj release_lock_file(lockfd); 5233555afedfScarlsonj 5234555afedfScarlsonj return (err); 5235555afedfScarlsonj } 5236555afedfScarlsonj 52370209230bSgjelinek /* 52380209230bSgjelinek * Check what scheduling class we're running under and print a warning if 52390209230bSgjelinek * we're not using FSS. 52400209230bSgjelinek */ 52410209230bSgjelinek static int 52420209230bSgjelinek check_sched_fss(zone_dochandle_t handle) 52430209230bSgjelinek { 52440209230bSgjelinek char class_name[PC_CLNMSZ]; 52450209230bSgjelinek 52460209230bSgjelinek if (zonecfg_get_dflt_sched_class(handle, class_name, 52470209230bSgjelinek sizeof (class_name)) != Z_OK) { 52480209230bSgjelinek zerror(gettext("WARNING: unable to determine the zone's " 52490209230bSgjelinek "scheduling class")); 52500209230bSgjelinek } else if (strcmp("FSS", class_name) != 0) { 52510209230bSgjelinek zerror(gettext("WARNING: The zone.cpu-shares rctl is set but\n" 52520209230bSgjelinek "FSS is not the default scheduling class for this zone. " 52530209230bSgjelinek "FSS will be\nused for processes in the zone but to get " 52540209230bSgjelinek "the full benefit of FSS,\nit should be the default " 52550209230bSgjelinek "scheduling class. See dispadmin(1M) for\nmore details.")); 52560209230bSgjelinek return (Z_SYSTEM); 52570209230bSgjelinek } 52580209230bSgjelinek 52590209230bSgjelinek return (Z_OK); 52600209230bSgjelinek } 52610209230bSgjelinek 52620209230bSgjelinek static int 52630209230bSgjelinek check_cpu_shares_sched(zone_dochandle_t handle) 52640209230bSgjelinek { 52650209230bSgjelinek int err; 52660209230bSgjelinek int res = Z_OK; 52670209230bSgjelinek struct zone_rctltab rctl; 52680209230bSgjelinek 52690209230bSgjelinek if ((err = zonecfg_setrctlent(handle)) != Z_OK) { 52700209230bSgjelinek errno = err; 52710209230bSgjelinek zperror(cmd_to_str(CMD_APPLY), B_TRUE); 52720209230bSgjelinek return (err); 52730209230bSgjelinek } 52740209230bSgjelinek 52750209230bSgjelinek while (zonecfg_getrctlent(handle, &rctl) == Z_OK) { 52760209230bSgjelinek if (strcmp(rctl.zone_rctl_name, "zone.cpu-shares") == 0) { 52770209230bSgjelinek if (check_sched_fss(handle) != Z_OK) 52780209230bSgjelinek res = Z_SYSTEM; 52790209230bSgjelinek break; 52800209230bSgjelinek } 52810209230bSgjelinek } 52820209230bSgjelinek 52830209230bSgjelinek (void) zonecfg_endrctlent(handle); 52840209230bSgjelinek 52850209230bSgjelinek return (res); 52860209230bSgjelinek } 52870209230bSgjelinek 52880209230bSgjelinek /* 52897ef01d19Sgjelinek * Check if there is a mix of processes running in different pools within the 52907ef01d19Sgjelinek * zone. This is currently only going to be called for the global zone from 52917ef01d19Sgjelinek * apply_func but that could be generalized in the future. 52927ef01d19Sgjelinek */ 52937ef01d19Sgjelinek static boolean_t 52947ef01d19Sgjelinek mixed_pools(zoneid_t zoneid) 52957ef01d19Sgjelinek { 52967ef01d19Sgjelinek DIR *dirp; 52977ef01d19Sgjelinek dirent_t *dent; 52987ef01d19Sgjelinek boolean_t mixed = B_FALSE; 52997ef01d19Sgjelinek boolean_t poolid_set = B_FALSE; 53007ef01d19Sgjelinek poolid_t last_poolid = 0; 53017ef01d19Sgjelinek 53027ef01d19Sgjelinek if ((dirp = opendir("/proc")) == NULL) { 53037ef01d19Sgjelinek zerror(gettext("could not open /proc")); 53047ef01d19Sgjelinek return (B_FALSE); 53057ef01d19Sgjelinek } 53067ef01d19Sgjelinek 53077ef01d19Sgjelinek while ((dent = readdir(dirp)) != NULL) { 53087ef01d19Sgjelinek int procfd; 53097ef01d19Sgjelinek psinfo_t ps; 53107ef01d19Sgjelinek char procpath[MAXPATHLEN]; 53117ef01d19Sgjelinek 53127ef01d19Sgjelinek if (dent->d_name[0] == '.') 53137ef01d19Sgjelinek continue; 53147ef01d19Sgjelinek 53157ef01d19Sgjelinek (void) snprintf(procpath, sizeof (procpath), "/proc/%s/psinfo", 53167ef01d19Sgjelinek dent->d_name); 53177ef01d19Sgjelinek 53187ef01d19Sgjelinek if ((procfd = open(procpath, O_RDONLY)) == -1) 53197ef01d19Sgjelinek continue; 53207ef01d19Sgjelinek 53217ef01d19Sgjelinek if (read(procfd, &ps, sizeof (ps)) == sizeof (psinfo_t)) { 53227ef01d19Sgjelinek /* skip processes in other zones and system processes */ 53237ef01d19Sgjelinek if (zoneid != ps.pr_zoneid || ps.pr_flag & SSYS) { 53247ef01d19Sgjelinek (void) close(procfd); 53257ef01d19Sgjelinek continue; 53267ef01d19Sgjelinek } 53277ef01d19Sgjelinek 53287ef01d19Sgjelinek if (poolid_set) { 53297ef01d19Sgjelinek if (ps.pr_poolid != last_poolid) 53307ef01d19Sgjelinek mixed = B_TRUE; 53317ef01d19Sgjelinek } else { 53327ef01d19Sgjelinek last_poolid = ps.pr_poolid; 53337ef01d19Sgjelinek poolid_set = B_TRUE; 53347ef01d19Sgjelinek } 53357ef01d19Sgjelinek } 53367ef01d19Sgjelinek 53377ef01d19Sgjelinek (void) close(procfd); 53387ef01d19Sgjelinek 53397ef01d19Sgjelinek if (mixed) 53407ef01d19Sgjelinek break; 53417ef01d19Sgjelinek } 53427ef01d19Sgjelinek 53437ef01d19Sgjelinek (void) closedir(dirp); 53447ef01d19Sgjelinek 53457ef01d19Sgjelinek return (mixed); 53467ef01d19Sgjelinek } 53477ef01d19Sgjelinek 53487ef01d19Sgjelinek /* 53497ef01d19Sgjelinek * Check if a persistent or temporary pool is configured for the zone. 53507ef01d19Sgjelinek * This is currently only going to be called for the global zone from 53517ef01d19Sgjelinek * apply_func but that could be generalized in the future. 53527ef01d19Sgjelinek */ 53537ef01d19Sgjelinek static boolean_t 53547ef01d19Sgjelinek pool_configured(zone_dochandle_t handle) 53557ef01d19Sgjelinek { 53567ef01d19Sgjelinek int err1, err2; 53577ef01d19Sgjelinek struct zone_psettab pset_tab; 53587ef01d19Sgjelinek char poolname[MAXPATHLEN]; 53597ef01d19Sgjelinek 53607ef01d19Sgjelinek err1 = zonecfg_lookup_pset(handle, &pset_tab); 53617ef01d19Sgjelinek err2 = zonecfg_get_pool(handle, poolname, sizeof (poolname)); 53627ef01d19Sgjelinek 53637ef01d19Sgjelinek if (err1 == Z_NO_ENTRY && 53647ef01d19Sgjelinek (err2 == Z_NO_ENTRY || (err2 == Z_OK && strlen(poolname) == 0))) 53657ef01d19Sgjelinek return (B_FALSE); 53667ef01d19Sgjelinek 53677ef01d19Sgjelinek return (B_TRUE); 53687ef01d19Sgjelinek } 53697ef01d19Sgjelinek 53707ef01d19Sgjelinek /* 53710209230bSgjelinek * This is an undocumented interface which is currently only used to apply 53720209230bSgjelinek * the global zone resource management settings when the system boots. 53730209230bSgjelinek * This function does not yet properly handle updating a running system so 53740209230bSgjelinek * any projects running in the zone would be trashed if this function 53750209230bSgjelinek * were to run after the zone had booted. It also does not reset any 53760209230bSgjelinek * rctl settings that were removed from zonecfg. There is still work to be 53770209230bSgjelinek * done before we can properly support dynamically updating the resource 53780209230bSgjelinek * management settings for a running zone (global or non-global). Thus, this 53790209230bSgjelinek * functionality is undocumented for now. 53800209230bSgjelinek */ 53810209230bSgjelinek /* ARGSUSED */ 53820209230bSgjelinek static int 53830209230bSgjelinek apply_func(int argc, char *argv[]) 53840209230bSgjelinek { 53850209230bSgjelinek int err; 53860209230bSgjelinek int res = Z_OK; 53870209230bSgjelinek priv_set_t *privset; 53880209230bSgjelinek zoneid_t zoneid; 53890209230bSgjelinek zone_dochandle_t handle; 53900209230bSgjelinek struct zone_mcaptab mcap; 53910209230bSgjelinek char pool_err[128]; 53920209230bSgjelinek 53930209230bSgjelinek zoneid = getzoneid(); 53940209230bSgjelinek 53950209230bSgjelinek if (zonecfg_in_alt_root() || zoneid != GLOBAL_ZONEID || 53960209230bSgjelinek target_zone == NULL || strcmp(target_zone, GLOBAL_ZONENAME) != 0) 53970209230bSgjelinek return (usage(B_FALSE)); 53980209230bSgjelinek 53990209230bSgjelinek if ((privset = priv_allocset()) == NULL) { 54000209230bSgjelinek zerror(gettext("%s failed"), "priv_allocset"); 54010209230bSgjelinek return (Z_ERR); 54020209230bSgjelinek } 54030209230bSgjelinek 54040209230bSgjelinek if (getppriv(PRIV_EFFECTIVE, privset) != 0) { 54050209230bSgjelinek zerror(gettext("%s failed"), "getppriv"); 54060209230bSgjelinek priv_freeset(privset); 54070209230bSgjelinek return (Z_ERR); 54080209230bSgjelinek } 54090209230bSgjelinek 54100209230bSgjelinek if (priv_isfullset(privset) == B_FALSE) { 54110209230bSgjelinek (void) usage(B_FALSE); 54120209230bSgjelinek priv_freeset(privset); 54130209230bSgjelinek return (Z_ERR); 54140209230bSgjelinek } 54150209230bSgjelinek priv_freeset(privset); 54160209230bSgjelinek 54170209230bSgjelinek if ((handle = zonecfg_init_handle()) == NULL) { 54180209230bSgjelinek zperror(cmd_to_str(CMD_APPLY), B_TRUE); 54190209230bSgjelinek return (Z_ERR); 54200209230bSgjelinek } 54210209230bSgjelinek 54220209230bSgjelinek if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) { 54230209230bSgjelinek errno = err; 54240209230bSgjelinek zperror(cmd_to_str(CMD_APPLY), B_TRUE); 54250209230bSgjelinek zonecfg_fini_handle(handle); 54260209230bSgjelinek return (Z_ERR); 54270209230bSgjelinek } 54280209230bSgjelinek 54290209230bSgjelinek /* specific error msgs are printed within apply_rctls */ 54300209230bSgjelinek if ((err = zonecfg_apply_rctls(target_zone, handle)) != Z_OK) { 54310209230bSgjelinek errno = err; 54320209230bSgjelinek zperror(cmd_to_str(CMD_APPLY), B_TRUE); 54330209230bSgjelinek res = Z_ERR; 54340209230bSgjelinek } 54350209230bSgjelinek 54360209230bSgjelinek if ((err = check_cpu_shares_sched(handle)) != Z_OK) 54370209230bSgjelinek res = Z_ERR; 54380209230bSgjelinek 54397ef01d19Sgjelinek if (pool_configured(handle)) { 54407ef01d19Sgjelinek if (mixed_pools(zoneid)) { 54417ef01d19Sgjelinek zerror(gettext("Zone is using multiple resource " 54427ef01d19Sgjelinek "pools. The pool\nconfiguration cannot be " 54437ef01d19Sgjelinek "applied without rebooting.")); 54447ef01d19Sgjelinek res = Z_ERR; 54457ef01d19Sgjelinek } else { 54467ef01d19Sgjelinek 54470209230bSgjelinek /* 54487ef01d19Sgjelinek * The next two blocks of code attempt to set up 54497ef01d19Sgjelinek * temporary pools as well as persistent pools. In 54507ef01d19Sgjelinek * both cases we call the functions unconditionally. 54517ef01d19Sgjelinek * Within each funtion the code will check if the zone 54527ef01d19Sgjelinek * is actually configured for a temporary pool or 54537ef01d19Sgjelinek * persistent pool and just return if there is nothing 54547ef01d19Sgjelinek * to do. 54550209230bSgjelinek */ 54567ef01d19Sgjelinek if ((err = zonecfg_bind_tmp_pool(handle, zoneid, 54577ef01d19Sgjelinek pool_err, sizeof (pool_err))) != Z_OK) { 54587ef01d19Sgjelinek if (err == Z_POOL || err == Z_POOL_CREATE || 54597ef01d19Sgjelinek err == Z_POOL_BIND) 54607ef01d19Sgjelinek zerror("%s: %s", zonecfg_strerror(err), 54617ef01d19Sgjelinek pool_err); 54620209230bSgjelinek else 54637ef01d19Sgjelinek zerror(gettext("could not bind zone to " 54647ef01d19Sgjelinek "temporary pool: %s"), 54657ef01d19Sgjelinek zonecfg_strerror(err)); 54660209230bSgjelinek res = Z_ERR; 54670209230bSgjelinek } 54680209230bSgjelinek 54690209230bSgjelinek if ((err = zonecfg_bind_pool(handle, zoneid, pool_err, 54700209230bSgjelinek sizeof (pool_err))) != Z_OK) { 54710209230bSgjelinek if (err == Z_POOL || err == Z_POOL_BIND) 54727ef01d19Sgjelinek zerror("%s: %s", zonecfg_strerror(err), 54737ef01d19Sgjelinek pool_err); 54740209230bSgjelinek else 54750209230bSgjelinek zerror("%s", zonecfg_strerror(err)); 54760209230bSgjelinek } 54777ef01d19Sgjelinek } 54787ef01d19Sgjelinek } 54790209230bSgjelinek 54800209230bSgjelinek /* 54810209230bSgjelinek * If a memory cap is configured, set the cap in the kernel using 54820209230bSgjelinek * zone_setattr() and make sure the rcapd SMF service is enabled. 54830209230bSgjelinek */ 54840209230bSgjelinek if (zonecfg_getmcapent(handle, &mcap) == Z_OK) { 54850209230bSgjelinek uint64_t num; 54860209230bSgjelinek char smf_err[128]; 54870209230bSgjelinek 54880209230bSgjelinek num = (uint64_t)strtoll(mcap.zone_physmem_cap, NULL, 10); 54890209230bSgjelinek if (zone_setattr(zoneid, ZONE_ATTR_PHYS_MCAP, &num, 0) == -1) { 54900209230bSgjelinek zerror(gettext("could not set zone memory cap")); 54910209230bSgjelinek res = Z_ERR; 54920209230bSgjelinek } 54930209230bSgjelinek 54940209230bSgjelinek if (zonecfg_enable_rcapd(smf_err, sizeof (smf_err)) != Z_OK) { 54950209230bSgjelinek zerror(gettext("enabling system/rcap service failed: " 54960209230bSgjelinek "%s"), smf_err); 54970209230bSgjelinek res = Z_ERR; 54980209230bSgjelinek } 54990209230bSgjelinek } 55000209230bSgjelinek 55010209230bSgjelinek zonecfg_fini_handle(handle); 55020209230bSgjelinek 55030209230bSgjelinek return (res); 55040209230bSgjelinek } 55050209230bSgjelinek 5506555afedfScarlsonj static int 55077c478bd9Sstevel@tonic-gate help_func(int argc, char *argv[]) 55087c478bd9Sstevel@tonic-gate { 55097c478bd9Sstevel@tonic-gate int arg, cmd_num; 55107c478bd9Sstevel@tonic-gate 55117c478bd9Sstevel@tonic-gate if (argc == 0) { 55127c478bd9Sstevel@tonic-gate (void) usage(B_TRUE); 55137c478bd9Sstevel@tonic-gate return (Z_OK); 55147c478bd9Sstevel@tonic-gate } 55157c478bd9Sstevel@tonic-gate optind = 0; 55167c478bd9Sstevel@tonic-gate if ((arg = getopt(argc, argv, "?")) != EOF) { 55177c478bd9Sstevel@tonic-gate switch (arg) { 55187c478bd9Sstevel@tonic-gate case '?': 55197c478bd9Sstevel@tonic-gate sub_usage(SHELP_HELP, CMD_HELP); 55207c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 55217c478bd9Sstevel@tonic-gate default: 55227c478bd9Sstevel@tonic-gate sub_usage(SHELP_HELP, CMD_HELP); 55237c478bd9Sstevel@tonic-gate return (Z_USAGE); 55247c478bd9Sstevel@tonic-gate } 55257c478bd9Sstevel@tonic-gate } 55267c478bd9Sstevel@tonic-gate while (optind < argc) { 5527394a25e2Scarlsonj /* Private commands have NULL short_usage; omit them */ 5528394a25e2Scarlsonj if ((cmd_num = cmd_match(argv[optind])) < 0 || 5529394a25e2Scarlsonj cmdtab[cmd_num].short_usage == NULL) { 55307c478bd9Sstevel@tonic-gate sub_usage(SHELP_HELP, CMD_HELP); 55317c478bd9Sstevel@tonic-gate return (Z_USAGE); 55327c478bd9Sstevel@tonic-gate } 55337c478bd9Sstevel@tonic-gate sub_usage(cmdtab[cmd_num].short_usage, cmd_num); 55347c478bd9Sstevel@tonic-gate optind++; 55357c478bd9Sstevel@tonic-gate } 55367c478bd9Sstevel@tonic-gate return (Z_OK); 55377c478bd9Sstevel@tonic-gate } 55387c478bd9Sstevel@tonic-gate 55397c478bd9Sstevel@tonic-gate /* 55407c478bd9Sstevel@tonic-gate * Returns: CMD_MIN thru CMD_MAX on success, -1 on error 55417c478bd9Sstevel@tonic-gate */ 55427c478bd9Sstevel@tonic-gate 55437c478bd9Sstevel@tonic-gate static int 55447c478bd9Sstevel@tonic-gate cmd_match(char *cmd) 55457c478bd9Sstevel@tonic-gate { 55467c478bd9Sstevel@tonic-gate int i; 55477c478bd9Sstevel@tonic-gate 55487c478bd9Sstevel@tonic-gate for (i = CMD_MIN; i <= CMD_MAX; i++) { 55497c478bd9Sstevel@tonic-gate /* return only if there is an exact match */ 55507c478bd9Sstevel@tonic-gate if (strcmp(cmd, cmdtab[i].cmd_name) == 0) 55517c478bd9Sstevel@tonic-gate return (cmdtab[i].cmd_num); 55527c478bd9Sstevel@tonic-gate } 55537c478bd9Sstevel@tonic-gate return (-1); 55547c478bd9Sstevel@tonic-gate } 55557c478bd9Sstevel@tonic-gate 55567c478bd9Sstevel@tonic-gate static int 55577c478bd9Sstevel@tonic-gate parse_and_run(int argc, char *argv[]) 55587c478bd9Sstevel@tonic-gate { 55597c478bd9Sstevel@tonic-gate int i = cmd_match(argv[0]); 55607c478bd9Sstevel@tonic-gate 55617c478bd9Sstevel@tonic-gate if (i < 0) 55627c478bd9Sstevel@tonic-gate return (usage(B_FALSE)); 55637c478bd9Sstevel@tonic-gate return (cmdtab[i].handler(argc - 1, &(argv[1]))); 55647c478bd9Sstevel@tonic-gate } 55657c478bd9Sstevel@tonic-gate 55667c478bd9Sstevel@tonic-gate static char * 55677c478bd9Sstevel@tonic-gate get_execbasename(char *execfullname) 55687c478bd9Sstevel@tonic-gate { 55697c478bd9Sstevel@tonic-gate char *last_slash, *execbasename; 55707c478bd9Sstevel@tonic-gate 55717c478bd9Sstevel@tonic-gate /* guard against '/' at end of command invocation */ 55727c478bd9Sstevel@tonic-gate for (;;) { 55737c478bd9Sstevel@tonic-gate last_slash = strrchr(execfullname, '/'); 55747c478bd9Sstevel@tonic-gate if (last_slash == NULL) { 55757c478bd9Sstevel@tonic-gate execbasename = execfullname; 55767c478bd9Sstevel@tonic-gate break; 55777c478bd9Sstevel@tonic-gate } else { 55787c478bd9Sstevel@tonic-gate execbasename = last_slash + 1; 55797c478bd9Sstevel@tonic-gate if (*execbasename == '\0') { 55807c478bd9Sstevel@tonic-gate *last_slash = '\0'; 55817c478bd9Sstevel@tonic-gate continue; 55827c478bd9Sstevel@tonic-gate } 55837c478bd9Sstevel@tonic-gate break; 55847c478bd9Sstevel@tonic-gate } 55857c478bd9Sstevel@tonic-gate } 55867c478bd9Sstevel@tonic-gate return (execbasename); 55877c478bd9Sstevel@tonic-gate } 55887c478bd9Sstevel@tonic-gate 55897c478bd9Sstevel@tonic-gate int 55907c478bd9Sstevel@tonic-gate main(int argc, char **argv) 55917c478bd9Sstevel@tonic-gate { 55927c478bd9Sstevel@tonic-gate int arg; 55937c478bd9Sstevel@tonic-gate zoneid_t zid; 5594108322fbScarlsonj struct stat st; 55959acbbeafSnn35248 char *zone_lock_env; 55969acbbeafSnn35248 int err; 55977c478bd9Sstevel@tonic-gate 55987c478bd9Sstevel@tonic-gate if ((locale = setlocale(LC_ALL, "")) == NULL) 55997c478bd9Sstevel@tonic-gate locale = "C"; 56007c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 56017c478bd9Sstevel@tonic-gate setbuf(stdout, NULL); 56027c478bd9Sstevel@tonic-gate (void) sigset(SIGHUP, SIG_IGN); 56037c478bd9Sstevel@tonic-gate execname = get_execbasename(argv[0]); 56047c478bd9Sstevel@tonic-gate target_zone = NULL; 56057c478bd9Sstevel@tonic-gate if (chdir("/") != 0) { 56067c478bd9Sstevel@tonic-gate zerror(gettext("could not change directory to /.")); 56077c478bd9Sstevel@tonic-gate exit(Z_ERR); 56087c478bd9Sstevel@tonic-gate } 56097c478bd9Sstevel@tonic-gate 561099653d4eSeschrock if (init_zfs() != Z_OK) 561199653d4eSeschrock exit(Z_ERR); 561299653d4eSeschrock 5613555afedfScarlsonj while ((arg = getopt(argc, argv, "?u:z:R:")) != EOF) { 56147c478bd9Sstevel@tonic-gate switch (arg) { 56157c478bd9Sstevel@tonic-gate case '?': 56167c478bd9Sstevel@tonic-gate return (usage(B_TRUE)); 5617555afedfScarlsonj case 'u': 5618555afedfScarlsonj target_uuid = optarg; 5619555afedfScarlsonj break; 56207c478bd9Sstevel@tonic-gate case 'z': 56217c478bd9Sstevel@tonic-gate target_zone = optarg; 56227c478bd9Sstevel@tonic-gate break; 5623108322fbScarlsonj case 'R': /* private option for admin/install use */ 5624108322fbScarlsonj if (*optarg != '/') { 5625108322fbScarlsonj zerror(gettext("root path must be absolute.")); 5626108322fbScarlsonj exit(Z_ERR); 5627108322fbScarlsonj } 5628108322fbScarlsonj if (stat(optarg, &st) == -1 || !S_ISDIR(st.st_mode)) { 5629108322fbScarlsonj zerror( 5630108322fbScarlsonj gettext("root path must be a directory.")); 5631108322fbScarlsonj exit(Z_ERR); 5632108322fbScarlsonj } 5633108322fbScarlsonj zonecfg_set_root(optarg); 5634108322fbScarlsonj break; 56357c478bd9Sstevel@tonic-gate default: 56367c478bd9Sstevel@tonic-gate return (usage(B_FALSE)); 56377c478bd9Sstevel@tonic-gate } 56387c478bd9Sstevel@tonic-gate } 56397c478bd9Sstevel@tonic-gate 56407c478bd9Sstevel@tonic-gate if (optind >= argc) 56417c478bd9Sstevel@tonic-gate return (usage(B_FALSE)); 5642555afedfScarlsonj 5643555afedfScarlsonj if (target_uuid != NULL && *target_uuid != '\0') { 5644555afedfScarlsonj uuid_t uuid; 5645555afedfScarlsonj static char newtarget[ZONENAME_MAX]; 5646555afedfScarlsonj 5647555afedfScarlsonj if (uuid_parse(target_uuid, uuid) == -1) { 5648555afedfScarlsonj zerror(gettext("illegal UUID value specified")); 5649555afedfScarlsonj exit(Z_ERR); 5650555afedfScarlsonj } 5651555afedfScarlsonj if (zonecfg_get_name_by_uuid(uuid, newtarget, 5652555afedfScarlsonj sizeof (newtarget)) == Z_OK) 5653555afedfScarlsonj target_zone = newtarget; 5654555afedfScarlsonj } 5655555afedfScarlsonj 56567c478bd9Sstevel@tonic-gate if (target_zone != NULL && zone_get_id(target_zone, &zid) != 0) { 56577c478bd9Sstevel@tonic-gate errno = Z_NO_ZONE; 56587c478bd9Sstevel@tonic-gate zperror(target_zone, B_TRUE); 56597c478bd9Sstevel@tonic-gate exit(Z_ERR); 56607c478bd9Sstevel@tonic-gate } 56619acbbeafSnn35248 56629acbbeafSnn35248 /* 56639acbbeafSnn35248 * See if we have inherited the right to manipulate this zone from 56649acbbeafSnn35248 * a zoneadm instance in our ancestry. If so, set zone_lock_cnt to 56659acbbeafSnn35248 * indicate it. If not, make that explicit in our environment. 56669acbbeafSnn35248 */ 56679acbbeafSnn35248 zone_lock_env = getenv(LOCK_ENV_VAR); 56689acbbeafSnn35248 if (zone_lock_env == NULL) { 56699acbbeafSnn35248 if (putenv(zoneadm_lock_not_held) != 0) { 56709acbbeafSnn35248 zperror(target_zone, B_TRUE); 56719acbbeafSnn35248 exit(Z_ERR); 56729acbbeafSnn35248 } 56739acbbeafSnn35248 } else { 56749acbbeafSnn35248 zoneadm_is_nested = B_TRUE; 56759acbbeafSnn35248 if (atoi(zone_lock_env) == 1) 56769acbbeafSnn35248 zone_lock_cnt = 1; 56779acbbeafSnn35248 } 56789acbbeafSnn35248 56799acbbeafSnn35248 /* 56809acbbeafSnn35248 * If we are going to be operating on a single zone, retrieve its 56819acbbeafSnn35248 * brand type and determine whether it is native or not. 56829acbbeafSnn35248 */ 56839acbbeafSnn35248 if ((target_zone != NULL) && 56849acbbeafSnn35248 (strcmp(target_zone, GLOBAL_ZONENAME) != NULL)) { 56859acbbeafSnn35248 if (zone_get_brand(target_zone, target_brand, 56869acbbeafSnn35248 sizeof (target_brand)) != Z_OK) { 56879acbbeafSnn35248 zerror(gettext("missing or invalid brand")); 56889acbbeafSnn35248 exit(Z_ERR); 56899acbbeafSnn35248 } 56909acbbeafSnn35248 is_native_zone = (strcmp(target_brand, NATIVE_BRAND_NAME) == 0); 5691*84561e8cStd153743 is_cluster_zone = 5692*84561e8cStd153743 (strcmp(target_brand, CLUSTER_BRAND_NAME) == 0); 56939acbbeafSnn35248 } 56949acbbeafSnn35248 56959acbbeafSnn35248 err = parse_and_run(argc - optind, &argv[optind]); 56969acbbeafSnn35248 56979acbbeafSnn35248 return (err); 56987c478bd9Sstevel@tonic-gate } 5699