17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5ffbafc53Scomay * Common Development and Distribution License (the "License"). 6ffbafc53Scomay * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 21ffbafc53Scomay 227c478bd9Sstevel@tonic-gate /* 23*efd4c9b6SSteve Lawrence * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved. 247c478bd9Sstevel@tonic-gate */ 257c478bd9Sstevel@tonic-gate 267c478bd9Sstevel@tonic-gate /* 277c478bd9Sstevel@tonic-gate * zoneadmd manages zones; one zoneadmd process is launched for each 287c478bd9Sstevel@tonic-gate * non-global zone on the system. This daemon juggles four jobs: 297c478bd9Sstevel@tonic-gate * 307c478bd9Sstevel@tonic-gate * - Implement setup and teardown of the zone "virtual platform": mount and 317c478bd9Sstevel@tonic-gate * unmount filesystems; create and destroy network interfaces; communicate 327c478bd9Sstevel@tonic-gate * with devfsadmd to lay out devices for the zone; instantiate the zone 337c478bd9Sstevel@tonic-gate * console device; configure process runtime attributes such as resource 347c478bd9Sstevel@tonic-gate * controls, pool bindings, fine-grained privileges. 357c478bd9Sstevel@tonic-gate * 367c478bd9Sstevel@tonic-gate * - Launch the zone's init(1M) process. 377c478bd9Sstevel@tonic-gate * 387c478bd9Sstevel@tonic-gate * - Implement a door server; clients (like zoneadm) connect to the door 397c478bd9Sstevel@tonic-gate * server and request zone state changes. The kernel is also a client of 407c478bd9Sstevel@tonic-gate * this door server. A request to halt or reboot the zone which originates 417c478bd9Sstevel@tonic-gate * *inside* the zone results in a door upcall from the kernel into zoneadmd. 427c478bd9Sstevel@tonic-gate * 437c478bd9Sstevel@tonic-gate * One minor problem is that messages emitted by zoneadmd need to be passed 447c478bd9Sstevel@tonic-gate * back to the zoneadm process making the request. These messages need to 457c478bd9Sstevel@tonic-gate * be rendered in the client's locale; so, this is passed in as part of the 467c478bd9Sstevel@tonic-gate * request. The exception is the kernel upcall to zoneadmd, in which case 477c478bd9Sstevel@tonic-gate * messages are syslog'd. 487c478bd9Sstevel@tonic-gate * 497c478bd9Sstevel@tonic-gate * To make all of this work, the Makefile adds -a to xgettext to extract *all* 507c478bd9Sstevel@tonic-gate * strings, and an exclusion file (zoneadmd.xcl) is used to exclude those 517c478bd9Sstevel@tonic-gate * strings which do not need to be translated. 527c478bd9Sstevel@tonic-gate * 537c478bd9Sstevel@tonic-gate * - Act as a console server for zlogin -C processes; see comments in zcons.c 547c478bd9Sstevel@tonic-gate * for more information about the zone console architecture. 557c478bd9Sstevel@tonic-gate * 567c478bd9Sstevel@tonic-gate * DESIGN NOTES 577c478bd9Sstevel@tonic-gate * 587c478bd9Sstevel@tonic-gate * Restart: 597c478bd9Sstevel@tonic-gate * A chief design constraint of zoneadmd is that it should be restartable in 607c478bd9Sstevel@tonic-gate * the case that the administrator kills it off, or it suffers a fatal error, 617c478bd9Sstevel@tonic-gate * without the running zone being impacted; this is akin to being able to 627c478bd9Sstevel@tonic-gate * reboot the service processor of a server without affecting the OS instance. 637c478bd9Sstevel@tonic-gate */ 647c478bd9Sstevel@tonic-gate 657c478bd9Sstevel@tonic-gate #include <sys/param.h> 667c478bd9Sstevel@tonic-gate #include <sys/mman.h> 677c478bd9Sstevel@tonic-gate #include <sys/types.h> 687c478bd9Sstevel@tonic-gate #include <sys/stat.h> 697c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h> 707c478bd9Sstevel@tonic-gate 717c478bd9Sstevel@tonic-gate #include <bsm/adt.h> 727c478bd9Sstevel@tonic-gate #include <bsm/adt_event.h> 737c478bd9Sstevel@tonic-gate 747c478bd9Sstevel@tonic-gate #include <alloca.h> 757c478bd9Sstevel@tonic-gate #include <assert.h> 767c478bd9Sstevel@tonic-gate #include <errno.h> 777c478bd9Sstevel@tonic-gate #include <door.h> 787c478bd9Sstevel@tonic-gate #include <fcntl.h> 797c478bd9Sstevel@tonic-gate #include <locale.h> 807c478bd9Sstevel@tonic-gate #include <signal.h> 817c478bd9Sstevel@tonic-gate #include <stdarg.h> 827c478bd9Sstevel@tonic-gate #include <stdio.h> 837c478bd9Sstevel@tonic-gate #include <stdlib.h> 847c478bd9Sstevel@tonic-gate #include <string.h> 857c478bd9Sstevel@tonic-gate #include <strings.h> 867c478bd9Sstevel@tonic-gate #include <synch.h> 877c478bd9Sstevel@tonic-gate #include <syslog.h> 887c478bd9Sstevel@tonic-gate #include <thread.h> 897c478bd9Sstevel@tonic-gate #include <unistd.h> 907c478bd9Sstevel@tonic-gate #include <wait.h> 917c478bd9Sstevel@tonic-gate #include <limits.h> 927c478bd9Sstevel@tonic-gate #include <zone.h> 939acbbeafSnn35248 #include <libbrand.h> 940679f794S #include <sys/brand.h> 957c478bd9Sstevel@tonic-gate #include <libcontract.h> 967c478bd9Sstevel@tonic-gate #include <libcontract_priv.h> 9762868012SSteve Lawrence #include <sys/brand.h> 987c478bd9Sstevel@tonic-gate #include <sys/contract/process.h> 997c478bd9Sstevel@tonic-gate #include <sys/ctfs.h> 1002b24ab6bSSebastien Roy #include <libdladm.h> 1012b24ab6bSSebastien Roy #include <sys/dls_mgmt.h> 1027c478bd9Sstevel@tonic-gate 1037c478bd9Sstevel@tonic-gate #include <libzonecfg.h> 104*efd4c9b6SSteve Lawrence #include <zonestat_impl.h> 1057c478bd9Sstevel@tonic-gate #include "zoneadmd.h" 1067c478bd9Sstevel@tonic-gate 1077c478bd9Sstevel@tonic-gate static char *progname; 1087c478bd9Sstevel@tonic-gate char *zone_name; /* zone which we are managing */ 109*efd4c9b6SSteve Lawrence char pool_name[MAXNAMELEN]; 110e5816e35SEdward Pilatowicz char default_brand[MAXNAMELEN]; 1119acbbeafSnn35248 char brand_name[MAXNAMELEN]; 1129acbbeafSnn35248 boolean_t zone_isnative; 11384561e8cStd153743 boolean_t zone_iscluster; 1149a5d73e0SRic Aleshire boolean_t zone_islabeled; 115108322fbScarlsonj static zoneid_t zone_id; 1164ac67f02SAnurag S. Maskey dladm_handle_t dld_handle = NULL; 1177c478bd9Sstevel@tonic-gate 118c5cd6260S static char pre_statechg_hook[2 * MAXPATHLEN]; 119c5cd6260S static char post_statechg_hook[2 * MAXPATHLEN]; 120c5cd6260S char query_hook[2 * MAXPATHLEN]; 121c5cd6260S 12222321485Svp157776 zlog_t logsys; 1237c478bd9Sstevel@tonic-gate 1247c478bd9Sstevel@tonic-gate mutex_t lock = DEFAULTMUTEX; /* to serialize stuff */ 1257c478bd9Sstevel@tonic-gate mutex_t msglock = DEFAULTMUTEX; /* for calling setlocale() */ 1267c478bd9Sstevel@tonic-gate 127108322fbScarlsonj static sema_t scratch_sem; /* for scratch zones */ 128108322fbScarlsonj 1297c478bd9Sstevel@tonic-gate static char zone_door_path[MAXPATHLEN]; 1307c478bd9Sstevel@tonic-gate static int zone_door = -1; 1317c478bd9Sstevel@tonic-gate 1327c478bd9Sstevel@tonic-gate boolean_t in_death_throes = B_FALSE; /* daemon is dying */ 1337c478bd9Sstevel@tonic-gate boolean_t bringup_failure_recovery = B_FALSE; /* ignore certain failures */ 1347c478bd9Sstevel@tonic-gate 1357c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) /* should be defined by cc -D */ 1367c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "SYS_TEST" /* Use this only if it wasn't */ 1377c478bd9Sstevel@tonic-gate #endif 1387c478bd9Sstevel@tonic-gate 1397c478bd9Sstevel@tonic-gate #define DEFAULT_LOCALE "C" 1407c478bd9Sstevel@tonic-gate 141108322fbScarlsonj static const char * 142108322fbScarlsonj z_cmd_name(zone_cmd_t zcmd) 143108322fbScarlsonj { 144108322fbScarlsonj /* This list needs to match the enum in sys/zone.h */ 145108322fbScarlsonj static const char *zcmdstr[] = { 1469acbbeafSnn35248 "ready", "boot", "forceboot", "reboot", "halt", 1479acbbeafSnn35248 "note_uninstalling", "mount", "forcemount", "unmount" 148108322fbScarlsonj }; 149108322fbScarlsonj 150108322fbScarlsonj if (zcmd >= sizeof (zcmdstr) / sizeof (*zcmdstr)) 151108322fbScarlsonj return ("unknown"); 152108322fbScarlsonj else 153108322fbScarlsonj return (zcmdstr[(int)zcmd]); 154108322fbScarlsonj } 155108322fbScarlsonj 1567c478bd9Sstevel@tonic-gate static char * 1577c478bd9Sstevel@tonic-gate get_execbasename(char *execfullname) 1587c478bd9Sstevel@tonic-gate { 1597c478bd9Sstevel@tonic-gate char *last_slash, *execbasename; 1607c478bd9Sstevel@tonic-gate 1617c478bd9Sstevel@tonic-gate /* guard against '/' at end of command invocation */ 1627c478bd9Sstevel@tonic-gate for (;;) { 1637c478bd9Sstevel@tonic-gate last_slash = strrchr(execfullname, '/'); 1647c478bd9Sstevel@tonic-gate if (last_slash == NULL) { 1657c478bd9Sstevel@tonic-gate execbasename = execfullname; 1667c478bd9Sstevel@tonic-gate break; 1677c478bd9Sstevel@tonic-gate } else { 1687c478bd9Sstevel@tonic-gate execbasename = last_slash + 1; 1697c478bd9Sstevel@tonic-gate if (*execbasename == '\0') { 1707c478bd9Sstevel@tonic-gate *last_slash = '\0'; 1717c478bd9Sstevel@tonic-gate continue; 1727c478bd9Sstevel@tonic-gate } 1737c478bd9Sstevel@tonic-gate break; 1747c478bd9Sstevel@tonic-gate } 1757c478bd9Sstevel@tonic-gate } 1767c478bd9Sstevel@tonic-gate return (execbasename); 1777c478bd9Sstevel@tonic-gate } 1787c478bd9Sstevel@tonic-gate 1797c478bd9Sstevel@tonic-gate static void 1807c478bd9Sstevel@tonic-gate usage(void) 1817c478bd9Sstevel@tonic-gate { 1827c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("Usage: %s -z zonename\n"), progname); 1837c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 1847c478bd9Sstevel@tonic-gate gettext("\tNote: %s should not be run directly.\n"), progname); 1857c478bd9Sstevel@tonic-gate exit(2); 1867c478bd9Sstevel@tonic-gate } 1877c478bd9Sstevel@tonic-gate 1887c478bd9Sstevel@tonic-gate /* ARGSUSED */ 1897c478bd9Sstevel@tonic-gate static void 1907c478bd9Sstevel@tonic-gate sigchld(int sig) 1917c478bd9Sstevel@tonic-gate { 1927c478bd9Sstevel@tonic-gate } 1937c478bd9Sstevel@tonic-gate 1947c478bd9Sstevel@tonic-gate char * 1957c478bd9Sstevel@tonic-gate localize_msg(char *locale, const char *msg) 1967c478bd9Sstevel@tonic-gate { 1977c478bd9Sstevel@tonic-gate char *out; 1987c478bd9Sstevel@tonic-gate 1997c478bd9Sstevel@tonic-gate (void) mutex_lock(&msglock); 2007c478bd9Sstevel@tonic-gate (void) setlocale(LC_MESSAGES, locale); 2017c478bd9Sstevel@tonic-gate out = gettext(msg); 2027c478bd9Sstevel@tonic-gate (void) setlocale(LC_MESSAGES, DEFAULT_LOCALE); 2037c478bd9Sstevel@tonic-gate (void) mutex_unlock(&msglock); 2047c478bd9Sstevel@tonic-gate return (out); 2057c478bd9Sstevel@tonic-gate } 2067c478bd9Sstevel@tonic-gate 2077c478bd9Sstevel@tonic-gate /* PRINTFLIKE3 */ 2087c478bd9Sstevel@tonic-gate void 2097c478bd9Sstevel@tonic-gate zerror(zlog_t *zlogp, boolean_t use_strerror, const char *fmt, ...) 2107c478bd9Sstevel@tonic-gate { 2117c478bd9Sstevel@tonic-gate va_list alist; 2127c478bd9Sstevel@tonic-gate char buf[MAXPATHLEN * 2]; /* enough space for err msg with a path */ 2137c478bd9Sstevel@tonic-gate char *bp; 2147c478bd9Sstevel@tonic-gate int saved_errno = errno; 2157c478bd9Sstevel@tonic-gate 2167c478bd9Sstevel@tonic-gate if (zlogp == NULL) 2177c478bd9Sstevel@tonic-gate return; 2187c478bd9Sstevel@tonic-gate if (zlogp == &logsys) 2197c478bd9Sstevel@tonic-gate (void) snprintf(buf, sizeof (buf), "[zone '%s'] ", 2207c478bd9Sstevel@tonic-gate zone_name); 2217c478bd9Sstevel@tonic-gate else 2227c478bd9Sstevel@tonic-gate buf[0] = '\0'; 2237c478bd9Sstevel@tonic-gate bp = &(buf[strlen(buf)]); 2247c478bd9Sstevel@tonic-gate 2257c478bd9Sstevel@tonic-gate /* 2267c478bd9Sstevel@tonic-gate * In theory, the locale pointer should be set to either "C" or a 2277c478bd9Sstevel@tonic-gate * char array, so it should never be NULL 2287c478bd9Sstevel@tonic-gate */ 2297c478bd9Sstevel@tonic-gate assert(zlogp->locale != NULL); 2307c478bd9Sstevel@tonic-gate /* Locale is per process, but we are multi-threaded... */ 2317c478bd9Sstevel@tonic-gate fmt = localize_msg(zlogp->locale, fmt); 2327c478bd9Sstevel@tonic-gate 2337c478bd9Sstevel@tonic-gate va_start(alist, fmt); 2347c478bd9Sstevel@tonic-gate (void) vsnprintf(bp, sizeof (buf) - (bp - buf), fmt, alist); 2357c478bd9Sstevel@tonic-gate va_end(alist); 2367c478bd9Sstevel@tonic-gate bp = &(buf[strlen(buf)]); 2377c478bd9Sstevel@tonic-gate if (use_strerror) 2387c478bd9Sstevel@tonic-gate (void) snprintf(bp, sizeof (buf) - (bp - buf), ": %s", 2397c478bd9Sstevel@tonic-gate strerror(saved_errno)); 2407c478bd9Sstevel@tonic-gate if (zlogp == &logsys) { 2417c478bd9Sstevel@tonic-gate (void) syslog(LOG_ERR, "%s", buf); 2427c478bd9Sstevel@tonic-gate } else if (zlogp->logfile != NULL) { 2437c478bd9Sstevel@tonic-gate (void) fprintf(zlogp->logfile, "%s\n", buf); 2447c478bd9Sstevel@tonic-gate } else { 2457c478bd9Sstevel@tonic-gate size_t buflen; 2467c478bd9Sstevel@tonic-gate size_t copylen; 2477c478bd9Sstevel@tonic-gate 2487c478bd9Sstevel@tonic-gate buflen = snprintf(zlogp->log, zlogp->loglen, "%s\n", buf); 2497c478bd9Sstevel@tonic-gate copylen = MIN(buflen, zlogp->loglen); 2507c478bd9Sstevel@tonic-gate zlogp->log += copylen; 2517c478bd9Sstevel@tonic-gate zlogp->loglen -= copylen; 2527c478bd9Sstevel@tonic-gate } 2537c478bd9Sstevel@tonic-gate } 2547c478bd9Sstevel@tonic-gate 2553f2f09c1Sdp /* 2563f2f09c1Sdp * Emit a warning for any boot arguments which are unrecognized. Since 2573f2f09c1Sdp * Solaris boot arguments are getopt(3c) compatible (see kernel(1m)), we 2583f2f09c1Sdp * put the arguments into an argv style array, use getopt to process them, 2593f2f09c1Sdp * and put the resultant argument string back into outargs. 2603f2f09c1Sdp * 2613f2f09c1Sdp * During the filtering, we pull out any arguments which are truly "boot" 2623f2f09c1Sdp * arguments, leaving only those which are to be passed intact to the 2633f2f09c1Sdp * progenitor process. The one we support at the moment is -i, which 2643f2f09c1Sdp * indicates to the kernel which program should be launched as 'init'. 2653f2f09c1Sdp * 2663f2f09c1Sdp * A return of Z_INVAL indicates specifically that the arguments are 2673f2f09c1Sdp * not valid; this is a non-fatal error. Except for Z_OK, all other return 2683f2f09c1Sdp * values are treated as fatal. 2693f2f09c1Sdp */ 2703f2f09c1Sdp static int 2713f2f09c1Sdp filter_bootargs(zlog_t *zlogp, const char *inargs, char *outargs, 2723f2f09c1Sdp char *init_file, char *badarg) 2733f2f09c1Sdp { 2743f2f09c1Sdp int argc = 0, argc_save; 2753f2f09c1Sdp int i; 2763f2f09c1Sdp int err; 2773f2f09c1Sdp char *arg, *lasts, **argv = NULL, **argv_save; 2783f2f09c1Sdp char zonecfg_args[BOOTARGS_MAX]; 2793f2f09c1Sdp char scratchargs[BOOTARGS_MAX], *sargs; 2803f2f09c1Sdp char c; 2813f2f09c1Sdp 2823f2f09c1Sdp bzero(outargs, BOOTARGS_MAX); 2833f2f09c1Sdp bzero(badarg, BOOTARGS_MAX); 2843f2f09c1Sdp 2853f2f09c1Sdp /* 2863f2f09c1Sdp * If the user didn't specify transient boot arguments, check 2873f2f09c1Sdp * to see if there were any specified in the zone configuration, 2883f2f09c1Sdp * and use them if applicable. 2893f2f09c1Sdp */ 2903f2f09c1Sdp if (inargs == NULL || inargs[0] == '\0') { 2913f2f09c1Sdp zone_dochandle_t handle; 2923f2f09c1Sdp if ((handle = zonecfg_init_handle()) == NULL) { 2933f2f09c1Sdp zerror(zlogp, B_TRUE, 2943f2f09c1Sdp "getting zone configuration handle"); 2953f2f09c1Sdp return (Z_BAD_HANDLE); 2963f2f09c1Sdp } 2973f2f09c1Sdp err = zonecfg_get_snapshot_handle(zone_name, handle); 2983f2f09c1Sdp if (err != Z_OK) { 2993f2f09c1Sdp zerror(zlogp, B_FALSE, 3003f2f09c1Sdp "invalid configuration snapshot"); 3013f2f09c1Sdp zonecfg_fini_handle(handle); 3023f2f09c1Sdp return (Z_BAD_HANDLE); 3033f2f09c1Sdp } 3043f2f09c1Sdp 3053f2f09c1Sdp bzero(zonecfg_args, sizeof (zonecfg_args)); 3063f2f09c1Sdp (void) zonecfg_get_bootargs(handle, zonecfg_args, 3073f2f09c1Sdp sizeof (zonecfg_args)); 3083f2f09c1Sdp inargs = zonecfg_args; 3093f2f09c1Sdp zonecfg_fini_handle(handle); 3103f2f09c1Sdp } 3113f2f09c1Sdp 3123f2f09c1Sdp if (strlen(inargs) >= BOOTARGS_MAX) { 3133f2f09c1Sdp zerror(zlogp, B_FALSE, "boot argument string too long"); 3143f2f09c1Sdp return (Z_INVAL); 3153f2f09c1Sdp } 3163f2f09c1Sdp 3173f2f09c1Sdp (void) strlcpy(scratchargs, inargs, sizeof (scratchargs)); 3183f2f09c1Sdp sargs = scratchargs; 3193f2f09c1Sdp while ((arg = strtok_r(sargs, " \t", &lasts)) != NULL) { 3203f2f09c1Sdp sargs = NULL; 3213f2f09c1Sdp argc++; 3223f2f09c1Sdp } 3233f2f09c1Sdp 3243f2f09c1Sdp if ((argv = calloc(argc + 1, sizeof (char *))) == NULL) { 3253f2f09c1Sdp zerror(zlogp, B_FALSE, "memory allocation failed"); 3263f2f09c1Sdp return (Z_NOMEM); 3273f2f09c1Sdp } 3283f2f09c1Sdp 3293f2f09c1Sdp argv_save = argv; 3303f2f09c1Sdp argc_save = argc; 3313f2f09c1Sdp 3323f2f09c1Sdp (void) strlcpy(scratchargs, inargs, sizeof (scratchargs)); 3333f2f09c1Sdp sargs = scratchargs; 3343f2f09c1Sdp i = 0; 3353f2f09c1Sdp while ((arg = strtok_r(sargs, " \t", &lasts)) != NULL) { 3363f2f09c1Sdp sargs = NULL; 3373f2f09c1Sdp if ((argv[i] = strdup(arg)) == NULL) { 3383f2f09c1Sdp err = Z_NOMEM; 3393f2f09c1Sdp zerror(zlogp, B_FALSE, "memory allocation failed"); 3403f2f09c1Sdp goto done; 3413f2f09c1Sdp } 3423f2f09c1Sdp i++; 3433f2f09c1Sdp } 3443f2f09c1Sdp 3453f2f09c1Sdp /* 3463f2f09c1Sdp * We preserve compatibility with the Solaris system boot behavior, 3473f2f09c1Sdp * which allows: 3483f2f09c1Sdp * 3493f2f09c1Sdp * # reboot kernel/unix -s -m verbose 3503f2f09c1Sdp * 3513f2f09c1Sdp * In this example, kernel/unix tells the booter what file to 3523f2f09c1Sdp * boot. We don't want reboot in a zone to be gratuitously different, 3533f2f09c1Sdp * so we silently ignore the boot file, if necessary. 3543f2f09c1Sdp */ 3553f2f09c1Sdp if (argv[0] == NULL) 3563f2f09c1Sdp goto done; 3573f2f09c1Sdp 3583f2f09c1Sdp assert(argv[0][0] != ' '); 3593f2f09c1Sdp assert(argv[0][0] != '\t'); 3603f2f09c1Sdp 3613f2f09c1Sdp if (argv[0][0] != '-' && argv[0][0] != '\0') { 3623f2f09c1Sdp argv = &argv[1]; 3633f2f09c1Sdp argc--; 3643f2f09c1Sdp } 3653f2f09c1Sdp 3663f2f09c1Sdp optind = 0; 3673f2f09c1Sdp opterr = 0; 3683f2f09c1Sdp err = Z_OK; 3699acbbeafSnn35248 while ((c = getopt(argc, argv, "fi:m:s")) != -1) { 3703f2f09c1Sdp switch (c) { 3713f2f09c1Sdp case 'i': 3723f2f09c1Sdp /* 3733f2f09c1Sdp * -i is handled by the runtime and is not passed 3743f2f09c1Sdp * along to userland 3753f2f09c1Sdp */ 3763f2f09c1Sdp (void) strlcpy(init_file, optarg, MAXPATHLEN); 3773f2f09c1Sdp break; 3789acbbeafSnn35248 case 'f': 3799acbbeafSnn35248 /* This has already been processed by zoneadm */ 3809acbbeafSnn35248 break; 3813f2f09c1Sdp case 'm': 3823f2f09c1Sdp case 's': 3833f2f09c1Sdp /* These pass through unmolested */ 3843f2f09c1Sdp (void) snprintf(outargs, BOOTARGS_MAX, 3853f2f09c1Sdp "%s -%c %s ", outargs, c, optarg ? optarg : ""); 3863f2f09c1Sdp break; 3873f2f09c1Sdp case '?': 3883f2f09c1Sdp /* 3893f2f09c1Sdp * We warn about unknown arguments but pass them 3903f2f09c1Sdp * along anyway-- if someone wants to develop their 3913f2f09c1Sdp * own init replacement, they can pass it whatever 3923f2f09c1Sdp * args they want. 3933f2f09c1Sdp */ 3943f2f09c1Sdp err = Z_INVAL; 3953f2f09c1Sdp (void) snprintf(outargs, BOOTARGS_MAX, 3963f2f09c1Sdp "%s -%c", outargs, optopt); 3973f2f09c1Sdp (void) snprintf(badarg, BOOTARGS_MAX, 3983f2f09c1Sdp "%s -%c", badarg, optopt); 3993f2f09c1Sdp break; 4003f2f09c1Sdp } 4013f2f09c1Sdp } 4023f2f09c1Sdp 4033f2f09c1Sdp /* 4043f2f09c1Sdp * For Solaris Zones we warn about and discard non-option arguments. 4053f2f09c1Sdp * Hence 'boot foo bar baz gub' --> 'boot'. However, to be similar 4063f2f09c1Sdp * to the kernel, we concat up all the other remaining boot args. 4073f2f09c1Sdp * and warn on them as a group. 4083f2f09c1Sdp */ 4093f2f09c1Sdp if (optind < argc) { 4103f2f09c1Sdp err = Z_INVAL; 4113f2f09c1Sdp while (optind < argc) { 4123f2f09c1Sdp (void) snprintf(badarg, BOOTARGS_MAX, "%s%s%s", 4133f2f09c1Sdp badarg, strlen(badarg) > 0 ? " " : "", 4143f2f09c1Sdp argv[optind]); 4153f2f09c1Sdp optind++; 4163f2f09c1Sdp } 4173f2f09c1Sdp zerror(zlogp, B_FALSE, "WARNING: Unused or invalid boot " 4183f2f09c1Sdp "arguments `%s'.", badarg); 4193f2f09c1Sdp } 4203f2f09c1Sdp 4213f2f09c1Sdp done: 4223f2f09c1Sdp for (i = 0; i < argc_save; i++) { 4233f2f09c1Sdp if (argv_save[i] != NULL) 4243f2f09c1Sdp free(argv_save[i]); 4253f2f09c1Sdp } 4263f2f09c1Sdp free(argv_save); 4273f2f09c1Sdp return (err); 4283f2f09c1Sdp } 4293f2f09c1Sdp 4303f2f09c1Sdp 4317c478bd9Sstevel@tonic-gate static int 4327c478bd9Sstevel@tonic-gate mkzonedir(zlog_t *zlogp) 4337c478bd9Sstevel@tonic-gate { 4347c478bd9Sstevel@tonic-gate struct stat st; 4357c478bd9Sstevel@tonic-gate /* 4367c478bd9Sstevel@tonic-gate * We must create and lock everyone but root out of ZONES_TMPDIR 4377c478bd9Sstevel@tonic-gate * since anyone can open any UNIX domain socket, regardless of 4387c478bd9Sstevel@tonic-gate * its file system permissions. Sigh... 4397c478bd9Sstevel@tonic-gate */ 4407c478bd9Sstevel@tonic-gate if (mkdir(ZONES_TMPDIR, S_IRWXU) < 0 && errno != EEXIST) { 4417c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "could not mkdir '%s'", ZONES_TMPDIR); 4427c478bd9Sstevel@tonic-gate return (-1); 4437c478bd9Sstevel@tonic-gate } 4447c478bd9Sstevel@tonic-gate /* paranoia */ 4454bc0a2efScasper if ((stat(ZONES_TMPDIR, &st) < 0) || !S_ISDIR(st.st_mode)) { 4467c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "'%s' is not a directory", ZONES_TMPDIR); 4477c478bd9Sstevel@tonic-gate return (-1); 4487c478bd9Sstevel@tonic-gate } 4497c478bd9Sstevel@tonic-gate (void) chmod(ZONES_TMPDIR, S_IRWXU); 4507c478bd9Sstevel@tonic-gate return (0); 4517c478bd9Sstevel@tonic-gate } 4527c478bd9Sstevel@tonic-gate 453108322fbScarlsonj /* 454c5cd6260S * Run the brand's pre-state change callback, if it exists. 455c5cd6260S */ 456c5cd6260S static int 457c5cd6260S brand_prestatechg(zlog_t *zlogp, int state, int cmd) 458c5cd6260S { 459c5cd6260S char cmdbuf[2 * MAXPATHLEN]; 4602a8b76b2SSusan Kamm-Worrell const char *altroot; 461c5cd6260S 462c5cd6260S if (pre_statechg_hook[0] == '\0') 463c5cd6260S return (0); 464c5cd6260S 4652a8b76b2SSusan Kamm-Worrell altroot = zonecfg_get_root(); 4662a8b76b2SSusan Kamm-Worrell if (snprintf(cmdbuf, sizeof (cmdbuf), "%s %d %d %s", pre_statechg_hook, 4672a8b76b2SSusan Kamm-Worrell state, cmd, altroot) > sizeof (cmdbuf)) 468c5cd6260S return (-1); 469c5cd6260S 470c5cd6260S if (do_subproc(zlogp, cmdbuf, NULL) != 0) 471c5cd6260S return (-1); 472c5cd6260S 473c5cd6260S return (0); 474c5cd6260S } 475c5cd6260S 476c5cd6260S /* 477c5cd6260S * Run the brand's post-state change callback, if it exists. 478c5cd6260S */ 479c5cd6260S static int 480c5cd6260S brand_poststatechg(zlog_t *zlogp, int state, int cmd) 481c5cd6260S { 482c5cd6260S char cmdbuf[2 * MAXPATHLEN]; 4832a8b76b2SSusan Kamm-Worrell const char *altroot; 484c5cd6260S 485c5cd6260S if (post_statechg_hook[0] == '\0') 486c5cd6260S return (0); 487c5cd6260S 4882a8b76b2SSusan Kamm-Worrell altroot = zonecfg_get_root(); 4892a8b76b2SSusan Kamm-Worrell if (snprintf(cmdbuf, sizeof (cmdbuf), "%s %d %d %s", post_statechg_hook, 4902a8b76b2SSusan Kamm-Worrell state, cmd, altroot) > sizeof (cmdbuf)) 491c5cd6260S return (-1); 492c5cd6260S 493c5cd6260S if (do_subproc(zlogp, cmdbuf, NULL) != 0) 494c5cd6260S return (-1); 495c5cd6260S 496c5cd6260S return (0); 497c5cd6260S } 498c5cd6260S 499c5cd6260S /* 500*efd4c9b6SSteve Lawrence * Notify zonestatd of the new zone. If zonestatd is not running, this 501*efd4c9b6SSteve Lawrence * will do nothing. 502*efd4c9b6SSteve Lawrence */ 503*efd4c9b6SSteve Lawrence static void 504*efd4c9b6SSteve Lawrence notify_zonestatd(zoneid_t zoneid) 505*efd4c9b6SSteve Lawrence { 506*efd4c9b6SSteve Lawrence int cmd[2]; 507*efd4c9b6SSteve Lawrence int fd; 508*efd4c9b6SSteve Lawrence door_arg_t params; 509*efd4c9b6SSteve Lawrence 510*efd4c9b6SSteve Lawrence fd = open(ZS_DOOR_PATH, O_RDONLY); 511*efd4c9b6SSteve Lawrence if (fd < 0) 512*efd4c9b6SSteve Lawrence return; 513*efd4c9b6SSteve Lawrence 514*efd4c9b6SSteve Lawrence cmd[0] = ZSD_CMD_NEW_ZONE; 515*efd4c9b6SSteve Lawrence cmd[1] = zoneid; 516*efd4c9b6SSteve Lawrence params.data_ptr = (char *)&cmd; 517*efd4c9b6SSteve Lawrence params.data_size = sizeof (cmd); 518*efd4c9b6SSteve Lawrence params.desc_ptr = NULL; 519*efd4c9b6SSteve Lawrence params.desc_num = 0; 520*efd4c9b6SSteve Lawrence params.rbuf = NULL; 521*efd4c9b6SSteve Lawrence params.rsize = NULL; 522*efd4c9b6SSteve Lawrence (void) door_call(fd, ¶ms); 523*efd4c9b6SSteve Lawrence (void) close(fd); 524*efd4c9b6SSteve Lawrence } 525*efd4c9b6SSteve Lawrence 526*efd4c9b6SSteve Lawrence /* 527108322fbScarlsonj * Bring a zone up to the pre-boot "ready" stage. The mount_cmd argument is 528108322fbScarlsonj * 'true' if this is being invoked as part of the processing for the "mount" 529108322fbScarlsonj * subcommand. 530108322fbScarlsonj */ 531108322fbScarlsonj static int 532c5cd6260S zone_ready(zlog_t *zlogp, zone_mnt_t mount_cmd, int zstate) 5337c478bd9Sstevel@tonic-gate { 5347c478bd9Sstevel@tonic-gate int err; 5357c478bd9Sstevel@tonic-gate 536c5cd6260S if (brand_prestatechg(zlogp, zstate, Z_READY) != 0) 537c5cd6260S return (-1); 538c5cd6260S 5397c478bd9Sstevel@tonic-gate if ((err = zonecfg_create_snapshot(zone_name)) != Z_OK) { 5407c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "unable to create snapshot: %s", 5417c478bd9Sstevel@tonic-gate zonecfg_strerror(err)); 5428fe9fdf2SDan Price goto bad; 5437c478bd9Sstevel@tonic-gate } 5447c478bd9Sstevel@tonic-gate 545108322fbScarlsonj if ((zone_id = vplat_create(zlogp, mount_cmd)) == -1) { 5467c478bd9Sstevel@tonic-gate if ((err = zonecfg_destroy_snapshot(zone_name)) != Z_OK) 5477c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "destroying snapshot: %s", 5487c478bd9Sstevel@tonic-gate zonecfg_strerror(err)); 5498fe9fdf2SDan Price goto bad; 5507c478bd9Sstevel@tonic-gate } 551555afedfScarlsonj if (vplat_bringup(zlogp, mount_cmd, zone_id) != 0) { 5527c478bd9Sstevel@tonic-gate bringup_failure_recovery = B_TRUE; 5536cfd72c6Sgjelinek (void) vplat_teardown(NULL, (mount_cmd != Z_MNT_BOOT), B_FALSE); 5547c478bd9Sstevel@tonic-gate if ((err = zonecfg_destroy_snapshot(zone_name)) != Z_OK) 5557c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "destroying snapshot: %s", 5567c478bd9Sstevel@tonic-gate zonecfg_strerror(err)); 5578fe9fdf2SDan Price goto bad; 5587c478bd9Sstevel@tonic-gate } 5597c478bd9Sstevel@tonic-gate 560c5cd6260S if (brand_poststatechg(zlogp, zstate, Z_READY) != 0) 5618fe9fdf2SDan Price goto bad; 562c5cd6260S 5637c478bd9Sstevel@tonic-gate return (0); 5648fe9fdf2SDan Price 5658fe9fdf2SDan Price bad: 5668fe9fdf2SDan Price /* 5678fe9fdf2SDan Price * If something goes wrong, we up the zones's state to the target 5688fe9fdf2SDan Price * state, READY, and then invoke the hook as if we're halting. 5698fe9fdf2SDan Price */ 5708fe9fdf2SDan Price (void) brand_poststatechg(zlogp, ZONE_STATE_READY, Z_HALT); 5718fe9fdf2SDan Price return (-1); 5727c478bd9Sstevel@tonic-gate } 5737c478bd9Sstevel@tonic-gate 574555afedfScarlsonj int 575555afedfScarlsonj init_template(void) 5767c478bd9Sstevel@tonic-gate { 5777c478bd9Sstevel@tonic-gate int fd; 5787c478bd9Sstevel@tonic-gate int err = 0; 5797c478bd9Sstevel@tonic-gate 5807c478bd9Sstevel@tonic-gate fd = open64(CTFS_ROOT "/process/template", O_RDWR); 5817c478bd9Sstevel@tonic-gate if (fd == -1) 5827c478bd9Sstevel@tonic-gate return (-1); 5837c478bd9Sstevel@tonic-gate 5847c478bd9Sstevel@tonic-gate /* 5857c478bd9Sstevel@tonic-gate * For now, zoneadmd doesn't do anything with the contract. 5867c478bd9Sstevel@tonic-gate * Deliver no events, don't inherit, and allow it to be orphaned. 5877c478bd9Sstevel@tonic-gate */ 5887c478bd9Sstevel@tonic-gate err |= ct_tmpl_set_critical(fd, 0); 5897c478bd9Sstevel@tonic-gate err |= ct_tmpl_set_informative(fd, 0); 5907c478bd9Sstevel@tonic-gate err |= ct_pr_tmpl_set_fatal(fd, CT_PR_EV_HWERR); 5917c478bd9Sstevel@tonic-gate err |= ct_pr_tmpl_set_param(fd, CT_PR_PGRPONLY | CT_PR_REGENT); 5927c478bd9Sstevel@tonic-gate if (err || ct_tmpl_activate(fd)) { 5937c478bd9Sstevel@tonic-gate (void) close(fd); 5947c478bd9Sstevel@tonic-gate return (-1); 5957c478bd9Sstevel@tonic-gate } 5967c478bd9Sstevel@tonic-gate 5977c478bd9Sstevel@tonic-gate return (fd); 5987c478bd9Sstevel@tonic-gate } 5997c478bd9Sstevel@tonic-gate 6009acbbeafSnn35248 typedef struct fs_callback { 6019acbbeafSnn35248 zlog_t *zlogp; 6029acbbeafSnn35248 zoneid_t zoneid; 603910f48daSedp boolean_t mount_cmd; 6049acbbeafSnn35248 } fs_callback_t; 6059acbbeafSnn35248 6067c478bd9Sstevel@tonic-gate static int 6079acbbeafSnn35248 mount_early_fs(void *data, const char *spec, const char *dir, 6089acbbeafSnn35248 const char *fstype, const char *opt) 6097c478bd9Sstevel@tonic-gate { 6109acbbeafSnn35248 zlog_t *zlogp = ((fs_callback_t *)data)->zlogp; 6119acbbeafSnn35248 zoneid_t zoneid = ((fs_callback_t *)data)->zoneid; 612910f48daSedp boolean_t mount_cmd = ((fs_callback_t *)data)->mount_cmd; 613d314f035Sedp char rootpath[MAXPATHLEN]; 6147c478bd9Sstevel@tonic-gate pid_t child; 6157c478bd9Sstevel@tonic-gate int child_status; 6167c478bd9Sstevel@tonic-gate int tmpl_fd; 617d314f035Sedp int rv; 6187c478bd9Sstevel@tonic-gate ctid_t ct; 6197c478bd9Sstevel@tonic-gate 620910f48daSedp /* determine the zone rootpath */ 621910f48daSedp if (mount_cmd) { 622910f48daSedp char zonepath[MAXPATHLEN]; 623910f48daSedp char luroot[MAXPATHLEN]; 624910f48daSedp 625910f48daSedp if (zone_get_zonepath(zone_name, 626910f48daSedp zonepath, sizeof (zonepath)) != Z_OK) { 627910f48daSedp zerror(zlogp, B_FALSE, "unable to determine zone path"); 628910f48daSedp return (-1); 629910f48daSedp } 630910f48daSedp 631910f48daSedp (void) snprintf(luroot, sizeof (luroot), "%s/lu", zonepath); 632910f48daSedp resolve_lofs(zlogp, luroot, sizeof (luroot)); 633910f48daSedp (void) strlcpy(rootpath, luroot, sizeof (rootpath)); 634910f48daSedp } else { 635910f48daSedp if (zone_get_rootpath(zone_name, 636910f48daSedp rootpath, sizeof (rootpath)) != Z_OK) { 637d314f035Sedp zerror(zlogp, B_FALSE, "unable to determine zone root"); 638d314f035Sedp return (-1); 639d314f035Sedp } 640910f48daSedp } 641d314f035Sedp 642d314f035Sedp if ((rv = valid_mount_path(zlogp, rootpath, spec, dir, fstype)) < 0) { 643d314f035Sedp zerror(zlogp, B_FALSE, "%s%s is not a valid mount point", 644d314f035Sedp rootpath, dir); 645d314f035Sedp return (-1); 646d314f035Sedp } else if (rv > 0) { 647d314f035Sedp /* The mount point path doesn't exist, create it now. */ 648d314f035Sedp if (make_one_dir(zlogp, rootpath, dir, 649d314f035Sedp DEFAULT_DIR_MODE, DEFAULT_DIR_USER, 650d314f035Sedp DEFAULT_DIR_GROUP) != 0) { 651d314f035Sedp zerror(zlogp, B_FALSE, "failed to create mount point"); 652d314f035Sedp return (-1); 653d314f035Sedp } 654d314f035Sedp 655d314f035Sedp /* 656d314f035Sedp * Now this might seem weird, but we need to invoke 657d314f035Sedp * valid_mount_path() again. Why? Because it checks 658d314f035Sedp * to make sure that the mount point path is canonical, 659d314f035Sedp * which it can only do if the path exists, so now that 660d314f035Sedp * we've created the path we have to verify it again. 661d314f035Sedp */ 662d314f035Sedp if ((rv = valid_mount_path(zlogp, rootpath, spec, dir, 663d314f035Sedp fstype)) < 0) { 664d314f035Sedp zerror(zlogp, B_FALSE, 665d314f035Sedp "%s%s is not a valid mount point", rootpath, dir); 666d314f035Sedp return (-1); 667d314f035Sedp } 668d314f035Sedp } 669d314f035Sedp 6707c478bd9Sstevel@tonic-gate if ((tmpl_fd = init_template()) == -1) { 6717c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "failed to create contract"); 6727c478bd9Sstevel@tonic-gate return (-1); 6737c478bd9Sstevel@tonic-gate } 6747c478bd9Sstevel@tonic-gate 6757c478bd9Sstevel@tonic-gate if ((child = fork()) == -1) { 6767c478bd9Sstevel@tonic-gate (void) ct_tmpl_clear(tmpl_fd); 6777c478bd9Sstevel@tonic-gate (void) close(tmpl_fd); 6787c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "failed to fork"); 6797c478bd9Sstevel@tonic-gate return (-1); 6807c478bd9Sstevel@tonic-gate 6817c478bd9Sstevel@tonic-gate } else if (child == 0) { /* child */ 6829acbbeafSnn35248 char opt_buf[MAX_MNTOPT_STR]; 6839acbbeafSnn35248 int optlen = 0; 6849acbbeafSnn35248 int mflag = MS_DATA; 6859acbbeafSnn35248 6867c478bd9Sstevel@tonic-gate (void) ct_tmpl_clear(tmpl_fd); 6877c478bd9Sstevel@tonic-gate /* 6887c478bd9Sstevel@tonic-gate * Even though there are no procs running in the zone, we 6897c478bd9Sstevel@tonic-gate * do this for paranoia's sake. 6907c478bd9Sstevel@tonic-gate */ 6917c478bd9Sstevel@tonic-gate (void) closefrom(0); 6927c478bd9Sstevel@tonic-gate 6937c478bd9Sstevel@tonic-gate if (zone_enter(zoneid) == -1) { 6947c478bd9Sstevel@tonic-gate _exit(errno); 6957c478bd9Sstevel@tonic-gate } 6969acbbeafSnn35248 if (opt != NULL) { 6979acbbeafSnn35248 /* 6989acbbeafSnn35248 * The mount() system call is incredibly annoying. 6999acbbeafSnn35248 * If options are specified, we need to copy them 7009acbbeafSnn35248 * into a temporary buffer since the mount() system 7019acbbeafSnn35248 * call will overwrite the options string. It will 7029acbbeafSnn35248 * also fail if the new option string it wants to 7039acbbeafSnn35248 * write is bigger than the one we passed in, so 7049acbbeafSnn35248 * you must pass in a buffer of the maximum possible 7059acbbeafSnn35248 * option string length. sigh. 7069acbbeafSnn35248 */ 7079acbbeafSnn35248 (void) strlcpy(opt_buf, opt, sizeof (opt_buf)); 7089acbbeafSnn35248 opt = opt_buf; 7099acbbeafSnn35248 optlen = MAX_MNTOPT_STR; 7109acbbeafSnn35248 mflag = MS_OPTIONSTR; 7119acbbeafSnn35248 } 7129acbbeafSnn35248 if (mount(spec, dir, mflag, fstype, NULL, 0, opt, optlen) != 0) 7137c478bd9Sstevel@tonic-gate _exit(errno); 7147c478bd9Sstevel@tonic-gate _exit(0); 7157c478bd9Sstevel@tonic-gate } 7167c478bd9Sstevel@tonic-gate 7177c478bd9Sstevel@tonic-gate /* parent */ 7187c478bd9Sstevel@tonic-gate if (contract_latest(&ct) == -1) 7197c478bd9Sstevel@tonic-gate ct = -1; 7207c478bd9Sstevel@tonic-gate (void) ct_tmpl_clear(tmpl_fd); 7217c478bd9Sstevel@tonic-gate (void) close(tmpl_fd); 7227c478bd9Sstevel@tonic-gate if (waitpid(child, &child_status, 0) != child) { 7237c478bd9Sstevel@tonic-gate /* unexpected: we must have been signalled */ 7247c478bd9Sstevel@tonic-gate (void) contract_abandon_id(ct); 7257c478bd9Sstevel@tonic-gate return (-1); 7267c478bd9Sstevel@tonic-gate } 7277c478bd9Sstevel@tonic-gate (void) contract_abandon_id(ct); 7287c478bd9Sstevel@tonic-gate if (WEXITSTATUS(child_status) != 0) { 7297c478bd9Sstevel@tonic-gate errno = WEXITSTATUS(child_status); 7307c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "mount of %s failed", dir); 7317c478bd9Sstevel@tonic-gate return (-1); 7327c478bd9Sstevel@tonic-gate } 7337c478bd9Sstevel@tonic-gate 7347c478bd9Sstevel@tonic-gate return (0); 7357c478bd9Sstevel@tonic-gate } 7367c478bd9Sstevel@tonic-gate 737c5cd6260S /* 738c5cd6260S * If retstr is not NULL, the output of the subproc is returned in the str, 739c5cd6260S * otherwise it is output using zerror(). Any memory allocated for retstr 740c5cd6260S * should be freed by the caller. 741c5cd6260S */ 7429acbbeafSnn35248 int 743c5cd6260S do_subproc(zlog_t *zlogp, char *cmdbuf, char **retstr) 744108322fbScarlsonj { 745c5cd6260S char buf[1024]; /* arbitrary large amount */ 746c5cd6260S char *inbuf; 7479acbbeafSnn35248 FILE *file; 7489acbbeafSnn35248 int status; 749c5cd6260S int rd_cnt; 750c5cd6260S 751c5cd6260S if (retstr != NULL) { 752c5cd6260S if ((*retstr = malloc(1024)) == NULL) { 753c5cd6260S zerror(zlogp, B_FALSE, "out of memory"); 754c5cd6260S return (-1); 755c5cd6260S } 756c5cd6260S inbuf = *retstr; 757c5cd6260S rd_cnt = 0; 758c5cd6260S } else { 759c5cd6260S inbuf = buf; 760c5cd6260S } 761108322fbScarlsonj 7629acbbeafSnn35248 file = popen(cmdbuf, "r"); 7639acbbeafSnn35248 if (file == NULL) { 7649acbbeafSnn35248 zerror(zlogp, B_TRUE, "could not launch: %s", cmdbuf); 765108322fbScarlsonj return (-1); 7669acbbeafSnn35248 } 767108322fbScarlsonj 768c5cd6260S while (fgets(inbuf, 1024, file) != NULL) { 7691f314719S if (retstr == NULL) { 7701f314719S if (zlogp != &logsys) 7719acbbeafSnn35248 zerror(zlogp, B_FALSE, "%s", inbuf); 772c5cd6260S } else { 773c5cd6260S char *p; 774c5cd6260S 775c5cd6260S rd_cnt += 1024 - 1; 776c5cd6260S if ((p = realloc(*retstr, rd_cnt + 1024)) == NULL) { 777c5cd6260S zerror(zlogp, B_FALSE, "out of memory"); 778c5cd6260S (void) pclose(file); 779c5cd6260S return (-1); 780c5cd6260S } 781c5cd6260S 782c5cd6260S *retstr = p; 783c5cd6260S inbuf = *retstr + rd_cnt; 784c5cd6260S } 785c5cd6260S } 7869acbbeafSnn35248 status = pclose(file); 7879acbbeafSnn35248 7889acbbeafSnn35248 if (WIFSIGNALED(status)) { 7899acbbeafSnn35248 zerror(zlogp, B_FALSE, "%s unexpectedly terminated due to " 7909acbbeafSnn35248 "signal %d", cmdbuf, WTERMSIG(status)); 7915518d15bSdp return (-1); 7929acbbeafSnn35248 } 7939acbbeafSnn35248 assert(WIFEXITED(status)); 7949acbbeafSnn35248 if (WEXITSTATUS(status) == ZEXIT_EXEC) { 7959acbbeafSnn35248 zerror(zlogp, B_FALSE, "failed to exec %s", cmdbuf); 796108322fbScarlsonj return (-1); 7979acbbeafSnn35248 } 7989acbbeafSnn35248 return (WEXITSTATUS(status)); 799108322fbScarlsonj } 800108322fbScarlsonj 801108322fbScarlsonj static int 802c5cd6260S zone_bootup(zlog_t *zlogp, const char *bootargs, int zstate) 8037c478bd9Sstevel@tonic-gate { 8047c478bd9Sstevel@tonic-gate zoneid_t zoneid; 8057c478bd9Sstevel@tonic-gate struct stat st; 806ff17c8bfSgjelinek char zpath[MAXPATHLEN], initpath[MAXPATHLEN], init_file[MAXPATHLEN]; 8073f2f09c1Sdp char nbootargs[BOOTARGS_MAX]; 8089acbbeafSnn35248 char cmdbuf[MAXPATHLEN]; 8099acbbeafSnn35248 fs_callback_t cb; 810123807fbSedp brand_handle_t bh; 8112b24ab6bSSebastien Roy zone_iptype_t iptype; 8122b24ab6bSSebastien Roy boolean_t links_loaded = B_FALSE; 8132b24ab6bSSebastien Roy dladm_status_t status; 8142b24ab6bSSebastien Roy char errmsg[DLADM_STRSIZE]; 8153f2f09c1Sdp int err; 8167c478bd9Sstevel@tonic-gate 817c5cd6260S if (brand_prestatechg(zlogp, zstate, Z_BOOT) != 0) 818c5cd6260S return (-1); 819c5cd6260S 8207c478bd9Sstevel@tonic-gate if ((zoneid = getzoneidbyname(zone_name)) == -1) { 8217c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "unable to get zoneid"); 8228fe9fdf2SDan Price goto bad; 8237c478bd9Sstevel@tonic-gate } 8247c478bd9Sstevel@tonic-gate 8259acbbeafSnn35248 cb.zlogp = zlogp; 8269acbbeafSnn35248 cb.zoneid = zoneid; 827910f48daSedp cb.mount_cmd = B_FALSE; 8289acbbeafSnn35248 8299acbbeafSnn35248 /* Get a handle to the brand info for this zone */ 830123807fbSedp if ((bh = brand_open(brand_name)) == NULL) { 8319acbbeafSnn35248 zerror(zlogp, B_FALSE, "unable to determine zone brand"); 8328fe9fdf2SDan Price goto bad; 8339acbbeafSnn35248 } 8349acbbeafSnn35248 8359acbbeafSnn35248 /* 8369acbbeafSnn35248 * Get the list of filesystems to mount from the brand 8379acbbeafSnn35248 * configuration. These mounts are done via a thread that will 8389acbbeafSnn35248 * enter the zone, so they are done from within the context of the 8399acbbeafSnn35248 * zone. 8409acbbeafSnn35248 */ 841123807fbSedp if (brand_platform_iter_mounts(bh, mount_early_fs, &cb) != 0) { 8429acbbeafSnn35248 zerror(zlogp, B_FALSE, "unable to mount filesystems"); 843123807fbSedp brand_close(bh); 8448fe9fdf2SDan Price goto bad; 8459acbbeafSnn35248 } 8469acbbeafSnn35248 8479acbbeafSnn35248 /* 8489acbbeafSnn35248 * Get the brand's boot callback if it exists. 8499acbbeafSnn35248 */ 850ff17c8bfSgjelinek if (zone_get_zonepath(zone_name, zpath, sizeof (zpath)) != Z_OK) { 851ff17c8bfSgjelinek zerror(zlogp, B_FALSE, "unable to determine zone path"); 852e767a340Sgjelinek brand_close(bh); 8538fe9fdf2SDan Price goto bad; 8549acbbeafSnn35248 } 8559acbbeafSnn35248 (void) strcpy(cmdbuf, EXEC_PREFIX); 856ff17c8bfSgjelinek if (brand_get_boot(bh, zone_name, zpath, cmdbuf + EXEC_LEN, 857ff17c8bfSgjelinek sizeof (cmdbuf) - EXEC_LEN) != 0) { 8589acbbeafSnn35248 zerror(zlogp, B_FALSE, 8599acbbeafSnn35248 "unable to determine branded zone's boot callback"); 860123807fbSedp brand_close(bh); 8618fe9fdf2SDan Price goto bad; 8629acbbeafSnn35248 } 8639acbbeafSnn35248 8649acbbeafSnn35248 /* Get the path for this zone's init(1M) (or equivalent) process. */ 865123807fbSedp if (brand_get_initname(bh, init_file, MAXPATHLEN) != 0) { 8669acbbeafSnn35248 zerror(zlogp, B_FALSE, 8679acbbeafSnn35248 "unable to determine zone's init(1M) location"); 868123807fbSedp brand_close(bh); 8698fe9fdf2SDan Price goto bad; 8709acbbeafSnn35248 } 8719acbbeafSnn35248 872123807fbSedp brand_close(bh); 8737c478bd9Sstevel@tonic-gate 8743f2f09c1Sdp err = filter_bootargs(zlogp, bootargs, nbootargs, init_file, 8753f2f09c1Sdp bad_boot_arg); 8763f2f09c1Sdp if (err == Z_INVAL) 8773f2f09c1Sdp eventstream_write(Z_EVT_ZONE_BADARGS); 8783f2f09c1Sdp else if (err != Z_OK) 8798fe9fdf2SDan Price goto bad; 8803f2f09c1Sdp 8813f2f09c1Sdp assert(init_file[0] != '\0'); 8823f2f09c1Sdp 8839acbbeafSnn35248 /* Try to anticipate possible problems: Make sure init is executable. */ 884ff17c8bfSgjelinek if (zone_get_rootpath(zone_name, zpath, sizeof (zpath)) != Z_OK) { 8857c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "unable to determine zone root"); 8868fe9fdf2SDan Price goto bad; 8877c478bd9Sstevel@tonic-gate } 8889acbbeafSnn35248 889ff17c8bfSgjelinek (void) snprintf(initpath, sizeof (initpath), "%s%s", zpath, init_file); 8907c478bd9Sstevel@tonic-gate 8917c478bd9Sstevel@tonic-gate if (stat(initpath, &st) == -1) { 8927c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "could not stat %s", initpath); 8938fe9fdf2SDan Price goto bad; 8947c478bd9Sstevel@tonic-gate } 8957c478bd9Sstevel@tonic-gate 8967c478bd9Sstevel@tonic-gate if ((st.st_mode & S_IXUSR) == 0) { 8977c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "%s is not executable", initpath); 8988fe9fdf2SDan Price goto bad; 8997c478bd9Sstevel@tonic-gate } 9007c478bd9Sstevel@tonic-gate 9019acbbeafSnn35248 /* 9022b24ab6bSSebastien Roy * Exclusive stack zones interact with the dlmgmtd running in the 9032b24ab6bSSebastien Roy * global zone. dladm_zone_boot() tells dlmgmtd that this zone is 9042b24ab6bSSebastien Roy * booting, and loads its datalinks from the zone's datalink 9052b24ab6bSSebastien Roy * configuration file. 9062b24ab6bSSebastien Roy */ 9072b24ab6bSSebastien Roy if (vplat_get_iptype(zlogp, &iptype) == 0 && iptype == ZS_EXCLUSIVE) { 9082b24ab6bSSebastien Roy status = dladm_zone_boot(dld_handle, zoneid); 9092b24ab6bSSebastien Roy if (status != DLADM_STATUS_OK) { 9102b24ab6bSSebastien Roy zerror(zlogp, B_FALSE, "unable to load zone datalinks: " 9112b24ab6bSSebastien Roy " %s", dladm_status2str(status, errmsg)); 9122b24ab6bSSebastien Roy goto bad; 9132b24ab6bSSebastien Roy } 9142b24ab6bSSebastien Roy links_loaded = B_TRUE; 9152b24ab6bSSebastien Roy } 9162b24ab6bSSebastien Roy 9172b24ab6bSSebastien Roy /* 9189acbbeafSnn35248 * If there is a brand 'boot' callback, execute it now to give the 9199acbbeafSnn35248 * brand one last chance to do any additional setup before the zone 9209acbbeafSnn35248 * is booted. 9219acbbeafSnn35248 */ 9229acbbeafSnn35248 if ((strlen(cmdbuf) > EXEC_LEN) && 923c5cd6260S (do_subproc(zlogp, cmdbuf, NULL) != Z_OK)) { 9249acbbeafSnn35248 zerror(zlogp, B_FALSE, "%s failed", cmdbuf); 9258fe9fdf2SDan Price goto bad; 9269acbbeafSnn35248 } 9279acbbeafSnn35248 9283f2f09c1Sdp if (zone_setattr(zoneid, ZONE_ATTR_INITNAME, init_file, 0) == -1) { 9293f2f09c1Sdp zerror(zlogp, B_TRUE, "could not set zone boot file"); 9308fe9fdf2SDan Price goto bad; 9313f2f09c1Sdp } 9323f2f09c1Sdp 9333f2f09c1Sdp if (zone_setattr(zoneid, ZONE_ATTR_BOOTARGS, nbootargs, 0) == -1) { 9343f2f09c1Sdp zerror(zlogp, B_TRUE, "could not set zone boot arguments"); 9358fe9fdf2SDan Price goto bad; 9363f2f09c1Sdp } 9373f2f09c1Sdp 938*efd4c9b6SSteve Lawrence /* 939*efd4c9b6SSteve Lawrence * Inform zonestatd of a new zone so that it can install a door for 940*efd4c9b6SSteve Lawrence * the zone to contact it. 941*efd4c9b6SSteve Lawrence */ 942*efd4c9b6SSteve Lawrence notify_zonestatd(zone_id); 943*efd4c9b6SSteve Lawrence 9443f2f09c1Sdp if (zone_boot(zoneid) == -1) { 9457c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "unable to boot zone"); 9468fe9fdf2SDan Price goto bad; 9477c478bd9Sstevel@tonic-gate } 9487c478bd9Sstevel@tonic-gate 949c5cd6260S if (brand_poststatechg(zlogp, zstate, Z_BOOT) != 0) 9508fe9fdf2SDan Price goto bad; 951c5cd6260S 9527c478bd9Sstevel@tonic-gate return (0); 9538fe9fdf2SDan Price 9548fe9fdf2SDan Price bad: 9558fe9fdf2SDan Price /* 9568fe9fdf2SDan Price * If something goes wrong, we up the zones's state to the target 9578fe9fdf2SDan Price * state, RUNNING, and then invoke the hook as if we're halting. 9588fe9fdf2SDan Price */ 9598fe9fdf2SDan Price (void) brand_poststatechg(zlogp, ZONE_STATE_RUNNING, Z_HALT); 9602b24ab6bSSebastien Roy if (links_loaded) 9612b24ab6bSSebastien Roy (void) dladm_zone_halt(dld_handle, zoneid); 9628fe9fdf2SDan Price return (-1); 9637c478bd9Sstevel@tonic-gate } 9647c478bd9Sstevel@tonic-gate 9657c478bd9Sstevel@tonic-gate static int 966c5cd6260S zone_halt(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting, int zstate) 9677c478bd9Sstevel@tonic-gate { 9687c478bd9Sstevel@tonic-gate int err; 9697c478bd9Sstevel@tonic-gate 970c5cd6260S if (brand_prestatechg(zlogp, zstate, Z_HALT) != 0) 971c5cd6260S return (-1); 972c5cd6260S 9730209230bSgjelinek if (vplat_teardown(zlogp, unmount_cmd, rebooting) != 0) { 9747c478bd9Sstevel@tonic-gate if (!bringup_failure_recovery) 9757c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "unable to destroy zone"); 9767c478bd9Sstevel@tonic-gate return (-1); 9777c478bd9Sstevel@tonic-gate } 9787c478bd9Sstevel@tonic-gate 9797c478bd9Sstevel@tonic-gate if ((err = zonecfg_destroy_snapshot(zone_name)) != Z_OK) 9807c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "destroying snapshot: %s", 9817c478bd9Sstevel@tonic-gate zonecfg_strerror(err)); 9827c478bd9Sstevel@tonic-gate 983c5cd6260S if (brand_poststatechg(zlogp, zstate, Z_HALT) != 0) 984c5cd6260S return (-1); 985c5cd6260S 9867c478bd9Sstevel@tonic-gate return (0); 9877c478bd9Sstevel@tonic-gate } 9887c478bd9Sstevel@tonic-gate 9897c478bd9Sstevel@tonic-gate /* 9907c478bd9Sstevel@tonic-gate * Generate AUE_zone_state for a command that boots a zone. 9917c478bd9Sstevel@tonic-gate */ 9927c478bd9Sstevel@tonic-gate static void 9937c478bd9Sstevel@tonic-gate audit_put_record(zlog_t *zlogp, ucred_t *uc, int return_val, 9947c478bd9Sstevel@tonic-gate char *new_state) 9957c478bd9Sstevel@tonic-gate { 9967c478bd9Sstevel@tonic-gate adt_session_data_t *ah; 9977c478bd9Sstevel@tonic-gate adt_event_data_t *event; 9987c478bd9Sstevel@tonic-gate int pass_fail, fail_reason; 9997c478bd9Sstevel@tonic-gate 10007c478bd9Sstevel@tonic-gate if (!adt_audit_enabled()) 10017c478bd9Sstevel@tonic-gate return; 10027c478bd9Sstevel@tonic-gate 10037c478bd9Sstevel@tonic-gate if (return_val == 0) { 10047c478bd9Sstevel@tonic-gate pass_fail = ADT_SUCCESS; 10057c478bd9Sstevel@tonic-gate fail_reason = ADT_SUCCESS; 10067c478bd9Sstevel@tonic-gate } else { 10077c478bd9Sstevel@tonic-gate pass_fail = ADT_FAILURE; 10087c478bd9Sstevel@tonic-gate fail_reason = ADT_FAIL_VALUE_PROGRAM; 10097c478bd9Sstevel@tonic-gate } 10107c478bd9Sstevel@tonic-gate 10117c478bd9Sstevel@tonic-gate if (adt_start_session(&ah, NULL, 0)) { 10127c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, gettext("audit failure.")); 10137c478bd9Sstevel@tonic-gate return; 10147c478bd9Sstevel@tonic-gate } 10157c478bd9Sstevel@tonic-gate if (adt_set_from_ucred(ah, uc, ADT_NEW)) { 10167c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, gettext("audit failure.")); 10177c478bd9Sstevel@tonic-gate (void) adt_end_session(ah); 10187c478bd9Sstevel@tonic-gate return; 10197c478bd9Sstevel@tonic-gate } 10207c478bd9Sstevel@tonic-gate 10217c478bd9Sstevel@tonic-gate event = adt_alloc_event(ah, ADT_zone_state); 10227c478bd9Sstevel@tonic-gate if (event == NULL) { 10237c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, gettext("audit failure.")); 10247c478bd9Sstevel@tonic-gate (void) adt_end_session(ah); 10257c478bd9Sstevel@tonic-gate return; 10267c478bd9Sstevel@tonic-gate } 10277c478bd9Sstevel@tonic-gate event->adt_zone_state.zonename = zone_name; 10287c478bd9Sstevel@tonic-gate event->adt_zone_state.new_state = new_state; 10297c478bd9Sstevel@tonic-gate 10307c478bd9Sstevel@tonic-gate if (adt_put_event(event, pass_fail, fail_reason)) 10317c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, gettext("audit failure.")); 10327c478bd9Sstevel@tonic-gate 10337c478bd9Sstevel@tonic-gate adt_free_event(event); 10347c478bd9Sstevel@tonic-gate 10357c478bd9Sstevel@tonic-gate (void) adt_end_session(ah); 10367c478bd9Sstevel@tonic-gate } 10377c478bd9Sstevel@tonic-gate 10387c478bd9Sstevel@tonic-gate /* 10397c478bd9Sstevel@tonic-gate * The main routine for the door server that deals with zone state transitions. 10407c478bd9Sstevel@tonic-gate */ 10417c478bd9Sstevel@tonic-gate /* ARGSUSED */ 10427c478bd9Sstevel@tonic-gate static void 10437c478bd9Sstevel@tonic-gate server(void *cookie, char *args, size_t alen, door_desc_t *dp, 10447c478bd9Sstevel@tonic-gate uint_t n_desc) 10457c478bd9Sstevel@tonic-gate { 10467c478bd9Sstevel@tonic-gate ucred_t *uc = NULL; 10477c478bd9Sstevel@tonic-gate const priv_set_t *eset; 10487c478bd9Sstevel@tonic-gate 10497c478bd9Sstevel@tonic-gate zone_state_t zstate; 10507c478bd9Sstevel@tonic-gate zone_cmd_t cmd; 10517c478bd9Sstevel@tonic-gate zone_cmd_arg_t *zargp; 10527c478bd9Sstevel@tonic-gate 10537c478bd9Sstevel@tonic-gate boolean_t kernelcall; 10547c478bd9Sstevel@tonic-gate 10557c478bd9Sstevel@tonic-gate int rval = -1; 10567c478bd9Sstevel@tonic-gate uint64_t uniqid; 10577c478bd9Sstevel@tonic-gate zoneid_t zoneid = -1; 10587c478bd9Sstevel@tonic-gate zlog_t zlog; 10597c478bd9Sstevel@tonic-gate zlog_t *zlogp; 10607c478bd9Sstevel@tonic-gate zone_cmd_rval_t *rvalp; 10617c478bd9Sstevel@tonic-gate size_t rlen = getpagesize(); /* conservative */ 10629acbbeafSnn35248 fs_callback_t cb; 1063123807fbSedp brand_handle_t bh; 10647c478bd9Sstevel@tonic-gate 10657c478bd9Sstevel@tonic-gate /* LINTED E_BAD_PTR_CAST_ALIGN */ 10667c478bd9Sstevel@tonic-gate zargp = (zone_cmd_arg_t *)args; 10677c478bd9Sstevel@tonic-gate 10687c478bd9Sstevel@tonic-gate /* 10697c478bd9Sstevel@tonic-gate * When we get the door unref message, we've fdetach'd the door, and 10707c478bd9Sstevel@tonic-gate * it is time for us to shut down zoneadmd. 10717c478bd9Sstevel@tonic-gate */ 10727c478bd9Sstevel@tonic-gate if (zargp == DOOR_UNREF_DATA) { 10737c478bd9Sstevel@tonic-gate /* 10747c478bd9Sstevel@tonic-gate * See comment at end of main() for info on the last rites. 10757c478bd9Sstevel@tonic-gate */ 10767c478bd9Sstevel@tonic-gate exit(0); 10777c478bd9Sstevel@tonic-gate } 10787c478bd9Sstevel@tonic-gate 10797c478bd9Sstevel@tonic-gate if (zargp == NULL) { 10807c478bd9Sstevel@tonic-gate (void) door_return(NULL, 0, 0, 0); 10817c478bd9Sstevel@tonic-gate } 10827c478bd9Sstevel@tonic-gate 10837c478bd9Sstevel@tonic-gate rvalp = alloca(rlen); 10847c478bd9Sstevel@tonic-gate bzero(rvalp, rlen); 10857c478bd9Sstevel@tonic-gate zlog.logfile = NULL; 10867c478bd9Sstevel@tonic-gate zlog.buflen = zlog.loglen = rlen - sizeof (zone_cmd_rval_t) + 1; 10877c478bd9Sstevel@tonic-gate zlog.buf = rvalp->errbuf; 10887c478bd9Sstevel@tonic-gate zlog.log = zlog.buf; 10897c478bd9Sstevel@tonic-gate /* defer initialization of zlog.locale until after credential check */ 10907c478bd9Sstevel@tonic-gate zlogp = &zlog; 10917c478bd9Sstevel@tonic-gate 10927c478bd9Sstevel@tonic-gate if (alen != sizeof (zone_cmd_arg_t)) { 10937c478bd9Sstevel@tonic-gate /* 10947c478bd9Sstevel@tonic-gate * This really shouldn't be happening. 10957c478bd9Sstevel@tonic-gate */ 10963f2f09c1Sdp zerror(&logsys, B_FALSE, "argument size (%d bytes) " 10973f2f09c1Sdp "unexpected (expected %d bytes)", alen, 10983f2f09c1Sdp sizeof (zone_cmd_arg_t)); 10997c478bd9Sstevel@tonic-gate goto out; 11007c478bd9Sstevel@tonic-gate } 11017c478bd9Sstevel@tonic-gate cmd = zargp->cmd; 11027c478bd9Sstevel@tonic-gate 11037c478bd9Sstevel@tonic-gate if (door_ucred(&uc) != 0) { 11047c478bd9Sstevel@tonic-gate zerror(&logsys, B_TRUE, "door_ucred"); 11057c478bd9Sstevel@tonic-gate goto out; 11067c478bd9Sstevel@tonic-gate } 11077c478bd9Sstevel@tonic-gate eset = ucred_getprivset(uc, PRIV_EFFECTIVE); 11087c478bd9Sstevel@tonic-gate if (ucred_getzoneid(uc) != GLOBAL_ZONEID || 11097c478bd9Sstevel@tonic-gate (eset != NULL ? !priv_ismember(eset, PRIV_SYS_CONFIG) : 11107c478bd9Sstevel@tonic-gate ucred_geteuid(uc) != 0)) { 11117c478bd9Sstevel@tonic-gate zerror(&logsys, B_FALSE, "insufficient privileges"); 11127c478bd9Sstevel@tonic-gate goto out; 11137c478bd9Sstevel@tonic-gate } 11147c478bd9Sstevel@tonic-gate 11157c478bd9Sstevel@tonic-gate kernelcall = ucred_getpid(uc) == 0; 11167c478bd9Sstevel@tonic-gate 11177c478bd9Sstevel@tonic-gate /* 11187c478bd9Sstevel@tonic-gate * This is safe because we only use a zlog_t throughout the 11197c478bd9Sstevel@tonic-gate * duration of a door call; i.e., by the time the pointer 11207c478bd9Sstevel@tonic-gate * might become invalid, the door call would be over. 11217c478bd9Sstevel@tonic-gate */ 11227c478bd9Sstevel@tonic-gate zlog.locale = kernelcall ? DEFAULT_LOCALE : zargp->locale; 11237c478bd9Sstevel@tonic-gate 11247c478bd9Sstevel@tonic-gate (void) mutex_lock(&lock); 11257c478bd9Sstevel@tonic-gate 11267c478bd9Sstevel@tonic-gate /* 11277c478bd9Sstevel@tonic-gate * Once we start to really die off, we don't want more connections. 11287c478bd9Sstevel@tonic-gate */ 11297c478bd9Sstevel@tonic-gate if (in_death_throes) { 11307c478bd9Sstevel@tonic-gate (void) mutex_unlock(&lock); 11317c478bd9Sstevel@tonic-gate ucred_free(uc); 11327c478bd9Sstevel@tonic-gate (void) door_return(NULL, 0, 0, 0); 11337c478bd9Sstevel@tonic-gate thr_exit(NULL); 11347c478bd9Sstevel@tonic-gate } 11357c478bd9Sstevel@tonic-gate 11367c478bd9Sstevel@tonic-gate /* 11377c478bd9Sstevel@tonic-gate * Check for validity of command. 11387c478bd9Sstevel@tonic-gate */ 11399acbbeafSnn35248 if (cmd != Z_READY && cmd != Z_BOOT && cmd != Z_FORCEBOOT && 11409acbbeafSnn35248 cmd != Z_REBOOT && cmd != Z_HALT && cmd != Z_NOTE_UNINSTALLING && 11419acbbeafSnn35248 cmd != Z_MOUNT && cmd != Z_FORCEMOUNT && cmd != Z_UNMOUNT) { 1142108322fbScarlsonj zerror(&logsys, B_FALSE, "invalid command %d", (int)cmd); 11437c478bd9Sstevel@tonic-gate goto out; 11447c478bd9Sstevel@tonic-gate } 11457c478bd9Sstevel@tonic-gate 11467c478bd9Sstevel@tonic-gate if (kernelcall && (cmd != Z_HALT && cmd != Z_REBOOT)) { 11477c478bd9Sstevel@tonic-gate /* 11487c478bd9Sstevel@tonic-gate * Can't happen 11497c478bd9Sstevel@tonic-gate */ 11507c478bd9Sstevel@tonic-gate zerror(&logsys, B_FALSE, "received unexpected kernel upcall %d", 11517c478bd9Sstevel@tonic-gate cmd); 11527c478bd9Sstevel@tonic-gate goto out; 11537c478bd9Sstevel@tonic-gate } 11547c478bd9Sstevel@tonic-gate /* 11557c478bd9Sstevel@tonic-gate * We ignore the possibility of someone calling zone_create(2) 11567c478bd9Sstevel@tonic-gate * explicitly; all requests must come through zoneadmd. 11577c478bd9Sstevel@tonic-gate */ 11587c478bd9Sstevel@tonic-gate if (zone_get_state(zone_name, &zstate) != Z_OK) { 11597c478bd9Sstevel@tonic-gate /* 11607c478bd9Sstevel@tonic-gate * Something terribly wrong happened 11617c478bd9Sstevel@tonic-gate */ 11627c478bd9Sstevel@tonic-gate zerror(&logsys, B_FALSE, "unable to determine state of zone"); 11637c478bd9Sstevel@tonic-gate goto out; 11647c478bd9Sstevel@tonic-gate } 11657c478bd9Sstevel@tonic-gate 11667c478bd9Sstevel@tonic-gate if (kernelcall) { 11677c478bd9Sstevel@tonic-gate /* 11687c478bd9Sstevel@tonic-gate * Kernel-initiated requests may lose their validity if the 11697c478bd9Sstevel@tonic-gate * zone_t the kernel was referring to has gone away. 11707c478bd9Sstevel@tonic-gate */ 11717c478bd9Sstevel@tonic-gate if ((zoneid = getzoneidbyname(zone_name)) == -1 || 11727c478bd9Sstevel@tonic-gate zone_getattr(zoneid, ZONE_ATTR_UNIQID, &uniqid, 11737c478bd9Sstevel@tonic-gate sizeof (uniqid)) == -1 || uniqid != zargp->uniqid) { 11747c478bd9Sstevel@tonic-gate /* 11757c478bd9Sstevel@tonic-gate * We're not talking about the same zone. The request 11767c478bd9Sstevel@tonic-gate * must have arrived too late. Return error. 11777c478bd9Sstevel@tonic-gate */ 11787c478bd9Sstevel@tonic-gate rval = -1; 11797c478bd9Sstevel@tonic-gate goto out; 11807c478bd9Sstevel@tonic-gate } 11817c478bd9Sstevel@tonic-gate zlogp = &logsys; /* Log errors to syslog */ 11827c478bd9Sstevel@tonic-gate } 11837c478bd9Sstevel@tonic-gate 11849acbbeafSnn35248 /* 11859acbbeafSnn35248 * If we are being asked to forcibly mount or boot a zone, we 11869acbbeafSnn35248 * pretend that an INCOMPLETE zone is actually INSTALLED. 11879acbbeafSnn35248 */ 11889acbbeafSnn35248 if (zstate == ZONE_STATE_INCOMPLETE && 11899acbbeafSnn35248 (cmd == Z_FORCEBOOT || cmd == Z_FORCEMOUNT)) 11909acbbeafSnn35248 zstate = ZONE_STATE_INSTALLED; 11919acbbeafSnn35248 11927c478bd9Sstevel@tonic-gate switch (zstate) { 11937c478bd9Sstevel@tonic-gate case ZONE_STATE_CONFIGURED: 11947c478bd9Sstevel@tonic-gate case ZONE_STATE_INCOMPLETE: 11957c478bd9Sstevel@tonic-gate /* 11967c478bd9Sstevel@tonic-gate * Not our area of expertise; we just print a nice message 11977c478bd9Sstevel@tonic-gate * and die off. 11987c478bd9Sstevel@tonic-gate */ 11997c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, 12007c478bd9Sstevel@tonic-gate "%s operation is invalid for zones in state '%s'", 1201108322fbScarlsonj z_cmd_name(cmd), zone_state_str(zstate)); 12027c478bd9Sstevel@tonic-gate break; 12037c478bd9Sstevel@tonic-gate 12047c478bd9Sstevel@tonic-gate case ZONE_STATE_INSTALLED: 12057c478bd9Sstevel@tonic-gate switch (cmd) { 12067c478bd9Sstevel@tonic-gate case Z_READY: 1207c5cd6260S rval = zone_ready(zlogp, Z_MNT_BOOT, zstate); 12087c478bd9Sstevel@tonic-gate if (rval == 0) 12097c478bd9Sstevel@tonic-gate eventstream_write(Z_EVT_ZONE_READIED); 12107c478bd9Sstevel@tonic-gate break; 12117c478bd9Sstevel@tonic-gate case Z_BOOT: 12129acbbeafSnn35248 case Z_FORCEBOOT: 12137c478bd9Sstevel@tonic-gate eventstream_write(Z_EVT_ZONE_BOOTING); 1214c5cd6260S if ((rval = zone_ready(zlogp, Z_MNT_BOOT, zstate)) 1215c5cd6260S == 0) { 1216c5cd6260S rval = zone_bootup(zlogp, zargp->bootbuf, 1217c5cd6260S zstate); 1218c5cd6260S } 12197c478bd9Sstevel@tonic-gate audit_put_record(zlogp, uc, rval, "boot"); 12207c478bd9Sstevel@tonic-gate if (rval != 0) { 12217c478bd9Sstevel@tonic-gate bringup_failure_recovery = B_TRUE; 1222c5cd6260S (void) zone_halt(zlogp, B_FALSE, B_FALSE, 1223c5cd6260S zstate); 1224ffbafc53Scomay eventstream_write(Z_EVT_ZONE_BOOTFAILED); 12257c478bd9Sstevel@tonic-gate } 12267c478bd9Sstevel@tonic-gate break; 12277c478bd9Sstevel@tonic-gate case Z_HALT: 12287c478bd9Sstevel@tonic-gate if (kernelcall) /* Invalid; can't happen */ 12297c478bd9Sstevel@tonic-gate abort(); 12307c478bd9Sstevel@tonic-gate /* 12317c478bd9Sstevel@tonic-gate * We could have two clients racing to halt this 12327c478bd9Sstevel@tonic-gate * zone; the second client loses, but his request 12337c478bd9Sstevel@tonic-gate * doesn't fail, since the zone is now in the desired 12347c478bd9Sstevel@tonic-gate * state. 12357c478bd9Sstevel@tonic-gate */ 12367c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "zone is already halted"); 12377c478bd9Sstevel@tonic-gate rval = 0; 12387c478bd9Sstevel@tonic-gate break; 12397c478bd9Sstevel@tonic-gate case Z_REBOOT: 12407c478bd9Sstevel@tonic-gate if (kernelcall) /* Invalid; can't happen */ 12417c478bd9Sstevel@tonic-gate abort(); 12427c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "%s operation is invalid " 1243108322fbScarlsonj "for zones in state '%s'", z_cmd_name(cmd), 12447c478bd9Sstevel@tonic-gate zone_state_str(zstate)); 12457c478bd9Sstevel@tonic-gate rval = -1; 12467c478bd9Sstevel@tonic-gate break; 12477c478bd9Sstevel@tonic-gate case Z_NOTE_UNINSTALLING: 12487c478bd9Sstevel@tonic-gate if (kernelcall) /* Invalid; can't happen */ 12497c478bd9Sstevel@tonic-gate abort(); 12507c478bd9Sstevel@tonic-gate /* 12517c478bd9Sstevel@tonic-gate * Tell the console to print out a message about this. 12527c478bd9Sstevel@tonic-gate * Once it does, we will be in_death_throes. 12537c478bd9Sstevel@tonic-gate */ 12547c478bd9Sstevel@tonic-gate eventstream_write(Z_EVT_ZONE_UNINSTALLING); 12557c478bd9Sstevel@tonic-gate break; 1256108322fbScarlsonj case Z_MOUNT: 12579acbbeafSnn35248 case Z_FORCEMOUNT: 1258108322fbScarlsonj if (kernelcall) /* Invalid; can't happen */ 1259108322fbScarlsonj abort(); 12609a5d73e0SRic Aleshire if (!zone_isnative && !zone_iscluster && 12619a5d73e0SRic Aleshire !zone_islabeled) { 12620679f794S /* 12630679f794S * -U mounts the zone without lofs mounting 12640679f794S * zone file systems back into the scratch 12650679f794S * zone. This is required when mounting 12660679f794S * non-native branded zones. 12670679f794S */ 12680679f794S (void) strlcpy(zargp->bootbuf, "-U", 12690679f794S BOOTARGS_MAX); 1270ffbafc53Scomay } 1271ffbafc53Scomay 12726cfd72c6Sgjelinek rval = zone_ready(zlogp, 12736cfd72c6Sgjelinek strcmp(zargp->bootbuf, "-U") == 0 ? 1274c5cd6260S Z_MNT_UPDATE : Z_MNT_SCRATCH, zstate); 12759acbbeafSnn35248 if (rval != 0) 12769acbbeafSnn35248 break; 12779acbbeafSnn35248 12789acbbeafSnn35248 eventstream_write(Z_EVT_ZONE_READIED); 12799acbbeafSnn35248 12800679f794S /* 1281e5816e35SEdward Pilatowicz * Get a handle to the default brand info. 1282e5816e35SEdward Pilatowicz * We must always use the default brand file system 12830679f794S * list when mounting the zone. 12840679f794S */ 1285e5816e35SEdward Pilatowicz if ((bh = brand_open(default_brand)) == NULL) { 12869acbbeafSnn35248 rval = -1; 12879acbbeafSnn35248 break; 12889acbbeafSnn35248 } 12899acbbeafSnn35248 12909acbbeafSnn35248 /* 12919acbbeafSnn35248 * Get the list of filesystems to mount from 12929acbbeafSnn35248 * the brand configuration. These mounts are done 12939acbbeafSnn35248 * via a thread that will enter the zone, so they 12949acbbeafSnn35248 * are done from within the context of the zone. 12959acbbeafSnn35248 */ 12969acbbeafSnn35248 cb.zlogp = zlogp; 12979acbbeafSnn35248 cb.zoneid = zone_id; 1298910f48daSedp cb.mount_cmd = B_TRUE; 1299123807fbSedp rval = brand_platform_iter_mounts(bh, 13009acbbeafSnn35248 mount_early_fs, &cb); 13019acbbeafSnn35248 1302123807fbSedp brand_close(bh); 13039acbbeafSnn35248 1304108322fbScarlsonj /* 1305108322fbScarlsonj * Ordinarily, /dev/fd would be mounted inside the zone 1306108322fbScarlsonj * by svc:/system/filesystem/usr:default, but since 1307108322fbScarlsonj * we're not booting the zone, we need to do this 1308108322fbScarlsonj * manually. 1309108322fbScarlsonj */ 1310108322fbScarlsonj if (rval == 0) 13119acbbeafSnn35248 rval = mount_early_fs(&cb, 13129acbbeafSnn35248 "fd", "/dev/fd", "fd", NULL); 1313108322fbScarlsonj break; 1314108322fbScarlsonj case Z_UNMOUNT: 1315108322fbScarlsonj if (kernelcall) /* Invalid; can't happen */ 1316108322fbScarlsonj abort(); 1317108322fbScarlsonj zerror(zlogp, B_FALSE, "zone is already unmounted"); 1318108322fbScarlsonj rval = 0; 1319108322fbScarlsonj break; 13207c478bd9Sstevel@tonic-gate } 13217c478bd9Sstevel@tonic-gate break; 13227c478bd9Sstevel@tonic-gate 13237c478bd9Sstevel@tonic-gate case ZONE_STATE_READY: 13247c478bd9Sstevel@tonic-gate switch (cmd) { 13257c478bd9Sstevel@tonic-gate case Z_READY: 13267c478bd9Sstevel@tonic-gate /* 13277c478bd9Sstevel@tonic-gate * We could have two clients racing to ready this 13287c478bd9Sstevel@tonic-gate * zone; the second client loses, but his request 13297c478bd9Sstevel@tonic-gate * doesn't fail, since the zone is now in the desired 13307c478bd9Sstevel@tonic-gate * state. 13317c478bd9Sstevel@tonic-gate */ 13327c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "zone is already ready"); 13337c478bd9Sstevel@tonic-gate rval = 0; 13347c478bd9Sstevel@tonic-gate break; 13357c478bd9Sstevel@tonic-gate case Z_BOOT: 13363f2f09c1Sdp (void) strlcpy(boot_args, zargp->bootbuf, 13373f2f09c1Sdp sizeof (boot_args)); 13387c478bd9Sstevel@tonic-gate eventstream_write(Z_EVT_ZONE_BOOTING); 1339c5cd6260S rval = zone_bootup(zlogp, zargp->bootbuf, zstate); 13407c478bd9Sstevel@tonic-gate audit_put_record(zlogp, uc, rval, "boot"); 13417c478bd9Sstevel@tonic-gate if (rval != 0) { 13427c478bd9Sstevel@tonic-gate bringup_failure_recovery = B_TRUE; 1343c5cd6260S (void) zone_halt(zlogp, B_FALSE, B_TRUE, 1344c5cd6260S zstate); 1345ffbafc53Scomay eventstream_write(Z_EVT_ZONE_BOOTFAILED); 13467c478bd9Sstevel@tonic-gate } 13473f2f09c1Sdp boot_args[0] = '\0'; 13487c478bd9Sstevel@tonic-gate break; 13497c478bd9Sstevel@tonic-gate case Z_HALT: 13507c478bd9Sstevel@tonic-gate if (kernelcall) /* Invalid; can't happen */ 13517c478bd9Sstevel@tonic-gate abort(); 1352c5cd6260S if ((rval = zone_halt(zlogp, B_FALSE, B_FALSE, zstate)) 1353c5cd6260S != 0) 13547c478bd9Sstevel@tonic-gate break; 13557c478bd9Sstevel@tonic-gate eventstream_write(Z_EVT_ZONE_HALTED); 13567c478bd9Sstevel@tonic-gate break; 13577c478bd9Sstevel@tonic-gate case Z_REBOOT: 1358108322fbScarlsonj case Z_NOTE_UNINSTALLING: 1359108322fbScarlsonj case Z_MOUNT: 1360108322fbScarlsonj case Z_UNMOUNT: 13617c478bd9Sstevel@tonic-gate if (kernelcall) /* Invalid; can't happen */ 13627c478bd9Sstevel@tonic-gate abort(); 13637c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "%s operation is invalid " 1364108322fbScarlsonj "for zones in state '%s'", z_cmd_name(cmd), 13657c478bd9Sstevel@tonic-gate zone_state_str(zstate)); 13667c478bd9Sstevel@tonic-gate rval = -1; 13677c478bd9Sstevel@tonic-gate break; 1368108322fbScarlsonj } 1369108322fbScarlsonj break; 1370108322fbScarlsonj 1371108322fbScarlsonj case ZONE_STATE_MOUNTED: 1372108322fbScarlsonj switch (cmd) { 1373108322fbScarlsonj case Z_UNMOUNT: 13747c478bd9Sstevel@tonic-gate if (kernelcall) /* Invalid; can't happen */ 13757c478bd9Sstevel@tonic-gate abort(); 1376c5cd6260S rval = zone_halt(zlogp, B_TRUE, B_FALSE, zstate); 1377ffbafc53Scomay if (rval == 0) { 1378ffbafc53Scomay eventstream_write(Z_EVT_ZONE_HALTED); 1379108322fbScarlsonj (void) sema_post(&scratch_sem); 1380ffbafc53Scomay } 1381108322fbScarlsonj break; 1382108322fbScarlsonj default: 1383108322fbScarlsonj if (kernelcall) /* Invalid; can't happen */ 1384108322fbScarlsonj abort(); 1385108322fbScarlsonj zerror(zlogp, B_FALSE, "%s operation is invalid " 1386108322fbScarlsonj "for zones in state '%s'", z_cmd_name(cmd), 1387108322fbScarlsonj zone_state_str(zstate)); 13887c478bd9Sstevel@tonic-gate rval = -1; 13897c478bd9Sstevel@tonic-gate break; 13907c478bd9Sstevel@tonic-gate } 13917c478bd9Sstevel@tonic-gate break; 13927c478bd9Sstevel@tonic-gate 13937c478bd9Sstevel@tonic-gate case ZONE_STATE_RUNNING: 13947c478bd9Sstevel@tonic-gate case ZONE_STATE_SHUTTING_DOWN: 13957c478bd9Sstevel@tonic-gate case ZONE_STATE_DOWN: 13967c478bd9Sstevel@tonic-gate switch (cmd) { 13977c478bd9Sstevel@tonic-gate case Z_READY: 1398c5cd6260S if ((rval = zone_halt(zlogp, B_FALSE, B_TRUE, zstate)) 1399c5cd6260S != 0) 14007c478bd9Sstevel@tonic-gate break; 1401c5cd6260S if ((rval = zone_ready(zlogp, Z_MNT_BOOT, zstate)) == 0) 14027c478bd9Sstevel@tonic-gate eventstream_write(Z_EVT_ZONE_READIED); 1403ffbafc53Scomay else 1404ffbafc53Scomay eventstream_write(Z_EVT_ZONE_HALTED); 14057c478bd9Sstevel@tonic-gate break; 14067c478bd9Sstevel@tonic-gate case Z_BOOT: 14077c478bd9Sstevel@tonic-gate /* 14087c478bd9Sstevel@tonic-gate * We could have two clients racing to boot this 14097c478bd9Sstevel@tonic-gate * zone; the second client loses, but his request 14107c478bd9Sstevel@tonic-gate * doesn't fail, since the zone is now in the desired 14117c478bd9Sstevel@tonic-gate * state. 14127c478bd9Sstevel@tonic-gate */ 14137c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "zone is already booted"); 14147c478bd9Sstevel@tonic-gate rval = 0; 14157c478bd9Sstevel@tonic-gate break; 14167c478bd9Sstevel@tonic-gate case Z_HALT: 1417c5cd6260S if ((rval = zone_halt(zlogp, B_FALSE, B_FALSE, zstate)) 1418c5cd6260S != 0) 14197c478bd9Sstevel@tonic-gate break; 14207c478bd9Sstevel@tonic-gate eventstream_write(Z_EVT_ZONE_HALTED); 14217c478bd9Sstevel@tonic-gate break; 14227c478bd9Sstevel@tonic-gate case Z_REBOOT: 14233f2f09c1Sdp (void) strlcpy(boot_args, zargp->bootbuf, 14243f2f09c1Sdp sizeof (boot_args)); 14257c478bd9Sstevel@tonic-gate eventstream_write(Z_EVT_ZONE_REBOOTING); 1426c5cd6260S if ((rval = zone_halt(zlogp, B_FALSE, B_TRUE, zstate)) 1427c5cd6260S != 0) { 1428ffbafc53Scomay eventstream_write(Z_EVT_ZONE_BOOTFAILED); 14293f2f09c1Sdp boot_args[0] = '\0'; 14307c478bd9Sstevel@tonic-gate break; 1431ffbafc53Scomay } 1432c5cd6260S if ((rval = zone_ready(zlogp, Z_MNT_BOOT, zstate)) 1433c5cd6260S != 0) { 1434ffbafc53Scomay eventstream_write(Z_EVT_ZONE_BOOTFAILED); 14353f2f09c1Sdp boot_args[0] = '\0'; 1436ffbafc53Scomay break; 1437ffbafc53Scomay } 1438c5cd6260S rval = zone_bootup(zlogp, zargp->bootbuf, zstate); 14397c478bd9Sstevel@tonic-gate audit_put_record(zlogp, uc, rval, "reboot"); 1440ffbafc53Scomay if (rval != 0) { 1441c5cd6260S (void) zone_halt(zlogp, B_FALSE, B_TRUE, 1442c5cd6260S zstate); 1443ffbafc53Scomay eventstream_write(Z_EVT_ZONE_BOOTFAILED); 14447c478bd9Sstevel@tonic-gate } 14453f2f09c1Sdp boot_args[0] = '\0'; 14467c478bd9Sstevel@tonic-gate break; 14477c478bd9Sstevel@tonic-gate case Z_NOTE_UNINSTALLING: 1448108322fbScarlsonj case Z_MOUNT: 1449108322fbScarlsonj case Z_UNMOUNT: 1450108322fbScarlsonj zerror(zlogp, B_FALSE, "%s operation is invalid " 1451108322fbScarlsonj "for zones in state '%s'", z_cmd_name(cmd), 1452108322fbScarlsonj zone_state_str(zstate)); 14537c478bd9Sstevel@tonic-gate rval = -1; 14547c478bd9Sstevel@tonic-gate break; 14557c478bd9Sstevel@tonic-gate } 14567c478bd9Sstevel@tonic-gate break; 14577c478bd9Sstevel@tonic-gate default: 14587c478bd9Sstevel@tonic-gate abort(); 14597c478bd9Sstevel@tonic-gate } 14607c478bd9Sstevel@tonic-gate 14617c478bd9Sstevel@tonic-gate /* 14627c478bd9Sstevel@tonic-gate * Because the state of the zone may have changed, we make sure 14637c478bd9Sstevel@tonic-gate * to wake the console poller, which is in charge of initiating 14647c478bd9Sstevel@tonic-gate * the shutdown procedure as necessary. 14657c478bd9Sstevel@tonic-gate */ 14667c478bd9Sstevel@tonic-gate eventstream_write(Z_EVT_NULL); 14677c478bd9Sstevel@tonic-gate 14687c478bd9Sstevel@tonic-gate out: 14697c478bd9Sstevel@tonic-gate (void) mutex_unlock(&lock); 14707c478bd9Sstevel@tonic-gate if (kernelcall) { 14717c478bd9Sstevel@tonic-gate rvalp = NULL; 14727c478bd9Sstevel@tonic-gate rlen = 0; 14737c478bd9Sstevel@tonic-gate } else { 14747c478bd9Sstevel@tonic-gate rvalp->rval = rval; 14757c478bd9Sstevel@tonic-gate } 14767c478bd9Sstevel@tonic-gate if (uc != NULL) 14777c478bd9Sstevel@tonic-gate ucred_free(uc); 14787c478bd9Sstevel@tonic-gate (void) door_return((char *)rvalp, rlen, NULL, 0); 14797c478bd9Sstevel@tonic-gate thr_exit(NULL); 14807c478bd9Sstevel@tonic-gate } 14817c478bd9Sstevel@tonic-gate 14827c478bd9Sstevel@tonic-gate static int 14837c478bd9Sstevel@tonic-gate setup_door(zlog_t *zlogp) 14847c478bd9Sstevel@tonic-gate { 14857c478bd9Sstevel@tonic-gate if ((zone_door = door_create(server, NULL, 14867c478bd9Sstevel@tonic-gate DOOR_UNREF | DOOR_REFUSE_DESC | DOOR_NO_CANCEL)) < 0) { 14877c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "%s failed", "door_create"); 14887c478bd9Sstevel@tonic-gate return (-1); 14897c478bd9Sstevel@tonic-gate } 14907c478bd9Sstevel@tonic-gate (void) fdetach(zone_door_path); 14917c478bd9Sstevel@tonic-gate 14927c478bd9Sstevel@tonic-gate if (fattach(zone_door, zone_door_path) != 0) { 14937c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "fattach to %s failed", zone_door_path); 14947c478bd9Sstevel@tonic-gate (void) door_revoke(zone_door); 14957c478bd9Sstevel@tonic-gate (void) fdetach(zone_door_path); 14967c478bd9Sstevel@tonic-gate zone_door = -1; 14977c478bd9Sstevel@tonic-gate return (-1); 14987c478bd9Sstevel@tonic-gate } 14997c478bd9Sstevel@tonic-gate return (0); 15007c478bd9Sstevel@tonic-gate } 15017c478bd9Sstevel@tonic-gate 15027c478bd9Sstevel@tonic-gate /* 15037c478bd9Sstevel@tonic-gate * zoneadm(1m) will start zoneadmd if it thinks it isn't running; this 15047c478bd9Sstevel@tonic-gate * is where zoneadmd itself will check to see that another instance of 15057c478bd9Sstevel@tonic-gate * zoneadmd isn't already controlling this zone. 15067c478bd9Sstevel@tonic-gate * 15077c478bd9Sstevel@tonic-gate * The idea here is that we want to open the path to which we will 15087c478bd9Sstevel@tonic-gate * attach our door, lock it, and then make sure that no-one has beat us 15097c478bd9Sstevel@tonic-gate * to fattach(3c)ing onto it. 15107c478bd9Sstevel@tonic-gate * 15117c478bd9Sstevel@tonic-gate * fattach(3c) is really a mount, so there are actually two possible 15127c478bd9Sstevel@tonic-gate * vnodes we could be dealing with. Our strategy is as follows: 15137c478bd9Sstevel@tonic-gate * 15147c478bd9Sstevel@tonic-gate * - If the file we opened is a regular file (common case): 15157c478bd9Sstevel@tonic-gate * There is no fattach(3c)ed door, so we have a chance of becoming 15167c478bd9Sstevel@tonic-gate * the managing zoneadmd. We attempt to lock the file: if it is 15177c478bd9Sstevel@tonic-gate * already locked, that means someone else raced us here, so we 15187c478bd9Sstevel@tonic-gate * lose and give up. zoneadm(1m) will try to contact the zoneadmd 15197c478bd9Sstevel@tonic-gate * that beat us to it. 15207c478bd9Sstevel@tonic-gate * 15217c478bd9Sstevel@tonic-gate * - If the file we opened is a namefs file: 15227c478bd9Sstevel@tonic-gate * This means there is already an established door fattach(3c)'ed 15237c478bd9Sstevel@tonic-gate * to the rendezvous path. We've lost the race, so we give up. 15247c478bd9Sstevel@tonic-gate * Note that in this case we also try to grab the file lock, and 15257c478bd9Sstevel@tonic-gate * will succeed in acquiring it since the vnode locked by the 15267c478bd9Sstevel@tonic-gate * "winning" zoneadmd was a regular one, and the one we locked was 15277c478bd9Sstevel@tonic-gate * the fattach(3c)'ed door node. At any rate, no harm is done, and 15287c478bd9Sstevel@tonic-gate * we just return to zoneadm(1m) which knows to retry. 15297c478bd9Sstevel@tonic-gate */ 15307c478bd9Sstevel@tonic-gate static int 15317c478bd9Sstevel@tonic-gate make_daemon_exclusive(zlog_t *zlogp) 15327c478bd9Sstevel@tonic-gate { 15337c478bd9Sstevel@tonic-gate int doorfd = -1; 15347c478bd9Sstevel@tonic-gate int err, ret = -1; 15357c478bd9Sstevel@tonic-gate struct stat st; 15367c478bd9Sstevel@tonic-gate struct flock flock; 15377c478bd9Sstevel@tonic-gate zone_state_t zstate; 15387c478bd9Sstevel@tonic-gate 15397c478bd9Sstevel@tonic-gate top: 15407c478bd9Sstevel@tonic-gate if ((err = zone_get_state(zone_name, &zstate)) != Z_OK) { 15413f2f09c1Sdp zerror(zlogp, B_FALSE, "failed to get zone state: %s", 15427c478bd9Sstevel@tonic-gate zonecfg_strerror(err)); 15437c478bd9Sstevel@tonic-gate goto out; 15447c478bd9Sstevel@tonic-gate } 15457c478bd9Sstevel@tonic-gate if ((doorfd = open(zone_door_path, O_CREAT|O_RDWR, 15467c478bd9Sstevel@tonic-gate S_IREAD|S_IWRITE)) < 0) { 15477c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "failed to open %s", zone_door_path); 15487c478bd9Sstevel@tonic-gate goto out; 15497c478bd9Sstevel@tonic-gate } 15507c478bd9Sstevel@tonic-gate if (fstat(doorfd, &st) < 0) { 15517c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "failed to stat %s", zone_door_path); 15527c478bd9Sstevel@tonic-gate goto out; 15537c478bd9Sstevel@tonic-gate } 15547c478bd9Sstevel@tonic-gate /* 15557c478bd9Sstevel@tonic-gate * Lock the file to synchronize with other zoneadmd 15567c478bd9Sstevel@tonic-gate */ 15577c478bd9Sstevel@tonic-gate flock.l_type = F_WRLCK; 15587c478bd9Sstevel@tonic-gate flock.l_whence = SEEK_SET; 15597c478bd9Sstevel@tonic-gate flock.l_start = (off_t)0; 15607c478bd9Sstevel@tonic-gate flock.l_len = (off_t)0; 15617c478bd9Sstevel@tonic-gate if (fcntl(doorfd, F_SETLK, &flock) < 0) { 15627c478bd9Sstevel@tonic-gate /* 15637c478bd9Sstevel@tonic-gate * Someone else raced us here and grabbed the lock file 15647c478bd9Sstevel@tonic-gate * first. A warning here is inappropriate since nothing 15657c478bd9Sstevel@tonic-gate * went wrong. 15667c478bd9Sstevel@tonic-gate */ 15677c478bd9Sstevel@tonic-gate goto out; 15687c478bd9Sstevel@tonic-gate } 15697c478bd9Sstevel@tonic-gate 15707c478bd9Sstevel@tonic-gate if (strcmp(st.st_fstype, "namefs") == 0) { 15717c478bd9Sstevel@tonic-gate struct door_info info; 15727c478bd9Sstevel@tonic-gate 15737c478bd9Sstevel@tonic-gate /* 15747c478bd9Sstevel@tonic-gate * There is already something fattach()'ed to this file. 15757c478bd9Sstevel@tonic-gate * Lets see what the door is up to. 15767c478bd9Sstevel@tonic-gate */ 15777c478bd9Sstevel@tonic-gate if (door_info(doorfd, &info) == 0 && info.di_target != -1) { 15787c478bd9Sstevel@tonic-gate /* 15797c478bd9Sstevel@tonic-gate * Another zoneadmd process seems to be in 15807c478bd9Sstevel@tonic-gate * control of the situation and we don't need to 15817c478bd9Sstevel@tonic-gate * be here. A warning here is inappropriate 15827c478bd9Sstevel@tonic-gate * since nothing went wrong. 15837c478bd9Sstevel@tonic-gate * 15847c478bd9Sstevel@tonic-gate * If the door has been revoked, the zoneadmd 15857c478bd9Sstevel@tonic-gate * process currently managing the zone is going 15867c478bd9Sstevel@tonic-gate * away. We'll return control to zoneadm(1m) 15877c478bd9Sstevel@tonic-gate * which will try again (by which time zoneadmd 15887c478bd9Sstevel@tonic-gate * will hopefully have exited). 15897c478bd9Sstevel@tonic-gate */ 15907c478bd9Sstevel@tonic-gate goto out; 15917c478bd9Sstevel@tonic-gate } 15927c478bd9Sstevel@tonic-gate 15937c478bd9Sstevel@tonic-gate /* 15947c478bd9Sstevel@tonic-gate * If we got this far, there's a fattach(3c)'ed door 15957c478bd9Sstevel@tonic-gate * that belongs to a process that has exited, which can 15967c478bd9Sstevel@tonic-gate * happen if the previous zoneadmd died unexpectedly. 15977c478bd9Sstevel@tonic-gate * 15987c478bd9Sstevel@tonic-gate * Let user know that something is amiss, but that we can 15997c478bd9Sstevel@tonic-gate * recover; if the zone is in the installed state, then don't 16007c478bd9Sstevel@tonic-gate * message, since having a running zoneadmd isn't really 16017c478bd9Sstevel@tonic-gate * expected/needed. We want to keep occurences of this message 16027c478bd9Sstevel@tonic-gate * limited to times when zoneadmd is picking back up from a 16037c478bd9Sstevel@tonic-gate * zoneadmd that died while the zone was in some non-trivial 16047c478bd9Sstevel@tonic-gate * state. 16057c478bd9Sstevel@tonic-gate */ 16067c478bd9Sstevel@tonic-gate if (zstate > ZONE_STATE_INSTALLED) { 16077c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, 16087c478bd9Sstevel@tonic-gate "zone '%s': WARNING: zone is in state '%s', but " 16097c478bd9Sstevel@tonic-gate "zoneadmd does not appear to be available; " 16107c478bd9Sstevel@tonic-gate "restarted zoneadmd to recover.", 16117c478bd9Sstevel@tonic-gate zone_name, zone_state_str(zstate)); 16127c478bd9Sstevel@tonic-gate } 16137c478bd9Sstevel@tonic-gate 16147c478bd9Sstevel@tonic-gate (void) fdetach(zone_door_path); 16157c478bd9Sstevel@tonic-gate (void) close(doorfd); 16167c478bd9Sstevel@tonic-gate goto top; 16177c478bd9Sstevel@tonic-gate } 16187c478bd9Sstevel@tonic-gate ret = 0; 16197c478bd9Sstevel@tonic-gate out: 16207c478bd9Sstevel@tonic-gate (void) close(doorfd); 16217c478bd9Sstevel@tonic-gate return (ret); 16227c478bd9Sstevel@tonic-gate } 16237c478bd9Sstevel@tonic-gate 1624c5cd6260S /* 1625c5cd6260S * Setup the brand's pre and post state change callbacks, as well as the 1626c5cd6260S * query callback, if any of these exist. 1627c5cd6260S */ 1628c5cd6260S static int 1629c5cd6260S brand_callback_init(brand_handle_t bh, char *zone_name) 1630c5cd6260S { 1631c5cd6260S char zpath[MAXPATHLEN]; 1632c5cd6260S 1633c5cd6260S if (zone_get_zonepath(zone_name, zpath, sizeof (zpath)) != Z_OK) 1634c5cd6260S return (-1); 1635c5cd6260S 1636c5cd6260S (void) strlcpy(pre_statechg_hook, EXEC_PREFIX, 1637c5cd6260S sizeof (pre_statechg_hook)); 1638c5cd6260S 1639c5cd6260S if (brand_get_prestatechange(bh, zone_name, zpath, 1640c5cd6260S pre_statechg_hook + EXEC_LEN, 1641c5cd6260S sizeof (pre_statechg_hook) - EXEC_LEN) != 0) 1642c5cd6260S return (-1); 1643c5cd6260S 1644c5cd6260S if (strlen(pre_statechg_hook) <= EXEC_LEN) 1645c5cd6260S pre_statechg_hook[0] = '\0'; 1646c5cd6260S 1647c5cd6260S (void) strlcpy(post_statechg_hook, EXEC_PREFIX, 1648c5cd6260S sizeof (post_statechg_hook)); 1649c5cd6260S 1650c5cd6260S if (brand_get_poststatechange(bh, zone_name, zpath, 1651c5cd6260S post_statechg_hook + EXEC_LEN, 1652c5cd6260S sizeof (post_statechg_hook) - EXEC_LEN) != 0) 1653c5cd6260S return (-1); 1654c5cd6260S 1655c5cd6260S if (strlen(post_statechg_hook) <= EXEC_LEN) 1656c5cd6260S post_statechg_hook[0] = '\0'; 1657c5cd6260S 1658c5cd6260S (void) strlcpy(query_hook, EXEC_PREFIX, 1659c5cd6260S sizeof (query_hook)); 1660c5cd6260S 1661c5cd6260S if (brand_get_query(bh, zone_name, zpath, query_hook + EXEC_LEN, 1662c5cd6260S sizeof (query_hook) - EXEC_LEN) != 0) 1663c5cd6260S return (-1); 1664c5cd6260S 1665c5cd6260S if (strlen(query_hook) <= EXEC_LEN) 1666c5cd6260S query_hook[0] = '\0'; 1667c5cd6260S 1668c5cd6260S return (0); 1669c5cd6260S } 1670c5cd6260S 16717c478bd9Sstevel@tonic-gate int 16727c478bd9Sstevel@tonic-gate main(int argc, char *argv[]) 16737c478bd9Sstevel@tonic-gate { 16747c478bd9Sstevel@tonic-gate int opt; 16757c478bd9Sstevel@tonic-gate zoneid_t zid; 16767c478bd9Sstevel@tonic-gate priv_set_t *privset; 16777c478bd9Sstevel@tonic-gate zone_state_t zstate; 16787c478bd9Sstevel@tonic-gate char parents_locale[MAXPATHLEN]; 1679123807fbSedp brand_handle_t bh; 16807c478bd9Sstevel@tonic-gate int err; 16817c478bd9Sstevel@tonic-gate 16827c478bd9Sstevel@tonic-gate pid_t pid; 16837c478bd9Sstevel@tonic-gate sigset_t blockset; 16847c478bd9Sstevel@tonic-gate sigset_t block_cld; 16857c478bd9Sstevel@tonic-gate 16867c478bd9Sstevel@tonic-gate struct { 16877c478bd9Sstevel@tonic-gate sema_t sem; 16887c478bd9Sstevel@tonic-gate int status; 16897c478bd9Sstevel@tonic-gate zlog_t log; 16907c478bd9Sstevel@tonic-gate } *shstate; 16917c478bd9Sstevel@tonic-gate size_t shstatelen = getpagesize(); 16927c478bd9Sstevel@tonic-gate 16937c478bd9Sstevel@tonic-gate zlog_t errlog; 16947c478bd9Sstevel@tonic-gate zlog_t *zlogp; 16957c478bd9Sstevel@tonic-gate 16965cb4571dSdp int ctfd; 16975cb4571dSdp 16987c478bd9Sstevel@tonic-gate progname = get_execbasename(argv[0]); 16997c478bd9Sstevel@tonic-gate 17007c478bd9Sstevel@tonic-gate /* 17017c478bd9Sstevel@tonic-gate * Make sure stderr is unbuffered 17027c478bd9Sstevel@tonic-gate */ 17037c478bd9Sstevel@tonic-gate (void) setbuffer(stderr, NULL, 0); 17047c478bd9Sstevel@tonic-gate 17057c478bd9Sstevel@tonic-gate /* 17067c478bd9Sstevel@tonic-gate * Get out of the way of mounted filesystems, since we will daemonize 17077c478bd9Sstevel@tonic-gate * soon. 17087c478bd9Sstevel@tonic-gate */ 17097c478bd9Sstevel@tonic-gate (void) chdir("/"); 17107c478bd9Sstevel@tonic-gate 17117c478bd9Sstevel@tonic-gate /* 17127c478bd9Sstevel@tonic-gate * Use the default system umask per PSARC 1998/110 rather than 17137c478bd9Sstevel@tonic-gate * anything that may have been set by the caller. 17147c478bd9Sstevel@tonic-gate */ 17157c478bd9Sstevel@tonic-gate (void) umask(CMASK); 17167c478bd9Sstevel@tonic-gate 17177c478bd9Sstevel@tonic-gate /* 17187c478bd9Sstevel@tonic-gate * Initially we want to use our parent's locale. 17197c478bd9Sstevel@tonic-gate */ 17207c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 17217c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 17227c478bd9Sstevel@tonic-gate (void) strlcpy(parents_locale, setlocale(LC_MESSAGES, NULL), 17237c478bd9Sstevel@tonic-gate sizeof (parents_locale)); 17247c478bd9Sstevel@tonic-gate 17257c478bd9Sstevel@tonic-gate /* 17267c478bd9Sstevel@tonic-gate * This zlog_t is used for writing to stderr 17277c478bd9Sstevel@tonic-gate */ 17287c478bd9Sstevel@tonic-gate errlog.logfile = stderr; 17297c478bd9Sstevel@tonic-gate errlog.buflen = errlog.loglen = 0; 17307c478bd9Sstevel@tonic-gate errlog.buf = errlog.log = NULL; 17317c478bd9Sstevel@tonic-gate errlog.locale = parents_locale; 17327c478bd9Sstevel@tonic-gate 17337c478bd9Sstevel@tonic-gate /* 17347c478bd9Sstevel@tonic-gate * We start off writing to stderr until we're ready to daemonize. 17357c478bd9Sstevel@tonic-gate */ 17367c478bd9Sstevel@tonic-gate zlogp = &errlog; 17377c478bd9Sstevel@tonic-gate 17387c478bd9Sstevel@tonic-gate /* 17397c478bd9Sstevel@tonic-gate * Process options. 17407c478bd9Sstevel@tonic-gate */ 1741108322fbScarlsonj while ((opt = getopt(argc, argv, "R:z:")) != EOF) { 17427c478bd9Sstevel@tonic-gate switch (opt) { 1743108322fbScarlsonj case 'R': 1744108322fbScarlsonj zonecfg_set_root(optarg); 1745108322fbScarlsonj break; 17467c478bd9Sstevel@tonic-gate case 'z': 17477c478bd9Sstevel@tonic-gate zone_name = optarg; 17487c478bd9Sstevel@tonic-gate break; 17497c478bd9Sstevel@tonic-gate default: 17507c478bd9Sstevel@tonic-gate usage(); 17517c478bd9Sstevel@tonic-gate } 17527c478bd9Sstevel@tonic-gate } 17537c478bd9Sstevel@tonic-gate 17547c478bd9Sstevel@tonic-gate if (zone_name == NULL) 17557c478bd9Sstevel@tonic-gate usage(); 17567c478bd9Sstevel@tonic-gate 17577c478bd9Sstevel@tonic-gate /* 17587c478bd9Sstevel@tonic-gate * Because usage() prints directly to stderr, it has gettext() 17597c478bd9Sstevel@tonic-gate * wrapping, which depends on the locale. But since zerror() calls 17607c478bd9Sstevel@tonic-gate * localize() which tweaks the locale, it is not safe to call zerror() 17617c478bd9Sstevel@tonic-gate * until after the last call to usage(). Fortunately, the last call 17627c478bd9Sstevel@tonic-gate * to usage() is just above and the first call to zerror() is just 17637c478bd9Sstevel@tonic-gate * below. Don't mess this up. 17647c478bd9Sstevel@tonic-gate */ 17657c478bd9Sstevel@tonic-gate if (strcmp(zone_name, GLOBAL_ZONENAME) == 0) { 17667c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "cannot manage the %s zone", 17677c478bd9Sstevel@tonic-gate GLOBAL_ZONENAME); 17687c478bd9Sstevel@tonic-gate return (1); 17697c478bd9Sstevel@tonic-gate } 17707c478bd9Sstevel@tonic-gate 17717c478bd9Sstevel@tonic-gate if (zone_get_id(zone_name, &zid) != 0) { 17723f2f09c1Sdp zerror(zlogp, B_FALSE, "could not manage %s: %s", zone_name, 17737c478bd9Sstevel@tonic-gate zonecfg_strerror(Z_NO_ZONE)); 17747c478bd9Sstevel@tonic-gate return (1); 17757c478bd9Sstevel@tonic-gate } 17767c478bd9Sstevel@tonic-gate 17777c478bd9Sstevel@tonic-gate if ((err = zone_get_state(zone_name, &zstate)) != Z_OK) { 17783f2f09c1Sdp zerror(zlogp, B_FALSE, "failed to get zone state: %s", 17797c478bd9Sstevel@tonic-gate zonecfg_strerror(err)); 17807c478bd9Sstevel@tonic-gate return (1); 17817c478bd9Sstevel@tonic-gate } 17829acbbeafSnn35248 if (zstate < ZONE_STATE_INCOMPLETE) { 17837c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, 17847c478bd9Sstevel@tonic-gate "cannot manage a zone which is in state '%s'", 17857c478bd9Sstevel@tonic-gate zone_state_str(zstate)); 17867c478bd9Sstevel@tonic-gate return (1); 17877c478bd9Sstevel@tonic-gate } 17887c478bd9Sstevel@tonic-gate 1789e5816e35SEdward Pilatowicz if (zonecfg_default_brand(default_brand, 1790e5816e35SEdward Pilatowicz sizeof (default_brand)) != Z_OK) { 1791e5816e35SEdward Pilatowicz zerror(zlogp, B_FALSE, "unable to determine default brand"); 1792e5816e35SEdward Pilatowicz return (1); 1793e5816e35SEdward Pilatowicz } 1794e5816e35SEdward Pilatowicz 17959acbbeafSnn35248 /* Get a handle to the brand info for this zone */ 179662868012SSteve Lawrence if (zone_get_brand(zone_name, brand_name, sizeof (brand_name)) 179762868012SSteve Lawrence != Z_OK) { 17989acbbeafSnn35248 zerror(zlogp, B_FALSE, "unable to determine zone brand"); 17999acbbeafSnn35248 return (1); 18009acbbeafSnn35248 } 180162868012SSteve Lawrence zone_isnative = (strcmp(brand_name, NATIVE_BRAND_NAME) == 0); 18029a5d73e0SRic Aleshire zone_islabeled = (strcmp(brand_name, LABELED_BRAND_NAME) == 0); 1803c5cd6260S 180462868012SSteve Lawrence /* 180562868012SSteve Lawrence * In the alternate root environment, the only supported 180662868012SSteve Lawrence * operations are mount and unmount. In this case, just treat 180762868012SSteve Lawrence * the zone as native if it is cluster. Cluster zones can be 180862868012SSteve Lawrence * native for the purpose of LU or upgrade, and the cluster 180962868012SSteve Lawrence * brand may not exist in the miniroot (such as in net install 181062868012SSteve Lawrence * upgrade). 181162868012SSteve Lawrence */ 181262868012SSteve Lawrence if (strcmp(brand_name, CLUSTER_BRAND_NAME) == 0) { 181362868012SSteve Lawrence zone_iscluster = B_TRUE; 181462868012SSteve Lawrence if (zonecfg_in_alt_root()) { 1815e5816e35SEdward Pilatowicz (void) strlcpy(brand_name, default_brand, 181662868012SSteve Lawrence sizeof (brand_name)); 181762868012SSteve Lawrence } 181862868012SSteve Lawrence } else { 181962868012SSteve Lawrence zone_iscluster = B_FALSE; 182062868012SSteve Lawrence } 182162868012SSteve Lawrence 182262868012SSteve Lawrence if ((bh = brand_open(brand_name)) == NULL) { 182362868012SSteve Lawrence zerror(zlogp, B_FALSE, "unable to open zone brand"); 182462868012SSteve Lawrence return (1); 182562868012SSteve Lawrence } 182662868012SSteve Lawrence 1827c5cd6260S /* Get state change brand hooks. */ 1828c5cd6260S if (brand_callback_init(bh, zone_name) == -1) { 1829c5cd6260S zerror(zlogp, B_TRUE, 1830c5cd6260S "failed to initialize brand state change hooks"); 1831c5cd6260S brand_close(bh); 1832c5cd6260S return (1); 1833c5cd6260S } 1834c5cd6260S 1835123807fbSedp brand_close(bh); 18369acbbeafSnn35248 18377c478bd9Sstevel@tonic-gate /* 18387c478bd9Sstevel@tonic-gate * Check that we have all privileges. It would be nice to pare 18397c478bd9Sstevel@tonic-gate * this down, but this is at least a first cut. 18407c478bd9Sstevel@tonic-gate */ 18417c478bd9Sstevel@tonic-gate if ((privset = priv_allocset()) == NULL) { 18427c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "%s failed", "priv_allocset"); 18437c478bd9Sstevel@tonic-gate return (1); 18447c478bd9Sstevel@tonic-gate } 18457c478bd9Sstevel@tonic-gate 18467c478bd9Sstevel@tonic-gate if (getppriv(PRIV_EFFECTIVE, privset) != 0) { 18477c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "%s failed", "getppriv"); 18487c478bd9Sstevel@tonic-gate priv_freeset(privset); 18497c478bd9Sstevel@tonic-gate return (1); 18507c478bd9Sstevel@tonic-gate } 18517c478bd9Sstevel@tonic-gate 18527c478bd9Sstevel@tonic-gate if (priv_isfullset(privset) == B_FALSE) { 18537c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "You lack sufficient privilege to " 18543f2f09c1Sdp "run this command (all privs required)"); 18557c478bd9Sstevel@tonic-gate priv_freeset(privset); 18567c478bd9Sstevel@tonic-gate return (1); 18577c478bd9Sstevel@tonic-gate } 18587c478bd9Sstevel@tonic-gate priv_freeset(privset); 18597c478bd9Sstevel@tonic-gate 18607c478bd9Sstevel@tonic-gate if (mkzonedir(zlogp) != 0) 18617c478bd9Sstevel@tonic-gate return (1); 18627c478bd9Sstevel@tonic-gate 18637c478bd9Sstevel@tonic-gate /* 18647c478bd9Sstevel@tonic-gate * Pre-fork: setup shared state 18657c478bd9Sstevel@tonic-gate */ 18667c478bd9Sstevel@tonic-gate if ((shstate = (void *)mmap(NULL, shstatelen, 18677c478bd9Sstevel@tonic-gate PROT_READ|PROT_WRITE, MAP_SHARED|MAP_ANON, -1, (off_t)0)) == 18687c478bd9Sstevel@tonic-gate MAP_FAILED) { 18697c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "%s failed", "mmap"); 18707c478bd9Sstevel@tonic-gate return (1); 18717c478bd9Sstevel@tonic-gate } 18727c478bd9Sstevel@tonic-gate if (sema_init(&shstate->sem, 0, USYNC_PROCESS, NULL) != 0) { 18737c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "%s failed", "sema_init()"); 18747c478bd9Sstevel@tonic-gate (void) munmap((char *)shstate, shstatelen); 18757c478bd9Sstevel@tonic-gate return (1); 18767c478bd9Sstevel@tonic-gate } 18777c478bd9Sstevel@tonic-gate shstate->log.logfile = NULL; 18787c478bd9Sstevel@tonic-gate shstate->log.buflen = shstatelen - sizeof (*shstate); 18797c478bd9Sstevel@tonic-gate shstate->log.loglen = shstate->log.buflen; 18807c478bd9Sstevel@tonic-gate shstate->log.buf = (char *)shstate + sizeof (*shstate); 18817c478bd9Sstevel@tonic-gate shstate->log.log = shstate->log.buf; 18827c478bd9Sstevel@tonic-gate shstate->log.locale = parents_locale; 18837c478bd9Sstevel@tonic-gate shstate->status = -1; 18847c478bd9Sstevel@tonic-gate 18857c478bd9Sstevel@tonic-gate /* 18867c478bd9Sstevel@tonic-gate * We need a SIGCHLD handler so the sema_wait() below will wake 18877c478bd9Sstevel@tonic-gate * up if the child dies without doing a sema_post(). 18887c478bd9Sstevel@tonic-gate */ 18897c478bd9Sstevel@tonic-gate (void) sigset(SIGCHLD, sigchld); 18907c478bd9Sstevel@tonic-gate /* 18917c478bd9Sstevel@tonic-gate * We must mask SIGCHLD until after we've coped with the fork 18927c478bd9Sstevel@tonic-gate * sufficiently to deal with it; otherwise we can race and 18937c478bd9Sstevel@tonic-gate * receive the signal before pid has been initialized 18947c478bd9Sstevel@tonic-gate * (yes, this really happens). 18957c478bd9Sstevel@tonic-gate */ 18967c478bd9Sstevel@tonic-gate (void) sigemptyset(&block_cld); 18977c478bd9Sstevel@tonic-gate (void) sigaddset(&block_cld, SIGCHLD); 18987c478bd9Sstevel@tonic-gate (void) sigprocmask(SIG_BLOCK, &block_cld, NULL); 18997c478bd9Sstevel@tonic-gate 19005cb4571dSdp if ((ctfd = init_template()) == -1) { 19015cb4571dSdp zerror(zlogp, B_TRUE, "failed to create contract"); 19025cb4571dSdp return (1); 19035cb4571dSdp } 19045cb4571dSdp 19057c478bd9Sstevel@tonic-gate /* 19067c478bd9Sstevel@tonic-gate * Do not let another thread localize a message while we are forking. 19077c478bd9Sstevel@tonic-gate */ 19087c478bd9Sstevel@tonic-gate (void) mutex_lock(&msglock); 19097c478bd9Sstevel@tonic-gate pid = fork(); 19107c478bd9Sstevel@tonic-gate (void) mutex_unlock(&msglock); 19115cb4571dSdp 19125cb4571dSdp /* 19135cb4571dSdp * In all cases (parent, child, and in the event of an error) we 19145cb4571dSdp * don't want to cause creation of contracts on subsequent fork()s. 19155cb4571dSdp */ 19165cb4571dSdp (void) ct_tmpl_clear(ctfd); 19175cb4571dSdp (void) close(ctfd); 19185cb4571dSdp 19197c478bd9Sstevel@tonic-gate if (pid == -1) { 19207c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "could not fork"); 19217c478bd9Sstevel@tonic-gate return (1); 19227c478bd9Sstevel@tonic-gate 19237c478bd9Sstevel@tonic-gate } else if (pid > 0) { /* parent */ 19247c478bd9Sstevel@tonic-gate (void) sigprocmask(SIG_UNBLOCK, &block_cld, NULL); 19257c478bd9Sstevel@tonic-gate /* 19267c478bd9Sstevel@tonic-gate * This marks a window of vulnerability in which we receive 19277c478bd9Sstevel@tonic-gate * the SIGCLD before falling into sema_wait (normally we would 19287c478bd9Sstevel@tonic-gate * get woken up from sema_wait with EINTR upon receipt of 19297c478bd9Sstevel@tonic-gate * SIGCLD). So we may need to use some other scheme like 19307c478bd9Sstevel@tonic-gate * sema_posting in the sigcld handler. 19317c478bd9Sstevel@tonic-gate * blech 19327c478bd9Sstevel@tonic-gate */ 19337c478bd9Sstevel@tonic-gate (void) sema_wait(&shstate->sem); 19347c478bd9Sstevel@tonic-gate (void) sema_destroy(&shstate->sem); 19357c478bd9Sstevel@tonic-gate if (shstate->status != 0) 19367c478bd9Sstevel@tonic-gate (void) waitpid(pid, NULL, WNOHANG); 19377c478bd9Sstevel@tonic-gate /* 19387c478bd9Sstevel@tonic-gate * It's ok if we die with SIGPIPE. It's not like we could have 19397c478bd9Sstevel@tonic-gate * done anything about it. 19407c478bd9Sstevel@tonic-gate */ 19417c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "%s", shstate->log.buf); 19427c478bd9Sstevel@tonic-gate _exit(shstate->status == 0 ? 0 : 1); 19437c478bd9Sstevel@tonic-gate } 19447c478bd9Sstevel@tonic-gate 19457c478bd9Sstevel@tonic-gate /* 19467c478bd9Sstevel@tonic-gate * The child charges on. 19477c478bd9Sstevel@tonic-gate */ 19487c478bd9Sstevel@tonic-gate (void) sigset(SIGCHLD, SIG_DFL); 19497c478bd9Sstevel@tonic-gate (void) sigprocmask(SIG_UNBLOCK, &block_cld, NULL); 19507c478bd9Sstevel@tonic-gate 19517c478bd9Sstevel@tonic-gate /* 19527c478bd9Sstevel@tonic-gate * SIGPIPE can be delivered if we write to a socket for which the 19537c478bd9Sstevel@tonic-gate * peer endpoint is gone. That can lead to too-early termination 19547c478bd9Sstevel@tonic-gate * of zoneadmd, and that's not good eats. 19557c478bd9Sstevel@tonic-gate */ 19567c478bd9Sstevel@tonic-gate (void) sigset(SIGPIPE, SIG_IGN); 19577c478bd9Sstevel@tonic-gate /* 19587c478bd9Sstevel@tonic-gate * Stop using stderr 19597c478bd9Sstevel@tonic-gate */ 19607c478bd9Sstevel@tonic-gate zlogp = &shstate->log; 19617c478bd9Sstevel@tonic-gate 19627c478bd9Sstevel@tonic-gate /* 19637c478bd9Sstevel@tonic-gate * We don't need stdout/stderr from now on. 19647c478bd9Sstevel@tonic-gate */ 19657c478bd9Sstevel@tonic-gate closefrom(0); 19667c478bd9Sstevel@tonic-gate 19677c478bd9Sstevel@tonic-gate /* 19687c478bd9Sstevel@tonic-gate * Initialize the syslog zlog_t. This needs to be done after 19697c478bd9Sstevel@tonic-gate * the call to closefrom(). 19707c478bd9Sstevel@tonic-gate */ 19717c478bd9Sstevel@tonic-gate logsys.buf = logsys.log = NULL; 19727c478bd9Sstevel@tonic-gate logsys.buflen = logsys.loglen = 0; 19737c478bd9Sstevel@tonic-gate logsys.logfile = NULL; 19747c478bd9Sstevel@tonic-gate logsys.locale = DEFAULT_LOCALE; 19757c478bd9Sstevel@tonic-gate 19767c478bd9Sstevel@tonic-gate openlog("zoneadmd", LOG_PID, LOG_DAEMON); 19777c478bd9Sstevel@tonic-gate 19787c478bd9Sstevel@tonic-gate /* 19797c478bd9Sstevel@tonic-gate * The eventstream is used to publish state changes in the zone 19807c478bd9Sstevel@tonic-gate * from the door threads to the console I/O poller. 19817c478bd9Sstevel@tonic-gate */ 19827c478bd9Sstevel@tonic-gate if (eventstream_init() == -1) { 19837c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "unable to create eventstream"); 19847c478bd9Sstevel@tonic-gate goto child_out; 19857c478bd9Sstevel@tonic-gate } 19867c478bd9Sstevel@tonic-gate 19877c478bd9Sstevel@tonic-gate (void) snprintf(zone_door_path, sizeof (zone_door_path), 1988108322fbScarlsonj "%s" ZONE_DOOR_PATH, zonecfg_get_root(), zone_name); 19897c478bd9Sstevel@tonic-gate 19907c478bd9Sstevel@tonic-gate /* 19917c478bd9Sstevel@tonic-gate * See if another zoneadmd is running for this zone. If not, then we 19927c478bd9Sstevel@tonic-gate * can now modify system state. 19937c478bd9Sstevel@tonic-gate */ 19947c478bd9Sstevel@tonic-gate if (make_daemon_exclusive(zlogp) == -1) 19957c478bd9Sstevel@tonic-gate goto child_out; 19967c478bd9Sstevel@tonic-gate 19977c478bd9Sstevel@tonic-gate 19987c478bd9Sstevel@tonic-gate /* 19997c478bd9Sstevel@tonic-gate * Create/join a new session; we need to be careful of what we do with 20007c478bd9Sstevel@tonic-gate * the console from now on so we don't end up being the session leader 20017c478bd9Sstevel@tonic-gate * for the terminal we're going to be handing out. 20027c478bd9Sstevel@tonic-gate */ 20037c478bd9Sstevel@tonic-gate (void) setsid(); 20047c478bd9Sstevel@tonic-gate 20057c478bd9Sstevel@tonic-gate /* 20067c478bd9Sstevel@tonic-gate * This thread shouldn't be receiving any signals; in particular, 20077c478bd9Sstevel@tonic-gate * SIGCHLD should be received by the thread doing the fork(). 20087c478bd9Sstevel@tonic-gate */ 20097c478bd9Sstevel@tonic-gate (void) sigfillset(&blockset); 20107c478bd9Sstevel@tonic-gate (void) thr_sigsetmask(SIG_BLOCK, &blockset, NULL); 20117c478bd9Sstevel@tonic-gate 20127c478bd9Sstevel@tonic-gate /* 20137c478bd9Sstevel@tonic-gate * Setup the console device and get ready to serve the console; 20147c478bd9Sstevel@tonic-gate * once this has completed, we're ready to let console clients 20157c478bd9Sstevel@tonic-gate * make an attempt to connect (they will block until 20167c478bd9Sstevel@tonic-gate * serve_console_sock() below gets called, and any pending 20177c478bd9Sstevel@tonic-gate * connection is accept()ed). 20187c478bd9Sstevel@tonic-gate */ 20199d5056eaSjv227347 if (!zonecfg_in_alt_root() && init_console(zlogp) < 0) 20207c478bd9Sstevel@tonic-gate goto child_out; 20217c478bd9Sstevel@tonic-gate 20227c478bd9Sstevel@tonic-gate /* 20237c478bd9Sstevel@tonic-gate * Take the lock now, so that when the door server gets going, we 20247c478bd9Sstevel@tonic-gate * are guaranteed that it won't take a request until we are sure 20257c478bd9Sstevel@tonic-gate * that everything is completely set up. See the child_out: label 20267c478bd9Sstevel@tonic-gate * below to see why this matters. 20277c478bd9Sstevel@tonic-gate */ 20287c478bd9Sstevel@tonic-gate (void) mutex_lock(&lock); 20297c478bd9Sstevel@tonic-gate 2030108322fbScarlsonj /* Init semaphore for scratch zones. */ 2031108322fbScarlsonj if (sema_init(&scratch_sem, 0, USYNC_THREAD, NULL) == -1) { 2032108322fbScarlsonj zerror(zlogp, B_TRUE, 2033108322fbScarlsonj "failed to initialize semaphore for scratch zone"); 2034108322fbScarlsonj goto child_out; 2035108322fbScarlsonj } 2036108322fbScarlsonj 20374ac67f02SAnurag S. Maskey /* open the dladm handle */ 20384ac67f02SAnurag S. Maskey if (dladm_open(&dld_handle) != DLADM_STATUS_OK) { 20394ac67f02SAnurag S. Maskey zerror(zlogp, B_FALSE, "failed to open dladm handle"); 20404ac67f02SAnurag S. Maskey goto child_out; 20414ac67f02SAnurag S. Maskey } 20424ac67f02SAnurag S. Maskey 20437c478bd9Sstevel@tonic-gate /* 20447c478bd9Sstevel@tonic-gate * Note: door setup must occur *after* the console is setup. 20457c478bd9Sstevel@tonic-gate * This is so that as zlogin tests the door to see if zoneadmd 20467c478bd9Sstevel@tonic-gate * is ready yet, we know that the console will get serviced 20477c478bd9Sstevel@tonic-gate * once door_info() indicates that the door is "up". 20487c478bd9Sstevel@tonic-gate */ 20497c478bd9Sstevel@tonic-gate if (setup_door(zlogp) == -1) 20507c478bd9Sstevel@tonic-gate goto child_out; 20517c478bd9Sstevel@tonic-gate 20527c478bd9Sstevel@tonic-gate /* 20537c478bd9Sstevel@tonic-gate * Things seem OK so far; tell the parent process that we're done 20547c478bd9Sstevel@tonic-gate * with setup tasks. This will cause the parent to exit, signalling 20557c478bd9Sstevel@tonic-gate * to zoneadm, zlogin, or whatever forked it that we are ready to 20567c478bd9Sstevel@tonic-gate * service requests. 20577c478bd9Sstevel@tonic-gate */ 20587c478bd9Sstevel@tonic-gate shstate->status = 0; 20597c478bd9Sstevel@tonic-gate (void) sema_post(&shstate->sem); 20607c478bd9Sstevel@tonic-gate (void) munmap((char *)shstate, shstatelen); 20617c478bd9Sstevel@tonic-gate shstate = NULL; 20627c478bd9Sstevel@tonic-gate 20637c478bd9Sstevel@tonic-gate (void) mutex_unlock(&lock); 20647c478bd9Sstevel@tonic-gate 20657c478bd9Sstevel@tonic-gate /* 20667c478bd9Sstevel@tonic-gate * zlogp is now invalid, so reset it to the syslog logger. 20677c478bd9Sstevel@tonic-gate */ 20687c478bd9Sstevel@tonic-gate zlogp = &logsys; 20697c478bd9Sstevel@tonic-gate 20707c478bd9Sstevel@tonic-gate /* 20717c478bd9Sstevel@tonic-gate * Now that we are free of any parents, switch to the default locale. 20727c478bd9Sstevel@tonic-gate */ 20737c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, DEFAULT_LOCALE); 20747c478bd9Sstevel@tonic-gate 20757c478bd9Sstevel@tonic-gate /* 20767c478bd9Sstevel@tonic-gate * At this point the setup portion of main() is basically done, so 20777c478bd9Sstevel@tonic-gate * we reuse this thread to manage the zone console. When 20787c478bd9Sstevel@tonic-gate * serve_console() has returned, we are past the point of no return 20797c478bd9Sstevel@tonic-gate * in the life of this zoneadmd. 20807c478bd9Sstevel@tonic-gate */ 2081108322fbScarlsonj if (zonecfg_in_alt_root()) { 2082108322fbScarlsonj /* 2083108322fbScarlsonj * This is just awful, but mounted scratch zones don't (and 2084108322fbScarlsonj * can't) have consoles. We just wait for unmount instead. 2085108322fbScarlsonj */ 2086108322fbScarlsonj while (sema_wait(&scratch_sem) == EINTR) 2087108322fbScarlsonj ; 2088108322fbScarlsonj } else { 20897c478bd9Sstevel@tonic-gate serve_console(zlogp); 20907c478bd9Sstevel@tonic-gate assert(in_death_throes); 2091108322fbScarlsonj } 20927c478bd9Sstevel@tonic-gate 20937c478bd9Sstevel@tonic-gate /* 20947c478bd9Sstevel@tonic-gate * This is the next-to-last part of the exit interlock. Upon calling 20957c478bd9Sstevel@tonic-gate * fdetach(), the door will go unreferenced; once any 20967c478bd9Sstevel@tonic-gate * outstanding requests (like the door thread doing Z_HALT) are 20977c478bd9Sstevel@tonic-gate * done, the door will get an UNREF notification; when it handles 2098f594b34cSEdward Pilatowicz * the UNREF, the door server will cause the exit. It's possible 2099f594b34cSEdward Pilatowicz * that fdetach() can fail because the file is in use, in which 2100f594b34cSEdward Pilatowicz * case we'll retry the operation. 21017c478bd9Sstevel@tonic-gate */ 21027c478bd9Sstevel@tonic-gate assert(!MUTEX_HELD(&lock)); 2103f594b34cSEdward Pilatowicz for (;;) { 2104f594b34cSEdward Pilatowicz if ((fdetach(zone_door_path) == 0) || (errno != EBUSY)) 2105f594b34cSEdward Pilatowicz break; 2106f594b34cSEdward Pilatowicz yield(); 2107f594b34cSEdward Pilatowicz } 21084ac67f02SAnurag S. Maskey 21097c478bd9Sstevel@tonic-gate for (;;) 21107c478bd9Sstevel@tonic-gate (void) pause(); 21117c478bd9Sstevel@tonic-gate 21127c478bd9Sstevel@tonic-gate child_out: 21137c478bd9Sstevel@tonic-gate assert(pid == 0); 21147c478bd9Sstevel@tonic-gate if (shstate != NULL) { 21157c478bd9Sstevel@tonic-gate shstate->status = -1; 21167c478bd9Sstevel@tonic-gate (void) sema_post(&shstate->sem); 21177c478bd9Sstevel@tonic-gate (void) munmap((char *)shstate, shstatelen); 21187c478bd9Sstevel@tonic-gate } 21197c478bd9Sstevel@tonic-gate 21207c478bd9Sstevel@tonic-gate /* 21217c478bd9Sstevel@tonic-gate * This might trigger an unref notification, but if so, 21227c478bd9Sstevel@tonic-gate * we are still holding the lock, so our call to exit will 21237c478bd9Sstevel@tonic-gate * ultimately win the race and will publish the right exit 21247c478bd9Sstevel@tonic-gate * code. 21257c478bd9Sstevel@tonic-gate */ 21267c478bd9Sstevel@tonic-gate if (zone_door != -1) { 21277c478bd9Sstevel@tonic-gate assert(MUTEX_HELD(&lock)); 21287c478bd9Sstevel@tonic-gate (void) door_revoke(zone_door); 21297c478bd9Sstevel@tonic-gate (void) fdetach(zone_door_path); 21307c478bd9Sstevel@tonic-gate } 21314ac67f02SAnurag S. Maskey 21324ac67f02SAnurag S. Maskey if (dld_handle != NULL) 21334ac67f02SAnurag S. Maskey dladm_close(dld_handle); 21344ac67f02SAnurag S. Maskey 21357c478bd9Sstevel@tonic-gate return (1); /* return from main() forcibly exits an MT process */ 21367c478bd9Sstevel@tonic-gate } 2137