xref: /titanic_41/usr/src/cmd/zoneadmd/vplat.c (revision 0adc16190e36914964740716575460dda750de39)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 /*
30  * This module contains functions used to bring up and tear down the
31  * Virtual Platform: [un]mounting file-systems, [un]plumbing network
32  * interfaces, [un]configuring devices, establishing resource controls,
33  * and creating/destroying the zone in the kernel.  These actions, on
34  * the way up, ready the zone; on the way down, they halt the zone.
35  * See the much longer block comment at the beginning of zoneadmd.c
36  * for a bigger picture of how the whole program functions.
37  *
38  * This module also has primary responsibility for the layout of "scratch
39  * zones."  These are mounted, but inactive, zones that are used during
40  * operating system upgrade and potentially other administrative action.  The
41  * scratch zone environment is similar to the miniroot environment.  The zone's
42  * actual root is mounted read-write on /a, and the standard paths (/usr,
43  * /sbin, /lib) all lead to read-only copies of the running system's binaries.
44  * This allows the administrative tools to manipulate the zone using "-R /a"
45  * without relying on any binaries in the zone itself.
46  *
47  * If the scratch zone is on an alternate root (Live Upgrade [LU] boot
48  * environment), then we must resolve the lofs mounts used there to uncover
49  * writable (unshared) resources.  Shared resources, though, are always
50  * read-only.  In addition, if the "same" zone with a different root path is
51  * currently running, then "/b" inside the zone points to the running zone's
52  * root.  This allows LU to synchronize configuration files during the upgrade
53  * process.
54  *
55  * To construct this environment, this module creates a tmpfs mount on
56  * $ZONEPATH/lu.  Inside this scratch area, the miniroot-like environment as
57  * described above is constructed on the fly.  The zone is then created using
58  * $ZONEPATH/lu as the root.
59  *
60  * Note that scratch zones are inactive.  The zone's bits are not running and
61  * likely cannot be run correctly until upgrade is done.  Init is not running
62  * there, nor is SMF.  Because of this, the "mounted" state of a scratch zone
63  * is not a part of the usual halt/ready/boot state machine.
64  */
65 
66 #include <sys/param.h>
67 #include <sys/mount.h>
68 #include <sys/mntent.h>
69 #include <sys/socket.h>
70 #include <sys/utsname.h>
71 #include <sys/types.h>
72 #include <sys/stat.h>
73 #include <sys/sockio.h>
74 #include <sys/stropts.h>
75 #include <sys/conf.h>
76 
77 #include <inet/tcp.h>
78 #include <arpa/inet.h>
79 #include <netinet/in.h>
80 #include <net/route.h>
81 #include <netdb.h>
82 
83 #include <stdio.h>
84 #include <errno.h>
85 #include <fcntl.h>
86 #include <unistd.h>
87 #include <rctl.h>
88 #include <stdlib.h>
89 #include <string.h>
90 #include <strings.h>
91 #include <wait.h>
92 #include <limits.h>
93 #include <libgen.h>
94 #include <libzfs.h>
95 #include <zone.h>
96 #include <assert.h>
97 
98 #include <sys/mntio.h>
99 #include <sys/mnttab.h>
100 #include <sys/fs/autofs.h>	/* for _autofssys() */
101 #include <sys/fs/lofs_info.h>
102 #include <sys/fs/zfs.h>
103 
104 #include <pool.h>
105 #include <sys/pool.h>
106 
107 #include <libzonecfg.h>
108 #include "zoneadmd.h"
109 
110 #define	V4_ADDR_LEN	32
111 #define	V6_ADDR_LEN	128
112 
113 /* 0755 is the default directory mode. */
114 #define	DEFAULT_DIR_MODE \
115 	(S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH)
116 
117 #define	IPD_DEFAULT_OPTS \
118 	MNTOPT_RO "," MNTOPT_LOFS_NOSUB "," MNTOPT_NODEVICES
119 
120 #define	DFSTYPES	"/etc/dfs/fstypes"
121 
122 /*
123  * A list of directories which should be created.
124  */
125 
126 struct dir_info {
127 	char *dir_name;
128 	mode_t dir_mode;
129 };
130 
131 /*
132  * The pathnames below are relative to the zonepath
133  */
134 static struct dir_info dev_dirs[] = {
135 	{ "/dev",	0755 },
136 	{ "/dev/dsk",	0755 },
137 	{ "/dev/fd",	0555 },
138 	{ "/dev/pts",	0755 },
139 	{ "/dev/rdsk",	0755 },
140 	{ "/dev/rmt",	0755 },
141 	{ "/dev/sad",	0755 },
142 	{ "/dev/swap",	0755 },
143 	{ "/dev/term",	0755 },
144 };
145 
146 /*
147  * A list of devices which should be symlinked to /dev/zconsole.
148  */
149 
150 struct symlink_info {
151 	char *sl_source;
152 	char *sl_target;
153 };
154 
155 /*
156  * The "source" paths are relative to the zonepath
157  */
158 static struct symlink_info dev_symlinks[] = {
159 	{ "/dev/stderr",	"./fd/2" },
160 	{ "/dev/stdin",		"./fd/0" },
161 	{ "/dev/stdout",	"./fd/1" },
162 	{ "/dev/dtremote",	"/dev/null" },
163 	{ "/dev/console",	"zconsole" },
164 	{ "/dev/syscon",	"zconsole" },
165 	{ "/dev/sysmsg",	"zconsole" },
166 	{ "/dev/systty",	"zconsole" },
167 	{ "/dev/msglog",	"zconsole" },
168 };
169 
170 /* for routing socket */
171 static int rts_seqno = 0;
172 
173 /* mangled zone name when mounting in an alternate root environment */
174 static char kernzone[ZONENAME_MAX];
175 
176 /* array of cached mount entries for resolve_lofs */
177 static struct mnttab *resolve_lofs_mnts, *resolve_lofs_mnt_max;
178 
179 /* from libsocket, not in any header file */
180 extern int getnetmaskbyaddr(struct in_addr, struct in_addr *);
181 
182 /*
183  * An optimization for build_mnttable: reallocate (and potentially copy the
184  * data) only once every N times through the loop.
185  */
186 #define	MNTTAB_HUNK	32
187 
188 /*
189  * Private autofs system call
190  */
191 extern int _autofssys(int, void *);
192 
193 static int
194 autofs_cleanup(zoneid_t zoneid)
195 {
196 	/*
197 	 * Ask autofs to unmount all trigger nodes in the given zone.
198 	 */
199 	return (_autofssys(AUTOFS_UNMOUNTALL, (void *)zoneid));
200 }
201 
202 static void
203 free_mnttable(struct mnttab *mnt_array, uint_t nelem)
204 {
205 	uint_t i;
206 
207 	if (mnt_array == NULL)
208 		return;
209 	for (i = 0; i < nelem; i++) {
210 		free(mnt_array[i].mnt_mountp);
211 		free(mnt_array[i].mnt_fstype);
212 		free(mnt_array[i].mnt_special);
213 		free(mnt_array[i].mnt_mntopts);
214 		assert(mnt_array[i].mnt_time == NULL);
215 	}
216 	free(mnt_array);
217 }
218 
219 /*
220  * Build the mount table for the zone rooted at "zroot", storing the resulting
221  * array of struct mnttabs in "mnt_arrayp" and the number of elements in the
222  * array in "nelemp".
223  */
224 static int
225 build_mnttable(zlog_t *zlogp, const char *zroot, size_t zrootlen, FILE *mnttab,
226     struct mnttab **mnt_arrayp, uint_t *nelemp)
227 {
228 	struct mnttab mnt;
229 	struct mnttab *mnts;
230 	struct mnttab *mnp;
231 	uint_t nmnt;
232 
233 	rewind(mnttab);
234 	resetmnttab(mnttab);
235 	nmnt = 0;
236 	mnts = NULL;
237 	while (getmntent(mnttab, &mnt) == 0) {
238 		struct mnttab *tmp_array;
239 
240 		if (strncmp(mnt.mnt_mountp, zroot, zrootlen) != 0)
241 			continue;
242 		if (nmnt % MNTTAB_HUNK == 0) {
243 			tmp_array = realloc(mnts,
244 			    (nmnt + MNTTAB_HUNK) * sizeof (*mnts));
245 			if (tmp_array == NULL) {
246 				free_mnttable(mnts, nmnt);
247 				return (-1);
248 			}
249 			mnts = tmp_array;
250 		}
251 		mnp = &mnts[nmnt++];
252 
253 		/*
254 		 * Zero out any fields we're not using.
255 		 */
256 		(void) memset(mnp, 0, sizeof (*mnp));
257 
258 		if (mnt.mnt_special != NULL)
259 			mnp->mnt_special = strdup(mnt.mnt_special);
260 		if (mnt.mnt_mntopts != NULL)
261 			mnp->mnt_mntopts = strdup(mnt.mnt_mntopts);
262 		mnp->mnt_mountp = strdup(mnt.mnt_mountp);
263 		mnp->mnt_fstype = strdup(mnt.mnt_fstype);
264 		if ((mnt.mnt_special != NULL && mnp->mnt_special == NULL) ||
265 		    (mnt.mnt_mntopts != NULL && mnp->mnt_mntopts == NULL) ||
266 		    mnp->mnt_mountp == NULL || mnp->mnt_fstype == NULL) {
267 			zerror(zlogp, B_TRUE, "memory allocation failed");
268 			free_mnttable(mnts, nmnt);
269 			return (-1);
270 		}
271 	}
272 	*mnt_arrayp = mnts;
273 	*nelemp = nmnt;
274 	return (0);
275 }
276 
277 /*
278  * This is an optimization.  The resolve_lofs function is used quite frequently
279  * to manipulate file paths, and on a machine with a large number of zones,
280  * there will be a huge number of mounted file systems.  Thus, we trigger a
281  * reread of the list of mount points
282  */
283 static void
284 lofs_discard_mnttab(void)
285 {
286 	free_mnttable(resolve_lofs_mnts,
287 	    resolve_lofs_mnt_max - resolve_lofs_mnts);
288 	resolve_lofs_mnts = resolve_lofs_mnt_max = NULL;
289 }
290 
291 static int
292 lofs_read_mnttab(zlog_t *zlogp)
293 {
294 	FILE *mnttab;
295 	uint_t nmnts;
296 
297 	if ((mnttab = fopen(MNTTAB, "r")) == NULL)
298 		return (-1);
299 	if (build_mnttable(zlogp, "", 0, mnttab, &resolve_lofs_mnts,
300 	    &nmnts) == -1) {
301 		(void) fclose(mnttab);
302 		return (-1);
303 	}
304 	(void) fclose(mnttab);
305 	resolve_lofs_mnt_max = resolve_lofs_mnts + nmnts;
306 	return (0);
307 }
308 
309 /*
310  * This function loops over potential loopback mounts and symlinks in a given
311  * path and resolves them all down to an absolute path.
312  */
313 static void
314 resolve_lofs(zlog_t *zlogp, char *path, size_t pathlen)
315 {
316 	int len, arlen;
317 	const char *altroot;
318 	char tmppath[MAXPATHLEN];
319 	boolean_t outside_altroot;
320 
321 	if ((len = resolvepath(path, tmppath, sizeof (tmppath))) == -1)
322 		return;
323 	tmppath[len] = '\0';
324 	(void) strlcpy(path, tmppath, sizeof (tmppath));
325 
326 	/* This happens once per zoneadmd operation. */
327 	if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
328 		return;
329 
330 	altroot = zonecfg_get_root();
331 	arlen = strlen(altroot);
332 	outside_altroot = B_FALSE;
333 	for (;;) {
334 		struct mnttab *mnp;
335 
336 		for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max;
337 		    mnp++) {
338 			if (mnp->mnt_fstype == NULL ||
339 			    mnp->mnt_mountp == NULL ||
340 			    mnp->mnt_special == NULL ||
341 			    strcmp(mnp->mnt_fstype, MNTTYPE_LOFS) != 0)
342 				continue;
343 			len = strlen(mnp->mnt_mountp);
344 			if (strncmp(mnp->mnt_mountp, path, len) == 0 &&
345 			    (path[len] == '/' || path[len] == '\0'))
346 				break;
347 		}
348 		if (mnp >= resolve_lofs_mnt_max)
349 			break;
350 		if (outside_altroot) {
351 			char *cp;
352 			int olen = sizeof (MNTOPT_RO) - 1;
353 
354 			/*
355 			 * If we run into a read-only mount outside of the
356 			 * alternate root environment, then the user doesn't
357 			 * want this path to be made read-write.
358 			 */
359 			if (mnp->mnt_mntopts != NULL &&
360 			    (cp = strstr(mnp->mnt_mntopts, MNTOPT_RO)) !=
361 			    NULL &&
362 			    (cp == mnp->mnt_mntopts || cp[-1] == ',') &&
363 			    (cp[olen] == '\0' || cp[olen] == ',')) {
364 				break;
365 			}
366 		} else if (arlen > 0 &&
367 		    (strncmp(mnp->mnt_special, altroot, arlen) != 0 ||
368 		    (mnp->mnt_special[arlen] != '\0' &&
369 		    mnp->mnt_special[arlen] != '/'))) {
370 			outside_altroot = B_TRUE;
371 		}
372 		/* use temporary buffer because new path might be longer */
373 		(void) snprintf(tmppath, sizeof (tmppath), "%s%s",
374 		    mnp->mnt_special, path + len);
375 		if ((len = resolvepath(tmppath, path, pathlen)) == -1)
376 			break;
377 		path[len] = '\0';
378 	}
379 }
380 
381 /*
382  * For a regular mount, check if a replacement lofs mount is needed because the
383  * referenced device is already mounted somewhere.
384  */
385 static int
386 check_lofs_needed(zlog_t *zlogp, struct zone_fstab *fsptr)
387 {
388 	struct mnttab *mnp;
389 	zone_fsopt_t *optptr, *onext;
390 
391 	/* This happens once per zoneadmd operation. */
392 	if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
393 		return (-1);
394 
395 	/*
396 	 * If this special node isn't already in use, then it's ours alone;
397 	 * no need to worry about conflicting mounts.
398 	 */
399 	for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max;
400 	    mnp++) {
401 		if (strcmp(mnp->mnt_special, fsptr->zone_fs_special) == 0)
402 			break;
403 	}
404 	if (mnp >= resolve_lofs_mnt_max)
405 		return (0);
406 
407 	/*
408 	 * Convert this duplicate mount into a lofs mount.
409 	 */
410 	(void) strlcpy(fsptr->zone_fs_special, mnp->mnt_mountp,
411 	    sizeof (fsptr->zone_fs_special));
412 	(void) strlcpy(fsptr->zone_fs_type, MNTTYPE_LOFS,
413 	    sizeof (fsptr->zone_fs_type));
414 	fsptr->zone_fs_raw[0] = '\0';
415 
416 	/*
417 	 * Discard all but one of the original options and set that to be the
418 	 * same set of options used for inherit package directory resources.
419 	 */
420 	optptr = fsptr->zone_fs_options;
421 	if (optptr == NULL) {
422 		optptr = malloc(sizeof (*optptr));
423 		if (optptr == NULL) {
424 			zerror(zlogp, B_TRUE, "cannot mount %s",
425 			    fsptr->zone_fs_dir);
426 			return (-1);
427 		}
428 	} else {
429 		while ((onext = optptr->zone_fsopt_next) != NULL) {
430 			optptr->zone_fsopt_next = onext->zone_fsopt_next;
431 			free(onext);
432 		}
433 	}
434 	(void) strcpy(optptr->zone_fsopt_opt, IPD_DEFAULT_OPTS);
435 	optptr->zone_fsopt_next = NULL;
436 	fsptr->zone_fs_options = optptr;
437 	return (0);
438 }
439 
440 static int
441 make_one_dir(zlog_t *zlogp, const char *prefix, const char *subdir, mode_t mode)
442 {
443 	char path[MAXPATHLEN];
444 	struct stat st;
445 
446 	if (snprintf(path, sizeof (path), "%s%s", prefix, subdir) >
447 	    sizeof (path)) {
448 		zerror(zlogp, B_FALSE, "pathname %s%s is too long", prefix,
449 		    subdir);
450 		return (-1);
451 	}
452 
453 	if (lstat(path, &st) == 0) {
454 		/*
455 		 * We don't check the file mode since presumably the zone
456 		 * administrator may have had good reason to change the mode,
457 		 * and we don't need to second guess him.
458 		 */
459 		if (!S_ISDIR(st.st_mode)) {
460 			zerror(zlogp, B_FALSE, "%s is not a directory", path);
461 			return (-1);
462 		}
463 	} else if (mkdirp(path, mode) != 0) {
464 		if (errno == EROFS)
465 			zerror(zlogp, B_FALSE, "Could not mkdir %s.\nIt is on "
466 			    "a read-only file system in this local zone.\nMake "
467 			    "sure %s exists in the global zone.", path, subdir);
468 		else
469 			zerror(zlogp, B_TRUE, "mkdirp of %s failed", path);
470 		return (-1);
471 	}
472 	return (0);
473 }
474 
475 /*
476  * Make /dev and various directories underneath it.
477  */
478 static int
479 make_dev_dirs(zlog_t *zlogp, const char *zonepath)
480 {
481 	int i;
482 
483 	for (i = 0; i < sizeof (dev_dirs) / sizeof (struct dir_info); i++) {
484 		if (make_one_dir(zlogp, zonepath, dev_dirs[i].dir_name,
485 		    dev_dirs[i].dir_mode) != 0)
486 			return (-1);
487 	}
488 	return (0);
489 }
490 
491 /*
492  * Make various sym-links underneath /dev.
493  */
494 static int
495 make_dev_links(zlog_t *zlogp, char *zonepath)
496 {
497 	int i;
498 
499 	for (i = 0; i < sizeof (dev_symlinks) / sizeof (struct symlink_info);
500 	    i++) {
501 		char dev[MAXPATHLEN];
502 		struct stat st;
503 
504 		(void) snprintf(dev, sizeof (dev), "%s%s", zonepath,
505 		    dev_symlinks[i].sl_source);
506 		if (lstat(dev, &st) == 0) {
507 			/*
508 			 * Try not to call unlink(2) on directories, since that
509 			 * makes UFS unhappy.
510 			 */
511 			if (S_ISDIR(st.st_mode)) {
512 				zerror(zlogp, B_FALSE, "symlink path %s is a "
513 				    "directory", dev_symlinks[i].sl_source);
514 				return (-1);
515 			}
516 			(void) unlink(dev);
517 		}
518 		if (symlink(dev_symlinks[i].sl_target, dev) != 0) {
519 			zerror(zlogp, B_TRUE, "could not setup %s->%s symlink",
520 			    dev_symlinks[i].sl_source,
521 			    dev_symlinks[i].sl_target);
522 			return (-1);
523 		}
524 	}
525 	return (0);
526 }
527 
528 /*
529  * Create various directories and sym-links under /dev.
530  */
531 static int
532 create_dev_files(zlog_t *zlogp)
533 {
534 	char zonepath[MAXPATHLEN];
535 
536 	if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
537 		zerror(zlogp, B_TRUE, "unable to determine zone root");
538 		return (-1);
539 	}
540 	if (zonecfg_in_alt_root())
541 		resolve_lofs(zlogp, zonepath, sizeof (zonepath));
542 
543 	if (make_dev_dirs(zlogp, zonepath) != 0)
544 		return (-1);
545 	if (make_dev_links(zlogp, zonepath) != 0)
546 		return (-1);
547 	return (0);
548 }
549 
550 static void
551 free_remote_fstypes(char **types)
552 {
553 	uint_t i;
554 
555 	if (types == NULL)
556 		return;
557 	for (i = 0; types[i] != NULL; i++)
558 		free(types[i]);
559 	free(types);
560 }
561 
562 static char **
563 get_remote_fstypes(zlog_t *zlogp)
564 {
565 	char **types = NULL;
566 	FILE *fp;
567 	char buf[MAXPATHLEN];
568 	char fstype[MAXPATHLEN];
569 	uint_t lines = 0;
570 	uint_t i;
571 
572 	if ((fp = fopen(DFSTYPES, "r")) == NULL) {
573 		zerror(zlogp, B_TRUE, "failed to open %s", DFSTYPES);
574 		return (NULL);
575 	}
576 	/*
577 	 * Count the number of lines
578 	 */
579 	while (fgets(buf, sizeof (buf), fp) != NULL)
580 		lines++;
581 	if (lines == 0)	/* didn't read anything; empty file */
582 		goto out;
583 	rewind(fp);
584 	/*
585 	 * Allocate enough space for a NULL-terminated array.
586 	 */
587 	types = calloc(lines + 1, sizeof (char *));
588 	if (types == NULL) {
589 		zerror(zlogp, B_TRUE, "memory allocation failed");
590 		goto out;
591 	}
592 	i = 0;
593 	while (fgets(buf, sizeof (buf), fp) != NULL) {
594 		/* LINTED - fstype is big enough to hold buf */
595 		if (sscanf(buf, "%s", fstype) == 0) {
596 			zerror(zlogp, B_FALSE, "unable to parse %s", DFSTYPES);
597 			free_remote_fstypes(types);
598 			types = NULL;
599 			goto out;
600 		}
601 		types[i] = strdup(fstype);
602 		if (types[i] == NULL) {
603 			zerror(zlogp, B_TRUE, "memory allocation failed");
604 			free_remote_fstypes(types);
605 			types = NULL;
606 			goto out;
607 		}
608 		i++;
609 	}
610 out:
611 	(void) fclose(fp);
612 	return (types);
613 }
614 
615 static boolean_t
616 is_remote_fstype(const char *fstype, char *const *remote_fstypes)
617 {
618 	uint_t i;
619 
620 	if (remote_fstypes == NULL)
621 		return (B_FALSE);
622 	for (i = 0; remote_fstypes[i] != NULL; i++) {
623 		if (strcmp(remote_fstypes[i], fstype) == 0)
624 			return (B_TRUE);
625 	}
626 	return (B_FALSE);
627 }
628 
629 /*
630  * This converts a zone root path (normally of the form .../root) to a Live
631  * Upgrade scratch zone root (of the form .../lu).
632  */
633 static void
634 root_to_lu(zlog_t *zlogp, char *zroot, size_t zrootlen, boolean_t isresolved)
635 {
636 	if (!isresolved && zonecfg_in_alt_root())
637 		resolve_lofs(zlogp, zroot, zrootlen);
638 	(void) strcpy(strrchr(zroot, '/') + 1, "lu");
639 }
640 
641 /*
642  * The general strategy for unmounting filesystems is as follows:
643  *
644  * - Remote filesystems may be dead, and attempting to contact them as
645  * part of a regular unmount may hang forever; we want to always try to
646  * forcibly unmount such filesystems and only fall back to regular
647  * unmounts if the filesystem doesn't support forced unmounts.
648  *
649  * - We don't want to unnecessarily corrupt metadata on local
650  * filesystems (ie UFS), so we want to start off with graceful unmounts,
651  * and only escalate to doing forced unmounts if we get stuck.
652  *
653  * We start off walking backwards through the mount table.  This doesn't
654  * give us strict ordering but ensures that we try to unmount submounts
655  * first.  We thus limit the number of failed umount2(2) calls.
656  *
657  * The mechanism for determining if we're stuck is to count the number
658  * of failed unmounts each iteration through the mount table.  This
659  * gives us an upper bound on the number of filesystems which remain
660  * mounted (autofs trigger nodes are dealt with separately).  If at the
661  * end of one unmount+autofs_cleanup cycle we still have the same number
662  * of mounts that we started out with, we're stuck and try a forced
663  * unmount.  If that fails (filesystem doesn't support forced unmounts)
664  * then we bail and are unable to teardown the zone.  If it succeeds,
665  * we're no longer stuck so we continue with our policy of trying
666  * graceful mounts first.
667  *
668  * Zone must be down (ie, no processes or threads active).
669  */
670 static int
671 unmount_filesystems(zlog_t *zlogp, zoneid_t zoneid, boolean_t unmount_cmd)
672 {
673 	int error = 0;
674 	FILE *mnttab;
675 	struct mnttab *mnts;
676 	uint_t nmnt;
677 	char zroot[MAXPATHLEN + 1];
678 	size_t zrootlen;
679 	uint_t oldcount = UINT_MAX;
680 	boolean_t stuck = B_FALSE;
681 	char **remote_fstypes = NULL;
682 
683 	if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
684 		zerror(zlogp, B_FALSE, "unable to determine zone root");
685 		return (-1);
686 	}
687 	if (unmount_cmd)
688 		root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
689 
690 	(void) strcat(zroot, "/");
691 	zrootlen = strlen(zroot);
692 
693 	if ((mnttab = fopen(MNTTAB, "r")) == NULL) {
694 		zerror(zlogp, B_TRUE, "failed to open %s", MNTTAB);
695 		return (-1);
696 	}
697 	/*
698 	 * Use our hacky mntfs ioctl so we see everything, even mounts with
699 	 * MS_NOMNTTAB.
700 	 */
701 	if (ioctl(fileno(mnttab), MNTIOC_SHOWHIDDEN, NULL) < 0) {
702 		zerror(zlogp, B_TRUE, "unable to configure %s", MNTTAB);
703 		error++;
704 		goto out;
705 	}
706 
707 	/*
708 	 * Build the list of remote fstypes so we know which ones we
709 	 * should forcibly unmount.
710 	 */
711 	remote_fstypes = get_remote_fstypes(zlogp);
712 	for (; /* ever */; ) {
713 		uint_t newcount = 0;
714 		boolean_t unmounted;
715 		struct mnttab *mnp;
716 		char *path;
717 		uint_t i;
718 
719 		mnts = NULL;
720 		nmnt = 0;
721 		/*
722 		 * MNTTAB gives us a way to walk through mounted
723 		 * filesystems; we need to be able to walk them in
724 		 * reverse order, so we build a list of all mounted
725 		 * filesystems.
726 		 */
727 		if (build_mnttable(zlogp, zroot, zrootlen, mnttab, &mnts,
728 		    &nmnt) != 0) {
729 			error++;
730 			goto out;
731 		}
732 		for (i = 0; i < nmnt; i++) {
733 			mnp = &mnts[nmnt - i - 1]; /* access in reverse order */
734 			path = mnp->mnt_mountp;
735 			unmounted = B_FALSE;
736 			/*
737 			 * Try forced unmount first for remote filesystems.
738 			 *
739 			 * Not all remote filesystems support forced unmounts,
740 			 * so if this fails (ENOTSUP) we'll continue on
741 			 * and try a regular unmount.
742 			 */
743 			if (is_remote_fstype(mnp->mnt_fstype, remote_fstypes)) {
744 				if (umount2(path, MS_FORCE) == 0)
745 					unmounted = B_TRUE;
746 			}
747 			/*
748 			 * Try forced unmount if we're stuck.
749 			 */
750 			if (stuck) {
751 				if (umount2(path, MS_FORCE) == 0) {
752 					unmounted = B_TRUE;
753 					stuck = B_FALSE;
754 				} else {
755 					/*
756 					 * The first failure indicates a
757 					 * mount we won't be able to get
758 					 * rid of automatically, so we
759 					 * bail.
760 					 */
761 					error++;
762 					zerror(zlogp, B_FALSE,
763 					    "unable to unmount '%s'", path);
764 					free_mnttable(mnts, nmnt);
765 					goto out;
766 				}
767 			}
768 			/*
769 			 * Try regular unmounts for everything else.
770 			 */
771 			if (!unmounted && umount2(path, 0) != 0)
772 				newcount++;
773 		}
774 		free_mnttable(mnts, nmnt);
775 
776 		if (newcount == 0)
777 			break;
778 		if (newcount >= oldcount) {
779 			/*
780 			 * Last round didn't unmount anything; we're stuck and
781 			 * should start trying forced unmounts.
782 			 */
783 			stuck = B_TRUE;
784 		}
785 		oldcount = newcount;
786 
787 		/*
788 		 * Autofs doesn't let you unmount its trigger nodes from
789 		 * userland so we have to tell the kernel to cleanup for us.
790 		 */
791 		if (autofs_cleanup(zoneid) != 0) {
792 			zerror(zlogp, B_TRUE, "unable to remove autofs nodes");
793 			error++;
794 			goto out;
795 		}
796 	}
797 
798 out:
799 	free_remote_fstypes(remote_fstypes);
800 	(void) fclose(mnttab);
801 	return (error ? -1 : 0);
802 }
803 
804 static int
805 fs_compare(const void *m1, const void *m2)
806 {
807 	struct zone_fstab *i = (struct zone_fstab *)m1;
808 	struct zone_fstab *j = (struct zone_fstab *)m2;
809 
810 	return (strcmp(i->zone_fs_dir, j->zone_fs_dir));
811 }
812 
813 /*
814  * Fork and exec (and wait for) the mentioned binary with the provided
815  * arguments.  Returns (-1) if something went wrong with fork(2) or exec(2),
816  * returns the exit status otherwise.
817  *
818  * If we were unable to exec the provided pathname (for whatever
819  * reason), we return the special token ZEXIT_EXEC.  The current value
820  * of ZEXIT_EXEC doesn't conflict with legitimate exit codes of the
821  * consumers of this function; any future consumers must make sure this
822  * remains the case.
823  */
824 static int
825 forkexec(zlog_t *zlogp, const char *path, char *const argv[])
826 {
827 	pid_t child_pid;
828 	int child_status = 0;
829 
830 	/*
831 	 * Do not let another thread localize a message while we are forking.
832 	 */
833 	(void) mutex_lock(&msglock);
834 	child_pid = fork();
835 	(void) mutex_unlock(&msglock);
836 	if (child_pid == -1) {
837 		zerror(zlogp, B_TRUE, "could not fork for %s", argv[0]);
838 		return (-1);
839 	} else if (child_pid == 0) {
840 		closefrom(0);
841 		(void) execv(path, argv);
842 		/*
843 		 * Since we are in the child, there is no point calling zerror()
844 		 * since there is nobody waiting to consume it.  So exit with a
845 		 * special code that the parent will recognize and call zerror()
846 		 * accordingly.
847 		 */
848 
849 		_exit(ZEXIT_EXEC);
850 	} else {
851 		(void) waitpid(child_pid, &child_status, 0);
852 	}
853 
854 	if (WIFSIGNALED(child_status)) {
855 		zerror(zlogp, B_FALSE, "%s unexpectedly terminated due to "
856 		    "signal %d", path, WTERMSIG(child_status));
857 		return (-1);
858 	}
859 	assert(WIFEXITED(child_status));
860 	if (WEXITSTATUS(child_status) == ZEXIT_EXEC) {
861 		zerror(zlogp, B_FALSE, "failed to exec %s", path);
862 		return (-1);
863 	}
864 	return (WEXITSTATUS(child_status));
865 }
866 
867 static int
868 dofsck(zlog_t *zlogp, const char *fstype, const char *rawdev)
869 {
870 	char cmdbuf[MAXPATHLEN];
871 	char *argv[4];
872 	int status;
873 
874 	/*
875 	 * We could alternatively have called /usr/sbin/fsck -F <fstype>, but
876 	 * that would cost us an extra fork/exec without buying us anything.
877 	 */
878 	if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/fsck", fstype)
879 	    > sizeof (cmdbuf)) {
880 		zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
881 		return (-1);
882 	}
883 
884 	argv[0] = "fsck";
885 	argv[1] = "-m";
886 	argv[2] = (char *)rawdev;
887 	argv[3] = NULL;
888 
889 	status = forkexec(zlogp, cmdbuf, argv);
890 	if (status == 0 || status == -1)
891 		return (status);
892 	zerror(zlogp, B_FALSE, "fsck of '%s' failed with exit status %d; "
893 	    "run fsck manually", rawdev, status);
894 	return (-1);
895 }
896 
897 static int
898 domount(zlog_t *zlogp, const char *fstype, const char *opts,
899     const char *special, const char *directory)
900 {
901 	char cmdbuf[MAXPATHLEN];
902 	char *argv[6];
903 	int status;
904 
905 	/*
906 	 * We could alternatively have called /usr/sbin/mount -F <fstype>, but
907 	 * that would cost us an extra fork/exec without buying us anything.
908 	 */
909 	if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/mount", fstype)
910 	    > sizeof (cmdbuf)) {
911 		zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
912 		return (-1);
913 	}
914 	argv[0] = "mount";
915 	if (opts[0] == '\0') {
916 		argv[1] = (char *)special;
917 		argv[2] = (char *)directory;
918 		argv[3] = NULL;
919 	} else {
920 		argv[1] = "-o";
921 		argv[2] = (char *)opts;
922 		argv[3] = (char *)special;
923 		argv[4] = (char *)directory;
924 		argv[5] = NULL;
925 	}
926 
927 	status = forkexec(zlogp, cmdbuf, argv);
928 	if (status == 0 || status == -1)
929 		return (status);
930 	if (opts[0] == '\0')
931 		zerror(zlogp, B_FALSE, "\"%s %s %s\" "
932 		    "failed with exit code %d",
933 		    cmdbuf, special, directory, status);
934 	else
935 		zerror(zlogp, B_FALSE, "\"%s -o %s %s %s\" "
936 		    "failed with exit code %d",
937 		    cmdbuf, opts, special, directory, status);
938 	return (-1);
939 }
940 
941 /*
942  * Make sure if a given path exists, it is not a sym-link, and is a directory.
943  */
944 static int
945 check_path(zlog_t *zlogp, const char *path)
946 {
947 	struct stat statbuf;
948 	char respath[MAXPATHLEN];
949 	int res;
950 
951 	if (lstat(path, &statbuf) != 0) {
952 		if (errno == ENOENT)
953 			return (0);
954 		zerror(zlogp, B_TRUE, "can't stat %s", path);
955 		return (-1);
956 	}
957 	if (S_ISLNK(statbuf.st_mode)) {
958 		zerror(zlogp, B_FALSE, "%s is a symlink", path);
959 		return (-1);
960 	}
961 	if (!S_ISDIR(statbuf.st_mode)) {
962 		zerror(zlogp, B_FALSE, "%s is not a directory", path);
963 		return (-1);
964 	}
965 	if ((res = resolvepath(path, respath, sizeof (respath))) == -1) {
966 		zerror(zlogp, B_TRUE, "unable to resolve path %s", path);
967 		return (-1);
968 	}
969 	respath[res] = '\0';
970 	if (strcmp(path, respath) != 0) {
971 		/*
972 		 * We don't like ".."s and "."s throwing us off
973 		 */
974 		zerror(zlogp, B_FALSE, "%s is not a canonical path", path);
975 		return (-1);
976 	}
977 	return (0);
978 }
979 
980 /*
981  * Check every component of rootpath/relpath.  If any component fails (ie,
982  * exists but isn't the canonical path to a directory), it is returned in
983  * badpath, which is assumed to be at least of size MAXPATHLEN.
984  *
985  * Relpath must begin with '/'.
986  */
987 static boolean_t
988 valid_mount_path(zlog_t *zlogp, const char *rootpath, const char *relpath)
989 {
990 	char abspath[MAXPATHLEN], *slashp;
991 
992 	/*
993 	 * Make sure abspath has at least one '/' after its rootpath
994 	 * component, and ends with '/'.
995 	 */
996 	if (snprintf(abspath, sizeof (abspath), "%s%s/", rootpath, relpath) >
997 	    sizeof (abspath)) {
998 		zerror(zlogp, B_FALSE, "pathname %s%s is too long", rootpath,
999 		    relpath);
1000 		return (B_FALSE);
1001 	}
1002 
1003 	slashp = &abspath[strlen(rootpath)];
1004 	assert(*slashp == '/');
1005 	do {
1006 		*slashp = '\0';
1007 		if (check_path(zlogp, abspath) != 0)
1008 			return (B_FALSE);
1009 		*slashp = '/';
1010 		slashp++;
1011 	} while ((slashp = strchr(slashp, '/')) != NULL);
1012 	return (B_TRUE);
1013 }
1014 
1015 static int
1016 mount_one(zlog_t *zlogp, struct zone_fstab *fsptr, const char *rootpath)
1017 {
1018 	char    path[MAXPATHLEN];
1019 	char	specpath[MAXPATHLEN];
1020 	char    optstr[MAX_MNTOPT_STR];
1021 	zone_fsopt_t *optptr;
1022 
1023 	if (!valid_mount_path(zlogp, rootpath, fsptr->zone_fs_dir)) {
1024 		zerror(zlogp, B_FALSE, "%s%s is not a valid mount point",
1025 		    rootpath, fsptr->zone_fs_dir);
1026 		return (-1);
1027 	}
1028 
1029 	if (make_one_dir(zlogp, rootpath, fsptr->zone_fs_dir,
1030 	    DEFAULT_DIR_MODE) != 0)
1031 		return (-1);
1032 
1033 	(void) snprintf(path, sizeof (path), "%s%s", rootpath,
1034 	    fsptr->zone_fs_dir);
1035 
1036 	if (strlen(fsptr->zone_fs_special) == 0) {
1037 		/*
1038 		 * A zero-length special is how we distinguish IPDs from
1039 		 * general-purpose FSs.  Make sure it mounts from a place that
1040 		 * can be seen via the alternate zone's root.
1041 		 */
1042 		if (snprintf(specpath, sizeof (specpath), "%s%s",
1043 		    zonecfg_get_root(), fsptr->zone_fs_dir) >=
1044 		    sizeof (specpath)) {
1045 			zerror(zlogp, B_FALSE, "cannot mount %s: path too "
1046 			    "long in alternate root", fsptr->zone_fs_dir);
1047 			return (-1);
1048 		}
1049 		if (zonecfg_in_alt_root())
1050 			resolve_lofs(zlogp, specpath, sizeof (specpath));
1051 		if (domount(zlogp, MNTTYPE_LOFS, IPD_DEFAULT_OPTS,
1052 		    specpath, path) != 0) {
1053 			zerror(zlogp, B_TRUE, "failed to loopback mount %s",
1054 			    specpath);
1055 			return (-1);
1056 		}
1057 		return (0);
1058 	}
1059 
1060 	/*
1061 	 * In general the strategy here is to do just as much verification as
1062 	 * necessary to avoid crashing or otherwise doing something bad; if the
1063 	 * administrator initiated the operation via zoneadm(1m), he'll get
1064 	 * auto-verification which will let him know what's wrong.  If he
1065 	 * modifies the zone configuration of a running zone and doesn't attempt
1066 	 * to verify that it's OK we won't crash but won't bother trying to be
1067 	 * too helpful either.  zoneadm verify is only a couple keystrokes away.
1068 	 */
1069 	if (!zonecfg_valid_fs_type(fsptr->zone_fs_type)) {
1070 		zerror(zlogp, B_FALSE, "cannot mount %s on %s: "
1071 		    "invalid file-system type %s", fsptr->zone_fs_special,
1072 		    fsptr->zone_fs_dir, fsptr->zone_fs_type);
1073 		return (-1);
1074 	}
1075 
1076 	/*
1077 	 * If we're looking at an alternate root environment, then construct
1078 	 * read-only loopback mounts as necessary.  For all lofs mounts, make
1079 	 * sure that the 'special' entry points inside the alternate root.  (We
1080 	 * don't do this with other mounts, as devfs isn't in the alternate
1081 	 * root, and we need to assume the device environment is roughly the
1082 	 * same.)
1083 	 */
1084 	if (zonecfg_in_alt_root()) {
1085 		struct stat64 st;
1086 
1087 		if (stat64(fsptr->zone_fs_special, &st) != -1 &&
1088 		    S_ISBLK(st.st_mode) &&
1089 		    check_lofs_needed(zlogp, fsptr) == -1)
1090 			return (-1);
1091 		if (strcmp(fsptr->zone_fs_type, MNTTYPE_LOFS) == 0) {
1092 			if (snprintf(specpath, sizeof (specpath), "%s%s",
1093 			    zonecfg_get_root(), fsptr->zone_fs_special) >=
1094 			    sizeof (specpath)) {
1095 				zerror(zlogp, B_FALSE, "cannot mount %s: path "
1096 				    "too long in alternate root",
1097 				    fsptr->zone_fs_special);
1098 				return (-1);
1099 			}
1100 			resolve_lofs(zlogp, specpath, sizeof (specpath));
1101 			(void) strlcpy(fsptr->zone_fs_special, specpath,
1102 			    sizeof (fsptr->zone_fs_special));
1103 		}
1104 	}
1105 
1106 	/*
1107 	 * Run 'fsck -m' if there's a device to fsck.
1108 	 */
1109 	if (fsptr->zone_fs_raw[0] != '\0' &&
1110 	    dofsck(zlogp, fsptr->zone_fs_type, fsptr->zone_fs_raw) != 0)
1111 		return (-1);
1112 
1113 	/*
1114 	 * Build up mount option string.
1115 	 */
1116 	optstr[0] = '\0';
1117 	if (fsptr->zone_fs_options != NULL) {
1118 		(void) strlcpy(optstr, fsptr->zone_fs_options->zone_fsopt_opt,
1119 		    sizeof (optstr));
1120 		for (optptr = fsptr->zone_fs_options->zone_fsopt_next;
1121 		    optptr != NULL; optptr = optptr->zone_fsopt_next) {
1122 			(void) strlcat(optstr, ",", sizeof (optstr));
1123 			(void) strlcat(optstr, optptr->zone_fsopt_opt,
1124 			    sizeof (optstr));
1125 		}
1126 	}
1127 	return (domount(zlogp, fsptr->zone_fs_type, optstr,
1128 	    fsptr->zone_fs_special, path));
1129 }
1130 
1131 static void
1132 free_fs_data(struct zone_fstab *fsarray, uint_t nelem)
1133 {
1134 	uint_t i;
1135 
1136 	if (fsarray == NULL)
1137 		return;
1138 	for (i = 0; i < nelem; i++)
1139 		zonecfg_free_fs_option_list(fsarray[i].zone_fs_options);
1140 	free(fsarray);
1141 }
1142 
1143 /*
1144  * This function constructs the miniroot-like "scratch zone" environment.  If
1145  * it returns B_FALSE, then the error has already been logged.
1146  */
1147 static boolean_t
1148 build_mounted(zlog_t *zlogp, char *rootpath, size_t rootlen,
1149     const char *zonepath)
1150 {
1151 	char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1152 	char luroot[MAXPATHLEN];
1153 	const char **cpp;
1154 	static const char *mkdirs[] = {
1155 		"/system", "/system/contract", "/proc", "/dev", "/tmp",
1156 		"/a", NULL
1157 	};
1158 	static const char *localdirs[] = {
1159 		"/etc", "/var", NULL
1160 	};
1161 	static const char *loopdirs[] = {
1162 		"/etc/lib", "/etc/fs", "/lib", "/sbin", "/platform",
1163 		"/usr", NULL
1164 	};
1165 	static const char *tmpdirs[] = {
1166 		"/tmp", "/var/run", NULL
1167 	};
1168 	FILE *fp;
1169 	struct stat st;
1170 	char *altstr;
1171 	uuid_t uuid;
1172 
1173 	/*
1174 	 * Construct a small Solaris environment, including the zone root
1175 	 * mounted on '/a' inside that environment.
1176 	 */
1177 	resolve_lofs(zlogp, rootpath, rootlen);
1178 	(void) snprintf(luroot, sizeof (luroot), "%s/lu", zonepath);
1179 	resolve_lofs(zlogp, luroot, sizeof (luroot));
1180 	(void) snprintf(tmp, sizeof (tmp), "%s/bin", luroot);
1181 	(void) symlink("./usr/bin", tmp);
1182 
1183 	/*
1184 	 * These are mostly special mount points; not handled here.  (See
1185 	 * zone_mount_early.)
1186 	 */
1187 	for (cpp = mkdirs; *cpp != NULL; cpp++) {
1188 		(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1189 		if (mkdir(tmp, 0755) != 0) {
1190 			zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1191 			return (B_FALSE);
1192 		}
1193 	}
1194 
1195 	/*
1196 	 * These are mounted read-write from the zone undergoing upgrade.  We
1197 	 * must be careful not to 'leak' things from the main system into the
1198 	 * zone, and this accomplishes that goal.
1199 	 */
1200 	for (cpp = localdirs; *cpp != NULL; cpp++) {
1201 		(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1202 		(void) snprintf(fromdir, sizeof (fromdir), "%s%s", rootpath,
1203 		    *cpp);
1204 		if (mkdir(tmp, 0755) != 0) {
1205 			zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1206 			return (B_FALSE);
1207 		}
1208 		if (domount(zlogp, MNTTYPE_LOFS, "", fromdir, tmp) != 0) {
1209 			zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1210 			    *cpp);
1211 			return (B_FALSE);
1212 		}
1213 	}
1214 
1215 	/*
1216 	 * These are things mounted read-only from the running system because
1217 	 * they contain binaries that must match system.
1218 	 */
1219 	for (cpp = loopdirs; *cpp != NULL; cpp++) {
1220 		(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1221 		if (mkdir(tmp, 0755) != 0) {
1222 			if (errno != EEXIST) {
1223 				zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1224 				return (B_FALSE);
1225 			}
1226 			if (lstat(tmp, &st) != 0) {
1227 				zerror(zlogp, B_TRUE, "cannot stat %s", tmp);
1228 				return (B_FALSE);
1229 			}
1230 			/*
1231 			 * Ignore any non-directories encountered.  These are
1232 			 * things that have been converted into symlinks
1233 			 * (/etc/fs and /etc/lib) and no longer need a lofs
1234 			 * fixup.
1235 			 */
1236 			if (!S_ISDIR(st.st_mode))
1237 				continue;
1238 		}
1239 		if (domount(zlogp, MNTTYPE_LOFS, IPD_DEFAULT_OPTS, *cpp,
1240 		    tmp) != 0) {
1241 			zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1242 			    *cpp);
1243 			return (B_FALSE);
1244 		}
1245 	}
1246 
1247 	/*
1248 	 * These are things with tmpfs mounted inside.
1249 	 */
1250 	for (cpp = tmpdirs; *cpp != NULL; cpp++) {
1251 		(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1252 		if (mkdir(tmp, 0755) != 0 && errno != EEXIST) {
1253 			zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1254 			return (B_FALSE);
1255 		}
1256 		if (domount(zlogp, MNTTYPE_TMPFS, "", "swap", tmp) != 0) {
1257 			zerror(zlogp, B_TRUE, "cannot mount swap on %s", *cpp);
1258 			return (B_FALSE);
1259 		}
1260 	}
1261 
1262 	/*
1263 	 * This is here to support lucopy.  If there's an instance of this same
1264 	 * zone on the current running system, then we mount its root up as
1265 	 * read-only inside the scratch zone.
1266 	 */
1267 	(void) zonecfg_get_uuid(zone_name, uuid);
1268 	altstr = strdup(zonecfg_get_root());
1269 	if (altstr == NULL) {
1270 		zerror(zlogp, B_TRUE, "out of memory");
1271 		return (B_FALSE);
1272 	}
1273 	zonecfg_set_root("");
1274 	(void) strlcpy(tmp, zone_name, sizeof (tmp));
1275 	(void) zonecfg_get_name_by_uuid(uuid, tmp, sizeof (tmp));
1276 	if (zone_get_rootpath(tmp, fromdir, sizeof (fromdir)) == Z_OK &&
1277 	    strcmp(fromdir, rootpath) != 0) {
1278 		(void) snprintf(tmp, sizeof (tmp), "%s/b", luroot);
1279 		if (mkdir(tmp, 0755) != 0) {
1280 			zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1281 			return (B_FALSE);
1282 		}
1283 		if (domount(zlogp, MNTTYPE_LOFS, IPD_DEFAULT_OPTS, fromdir,
1284 		    tmp) != 0) {
1285 			zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1286 			    fromdir);
1287 			return (B_FALSE);
1288 		}
1289 	}
1290 	zonecfg_set_root(altstr);
1291 	free(altstr);
1292 
1293 	if ((fp = zonecfg_open_scratch(luroot, B_TRUE)) == NULL) {
1294 		zerror(zlogp, B_TRUE, "cannot open zone mapfile");
1295 		return (B_FALSE);
1296 	}
1297 	(void) ftruncate(fileno(fp), 0);
1298 	if (zonecfg_add_scratch(fp, zone_name, kernzone, "/") == -1) {
1299 		zerror(zlogp, B_TRUE, "cannot add zone mapfile entry");
1300 	}
1301 	zonecfg_close_scratch(fp);
1302 	(void) snprintf(tmp, sizeof (tmp), "%s/a", luroot);
1303 	if (domount(zlogp, MNTTYPE_LOFS, "", rootpath, tmp) != 0)
1304 		return (B_FALSE);
1305 	(void) strlcpy(rootpath, tmp, rootlen);
1306 	return (B_TRUE);
1307 }
1308 
1309 static int
1310 mount_filesystems(zlog_t *zlogp, boolean_t mount_cmd)
1311 {
1312 	char	rootpath[MAXPATHLEN];
1313 	char	zonepath[MAXPATHLEN];
1314 	int	num_fs = 0, i;
1315 	struct zone_fstab fstab, *fs_ptr = NULL, *tmp_ptr;
1316 	struct zone_fstab *fsp;
1317 	zone_dochandle_t handle = NULL;
1318 	zone_state_t zstate;
1319 
1320 	if (zone_get_state(zone_name, &zstate) != Z_OK ||
1321 	    (zstate != ZONE_STATE_READY && zstate != ZONE_STATE_MOUNTED)) {
1322 		zerror(zlogp, B_FALSE,
1323 		    "zone must be in '%s' or '%s' state to mount file-systems",
1324 		    zone_state_str(ZONE_STATE_READY),
1325 		    zone_state_str(ZONE_STATE_MOUNTED));
1326 		goto bad;
1327 	}
1328 
1329 	if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
1330 		zerror(zlogp, B_TRUE, "unable to determine zone path");
1331 		goto bad;
1332 	}
1333 
1334 	if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
1335 		zerror(zlogp, B_TRUE, "unable to determine zone root");
1336 		goto bad;
1337 	}
1338 
1339 	if ((handle = zonecfg_init_handle()) == NULL) {
1340 		zerror(zlogp, B_TRUE,
1341 		    "could not get zone configuration handle");
1342 		goto bad;
1343 	}
1344 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK ||
1345 	    zonecfg_setfsent(handle) != Z_OK) {
1346 		zerror(zlogp, B_FALSE, "invalid configuration");
1347 		goto bad;
1348 	}
1349 
1350 	/*
1351 	 * /dev in the zone is loopback'd from the external /dev repository,
1352 	 * in order to provide a largely read-only semantic.  But because
1353 	 * processes in the zone need to be able to chown, chmod, etc. zone
1354 	 * /dev files, we can't use a 'ro' lofs mount.  Instead we use a
1355 	 * special mode just for zones, "zonedevfs".
1356 	 *
1357 	 * In the future we should front /dev with a full-fledged filesystem.
1358 	 */
1359 	num_fs++;
1360 	if ((tmp_ptr = realloc(fs_ptr, num_fs * sizeof (*tmp_ptr))) == NULL) {
1361 		zerror(zlogp, B_TRUE, "memory allocation failed");
1362 		num_fs--;
1363 		goto bad;
1364 	}
1365 	fs_ptr = tmp_ptr;
1366 	fsp = &fs_ptr[num_fs - 1];
1367 	/*
1368 	 * Note that mount_one will prepend the alternate root to
1369 	 * zone_fs_special and do the necessary resolution, so all that is
1370 	 * needed here is to strip the root added by zone_get_zonepath.
1371 	 */
1372 	(void) strlcpy(fsp->zone_fs_dir, "/dev", sizeof (fsp->zone_fs_dir));
1373 	(void) snprintf(fsp->zone_fs_special, sizeof (fsp->zone_fs_special),
1374 	    "%s/dev", zonepath + strlen(zonecfg_get_root()));
1375 	fsp->zone_fs_raw[0] = '\0';
1376 	(void) strlcpy(fsp->zone_fs_type, MNTTYPE_LOFS,
1377 	    sizeof (fsp->zone_fs_type));
1378 	fsp->zone_fs_options = NULL;
1379 	if (zonecfg_add_fs_option(fsp, MNTOPT_LOFS_ZONEDEVFS) != Z_OK) {
1380 		zerror(zlogp, B_FALSE, "error adding property");
1381 		goto bad;
1382 	}
1383 
1384 	/*
1385 	 * Iterate through the rest of the filesystems, first the IPDs, then
1386 	 * the general FSs.  Sort them all, then mount them in sorted order.
1387 	 * This is to make sure the higher level directories (e.g., /usr)
1388 	 * get mounted before any beneath them (e.g., /usr/local).
1389 	 */
1390 	if (zonecfg_setipdent(handle) != Z_OK) {
1391 		zerror(zlogp, B_FALSE, "invalid configuration");
1392 		goto bad;
1393 	}
1394 	while (zonecfg_getipdent(handle, &fstab) == Z_OK) {
1395 		num_fs++;
1396 		if ((tmp_ptr = realloc(fs_ptr,
1397 		    num_fs * sizeof (*tmp_ptr))) == NULL) {
1398 			zerror(zlogp, B_TRUE, "memory allocation failed");
1399 			num_fs--;
1400 			(void) zonecfg_endipdent(handle);
1401 			goto bad;
1402 		}
1403 		fs_ptr = tmp_ptr;
1404 		fsp = &fs_ptr[num_fs - 1];
1405 		/*
1406 		 * IPDs logically only have a mount point; all other properties
1407 		 * are implied.
1408 		 */
1409 		(void) strlcpy(fsp->zone_fs_dir,
1410 		    fstab.zone_fs_dir, sizeof (fsp->zone_fs_dir));
1411 		fsp->zone_fs_special[0] = '\0';
1412 		fsp->zone_fs_raw[0] = '\0';
1413 		fsp->zone_fs_type[0] = '\0';
1414 		fsp->zone_fs_options = NULL;
1415 	}
1416 	(void) zonecfg_endipdent(handle);
1417 
1418 	if (zonecfg_setfsent(handle) != Z_OK) {
1419 		zerror(zlogp, B_FALSE, "invalid configuration");
1420 		goto bad;
1421 	}
1422 	while (zonecfg_getfsent(handle, &fstab) == Z_OK) {
1423 		/*
1424 		 * ZFS filesystems will not be accessible under an alternate
1425 		 * root, since the pool will not be known.  Ignore them in this
1426 		 * case.
1427 		 */
1428 		if (mount_cmd && strcmp(fstab.zone_fs_type, MNTTYPE_ZFS) == 0)
1429 			continue;
1430 
1431 		num_fs++;
1432 		if ((tmp_ptr = realloc(fs_ptr,
1433 		    num_fs * sizeof (*tmp_ptr))) == NULL) {
1434 			zerror(zlogp, B_TRUE, "memory allocation failed");
1435 			num_fs--;
1436 			(void) zonecfg_endfsent(handle);
1437 			goto bad;
1438 		}
1439 		fs_ptr = tmp_ptr;
1440 		fsp = &fs_ptr[num_fs - 1];
1441 		(void) strlcpy(fsp->zone_fs_dir,
1442 		    fstab.zone_fs_dir, sizeof (fsp->zone_fs_dir));
1443 		(void) strlcpy(fsp->zone_fs_special, fstab.zone_fs_special,
1444 		    sizeof (fsp->zone_fs_special));
1445 		(void) strlcpy(fsp->zone_fs_raw, fstab.zone_fs_raw,
1446 		    sizeof (fsp->zone_fs_raw));
1447 		(void) strlcpy(fsp->zone_fs_type, fstab.zone_fs_type,
1448 		    sizeof (fsp->zone_fs_type));
1449 		fsp->zone_fs_options = fstab.zone_fs_options;
1450 	}
1451 	(void) zonecfg_endfsent(handle);
1452 	zonecfg_fini_handle(handle);
1453 	handle = NULL;
1454 
1455 	/*
1456 	 * If we're mounting a zone for administration, then we need to set up
1457 	 * the "/a" environment inside the zone so that the commands that run
1458 	 * in there have access to both the running system's utilities and the
1459 	 * to-be-modified zone's files.
1460 	 */
1461 	if (mount_cmd &&
1462 	    !build_mounted(zlogp, rootpath, sizeof (rootpath), zonepath))
1463 		goto bad;
1464 
1465 	qsort(fs_ptr, num_fs, sizeof (*fs_ptr), fs_compare);
1466 	for (i = 0; i < num_fs; i++) {
1467 		if (mount_cmd && strcmp(fs_ptr[i].zone_fs_dir, "/dev") == 0) {
1468 			size_t slen = strlen(rootpath) - 2;
1469 
1470 			/* /dev is special and always goes at the top */
1471 			rootpath[slen] = '\0';
1472 			if (mount_one(zlogp, &fs_ptr[i], rootpath) != 0)
1473 				goto bad;
1474 			rootpath[slen] = '/';
1475 			continue;
1476 		}
1477 		if (mount_one(zlogp, &fs_ptr[i], rootpath) != 0)
1478 			goto bad;
1479 	}
1480 	free_fs_data(fs_ptr, num_fs);
1481 
1482 	/*
1483 	 * Everything looks fine.
1484 	 */
1485 	return (0);
1486 
1487 bad:
1488 	if (handle != NULL)
1489 		zonecfg_fini_handle(handle);
1490 	free_fs_data(fs_ptr, num_fs);
1491 	return (-1);
1492 }
1493 
1494 /* caller makes sure neither parameter is NULL */
1495 static int
1496 addr2netmask(char *prefixstr, int maxprefixlen, uchar_t *maskstr)
1497 {
1498 	int prefixlen;
1499 
1500 	prefixlen = atoi(prefixstr);
1501 	if (prefixlen < 0 || prefixlen > maxprefixlen)
1502 		return (1);
1503 	while (prefixlen > 0) {
1504 		if (prefixlen >= 8) {
1505 			*maskstr++ = 0xFF;
1506 			prefixlen -= 8;
1507 			continue;
1508 		}
1509 		*maskstr |= 1 << (8 - prefixlen);
1510 		prefixlen--;
1511 	}
1512 	return (0);
1513 }
1514 
1515 /*
1516  * Tear down all interfaces belonging to the given zone.  This should
1517  * be called with the zone in a state other than "running", so that
1518  * interfaces can't be assigned to the zone after this returns.
1519  *
1520  * If anything goes wrong, log an error message and return an error.
1521  */
1522 static int
1523 unconfigure_network_interfaces(zlog_t *zlogp, zoneid_t zone_id)
1524 {
1525 	struct lifnum lifn;
1526 	struct lifconf lifc;
1527 	struct lifreq *lifrp, lifrl;
1528 	int64_t lifc_flags = LIFC_NOXMIT | LIFC_ALLZONES;
1529 	int num_ifs, s, i, ret_code = 0;
1530 	uint_t bufsize;
1531 	char *buf = NULL;
1532 
1533 	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
1534 		zerror(zlogp, B_TRUE, "could not get socket");
1535 		ret_code = -1;
1536 		goto bad;
1537 	}
1538 	lifn.lifn_family = AF_UNSPEC;
1539 	lifn.lifn_flags = (int)lifc_flags;
1540 	if (ioctl(s, SIOCGLIFNUM, (char *)&lifn) < 0) {
1541 		zerror(zlogp, B_TRUE,
1542 		    "could not determine number of interfaces");
1543 		ret_code = -1;
1544 		goto bad;
1545 	}
1546 	num_ifs = lifn.lifn_count;
1547 	bufsize = num_ifs * sizeof (struct lifreq);
1548 	if ((buf = malloc(bufsize)) == NULL) {
1549 		zerror(zlogp, B_TRUE, "memory allocation failed");
1550 		ret_code = -1;
1551 		goto bad;
1552 	}
1553 	lifc.lifc_family = AF_UNSPEC;
1554 	lifc.lifc_flags = (int)lifc_flags;
1555 	lifc.lifc_len = bufsize;
1556 	lifc.lifc_buf = buf;
1557 	if (ioctl(s, SIOCGLIFCONF, (char *)&lifc) < 0) {
1558 		zerror(zlogp, B_TRUE, "could not get configured interfaces");
1559 		ret_code = -1;
1560 		goto bad;
1561 	}
1562 	lifrp = lifc.lifc_req;
1563 	for (i = lifc.lifc_len / sizeof (struct lifreq); i > 0; i--, lifrp++) {
1564 		(void) close(s);
1565 		if ((s = socket(lifrp->lifr_addr.ss_family, SOCK_DGRAM, 0)) <
1566 		    0) {
1567 			zerror(zlogp, B_TRUE, "%s: could not get socket",
1568 			    lifrl.lifr_name);
1569 			ret_code = -1;
1570 			continue;
1571 		}
1572 		(void) memset(&lifrl, 0, sizeof (lifrl));
1573 		(void) strncpy(lifrl.lifr_name, lifrp->lifr_name,
1574 		    sizeof (lifrl.lifr_name));
1575 		if (ioctl(s, SIOCGLIFZONE, (caddr_t)&lifrl) < 0) {
1576 			zerror(zlogp, B_TRUE,
1577 			    "%s: could not determine zone interface belongs to",
1578 			    lifrl.lifr_name);
1579 			ret_code = -1;
1580 			continue;
1581 		}
1582 		if (lifrl.lifr_zoneid == zone_id) {
1583 			if (ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifrl) < 0) {
1584 				zerror(zlogp, B_TRUE,
1585 				    "%s: could not remove interface",
1586 				    lifrl.lifr_name);
1587 				ret_code = -1;
1588 				continue;
1589 			}
1590 		}
1591 	}
1592 bad:
1593 	if (s > 0)
1594 		(void) close(s);
1595 	if (buf)
1596 		free(buf);
1597 	return (ret_code);
1598 }
1599 
1600 static union	sockunion {
1601 	struct	sockaddr sa;
1602 	struct	sockaddr_in sin;
1603 	struct	sockaddr_dl sdl;
1604 	struct	sockaddr_in6 sin6;
1605 } so_dst, so_ifp;
1606 
1607 static struct {
1608 	struct	rt_msghdr hdr;
1609 	char	space[512];
1610 } rtmsg;
1611 
1612 static int
1613 salen(struct sockaddr *sa)
1614 {
1615 	switch (sa->sa_family) {
1616 	case AF_INET:
1617 		return (sizeof (struct sockaddr_in));
1618 	case AF_LINK:
1619 		return (sizeof (struct sockaddr_dl));
1620 	case AF_INET6:
1621 		return (sizeof (struct sockaddr_in6));
1622 	default:
1623 		return (sizeof (struct sockaddr));
1624 	}
1625 }
1626 
1627 #define	ROUNDUP_LONG(a) \
1628 	((a) > 0 ? (1 + (((a) - 1) | (sizeof (long) - 1))) : sizeof (long))
1629 
1630 /*
1631  * Look up which zone is using a given IP address.  The address in question
1632  * is expected to have been stuffed into the structure to which lifr points
1633  * via a previous SIOCGLIFADDR ioctl().
1634  *
1635  * This is done using black router socket magic.
1636  *
1637  * Return the name of the zone on success or NULL on failure.
1638  *
1639  * This is a lot of code for a simple task; a new ioctl request to take care
1640  * of this might be a useful RFE.
1641  */
1642 
1643 static char *
1644 who_is_using(zlog_t *zlogp, struct lifreq *lifr)
1645 {
1646 	static char answer[ZONENAME_MAX];
1647 	pid_t pid;
1648 	int s, rlen, l, i;
1649 	char *cp = rtmsg.space;
1650 	struct sockaddr_dl *ifp = NULL;
1651 	struct sockaddr *sa;
1652 	char save_if_name[LIFNAMSIZ];
1653 
1654 	answer[0] = '\0';
1655 
1656 	pid = getpid();
1657 	if ((s = socket(PF_ROUTE, SOCK_RAW, 0)) < 0) {
1658 		zerror(zlogp, B_TRUE, "could not get routing socket");
1659 		return (NULL);
1660 	}
1661 
1662 	if (lifr->lifr_addr.ss_family == AF_INET) {
1663 		struct sockaddr_in *sin4;
1664 
1665 		so_dst.sa.sa_family = AF_INET;
1666 		sin4 = (struct sockaddr_in *)&lifr->lifr_addr;
1667 		so_dst.sin.sin_addr = sin4->sin_addr;
1668 	} else {
1669 		struct sockaddr_in6 *sin6;
1670 
1671 		so_dst.sa.sa_family = AF_INET6;
1672 		sin6 = (struct sockaddr_in6 *)&lifr->lifr_addr;
1673 		so_dst.sin6.sin6_addr = sin6->sin6_addr;
1674 	}
1675 
1676 	so_ifp.sa.sa_family = AF_LINK;
1677 
1678 	(void) memset(&rtmsg, 0, sizeof (rtmsg));
1679 	rtmsg.hdr.rtm_type = RTM_GET;
1680 	rtmsg.hdr.rtm_flags = RTF_UP | RTF_HOST;
1681 	rtmsg.hdr.rtm_version = RTM_VERSION;
1682 	rtmsg.hdr.rtm_seq = ++rts_seqno;
1683 	rtmsg.hdr.rtm_addrs = RTA_IFP | RTA_DST;
1684 
1685 	l = ROUNDUP_LONG(salen(&so_dst.sa));
1686 	(void) memmove(cp, &(so_dst), l);
1687 	cp += l;
1688 	l = ROUNDUP_LONG(salen(&so_ifp.sa));
1689 	(void) memmove(cp, &(so_ifp), l);
1690 	cp += l;
1691 
1692 	rtmsg.hdr.rtm_msglen = l = cp - (char *)&rtmsg;
1693 
1694 	if ((rlen = write(s, &rtmsg, l)) < 0) {
1695 		zerror(zlogp, B_TRUE, "writing to routing socket");
1696 		return (NULL);
1697 	} else if (rlen < (int)rtmsg.hdr.rtm_msglen) {
1698 		zerror(zlogp, B_TRUE,
1699 		    "write to routing socket got only %d for len\n", rlen);
1700 		return (NULL);
1701 	}
1702 	do {
1703 		l = read(s, &rtmsg, sizeof (rtmsg));
1704 	} while (l > 0 && (rtmsg.hdr.rtm_seq != rts_seqno ||
1705 	    rtmsg.hdr.rtm_pid != pid));
1706 	if (l < 0) {
1707 		zerror(zlogp, B_TRUE, "reading from routing socket");
1708 		return (NULL);
1709 	}
1710 
1711 	if (rtmsg.hdr.rtm_version != RTM_VERSION) {
1712 		zerror(zlogp, B_FALSE,
1713 		    "routing message version %d not understood",
1714 		    rtmsg.hdr.rtm_version);
1715 		return (NULL);
1716 	}
1717 	if (rtmsg.hdr.rtm_msglen != (ushort_t)l) {
1718 		zerror(zlogp, B_FALSE, "message length mismatch, "
1719 		    "expected %d bytes, returned %d bytes",
1720 		    rtmsg.hdr.rtm_msglen, l);
1721 		return (NULL);
1722 	}
1723 	if (rtmsg.hdr.rtm_errno != 0)  {
1724 		errno = rtmsg.hdr.rtm_errno;
1725 		zerror(zlogp, B_TRUE, "RTM_GET routing socket message");
1726 		return (NULL);
1727 	}
1728 	if ((rtmsg.hdr.rtm_addrs & RTA_IFP) == 0) {
1729 		zerror(zlogp, B_FALSE, "interface not found");
1730 		return (NULL);
1731 	}
1732 	cp = ((char *)(&rtmsg.hdr + 1));
1733 	for (i = 1; i != 0; i <<= 1) {
1734 		/* LINTED E_BAD_PTR_CAST_ALIGN */
1735 		sa = (struct sockaddr *)cp;
1736 		if (i != RTA_IFP) {
1737 			if ((i & rtmsg.hdr.rtm_addrs) != 0)
1738 				cp += ROUNDUP_LONG(salen(sa));
1739 			continue;
1740 		}
1741 		if (sa->sa_family == AF_LINK &&
1742 		    ((struct sockaddr_dl *)sa)->sdl_nlen != 0)
1743 			ifp = (struct sockaddr_dl *)sa;
1744 		break;
1745 	}
1746 	if (ifp == NULL) {
1747 		zerror(zlogp, B_FALSE, "interface could not be determined");
1748 		return (NULL);
1749 	}
1750 
1751 	/*
1752 	 * We need to set the I/F name to what we got above, then do the
1753 	 * appropriate ioctl to get its zone name.  But lifr->lifr_name is
1754 	 * used by the calling function to do a REMOVEIF, so if we leave the
1755 	 * "good" zone's I/F name in place, *that* I/F will be removed instead
1756 	 * of the bad one.  So we save the old (bad) I/F name before over-
1757 	 * writing it and doing the ioctl, then restore it after the ioctl.
1758 	 */
1759 	(void) strlcpy(save_if_name, lifr->lifr_name, sizeof (save_if_name));
1760 	(void) strncpy(lifr->lifr_name, ifp->sdl_data, ifp->sdl_nlen);
1761 	lifr->lifr_name[ifp->sdl_nlen] = '\0';
1762 	i = ioctl(s, SIOCGLIFZONE, lifr);
1763 	(void) strlcpy(lifr->lifr_name, save_if_name, sizeof (save_if_name));
1764 	if (i < 0) {
1765 		zerror(zlogp, B_TRUE,
1766 		    "%s: could not determine the zone interface belongs to",
1767 		    lifr->lifr_name);
1768 		return (NULL);
1769 	}
1770 	if (getzonenamebyid(lifr->lifr_zoneid, answer, sizeof (answer)) < 0)
1771 		(void) snprintf(answer, sizeof (answer), "%d",
1772 		    lifr->lifr_zoneid);
1773 
1774 	if (strlen(answer) > 0)
1775 		return (answer);
1776 	return (NULL);
1777 }
1778 
1779 typedef struct mcast_rtmsg_s {
1780 	struct rt_msghdr	m_rtm;
1781 	union {
1782 		struct {
1783 			struct sockaddr_in	m_dst;
1784 			struct sockaddr_in	m_gw;
1785 			struct sockaddr_in	m_netmask;
1786 		} m_v4;
1787 		struct {
1788 			struct sockaddr_in6	m_dst;
1789 			struct sockaddr_in6	m_gw;
1790 			struct sockaddr_in6	m_netmask;
1791 		} m_v6;
1792 	} m_u;
1793 } mcast_rtmsg_t;
1794 #define	m_dst4		m_u.m_v4.m_dst
1795 #define	m_dst6		m_u.m_v6.m_dst
1796 #define	m_gw4		m_u.m_v4.m_gw
1797 #define	m_gw6		m_u.m_v6.m_gw
1798 #define	m_netmask4	m_u.m_v4.m_netmask
1799 #define	m_netmask6	m_u.m_v6.m_netmask
1800 
1801 /*
1802  * Configures a single interface: a new virtual interface is added, based on
1803  * the physical interface nwiftabptr->zone_nwif_physical, with the address
1804  * specified in nwiftabptr->zone_nwif_address, for zone zone_id.  Note that
1805  * the "address" can be an IPv6 address (with a /prefixlength required), an
1806  * IPv4 address (with a /prefixlength optional), or a name; for the latter,
1807  * an IPv4 name-to-address resolution will be attempted.
1808  *
1809  * A default interface route for multicast is created on the first IPv4 and
1810  * IPv6 interfaces (that have the IFF_MULTICAST flag set), respectively.
1811  * This should really be done in the init scripts if we ever allow zones to
1812  * modify the routing tables.
1813  *
1814  * If anything goes wrong, we log an detailed error message, attempt to tear
1815  * down whatever we set up and return an error.
1816  */
1817 static int
1818 configure_one_interface(zlog_t *zlogp, zoneid_t zone_id,
1819     struct zone_nwiftab *nwiftabptr, boolean_t *mcast_rt_v4_setp,
1820     boolean_t *mcast_rt_v6_setp)
1821 {
1822 	struct lifreq lifr;
1823 	struct sockaddr_in netmask4;
1824 	struct sockaddr_in6 netmask6;
1825 	struct in_addr in4;
1826 	struct in6_addr in6;
1827 	sa_family_t af;
1828 	char *slashp = strchr(nwiftabptr->zone_nwif_address, '/');
1829 	mcast_rtmsg_t mcast_rtmsg;
1830 	int s;
1831 	int rs;
1832 	int rlen;
1833 	boolean_t got_netmask = B_FALSE;
1834 	char addrstr4[INET_ADDRSTRLEN];
1835 	int res;
1836 
1837 	res = zonecfg_valid_net_address(nwiftabptr->zone_nwif_address, &lifr);
1838 	if (res != Z_OK) {
1839 		zerror(zlogp, B_FALSE, "%s: %s", zonecfg_strerror(res),
1840 		    nwiftabptr->zone_nwif_address);
1841 		return (-1);
1842 	}
1843 	af = lifr.lifr_addr.ss_family;
1844 	if (af == AF_INET)
1845 		in4 = ((struct sockaddr_in *)(&lifr.lifr_addr))->sin_addr;
1846 	else
1847 		in6 = ((struct sockaddr_in6 *)(&lifr.lifr_addr))->sin6_addr;
1848 
1849 	if ((s = socket(af, SOCK_DGRAM, 0)) < 0) {
1850 		zerror(zlogp, B_TRUE, "could not get socket");
1851 		return (-1);
1852 	}
1853 
1854 	(void) strlcpy(lifr.lifr_name, nwiftabptr->zone_nwif_physical,
1855 	    sizeof (lifr.lifr_name));
1856 	if (ioctl(s, SIOCLIFADDIF, (caddr_t)&lifr) < 0) {
1857 		zerror(zlogp, B_TRUE, "%s: could not add interface",
1858 		    lifr.lifr_name);
1859 		(void) close(s);
1860 		return (-1);
1861 	}
1862 
1863 	if (ioctl(s, SIOCSLIFADDR, (caddr_t)&lifr) < 0) {
1864 		zerror(zlogp, B_TRUE,
1865 		    "%s: could not set IP address to %s",
1866 		    lifr.lifr_name, nwiftabptr->zone_nwif_address);
1867 		goto bad;
1868 	}
1869 
1870 	/* Preserve literal IPv4 address for later potential printing. */
1871 	if (af == AF_INET)
1872 		(void) inet_ntop(AF_INET, &in4, addrstr4, INET_ADDRSTRLEN);
1873 
1874 	lifr.lifr_zoneid = zone_id;
1875 	if (ioctl(s, SIOCSLIFZONE, (caddr_t)&lifr) < 0) {
1876 		zerror(zlogp, B_TRUE, "%s: could not place interface into zone",
1877 		    lifr.lifr_name);
1878 		goto bad;
1879 	}
1880 
1881 	if (strcmp(nwiftabptr->zone_nwif_physical, "lo0") == 0) {
1882 		got_netmask = B_TRUE;	/* default setting will be correct */
1883 	} else {
1884 		if (af == AF_INET) {
1885 			/*
1886 			 * The IPv4 netmask can be determined either
1887 			 * directly if a prefix length was supplied with
1888 			 * the address or via the netmasks database.  Not
1889 			 * being able to determine it is a common failure,
1890 			 * but it often is not fatal to operation of the
1891 			 * interface.  In that case, a warning will be
1892 			 * printed after the rest of the interface's
1893 			 * parameters have been configured.
1894 			 */
1895 			(void) memset(&netmask4, 0, sizeof (netmask4));
1896 			if (slashp != NULL) {
1897 				if (addr2netmask(slashp + 1, V4_ADDR_LEN,
1898 				    (uchar_t *)&netmask4.sin_addr) != 0) {
1899 					*slashp = '/';
1900 					zerror(zlogp, B_FALSE,
1901 					    "%s: invalid prefix length in %s",
1902 					    lifr.lifr_name,
1903 					    nwiftabptr->zone_nwif_address);
1904 					goto bad;
1905 				}
1906 				got_netmask = B_TRUE;
1907 			} else if (getnetmaskbyaddr(in4,
1908 			    &netmask4.sin_addr) == 0) {
1909 				got_netmask = B_TRUE;
1910 			}
1911 			if (got_netmask) {
1912 				netmask4.sin_family = af;
1913 				(void) memcpy(&lifr.lifr_addr, &netmask4,
1914 				    sizeof (netmask4));
1915 			}
1916 		} else {
1917 			(void) memset(&netmask6, 0, sizeof (netmask6));
1918 			if (addr2netmask(slashp + 1, V6_ADDR_LEN,
1919 			    (uchar_t *)&netmask6.sin6_addr) != 0) {
1920 				*slashp = '/';
1921 				zerror(zlogp, B_FALSE,
1922 				    "%s: invalid prefix length in %s",
1923 				    lifr.lifr_name,
1924 				    nwiftabptr->zone_nwif_address);
1925 				goto bad;
1926 			}
1927 			got_netmask = B_TRUE;
1928 			netmask6.sin6_family = af;
1929 			(void) memcpy(&lifr.lifr_addr, &netmask6,
1930 			    sizeof (netmask6));
1931 		}
1932 		if (got_netmask &&
1933 		    ioctl(s, SIOCSLIFNETMASK, (caddr_t)&lifr) < 0) {
1934 			zerror(zlogp, B_TRUE, "%s: could not set netmask",
1935 			    lifr.lifr_name);
1936 			goto bad;
1937 		}
1938 
1939 		/*
1940 		 * This doesn't set the broadcast address at all. Rather, it
1941 		 * gets, then sets the interface's address, relying on the fact
1942 		 * that resetting the address will reset the broadcast address.
1943 		 */
1944 		if (ioctl(s, SIOCGLIFADDR, (caddr_t)&lifr) < 0) {
1945 			zerror(zlogp, B_TRUE, "%s: could not get address",
1946 			    lifr.lifr_name);
1947 			goto bad;
1948 		}
1949 		if (ioctl(s, SIOCSLIFADDR, (caddr_t)&lifr) < 0) {
1950 			zerror(zlogp, B_TRUE,
1951 			    "%s: could not reset broadcast address",
1952 			    lifr.lifr_name);
1953 			goto bad;
1954 		}
1955 	}
1956 
1957 	if (ioctl(s, SIOCGLIFFLAGS, (caddr_t)&lifr) < 0) {
1958 		zerror(zlogp, B_TRUE, "%s: could not get flags",
1959 		    lifr.lifr_name);
1960 		goto bad;
1961 	}
1962 	lifr.lifr_flags |= IFF_UP;
1963 	if (ioctl(s, SIOCSLIFFLAGS, (caddr_t)&lifr) < 0) {
1964 		int save_errno = errno;
1965 		char *zone_using;
1966 
1967 		/*
1968 		 * If we failed with something other than EADDRNOTAVAIL,
1969 		 * then skip to the end.  Otherwise, look up our address,
1970 		 * then call a function to determine which zone is already
1971 		 * using that address.
1972 		 */
1973 		if (errno != EADDRNOTAVAIL) {
1974 			zerror(zlogp, B_TRUE,
1975 			    "%s: could not bring interface up", lifr.lifr_name);
1976 			goto bad;
1977 		}
1978 		if (ioctl(s, SIOCGLIFADDR, (caddr_t)&lifr) < 0) {
1979 			zerror(zlogp, B_TRUE, "%s: could not get address",
1980 			    lifr.lifr_name);
1981 			goto bad;
1982 		}
1983 		zone_using = who_is_using(zlogp, &lifr);
1984 		errno = save_errno;
1985 		if (zone_using == NULL)
1986 			zerror(zlogp, B_TRUE,
1987 			    "%s: could not bring interface up", lifr.lifr_name);
1988 		else
1989 			zerror(zlogp, B_TRUE, "%s: could not bring interface "
1990 			    "up: address in use by zone '%s'", lifr.lifr_name,
1991 			    zone_using);
1992 		goto bad;
1993 	}
1994 	if ((lifr.lifr_flags & IFF_MULTICAST) && ((af == AF_INET &&
1995 	    mcast_rt_v4_setp != NULL && *mcast_rt_v4_setp == B_FALSE) ||
1996 	    (af == AF_INET6 &&
1997 	    mcast_rt_v6_setp != NULL && *mcast_rt_v6_setp == B_FALSE))) {
1998 		rs = socket(PF_ROUTE, SOCK_RAW, 0);
1999 		if (rs < 0) {
2000 			zerror(zlogp, B_TRUE, "%s: could not create "
2001 			    "routing socket", lifr.lifr_name);
2002 			goto bad;
2003 		}
2004 		(void) shutdown(rs, 0);
2005 		(void) memset((void *)&mcast_rtmsg, 0, sizeof (mcast_rtmsg_t));
2006 		mcast_rtmsg.m_rtm.rtm_msglen =  sizeof (struct rt_msghdr) +
2007 		    3 * (af == AF_INET ? sizeof (struct sockaddr_in) :
2008 		    sizeof (struct sockaddr_in6));
2009 		mcast_rtmsg.m_rtm.rtm_version = RTM_VERSION;
2010 		mcast_rtmsg.m_rtm.rtm_type = RTM_ADD;
2011 		mcast_rtmsg.m_rtm.rtm_flags = RTF_UP;
2012 		mcast_rtmsg.m_rtm.rtm_addrs =
2013 		    RTA_DST | RTA_GATEWAY | RTA_NETMASK;
2014 		mcast_rtmsg.m_rtm.rtm_seq = ++rts_seqno;
2015 		if (af == AF_INET) {
2016 			mcast_rtmsg.m_dst4.sin_family = AF_INET;
2017 			mcast_rtmsg.m_dst4.sin_addr.s_addr =
2018 			    htonl(INADDR_UNSPEC_GROUP);
2019 			mcast_rtmsg.m_gw4.sin_family = AF_INET;
2020 			mcast_rtmsg.m_gw4.sin_addr = in4;
2021 			mcast_rtmsg.m_netmask4.sin_family = AF_INET;
2022 			mcast_rtmsg.m_netmask4.sin_addr.s_addr =
2023 			    htonl(IN_CLASSD_NET);
2024 		} else {
2025 			mcast_rtmsg.m_dst6.sin6_family = AF_INET6;
2026 			mcast_rtmsg.m_dst6.sin6_addr.s6_addr[0] = 0xffU;
2027 			mcast_rtmsg.m_gw6.sin6_family = AF_INET6;
2028 			mcast_rtmsg.m_gw6.sin6_addr = in6;
2029 			mcast_rtmsg.m_netmask6.sin6_family = AF_INET6;
2030 			mcast_rtmsg.m_netmask6.sin6_addr.s6_addr[0] = 0xffU;
2031 		}
2032 		rlen = write(rs, (char *)&mcast_rtmsg,
2033 		    mcast_rtmsg.m_rtm.rtm_msglen);
2034 		if (rlen < mcast_rtmsg.m_rtm.rtm_msglen) {
2035 			if (rlen < 0) {
2036 				zerror(zlogp, B_TRUE, "%s: could not set "
2037 				    "default interface for multicast",
2038 				    lifr.lifr_name);
2039 			} else {
2040 				zerror(zlogp, B_FALSE, "%s: write to routing "
2041 				    "socket returned %d", lifr.lifr_name, rlen);
2042 			}
2043 			(void) close(rs);
2044 			goto bad;
2045 		}
2046 		if (af == AF_INET) {
2047 			*mcast_rt_v4_setp = B_TRUE;
2048 		} else {
2049 			*mcast_rt_v6_setp = B_TRUE;
2050 		}
2051 		(void) close(rs);
2052 	}
2053 
2054 	if (!got_netmask) {
2055 		/*
2056 		 * A common, but often non-fatal problem, is that the system
2057 		 * cannot find the netmask for an interface address. This is
2058 		 * often caused by it being only in /etc/inet/netmasks, but
2059 		 * /etc/nsswitch.conf says to use NIS or NIS+ and it's not
2060 		 * in that. This doesn't show up at boot because the netmask
2061 		 * is obtained from /etc/inet/netmasks when no network
2062 		 * interfaces are up, but isn't consulted when NIS/NIS+ is
2063 		 * available. We warn the user here that something like this
2064 		 * has happened and we're just running with a default and
2065 		 * possible incorrect netmask.
2066 		 */
2067 		char buffer[INET6_ADDRSTRLEN];
2068 		void  *addr;
2069 
2070 		if (af == AF_INET)
2071 			addr = &((struct sockaddr_in *)
2072 			    (&lifr.lifr_addr))->sin_addr;
2073 		else
2074 			addr = &((struct sockaddr_in6 *)
2075 			    (&lifr.lifr_addr))->sin6_addr;
2076 
2077 		/* Find out what netmask interface is going to be using */
2078 		if (ioctl(s, SIOCGLIFNETMASK, (caddr_t)&lifr) < 0 ||
2079 		    inet_ntop(af, addr, buffer, sizeof (buffer)) == NULL)
2080 			goto bad;
2081 		zerror(zlogp, B_FALSE,
2082 		    "WARNING: %s: no matching subnet found in netmasks(4) for "
2083 		    "%s; using default of %s.",
2084 		    lifr.lifr_name, addrstr4, buffer);
2085 	}
2086 
2087 	(void) close(s);
2088 	return (Z_OK);
2089 bad:
2090 	(void) ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifr);
2091 	(void) close(s);
2092 	return (-1);
2093 }
2094 
2095 /*
2096  * Sets up network interfaces based on information from the zone configuration.
2097  * An IPv4 loopback interface is set up "for free", modeling the global system.
2098  * If any of the configuration interfaces were IPv6, then an IPv6 loopback
2099  * address is set up as well.
2100  *
2101  * If anything goes wrong, we log a general error message, attempt to tear down
2102  * whatever we set up, and return an error.
2103  */
2104 static int
2105 configure_network_interfaces(zlog_t *zlogp)
2106 {
2107 	zone_dochandle_t handle;
2108 	struct zone_nwiftab nwiftab, loopback_iftab;
2109 	boolean_t saw_v6 = B_FALSE;
2110 	boolean_t mcast_rt_v4_set = B_FALSE;
2111 	boolean_t mcast_rt_v6_set = B_FALSE;
2112 	zoneid_t zoneid;
2113 
2114 	if ((zoneid = getzoneidbyname(zone_name)) == ZONE_ID_UNDEFINED) {
2115 		zerror(zlogp, B_TRUE, "unable to get zoneid");
2116 		return (-1);
2117 	}
2118 
2119 	if ((handle = zonecfg_init_handle()) == NULL) {
2120 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
2121 		return (-1);
2122 	}
2123 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2124 		zerror(zlogp, B_FALSE, "invalid configuration");
2125 		zonecfg_fini_handle(handle);
2126 		return (-1);
2127 	}
2128 	if (zonecfg_setnwifent(handle) == Z_OK) {
2129 		for (;;) {
2130 			struct in6_addr in6;
2131 
2132 			if (zonecfg_getnwifent(handle, &nwiftab) != Z_OK)
2133 				break;
2134 			if (configure_one_interface(zlogp, zoneid,
2135 			    &nwiftab, &mcast_rt_v4_set, &mcast_rt_v6_set) !=
2136 			    Z_OK) {
2137 				(void) zonecfg_endnwifent(handle);
2138 				zonecfg_fini_handle(handle);
2139 				return (-1);
2140 			}
2141 			if (inet_pton(AF_INET6, nwiftab.zone_nwif_address,
2142 			    &in6) == 1)
2143 				saw_v6 = B_TRUE;
2144 		}
2145 		(void) zonecfg_endnwifent(handle);
2146 	}
2147 	zonecfg_fini_handle(handle);
2148 	(void) strlcpy(loopback_iftab.zone_nwif_physical, "lo0",
2149 	    sizeof (loopback_iftab.zone_nwif_physical));
2150 	(void) strlcpy(loopback_iftab.zone_nwif_address, "127.0.0.1",
2151 	    sizeof (loopback_iftab.zone_nwif_address));
2152 	if (configure_one_interface(zlogp, zoneid, &loopback_iftab, NULL, NULL)
2153 	    != Z_OK) {
2154 		return (-1);
2155 	}
2156 	if (saw_v6) {
2157 		(void) strlcpy(loopback_iftab.zone_nwif_address, "::1/128",
2158 		    sizeof (loopback_iftab.zone_nwif_address));
2159 		if (configure_one_interface(zlogp, zoneid,
2160 		    &loopback_iftab, NULL, NULL) != Z_OK) {
2161 			return (-1);
2162 		}
2163 	}
2164 	return (0);
2165 }
2166 
2167 static int
2168 tcp_abort_conn(zlog_t *zlogp, zoneid_t zoneid,
2169     const struct sockaddr_storage *local, const struct sockaddr_storage *remote)
2170 {
2171 	int fd;
2172 	struct strioctl ioc;
2173 	tcp_ioc_abort_conn_t conn;
2174 	int error;
2175 
2176 	conn.ac_local = *local;
2177 	conn.ac_remote = *remote;
2178 	conn.ac_start = TCPS_SYN_SENT;
2179 	conn.ac_end = TCPS_TIME_WAIT;
2180 	conn.ac_zoneid = zoneid;
2181 
2182 	ioc.ic_cmd = TCP_IOC_ABORT_CONN;
2183 	ioc.ic_timout = -1; /* infinite timeout */
2184 	ioc.ic_len = sizeof (conn);
2185 	ioc.ic_dp = (char *)&conn;
2186 
2187 	if ((fd = open("/dev/tcp", O_RDONLY)) < 0) {
2188 		zerror(zlogp, B_TRUE, "unable to open %s", "/dev/tcp");
2189 		return (-1);
2190 	}
2191 
2192 	error = ioctl(fd, I_STR, &ioc);
2193 	(void) close(fd);
2194 	if (error == 0 || errno == ENOENT)	/* ENOENT is not an error */
2195 		return (0);
2196 	return (-1);
2197 }
2198 
2199 static int
2200 tcp_abort_connections(zlog_t *zlogp, zoneid_t zoneid)
2201 {
2202 	struct sockaddr_storage l, r;
2203 	struct sockaddr_in *local, *remote;
2204 	struct sockaddr_in6 *local6, *remote6;
2205 	int error;
2206 
2207 	/*
2208 	 * Abort IPv4 connections.
2209 	 */
2210 	bzero(&l, sizeof (*local));
2211 	local = (struct sockaddr_in *)&l;
2212 	local->sin_family = AF_INET;
2213 	local->sin_addr.s_addr = INADDR_ANY;
2214 	local->sin_port = 0;
2215 
2216 	bzero(&r, sizeof (*remote));
2217 	remote = (struct sockaddr_in *)&r;
2218 	remote->sin_family = AF_INET;
2219 	remote->sin_addr.s_addr = INADDR_ANY;
2220 	remote->sin_port = 0;
2221 
2222 	if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
2223 		return (error);
2224 
2225 	/*
2226 	 * Abort IPv6 connections.
2227 	 */
2228 	bzero(&l, sizeof (*local6));
2229 	local6 = (struct sockaddr_in6 *)&l;
2230 	local6->sin6_family = AF_INET6;
2231 	local6->sin6_port = 0;
2232 	local6->sin6_addr = in6addr_any;
2233 
2234 	bzero(&r, sizeof (*remote6));
2235 	remote6 = (struct sockaddr_in6 *)&r;
2236 	remote6->sin6_family = AF_INET6;
2237 	remote6->sin6_port = 0;
2238 	remote6->sin6_addr = in6addr_any;
2239 
2240 	if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
2241 		return (error);
2242 	return (0);
2243 }
2244 
2245 static int
2246 devfsadm_call(zlog_t *zlogp, const char *arg)
2247 {
2248 	char *argv[4];
2249 	int status;
2250 
2251 	argv[0] = DEVFSADM;
2252 	argv[1] = (char *)arg;
2253 	argv[2] = zone_name;
2254 	argv[3] = NULL;
2255 	status = forkexec(zlogp, DEVFSADM_PATH, argv);
2256 	if (status == 0 || status == -1)
2257 		return (status);
2258 	zerror(zlogp, B_FALSE, "%s call (%s %s %s) unexpectedly returned %d",
2259 		    DEVFSADM, DEVFSADM_PATH, arg, zone_name, status);
2260 	return (-1);
2261 }
2262 
2263 static int
2264 devfsadm_register(zlog_t *zlogp)
2265 {
2266 	/*
2267 	 * Ready the zone's devices.
2268 	 */
2269 	return (devfsadm_call(zlogp, "-z"));
2270 }
2271 
2272 static int
2273 devfsadm_unregister(zlog_t *zlogp)
2274 {
2275 	return (devfsadm_call(zlogp, "-Z"));
2276 }
2277 
2278 static int
2279 get_rctls(zlog_t *zlogp, char **bufp, size_t *bufsizep)
2280 {
2281 	nvlist_t *nvl = NULL;
2282 	char *nvl_packed = NULL;
2283 	size_t nvl_size = 0;
2284 	nvlist_t **nvlv = NULL;
2285 	int rctlcount = 0;
2286 	int error = -1;
2287 	zone_dochandle_t handle;
2288 	struct zone_rctltab rctltab;
2289 	rctlblk_t *rctlblk = NULL;
2290 
2291 	*bufp = NULL;
2292 	*bufsizep = 0;
2293 
2294 	if ((handle = zonecfg_init_handle()) == NULL) {
2295 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
2296 		return (-1);
2297 	}
2298 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2299 		zerror(zlogp, B_FALSE, "invalid configuration");
2300 		zonecfg_fini_handle(handle);
2301 		return (-1);
2302 	}
2303 
2304 	rctltab.zone_rctl_valptr = NULL;
2305 	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0) {
2306 		zerror(zlogp, B_TRUE, "%s failed", "nvlist_alloc");
2307 		goto out;
2308 	}
2309 
2310 	if (zonecfg_setrctlent(handle) != Z_OK) {
2311 		zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setrctlent");
2312 		goto out;
2313 	}
2314 
2315 	if ((rctlblk = malloc(rctlblk_size())) == NULL) {
2316 		zerror(zlogp, B_TRUE, "memory allocation failed");
2317 		goto out;
2318 	}
2319 	while (zonecfg_getrctlent(handle, &rctltab) == Z_OK) {
2320 		struct zone_rctlvaltab *rctlval;
2321 		uint_t i, count;
2322 		const char *name = rctltab.zone_rctl_name;
2323 
2324 		/* zoneadm should have already warned about unknown rctls. */
2325 		if (!zonecfg_is_rctl(name)) {
2326 			zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
2327 			rctltab.zone_rctl_valptr = NULL;
2328 			continue;
2329 		}
2330 		count = 0;
2331 		for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
2332 		    rctlval = rctlval->zone_rctlval_next) {
2333 			count++;
2334 		}
2335 		if (count == 0) {	/* ignore */
2336 			continue;	/* Nothing to free */
2337 		}
2338 		if ((nvlv = malloc(sizeof (*nvlv) * count)) == NULL)
2339 			goto out;
2340 		i = 0;
2341 		for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
2342 		    rctlval = rctlval->zone_rctlval_next, i++) {
2343 			if (nvlist_alloc(&nvlv[i], NV_UNIQUE_NAME, 0) != 0) {
2344 				zerror(zlogp, B_TRUE, "%s failed",
2345 				    "nvlist_alloc");
2346 				goto out;
2347 			}
2348 			if (zonecfg_construct_rctlblk(rctlval, rctlblk)
2349 			    != Z_OK) {
2350 				zerror(zlogp, B_FALSE, "invalid rctl value: "
2351 				    "(priv=%s,limit=%s,action=%s)",
2352 				    rctlval->zone_rctlval_priv,
2353 				    rctlval->zone_rctlval_limit,
2354 				    rctlval->zone_rctlval_action);
2355 				goto out;
2356 			}
2357 			if (!zonecfg_valid_rctl(name, rctlblk)) {
2358 				zerror(zlogp, B_FALSE,
2359 				    "(priv=%s,limit=%s,action=%s) is not a "
2360 				    "valid value for rctl '%s'",
2361 				    rctlval->zone_rctlval_priv,
2362 				    rctlval->zone_rctlval_limit,
2363 				    rctlval->zone_rctlval_action,
2364 				    name);
2365 				goto out;
2366 			}
2367 			if (nvlist_add_uint64(nvlv[i], "privilege",
2368 				    rctlblk_get_privilege(rctlblk)) != 0) {
2369 				zerror(zlogp, B_FALSE, "%s failed",
2370 				    "nvlist_add_uint64");
2371 				goto out;
2372 			}
2373 			if (nvlist_add_uint64(nvlv[i], "limit",
2374 				    rctlblk_get_value(rctlblk)) != 0) {
2375 				zerror(zlogp, B_FALSE, "%s failed",
2376 				    "nvlist_add_uint64");
2377 				goto out;
2378 			}
2379 			if (nvlist_add_uint64(nvlv[i], "action",
2380 			    (uint_t)rctlblk_get_local_action(rctlblk, NULL))
2381 			    != 0) {
2382 				zerror(zlogp, B_FALSE, "%s failed",
2383 				    "nvlist_add_uint64");
2384 				goto out;
2385 			}
2386 		}
2387 		zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
2388 		rctltab.zone_rctl_valptr = NULL;
2389 		if (nvlist_add_nvlist_array(nvl, (char *)name, nvlv, count)
2390 		    != 0) {
2391 			zerror(zlogp, B_FALSE, "%s failed",
2392 			    "nvlist_add_nvlist_array");
2393 			goto out;
2394 		}
2395 		for (i = 0; i < count; i++)
2396 			nvlist_free(nvlv[i]);
2397 		free(nvlv);
2398 		nvlv = NULL;
2399 		rctlcount++;
2400 	}
2401 	(void) zonecfg_endrctlent(handle);
2402 
2403 	if (rctlcount == 0) {
2404 		error = 0;
2405 		goto out;
2406 	}
2407 	if (nvlist_pack(nvl, &nvl_packed, &nvl_size, NV_ENCODE_NATIVE, 0)
2408 	    != 0) {
2409 		zerror(zlogp, B_FALSE, "%s failed", "nvlist_pack");
2410 		goto out;
2411 	}
2412 
2413 	error = 0;
2414 	*bufp = nvl_packed;
2415 	*bufsizep = nvl_size;
2416 
2417 out:
2418 	free(rctlblk);
2419 	zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
2420 	if (error && nvl_packed != NULL)
2421 		free(nvl_packed);
2422 	if (nvl != NULL)
2423 		nvlist_free(nvl);
2424 	if (nvlv != NULL)
2425 		free(nvlv);
2426 	if (handle != NULL)
2427 		zonecfg_fini_handle(handle);
2428 	return (error);
2429 }
2430 
2431 static int
2432 get_zone_pool(zlog_t *zlogp, char *poolbuf, size_t bufsz)
2433 {
2434 	zone_dochandle_t handle;
2435 	int error;
2436 
2437 	if ((handle = zonecfg_init_handle()) == NULL) {
2438 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
2439 		return (-1);
2440 	}
2441 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2442 		zerror(zlogp, B_FALSE, "invalid configuration");
2443 		zonecfg_fini_handle(handle);
2444 		return (-1);
2445 	}
2446 	error = zonecfg_get_pool(handle, poolbuf, bufsz);
2447 	zonecfg_fini_handle(handle);
2448 	return (error);
2449 }
2450 
2451 static int
2452 get_datasets(zlog_t *zlogp, char **bufp, size_t *bufsizep)
2453 {
2454 	zone_dochandle_t handle;
2455 	struct zone_dstab dstab;
2456 	size_t total, offset, len;
2457 	int error = -1;
2458 	char *str;
2459 
2460 	*bufp = NULL;
2461 	*bufsizep = 0;
2462 
2463 	if ((handle = zonecfg_init_handle()) == NULL) {
2464 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
2465 		return (-1);
2466 	}
2467 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2468 		zerror(zlogp, B_FALSE, "invalid configuration");
2469 		zonecfg_fini_handle(handle);
2470 		return (-1);
2471 	}
2472 
2473 	if (zonecfg_setdsent(handle) != Z_OK) {
2474 		zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
2475 		goto out;
2476 	}
2477 
2478 	total = 0;
2479 	while (zonecfg_getdsent(handle, &dstab) == Z_OK)
2480 		total += strlen(dstab.zone_dataset_name) + 1;
2481 	(void) zonecfg_enddsent(handle);
2482 
2483 	if (total == 0) {
2484 		error = 0;
2485 		goto out;
2486 	}
2487 
2488 	if ((str = malloc(total)) == NULL) {
2489 		zerror(zlogp, B_TRUE, "memory allocation failed");
2490 		goto out;
2491 	}
2492 
2493 	if (zonecfg_setdsent(handle) != Z_OK) {
2494 		zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
2495 		goto out;
2496 	}
2497 	offset = 0;
2498 	while (zonecfg_getdsent(handle, &dstab) == Z_OK) {
2499 		len = strlen(dstab.zone_dataset_name);
2500 		(void) strlcpy(str + offset, dstab.zone_dataset_name,
2501 		    sizeof (dstab.zone_dataset_name) - offset);
2502 		offset += len;
2503 		if (offset != total - 1)
2504 			str[offset++] = ',';
2505 	}
2506 	(void) zonecfg_enddsent(handle);
2507 
2508 	error = 0;
2509 	*bufp = str;
2510 	*bufsizep = total;
2511 
2512 out:
2513 	if (error != 0 && str != NULL)
2514 		free(str);
2515 	if (handle != NULL)
2516 		zonecfg_fini_handle(handle);
2517 
2518 	return (error);
2519 }
2520 
2521 /* ARGSUSED */
2522 static void
2523 zfs_error_handler(const char *fmt, va_list ap)
2524 {
2525 	/*
2526 	 * Do nothing - we interpret the failures from each libzfs call below.
2527 	 */
2528 }
2529 
2530 static int
2531 validate_datasets(zlog_t *zlogp)
2532 {
2533 	zone_dochandle_t handle;
2534 	struct zone_dstab dstab;
2535 	zfs_handle_t *zhp;
2536 
2537 	if ((handle = zonecfg_init_handle()) == NULL) {
2538 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
2539 		return (-1);
2540 	}
2541 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2542 		zerror(zlogp, B_FALSE, "invalid configuration");
2543 		zonecfg_fini_handle(handle);
2544 		return (-1);
2545 	}
2546 
2547 	if (zonecfg_setdsent(handle) != Z_OK) {
2548 		zerror(zlogp, B_FALSE, "invalid configuration");
2549 		zonecfg_fini_handle(handle);
2550 		return (-1);
2551 	}
2552 
2553 	zfs_set_error_handler(zfs_error_handler);
2554 
2555 	/*
2556 	 * libzfs opens /dev/zfs during its .init routine.
2557 	 * zoneadmd automatically closes these files when it daemonizes,
2558 	 * so we cheat by re-calling the init routine.
2559 	 */
2560 	zfs_init();
2561 
2562 	while (zonecfg_getdsent(handle, &dstab) == Z_OK) {
2563 
2564 		if ((zhp = zfs_open(dstab.zone_dataset_name,
2565 		    ZFS_TYPE_FILESYSTEM)) == NULL) {
2566 			zerror(zlogp, B_FALSE, "cannot open ZFS dataset '%s'",
2567 			    dstab.zone_dataset_name);
2568 			zonecfg_fini_handle(handle);
2569 			return (-1);
2570 		}
2571 
2572 		/*
2573 		 * Automatically set the 'zoned' property.  We check the value
2574 		 * first because we'll get EPERM if it is already set.
2575 		 */
2576 		if (!zfs_prop_get_int(zhp, ZFS_PROP_ZONED) &&
2577 		    zfs_prop_set(zhp, ZFS_PROP_ZONED, "on") != 0) {
2578 			zerror(zlogp, B_FALSE, "cannot set 'zoned' "
2579 			    "property for ZFS dataset '%s'\n",
2580 			    dstab.zone_dataset_name);
2581 			zonecfg_fini_handle(handle);
2582 			zfs_close(zhp);
2583 			return (-1);
2584 		}
2585 
2586 		zfs_close(zhp);
2587 	}
2588 	(void) zonecfg_enddsent(handle);
2589 
2590 	zonecfg_fini_handle(handle);
2591 
2592 	return (0);
2593 }
2594 
2595 static int
2596 bind_to_pool(zlog_t *zlogp, zoneid_t zoneid)
2597 {
2598 	pool_conf_t *poolconf;
2599 	pool_t *pool;
2600 	char poolname[MAXPATHLEN];
2601 	int status;
2602 	int error;
2603 
2604 	/*
2605 	 * Find the pool mentioned in the zone configuration, and bind to it.
2606 	 */
2607 	error = get_zone_pool(zlogp, poolname, sizeof (poolname));
2608 	if (error == Z_NO_ENTRY || (error == Z_OK && strlen(poolname) == 0)) {
2609 		/*
2610 		 * The property is not set on the zone, so the pool
2611 		 * should be bound to the default pool.  But that's
2612 		 * already done by the kernel, so we can just return.
2613 		 */
2614 		return (0);
2615 	}
2616 	if (error != Z_OK) {
2617 		/*
2618 		 * Not an error, even though it shouldn't be happening.
2619 		 */
2620 		zerror(zlogp, B_FALSE,
2621 		    "WARNING: unable to retrieve default pool.");
2622 		return (0);
2623 	}
2624 	/*
2625 	 * Don't do anything if pools aren't enabled.
2626 	 */
2627 	if (pool_get_status(&status) != PO_SUCCESS || status != POOL_ENABLED) {
2628 		zerror(zlogp, B_FALSE, "WARNING: pools facility not active; "
2629 		    "zone will not be bound to pool '%s'.", poolname);
2630 		return (0);
2631 	}
2632 	/*
2633 	 * Try to provide a sane error message if the requested pool doesn't
2634 	 * exist.
2635 	 */
2636 	if ((poolconf = pool_conf_alloc()) == NULL) {
2637 		zerror(zlogp, B_FALSE, "%s failed", "pool_conf_alloc");
2638 		return (-1);
2639 	}
2640 	if (pool_conf_open(poolconf, pool_dynamic_location(), PO_RDONLY) !=
2641 	    PO_SUCCESS) {
2642 		zerror(zlogp, B_FALSE, "%s failed", "pool_conf_open");
2643 		pool_conf_free(poolconf);
2644 		return (-1);
2645 	}
2646 	pool = pool_get_pool(poolconf, poolname);
2647 	(void) pool_conf_close(poolconf);
2648 	pool_conf_free(poolconf);
2649 	if (pool == NULL) {
2650 		zerror(zlogp, B_FALSE, "WARNING: pool '%s' not found; "
2651 		    "using default pool.", poolname);
2652 		return (0);
2653 	}
2654 	/*
2655 	 * Bind the zone to the pool.
2656 	 */
2657 	if (pool_set_binding(poolname, P_ZONEID, zoneid) != PO_SUCCESS) {
2658 		zerror(zlogp, B_FALSE, "WARNING: unable to bind to pool '%s'; "
2659 		    "using default pool.", poolname);
2660 	}
2661 	return (0);
2662 }
2663 
2664 int
2665 prtmount(const char *fs, void *x) {
2666 	zerror((zlog_t *)x, B_FALSE, "  %s", fs);
2667 	return (0);
2668 }
2669 
2670 /*
2671  * Look for zones running on the main system that are using this root (or any
2672  * subdirectory of it).  Return B_TRUE and print an error if a conflicting zone
2673  * is found or if we can't tell.
2674  */
2675 static boolean_t
2676 duplicate_zone_root(zlog_t *zlogp, const char *rootpath)
2677 {
2678 	zoneid_t *zids = NULL;
2679 	uint_t nzids = 0;
2680 	boolean_t retv;
2681 	int rlen, zlen;
2682 	char zroot[MAXPATHLEN];
2683 	char zonename[ZONENAME_MAX];
2684 
2685 	for (;;) {
2686 		nzids += 10;
2687 		zids = malloc(nzids * sizeof (*zids));
2688 		if (zids == NULL) {
2689 			zerror(zlogp, B_TRUE, "unable to allocate memory");
2690 			return (B_TRUE);
2691 		}
2692 		if (zone_list(zids, &nzids) == 0)
2693 			break;
2694 		free(zids);
2695 	}
2696 	retv = B_FALSE;
2697 	rlen = strlen(rootpath);
2698 	while (nzids > 0) {
2699 		/*
2700 		 * Ignore errors; they just mean that the zone has disappeared
2701 		 * while we were busy.
2702 		 */
2703 		if (zone_getattr(zids[--nzids], ZONE_ATTR_ROOT, zroot,
2704 		    sizeof (zroot)) == -1)
2705 			continue;
2706 		zlen = strlen(zroot);
2707 		if (zlen > rlen)
2708 			zlen = rlen;
2709 		if (strncmp(rootpath, zroot, zlen) == 0 &&
2710 		    (zroot[zlen] == '\0' || zroot[zlen] == '/') &&
2711 		    (rootpath[zlen] == '\0' || rootpath[zlen] == '/')) {
2712 			if (getzonenamebyid(zids[nzids], zonename,
2713 			    sizeof (zonename)) == -1)
2714 				(void) snprintf(zonename, sizeof (zonename),
2715 				    "id %d", (int)zids[nzids]);
2716 			zerror(zlogp, B_FALSE,
2717 			    "zone root %s already in use by zone %s",
2718 			    rootpath, zonename);
2719 			retv = B_TRUE;
2720 			break;
2721 		}
2722 	}
2723 	free(zids);
2724 	return (retv);
2725 }
2726 
2727 /*
2728  * Search for loopback mounts that use this same source node (same device and
2729  * inode).  Return B_TRUE if there is one or if we can't tell.
2730  */
2731 static boolean_t
2732 duplicate_reachable_path(zlog_t *zlogp, const char *rootpath)
2733 {
2734 	struct stat64 rst, zst;
2735 	struct mnttab *mnp;
2736 
2737 	if (stat64(rootpath, &rst) == -1) {
2738 		zerror(zlogp, B_TRUE, "can't stat %s", rootpath);
2739 		return (B_TRUE);
2740 	}
2741 	if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
2742 		return (B_TRUE);
2743 	for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max; mnp++) {
2744 		if (mnp->mnt_fstype == NULL ||
2745 		    strcmp(MNTTYPE_LOFS, mnp->mnt_fstype) != 0)
2746 			continue;
2747 		/* We're looking at a loopback mount.  Stat it. */
2748 		if (mnp->mnt_special != NULL &&
2749 		    stat64(mnp->mnt_special, &zst) != -1 &&
2750 		    rst.st_dev == zst.st_dev && rst.st_ino == zst.st_ino) {
2751 			zerror(zlogp, B_FALSE,
2752 			    "zone root %s is reachable through %s",
2753 			    rootpath, mnp->mnt_mountp);
2754 			return (B_TRUE);
2755 		}
2756 	}
2757 	return (B_FALSE);
2758 }
2759 
2760 zoneid_t
2761 vplat_create(zlog_t *zlogp, boolean_t mount_cmd)
2762 {
2763 	zoneid_t rval = -1;
2764 	priv_set_t *privs;
2765 	char rootpath[MAXPATHLEN];
2766 	char *rctlbuf = NULL;
2767 	size_t rctlbufsz = 0;
2768 	char *zfsbuf = NULL;
2769 	size_t zfsbufsz = 0;
2770 	zoneid_t zoneid = -1;
2771 	int xerr;
2772 	char *kzone;
2773 	FILE *fp = NULL;
2774 
2775 	if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
2776 		zerror(zlogp, B_TRUE, "unable to determine zone root");
2777 		return (-1);
2778 	}
2779 	if (zonecfg_in_alt_root())
2780 		resolve_lofs(zlogp, rootpath, sizeof (rootpath));
2781 
2782 	if ((privs = priv_allocset()) == NULL) {
2783 		zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
2784 		return (-1);
2785 	}
2786 	priv_emptyset(privs);
2787 	if (zonecfg_get_privset(privs) != Z_OK) {
2788 		zerror(zlogp, B_TRUE, "Failed to initialize privileges");
2789 		goto error;
2790 	}
2791 	if (!mount_cmd && get_rctls(zlogp, &rctlbuf, &rctlbufsz) != 0) {
2792 		zerror(zlogp, B_FALSE, "Unable to get list of rctls");
2793 		goto error;
2794 	}
2795 	if (get_datasets(zlogp, &zfsbuf, &zfsbufsz) != 0) {
2796 		zerror(zlogp, B_FALSE, "Unable to get list of ZFS datasets");
2797 		goto error;
2798 	}
2799 
2800 	kzone = zone_name;
2801 
2802 	/*
2803 	 * We must do this scan twice.  First, we look for zones running on the
2804 	 * main system that are using this root (or any subdirectory of it).
2805 	 * Next, we reduce to the shortest path and search for loopback mounts
2806 	 * that use this same source node (same device and inode).
2807 	 */
2808 	if (duplicate_zone_root(zlogp, rootpath))
2809 		goto error;
2810 	if (duplicate_reachable_path(zlogp, rootpath))
2811 		goto error;
2812 
2813 	if (mount_cmd) {
2814 		root_to_lu(zlogp, rootpath, sizeof (rootpath), B_TRUE);
2815 
2816 		/*
2817 		 * Forge up a special root for this zone.  When a zone is
2818 		 * mounted, we can't let the zone have its own root because the
2819 		 * tools that will be used in this "scratch zone" need access
2820 		 * to both the zone's resources and the running machine's
2821 		 * executables.
2822 		 *
2823 		 * Note that the mkdir here also catches read-only filesystems.
2824 		 */
2825 		if (mkdir(rootpath, 0755) != 0 && errno != EEXIST) {
2826 			zerror(zlogp, B_TRUE, "cannot create %s", rootpath);
2827 			goto error;
2828 		}
2829 		if (domount(zlogp, "tmpfs", "", "swap", rootpath) != 0)
2830 			goto error;
2831 	}
2832 
2833 	if (zonecfg_in_alt_root()) {
2834 		/*
2835 		 * If we are mounting up a zone in an alternate root partition,
2836 		 * then we have some additional work to do before starting the
2837 		 * zone.  First, resolve the root path down so that we're not
2838 		 * fooled by duplicates.  Then forge up an internal name for
2839 		 * the zone.
2840 		 */
2841 		if ((fp = zonecfg_open_scratch("", B_TRUE)) == NULL) {
2842 			zerror(zlogp, B_TRUE, "cannot open mapfile");
2843 			goto error;
2844 		}
2845 		if (zonecfg_lock_scratch(fp) != 0) {
2846 			zerror(zlogp, B_TRUE, "cannot lock mapfile");
2847 			goto error;
2848 		}
2849 		if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
2850 		    NULL, 0) == 0) {
2851 			zerror(zlogp, B_FALSE, "scratch zone already running");
2852 			goto error;
2853 		}
2854 		/* This is the preferred name */
2855 		(void) snprintf(kernzone, sizeof (kernzone), "SUNWlu-%s",
2856 		    zone_name);
2857 		srandom(getpid());
2858 		while (zonecfg_reverse_scratch(fp, kernzone, NULL, 0, NULL,
2859 		    0) == 0) {
2860 			/* This is just an arbitrary name; note "." usage */
2861 			(void) snprintf(kernzone, sizeof (kernzone),
2862 			    "SUNWlu.%08lX%08lX", random(), random());
2863 		}
2864 		kzone = kernzone;
2865 	}
2866 
2867 	xerr = 0;
2868 	if ((zoneid = zone_create(kzone, rootpath, privs, rctlbuf,
2869 	    rctlbufsz, zfsbuf, zfsbufsz, &xerr)) == -1) {
2870 		if (xerr == ZE_AREMOUNTS) {
2871 			if (zonecfg_find_mounts(rootpath, NULL, NULL) < 1) {
2872 				zerror(zlogp, B_FALSE,
2873 				    "An unknown file-system is mounted on "
2874 				    "a subdirectory of %s", rootpath);
2875 			} else {
2876 
2877 				zerror(zlogp, B_FALSE,
2878 				    "These file-systems are mounted on "
2879 				    "subdirectories of %s:", rootpath);
2880 				(void) zonecfg_find_mounts(rootpath,
2881 				    prtmount, zlogp);
2882 			}
2883 		} else if (xerr == ZE_CHROOTED) {
2884 			zerror(zlogp, B_FALSE, "%s: "
2885 			    "cannot create a zone from a chrooted "
2886 			    "environment", "zone_create");
2887 		} else {
2888 			zerror(zlogp, B_TRUE, "%s failed", "zone_create");
2889 		}
2890 		goto error;
2891 	}
2892 
2893 	if (zonecfg_in_alt_root() &&
2894 	    zonecfg_add_scratch(fp, zone_name, kernzone,
2895 	    zonecfg_get_root()) == -1) {
2896 		zerror(zlogp, B_TRUE, "cannot add mapfile entry");
2897 		goto error;
2898 	}
2899 
2900 	/*
2901 	 * The following is a warning, not an error, and is not performed when
2902 	 * merely mounting a zone for administrative use.
2903 	 */
2904 	if (!mount_cmd && bind_to_pool(zlogp, zoneid) != 0)
2905 		zerror(zlogp, B_FALSE, "WARNING: unable to bind zone to "
2906 		    "requested pool; using default pool.");
2907 	rval = zoneid;
2908 	zoneid = -1;
2909 
2910 error:
2911 	if (zoneid != -1)
2912 		(void) zone_destroy(zoneid);
2913 	if (rctlbuf != NULL)
2914 		free(rctlbuf);
2915 	priv_freeset(privs);
2916 	if (fp != NULL)
2917 		zonecfg_close_scratch(fp);
2918 	lofs_discard_mnttab();
2919 	return (rval);
2920 }
2921 
2922 int
2923 vplat_bringup(zlog_t *zlogp, boolean_t mount_cmd)
2924 {
2925 	if (!mount_cmd && validate_datasets(zlogp) != 0) {
2926 		lofs_discard_mnttab();
2927 		return (-1);
2928 	}
2929 
2930 	if (create_dev_files(zlogp) != 0 ||
2931 	    mount_filesystems(zlogp, mount_cmd) != 0) {
2932 		lofs_discard_mnttab();
2933 		return (-1);
2934 	}
2935 	if (!mount_cmd && (devfsadm_register(zlogp) != 0 ||
2936 	    configure_network_interfaces(zlogp) != 0)) {
2937 		lofs_discard_mnttab();
2938 		return (-1);
2939 	}
2940 	lofs_discard_mnttab();
2941 	return (0);
2942 }
2943 
2944 static int
2945 lu_root_teardown(zlog_t *zlogp)
2946 {
2947 	char zroot[MAXPATHLEN];
2948 
2949 	if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
2950 		zerror(zlogp, B_FALSE, "unable to determine zone root");
2951 		return (-1);
2952 	}
2953 	root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
2954 
2955 	/*
2956 	 * At this point, the processes are gone, the filesystems (save the
2957 	 * root) are unmounted, and the zone is on death row.  But there may
2958 	 * still be creds floating about in the system that reference the
2959 	 * zone_t, and which pin down zone_rootvp causing this call to fail
2960 	 * with EBUSY.  Thus, we try for a little while before just giving up.
2961 	 * (How I wish this were not true, and umount2 just did the right
2962 	 * thing, or tmpfs supported MS_FORCE This is a gross hack.)
2963 	 */
2964 	if (umount2(zroot, MS_FORCE) != 0) {
2965 		if (errno == ENOTSUP && umount2(zroot, 0) == 0)
2966 			goto unmounted;
2967 		if (errno == EBUSY) {
2968 			int tries = 10;
2969 
2970 			while (--tries >= 0) {
2971 				(void) sleep(1);
2972 				if (umount2(zroot, 0) == 0)
2973 					goto unmounted;
2974 				if (errno != EBUSY)
2975 					break;
2976 			}
2977 		}
2978 		zerror(zlogp, B_TRUE, "unable to unmount '%s'", zroot);
2979 		return (-1);
2980 	}
2981 unmounted:
2982 
2983 	/*
2984 	 * Only zones in an alternate root environment have scratch zone
2985 	 * entries.
2986 	 */
2987 	if (zonecfg_in_alt_root()) {
2988 		FILE *fp;
2989 		int retv;
2990 
2991 		if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
2992 			zerror(zlogp, B_TRUE, "cannot open mapfile");
2993 			return (-1);
2994 		}
2995 		retv = -1;
2996 		if (zonecfg_lock_scratch(fp) != 0)
2997 			zerror(zlogp, B_TRUE, "cannot lock mapfile");
2998 		else if (zonecfg_delete_scratch(fp, kernzone) != 0)
2999 			zerror(zlogp, B_TRUE, "cannot delete map entry");
3000 		else
3001 			retv = 0;
3002 		zonecfg_close_scratch(fp);
3003 		return (retv);
3004 	} else {
3005 		return (0);
3006 	}
3007 }
3008 
3009 int
3010 vplat_teardown(zlog_t *zlogp, boolean_t unmount_cmd)
3011 {
3012 	char *kzone;
3013 	zoneid_t zoneid;
3014 
3015 	kzone = zone_name;
3016 	if (zonecfg_in_alt_root()) {
3017 		FILE *fp;
3018 
3019 		if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
3020 			zerror(zlogp, B_TRUE, "unable to open map file");
3021 			goto error;
3022 		}
3023 		if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
3024 		    kernzone, sizeof (kernzone)) != 0) {
3025 			zerror(zlogp, B_FALSE, "unable to find scratch zone");
3026 			zonecfg_close_scratch(fp);
3027 			goto error;
3028 		}
3029 		zonecfg_close_scratch(fp);
3030 		kzone = kernzone;
3031 	}
3032 
3033 	if ((zoneid = getzoneidbyname(kzone)) == ZONE_ID_UNDEFINED) {
3034 		if (!bringup_failure_recovery)
3035 			zerror(zlogp, B_TRUE, "unable to get zoneid");
3036 		if (unmount_cmd)
3037 			(void) lu_root_teardown(zlogp);
3038 		goto error;
3039 	}
3040 
3041 	if (zone_shutdown(zoneid) != 0) {
3042 		zerror(zlogp, B_TRUE, "unable to shutdown zone");
3043 		goto error;
3044 	}
3045 
3046 	if (!unmount_cmd && devfsadm_unregister(zlogp) != 0)
3047 		goto error;
3048 
3049 	if (!unmount_cmd &&
3050 	    unconfigure_network_interfaces(zlogp, zoneid) != 0) {
3051 		zerror(zlogp, B_FALSE,
3052 		    "unable to unconfigure network interfaces in zone");
3053 		goto error;
3054 	}
3055 
3056 	if (!unmount_cmd && tcp_abort_connections(zlogp, zoneid) != 0) {
3057 		zerror(zlogp, B_TRUE, "unable to abort TCP connections");
3058 		goto error;
3059 	}
3060 
3061 	if (unmount_filesystems(zlogp, zoneid, unmount_cmd) != 0) {
3062 		zerror(zlogp, B_FALSE,
3063 		    "unable to unmount file systems in zone");
3064 		goto error;
3065 	}
3066 
3067 	if (zone_destroy(zoneid) != 0) {
3068 		zerror(zlogp, B_TRUE, "unable to destroy zone");
3069 		goto error;
3070 	}
3071 
3072 	/*
3073 	 * Special teardown for alternate boot environments: remove the tmpfs
3074 	 * root for the zone and then remove it from the map file.
3075 	 */
3076 	if (unmount_cmd && lu_root_teardown(zlogp) != 0)
3077 		goto error;
3078 
3079 	if (!unmount_cmd)
3080 		destroy_console_slave();
3081 
3082 	lofs_discard_mnttab();
3083 	return (0);
3084 
3085 error:
3086 	lofs_discard_mnttab();
3087 	return (-1);
3088 }
3089