xref: /titanic_44/usr/src/cmd/zoneadmd/vplat.c (revision a0e56b0eb1fdc159ff8348ca0e77d884bb7d126b)
1  /*
2   * CDDL HEADER START
3   *
4   * The contents of this file are subject to the terms of the
5   * Common Development and Distribution License (the "License").
6   * You may not use this file except in compliance with the License.
7   *
8   * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9   * or http://www.opensolaris.org/os/licensing.
10   * See the License for the specific language governing permissions
11   * and limitations under the License.
12   *
13   * When distributing Covered Code, include this CDDL HEADER in each
14   * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15   * If applicable, add the following below this CDDL HEADER, with the
16   * fields enclosed by brackets "[]" replaced with your own identifying
17   * information: Portions Copyright [yyyy] [name of copyright owner]
18   *
19   * CDDL HEADER END
20   */
21  
22  /*
23   * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
24   * Use is subject to license terms.
25   */
26  
27  #pragma ident	"%Z%%M%	%I%	%E% SMI"
28  
29  /*
30   * This module contains functions used to bring up and tear down the
31   * Virtual Platform: [un]mounting file-systems, [un]plumbing network
32   * interfaces, [un]configuring devices, establishing resource controls,
33   * and creating/destroying the zone in the kernel.  These actions, on
34   * the way up, ready the zone; on the way down, they halt the zone.
35   * See the much longer block comment at the beginning of zoneadmd.c
36   * for a bigger picture of how the whole program functions.
37   *
38   * This module also has primary responsibility for the layout of "scratch
39   * zones."  These are mounted, but inactive, zones that are used during
40   * operating system upgrade and potentially other administrative action.  The
41   * scratch zone environment is similar to the miniroot environment.  The zone's
42   * actual root is mounted read-write on /a, and the standard paths (/usr,
43   * /sbin, /lib) all lead to read-only copies of the running system's binaries.
44   * This allows the administrative tools to manipulate the zone using "-R /a"
45   * without relying on any binaries in the zone itself.
46   *
47   * If the scratch zone is on an alternate root (Live Upgrade [LU] boot
48   * environment), then we must resolve the lofs mounts used there to uncover
49   * writable (unshared) resources.  Shared resources, though, are always
50   * read-only.  In addition, if the "same" zone with a different root path is
51   * currently running, then "/b" inside the zone points to the running zone's
52   * root.  This allows LU to synchronize configuration files during the upgrade
53   * process.
54   *
55   * To construct this environment, this module creates a tmpfs mount on
56   * $ZONEPATH/lu.  Inside this scratch area, the miniroot-like environment as
57   * described above is constructed on the fly.  The zone is then created using
58   * $ZONEPATH/lu as the root.
59   *
60   * Note that scratch zones are inactive.  The zone's bits are not running and
61   * likely cannot be run correctly until upgrade is done.  Init is not running
62   * there, nor is SMF.  Because of this, the "mounted" state of a scratch zone
63   * is not a part of the usual halt/ready/boot state machine.
64   */
65  
66  #include <sys/param.h>
67  #include <sys/mount.h>
68  #include <sys/mntent.h>
69  #include <sys/socket.h>
70  #include <sys/utsname.h>
71  #include <sys/types.h>
72  #include <sys/stat.h>
73  #include <sys/sockio.h>
74  #include <sys/stropts.h>
75  #include <sys/conf.h>
76  
77  #include <inet/tcp.h>
78  #include <arpa/inet.h>
79  #include <netinet/in.h>
80  #include <net/route.h>
81  
82  #include <stdio.h>
83  #include <errno.h>
84  #include <fcntl.h>
85  #include <unistd.h>
86  #include <rctl.h>
87  #include <stdlib.h>
88  #include <string.h>
89  #include <strings.h>
90  #include <wait.h>
91  #include <limits.h>
92  #include <libgen.h>
93  #include <libzfs.h>
94  #include <libdevinfo.h>
95  #include <zone.h>
96  #include <assert.h>
97  #include <libcontract.h>
98  #include <libcontract_priv.h>
99  #include <uuid/uuid.h>
100  
101  #include <sys/mntio.h>
102  #include <sys/mnttab.h>
103  #include <sys/fs/autofs.h>	/* for _autofssys() */
104  #include <sys/fs/lofs_info.h>
105  #include <sys/fs/zfs.h>
106  
107  #include <pool.h>
108  #include <sys/pool.h>
109  
110  #include <libbrand.h>
111  #include <sys/brand.h>
112  #include <libzonecfg.h>
113  #include <synch.h>
114  
115  #include "zoneadmd.h"
116  #include <tsol/label.h>
117  #include <libtsnet.h>
118  #include <sys/priv.h>
119  
120  #define	V4_ADDR_LEN	32
121  #define	V6_ADDR_LEN	128
122  
123  /* 0755 is the default directory mode. */
124  #define	DEFAULT_DIR_MODE \
125  	(S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH)
126  
127  #define	IPD_DEFAULT_OPTS \
128  	MNTOPT_RO "," MNTOPT_LOFS_NOSUB "," MNTOPT_NODEVICES
129  
130  #define	DFSTYPES	"/etc/dfs/fstypes"
131  #define	MAXTNZLEN	2048
132  
133  /* for routing socket */
134  static int rts_seqno = 0;
135  
136  /* mangled zone name when mounting in an alternate root environment */
137  static char kernzone[ZONENAME_MAX];
138  
139  /* array of cached mount entries for resolve_lofs */
140  static struct mnttab *resolve_lofs_mnts, *resolve_lofs_mnt_max;
141  
142  /* for Trusted Extensions */
143  static tsol_zcent_t *get_zone_label(zlog_t *, priv_set_t *);
144  static int tsol_mounts(zlog_t *, char *, char *);
145  static void tsol_unmounts(zlog_t *, char *);
146  static m_label_t *zlabel = NULL;
147  static m_label_t *zid_label = NULL;
148  static priv_set_t *zprivs = NULL;
149  
150  /* from libsocket, not in any header file */
151  extern int getnetmaskbyaddr(struct in_addr, struct in_addr *);
152  
153  /*
154   * An optimization for build_mnttable: reallocate (and potentially copy the
155   * data) only once every N times through the loop.
156   */
157  #define	MNTTAB_HUNK	32
158  
159  /*
160   * Private autofs system call
161   */
162  extern int _autofssys(int, void *);
163  
164  static int
165  autofs_cleanup(zoneid_t zoneid)
166  {
167  	/*
168  	 * Ask autofs to unmount all trigger nodes in the given zone.
169  	 */
170  	return (_autofssys(AUTOFS_UNMOUNTALL, (void *)zoneid));
171  }
172  
173  static void
174  free_mnttable(struct mnttab *mnt_array, uint_t nelem)
175  {
176  	uint_t i;
177  
178  	if (mnt_array == NULL)
179  		return;
180  	for (i = 0; i < nelem; i++) {
181  		free(mnt_array[i].mnt_mountp);
182  		free(mnt_array[i].mnt_fstype);
183  		free(mnt_array[i].mnt_special);
184  		free(mnt_array[i].mnt_mntopts);
185  		assert(mnt_array[i].mnt_time == NULL);
186  	}
187  	free(mnt_array);
188  }
189  
190  /*
191   * Build the mount table for the zone rooted at "zroot", storing the resulting
192   * array of struct mnttabs in "mnt_arrayp" and the number of elements in the
193   * array in "nelemp".
194   */
195  static int
196  build_mnttable(zlog_t *zlogp, const char *zroot, size_t zrootlen, FILE *mnttab,
197      struct mnttab **mnt_arrayp, uint_t *nelemp)
198  {
199  	struct mnttab mnt;
200  	struct mnttab *mnts;
201  	struct mnttab *mnp;
202  	uint_t nmnt;
203  
204  	rewind(mnttab);
205  	resetmnttab(mnttab);
206  	nmnt = 0;
207  	mnts = NULL;
208  	while (getmntent(mnttab, &mnt) == 0) {
209  		struct mnttab *tmp_array;
210  
211  		if (strncmp(mnt.mnt_mountp, zroot, zrootlen) != 0)
212  			continue;
213  		if (nmnt % MNTTAB_HUNK == 0) {
214  			tmp_array = realloc(mnts,
215  			    (nmnt + MNTTAB_HUNK) * sizeof (*mnts));
216  			if (tmp_array == NULL) {
217  				free_mnttable(mnts, nmnt);
218  				return (-1);
219  			}
220  			mnts = tmp_array;
221  		}
222  		mnp = &mnts[nmnt++];
223  
224  		/*
225  		 * Zero out any fields we're not using.
226  		 */
227  		(void) memset(mnp, 0, sizeof (*mnp));
228  
229  		if (mnt.mnt_special != NULL)
230  			mnp->mnt_special = strdup(mnt.mnt_special);
231  		if (mnt.mnt_mntopts != NULL)
232  			mnp->mnt_mntopts = strdup(mnt.mnt_mntopts);
233  		mnp->mnt_mountp = strdup(mnt.mnt_mountp);
234  		mnp->mnt_fstype = strdup(mnt.mnt_fstype);
235  		if ((mnt.mnt_special != NULL && mnp->mnt_special == NULL) ||
236  		    (mnt.mnt_mntopts != NULL && mnp->mnt_mntopts == NULL) ||
237  		    mnp->mnt_mountp == NULL || mnp->mnt_fstype == NULL) {
238  			zerror(zlogp, B_TRUE, "memory allocation failed");
239  			free_mnttable(mnts, nmnt);
240  			return (-1);
241  		}
242  	}
243  	*mnt_arrayp = mnts;
244  	*nelemp = nmnt;
245  	return (0);
246  }
247  
248  /*
249   * This is an optimization.  The resolve_lofs function is used quite frequently
250   * to manipulate file paths, and on a machine with a large number of zones,
251   * there will be a huge number of mounted file systems.  Thus, we trigger a
252   * reread of the list of mount points
253   */
254  static void
255  lofs_discard_mnttab(void)
256  {
257  	free_mnttable(resolve_lofs_mnts,
258  	    resolve_lofs_mnt_max - resolve_lofs_mnts);
259  	resolve_lofs_mnts = resolve_lofs_mnt_max = NULL;
260  }
261  
262  static int
263  lofs_read_mnttab(zlog_t *zlogp)
264  {
265  	FILE *mnttab;
266  	uint_t nmnts;
267  
268  	if ((mnttab = fopen(MNTTAB, "r")) == NULL)
269  		return (-1);
270  	if (build_mnttable(zlogp, "", 0, mnttab, &resolve_lofs_mnts,
271  	    &nmnts) == -1) {
272  		(void) fclose(mnttab);
273  		return (-1);
274  	}
275  	(void) fclose(mnttab);
276  	resolve_lofs_mnt_max = resolve_lofs_mnts + nmnts;
277  	return (0);
278  }
279  
280  /*
281   * This function loops over potential loopback mounts and symlinks in a given
282   * path and resolves them all down to an absolute path.
283   */
284  static void
285  resolve_lofs(zlog_t *zlogp, char *path, size_t pathlen)
286  {
287  	int len, arlen;
288  	const char *altroot;
289  	char tmppath[MAXPATHLEN];
290  	boolean_t outside_altroot;
291  
292  	if ((len = resolvepath(path, tmppath, sizeof (tmppath))) == -1)
293  		return;
294  	tmppath[len] = '\0';
295  	(void) strlcpy(path, tmppath, sizeof (tmppath));
296  
297  	/* This happens once per zoneadmd operation. */
298  	if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
299  		return;
300  
301  	altroot = zonecfg_get_root();
302  	arlen = strlen(altroot);
303  	outside_altroot = B_FALSE;
304  	for (;;) {
305  		struct mnttab *mnp;
306  
307  		for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max;
308  		    mnp++) {
309  			if (mnp->mnt_fstype == NULL ||
310  			    mnp->mnt_mountp == NULL ||
311  			    mnp->mnt_special == NULL ||
312  			    strcmp(mnp->mnt_fstype, MNTTYPE_LOFS) != 0)
313  				continue;
314  			len = strlen(mnp->mnt_mountp);
315  			if (strncmp(mnp->mnt_mountp, path, len) == 0 &&
316  			    (path[len] == '/' || path[len] == '\0'))
317  				break;
318  		}
319  		if (mnp >= resolve_lofs_mnt_max)
320  			break;
321  		if (outside_altroot) {
322  			char *cp;
323  			int olen = sizeof (MNTOPT_RO) - 1;
324  
325  			/*
326  			 * If we run into a read-only mount outside of the
327  			 * alternate root environment, then the user doesn't
328  			 * want this path to be made read-write.
329  			 */
330  			if (mnp->mnt_mntopts != NULL &&
331  			    (cp = strstr(mnp->mnt_mntopts, MNTOPT_RO)) !=
332  			    NULL &&
333  			    (cp == mnp->mnt_mntopts || cp[-1] == ',') &&
334  			    (cp[olen] == '\0' || cp[olen] == ',')) {
335  				break;
336  			}
337  		} else if (arlen > 0 &&
338  		    (strncmp(mnp->mnt_special, altroot, arlen) != 0 ||
339  		    (mnp->mnt_special[arlen] != '\0' &&
340  		    mnp->mnt_special[arlen] != '/'))) {
341  			outside_altroot = B_TRUE;
342  		}
343  		/* use temporary buffer because new path might be longer */
344  		(void) snprintf(tmppath, sizeof (tmppath), "%s%s",
345  		    mnp->mnt_special, path + len);
346  		if ((len = resolvepath(tmppath, path, pathlen)) == -1)
347  			break;
348  		path[len] = '\0';
349  	}
350  }
351  
352  /*
353   * For a regular mount, check if a replacement lofs mount is needed because the
354   * referenced device is already mounted somewhere.
355   */
356  static int
357  check_lofs_needed(zlog_t *zlogp, struct zone_fstab *fsptr)
358  {
359  	struct mnttab *mnp;
360  	zone_fsopt_t *optptr, *onext;
361  
362  	/* This happens once per zoneadmd operation. */
363  	if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
364  		return (-1);
365  
366  	/*
367  	 * If this special node isn't already in use, then it's ours alone;
368  	 * no need to worry about conflicting mounts.
369  	 */
370  	for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max;
371  	    mnp++) {
372  		if (strcmp(mnp->mnt_special, fsptr->zone_fs_special) == 0)
373  			break;
374  	}
375  	if (mnp >= resolve_lofs_mnt_max)
376  		return (0);
377  
378  	/*
379  	 * Convert this duplicate mount into a lofs mount.
380  	 */
381  	(void) strlcpy(fsptr->zone_fs_special, mnp->mnt_mountp,
382  	    sizeof (fsptr->zone_fs_special));
383  	(void) strlcpy(fsptr->zone_fs_type, MNTTYPE_LOFS,
384  	    sizeof (fsptr->zone_fs_type));
385  	fsptr->zone_fs_raw[0] = '\0';
386  
387  	/*
388  	 * Discard all but one of the original options and set that to be the
389  	 * same set of options used for inherit package directory resources.
390  	 */
391  	optptr = fsptr->zone_fs_options;
392  	if (optptr == NULL) {
393  		optptr = malloc(sizeof (*optptr));
394  		if (optptr == NULL) {
395  			zerror(zlogp, B_TRUE, "cannot mount %s",
396  			    fsptr->zone_fs_dir);
397  			return (-1);
398  		}
399  	} else {
400  		while ((onext = optptr->zone_fsopt_next) != NULL) {
401  			optptr->zone_fsopt_next = onext->zone_fsopt_next;
402  			free(onext);
403  		}
404  	}
405  	(void) strcpy(optptr->zone_fsopt_opt, IPD_DEFAULT_OPTS);
406  	optptr->zone_fsopt_next = NULL;
407  	fsptr->zone_fs_options = optptr;
408  	return (0);
409  }
410  
411  static int
412  make_one_dir(zlog_t *zlogp, const char *prefix, const char *subdir, mode_t mode)
413  {
414  	char path[MAXPATHLEN];
415  	struct stat st;
416  
417  	if (snprintf(path, sizeof (path), "%s%s", prefix, subdir) >
418  	    sizeof (path)) {
419  		zerror(zlogp, B_FALSE, "pathname %s%s is too long", prefix,
420  		    subdir);
421  		return (-1);
422  	}
423  
424  	if (lstat(path, &st) == 0) {
425  		/*
426  		 * We don't check the file mode since presumably the zone
427  		 * administrator may have had good reason to change the mode,
428  		 * and we don't need to second guess him.
429  		 */
430  		if (!S_ISDIR(st.st_mode)) {
431  			if (is_system_labeled() &&
432  			    S_ISREG(st.st_mode)) {
433  				/*
434  				 * The need to mount readonly copies of
435  				 * global zone /etc/ files is unique to
436  				 * Trusted Extensions.
437  				 */
438  				if (strncmp(subdir, "/etc/",
439  				    strlen("/etc/")) != 0) {
440  					zerror(zlogp, B_FALSE,
441  					    "%s is not in /etc", path);
442  					return (-1);
443  				}
444  			} else {
445  				zerror(zlogp, B_FALSE,
446  				    "%s is not a directory", path);
447  				return (-1);
448  			}
449  		}
450  	} else if (mkdirp(path, mode) != 0) {
451  		if (errno == EROFS)
452  			zerror(zlogp, B_FALSE, "Could not mkdir %s.\nIt is on "
453  			    "a read-only file system in this local zone.\nMake "
454  			    "sure %s exists in the global zone.", path, subdir);
455  		else
456  			zerror(zlogp, B_TRUE, "mkdirp of %s failed", path);
457  		return (-1);
458  	}
459  	return (0);
460  }
461  
462  static void
463  free_remote_fstypes(char **types)
464  {
465  	uint_t i;
466  
467  	if (types == NULL)
468  		return;
469  	for (i = 0; types[i] != NULL; i++)
470  		free(types[i]);
471  	free(types);
472  }
473  
474  static char **
475  get_remote_fstypes(zlog_t *zlogp)
476  {
477  	char **types = NULL;
478  	FILE *fp;
479  	char buf[MAXPATHLEN];
480  	char fstype[MAXPATHLEN];
481  	uint_t lines = 0;
482  	uint_t i;
483  
484  	if ((fp = fopen(DFSTYPES, "r")) == NULL) {
485  		zerror(zlogp, B_TRUE, "failed to open %s", DFSTYPES);
486  		return (NULL);
487  	}
488  	/*
489  	 * Count the number of lines
490  	 */
491  	while (fgets(buf, sizeof (buf), fp) != NULL)
492  		lines++;
493  	if (lines == 0)	/* didn't read anything; empty file */
494  		goto out;
495  	rewind(fp);
496  	/*
497  	 * Allocate enough space for a NULL-terminated array.
498  	 */
499  	types = calloc(lines + 1, sizeof (char *));
500  	if (types == NULL) {
501  		zerror(zlogp, B_TRUE, "memory allocation failed");
502  		goto out;
503  	}
504  	i = 0;
505  	while (fgets(buf, sizeof (buf), fp) != NULL) {
506  		/* LINTED - fstype is big enough to hold buf */
507  		if (sscanf(buf, "%s", fstype) == 0) {
508  			zerror(zlogp, B_FALSE, "unable to parse %s", DFSTYPES);
509  			free_remote_fstypes(types);
510  			types = NULL;
511  			goto out;
512  		}
513  		types[i] = strdup(fstype);
514  		if (types[i] == NULL) {
515  			zerror(zlogp, B_TRUE, "memory allocation failed");
516  			free_remote_fstypes(types);
517  			types = NULL;
518  			goto out;
519  		}
520  		i++;
521  	}
522  out:
523  	(void) fclose(fp);
524  	return (types);
525  }
526  
527  static boolean_t
528  is_remote_fstype(const char *fstype, char *const *remote_fstypes)
529  {
530  	uint_t i;
531  
532  	if (remote_fstypes == NULL)
533  		return (B_FALSE);
534  	for (i = 0; remote_fstypes[i] != NULL; i++) {
535  		if (strcmp(remote_fstypes[i], fstype) == 0)
536  			return (B_TRUE);
537  	}
538  	return (B_FALSE);
539  }
540  
541  /*
542   * This converts a zone root path (normally of the form .../root) to a Live
543   * Upgrade scratch zone root (of the form .../lu).
544   */
545  static void
546  root_to_lu(zlog_t *zlogp, char *zroot, size_t zrootlen, boolean_t isresolved)
547  {
548  	assert(zone_isnative);
549  
550  	if (!isresolved && zonecfg_in_alt_root())
551  		resolve_lofs(zlogp, zroot, zrootlen);
552  	(void) strcpy(strrchr(zroot, '/') + 1, "lu");
553  }
554  
555  /*
556   * The general strategy for unmounting filesystems is as follows:
557   *
558   * - Remote filesystems may be dead, and attempting to contact them as
559   * part of a regular unmount may hang forever; we want to always try to
560   * forcibly unmount such filesystems and only fall back to regular
561   * unmounts if the filesystem doesn't support forced unmounts.
562   *
563   * - We don't want to unnecessarily corrupt metadata on local
564   * filesystems (ie UFS), so we want to start off with graceful unmounts,
565   * and only escalate to doing forced unmounts if we get stuck.
566   *
567   * We start off walking backwards through the mount table.  This doesn't
568   * give us strict ordering but ensures that we try to unmount submounts
569   * first.  We thus limit the number of failed umount2(2) calls.
570   *
571   * The mechanism for determining if we're stuck is to count the number
572   * of failed unmounts each iteration through the mount table.  This
573   * gives us an upper bound on the number of filesystems which remain
574   * mounted (autofs trigger nodes are dealt with separately).  If at the
575   * end of one unmount+autofs_cleanup cycle we still have the same number
576   * of mounts that we started out with, we're stuck and try a forced
577   * unmount.  If that fails (filesystem doesn't support forced unmounts)
578   * then we bail and are unable to teardown the zone.  If it succeeds,
579   * we're no longer stuck so we continue with our policy of trying
580   * graceful mounts first.
581   *
582   * Zone must be down (ie, no processes or threads active).
583   */
584  static int
585  unmount_filesystems(zlog_t *zlogp, zoneid_t zoneid, boolean_t unmount_cmd)
586  {
587  	int error = 0;
588  	FILE *mnttab;
589  	struct mnttab *mnts;
590  	uint_t nmnt;
591  	char zroot[MAXPATHLEN + 1];
592  	size_t zrootlen;
593  	uint_t oldcount = UINT_MAX;
594  	boolean_t stuck = B_FALSE;
595  	char **remote_fstypes = NULL;
596  
597  	if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
598  		zerror(zlogp, B_FALSE, "unable to determine zone root");
599  		return (-1);
600  	}
601  	if (unmount_cmd)
602  		root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
603  
604  	(void) strcat(zroot, "/");
605  	zrootlen = strlen(zroot);
606  
607  	/*
608  	 * For Trusted Extensions unmount each higher level zone's mount
609  	 * of our zone's /export/home
610  	 */
611  	if (!unmount_cmd)
612  		tsol_unmounts(zlogp, zone_name);
613  
614  	if ((mnttab = fopen(MNTTAB, "r")) == NULL) {
615  		zerror(zlogp, B_TRUE, "failed to open %s", MNTTAB);
616  		return (-1);
617  	}
618  	/*
619  	 * Use our hacky mntfs ioctl so we see everything, even mounts with
620  	 * MS_NOMNTTAB.
621  	 */
622  	if (ioctl(fileno(mnttab), MNTIOC_SHOWHIDDEN, NULL) < 0) {
623  		zerror(zlogp, B_TRUE, "unable to configure %s", MNTTAB);
624  		error++;
625  		goto out;
626  	}
627  
628  	/*
629  	 * Build the list of remote fstypes so we know which ones we
630  	 * should forcibly unmount.
631  	 */
632  	remote_fstypes = get_remote_fstypes(zlogp);
633  	for (; /* ever */; ) {
634  		uint_t newcount = 0;
635  		boolean_t unmounted;
636  		struct mnttab *mnp;
637  		char *path;
638  		uint_t i;
639  
640  		mnts = NULL;
641  		nmnt = 0;
642  		/*
643  		 * MNTTAB gives us a way to walk through mounted
644  		 * filesystems; we need to be able to walk them in
645  		 * reverse order, so we build a list of all mounted
646  		 * filesystems.
647  		 */
648  		if (build_mnttable(zlogp, zroot, zrootlen, mnttab, &mnts,
649  		    &nmnt) != 0) {
650  			error++;
651  			goto out;
652  		}
653  		for (i = 0; i < nmnt; i++) {
654  			mnp = &mnts[nmnt - i - 1]; /* access in reverse order */
655  			path = mnp->mnt_mountp;
656  			unmounted = B_FALSE;
657  			/*
658  			 * Try forced unmount first for remote filesystems.
659  			 *
660  			 * Not all remote filesystems support forced unmounts,
661  			 * so if this fails (ENOTSUP) we'll continue on
662  			 * and try a regular unmount.
663  			 */
664  			if (is_remote_fstype(mnp->mnt_fstype, remote_fstypes)) {
665  				if (umount2(path, MS_FORCE) == 0)
666  					unmounted = B_TRUE;
667  			}
668  			/*
669  			 * Try forced unmount if we're stuck.
670  			 */
671  			if (stuck) {
672  				if (umount2(path, MS_FORCE) == 0) {
673  					unmounted = B_TRUE;
674  					stuck = B_FALSE;
675  				} else {
676  					/*
677  					 * The first failure indicates a
678  					 * mount we won't be able to get
679  					 * rid of automatically, so we
680  					 * bail.
681  					 */
682  					error++;
683  					zerror(zlogp, B_FALSE,
684  					    "unable to unmount '%s'", path);
685  					free_mnttable(mnts, nmnt);
686  					goto out;
687  				}
688  			}
689  			/*
690  			 * Try regular unmounts for everything else.
691  			 */
692  			if (!unmounted && umount2(path, 0) != 0)
693  				newcount++;
694  		}
695  		free_mnttable(mnts, nmnt);
696  
697  		if (newcount == 0)
698  			break;
699  		if (newcount >= oldcount) {
700  			/*
701  			 * Last round didn't unmount anything; we're stuck and
702  			 * should start trying forced unmounts.
703  			 */
704  			stuck = B_TRUE;
705  		}
706  		oldcount = newcount;
707  
708  		/*
709  		 * Autofs doesn't let you unmount its trigger nodes from
710  		 * userland so we have to tell the kernel to cleanup for us.
711  		 */
712  		if (autofs_cleanup(zoneid) != 0) {
713  			zerror(zlogp, B_TRUE, "unable to remove autofs nodes");
714  			error++;
715  			goto out;
716  		}
717  	}
718  
719  out:
720  	free_remote_fstypes(remote_fstypes);
721  	(void) fclose(mnttab);
722  	return (error ? -1 : 0);
723  }
724  
725  static int
726  fs_compare(const void *m1, const void *m2)
727  {
728  	struct zone_fstab *i = (struct zone_fstab *)m1;
729  	struct zone_fstab *j = (struct zone_fstab *)m2;
730  
731  	return (strcmp(i->zone_fs_dir, j->zone_fs_dir));
732  }
733  
734  /*
735   * Fork and exec (and wait for) the mentioned binary with the provided
736   * arguments.  Returns (-1) if something went wrong with fork(2) or exec(2),
737   * returns the exit status otherwise.
738   *
739   * If we were unable to exec the provided pathname (for whatever
740   * reason), we return the special token ZEXIT_EXEC.  The current value
741   * of ZEXIT_EXEC doesn't conflict with legitimate exit codes of the
742   * consumers of this function; any future consumers must make sure this
743   * remains the case.
744   */
745  static int
746  forkexec(zlog_t *zlogp, const char *path, char *const argv[])
747  {
748  	pid_t child_pid;
749  	int child_status = 0;
750  
751  	/*
752  	 * Do not let another thread localize a message while we are forking.
753  	 */
754  	(void) mutex_lock(&msglock);
755  	child_pid = fork();
756  	(void) mutex_unlock(&msglock);
757  	if (child_pid == -1) {
758  		zerror(zlogp, B_TRUE, "could not fork for %s", argv[0]);
759  		return (-1);
760  	} else if (child_pid == 0) {
761  		closefrom(0);
762  		/* redirect stdin, stdout & stderr to /dev/null */
763  		(void) open("/dev/null", O_RDONLY);	/* stdin */
764  		(void) open("/dev/null", O_WRONLY);	/* stdout */
765  		(void) open("/dev/null", O_WRONLY);	/* stderr */
766  		(void) execv(path, argv);
767  		/*
768  		 * Since we are in the child, there is no point calling zerror()
769  		 * since there is nobody waiting to consume it.  So exit with a
770  		 * special code that the parent will recognize and call zerror()
771  		 * accordingly.
772  		 */
773  
774  		_exit(ZEXIT_EXEC);
775  	} else {
776  		(void) waitpid(child_pid, &child_status, 0);
777  	}
778  
779  	if (WIFSIGNALED(child_status)) {
780  		zerror(zlogp, B_FALSE, "%s unexpectedly terminated due to "
781  		    "signal %d", path, WTERMSIG(child_status));
782  		return (-1);
783  	}
784  	assert(WIFEXITED(child_status));
785  	if (WEXITSTATUS(child_status) == ZEXIT_EXEC) {
786  		zerror(zlogp, B_FALSE, "failed to exec %s", path);
787  		return (-1);
788  	}
789  	return (WEXITSTATUS(child_status));
790  }
791  
792  static int
793  dofsck(zlog_t *zlogp, const char *fstype, const char *rawdev)
794  {
795  	char cmdbuf[MAXPATHLEN];
796  	char *argv[4];
797  	int status;
798  
799  	/*
800  	 * We could alternatively have called /usr/sbin/fsck -F <fstype>, but
801  	 * that would cost us an extra fork/exec without buying us anything.
802  	 */
803  	if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/fsck", fstype)
804  	    >= sizeof (cmdbuf)) {
805  		zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
806  		return (-1);
807  	}
808  
809  	argv[0] = "fsck";
810  	argv[1] = "-m";
811  	argv[2] = (char *)rawdev;
812  	argv[3] = NULL;
813  
814  	status = forkexec(zlogp, cmdbuf, argv);
815  	if (status == 0 || status == -1)
816  		return (status);
817  	zerror(zlogp, B_FALSE, "fsck of '%s' failed with exit status %d; "
818  	    "run fsck manually", rawdev, status);
819  	return (-1);
820  }
821  
822  static int
823  domount(zlog_t *zlogp, const char *fstype, const char *opts,
824      const char *special, const char *directory)
825  {
826  	char cmdbuf[MAXPATHLEN];
827  	char *argv[6];
828  	int status;
829  
830  	/*
831  	 * We could alternatively have called /usr/sbin/mount -F <fstype>, but
832  	 * that would cost us an extra fork/exec without buying us anything.
833  	 */
834  	if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/mount", fstype)
835  	    >= sizeof (cmdbuf)) {
836  		zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
837  		return (-1);
838  	}
839  	argv[0] = "mount";
840  	if (opts[0] == '\0') {
841  		argv[1] = (char *)special;
842  		argv[2] = (char *)directory;
843  		argv[3] = NULL;
844  	} else {
845  		argv[1] = "-o";
846  		argv[2] = (char *)opts;
847  		argv[3] = (char *)special;
848  		argv[4] = (char *)directory;
849  		argv[5] = NULL;
850  	}
851  
852  	status = forkexec(zlogp, cmdbuf, argv);
853  	if (status == 0 || status == -1)
854  		return (status);
855  	if (opts[0] == '\0')
856  		zerror(zlogp, B_FALSE, "\"%s %s %s\" "
857  		    "failed with exit code %d",
858  		    cmdbuf, special, directory, status);
859  	else
860  		zerror(zlogp, B_FALSE, "\"%s -o %s %s %s\" "
861  		    "failed with exit code %d",
862  		    cmdbuf, opts, special, directory, status);
863  	return (-1);
864  }
865  
866  /*
867   * Make sure if a given path exists, it is not a sym-link, and is a directory.
868   */
869  static int
870  check_path(zlog_t *zlogp, const char *path)
871  {
872  	struct stat statbuf;
873  	char respath[MAXPATHLEN];
874  	int res;
875  
876  	if (lstat(path, &statbuf) != 0) {
877  		if (errno == ENOENT)
878  			return (0);
879  		zerror(zlogp, B_TRUE, "can't stat %s", path);
880  		return (-1);
881  	}
882  	if (S_ISLNK(statbuf.st_mode)) {
883  		zerror(zlogp, B_FALSE, "%s is a symlink", path);
884  		return (-1);
885  	}
886  	if (!S_ISDIR(statbuf.st_mode)) {
887  		if (is_system_labeled() && S_ISREG(statbuf.st_mode)) {
888  			/*
889  			 * The need to mount readonly copies of
890  			 * global zone /etc/ files is unique to
891  			 * Trusted Extensions.
892  			 * The check for /etc/ via strstr() is to
893  			 * allow paths like $ZONEROOT/etc/passwd
894  			 */
895  			if (strstr(path, "/etc/") == NULL) {
896  				zerror(zlogp, B_FALSE,
897  				    "%s is not in /etc", path);
898  				return (-1);
899  			}
900  		} else {
901  			zerror(zlogp, B_FALSE, "%s is not a directory", path);
902  			return (-1);
903  		}
904  	}
905  	if ((res = resolvepath(path, respath, sizeof (respath))) == -1) {
906  		zerror(zlogp, B_TRUE, "unable to resolve path %s", path);
907  		return (-1);
908  	}
909  	respath[res] = '\0';
910  	if (strcmp(path, respath) != 0) {
911  		/*
912  		 * We don't like ".."s and "."s throwing us off
913  		 */
914  		zerror(zlogp, B_FALSE, "%s is not a canonical path", path);
915  		return (-1);
916  	}
917  	return (0);
918  }
919  
920  /*
921   * Check every component of rootpath/relpath.  If any component fails (ie,
922   * exists but isn't the canonical path to a directory), it is returned in
923   * badpath, which is assumed to be at least of size MAXPATHLEN.
924   *
925   * Relpath must begin with '/'.
926   */
927  static boolean_t
928  valid_mount_path(zlog_t *zlogp, const char *rootpath, const char *relpath)
929  {
930  	char abspath[MAXPATHLEN], *slashp;
931  
932  	/*
933  	 * Make sure abspath has at least one '/' after its rootpath
934  	 * component, and ends with '/'.
935  	 */
936  	if (snprintf(abspath, sizeof (abspath), "%s%s/", rootpath, relpath) >=
937  	    sizeof (abspath)) {
938  		zerror(zlogp, B_FALSE, "pathname %s%s is too long", rootpath,
939  		    relpath);
940  		return (B_FALSE);
941  	}
942  
943  	slashp = &abspath[strlen(rootpath)];
944  	assert(*slashp == '/');
945  	do {
946  		*slashp = '\0';
947  		if (check_path(zlogp, abspath) != 0)
948  			return (B_FALSE);
949  		*slashp = '/';
950  		slashp++;
951  	} while ((slashp = strchr(slashp, '/')) != NULL);
952  	return (B_TRUE);
953  }
954  
955  static int
956  mount_one_dev_device_cb(void *arg, const char *match, const char *name)
957  {
958  	di_prof_t prof = arg;
959  
960  	if (name == NULL)
961  		return (di_prof_add_dev(prof, match));
962  	return (di_prof_add_map(prof, match, name));
963  }
964  
965  static int
966  mount_one_dev_symlink_cb(void *arg, const char *source, const char *target)
967  {
968  	di_prof_t prof = arg;
969  
970  	return (di_prof_add_symlink(prof, source, target));
971  }
972  
973  /*
974   * Apply the standard lists of devices/symlinks/mappings and the user-specified
975   * list of devices (via zonecfg) to the /dev filesystem.  The filesystem will
976   * use these as a profile/filter to determine what exists in /dev.
977   */
978  static int
979  mount_one_dev(zlog_t *zlogp, char *devpath)
980  {
981  	char			brand[MAXNAMELEN];
982  	zone_dochandle_t	handle = NULL;
983  	brand_handle_t		bh = NULL;
984  	struct zone_devtab	ztab;
985  	di_prof_t		prof = NULL;
986  	int			err;
987  	int			retval = -1;
988  
989  	if (di_prof_init(devpath, &prof)) {
990  		zerror(zlogp, B_TRUE, "failed to initialize profile");
991  		goto cleanup;
992  	}
993  
994  	/* Get a handle to the brand info for this zone */
995  	if ((zone_get_brand(zone_name, brand, sizeof (brand)) != Z_OK) ||
996  	    (bh = brand_open(brand)) == NULL) {
997  		zerror(zlogp, B_FALSE, "unable to determine zone brand");
998  		goto cleanup;
999  	}
1000  
1001  	if (brand_platform_iter_devices(bh, zone_name,
1002  	    mount_one_dev_device_cb, prof) != 0) {
1003  		zerror(zlogp, B_TRUE, "failed to add standard device");
1004  		goto cleanup;
1005  	}
1006  
1007  	if (brand_platform_iter_link(bh,
1008  	    mount_one_dev_symlink_cb, prof) != 0) {
1009  		zerror(zlogp, B_TRUE, "failed to add standard symlink");
1010  		goto cleanup;
1011  	}
1012  
1013  	/* Add user-specified devices and directories */
1014  	if ((handle = zonecfg_init_handle()) == NULL) {
1015  		zerror(zlogp, B_FALSE, "can't initialize zone handle");
1016  		goto cleanup;
1017  	}
1018  	if (err = zonecfg_get_handle(zone_name, handle)) {
1019  		zerror(zlogp, B_FALSE, "can't get handle for zone "
1020  		    "%s: %s", zone_name, zonecfg_strerror(err));
1021  		goto cleanup;
1022  	}
1023  	if (err = zonecfg_setdevent(handle)) {
1024  		zerror(zlogp, B_FALSE, "%s: %s", zone_name,
1025  		    zonecfg_strerror(err));
1026  		goto cleanup;
1027  	}
1028  	while (zonecfg_getdevent(handle, &ztab) == Z_OK) {
1029  		if (di_prof_add_dev(prof, ztab.zone_dev_match)) {
1030  			zerror(zlogp, B_TRUE, "failed to add "
1031  			    "user-specified device");
1032  			goto cleanup;
1033  		}
1034  	}
1035  	(void) zonecfg_enddevent(handle);
1036  
1037  	/* Send profile to kernel */
1038  	if (di_prof_commit(prof)) {
1039  		zerror(zlogp, B_TRUE, "failed to commit profile");
1040  		goto cleanup;
1041  	}
1042  
1043  	retval = 0;
1044  
1045  cleanup:
1046  	if (bh != NULL)
1047  		brand_close(bh);
1048  	if (handle)
1049  		zonecfg_fini_handle(handle);
1050  	if (prof)
1051  		di_prof_fini(prof);
1052  	return (retval);
1053  }
1054  
1055  static int
1056  mount_one(zlog_t *zlogp, struct zone_fstab *fsptr, const char *rootpath)
1057  {
1058  	char path[MAXPATHLEN];
1059  	char specpath[MAXPATHLEN];
1060  	char optstr[MAX_MNTOPT_STR];
1061  	zone_fsopt_t *optptr;
1062  	int rv;
1063  
1064  	if (!valid_mount_path(zlogp, rootpath, fsptr->zone_fs_dir)) {
1065  		zerror(zlogp, B_FALSE, "%s%s is not a valid mount point",
1066  		    rootpath, fsptr->zone_fs_dir);
1067  		return (-1);
1068  	}
1069  
1070  	if (make_one_dir(zlogp, rootpath, fsptr->zone_fs_dir,
1071  	    DEFAULT_DIR_MODE) != 0)
1072  		return (-1);
1073  
1074  	(void) snprintf(path, sizeof (path), "%s%s", rootpath,
1075  	    fsptr->zone_fs_dir);
1076  
1077  	if (strlen(fsptr->zone_fs_special) == 0) {
1078  		/*
1079  		 * A zero-length special is how we distinguish IPDs from
1080  		 * general-purpose FSs.  Make sure it mounts from a place that
1081  		 * can be seen via the alternate zone's root.
1082  		 */
1083  		if (snprintf(specpath, sizeof (specpath), "%s%s",
1084  		    zonecfg_get_root(), fsptr->zone_fs_dir) >=
1085  		    sizeof (specpath)) {
1086  			zerror(zlogp, B_FALSE, "cannot mount %s: path too "
1087  			    "long in alternate root", fsptr->zone_fs_dir);
1088  			return (-1);
1089  		}
1090  		if (zonecfg_in_alt_root())
1091  			resolve_lofs(zlogp, specpath, sizeof (specpath));
1092  		if (domount(zlogp, MNTTYPE_LOFS, IPD_DEFAULT_OPTS,
1093  		    specpath, path) != 0) {
1094  			zerror(zlogp, B_TRUE, "failed to loopback mount %s",
1095  			    specpath);
1096  			return (-1);
1097  		}
1098  		return (0);
1099  	}
1100  
1101  	/*
1102  	 * In general the strategy here is to do just as much verification as
1103  	 * necessary to avoid crashing or otherwise doing something bad; if the
1104  	 * administrator initiated the operation via zoneadm(1m), he'll get
1105  	 * auto-verification which will let him know what's wrong.  If he
1106  	 * modifies the zone configuration of a running zone and doesn't attempt
1107  	 * to verify that it's OK we won't crash but won't bother trying to be
1108  	 * too helpful either.  zoneadm verify is only a couple keystrokes away.
1109  	 */
1110  	if (!zonecfg_valid_fs_type(fsptr->zone_fs_type)) {
1111  		zerror(zlogp, B_FALSE, "cannot mount %s on %s: "
1112  		    "invalid file-system type %s", fsptr->zone_fs_special,
1113  		    fsptr->zone_fs_dir, fsptr->zone_fs_type);
1114  		return (-1);
1115  	}
1116  
1117  	/*
1118  	 * If we're looking at an alternate root environment, then construct
1119  	 * read-only loopback mounts as necessary.  For all lofs mounts, make
1120  	 * sure that the 'special' entry points inside the alternate root.  (We
1121  	 * don't do this with other mounts, as devfs isn't in the alternate
1122  	 * root, and we need to assume the device environment is roughly the
1123  	 * same.)
1124  	 */
1125  	if (zonecfg_in_alt_root()) {
1126  		struct stat64 st;
1127  
1128  		if (stat64(fsptr->zone_fs_special, &st) != -1 &&
1129  		    S_ISBLK(st.st_mode)) {
1130  			if (check_lofs_needed(zlogp, fsptr) == -1)
1131  				return (-1);
1132  		} else if (strcmp(fsptr->zone_fs_type, MNTTYPE_LOFS) == 0) {
1133  			if (snprintf(specpath, sizeof (specpath), "%s%s",
1134  			    zonecfg_get_root(), fsptr->zone_fs_special) >=
1135  			    sizeof (specpath)) {
1136  				zerror(zlogp, B_FALSE, "cannot mount %s: path "
1137  				    "too long in alternate root",
1138  				    fsptr->zone_fs_special);
1139  				return (-1);
1140  			}
1141  			resolve_lofs(zlogp, specpath, sizeof (specpath));
1142  			(void) strlcpy(fsptr->zone_fs_special, specpath,
1143  			    sizeof (fsptr->zone_fs_special));
1144  		}
1145  	}
1146  
1147  	/*
1148  	 * Run 'fsck -m' if there's a device to fsck.
1149  	 */
1150  	if (fsptr->zone_fs_raw[0] != '\0' &&
1151  	    dofsck(zlogp, fsptr->zone_fs_type, fsptr->zone_fs_raw) != 0)
1152  		return (-1);
1153  
1154  	/*
1155  	 * Build up mount option string.
1156  	 */
1157  	optstr[0] = '\0';
1158  	if (fsptr->zone_fs_options != NULL) {
1159  		(void) strlcpy(optstr, fsptr->zone_fs_options->zone_fsopt_opt,
1160  		    sizeof (optstr));
1161  		for (optptr = fsptr->zone_fs_options->zone_fsopt_next;
1162  		    optptr != NULL; optptr = optptr->zone_fsopt_next) {
1163  			(void) strlcat(optstr, ",", sizeof (optstr));
1164  			(void) strlcat(optstr, optptr->zone_fsopt_opt,
1165  			    sizeof (optstr));
1166  		}
1167  	}
1168  
1169  	if ((rv = domount(zlogp, fsptr->zone_fs_type, optstr,
1170  	    fsptr->zone_fs_special, path)) != 0)
1171  		return (rv);
1172  
1173  	/*
1174  	 * The mount succeeded.  If this was not a mount of /dev then
1175  	 * we're done.
1176  	 */
1177  	if (strcmp(fsptr->zone_fs_type, MNTTYPE_DEV) != 0)
1178  		return (0);
1179  
1180  	/*
1181  	 * We just mounted an instance of a /dev filesystem, so now we
1182  	 * need to configure it.
1183  	 */
1184  	return (mount_one_dev(zlogp, path));
1185  }
1186  
1187  static void
1188  free_fs_data(struct zone_fstab *fsarray, uint_t nelem)
1189  {
1190  	uint_t i;
1191  
1192  	if (fsarray == NULL)
1193  		return;
1194  	for (i = 0; i < nelem; i++)
1195  		zonecfg_free_fs_option_list(fsarray[i].zone_fs_options);
1196  	free(fsarray);
1197  }
1198  
1199  /*
1200   * This function initiates the creation of a small Solaris Environment for
1201   * scratch zone. The Environment creation process is split up into two
1202   * functions(build_mounted_pre_var() and build_mounted_post_var()). It
1203   * is done this way because:
1204   * 	We need to have both /etc and /var in the root of the scratchzone.
1205   * 	We loopback mount zone's own /etc and /var into the root of the
1206   * 	scratch zone. Unlike /etc, /var can be a seperate filesystem. So we
1207   * 	need to delay the mount of /var till the zone's root gets populated.
1208   *	So mounting of localdirs[](/etc and /var) have been moved to the
1209   * 	build_mounted_post_var() which gets called only after the zone
1210   * 	specific filesystems are mounted.
1211   */
1212  static boolean_t
1213  build_mounted_pre_var(zlog_t *zlogp, char *rootpath,
1214      size_t rootlen, const char *zonepath)
1215  {
1216  	char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1217  	char luroot[MAXPATHLEN];
1218  	const char **cpp;
1219  	static const char *mkdirs[] = {
1220  		"/system", "/system/contract", "/system/object", "/proc",
1221  		"/dev", "/tmp", "/a", NULL
1222  	};
1223  	char *altstr;
1224  	FILE *fp;
1225  	uuid_t uuid;
1226  
1227  	assert(zone_isnative);
1228  
1229  	resolve_lofs(zlogp, rootpath, rootlen);
1230  	(void) snprintf(luroot, sizeof (luroot), "%s/lu", zonepath);
1231  	resolve_lofs(zlogp, luroot, sizeof (luroot));
1232  	(void) snprintf(tmp, sizeof (tmp), "%s/bin", luroot);
1233  	(void) symlink("./usr/bin", tmp);
1234  
1235  	/*
1236  	 * These are mostly special mount points; not handled here.  (See
1237  	 * zone_mount_early.)
1238  	 */
1239  	for (cpp = mkdirs; *cpp != NULL; cpp++) {
1240  		(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1241  		if (mkdir(tmp, 0755) != 0) {
1242  			zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1243  			return (B_FALSE);
1244  		}
1245  	}
1246  	/*
1247  	 * This is here to support lucopy.  If there's an instance of this same
1248  	 * zone on the current running system, then we mount its root up as
1249  	 * read-only inside the scratch zone.
1250  	 */
1251  	(void) zonecfg_get_uuid(zone_name, uuid);
1252  	altstr = strdup(zonecfg_get_root());
1253  	if (altstr == NULL) {
1254  		zerror(zlogp, B_TRUE, "memory allocation failed");
1255  		return (B_FALSE);
1256  	}
1257  	zonecfg_set_root("");
1258  	(void) strlcpy(tmp, zone_name, sizeof (tmp));
1259  	(void) zonecfg_get_name_by_uuid(uuid, tmp, sizeof (tmp));
1260  	if (zone_get_rootpath(tmp, fromdir, sizeof (fromdir)) == Z_OK &&
1261  	    strcmp(fromdir, rootpath) != 0) {
1262  		(void) snprintf(tmp, sizeof (tmp), "%s/b", luroot);
1263  		if (mkdir(tmp, 0755) != 0) {
1264  			zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1265  			return (B_FALSE);
1266  		}
1267  		if (domount(zlogp, MNTTYPE_LOFS, IPD_DEFAULT_OPTS, fromdir,
1268  		    tmp) != 0) {
1269  			zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1270  			    fromdir);
1271  			return (B_FALSE);
1272  		}
1273  	}
1274  	zonecfg_set_root(altstr);
1275  	free(altstr);
1276  
1277  	if ((fp = zonecfg_open_scratch(luroot, B_TRUE)) == NULL) {
1278  		zerror(zlogp, B_TRUE, "cannot open zone mapfile");
1279  		return (B_FALSE);
1280  	}
1281  	(void) ftruncate(fileno(fp), 0);
1282  	if (zonecfg_add_scratch(fp, zone_name, kernzone, "/") == -1) {
1283  		zerror(zlogp, B_TRUE, "cannot add zone mapfile entry");
1284  	}
1285  	zonecfg_close_scratch(fp);
1286  	(void) snprintf(tmp, sizeof (tmp), "%s/a", luroot);
1287  	if (domount(zlogp, MNTTYPE_LOFS, "", rootpath, tmp) != 0)
1288  		return (B_FALSE);
1289  	(void) strlcpy(rootpath, tmp, rootlen);
1290  	return (B_TRUE);
1291  }
1292  
1293  
1294  static boolean_t
1295  build_mounted_post_var(zlog_t *zlogp, char *rootpath, const char *zonepath)
1296  {
1297  	char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1298  	char luroot[MAXPATHLEN];
1299  	const char **cpp;
1300  	static const char *localdirs[] = {
1301  		"/etc", "/var", NULL
1302  	};
1303  	static const char *loopdirs[] = {
1304  		"/etc/lib", "/etc/fs", "/lib", "/sbin", "/platform",
1305  		"/usr", NULL
1306  	};
1307  	static const char *tmpdirs[] = {
1308  		"/tmp", "/var/run", NULL
1309  	};
1310  	struct stat st;
1311  
1312  	(void) snprintf(luroot, sizeof (luroot), "%s/lu", zonepath);
1313  
1314  	/*
1315  	 * These are mounted read-write from the zone undergoing upgrade.  We
1316  	 * must be careful not to 'leak' things from the main system into the
1317  	 * zone, and this accomplishes that goal.
1318  	 */
1319  	for (cpp = localdirs; *cpp != NULL; cpp++) {
1320  		(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1321  		(void) snprintf(fromdir, sizeof (fromdir), "%s%s", rootpath,
1322  		    *cpp);
1323  		if (mkdir(tmp, 0755) != 0) {
1324  			zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1325  			return (B_FALSE);
1326  		}
1327  		if (domount(zlogp, MNTTYPE_LOFS, "", fromdir, tmp) != 0) {
1328  			zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1329  			    *cpp);
1330  			return (B_FALSE);
1331  		}
1332  	}
1333  
1334  	/*
1335  	 * These are things mounted read-only from the running system because
1336  	 * they contain binaries that must match system.
1337  	 */
1338  	for (cpp = loopdirs; *cpp != NULL; cpp++) {
1339  		(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1340  		if (mkdir(tmp, 0755) != 0) {
1341  			if (errno != EEXIST) {
1342  				zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1343  				return (B_FALSE);
1344  			}
1345  			if (lstat(tmp, &st) != 0) {
1346  				zerror(zlogp, B_TRUE, "cannot stat %s", tmp);
1347  				return (B_FALSE);
1348  			}
1349  			/*
1350  			 * Ignore any non-directories encountered.  These are
1351  			 * things that have been converted into symlinks
1352  			 * (/etc/fs and /etc/lib) and no longer need a lofs
1353  			 * fixup.
1354  			 */
1355  			if (!S_ISDIR(st.st_mode))
1356  				continue;
1357  		}
1358  		if (domount(zlogp, MNTTYPE_LOFS, IPD_DEFAULT_OPTS, *cpp,
1359  		    tmp) != 0) {
1360  			zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1361  			    *cpp);
1362  			return (B_FALSE);
1363  		}
1364  	}
1365  
1366  	/*
1367  	 * These are things with tmpfs mounted inside.
1368  	 */
1369  	for (cpp = tmpdirs; *cpp != NULL; cpp++) {
1370  		(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1371  		if (mkdir(tmp, 0755) != 0 && errno != EEXIST) {
1372  			zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1373  			return (B_FALSE);
1374  		}
1375  		if (domount(zlogp, MNTTYPE_TMPFS, "", "swap", tmp) != 0) {
1376  			zerror(zlogp, B_TRUE, "cannot mount swap on %s", *cpp);
1377  			return (B_FALSE);
1378  		}
1379  	}
1380  	return (B_TRUE);
1381  }
1382  
1383  typedef struct plat_gmount_cb_data {
1384  	zlog_t			*pgcd_zlogp;
1385  	struct zone_fstab	**pgcd_fs_tab;
1386  	int			*pgcd_num_fs;
1387  } plat_gmount_cb_data_t;
1388  
1389  /*
1390   * plat_gmount_cb() is a callback function invoked by libbrand to iterate
1391   * through all global brand platform mounts.
1392   */
1393  int
1394  plat_gmount_cb(void *data, const char *spec, const char *dir,
1395      const char *fstype, const char *opt)
1396  {
1397  	plat_gmount_cb_data_t	*cp = data;
1398  	zlog_t			*zlogp = cp->pgcd_zlogp;
1399  	struct zone_fstab	*fs_ptr = *cp->pgcd_fs_tab;
1400  	int			num_fs = *cp->pgcd_num_fs;
1401  	struct zone_fstab	*fsp, *tmp_ptr;
1402  
1403  	num_fs++;
1404  	if ((tmp_ptr = realloc(fs_ptr, num_fs * sizeof (*tmp_ptr))) == NULL) {
1405  		zerror(zlogp, B_TRUE, "memory allocation failed");
1406  		return (-1);
1407  	}
1408  
1409  	fs_ptr = tmp_ptr;
1410  	fsp = &fs_ptr[num_fs - 1];
1411  
1412  	/* update the callback struct passed in */
1413  	*cp->pgcd_fs_tab = fs_ptr;
1414  	*cp->pgcd_num_fs = num_fs;
1415  
1416  	fsp->zone_fs_raw[0] = '\0';
1417  	(void) strlcpy(fsp->zone_fs_special, spec,
1418  	    sizeof (fsp->zone_fs_special));
1419  	(void) strlcpy(fsp->zone_fs_dir, dir, sizeof (fsp->zone_fs_dir));
1420  	(void) strlcpy(fsp->zone_fs_type, fstype, sizeof (fsp->zone_fs_type));
1421  	fsp->zone_fs_options = NULL;
1422  	if (zonecfg_add_fs_option(fsp, (char *)opt) != Z_OK) {
1423  		zerror(zlogp, B_FALSE, "error adding property");
1424  		return (-1);
1425  	}
1426  
1427  	return (0);
1428  }
1429  
1430  static int
1431  mount_filesystems_ipdent(zone_dochandle_t handle, zlog_t *zlogp,
1432      struct zone_fstab **fs_tabp, int *num_fsp)
1433  {
1434  	struct zone_fstab *tmp_ptr, *fs_ptr, *fsp, fstab;
1435  	int num_fs;
1436  
1437  	num_fs = *num_fsp;
1438  	fs_ptr = *fs_tabp;
1439  
1440  	if (zonecfg_setipdent(handle) != Z_OK) {
1441  		zerror(zlogp, B_FALSE, "invalid configuration");
1442  		return (-1);
1443  	}
1444  	while (zonecfg_getipdent(handle, &fstab) == Z_OK) {
1445  		num_fs++;
1446  		if ((tmp_ptr = realloc(fs_ptr,
1447  		    num_fs * sizeof (*tmp_ptr))) == NULL) {
1448  			zerror(zlogp, B_TRUE, "memory allocation failed");
1449  			(void) zonecfg_endipdent(handle);
1450  			return (-1);
1451  		}
1452  
1453  		/* update the pointers passed in */
1454  		*fs_tabp = tmp_ptr;
1455  		*num_fsp = num_fs;
1456  
1457  		/*
1458  		 * IPDs logically only have a mount point; all other properties
1459  		 * are implied.
1460  		 */
1461  		fs_ptr = tmp_ptr;
1462  		fsp = &fs_ptr[num_fs - 1];
1463  		(void) strlcpy(fsp->zone_fs_dir,
1464  		    fstab.zone_fs_dir, sizeof (fsp->zone_fs_dir));
1465  		fsp->zone_fs_special[0] = '\0';
1466  		fsp->zone_fs_raw[0] = '\0';
1467  		fsp->zone_fs_type[0] = '\0';
1468  		fsp->zone_fs_options = NULL;
1469  	}
1470  	(void) zonecfg_endipdent(handle);
1471  	return (0);
1472  }
1473  
1474  static int
1475  mount_filesystems_fsent(zone_dochandle_t handle, zlog_t *zlogp,
1476      struct zone_fstab **fs_tabp, int *num_fsp, int mount_cmd)
1477  {
1478  	struct zone_fstab *tmp_ptr, *fs_ptr, *fsp, fstab;
1479  	int num_fs;
1480  
1481  	num_fs = *num_fsp;
1482  	fs_ptr = *fs_tabp;
1483  
1484  	if (zonecfg_setfsent(handle) != Z_OK) {
1485  		zerror(zlogp, B_FALSE, "invalid configuration");
1486  		return (-1);
1487  	}
1488  	while (zonecfg_getfsent(handle, &fstab) == Z_OK) {
1489  		/*
1490  		 * ZFS filesystems will not be accessible under an alternate
1491  		 * root, since the pool will not be known.  Ignore them in this
1492  		 * case.
1493  		 */
1494  		if (mount_cmd && strcmp(fstab.zone_fs_type, MNTTYPE_ZFS) == 0)
1495  			continue;
1496  
1497  		num_fs++;
1498  		if ((tmp_ptr = realloc(fs_ptr,
1499  		    num_fs * sizeof (*tmp_ptr))) == NULL) {
1500  			zerror(zlogp, B_TRUE, "memory allocation failed");
1501  			(void) zonecfg_endfsent(handle);
1502  			return (-1);
1503  		}
1504  		/* update the pointers passed in */
1505  		*fs_tabp = tmp_ptr;
1506  		*num_fsp = num_fs;
1507  
1508  		fs_ptr = tmp_ptr;
1509  		fsp = &fs_ptr[num_fs - 1];
1510  		(void) strlcpy(fsp->zone_fs_dir,
1511  		    fstab.zone_fs_dir, sizeof (fsp->zone_fs_dir));
1512  		(void) strlcpy(fsp->zone_fs_special, fstab.zone_fs_special,
1513  		    sizeof (fsp->zone_fs_special));
1514  		(void) strlcpy(fsp->zone_fs_raw, fstab.zone_fs_raw,
1515  		    sizeof (fsp->zone_fs_raw));
1516  		(void) strlcpy(fsp->zone_fs_type, fstab.zone_fs_type,
1517  		    sizeof (fsp->zone_fs_type));
1518  		fsp->zone_fs_options = fstab.zone_fs_options;
1519  	}
1520  	(void) zonecfg_endfsent(handle);
1521  	return (0);
1522  }
1523  
1524  static int
1525  mount_filesystems(zlog_t *zlogp, boolean_t mount_cmd)
1526  {
1527  	char rootpath[MAXPATHLEN];
1528  	char zonepath[MAXPATHLEN];
1529  	char brand[MAXNAMELEN];
1530  	int i, num_fs = 0;
1531  	struct zone_fstab *fs_ptr = NULL;
1532  	zone_dochandle_t handle = NULL;
1533  	zone_state_t zstate;
1534  	brand_handle_t bh;
1535  	plat_gmount_cb_data_t cb;
1536  
1537  	if (zone_get_state(zone_name, &zstate) != Z_OK ||
1538  	    (zstate != ZONE_STATE_READY && zstate != ZONE_STATE_MOUNTED)) {
1539  		zerror(zlogp, B_FALSE,
1540  		    "zone must be in '%s' or '%s' state to mount file-systems",
1541  		    zone_state_str(ZONE_STATE_READY),
1542  		    zone_state_str(ZONE_STATE_MOUNTED));
1543  		goto bad;
1544  	}
1545  
1546  	if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
1547  		zerror(zlogp, B_TRUE, "unable to determine zone path");
1548  		goto bad;
1549  	}
1550  
1551  	if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
1552  		zerror(zlogp, B_TRUE, "unable to determine zone root");
1553  		goto bad;
1554  	}
1555  
1556  	if ((handle = zonecfg_init_handle()) == NULL) {
1557  		zerror(zlogp, B_TRUE, "getting zone configuration handle");
1558  		goto bad;
1559  	}
1560  	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK ||
1561  	    zonecfg_setfsent(handle) != Z_OK) {
1562  		zerror(zlogp, B_FALSE, "invalid configuration");
1563  		goto bad;
1564  	}
1565  
1566  	/* Get a handle to the brand info for this zone */
1567  	if ((zone_get_brand(zone_name, brand, sizeof (brand)) != Z_OK) ||
1568  	    (bh = brand_open(brand)) == NULL) {
1569  		zerror(zlogp, B_FALSE, "unable to determine zone brand");
1570  		return (-1);
1571  	}
1572  
1573  	/*
1574  	 * Get the list of global filesystems to mount from the brand
1575  	 * configuration.
1576  	 */
1577  	cb.pgcd_zlogp = zlogp;
1578  	cb.pgcd_fs_tab = &fs_ptr;
1579  	cb.pgcd_num_fs = &num_fs;
1580  	if (brand_platform_iter_gmounts(bh, zonepath,
1581  	    plat_gmount_cb, &cb) != 0) {
1582  		zerror(zlogp, B_FALSE, "unable to mount filesystems");
1583  		brand_close(bh);
1584  		return (-1);
1585  	}
1586  	brand_close(bh);
1587  
1588  	/*
1589  	 * Iterate through the rest of the filesystems, first the IPDs, then
1590  	 * the general FSs.  Sort them all, then mount them in sorted order.
1591  	 * This is to make sure the higher level directories (e.g., /usr)
1592  	 * get mounted before any beneath them (e.g., /usr/local).
1593  	 */
1594  	if (mount_filesystems_ipdent(handle, zlogp, &fs_ptr, &num_fs) != 0)
1595  		goto bad;
1596  
1597  	if (mount_filesystems_fsent(handle, zlogp, &fs_ptr, &num_fs,
1598  	    mount_cmd) != 0)
1599  		goto bad;
1600  
1601  	zonecfg_fini_handle(handle);
1602  	handle = NULL;
1603  
1604  	/*
1605  	 * Normally when we mount a zone all the zone filesystems
1606  	 * get mounted relative to rootpath, which is usually
1607  	 * <zonepath>/root.  But when mounting a zone for administration
1608  	 * purposes via the zone "mount" state, build_mounted_pre_var()
1609  	 * updates rootpath to be <zonepath>/lu/a so we'll mount all
1610  	 * the zones filesystems there instead.
1611  	 *
1612  	 * build_mounted_pre_var() and build_mounted_post_var() will
1613  	 * also do some extra work to create directories and lofs mount
1614  	 * a bunch of global zone file system paths into <zonepath>/lu.
1615  	 *
1616  	 * This allows us to be able to enter the zone (now rooted at
1617  	 * <zonepath>/lu) and run the upgrade/patch tools that are in the
1618  	 * global zone and have them upgrade the to-be-modified zone's
1619  	 * files mounted on /a.  (Which mirrors the existing standard
1620  	 * upgrade environment.)
1621  	 *
1622  	 * There is of course one catch.  When doing the upgrade
1623  	 * we need <zoneroot>/lu/dev to be the /dev filesystem
1624  	 * for the zone and we don't want to have any /dev filesystem
1625  	 * mounted at <zoneroot>/lu/a/dev.  Since /dev is specified
1626  	 * as a normal zone filesystem by default we'll try to mount
1627  	 * it at <zoneroot>/lu/a/dev, so we have to detect this
1628  	 * case and instead mount it at <zoneroot>/lu/dev.
1629  	 *
1630  	 * All this work is done in three phases:
1631  	 *   1) Create and populate lu directory (build_mounted_pre_var()).
1632  	 *   2) Mount the required filesystems as per the zone configuration.
1633  	 *   3) Set up the rest of the scratch zone environment
1634  	 *	(build_mounted_post_var()).
1635  	 */
1636  	if (mount_cmd &&
1637  	    !build_mounted_pre_var(zlogp,
1638  	    rootpath, sizeof (rootpath), zonepath))
1639  		goto bad;
1640  
1641  	qsort(fs_ptr, num_fs, sizeof (*fs_ptr), fs_compare);
1642  
1643  	for (i = 0; i < num_fs; i++) {
1644  		if (mount_cmd &&
1645  		    strcmp(fs_ptr[i].zone_fs_dir, "/dev") == 0) {
1646  			size_t slen = strlen(rootpath) - 2;
1647  
1648  			/*
1649  			 * By default we'll try to mount /dev as /a/dev
1650  			 * but /dev is special and always goes at the top
1651  			 * so strip the trailing '/a' from the rootpath.
1652  			 */
1653  			assert(zone_isnative);
1654  			assert(strcmp(&rootpath[slen], "/a") == 0);
1655  			rootpath[slen] = '\0';
1656  			if (mount_one(zlogp, &fs_ptr[i], rootpath) != 0)
1657  				goto bad;
1658  			rootpath[slen] = '/';
1659  			continue;
1660  		}
1661  		if (mount_one(zlogp, &fs_ptr[i], rootpath) != 0)
1662  			goto bad;
1663  	}
1664  	if (mount_cmd &&
1665  	    !build_mounted_post_var(zlogp, rootpath, zonepath))
1666  		goto bad;
1667  
1668  	/*
1669  	 * For Trusted Extensions cross-mount each lower level /export/home
1670  	 */
1671  	if (!mount_cmd && tsol_mounts(zlogp, zone_name, rootpath) != 0)
1672  		goto bad;
1673  
1674  	free_fs_data(fs_ptr, num_fs);
1675  
1676  	/*
1677  	 * Everything looks fine.
1678  	 */
1679  	return (0);
1680  
1681  bad:
1682  	if (handle != NULL)
1683  		zonecfg_fini_handle(handle);
1684  	free_fs_data(fs_ptr, num_fs);
1685  	return (-1);
1686  }
1687  
1688  /* caller makes sure neither parameter is NULL */
1689  static int
1690  addr2netmask(char *prefixstr, int maxprefixlen, uchar_t *maskstr)
1691  {
1692  	int prefixlen;
1693  
1694  	prefixlen = atoi(prefixstr);
1695  	if (prefixlen < 0 || prefixlen > maxprefixlen)
1696  		return (1);
1697  	while (prefixlen > 0) {
1698  		if (prefixlen >= 8) {
1699  			*maskstr++ = 0xFF;
1700  			prefixlen -= 8;
1701  			continue;
1702  		}
1703  		*maskstr |= 1 << (8 - prefixlen);
1704  		prefixlen--;
1705  	}
1706  	return (0);
1707  }
1708  
1709  /*
1710   * Tear down all interfaces belonging to the given zone.  This should
1711   * be called with the zone in a state other than "running", so that
1712   * interfaces can't be assigned to the zone after this returns.
1713   *
1714   * If anything goes wrong, log an error message and return an error.
1715   */
1716  static int
1717  unconfigure_network_interfaces(zlog_t *zlogp, zoneid_t zone_id)
1718  {
1719  	struct lifnum lifn;
1720  	struct lifconf lifc;
1721  	struct lifreq *lifrp, lifrl;
1722  	int64_t lifc_flags = LIFC_NOXMIT | LIFC_ALLZONES;
1723  	int num_ifs, s, i, ret_code = 0;
1724  	uint_t bufsize;
1725  	char *buf = NULL;
1726  
1727  	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
1728  		zerror(zlogp, B_TRUE, "could not get socket");
1729  		ret_code = -1;
1730  		goto bad;
1731  	}
1732  	lifn.lifn_family = AF_UNSPEC;
1733  	lifn.lifn_flags = (int)lifc_flags;
1734  	if (ioctl(s, SIOCGLIFNUM, (char *)&lifn) < 0) {
1735  		zerror(zlogp, B_TRUE,
1736  		    "could not determine number of interfaces");
1737  		ret_code = -1;
1738  		goto bad;
1739  	}
1740  	num_ifs = lifn.lifn_count;
1741  	bufsize = num_ifs * sizeof (struct lifreq);
1742  	if ((buf = malloc(bufsize)) == NULL) {
1743  		zerror(zlogp, B_TRUE, "memory allocation failed");
1744  		ret_code = -1;
1745  		goto bad;
1746  	}
1747  	lifc.lifc_family = AF_UNSPEC;
1748  	lifc.lifc_flags = (int)lifc_flags;
1749  	lifc.lifc_len = bufsize;
1750  	lifc.lifc_buf = buf;
1751  	if (ioctl(s, SIOCGLIFCONF, (char *)&lifc) < 0) {
1752  		zerror(zlogp, B_TRUE, "could not get configured interfaces");
1753  		ret_code = -1;
1754  		goto bad;
1755  	}
1756  	lifrp = lifc.lifc_req;
1757  	for (i = lifc.lifc_len / sizeof (struct lifreq); i > 0; i--, lifrp++) {
1758  		(void) close(s);
1759  		if ((s = socket(lifrp->lifr_addr.ss_family, SOCK_DGRAM, 0)) <
1760  		    0) {
1761  			zerror(zlogp, B_TRUE, "%s: could not get socket",
1762  			    lifrl.lifr_name);
1763  			ret_code = -1;
1764  			continue;
1765  		}
1766  		(void) memset(&lifrl, 0, sizeof (lifrl));
1767  		(void) strncpy(lifrl.lifr_name, lifrp->lifr_name,
1768  		    sizeof (lifrl.lifr_name));
1769  		if (ioctl(s, SIOCGLIFZONE, (caddr_t)&lifrl) < 0) {
1770  			zerror(zlogp, B_TRUE,
1771  			    "%s: could not determine zone interface belongs to",
1772  			    lifrl.lifr_name);
1773  			ret_code = -1;
1774  			continue;
1775  		}
1776  		if (lifrl.lifr_zoneid == zone_id) {
1777  			if (ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifrl) < 0) {
1778  				zerror(zlogp, B_TRUE,
1779  				    "%s: could not remove interface",
1780  				    lifrl.lifr_name);
1781  				ret_code = -1;
1782  				continue;
1783  			}
1784  		}
1785  	}
1786  bad:
1787  	if (s > 0)
1788  		(void) close(s);
1789  	if (buf)
1790  		free(buf);
1791  	return (ret_code);
1792  }
1793  
1794  static union	sockunion {
1795  	struct	sockaddr sa;
1796  	struct	sockaddr_in sin;
1797  	struct	sockaddr_dl sdl;
1798  	struct	sockaddr_in6 sin6;
1799  } so_dst, so_ifp;
1800  
1801  static struct {
1802  	struct	rt_msghdr hdr;
1803  	char	space[512];
1804  } rtmsg;
1805  
1806  static int
1807  salen(struct sockaddr *sa)
1808  {
1809  	switch (sa->sa_family) {
1810  	case AF_INET:
1811  		return (sizeof (struct sockaddr_in));
1812  	case AF_LINK:
1813  		return (sizeof (struct sockaddr_dl));
1814  	case AF_INET6:
1815  		return (sizeof (struct sockaddr_in6));
1816  	default:
1817  		return (sizeof (struct sockaddr));
1818  	}
1819  }
1820  
1821  #define	ROUNDUP_LONG(a) \
1822  	((a) > 0 ? (1 + (((a) - 1) | (sizeof (long) - 1))) : sizeof (long))
1823  
1824  /*
1825   * Look up which zone is using a given IP address.  The address in question
1826   * is expected to have been stuffed into the structure to which lifr points
1827   * via a previous SIOCGLIFADDR ioctl().
1828   *
1829   * This is done using black router socket magic.
1830   *
1831   * Return the name of the zone on success or NULL on failure.
1832   *
1833   * This is a lot of code for a simple task; a new ioctl request to take care
1834   * of this might be a useful RFE.
1835   */
1836  
1837  static char *
1838  who_is_using(zlog_t *zlogp, struct lifreq *lifr)
1839  {
1840  	static char answer[ZONENAME_MAX];
1841  	pid_t pid;
1842  	int s, rlen, l, i;
1843  	char *cp = rtmsg.space;
1844  	struct sockaddr_dl *ifp = NULL;
1845  	struct sockaddr *sa;
1846  	char save_if_name[LIFNAMSIZ];
1847  
1848  	answer[0] = '\0';
1849  
1850  	pid = getpid();
1851  	if ((s = socket(PF_ROUTE, SOCK_RAW, 0)) < 0) {
1852  		zerror(zlogp, B_TRUE, "could not get routing socket");
1853  		return (NULL);
1854  	}
1855  
1856  	if (lifr->lifr_addr.ss_family == AF_INET) {
1857  		struct sockaddr_in *sin4;
1858  
1859  		so_dst.sa.sa_family = AF_INET;
1860  		sin4 = (struct sockaddr_in *)&lifr->lifr_addr;
1861  		so_dst.sin.sin_addr = sin4->sin_addr;
1862  	} else {
1863  		struct sockaddr_in6 *sin6;
1864  
1865  		so_dst.sa.sa_family = AF_INET6;
1866  		sin6 = (struct sockaddr_in6 *)&lifr->lifr_addr;
1867  		so_dst.sin6.sin6_addr = sin6->sin6_addr;
1868  	}
1869  
1870  	so_ifp.sa.sa_family = AF_LINK;
1871  
1872  	(void) memset(&rtmsg, 0, sizeof (rtmsg));
1873  	rtmsg.hdr.rtm_type = RTM_GET;
1874  	rtmsg.hdr.rtm_flags = RTF_UP | RTF_HOST;
1875  	rtmsg.hdr.rtm_version = RTM_VERSION;
1876  	rtmsg.hdr.rtm_seq = ++rts_seqno;
1877  	rtmsg.hdr.rtm_addrs = RTA_IFP | RTA_DST;
1878  
1879  	l = ROUNDUP_LONG(salen(&so_dst.sa));
1880  	(void) memmove(cp, &(so_dst), l);
1881  	cp += l;
1882  	l = ROUNDUP_LONG(salen(&so_ifp.sa));
1883  	(void) memmove(cp, &(so_ifp), l);
1884  	cp += l;
1885  
1886  	rtmsg.hdr.rtm_msglen = l = cp - (char *)&rtmsg;
1887  
1888  	if ((rlen = write(s, &rtmsg, l)) < 0) {
1889  		zerror(zlogp, B_TRUE, "writing to routing socket");
1890  		return (NULL);
1891  	} else if (rlen < (int)rtmsg.hdr.rtm_msglen) {
1892  		zerror(zlogp, B_TRUE,
1893  		    "write to routing socket got only %d for len\n", rlen);
1894  		return (NULL);
1895  	}
1896  	do {
1897  		l = read(s, &rtmsg, sizeof (rtmsg));
1898  	} while (l > 0 && (rtmsg.hdr.rtm_seq != rts_seqno ||
1899  	    rtmsg.hdr.rtm_pid != pid));
1900  	if (l < 0) {
1901  		zerror(zlogp, B_TRUE, "reading from routing socket");
1902  		return (NULL);
1903  	}
1904  
1905  	if (rtmsg.hdr.rtm_version != RTM_VERSION) {
1906  		zerror(zlogp, B_FALSE,
1907  		    "routing message version %d not understood",
1908  		    rtmsg.hdr.rtm_version);
1909  		return (NULL);
1910  	}
1911  	if (rtmsg.hdr.rtm_msglen != (ushort_t)l) {
1912  		zerror(zlogp, B_FALSE, "message length mismatch, "
1913  		    "expected %d bytes, returned %d bytes",
1914  		    rtmsg.hdr.rtm_msglen, l);
1915  		return (NULL);
1916  	}
1917  	if (rtmsg.hdr.rtm_errno != 0)  {
1918  		errno = rtmsg.hdr.rtm_errno;
1919  		zerror(zlogp, B_TRUE, "RTM_GET routing socket message");
1920  		return (NULL);
1921  	}
1922  	if ((rtmsg.hdr.rtm_addrs & RTA_IFP) == 0) {
1923  		zerror(zlogp, B_FALSE, "interface not found");
1924  		return (NULL);
1925  	}
1926  	cp = ((char *)(&rtmsg.hdr + 1));
1927  	for (i = 1; i != 0; i <<= 1) {
1928  		/* LINTED E_BAD_PTR_CAST_ALIGN */
1929  		sa = (struct sockaddr *)cp;
1930  		if (i != RTA_IFP) {
1931  			if ((i & rtmsg.hdr.rtm_addrs) != 0)
1932  				cp += ROUNDUP_LONG(salen(sa));
1933  			continue;
1934  		}
1935  		if (sa->sa_family == AF_LINK &&
1936  		    ((struct sockaddr_dl *)sa)->sdl_nlen != 0)
1937  			ifp = (struct sockaddr_dl *)sa;
1938  		break;
1939  	}
1940  	if (ifp == NULL) {
1941  		zerror(zlogp, B_FALSE, "interface could not be determined");
1942  		return (NULL);
1943  	}
1944  
1945  	/*
1946  	 * We need to set the I/F name to what we got above, then do the
1947  	 * appropriate ioctl to get its zone name.  But lifr->lifr_name is
1948  	 * used by the calling function to do a REMOVEIF, so if we leave the
1949  	 * "good" zone's I/F name in place, *that* I/F will be removed instead
1950  	 * of the bad one.  So we save the old (bad) I/F name before over-
1951  	 * writing it and doing the ioctl, then restore it after the ioctl.
1952  	 */
1953  	(void) strlcpy(save_if_name, lifr->lifr_name, sizeof (save_if_name));
1954  	(void) strncpy(lifr->lifr_name, ifp->sdl_data, ifp->sdl_nlen);
1955  	lifr->lifr_name[ifp->sdl_nlen] = '\0';
1956  	i = ioctl(s, SIOCGLIFZONE, lifr);
1957  	(void) strlcpy(lifr->lifr_name, save_if_name, sizeof (save_if_name));
1958  	if (i < 0) {
1959  		zerror(zlogp, B_TRUE,
1960  		    "%s: could not determine the zone interface belongs to",
1961  		    lifr->lifr_name);
1962  		return (NULL);
1963  	}
1964  	if (getzonenamebyid(lifr->lifr_zoneid, answer, sizeof (answer)) < 0)
1965  		(void) snprintf(answer, sizeof (answer), "%d",
1966  		    lifr->lifr_zoneid);
1967  
1968  	if (strlen(answer) > 0)
1969  		return (answer);
1970  	return (NULL);
1971  }
1972  
1973  typedef struct mcast_rtmsg_s {
1974  	struct rt_msghdr	m_rtm;
1975  	union {
1976  		struct {
1977  			struct sockaddr_in	m_dst;
1978  			struct sockaddr_in	m_gw;
1979  			struct sockaddr_in	m_netmask;
1980  		} m_v4;
1981  		struct {
1982  			struct sockaddr_in6	m_dst;
1983  			struct sockaddr_in6	m_gw;
1984  			struct sockaddr_in6	m_netmask;
1985  		} m_v6;
1986  	} m_u;
1987  } mcast_rtmsg_t;
1988  #define	m_dst4		m_u.m_v4.m_dst
1989  #define	m_dst6		m_u.m_v6.m_dst
1990  #define	m_gw4		m_u.m_v4.m_gw
1991  #define	m_gw6		m_u.m_v6.m_gw
1992  #define	m_netmask4	m_u.m_v4.m_netmask
1993  #define	m_netmask6	m_u.m_v6.m_netmask
1994  
1995  /*
1996   * Configures a single interface: a new virtual interface is added, based on
1997   * the physical interface nwiftabptr->zone_nwif_physical, with the address
1998   * specified in nwiftabptr->zone_nwif_address, for zone zone_id.  Note that
1999   * the "address" can be an IPv6 address (with a /prefixlength required), an
2000   * IPv4 address (with a /prefixlength optional), or a name; for the latter,
2001   * an IPv4 name-to-address resolution will be attempted.
2002   *
2003   * A default interface route for multicast is created on the first IPv4 and
2004   * IPv6 interfaces (that have the IFF_MULTICAST flag set), respectively.
2005   * This should really be done in the init scripts if we ever allow zones to
2006   * modify the routing tables.
2007   *
2008   * If anything goes wrong, we log an detailed error message, attempt to tear
2009   * down whatever we set up and return an error.
2010   */
2011  static int
2012  configure_one_interface(zlog_t *zlogp, zoneid_t zone_id,
2013      struct zone_nwiftab *nwiftabptr, boolean_t *mcast_rt_v4_setp,
2014      boolean_t *mcast_rt_v6_setp)
2015  {
2016  	struct lifreq lifr;
2017  	struct sockaddr_in netmask4;
2018  	struct sockaddr_in6 netmask6;
2019  	struct in_addr in4;
2020  	struct in6_addr in6;
2021  	sa_family_t af;
2022  	char *slashp = strchr(nwiftabptr->zone_nwif_address, '/');
2023  	mcast_rtmsg_t mcast_rtmsg;
2024  	int s;
2025  	int rs;
2026  	int rlen;
2027  	boolean_t got_netmask = B_FALSE;
2028  	char addrstr4[INET_ADDRSTRLEN];
2029  	int res;
2030  
2031  	res = zonecfg_valid_net_address(nwiftabptr->zone_nwif_address, &lifr);
2032  	if (res != Z_OK) {
2033  		zerror(zlogp, B_FALSE, "%s: %s", zonecfg_strerror(res),
2034  		    nwiftabptr->zone_nwif_address);
2035  		return (-1);
2036  	}
2037  	af = lifr.lifr_addr.ss_family;
2038  	if (af == AF_INET)
2039  		in4 = ((struct sockaddr_in *)(&lifr.lifr_addr))->sin_addr;
2040  	else
2041  		in6 = ((struct sockaddr_in6 *)(&lifr.lifr_addr))->sin6_addr;
2042  
2043  	if ((s = socket(af, SOCK_DGRAM, 0)) < 0) {
2044  		zerror(zlogp, B_TRUE, "could not get socket");
2045  		return (-1);
2046  	}
2047  
2048  	(void) strlcpy(lifr.lifr_name, nwiftabptr->zone_nwif_physical,
2049  	    sizeof (lifr.lifr_name));
2050  	if (ioctl(s, SIOCLIFADDIF, (caddr_t)&lifr) < 0) {
2051  		/*
2052  		 * Here, we know that the interface can't be brought up.
2053  		 * A similar warning message was already printed out to
2054  		 * the console by zoneadm(1M) so instead we log the
2055  		 * message to syslog and continue.
2056  		 */
2057  		zerror(&logsys, B_TRUE, "WARNING: skipping interface "
2058  		    "'%s' which may not be present/plumbed in the "
2059  		    "global zone.", lifr.lifr_name);
2060  		(void) close(s);
2061  		return (Z_OK);
2062  	}
2063  
2064  	if (ioctl(s, SIOCSLIFADDR, (caddr_t)&lifr) < 0) {
2065  		zerror(zlogp, B_TRUE,
2066  		    "%s: could not set IP address to %s",
2067  		    lifr.lifr_name, nwiftabptr->zone_nwif_address);
2068  		goto bad;
2069  	}
2070  
2071  	/* Preserve literal IPv4 address for later potential printing. */
2072  	if (af == AF_INET)
2073  		(void) inet_ntop(AF_INET, &in4, addrstr4, INET_ADDRSTRLEN);
2074  
2075  	lifr.lifr_zoneid = zone_id;
2076  	if (ioctl(s, SIOCSLIFZONE, (caddr_t)&lifr) < 0) {
2077  		zerror(zlogp, B_TRUE, "%s: could not place interface into zone",
2078  		    lifr.lifr_name);
2079  		goto bad;
2080  	}
2081  
2082  	if (strcmp(nwiftabptr->zone_nwif_physical, "lo0") == 0) {
2083  		got_netmask = B_TRUE;	/* default setting will be correct */
2084  	} else {
2085  		if (af == AF_INET) {
2086  			/*
2087  			 * The IPv4 netmask can be determined either
2088  			 * directly if a prefix length was supplied with
2089  			 * the address or via the netmasks database.  Not
2090  			 * being able to determine it is a common failure,
2091  			 * but it often is not fatal to operation of the
2092  			 * interface.  In that case, a warning will be
2093  			 * printed after the rest of the interface's
2094  			 * parameters have been configured.
2095  			 */
2096  			(void) memset(&netmask4, 0, sizeof (netmask4));
2097  			if (slashp != NULL) {
2098  				if (addr2netmask(slashp + 1, V4_ADDR_LEN,
2099  				    (uchar_t *)&netmask4.sin_addr) != 0) {
2100  					*slashp = '/';
2101  					zerror(zlogp, B_FALSE,
2102  					    "%s: invalid prefix length in %s",
2103  					    lifr.lifr_name,
2104  					    nwiftabptr->zone_nwif_address);
2105  					goto bad;
2106  				}
2107  				got_netmask = B_TRUE;
2108  			} else if (getnetmaskbyaddr(in4,
2109  			    &netmask4.sin_addr) == 0) {
2110  				got_netmask = B_TRUE;
2111  			}
2112  			if (got_netmask) {
2113  				netmask4.sin_family = af;
2114  				(void) memcpy(&lifr.lifr_addr, &netmask4,
2115  				    sizeof (netmask4));
2116  			}
2117  		} else {
2118  			(void) memset(&netmask6, 0, sizeof (netmask6));
2119  			if (addr2netmask(slashp + 1, V6_ADDR_LEN,
2120  			    (uchar_t *)&netmask6.sin6_addr) != 0) {
2121  				*slashp = '/';
2122  				zerror(zlogp, B_FALSE,
2123  				    "%s: invalid prefix length in %s",
2124  				    lifr.lifr_name,
2125  				    nwiftabptr->zone_nwif_address);
2126  				goto bad;
2127  			}
2128  			got_netmask = B_TRUE;
2129  			netmask6.sin6_family = af;
2130  			(void) memcpy(&lifr.lifr_addr, &netmask6,
2131  			    sizeof (netmask6));
2132  		}
2133  		if (got_netmask &&
2134  		    ioctl(s, SIOCSLIFNETMASK, (caddr_t)&lifr) < 0) {
2135  			zerror(zlogp, B_TRUE, "%s: could not set netmask",
2136  			    lifr.lifr_name);
2137  			goto bad;
2138  		}
2139  
2140  		/*
2141  		 * This doesn't set the broadcast address at all. Rather, it
2142  		 * gets, then sets the interface's address, relying on the fact
2143  		 * that resetting the address will reset the broadcast address.
2144  		 */
2145  		if (ioctl(s, SIOCGLIFADDR, (caddr_t)&lifr) < 0) {
2146  			zerror(zlogp, B_TRUE, "%s: could not get address",
2147  			    lifr.lifr_name);
2148  			goto bad;
2149  		}
2150  		if (ioctl(s, SIOCSLIFADDR, (caddr_t)&lifr) < 0) {
2151  			zerror(zlogp, B_TRUE,
2152  			    "%s: could not reset broadcast address",
2153  			    lifr.lifr_name);
2154  			goto bad;
2155  		}
2156  	}
2157  
2158  	if (ioctl(s, SIOCGLIFFLAGS, (caddr_t)&lifr) < 0) {
2159  		zerror(zlogp, B_TRUE, "%s: could not get flags",
2160  		    lifr.lifr_name);
2161  		goto bad;
2162  	}
2163  	lifr.lifr_flags |= IFF_UP;
2164  	if (ioctl(s, SIOCSLIFFLAGS, (caddr_t)&lifr) < 0) {
2165  		int save_errno = errno;
2166  		char *zone_using;
2167  
2168  		/*
2169  		 * If we failed with something other than EADDRNOTAVAIL,
2170  		 * then skip to the end.  Otherwise, look up our address,
2171  		 * then call a function to determine which zone is already
2172  		 * using that address.
2173  		 */
2174  		if (errno != EADDRNOTAVAIL) {
2175  			zerror(zlogp, B_TRUE,
2176  			    "%s: could not bring interface up", lifr.lifr_name);
2177  			goto bad;
2178  		}
2179  		if (ioctl(s, SIOCGLIFADDR, (caddr_t)&lifr) < 0) {
2180  			zerror(zlogp, B_TRUE, "%s: could not get address",
2181  			    lifr.lifr_name);
2182  			goto bad;
2183  		}
2184  		zone_using = who_is_using(zlogp, &lifr);
2185  		errno = save_errno;
2186  		if (zone_using == NULL)
2187  			zerror(zlogp, B_TRUE,
2188  			    "%s: could not bring interface up", lifr.lifr_name);
2189  		else
2190  			zerror(zlogp, B_TRUE, "%s: could not bring interface "
2191  			    "up: address in use by zone '%s'", lifr.lifr_name,
2192  			    zone_using);
2193  		goto bad;
2194  	}
2195  	if ((lifr.lifr_flags & IFF_MULTICAST) && ((af == AF_INET &&
2196  	    mcast_rt_v4_setp != NULL && *mcast_rt_v4_setp == B_FALSE) ||
2197  	    (af == AF_INET6 &&
2198  	    mcast_rt_v6_setp != NULL && *mcast_rt_v6_setp == B_FALSE))) {
2199  		rs = socket(PF_ROUTE, SOCK_RAW, 0);
2200  		if (rs < 0) {
2201  			zerror(zlogp, B_TRUE, "%s: could not create "
2202  			    "routing socket", lifr.lifr_name);
2203  			goto bad;
2204  		}
2205  		(void) shutdown(rs, 0);
2206  		(void) memset((void *)&mcast_rtmsg, 0, sizeof (mcast_rtmsg_t));
2207  		mcast_rtmsg.m_rtm.rtm_msglen =  sizeof (struct rt_msghdr) +
2208  		    3 * (af == AF_INET ? sizeof (struct sockaddr_in) :
2209  		    sizeof (struct sockaddr_in6));
2210  		mcast_rtmsg.m_rtm.rtm_version = RTM_VERSION;
2211  		mcast_rtmsg.m_rtm.rtm_type = RTM_ADD;
2212  		mcast_rtmsg.m_rtm.rtm_flags = RTF_UP;
2213  		mcast_rtmsg.m_rtm.rtm_addrs =
2214  		    RTA_DST | RTA_GATEWAY | RTA_NETMASK;
2215  		mcast_rtmsg.m_rtm.rtm_seq = ++rts_seqno;
2216  		if (af == AF_INET) {
2217  			mcast_rtmsg.m_dst4.sin_family = AF_INET;
2218  			mcast_rtmsg.m_dst4.sin_addr.s_addr =
2219  			    htonl(INADDR_UNSPEC_GROUP);
2220  			mcast_rtmsg.m_gw4.sin_family = AF_INET;
2221  			mcast_rtmsg.m_gw4.sin_addr = in4;
2222  			mcast_rtmsg.m_netmask4.sin_family = AF_INET;
2223  			mcast_rtmsg.m_netmask4.sin_addr.s_addr =
2224  			    htonl(IN_CLASSD_NET);
2225  		} else {
2226  			mcast_rtmsg.m_dst6.sin6_family = AF_INET6;
2227  			mcast_rtmsg.m_dst6.sin6_addr.s6_addr[0] = 0xffU;
2228  			mcast_rtmsg.m_gw6.sin6_family = AF_INET6;
2229  			mcast_rtmsg.m_gw6.sin6_addr = in6;
2230  			mcast_rtmsg.m_netmask6.sin6_family = AF_INET6;
2231  			mcast_rtmsg.m_netmask6.sin6_addr.s6_addr[0] = 0xffU;
2232  		}
2233  		rlen = write(rs, (char *)&mcast_rtmsg,
2234  		    mcast_rtmsg.m_rtm.rtm_msglen);
2235  		/*
2236  		 * The write to the multicast socket will fail if the
2237  		 * interface belongs to a failed IPMP group. This is a
2238  		 * non-fatal error and the zone will continue booting.
2239  		 * While the zone is running, if any interface in the
2240  		 * failed IPMP group recovers, the zone will fallback to
2241  		 * using that interface.
2242  		 */
2243  		if (rlen < mcast_rtmsg.m_rtm.rtm_msglen) {
2244  			if (rlen < 0) {
2245  				zerror(zlogp, B_TRUE, "WARNING: interface "
2246  				    "'%s' not available as default for "
2247  				    "multicast.", lifr.lifr_name);
2248  			} else {
2249  				zerror(zlogp, B_FALSE, "WARNING: interface "
2250  				    "'%s' not available as default for "
2251  				    "multicast; routing socket returned "
2252  				    "unexpected %d bytes.",
2253  				    lifr.lifr_name, rlen);
2254  			}
2255  		} else {
2256  
2257  			if (af == AF_INET) {
2258  				*mcast_rt_v4_setp = B_TRUE;
2259  			} else {
2260  				*mcast_rt_v6_setp = B_TRUE;
2261  			}
2262  		}
2263  		(void) close(rs);
2264  	}
2265  
2266  	if (!got_netmask) {
2267  		/*
2268  		 * A common, but often non-fatal problem, is that the system
2269  		 * cannot find the netmask for an interface address. This is
2270  		 * often caused by it being only in /etc/inet/netmasks, but
2271  		 * /etc/nsswitch.conf says to use NIS or NIS+ and it's not
2272  		 * in that. This doesn't show up at boot because the netmask
2273  		 * is obtained from /etc/inet/netmasks when no network
2274  		 * interfaces are up, but isn't consulted when NIS/NIS+ is
2275  		 * available. We warn the user here that something like this
2276  		 * has happened and we're just running with a default and
2277  		 * possible incorrect netmask.
2278  		 */
2279  		char buffer[INET6_ADDRSTRLEN];
2280  		void  *addr;
2281  
2282  		if (af == AF_INET)
2283  			addr = &((struct sockaddr_in *)
2284  			    (&lifr.lifr_addr))->sin_addr;
2285  		else
2286  			addr = &((struct sockaddr_in6 *)
2287  			    (&lifr.lifr_addr))->sin6_addr;
2288  
2289  		/* Find out what netmask interface is going to be using */
2290  		if (ioctl(s, SIOCGLIFNETMASK, (caddr_t)&lifr) < 0 ||
2291  		    inet_ntop(af, addr, buffer, sizeof (buffer)) == NULL)
2292  			goto bad;
2293  		zerror(zlogp, B_FALSE,
2294  		    "WARNING: %s: no matching subnet found in netmasks(4) for "
2295  		    "%s; using default of %s.",
2296  		    lifr.lifr_name, addrstr4, buffer);
2297  	}
2298  
2299  	(void) close(s);
2300  	return (Z_OK);
2301  bad:
2302  	(void) ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifr);
2303  	(void) close(s);
2304  	return (-1);
2305  }
2306  
2307  /*
2308   * Sets up network interfaces based on information from the zone configuration.
2309   * An IPv4 loopback interface is set up "for free", modeling the global system.
2310   * If any of the configuration interfaces were IPv6, then an IPv6 loopback
2311   * address is set up as well.
2312   *
2313   * If anything goes wrong, we log a general error message, attempt to tear down
2314   * whatever we set up, and return an error.
2315   */
2316  static int
2317  configure_network_interfaces(zlog_t *zlogp)
2318  {
2319  	zone_dochandle_t handle;
2320  	struct zone_nwiftab nwiftab, loopback_iftab;
2321  	boolean_t saw_v6 = B_FALSE;
2322  	boolean_t mcast_rt_v4_set = B_FALSE;
2323  	boolean_t mcast_rt_v6_set = B_FALSE;
2324  	zoneid_t zoneid;
2325  
2326  	if ((zoneid = getzoneidbyname(zone_name)) == ZONE_ID_UNDEFINED) {
2327  		zerror(zlogp, B_TRUE, "unable to get zoneid");
2328  		return (-1);
2329  	}
2330  
2331  	if ((handle = zonecfg_init_handle()) == NULL) {
2332  		zerror(zlogp, B_TRUE, "getting zone configuration handle");
2333  		return (-1);
2334  	}
2335  	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2336  		zerror(zlogp, B_FALSE, "invalid configuration");
2337  		zonecfg_fini_handle(handle);
2338  		return (-1);
2339  	}
2340  	if (zonecfg_setnwifent(handle) == Z_OK) {
2341  		for (;;) {
2342  			struct in6_addr in6;
2343  
2344  			if (zonecfg_getnwifent(handle, &nwiftab) != Z_OK)
2345  				break;
2346  			if (configure_one_interface(zlogp, zoneid,
2347  			    &nwiftab, &mcast_rt_v4_set, &mcast_rt_v6_set) !=
2348  			    Z_OK) {
2349  				(void) zonecfg_endnwifent(handle);
2350  				zonecfg_fini_handle(handle);
2351  				return (-1);
2352  			}
2353  			if (inet_pton(AF_INET6, nwiftab.zone_nwif_address,
2354  			    &in6) == 1)
2355  				saw_v6 = B_TRUE;
2356  		}
2357  		(void) zonecfg_endnwifent(handle);
2358  	}
2359  	zonecfg_fini_handle(handle);
2360  	(void) strlcpy(loopback_iftab.zone_nwif_physical, "lo0",
2361  	    sizeof (loopback_iftab.zone_nwif_physical));
2362  	(void) strlcpy(loopback_iftab.zone_nwif_address, "127.0.0.1",
2363  	    sizeof (loopback_iftab.zone_nwif_address));
2364  	if (configure_one_interface(zlogp, zoneid, &loopback_iftab, NULL, NULL)
2365  	    != Z_OK) {
2366  		return (-1);
2367  	}
2368  	if (saw_v6) {
2369  		(void) strlcpy(loopback_iftab.zone_nwif_address, "::1/128",
2370  		    sizeof (loopback_iftab.zone_nwif_address));
2371  		if (configure_one_interface(zlogp, zoneid,
2372  		    &loopback_iftab, NULL, NULL) != Z_OK) {
2373  			return (-1);
2374  		}
2375  	}
2376  	return (0);
2377  }
2378  
2379  static int
2380  tcp_abort_conn(zlog_t *zlogp, zoneid_t zoneid,
2381      const struct sockaddr_storage *local, const struct sockaddr_storage *remote)
2382  {
2383  	int fd;
2384  	struct strioctl ioc;
2385  	tcp_ioc_abort_conn_t conn;
2386  	int error;
2387  
2388  	conn.ac_local = *local;
2389  	conn.ac_remote = *remote;
2390  	conn.ac_start = TCPS_SYN_SENT;
2391  	conn.ac_end = TCPS_TIME_WAIT;
2392  	conn.ac_zoneid = zoneid;
2393  
2394  	ioc.ic_cmd = TCP_IOC_ABORT_CONN;
2395  	ioc.ic_timout = -1; /* infinite timeout */
2396  	ioc.ic_len = sizeof (conn);
2397  	ioc.ic_dp = (char *)&conn;
2398  
2399  	if ((fd = open("/dev/tcp", O_RDONLY)) < 0) {
2400  		zerror(zlogp, B_TRUE, "unable to open %s", "/dev/tcp");
2401  		return (-1);
2402  	}
2403  
2404  	error = ioctl(fd, I_STR, &ioc);
2405  	(void) close(fd);
2406  	if (error == 0 || errno == ENOENT)	/* ENOENT is not an error */
2407  		return (0);
2408  	return (-1);
2409  }
2410  
2411  static int
2412  tcp_abort_connections(zlog_t *zlogp, zoneid_t zoneid)
2413  {
2414  	struct sockaddr_storage l, r;
2415  	struct sockaddr_in *local, *remote;
2416  	struct sockaddr_in6 *local6, *remote6;
2417  	int error;
2418  
2419  	/*
2420  	 * Abort IPv4 connections.
2421  	 */
2422  	bzero(&l, sizeof (*local));
2423  	local = (struct sockaddr_in *)&l;
2424  	local->sin_family = AF_INET;
2425  	local->sin_addr.s_addr = INADDR_ANY;
2426  	local->sin_port = 0;
2427  
2428  	bzero(&r, sizeof (*remote));
2429  	remote = (struct sockaddr_in *)&r;
2430  	remote->sin_family = AF_INET;
2431  	remote->sin_addr.s_addr = INADDR_ANY;
2432  	remote->sin_port = 0;
2433  
2434  	if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
2435  		return (error);
2436  
2437  	/*
2438  	 * Abort IPv6 connections.
2439  	 */
2440  	bzero(&l, sizeof (*local6));
2441  	local6 = (struct sockaddr_in6 *)&l;
2442  	local6->sin6_family = AF_INET6;
2443  	local6->sin6_port = 0;
2444  	local6->sin6_addr = in6addr_any;
2445  
2446  	bzero(&r, sizeof (*remote6));
2447  	remote6 = (struct sockaddr_in6 *)&r;
2448  	remote6->sin6_family = AF_INET6;
2449  	remote6->sin6_port = 0;
2450  	remote6->sin6_addr = in6addr_any;
2451  
2452  	if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
2453  		return (error);
2454  	return (0);
2455  }
2456  
2457  static int
2458  get_privset(zlog_t *zlogp, priv_set_t *privs, boolean_t mount_cmd)
2459  {
2460  	int error = -1;
2461  	zone_dochandle_t handle;
2462  	char *privname = NULL;
2463  
2464  	if ((handle = zonecfg_init_handle()) == NULL) {
2465  		zerror(zlogp, B_TRUE, "getting zone configuration handle");
2466  		return (-1);
2467  	}
2468  	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2469  		zerror(zlogp, B_FALSE, "invalid configuration");
2470  		zonecfg_fini_handle(handle);
2471  		return (-1);
2472  	}
2473  
2474  	if (mount_cmd) {
2475  		if (zonecfg_default_privset(privs) == Z_OK)
2476  			return (0);
2477  		zerror(zlogp, B_FALSE,
2478  		    "failed to determine the zone's default privilege set");
2479  		zonecfg_fini_handle(handle);
2480  		return (-1);
2481  	}
2482  
2483  	switch (zonecfg_get_privset(handle, privs, &privname)) {
2484  	case Z_OK:
2485  		error = 0;
2486  		break;
2487  	case Z_PRIV_PROHIBITED:
2488  		zerror(zlogp, B_FALSE, "privilege \"%s\" is not permitted "
2489  		    "within the zone's privilege set", privname);
2490  		break;
2491  	case Z_PRIV_REQUIRED:
2492  		zerror(zlogp, B_FALSE, "required privilege \"%s\" is missing "
2493  		    "from the zone's privilege set", privname);
2494  		break;
2495  	case Z_PRIV_UNKNOWN:
2496  		zerror(zlogp, B_FALSE, "unknown privilege \"%s\" specified "
2497  		    "in the zone's privilege set", privname);
2498  		break;
2499  	default:
2500  		zerror(zlogp, B_FALSE, "failed to determine the zone's "
2501  		    "privilege set");
2502  		break;
2503  	}
2504  
2505  	free(privname);
2506  	zonecfg_fini_handle(handle);
2507  	return (error);
2508  }
2509  
2510  static int
2511  get_rctls(zlog_t *zlogp, char **bufp, size_t *bufsizep)
2512  {
2513  	nvlist_t *nvl = NULL;
2514  	char *nvl_packed = NULL;
2515  	size_t nvl_size = 0;
2516  	nvlist_t **nvlv = NULL;
2517  	int rctlcount = 0;
2518  	int error = -1;
2519  	zone_dochandle_t handle;
2520  	struct zone_rctltab rctltab;
2521  	rctlblk_t *rctlblk = NULL;
2522  
2523  	*bufp = NULL;
2524  	*bufsizep = 0;
2525  
2526  	if ((handle = zonecfg_init_handle()) == NULL) {
2527  		zerror(zlogp, B_TRUE, "getting zone configuration handle");
2528  		return (-1);
2529  	}
2530  	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2531  		zerror(zlogp, B_FALSE, "invalid configuration");
2532  		zonecfg_fini_handle(handle);
2533  		return (-1);
2534  	}
2535  
2536  	rctltab.zone_rctl_valptr = NULL;
2537  	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0) {
2538  		zerror(zlogp, B_TRUE, "%s failed", "nvlist_alloc");
2539  		goto out;
2540  	}
2541  
2542  	if (zonecfg_setrctlent(handle) != Z_OK) {
2543  		zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setrctlent");
2544  		goto out;
2545  	}
2546  
2547  	if ((rctlblk = malloc(rctlblk_size())) == NULL) {
2548  		zerror(zlogp, B_TRUE, "memory allocation failed");
2549  		goto out;
2550  	}
2551  	while (zonecfg_getrctlent(handle, &rctltab) == Z_OK) {
2552  		struct zone_rctlvaltab *rctlval;
2553  		uint_t i, count;
2554  		const char *name = rctltab.zone_rctl_name;
2555  
2556  		/* zoneadm should have already warned about unknown rctls. */
2557  		if (!zonecfg_is_rctl(name)) {
2558  			zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
2559  			rctltab.zone_rctl_valptr = NULL;
2560  			continue;
2561  		}
2562  		count = 0;
2563  		for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
2564  		    rctlval = rctlval->zone_rctlval_next) {
2565  			count++;
2566  		}
2567  		if (count == 0) {	/* ignore */
2568  			continue;	/* Nothing to free */
2569  		}
2570  		if ((nvlv = malloc(sizeof (*nvlv) * count)) == NULL)
2571  			goto out;
2572  		i = 0;
2573  		for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
2574  		    rctlval = rctlval->zone_rctlval_next, i++) {
2575  			if (nvlist_alloc(&nvlv[i], NV_UNIQUE_NAME, 0) != 0) {
2576  				zerror(zlogp, B_TRUE, "%s failed",
2577  				    "nvlist_alloc");
2578  				goto out;
2579  			}
2580  			if (zonecfg_construct_rctlblk(rctlval, rctlblk)
2581  			    != Z_OK) {
2582  				zerror(zlogp, B_FALSE, "invalid rctl value: "
2583  				    "(priv=%s,limit=%s,action=%s)",
2584  				    rctlval->zone_rctlval_priv,
2585  				    rctlval->zone_rctlval_limit,
2586  				    rctlval->zone_rctlval_action);
2587  				goto out;
2588  			}
2589  			if (!zonecfg_valid_rctl(name, rctlblk)) {
2590  				zerror(zlogp, B_FALSE,
2591  				    "(priv=%s,limit=%s,action=%s) is not a "
2592  				    "valid value for rctl '%s'",
2593  				    rctlval->zone_rctlval_priv,
2594  				    rctlval->zone_rctlval_limit,
2595  				    rctlval->zone_rctlval_action,
2596  				    name);
2597  				goto out;
2598  			}
2599  			if (nvlist_add_uint64(nvlv[i], "privilege",
2600  			    rctlblk_get_privilege(rctlblk)) != 0) {
2601  				zerror(zlogp, B_FALSE, "%s failed",
2602  				    "nvlist_add_uint64");
2603  				goto out;
2604  			}
2605  			if (nvlist_add_uint64(nvlv[i], "limit",
2606  			    rctlblk_get_value(rctlblk)) != 0) {
2607  				zerror(zlogp, B_FALSE, "%s failed",
2608  				    "nvlist_add_uint64");
2609  				goto out;
2610  			}
2611  			if (nvlist_add_uint64(nvlv[i], "action",
2612  			    (uint_t)rctlblk_get_local_action(rctlblk, NULL))
2613  			    != 0) {
2614  				zerror(zlogp, B_FALSE, "%s failed",
2615  				    "nvlist_add_uint64");
2616  				goto out;
2617  			}
2618  		}
2619  		zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
2620  		rctltab.zone_rctl_valptr = NULL;
2621  		if (nvlist_add_nvlist_array(nvl, (char *)name, nvlv, count)
2622  		    != 0) {
2623  			zerror(zlogp, B_FALSE, "%s failed",
2624  			    "nvlist_add_nvlist_array");
2625  			goto out;
2626  		}
2627  		for (i = 0; i < count; i++)
2628  			nvlist_free(nvlv[i]);
2629  		free(nvlv);
2630  		nvlv = NULL;
2631  		rctlcount++;
2632  	}
2633  	(void) zonecfg_endrctlent(handle);
2634  
2635  	if (rctlcount == 0) {
2636  		error = 0;
2637  		goto out;
2638  	}
2639  	if (nvlist_pack(nvl, &nvl_packed, &nvl_size, NV_ENCODE_NATIVE, 0)
2640  	    != 0) {
2641  		zerror(zlogp, B_FALSE, "%s failed", "nvlist_pack");
2642  		goto out;
2643  	}
2644  
2645  	error = 0;
2646  	*bufp = nvl_packed;
2647  	*bufsizep = nvl_size;
2648  
2649  out:
2650  	free(rctlblk);
2651  	zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
2652  	if (error && nvl_packed != NULL)
2653  		free(nvl_packed);
2654  	if (nvl != NULL)
2655  		nvlist_free(nvl);
2656  	if (nvlv != NULL)
2657  		free(nvlv);
2658  	if (handle != NULL)
2659  		zonecfg_fini_handle(handle);
2660  	return (error);
2661  }
2662  
2663  static int
2664  get_zone_pool(zlog_t *zlogp, char *poolbuf, size_t bufsz)
2665  {
2666  	zone_dochandle_t handle;
2667  	int error;
2668  
2669  	if ((handle = zonecfg_init_handle()) == NULL) {
2670  		zerror(zlogp, B_TRUE, "getting zone configuration handle");
2671  		return (Z_NOMEM);
2672  	}
2673  	error = zonecfg_get_snapshot_handle(zone_name, handle);
2674  	if (error != Z_OK) {
2675  		zerror(zlogp, B_FALSE, "invalid configuration");
2676  		zonecfg_fini_handle(handle);
2677  		return (error);
2678  	}
2679  	error = zonecfg_get_pool(handle, poolbuf, bufsz);
2680  	zonecfg_fini_handle(handle);
2681  	return (error);
2682  }
2683  
2684  static int
2685  get_datasets(zlog_t *zlogp, char **bufp, size_t *bufsizep)
2686  {
2687  	zone_dochandle_t handle;
2688  	struct zone_dstab dstab;
2689  	size_t total, offset, len;
2690  	int error = -1;
2691  	char *str;
2692  
2693  	*bufp = NULL;
2694  	*bufsizep = 0;
2695  
2696  	if ((handle = zonecfg_init_handle()) == NULL) {
2697  		zerror(zlogp, B_TRUE, "getting zone configuration handle");
2698  		return (-1);
2699  	}
2700  	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2701  		zerror(zlogp, B_FALSE, "invalid configuration");
2702  		zonecfg_fini_handle(handle);
2703  		return (-1);
2704  	}
2705  
2706  	if (zonecfg_setdsent(handle) != Z_OK) {
2707  		zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
2708  		goto out;
2709  	}
2710  
2711  	total = 0;
2712  	while (zonecfg_getdsent(handle, &dstab) == Z_OK)
2713  		total += strlen(dstab.zone_dataset_name) + 1;
2714  	(void) zonecfg_enddsent(handle);
2715  
2716  	if (total == 0) {
2717  		error = 0;
2718  		goto out;
2719  	}
2720  
2721  	if ((str = malloc(total)) == NULL) {
2722  		zerror(zlogp, B_TRUE, "memory allocation failed");
2723  		goto out;
2724  	}
2725  
2726  	if (zonecfg_setdsent(handle) != Z_OK) {
2727  		zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
2728  		goto out;
2729  	}
2730  	offset = 0;
2731  	while (zonecfg_getdsent(handle, &dstab) == Z_OK) {
2732  		len = strlen(dstab.zone_dataset_name);
2733  		(void) strlcpy(str + offset, dstab.zone_dataset_name,
2734  		    sizeof (dstab.zone_dataset_name) - offset);
2735  		offset += len;
2736  		if (offset != total - 1)
2737  			str[offset++] = ',';
2738  	}
2739  	(void) zonecfg_enddsent(handle);
2740  
2741  	error = 0;
2742  	*bufp = str;
2743  	*bufsizep = total;
2744  
2745  out:
2746  	if (error != 0 && str != NULL)
2747  		free(str);
2748  	if (handle != NULL)
2749  		zonecfg_fini_handle(handle);
2750  
2751  	return (error);
2752  }
2753  
2754  static int
2755  validate_datasets(zlog_t *zlogp)
2756  {
2757  	zone_dochandle_t handle;
2758  	struct zone_dstab dstab;
2759  	zfs_handle_t *zhp;
2760  	libzfs_handle_t *hdl;
2761  
2762  	if ((handle = zonecfg_init_handle()) == NULL) {
2763  		zerror(zlogp, B_TRUE, "getting zone configuration handle");
2764  		return (-1);
2765  	}
2766  	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2767  		zerror(zlogp, B_FALSE, "invalid configuration");
2768  		zonecfg_fini_handle(handle);
2769  		return (-1);
2770  	}
2771  
2772  	if (zonecfg_setdsent(handle) != Z_OK) {
2773  		zerror(zlogp, B_FALSE, "invalid configuration");
2774  		zonecfg_fini_handle(handle);
2775  		return (-1);
2776  	}
2777  
2778  	if ((hdl = libzfs_init()) == NULL) {
2779  		zerror(zlogp, B_FALSE, "opening ZFS library");
2780  		zonecfg_fini_handle(handle);
2781  		return (-1);
2782  	}
2783  
2784  	while (zonecfg_getdsent(handle, &dstab) == Z_OK) {
2785  
2786  		if ((zhp = zfs_open(hdl, dstab.zone_dataset_name,
2787  		    ZFS_TYPE_FILESYSTEM)) == NULL) {
2788  			zerror(zlogp, B_FALSE, "cannot open ZFS dataset '%s'",
2789  			    dstab.zone_dataset_name);
2790  			zonecfg_fini_handle(handle);
2791  			libzfs_fini(hdl);
2792  			return (-1);
2793  		}
2794  
2795  		/*
2796  		 * Automatically set the 'zoned' property.  We check the value
2797  		 * first because we'll get EPERM if it is already set.
2798  		 */
2799  		if (!zfs_prop_get_int(zhp, ZFS_PROP_ZONED) &&
2800  		    zfs_prop_set(zhp, zfs_prop_to_name(ZFS_PROP_ZONED),
2801  		    "on") != 0) {
2802  			zerror(zlogp, B_FALSE, "cannot set 'zoned' "
2803  			    "property for ZFS dataset '%s'\n",
2804  			    dstab.zone_dataset_name);
2805  			zonecfg_fini_handle(handle);
2806  			zfs_close(zhp);
2807  			libzfs_fini(hdl);
2808  			return (-1);
2809  		}
2810  
2811  		zfs_close(zhp);
2812  	}
2813  	(void) zonecfg_enddsent(handle);
2814  
2815  	zonecfg_fini_handle(handle);
2816  	libzfs_fini(hdl);
2817  
2818  	return (0);
2819  }
2820  
2821  static int
2822  bind_to_pool(zlog_t *zlogp, zoneid_t zoneid)
2823  {
2824  	pool_conf_t *poolconf;
2825  	pool_t *pool;
2826  	char poolname[MAXPATHLEN];
2827  	int status;
2828  	int error;
2829  
2830  	/*
2831  	 * Find the pool mentioned in the zone configuration, and bind to it.
2832  	 */
2833  	error = get_zone_pool(zlogp, poolname, sizeof (poolname));
2834  	if (error == Z_NO_ENTRY || (error == Z_OK && strlen(poolname) == 0)) {
2835  		/*
2836  		 * The property is not set on the zone, so the pool
2837  		 * should be bound to the default pool.  But that's
2838  		 * already done by the kernel, so we can just return.
2839  		 */
2840  		return (0);
2841  	}
2842  	if (error != Z_OK) {
2843  		/*
2844  		 * Not an error, even though it shouldn't be happening.
2845  		 */
2846  		zerror(zlogp, B_FALSE,
2847  		    "WARNING: unable to retrieve default pool.");
2848  		return (0);
2849  	}
2850  	/*
2851  	 * Don't do anything if pools aren't enabled.
2852  	 */
2853  	if (pool_get_status(&status) != PO_SUCCESS || status != POOL_ENABLED) {
2854  		zerror(zlogp, B_FALSE, "WARNING: pools facility not active; "
2855  		    "zone will not be bound to pool '%s'.", poolname);
2856  		return (0);
2857  	}
2858  	/*
2859  	 * Try to provide a sane error message if the requested pool doesn't
2860  	 * exist.
2861  	 */
2862  	if ((poolconf = pool_conf_alloc()) == NULL) {
2863  		zerror(zlogp, B_FALSE, "%s failed", "pool_conf_alloc");
2864  		return (-1);
2865  	}
2866  	if (pool_conf_open(poolconf, pool_dynamic_location(), PO_RDONLY) !=
2867  	    PO_SUCCESS) {
2868  		zerror(zlogp, B_FALSE, "%s failed", "pool_conf_open");
2869  		pool_conf_free(poolconf);
2870  		return (-1);
2871  	}
2872  	pool = pool_get_pool(poolconf, poolname);
2873  	(void) pool_conf_close(poolconf);
2874  	pool_conf_free(poolconf);
2875  	if (pool == NULL) {
2876  		zerror(zlogp, B_FALSE, "WARNING: pool '%s' not found; "
2877  		    "using default pool.", poolname);
2878  		return (0);
2879  	}
2880  	/*
2881  	 * Bind the zone to the pool.
2882  	 */
2883  	if (pool_set_binding(poolname, P_ZONEID, zoneid) != PO_SUCCESS) {
2884  		zerror(zlogp, B_FALSE, "WARNING: unable to bind to pool '%s'; "
2885  		    "using default pool.", poolname);
2886  	}
2887  	return (0);
2888  }
2889  
2890  /*
2891   * Mount lower level home directories into/from current zone
2892   * Share exported directories specified in dfstab for zone
2893   */
2894  static int
2895  tsol_mounts(zlog_t *zlogp, char *zone_name, char *rootpath)
2896  {
2897  	zoneid_t *zids = NULL;
2898  	priv_set_t *zid_privs;
2899  	const priv_impl_info_t *ip = NULL;
2900  	uint_t nzents_saved;
2901  	uint_t nzents;
2902  	int i;
2903  	char readonly[] = "ro";
2904  	struct zone_fstab lower_fstab;
2905  	char *argv[4];
2906  
2907  	if (!is_system_labeled())
2908  		return (0);
2909  
2910  	if (zid_label == NULL) {
2911  		zid_label = m_label_alloc(MAC_LABEL);
2912  		if (zid_label == NULL)
2913  			return (-1);
2914  	}
2915  
2916  	/* Make sure our zone has an /export/home dir */
2917  	(void) make_one_dir(zlogp, rootpath, "/export/home",
2918  	    DEFAULT_DIR_MODE);
2919  
2920  	lower_fstab.zone_fs_raw[0] = '\0';
2921  	(void) strlcpy(lower_fstab.zone_fs_type, MNTTYPE_LOFS,
2922  	    sizeof (lower_fstab.zone_fs_type));
2923  	lower_fstab.zone_fs_options = NULL;
2924  	(void) zonecfg_add_fs_option(&lower_fstab, readonly);
2925  
2926  	/*
2927  	 * Get the list of zones from the kernel
2928  	 */
2929  	if (zone_list(NULL, &nzents) != 0) {
2930  		zerror(zlogp, B_TRUE, "unable to list zones");
2931  		zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
2932  		return (-1);
2933  	}
2934  again:
2935  	if (nzents == 0) {
2936  		zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
2937  		return (-1);
2938  	}
2939  
2940  	zids = malloc(nzents * sizeof (zoneid_t));
2941  	if (zids == NULL) {
2942  		zerror(zlogp, B_TRUE, "memory allocation failed");
2943  		return (-1);
2944  	}
2945  	nzents_saved = nzents;
2946  
2947  	if (zone_list(zids, &nzents) != 0) {
2948  		zerror(zlogp, B_TRUE, "unable to list zones");
2949  		zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
2950  		free(zids);
2951  		return (-1);
2952  	}
2953  	if (nzents != nzents_saved) {
2954  		/* list changed, try again */
2955  		free(zids);
2956  		goto again;
2957  	}
2958  
2959  	ip = getprivimplinfo();
2960  	if ((zid_privs = priv_allocset()) == NULL) {
2961  		zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
2962  		zonecfg_free_fs_option_list(
2963  		    lower_fstab.zone_fs_options);
2964  		free(zids);
2965  		return (-1);
2966  	}
2967  
2968  	for (i = 0; i < nzents; i++) {
2969  		char zid_name[ZONENAME_MAX];
2970  		zone_state_t zid_state;
2971  		char zid_rpath[MAXPATHLEN];
2972  		struct stat stat_buf;
2973  
2974  		if (zids[i] == GLOBAL_ZONEID)
2975  			continue;
2976  
2977  		if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
2978  			continue;
2979  
2980  		/*
2981  		 * Do special setup for the zone we are booting
2982  		 */
2983  		if (strcmp(zid_name, zone_name) == 0) {
2984  			struct zone_fstab autofs_fstab;
2985  			char map_path[MAXPATHLEN];
2986  			int fd;
2987  
2988  			/*
2989  			 * Create auto_home_<zone> map for this zone
2990  			 * in the global zone. The non-global zone entry
2991  			 * will be created by automount when the zone
2992  			 * is booted.
2993  			 */
2994  
2995  			(void) snprintf(autofs_fstab.zone_fs_special,
2996  			    MAXPATHLEN, "auto_home_%s", zid_name);
2997  
2998  			(void) snprintf(autofs_fstab.zone_fs_dir, MAXPATHLEN,
2999  			    "/zone/%s/home", zid_name);
3000  
3001  			(void) snprintf(map_path, sizeof (map_path),
3002  			    "/etc/%s", autofs_fstab.zone_fs_special);
3003  			/*
3004  			 * If the map file doesn't exist create a template
3005  			 */
3006  			if ((fd = open(map_path, O_RDWR | O_CREAT | O_EXCL,
3007  			    S_IRUSR | S_IWUSR | S_IRGRP| S_IROTH)) != -1) {
3008  				int len;
3009  				char map_rec[MAXPATHLEN];
3010  
3011  				len = snprintf(map_rec, sizeof (map_rec),
3012  				    "+%s\n*\t-fstype=lofs\t:%s/export/home/&\n",
3013  				    autofs_fstab.zone_fs_special, rootpath);
3014  				(void) write(fd, map_rec, len);
3015  				(void) close(fd);
3016  			}
3017  
3018  			/*
3019  			 * Mount auto_home_<zone> in the global zone if absent.
3020  			 * If it's already of type autofs, then
3021  			 * don't mount it again.
3022  			 */
3023  			if ((stat(autofs_fstab.zone_fs_dir, &stat_buf) == -1) ||
3024  			    strcmp(stat_buf.st_fstype, MNTTYPE_AUTOFS) != 0) {
3025  				char optstr[] = "indirect,ignore,nobrowse";
3026  
3027  				(void) make_one_dir(zlogp, "",
3028  				    autofs_fstab.zone_fs_dir, DEFAULT_DIR_MODE);
3029  
3030  				/*
3031  				 * Mount will fail if automounter has already
3032  				 * processed the auto_home_<zonename> map
3033  				 */
3034  				(void) domount(zlogp, MNTTYPE_AUTOFS, optstr,
3035  				    autofs_fstab.zone_fs_special,
3036  				    autofs_fstab.zone_fs_dir);
3037  			}
3038  			continue;
3039  		}
3040  
3041  
3042  		if (zone_get_state(zid_name, &zid_state) != Z_OK ||
3043  		    (zid_state != ZONE_STATE_READY &&
3044  		    zid_state != ZONE_STATE_RUNNING))
3045  			/* Skip over zones without mounted filesystems */
3046  			continue;
3047  
3048  		if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
3049  		    sizeof (m_label_t)) < 0)
3050  			/* Skip over zones with unspecified label */
3051  			continue;
3052  
3053  		if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
3054  		    sizeof (zid_rpath)) == -1)
3055  			/* Skip over zones with bad path */
3056  			continue;
3057  
3058  		if (zone_getattr(zids[i], ZONE_ATTR_PRIVSET, zid_privs,
3059  		    sizeof (priv_chunk_t) * ip->priv_setsize) == -1)
3060  			/* Skip over zones with bad privs */
3061  			continue;
3062  
3063  		/*
3064  		 * Reading down is valid according to our label model
3065  		 * but some customers want to disable it because it
3066  		 * allows execute down and other possible attacks.
3067  		 * Therefore, we restrict this feature to zones that
3068  		 * have the NET_MAC_AWARE privilege which is required
3069  		 * for NFS read-down semantics.
3070  		 */
3071  		if ((bldominates(zlabel, zid_label)) &&
3072  		    (priv_ismember(zprivs, PRIV_NET_MAC_AWARE))) {
3073  			/*
3074  			 * Our zone dominates this one.
3075  			 * Create a lofs mount from lower zone's /export/home
3076  			 */
3077  			(void) snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
3078  			    "%s/zone/%s/export/home", rootpath, zid_name);
3079  
3080  			/*
3081  			 * If the target is already an LOFS mount
3082  			 * then don't do it again.
3083  			 */
3084  			if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
3085  			    strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
3086  
3087  				if (snprintf(lower_fstab.zone_fs_special,
3088  				    MAXPATHLEN, "%s/export",
3089  				    zid_rpath) > MAXPATHLEN)
3090  					continue;
3091  
3092  				/*
3093  				 * Make sure the lower-level home exists
3094  				 */
3095  				if (make_one_dir(zlogp,
3096  				    lower_fstab.zone_fs_special,
3097  				    "/home", DEFAULT_DIR_MODE) != 0)
3098  					continue;
3099  
3100  				(void) strlcat(lower_fstab.zone_fs_special,
3101  				    "/home", MAXPATHLEN);
3102  
3103  				/*
3104  				 * Mount can fail because the lower-level
3105  				 * zone may have already done a mount up.
3106  				 */
3107  				(void) mount_one(zlogp, &lower_fstab, "");
3108  			}
3109  		} else if ((bldominates(zid_label, zlabel)) &&
3110  		    (priv_ismember(zid_privs, PRIV_NET_MAC_AWARE))) {
3111  			/*
3112  			 * This zone dominates our zone.
3113  			 * Create a lofs mount from our zone's /export/home
3114  			 */
3115  			if (snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
3116  			    "%s/zone/%s/export/home", zid_rpath,
3117  			    zone_name) > MAXPATHLEN)
3118  				continue;
3119  
3120  			/*
3121  			 * If the target is already an LOFS mount
3122  			 * then don't do it again.
3123  			 */
3124  			if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
3125  			    strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
3126  
3127  				(void) snprintf(lower_fstab.zone_fs_special,
3128  				    MAXPATHLEN, "%s/export/home", rootpath);
3129  
3130  				/*
3131  				 * Mount can fail because the higher-level
3132  				 * zone may have already done a mount down.
3133  				 */
3134  				(void) mount_one(zlogp, &lower_fstab, "");
3135  			}
3136  		}
3137  	}
3138  	zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3139  	priv_freeset(zid_privs);
3140  	free(zids);
3141  
3142  	/*
3143  	 * Now share any exported directories from this zone.
3144  	 * Each zone can have its own dfstab.
3145  	 */
3146  
3147  	argv[0] = "zoneshare";
3148  	argv[1] = "-z";
3149  	argv[2] = zone_name;
3150  	argv[3] = NULL;
3151  
3152  	(void) forkexec(zlogp, "/usr/lib/zones/zoneshare", argv);
3153  	/* Don't check for errors since they don't affect the zone */
3154  
3155  	return (0);
3156  }
3157  
3158  /*
3159   * Unmount lofs mounts from higher level zones
3160   * Unshare nfs exported directories
3161   */
3162  static void
3163  tsol_unmounts(zlog_t *zlogp, char *zone_name)
3164  {
3165  	zoneid_t *zids = NULL;
3166  	uint_t nzents_saved;
3167  	uint_t nzents;
3168  	int i;
3169  	char *argv[4];
3170  	char path[MAXPATHLEN];
3171  
3172  	if (!is_system_labeled())
3173  		return;
3174  
3175  	/*
3176  	 * Get the list of zones from the kernel
3177  	 */
3178  	if (zone_list(NULL, &nzents) != 0) {
3179  		return;
3180  	}
3181  
3182  	if (zid_label == NULL) {
3183  		zid_label = m_label_alloc(MAC_LABEL);
3184  		if (zid_label == NULL)
3185  			return;
3186  	}
3187  
3188  again:
3189  	if (nzents == 0)
3190  		return;
3191  
3192  	zids = malloc(nzents * sizeof (zoneid_t));
3193  	if (zids == NULL) {
3194  		zerror(zlogp, B_TRUE, "memory allocation failed");
3195  		return;
3196  	}
3197  	nzents_saved = nzents;
3198  
3199  	if (zone_list(zids, &nzents) != 0) {
3200  		free(zids);
3201  		return;
3202  	}
3203  	if (nzents != nzents_saved) {
3204  		/* list changed, try again */
3205  		free(zids);
3206  		goto again;
3207  	}
3208  
3209  	for (i = 0; i < nzents; i++) {
3210  		char zid_name[ZONENAME_MAX];
3211  		zone_state_t zid_state;
3212  		char zid_rpath[MAXPATHLEN];
3213  
3214  		if (zids[i] == GLOBAL_ZONEID)
3215  			continue;
3216  
3217  		if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
3218  			continue;
3219  
3220  		/*
3221  		 * Skip the zone we are halting
3222  		 */
3223  		if (strcmp(zid_name, zone_name) == 0)
3224  			continue;
3225  
3226  		if ((zone_getattr(zids[i], ZONE_ATTR_STATUS, &zid_state,
3227  		    sizeof (zid_state)) < 0) ||
3228  		    (zid_state < ZONE_IS_READY))
3229  			/* Skip over zones without mounted filesystems */
3230  			continue;
3231  
3232  		if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
3233  		    sizeof (m_label_t)) < 0)
3234  			/* Skip over zones with unspecified label */
3235  			continue;
3236  
3237  		if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
3238  		    sizeof (zid_rpath)) == -1)
3239  			/* Skip over zones with bad path */
3240  			continue;
3241  
3242  		if (zlabel != NULL && bldominates(zid_label, zlabel)) {
3243  			/*
3244  			 * This zone dominates our zone.
3245  			 * Unmount the lofs mount of our zone's /export/home
3246  			 */
3247  
3248  			if (snprintf(path, MAXPATHLEN,
3249  			    "%s/zone/%s/export/home", zid_rpath,
3250  			    zone_name) > MAXPATHLEN)
3251  				continue;
3252  
3253  			/* Skip over mount failures */
3254  			(void) umount(path);
3255  		}
3256  	}
3257  	free(zids);
3258  
3259  	/*
3260  	 * Unmount global zone autofs trigger for this zone
3261  	 */
3262  	(void) snprintf(path, MAXPATHLEN, "/zone/%s/home", zone_name);
3263  	/* Skip over mount failures */
3264  	(void) umount(path);
3265  
3266  	/*
3267  	 * Next unshare any exported directories from this zone.
3268  	 */
3269  
3270  	argv[0] = "zoneunshare";
3271  	argv[1] = "-z";
3272  	argv[2] = zone_name;
3273  	argv[3] = NULL;
3274  
3275  	(void) forkexec(zlogp, "/usr/lib/zones/zoneunshare", argv);
3276  	/* Don't check for errors since they don't affect the zone */
3277  
3278  	/*
3279  	 * Finally, deallocate any devices in the zone.
3280  	 */
3281  
3282  	argv[0] = "deallocate";
3283  	argv[1] = "-Isz";
3284  	argv[2] = zone_name;
3285  	argv[3] = NULL;
3286  
3287  	(void) forkexec(zlogp, "/usr/sbin/deallocate", argv);
3288  	/* Don't check for errors since they don't affect the zone */
3289  }
3290  
3291  /*
3292   * Fetch the Trusted Extensions label and multi-level ports (MLPs) for
3293   * this zone.
3294   */
3295  static tsol_zcent_t *
3296  get_zone_label(zlog_t *zlogp, priv_set_t *privs)
3297  {
3298  	FILE *fp;
3299  	tsol_zcent_t *zcent = NULL;
3300  	char line[MAXTNZLEN];
3301  
3302  	if ((fp = fopen(TNZONECFG_PATH, "r")) == NULL) {
3303  		zerror(zlogp, B_TRUE, "%s", TNZONECFG_PATH);
3304  		return (NULL);
3305  	}
3306  
3307  	while (fgets(line, sizeof (line), fp) != NULL) {
3308  		/*
3309  		 * Check for malformed database
3310  		 */
3311  		if (strlen(line) == MAXTNZLEN - 1)
3312  			break;
3313  		if ((zcent = tsol_sgetzcent(line, NULL, NULL)) == NULL)
3314  			continue;
3315  		if (strcmp(zcent->zc_name, zone_name) == 0)
3316  			break;
3317  		tsol_freezcent(zcent);
3318  		zcent = NULL;
3319  	}
3320  	(void) fclose(fp);
3321  
3322  	if (zcent == NULL) {
3323  		zerror(zlogp, B_FALSE, "zone requires a label assignment. "
3324  		    "See tnzonecfg(4)");
3325  	} else {
3326  		if (zlabel == NULL)
3327  			zlabel = m_label_alloc(MAC_LABEL);
3328  		/*
3329  		 * Save this zone's privileges for later read-down processing
3330  		 */
3331  		if ((zprivs = priv_allocset()) == NULL) {
3332  			zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
3333  			return (NULL);
3334  		} else {
3335  			priv_copyset(privs, zprivs);
3336  		}
3337  	}
3338  	return (zcent);
3339  }
3340  
3341  /*
3342   * Add the Trusted Extensions multi-level ports for this zone.
3343   */
3344  static void
3345  set_mlps(zlog_t *zlogp, zoneid_t zoneid, tsol_zcent_t *zcent)
3346  {
3347  	tsol_mlp_t *mlp;
3348  	tsol_mlpent_t tsme;
3349  
3350  	if (!is_system_labeled())
3351  		return;
3352  
3353  	tsme.tsme_zoneid = zoneid;
3354  	tsme.tsme_flags = 0;
3355  	for (mlp = zcent->zc_private_mlp; !TSOL_MLP_END(mlp); mlp++) {
3356  		tsme.tsme_mlp = *mlp;
3357  		if (tnmlp(TNDB_LOAD, &tsme) != 0) {
3358  			zerror(zlogp, B_TRUE, "cannot set zone-specific MLP "
3359  			    "on %d-%d/%d", mlp->mlp_port,
3360  			    mlp->mlp_port_upper, mlp->mlp_ipp);
3361  		}
3362  	}
3363  
3364  	tsme.tsme_flags = TSOL_MEF_SHARED;
3365  	for (mlp = zcent->zc_shared_mlp; !TSOL_MLP_END(mlp); mlp++) {
3366  		tsme.tsme_mlp = *mlp;
3367  		if (tnmlp(TNDB_LOAD, &tsme) != 0) {
3368  			zerror(zlogp, B_TRUE, "cannot set shared MLP "
3369  			    "on %d-%d/%d", mlp->mlp_port,
3370  			    mlp->mlp_port_upper, mlp->mlp_ipp);
3371  		}
3372  	}
3373  }
3374  
3375  static void
3376  remove_mlps(zlog_t *zlogp, zoneid_t zoneid)
3377  {
3378  	tsol_mlpent_t tsme;
3379  
3380  	if (!is_system_labeled())
3381  		return;
3382  
3383  	(void) memset(&tsme, 0, sizeof (tsme));
3384  	tsme.tsme_zoneid = zoneid;
3385  	if (tnmlp(TNDB_FLUSH, &tsme) != 0)
3386  		zerror(zlogp, B_TRUE, "cannot flush MLPs");
3387  }
3388  
3389  int
3390  prtmount(const char *fs, void *x) {
3391  	zerror((zlog_t *)x, B_FALSE, "  %s", fs);
3392  	return (0);
3393  }
3394  
3395  /*
3396   * Look for zones running on the main system that are using this root (or any
3397   * subdirectory of it).  Return B_TRUE and print an error if a conflicting zone
3398   * is found or if we can't tell.
3399   */
3400  static boolean_t
3401  duplicate_zone_root(zlog_t *zlogp, const char *rootpath)
3402  {
3403  	zoneid_t *zids = NULL;
3404  	uint_t nzids = 0;
3405  	boolean_t retv;
3406  	int rlen, zlen;
3407  	char zroot[MAXPATHLEN];
3408  	char zonename[ZONENAME_MAX];
3409  
3410  	for (;;) {
3411  		nzids += 10;
3412  		zids = malloc(nzids * sizeof (*zids));
3413  		if (zids == NULL) {
3414  			zerror(zlogp, B_TRUE, "memory allocation failed");
3415  			return (B_TRUE);
3416  		}
3417  		if (zone_list(zids, &nzids) == 0)
3418  			break;
3419  		free(zids);
3420  	}
3421  	retv = B_FALSE;
3422  	rlen = strlen(rootpath);
3423  	while (nzids > 0) {
3424  		/*
3425  		 * Ignore errors; they just mean that the zone has disappeared
3426  		 * while we were busy.
3427  		 */
3428  		if (zone_getattr(zids[--nzids], ZONE_ATTR_ROOT, zroot,
3429  		    sizeof (zroot)) == -1)
3430  			continue;
3431  		zlen = strlen(zroot);
3432  		if (zlen > rlen)
3433  			zlen = rlen;
3434  		if (strncmp(rootpath, zroot, zlen) == 0 &&
3435  		    (zroot[zlen] == '\0' || zroot[zlen] == '/') &&
3436  		    (rootpath[zlen] == '\0' || rootpath[zlen] == '/')) {
3437  			if (getzonenamebyid(zids[nzids], zonename,
3438  			    sizeof (zonename)) == -1)
3439  				(void) snprintf(zonename, sizeof (zonename),
3440  				    "id %d", (int)zids[nzids]);
3441  			zerror(zlogp, B_FALSE,
3442  			    "zone root %s already in use by zone %s",
3443  			    rootpath, zonename);
3444  			retv = B_TRUE;
3445  			break;
3446  		}
3447  	}
3448  	free(zids);
3449  	return (retv);
3450  }
3451  
3452  /*
3453   * Search for loopback mounts that use this same source node (same device and
3454   * inode).  Return B_TRUE if there is one or if we can't tell.
3455   */
3456  static boolean_t
3457  duplicate_reachable_path(zlog_t *zlogp, const char *rootpath)
3458  {
3459  	struct stat64 rst, zst;
3460  	struct mnttab *mnp;
3461  
3462  	if (stat64(rootpath, &rst) == -1) {
3463  		zerror(zlogp, B_TRUE, "can't stat %s", rootpath);
3464  		return (B_TRUE);
3465  	}
3466  	if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
3467  		return (B_TRUE);
3468  	for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max; mnp++) {
3469  		if (mnp->mnt_fstype == NULL ||
3470  		    strcmp(MNTTYPE_LOFS, mnp->mnt_fstype) != 0)
3471  			continue;
3472  		/* We're looking at a loopback mount.  Stat it. */
3473  		if (mnp->mnt_special != NULL &&
3474  		    stat64(mnp->mnt_special, &zst) != -1 &&
3475  		    rst.st_dev == zst.st_dev && rst.st_ino == zst.st_ino) {
3476  			zerror(zlogp, B_FALSE,
3477  			    "zone root %s is reachable through %s",
3478  			    rootpath, mnp->mnt_mountp);
3479  			return (B_TRUE);
3480  		}
3481  	}
3482  	return (B_FALSE);
3483  }
3484  
3485  zoneid_t
3486  vplat_create(zlog_t *zlogp, boolean_t mount_cmd)
3487  {
3488  	zoneid_t rval = -1;
3489  	priv_set_t *privs;
3490  	char rootpath[MAXPATHLEN];
3491  	char modname[MAXPATHLEN];
3492  	struct brand_attr attr;
3493  	brand_handle_t bh;
3494  	char *rctlbuf = NULL;
3495  	size_t rctlbufsz = 0;
3496  	char *zfsbuf = NULL;
3497  	size_t zfsbufsz = 0;
3498  	zoneid_t zoneid = -1;
3499  	int xerr;
3500  	char *kzone;
3501  	FILE *fp = NULL;
3502  	tsol_zcent_t *zcent = NULL;
3503  	int match = 0;
3504  	int doi = 0;
3505  
3506  	if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
3507  		zerror(zlogp, B_TRUE, "unable to determine zone root");
3508  		return (-1);
3509  	}
3510  	if (zonecfg_in_alt_root())
3511  		resolve_lofs(zlogp, rootpath, sizeof (rootpath));
3512  
3513  	if ((privs = priv_allocset()) == NULL) {
3514  		zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
3515  		return (-1);
3516  	}
3517  	priv_emptyset(privs);
3518  	if (get_privset(zlogp, privs, mount_cmd) != 0)
3519  		goto error;
3520  
3521  	if (!mount_cmd && get_rctls(zlogp, &rctlbuf, &rctlbufsz) != 0) {
3522  		zerror(zlogp, B_FALSE, "Unable to get list of rctls");
3523  		goto error;
3524  	}
3525  
3526  	if (get_datasets(zlogp, &zfsbuf, &zfsbufsz) != 0) {
3527  		zerror(zlogp, B_FALSE, "Unable to get list of ZFS datasets");
3528  		goto error;
3529  	}
3530  
3531  	if (!mount_cmd && is_system_labeled()) {
3532  		zcent = get_zone_label(zlogp, privs);
3533  		if (zcent != NULL) {
3534  			match = zcent->zc_match;
3535  			doi = zcent->zc_doi;
3536  			*zlabel = zcent->zc_label;
3537  		} else {
3538  			goto error;
3539  		}
3540  	}
3541  
3542  	kzone = zone_name;
3543  
3544  	/*
3545  	 * We must do this scan twice.  First, we look for zones running on the
3546  	 * main system that are using this root (or any subdirectory of it).
3547  	 * Next, we reduce to the shortest path and search for loopback mounts
3548  	 * that use this same source node (same device and inode).
3549  	 */
3550  	if (duplicate_zone_root(zlogp, rootpath))
3551  		goto error;
3552  	if (duplicate_reachable_path(zlogp, rootpath))
3553  		goto error;
3554  
3555  	if (mount_cmd) {
3556  		assert(zone_isnative);
3557  		root_to_lu(zlogp, rootpath, sizeof (rootpath), B_TRUE);
3558  
3559  		/*
3560  		 * Forge up a special root for this zone.  When a zone is
3561  		 * mounted, we can't let the zone have its own root because the
3562  		 * tools that will be used in this "scratch zone" need access
3563  		 * to both the zone's resources and the running machine's
3564  		 * executables.
3565  		 *
3566  		 * Note that the mkdir here also catches read-only filesystems.
3567  		 */
3568  		if (mkdir(rootpath, 0755) != 0 && errno != EEXIST) {
3569  			zerror(zlogp, B_TRUE, "cannot create %s", rootpath);
3570  			goto error;
3571  		}
3572  		if (domount(zlogp, "tmpfs", "", "swap", rootpath) != 0)
3573  			goto error;
3574  	}
3575  
3576  	if (zonecfg_in_alt_root()) {
3577  		/*
3578  		 * If we are mounting up a zone in an alternate root partition,
3579  		 * then we have some additional work to do before starting the
3580  		 * zone.  First, resolve the root path down so that we're not
3581  		 * fooled by duplicates.  Then forge up an internal name for
3582  		 * the zone.
3583  		 */
3584  		if ((fp = zonecfg_open_scratch("", B_TRUE)) == NULL) {
3585  			zerror(zlogp, B_TRUE, "cannot open mapfile");
3586  			goto error;
3587  		}
3588  		if (zonecfg_lock_scratch(fp) != 0) {
3589  			zerror(zlogp, B_TRUE, "cannot lock mapfile");
3590  			goto error;
3591  		}
3592  		if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
3593  		    NULL, 0) == 0) {
3594  			zerror(zlogp, B_FALSE, "scratch zone already running");
3595  			goto error;
3596  		}
3597  		/* This is the preferred name */
3598  		(void) snprintf(kernzone, sizeof (kernzone), "SUNWlu-%s",
3599  		    zone_name);
3600  		srandom(getpid());
3601  		while (zonecfg_reverse_scratch(fp, kernzone, NULL, 0, NULL,
3602  		    0) == 0) {
3603  			/* This is just an arbitrary name; note "." usage */
3604  			(void) snprintf(kernzone, sizeof (kernzone),
3605  			    "SUNWlu.%08lX%08lX", random(), random());
3606  		}
3607  		kzone = kernzone;
3608  	}
3609  
3610  	xerr = 0;
3611  	if ((zoneid = zone_create(kzone, rootpath, privs, rctlbuf,
3612  	    rctlbufsz, zfsbuf, zfsbufsz, &xerr, match, doi, zlabel)) == -1) {
3613  		if (xerr == ZE_AREMOUNTS) {
3614  			if (zonecfg_find_mounts(rootpath, NULL, NULL) < 1) {
3615  				zerror(zlogp, B_FALSE,
3616  				    "An unknown file-system is mounted on "
3617  				    "a subdirectory of %s", rootpath);
3618  			} else {
3619  
3620  				zerror(zlogp, B_FALSE,
3621  				    "These file-systems are mounted on "
3622  				    "subdirectories of %s:", rootpath);
3623  				(void) zonecfg_find_mounts(rootpath,
3624  				    prtmount, zlogp);
3625  			}
3626  		} else if (xerr == ZE_CHROOTED) {
3627  			zerror(zlogp, B_FALSE, "%s: "
3628  			    "cannot create a zone from a chrooted "
3629  			    "environment", "zone_create");
3630  		} else {
3631  			zerror(zlogp, B_TRUE, "%s failed", "zone_create");
3632  		}
3633  		goto error;
3634  	}
3635  
3636  	if (zonecfg_in_alt_root() &&
3637  	    zonecfg_add_scratch(fp, zone_name, kernzone,
3638  	    zonecfg_get_root()) == -1) {
3639  		zerror(zlogp, B_TRUE, "cannot add mapfile entry");
3640  		goto error;
3641  	}
3642  
3643  	if ((zone_get_brand(zone_name, attr.ba_brandname,
3644  	    MAXNAMELEN) != Z_OK) ||
3645  	    (bh = brand_open(attr.ba_brandname)) == NULL) {
3646  		zerror(zlogp, B_FALSE, "unable to determine brand name");
3647  		return (-1);
3648  	}
3649  
3650  	/*
3651  	 * If this brand requires any kernel support, now is the time to
3652  	 * get it loaded and initialized.
3653  	 */
3654  	if (brand_get_modname(bh, modname, MAXPATHLEN) < 0) {
3655  		zerror(zlogp, B_FALSE, "unable to determine brand kernel "
3656  		    "module");
3657  		return (-1);
3658  	}
3659  
3660  	if (strlen(modname) > 0) {
3661  		(void) strlcpy(attr.ba_modname, modname, MAXPATHLEN);
3662  		if (zone_setattr(zoneid, ZONE_ATTR_BRAND, &attr,
3663  		    sizeof (attr) != 0)) {
3664  			zerror(zlogp, B_TRUE, "could not set zone brand "
3665  			    "attribute.");
3666  			goto error;
3667  		}
3668  	}
3669  
3670  	/*
3671  	 * The following is a warning, not an error, and is not performed when
3672  	 * merely mounting a zone for administrative use.
3673  	 */
3674  	if (!mount_cmd && bind_to_pool(zlogp, zoneid) != 0)
3675  		zerror(zlogp, B_FALSE, "WARNING: unable to bind zone to "
3676  		    "requested pool; using default pool.");
3677  	if (!mount_cmd)
3678  		set_mlps(zlogp, zoneid, zcent);
3679  	rval = zoneid;
3680  	zoneid = -1;
3681  
3682  error:
3683  	if (zoneid != -1)
3684  		(void) zone_destroy(zoneid);
3685  	if (rctlbuf != NULL)
3686  		free(rctlbuf);
3687  	priv_freeset(privs);
3688  	if (fp != NULL)
3689  		zonecfg_close_scratch(fp);
3690  	lofs_discard_mnttab();
3691  	if (zcent != NULL)
3692  		tsol_freezcent(zcent);
3693  	return (rval);
3694  }
3695  
3696  /*
3697   * Enter the zone and write a /etc/zones/index file there.  This allows
3698   * libzonecfg (and thus zoneadm) to report the UUID and potentially other zone
3699   * details from inside the zone.
3700   */
3701  static void
3702  write_index_file(zoneid_t zoneid)
3703  {
3704  	FILE *zef;
3705  	FILE *zet;
3706  	struct zoneent *zep;
3707  	pid_t child;
3708  	int tmpl_fd;
3709  	ctid_t ct;
3710  	int fd;
3711  	char uuidstr[UUID_PRINTABLE_STRING_LENGTH];
3712  
3713  	/* Locate the zone entry in the global zone's index file */
3714  	if ((zef = setzoneent()) == NULL)
3715  		return;
3716  	while ((zep = getzoneent_private(zef)) != NULL) {
3717  		if (strcmp(zep->zone_name, zone_name) == 0)
3718  			break;
3719  		free(zep);
3720  	}
3721  	endzoneent(zef);
3722  	if (zep == NULL)
3723  		return;
3724  
3725  	if ((tmpl_fd = init_template()) == -1) {
3726  		free(zep);
3727  		return;
3728  	}
3729  
3730  	if ((child = fork()) == -1) {
3731  		(void) ct_tmpl_clear(tmpl_fd);
3732  		(void) close(tmpl_fd);
3733  		free(zep);
3734  		return;
3735  	}
3736  
3737  	/* parent waits for child to finish */
3738  	if (child != 0) {
3739  		free(zep);
3740  		if (contract_latest(&ct) == -1)
3741  			ct = -1;
3742  		(void) ct_tmpl_clear(tmpl_fd);
3743  		(void) close(tmpl_fd);
3744  		(void) waitpid(child, NULL, 0);
3745  		(void) contract_abandon_id(ct);
3746  		return;
3747  	}
3748  
3749  	/* child enters zone and sets up index file */
3750  	(void) ct_tmpl_clear(tmpl_fd);
3751  	if (zone_enter(zoneid) != -1) {
3752  		(void) mkdir(ZONE_CONFIG_ROOT, ZONE_CONFIG_MODE);
3753  		(void) chown(ZONE_CONFIG_ROOT, ZONE_CONFIG_UID,
3754  		    ZONE_CONFIG_GID);
3755  		fd = open(ZONE_INDEX_FILE, O_WRONLY|O_CREAT|O_TRUNC,
3756  		    ZONE_INDEX_MODE);
3757  		if (fd != -1 && (zet = fdopen(fd, "w")) != NULL) {
3758  			(void) fchown(fd, ZONE_INDEX_UID, ZONE_INDEX_GID);
3759  			if (uuid_is_null(zep->zone_uuid))
3760  				uuidstr[0] = '\0';
3761  			else
3762  				uuid_unparse(zep->zone_uuid, uuidstr);
3763  			(void) fprintf(zet, "%s:%s:/:%s\n", zep->zone_name,
3764  			    zone_state_str(zep->zone_state),
3765  			    uuidstr);
3766  			(void) fclose(zet);
3767  		}
3768  	}
3769  	_exit(0);
3770  }
3771  
3772  int
3773  vplat_bringup(zlog_t *zlogp, boolean_t mount_cmd, zoneid_t zoneid)
3774  {
3775  	char zonepath[MAXPATHLEN];
3776  
3777  	if (!mount_cmd && validate_datasets(zlogp) != 0) {
3778  		lofs_discard_mnttab();
3779  		return (-1);
3780  	}
3781  
3782  	/*
3783  	 * Before we try to mount filesystems we need to create the
3784  	 * attribute backing store for /dev
3785  	 */
3786  	if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
3787  		lofs_discard_mnttab();
3788  		return (-1);
3789  	}
3790  	if (make_one_dir(zlogp, zonepath, "/dev", DEFAULT_DIR_MODE) != 0) {
3791  		lofs_discard_mnttab();
3792  		return (-1);
3793  	}
3794  
3795  	if (mount_filesystems(zlogp, mount_cmd) != 0) {
3796  		lofs_discard_mnttab();
3797  		return (-1);
3798  	}
3799  
3800  	if (!mount_cmd && configure_network_interfaces(zlogp) != 0) {
3801  		lofs_discard_mnttab();
3802  		return (-1);
3803  	}
3804  
3805  	write_index_file(zoneid);
3806  
3807  	lofs_discard_mnttab();
3808  	return (0);
3809  }
3810  
3811  static int
3812  lu_root_teardown(zlog_t *zlogp)
3813  {
3814  	char zroot[MAXPATHLEN];
3815  
3816  	assert(zone_isnative);
3817  
3818  	if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
3819  		zerror(zlogp, B_FALSE, "unable to determine zone root");
3820  		return (-1);
3821  	}
3822  	root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
3823  
3824  	/*
3825  	 * At this point, the processes are gone, the filesystems (save the
3826  	 * root) are unmounted, and the zone is on death row.  But there may
3827  	 * still be creds floating about in the system that reference the
3828  	 * zone_t, and which pin down zone_rootvp causing this call to fail
3829  	 * with EBUSY.  Thus, we try for a little while before just giving up.
3830  	 * (How I wish this were not true, and umount2 just did the right
3831  	 * thing, or tmpfs supported MS_FORCE This is a gross hack.)
3832  	 */
3833  	if (umount2(zroot, MS_FORCE) != 0) {
3834  		if (errno == ENOTSUP && umount2(zroot, 0) == 0)
3835  			goto unmounted;
3836  		if (errno == EBUSY) {
3837  			int tries = 10;
3838  
3839  			while (--tries >= 0) {
3840  				(void) sleep(1);
3841  				if (umount2(zroot, 0) == 0)
3842  					goto unmounted;
3843  				if (errno != EBUSY)
3844  					break;
3845  			}
3846  		}
3847  		zerror(zlogp, B_TRUE, "unable to unmount '%s'", zroot);
3848  		return (-1);
3849  	}
3850  unmounted:
3851  
3852  	/*
3853  	 * Only zones in an alternate root environment have scratch zone
3854  	 * entries.
3855  	 */
3856  	if (zonecfg_in_alt_root()) {
3857  		FILE *fp;
3858  		int retv;
3859  
3860  		if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
3861  			zerror(zlogp, B_TRUE, "cannot open mapfile");
3862  			return (-1);
3863  		}
3864  		retv = -1;
3865  		if (zonecfg_lock_scratch(fp) != 0)
3866  			zerror(zlogp, B_TRUE, "cannot lock mapfile");
3867  		else if (zonecfg_delete_scratch(fp, kernzone) != 0)
3868  			zerror(zlogp, B_TRUE, "cannot delete map entry");
3869  		else
3870  			retv = 0;
3871  		zonecfg_close_scratch(fp);
3872  		return (retv);
3873  	} else {
3874  		return (0);
3875  	}
3876  }
3877  
3878  int
3879  vplat_teardown(zlog_t *zlogp, boolean_t unmount_cmd)
3880  {
3881  	char *kzone;
3882  	zoneid_t zoneid;
3883  	char zroot[MAXPATHLEN];
3884  	char cmdbuf[MAXPATHLEN];
3885  	char brand[MAXNAMELEN];
3886  	brand_handle_t bh = NULL;
3887  
3888  	kzone = zone_name;
3889  	if (zonecfg_in_alt_root()) {
3890  		FILE *fp;
3891  
3892  		if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
3893  			zerror(zlogp, B_TRUE, "unable to open map file");
3894  			goto error;
3895  		}
3896  		if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
3897  		    kernzone, sizeof (kernzone)) != 0) {
3898  			zerror(zlogp, B_FALSE, "unable to find scratch zone");
3899  			zonecfg_close_scratch(fp);
3900  			goto error;
3901  		}
3902  		zonecfg_close_scratch(fp);
3903  		kzone = kernzone;
3904  	}
3905  
3906  	if ((zoneid = getzoneidbyname(kzone)) == ZONE_ID_UNDEFINED) {
3907  		if (!bringup_failure_recovery)
3908  			zerror(zlogp, B_TRUE, "unable to get zoneid");
3909  		if (unmount_cmd)
3910  			(void) lu_root_teardown(zlogp);
3911  		goto error;
3912  	}
3913  
3914  	if (zone_shutdown(zoneid) != 0) {
3915  		zerror(zlogp, B_TRUE, "unable to shutdown zone");
3916  		goto error;
3917  	}
3918  
3919  	/* Get the path to the root of this zone */
3920  	if (zone_get_zonepath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
3921  		zerror(zlogp, B_FALSE, "unable to determine zone root");
3922  		goto error;
3923  	}
3924  
3925  	/* Get a handle to the brand info for this zone */
3926  	if ((zone_get_brand(zone_name, brand, sizeof (brand)) != Z_OK) ||
3927  	    (bh = brand_open(brand)) == NULL) {
3928  		zerror(zlogp, B_FALSE, "unable to determine zone brand");
3929  		return (-1);
3930  	}
3931  	/*
3932  	 * If there is a brand 'halt' callback, execute it now to give the
3933  	 * brand a chance to cleanup any custom configuration.
3934  	 */
3935  	(void) strcpy(cmdbuf, EXEC_PREFIX);
3936  	if (brand_get_halt(bh, zone_name, zroot, cmdbuf + EXEC_LEN,
3937  	    sizeof (cmdbuf) - EXEC_LEN, 0, NULL) < 0) {
3938  		brand_close(bh);
3939  		zerror(zlogp, B_FALSE, "unable to determine branded zone's "
3940  		    "halt callback.");
3941  		goto error;
3942  	}
3943  	brand_close(bh);
3944  
3945  	if ((strlen(cmdbuf) > EXEC_LEN) &&
3946  	    (do_subproc(zlogp, cmdbuf) != Z_OK)) {
3947  		zerror(zlogp, B_FALSE, "%s failed", cmdbuf);
3948  		goto error;
3949  	}
3950  
3951  	if (!unmount_cmd &&
3952  	    unconfigure_network_interfaces(zlogp, zoneid) != 0) {
3953  		zerror(zlogp, B_FALSE,
3954  		    "unable to unconfigure network interfaces in zone");
3955  		goto error;
3956  	}
3957  
3958  	if (!unmount_cmd && tcp_abort_connections(zlogp, zoneid) != 0) {
3959  		zerror(zlogp, B_TRUE, "unable to abort TCP connections");
3960  		goto error;
3961  	}
3962  
3963  	/* destroy zconsole before umount /dev */
3964  	if (!unmount_cmd)
3965  		destroy_console_slave();
3966  
3967  	if (unmount_filesystems(zlogp, zoneid, unmount_cmd) != 0) {
3968  		zerror(zlogp, B_FALSE,
3969  		    "unable to unmount file systems in zone");
3970  		goto error;
3971  	}
3972  
3973  	remove_mlps(zlogp, zoneid);
3974  
3975  	if (zone_destroy(zoneid) != 0) {
3976  		zerror(zlogp, B_TRUE, "unable to destroy zone");
3977  		goto error;
3978  	}
3979  
3980  	/*
3981  	 * Special teardown for alternate boot environments: remove the tmpfs
3982  	 * root for the zone and then remove it from the map file.
3983  	 */
3984  	if (unmount_cmd && lu_root_teardown(zlogp) != 0)
3985  		goto error;
3986  
3987  	lofs_discard_mnttab();
3988  	return (0);
3989  
3990  error:
3991  	lofs_discard_mnttab();
3992  	return (-1);
3993  }
3994