xref: /titanic_50/usr/src/cmd/zoneadmd/vplat.c (revision a574db851cdc636fc3939b68e80d79fe7fbd57f2)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 /*
30  * This module contains functions used to bring up and tear down the
31  * Virtual Platform: [un]mounting file-systems, [un]plumbing network
32  * interfaces, [un]configuring devices, establishing resource controls,
33  * and creating/destroying the zone in the kernel.  These actions, on
34  * the way up, ready the zone; on the way down, they halt the zone.
35  * See the much longer block comment at the beginning of zoneadmd.c
36  * for a bigger picture of how the whole program functions.
37  *
38  * This module also has primary responsibility for the layout of "scratch
39  * zones."  These are mounted, but inactive, zones that are used during
40  * operating system upgrade and potentially other administrative action.  The
41  * scratch zone environment is similar to the miniroot environment.  The zone's
42  * actual root is mounted read-write on /a, and the standard paths (/usr,
43  * /sbin, /lib) all lead to read-only copies of the running system's binaries.
44  * This allows the administrative tools to manipulate the zone using "-R /a"
45  * without relying on any binaries in the zone itself.
46  *
47  * If the scratch zone is on an alternate root (Live Upgrade [LU] boot
48  * environment), then we must resolve the lofs mounts used there to uncover
49  * writable (unshared) resources.  Shared resources, though, are always
50  * read-only.  In addition, if the "same" zone with a different root path is
51  * currently running, then "/b" inside the zone points to the running zone's
52  * root.  This allows LU to synchronize configuration files during the upgrade
53  * process.
54  *
55  * To construct this environment, this module creates a tmpfs mount on
56  * $ZONEPATH/lu.  Inside this scratch area, the miniroot-like environment as
57  * described above is constructed on the fly.  The zone is then created using
58  * $ZONEPATH/lu as the root.
59  *
60  * Note that scratch zones are inactive.  The zone's bits are not running and
61  * likely cannot be run correctly until upgrade is done.  Init is not running
62  * there, nor is SMF.  Because of this, the "mounted" state of a scratch zone
63  * is not a part of the usual halt/ready/boot state machine.
64  */
65 
66 #include <sys/param.h>
67 #include <sys/mount.h>
68 #include <sys/mntent.h>
69 #include <sys/socket.h>
70 #include <sys/utsname.h>
71 #include <sys/types.h>
72 #include <sys/stat.h>
73 #include <sys/sockio.h>
74 #include <sys/stropts.h>
75 #include <sys/conf.h>
76 
77 #include <sys/dlpi.h>
78 #include <libdlpi.h>
79 #include <libdllink.h>
80 
81 #include <inet/tcp.h>
82 #include <arpa/inet.h>
83 #include <netinet/in.h>
84 #include <net/route.h>
85 
86 #include <stdio.h>
87 #include <errno.h>
88 #include <fcntl.h>
89 #include <unistd.h>
90 #include <rctl.h>
91 #include <stdlib.h>
92 #include <string.h>
93 #include <strings.h>
94 #include <wait.h>
95 #include <limits.h>
96 #include <libgen.h>
97 #include <libzfs.h>
98 #include <libdevinfo.h>
99 #include <zone.h>
100 #include <assert.h>
101 #include <libcontract.h>
102 #include <libcontract_priv.h>
103 #include <uuid/uuid.h>
104 
105 #include <sys/mntio.h>
106 #include <sys/mnttab.h>
107 #include <sys/fs/autofs.h>	/* for _autofssys() */
108 #include <sys/fs/lofs_info.h>
109 #include <sys/fs/zfs.h>
110 
111 #include <pool.h>
112 #include <sys/pool.h>
113 #include <sys/priocntl.h>
114 
115 #include <libbrand.h>
116 #include <sys/brand.h>
117 #include <libzonecfg.h>
118 #include <synch.h>
119 
120 #include "zoneadmd.h"
121 #include <tsol/label.h>
122 #include <libtsnet.h>
123 #include <sys/priv.h>
124 
125 #include <sys/dld.h>	/* DLIOCHOLDVLAN and friends */
126 
127 #define	V4_ADDR_LEN	32
128 #define	V6_ADDR_LEN	128
129 
130 #define	IPD_DEFAULT_OPTS \
131 	MNTOPT_RO "," MNTOPT_LOFS_NOSUB "," MNTOPT_NODEVICES
132 
133 #define	DFSTYPES	"/etc/dfs/fstypes"
134 #define	MAXTNZLEN	2048
135 
136 #define	ALT_MOUNT(mount_cmd) 	((mount_cmd) != Z_MNT_BOOT)
137 
138 /* for routing socket */
139 static int rts_seqno = 0;
140 
141 /* mangled zone name when mounting in an alternate root environment */
142 static char kernzone[ZONENAME_MAX];
143 
144 /* array of cached mount entries for resolve_lofs */
145 static struct mnttab *resolve_lofs_mnts, *resolve_lofs_mnt_max;
146 
147 /* for Trusted Extensions */
148 static tsol_zcent_t *get_zone_label(zlog_t *, priv_set_t *);
149 static int tsol_mounts(zlog_t *, char *, char *);
150 static void tsol_unmounts(zlog_t *, char *);
151 static int driver_hold_link(const char *name, zoneid_t zoneid);
152 static int driver_rele_link(const char *name, zoneid_t zoneid);
153 
154 static m_label_t *zlabel = NULL;
155 static m_label_t *zid_label = NULL;
156 static priv_set_t *zprivs = NULL;
157 
158 /* from libsocket, not in any header file */
159 extern int getnetmaskbyaddr(struct in_addr, struct in_addr *);
160 
161 /*
162  * An optimization for build_mnttable: reallocate (and potentially copy the
163  * data) only once every N times through the loop.
164  */
165 #define	MNTTAB_HUNK	32
166 
167 /*
168  * Private autofs system call
169  */
170 extern int _autofssys(int, void *);
171 
172 static int
173 autofs_cleanup(zoneid_t zoneid)
174 {
175 	/*
176 	 * Ask autofs to unmount all trigger nodes in the given zone.
177 	 */
178 	return (_autofssys(AUTOFS_UNMOUNTALL, (void *)zoneid));
179 }
180 
181 static void
182 free_mnttable(struct mnttab *mnt_array, uint_t nelem)
183 {
184 	uint_t i;
185 
186 	if (mnt_array == NULL)
187 		return;
188 	for (i = 0; i < nelem; i++) {
189 		free(mnt_array[i].mnt_mountp);
190 		free(mnt_array[i].mnt_fstype);
191 		free(mnt_array[i].mnt_special);
192 		free(mnt_array[i].mnt_mntopts);
193 		assert(mnt_array[i].mnt_time == NULL);
194 	}
195 	free(mnt_array);
196 }
197 
198 /*
199  * Build the mount table for the zone rooted at "zroot", storing the resulting
200  * array of struct mnttabs in "mnt_arrayp" and the number of elements in the
201  * array in "nelemp".
202  */
203 static int
204 build_mnttable(zlog_t *zlogp, const char *zroot, size_t zrootlen, FILE *mnttab,
205     struct mnttab **mnt_arrayp, uint_t *nelemp)
206 {
207 	struct mnttab mnt;
208 	struct mnttab *mnts;
209 	struct mnttab *mnp;
210 	uint_t nmnt;
211 
212 	rewind(mnttab);
213 	resetmnttab(mnttab);
214 	nmnt = 0;
215 	mnts = NULL;
216 	while (getmntent(mnttab, &mnt) == 0) {
217 		struct mnttab *tmp_array;
218 
219 		if (strncmp(mnt.mnt_mountp, zroot, zrootlen) != 0)
220 			continue;
221 		if (nmnt % MNTTAB_HUNK == 0) {
222 			tmp_array = realloc(mnts,
223 			    (nmnt + MNTTAB_HUNK) * sizeof (*mnts));
224 			if (tmp_array == NULL) {
225 				free_mnttable(mnts, nmnt);
226 				return (-1);
227 			}
228 			mnts = tmp_array;
229 		}
230 		mnp = &mnts[nmnt++];
231 
232 		/*
233 		 * Zero out any fields we're not using.
234 		 */
235 		(void) memset(mnp, 0, sizeof (*mnp));
236 
237 		if (mnt.mnt_special != NULL)
238 			mnp->mnt_special = strdup(mnt.mnt_special);
239 		if (mnt.mnt_mntopts != NULL)
240 			mnp->mnt_mntopts = strdup(mnt.mnt_mntopts);
241 		mnp->mnt_mountp = strdup(mnt.mnt_mountp);
242 		mnp->mnt_fstype = strdup(mnt.mnt_fstype);
243 		if ((mnt.mnt_special != NULL && mnp->mnt_special == NULL) ||
244 		    (mnt.mnt_mntopts != NULL && mnp->mnt_mntopts == NULL) ||
245 		    mnp->mnt_mountp == NULL || mnp->mnt_fstype == NULL) {
246 			zerror(zlogp, B_TRUE, "memory allocation failed");
247 			free_mnttable(mnts, nmnt);
248 			return (-1);
249 		}
250 	}
251 	*mnt_arrayp = mnts;
252 	*nelemp = nmnt;
253 	return (0);
254 }
255 
256 /*
257  * This is an optimization.  The resolve_lofs function is used quite frequently
258  * to manipulate file paths, and on a machine with a large number of zones,
259  * there will be a huge number of mounted file systems.  Thus, we trigger a
260  * reread of the list of mount points
261  */
262 static void
263 lofs_discard_mnttab(void)
264 {
265 	free_mnttable(resolve_lofs_mnts,
266 	    resolve_lofs_mnt_max - resolve_lofs_mnts);
267 	resolve_lofs_mnts = resolve_lofs_mnt_max = NULL;
268 }
269 
270 static int
271 lofs_read_mnttab(zlog_t *zlogp)
272 {
273 	FILE *mnttab;
274 	uint_t nmnts;
275 
276 	if ((mnttab = fopen(MNTTAB, "r")) == NULL)
277 		return (-1);
278 	if (build_mnttable(zlogp, "", 0, mnttab, &resolve_lofs_mnts,
279 	    &nmnts) == -1) {
280 		(void) fclose(mnttab);
281 		return (-1);
282 	}
283 	(void) fclose(mnttab);
284 	resolve_lofs_mnt_max = resolve_lofs_mnts + nmnts;
285 	return (0);
286 }
287 
288 /*
289  * This function loops over potential loopback mounts and symlinks in a given
290  * path and resolves them all down to an absolute path.
291  */
292 void
293 resolve_lofs(zlog_t *zlogp, char *path, size_t pathlen)
294 {
295 	int len, arlen;
296 	const char *altroot;
297 	char tmppath[MAXPATHLEN];
298 	boolean_t outside_altroot;
299 
300 	if ((len = resolvepath(path, tmppath, sizeof (tmppath))) == -1)
301 		return;
302 	tmppath[len] = '\0';
303 	(void) strlcpy(path, tmppath, sizeof (tmppath));
304 
305 	/* This happens once per zoneadmd operation. */
306 	if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
307 		return;
308 
309 	altroot = zonecfg_get_root();
310 	arlen = strlen(altroot);
311 	outside_altroot = B_FALSE;
312 	for (;;) {
313 		struct mnttab *mnp;
314 
315 		/* Search in reverse order to find longest match */
316 		for (mnp = resolve_lofs_mnt_max - 1; mnp >= resolve_lofs_mnts;
317 		    mnp--) {
318 			if (mnp->mnt_fstype == NULL ||
319 			    mnp->mnt_mountp == NULL ||
320 			    mnp->mnt_special == NULL)
321 				continue;
322 			len = strlen(mnp->mnt_mountp);
323 			if (strncmp(mnp->mnt_mountp, path, len) == 0 &&
324 			    (path[len] == '/' || path[len] == '\0'))
325 				break;
326 		}
327 		if (mnp < resolve_lofs_mnts)
328 			break;
329 		/* If it's not a lofs then we're done */
330 		if (strcmp(mnp->mnt_fstype, MNTTYPE_LOFS) != 0)
331 			break;
332 		if (outside_altroot) {
333 			char *cp;
334 			int olen = sizeof (MNTOPT_RO) - 1;
335 
336 			/*
337 			 * If we run into a read-only mount outside of the
338 			 * alternate root environment, then the user doesn't
339 			 * want this path to be made read-write.
340 			 */
341 			if (mnp->mnt_mntopts != NULL &&
342 			    (cp = strstr(mnp->mnt_mntopts, MNTOPT_RO)) !=
343 			    NULL &&
344 			    (cp == mnp->mnt_mntopts || cp[-1] == ',') &&
345 			    (cp[olen] == '\0' || cp[olen] == ',')) {
346 				break;
347 			}
348 		} else if (arlen > 0 &&
349 		    (strncmp(mnp->mnt_special, altroot, arlen) != 0 ||
350 		    (mnp->mnt_special[arlen] != '\0' &&
351 		    mnp->mnt_special[arlen] != '/'))) {
352 			outside_altroot = B_TRUE;
353 		}
354 		/* use temporary buffer because new path might be longer */
355 		(void) snprintf(tmppath, sizeof (tmppath), "%s%s",
356 		    mnp->mnt_special, path + len);
357 		if ((len = resolvepath(tmppath, path, pathlen)) == -1)
358 			break;
359 		path[len] = '\0';
360 	}
361 }
362 
363 /*
364  * For a regular mount, check if a replacement lofs mount is needed because the
365  * referenced device is already mounted somewhere.
366  */
367 static int
368 check_lofs_needed(zlog_t *zlogp, struct zone_fstab *fsptr)
369 {
370 	struct mnttab *mnp;
371 	zone_fsopt_t *optptr, *onext;
372 
373 	/* This happens once per zoneadmd operation. */
374 	if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
375 		return (-1);
376 
377 	/*
378 	 * If this special node isn't already in use, then it's ours alone;
379 	 * no need to worry about conflicting mounts.
380 	 */
381 	for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max;
382 	    mnp++) {
383 		if (strcmp(mnp->mnt_special, fsptr->zone_fs_special) == 0)
384 			break;
385 	}
386 	if (mnp >= resolve_lofs_mnt_max)
387 		return (0);
388 
389 	/*
390 	 * Convert this duplicate mount into a lofs mount.
391 	 */
392 	(void) strlcpy(fsptr->zone_fs_special, mnp->mnt_mountp,
393 	    sizeof (fsptr->zone_fs_special));
394 	(void) strlcpy(fsptr->zone_fs_type, MNTTYPE_LOFS,
395 	    sizeof (fsptr->zone_fs_type));
396 	fsptr->zone_fs_raw[0] = '\0';
397 
398 	/*
399 	 * Discard all but one of the original options and set that to be the
400 	 * same set of options used for inherit package directory resources.
401 	 */
402 	optptr = fsptr->zone_fs_options;
403 	if (optptr == NULL) {
404 		optptr = malloc(sizeof (*optptr));
405 		if (optptr == NULL) {
406 			zerror(zlogp, B_TRUE, "cannot mount %s",
407 			    fsptr->zone_fs_dir);
408 			return (-1);
409 		}
410 	} else {
411 		while ((onext = optptr->zone_fsopt_next) != NULL) {
412 			optptr->zone_fsopt_next = onext->zone_fsopt_next;
413 			free(onext);
414 		}
415 	}
416 	(void) strcpy(optptr->zone_fsopt_opt, IPD_DEFAULT_OPTS);
417 	optptr->zone_fsopt_next = NULL;
418 	fsptr->zone_fs_options = optptr;
419 	return (0);
420 }
421 
422 int
423 make_one_dir(zlog_t *zlogp, const char *prefix, const char *subdir, mode_t mode,
424     uid_t userid, gid_t groupid)
425 {
426 	char path[MAXPATHLEN];
427 	struct stat st;
428 
429 	if (snprintf(path, sizeof (path), "%s%s", prefix, subdir) >
430 	    sizeof (path)) {
431 		zerror(zlogp, B_FALSE, "pathname %s%s is too long", prefix,
432 		    subdir);
433 		return (-1);
434 	}
435 
436 	if (lstat(path, &st) == 0) {
437 		/*
438 		 * We don't check the file mode since presumably the zone
439 		 * administrator may have had good reason to change the mode,
440 		 * and we don't need to second guess him.
441 		 */
442 		if (!S_ISDIR(st.st_mode)) {
443 			if (is_system_labeled() &&
444 			    S_ISREG(st.st_mode)) {
445 				/*
446 				 * The need to mount readonly copies of
447 				 * global zone /etc/ files is unique to
448 				 * Trusted Extensions.
449 				 */
450 				if (strncmp(subdir, "/etc/",
451 				    strlen("/etc/")) != 0) {
452 					zerror(zlogp, B_FALSE,
453 					    "%s is not in /etc", path);
454 					return (-1);
455 				}
456 			} else {
457 				zerror(zlogp, B_FALSE,
458 				    "%s is not a directory", path);
459 				return (-1);
460 			}
461 		}
462 		return (0);
463 	}
464 
465 	if (mkdirp(path, mode) != 0) {
466 		if (errno == EROFS)
467 			zerror(zlogp, B_FALSE, "Could not mkdir %s.\nIt is on "
468 			    "a read-only file system in this local zone.\nMake "
469 			    "sure %s exists in the global zone.", path, subdir);
470 		else
471 			zerror(zlogp, B_TRUE, "mkdirp of %s failed", path);
472 		return (-1);
473 	}
474 
475 	(void) chown(path, userid, groupid);
476 	return (0);
477 }
478 
479 static void
480 free_remote_fstypes(char **types)
481 {
482 	uint_t i;
483 
484 	if (types == NULL)
485 		return;
486 	for (i = 0; types[i] != NULL; i++)
487 		free(types[i]);
488 	free(types);
489 }
490 
491 static char **
492 get_remote_fstypes(zlog_t *zlogp)
493 {
494 	char **types = NULL;
495 	FILE *fp;
496 	char buf[MAXPATHLEN];
497 	char fstype[MAXPATHLEN];
498 	uint_t lines = 0;
499 	uint_t i;
500 
501 	if ((fp = fopen(DFSTYPES, "r")) == NULL) {
502 		zerror(zlogp, B_TRUE, "failed to open %s", DFSTYPES);
503 		return (NULL);
504 	}
505 	/*
506 	 * Count the number of lines
507 	 */
508 	while (fgets(buf, sizeof (buf), fp) != NULL)
509 		lines++;
510 	if (lines == 0)	/* didn't read anything; empty file */
511 		goto out;
512 	rewind(fp);
513 	/*
514 	 * Allocate enough space for a NULL-terminated array.
515 	 */
516 	types = calloc(lines + 1, sizeof (char *));
517 	if (types == NULL) {
518 		zerror(zlogp, B_TRUE, "memory allocation failed");
519 		goto out;
520 	}
521 	i = 0;
522 	while (fgets(buf, sizeof (buf), fp) != NULL) {
523 		/* LINTED - fstype is big enough to hold buf */
524 		if (sscanf(buf, "%s", fstype) == 0) {
525 			zerror(zlogp, B_FALSE, "unable to parse %s", DFSTYPES);
526 			free_remote_fstypes(types);
527 			types = NULL;
528 			goto out;
529 		}
530 		types[i] = strdup(fstype);
531 		if (types[i] == NULL) {
532 			zerror(zlogp, B_TRUE, "memory allocation failed");
533 			free_remote_fstypes(types);
534 			types = NULL;
535 			goto out;
536 		}
537 		i++;
538 	}
539 out:
540 	(void) fclose(fp);
541 	return (types);
542 }
543 
544 static boolean_t
545 is_remote_fstype(const char *fstype, char *const *remote_fstypes)
546 {
547 	uint_t i;
548 
549 	if (remote_fstypes == NULL)
550 		return (B_FALSE);
551 	for (i = 0; remote_fstypes[i] != NULL; i++) {
552 		if (strcmp(remote_fstypes[i], fstype) == 0)
553 			return (B_TRUE);
554 	}
555 	return (B_FALSE);
556 }
557 
558 /*
559  * This converts a zone root path (normally of the form .../root) to a Live
560  * Upgrade scratch zone root (of the form .../lu).
561  */
562 static void
563 root_to_lu(zlog_t *zlogp, char *zroot, size_t zrootlen, boolean_t isresolved)
564 {
565 	assert(zone_isnative || zone_iscluster);
566 
567 	if (!isresolved && zonecfg_in_alt_root())
568 		resolve_lofs(zlogp, zroot, zrootlen);
569 	(void) strcpy(strrchr(zroot, '/') + 1, "lu");
570 }
571 
572 /*
573  * The general strategy for unmounting filesystems is as follows:
574  *
575  * - Remote filesystems may be dead, and attempting to contact them as
576  * part of a regular unmount may hang forever; we want to always try to
577  * forcibly unmount such filesystems and only fall back to regular
578  * unmounts if the filesystem doesn't support forced unmounts.
579  *
580  * - We don't want to unnecessarily corrupt metadata on local
581  * filesystems (ie UFS), so we want to start off with graceful unmounts,
582  * and only escalate to doing forced unmounts if we get stuck.
583  *
584  * We start off walking backwards through the mount table.  This doesn't
585  * give us strict ordering but ensures that we try to unmount submounts
586  * first.  We thus limit the number of failed umount2(2) calls.
587  *
588  * The mechanism for determining if we're stuck is to count the number
589  * of failed unmounts each iteration through the mount table.  This
590  * gives us an upper bound on the number of filesystems which remain
591  * mounted (autofs trigger nodes are dealt with separately).  If at the
592  * end of one unmount+autofs_cleanup cycle we still have the same number
593  * of mounts that we started out with, we're stuck and try a forced
594  * unmount.  If that fails (filesystem doesn't support forced unmounts)
595  * then we bail and are unable to teardown the zone.  If it succeeds,
596  * we're no longer stuck so we continue with our policy of trying
597  * graceful mounts first.
598  *
599  * Zone must be down (ie, no processes or threads active).
600  */
601 static int
602 unmount_filesystems(zlog_t *zlogp, zoneid_t zoneid, boolean_t unmount_cmd)
603 {
604 	int error = 0;
605 	FILE *mnttab;
606 	struct mnttab *mnts;
607 	uint_t nmnt;
608 	char zroot[MAXPATHLEN + 1];
609 	size_t zrootlen;
610 	uint_t oldcount = UINT_MAX;
611 	boolean_t stuck = B_FALSE;
612 	char **remote_fstypes = NULL;
613 
614 	if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
615 		zerror(zlogp, B_FALSE, "unable to determine zone root");
616 		return (-1);
617 	}
618 	if (unmount_cmd)
619 		root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
620 
621 	(void) strcat(zroot, "/");
622 	zrootlen = strlen(zroot);
623 
624 	/*
625 	 * For Trusted Extensions unmount each higher level zone's mount
626 	 * of our zone's /export/home
627 	 */
628 	if (!unmount_cmd)
629 		tsol_unmounts(zlogp, zone_name);
630 
631 	if ((mnttab = fopen(MNTTAB, "r")) == NULL) {
632 		zerror(zlogp, B_TRUE, "failed to open %s", MNTTAB);
633 		return (-1);
634 	}
635 	/*
636 	 * Use our hacky mntfs ioctl so we see everything, even mounts with
637 	 * MS_NOMNTTAB.
638 	 */
639 	if (ioctl(fileno(mnttab), MNTIOC_SHOWHIDDEN, NULL) < 0) {
640 		zerror(zlogp, B_TRUE, "unable to configure %s", MNTTAB);
641 		error++;
642 		goto out;
643 	}
644 
645 	/*
646 	 * Build the list of remote fstypes so we know which ones we
647 	 * should forcibly unmount.
648 	 */
649 	remote_fstypes = get_remote_fstypes(zlogp);
650 	for (; /* ever */; ) {
651 		uint_t newcount = 0;
652 		boolean_t unmounted;
653 		struct mnttab *mnp;
654 		char *path;
655 		uint_t i;
656 
657 		mnts = NULL;
658 		nmnt = 0;
659 		/*
660 		 * MNTTAB gives us a way to walk through mounted
661 		 * filesystems; we need to be able to walk them in
662 		 * reverse order, so we build a list of all mounted
663 		 * filesystems.
664 		 */
665 		if (build_mnttable(zlogp, zroot, zrootlen, mnttab, &mnts,
666 		    &nmnt) != 0) {
667 			error++;
668 			goto out;
669 		}
670 		for (i = 0; i < nmnt; i++) {
671 			mnp = &mnts[nmnt - i - 1]; /* access in reverse order */
672 			path = mnp->mnt_mountp;
673 			unmounted = B_FALSE;
674 			/*
675 			 * Try forced unmount first for remote filesystems.
676 			 *
677 			 * Not all remote filesystems support forced unmounts,
678 			 * so if this fails (ENOTSUP) we'll continue on
679 			 * and try a regular unmount.
680 			 */
681 			if (is_remote_fstype(mnp->mnt_fstype, remote_fstypes)) {
682 				if (umount2(path, MS_FORCE) == 0)
683 					unmounted = B_TRUE;
684 			}
685 			/*
686 			 * Try forced unmount if we're stuck.
687 			 */
688 			if (stuck) {
689 				if (umount2(path, MS_FORCE) == 0) {
690 					unmounted = B_TRUE;
691 					stuck = B_FALSE;
692 				} else {
693 					/*
694 					 * The first failure indicates a
695 					 * mount we won't be able to get
696 					 * rid of automatically, so we
697 					 * bail.
698 					 */
699 					error++;
700 					zerror(zlogp, B_FALSE,
701 					    "unable to unmount '%s'", path);
702 					free_mnttable(mnts, nmnt);
703 					goto out;
704 				}
705 			}
706 			/*
707 			 * Try regular unmounts for everything else.
708 			 */
709 			if (!unmounted && umount2(path, 0) != 0)
710 				newcount++;
711 		}
712 		free_mnttable(mnts, nmnt);
713 
714 		if (newcount == 0)
715 			break;
716 		if (newcount >= oldcount) {
717 			/*
718 			 * Last round didn't unmount anything; we're stuck and
719 			 * should start trying forced unmounts.
720 			 */
721 			stuck = B_TRUE;
722 		}
723 		oldcount = newcount;
724 
725 		/*
726 		 * Autofs doesn't let you unmount its trigger nodes from
727 		 * userland so we have to tell the kernel to cleanup for us.
728 		 */
729 		if (autofs_cleanup(zoneid) != 0) {
730 			zerror(zlogp, B_TRUE, "unable to remove autofs nodes");
731 			error++;
732 			goto out;
733 		}
734 	}
735 
736 out:
737 	free_remote_fstypes(remote_fstypes);
738 	(void) fclose(mnttab);
739 	return (error ? -1 : 0);
740 }
741 
742 static int
743 fs_compare(const void *m1, const void *m2)
744 {
745 	struct zone_fstab *i = (struct zone_fstab *)m1;
746 	struct zone_fstab *j = (struct zone_fstab *)m2;
747 
748 	return (strcmp(i->zone_fs_dir, j->zone_fs_dir));
749 }
750 
751 /*
752  * Fork and exec (and wait for) the mentioned binary with the provided
753  * arguments.  Returns (-1) if something went wrong with fork(2) or exec(2),
754  * returns the exit status otherwise.
755  *
756  * If we were unable to exec the provided pathname (for whatever
757  * reason), we return the special token ZEXIT_EXEC.  The current value
758  * of ZEXIT_EXEC doesn't conflict with legitimate exit codes of the
759  * consumers of this function; any future consumers must make sure this
760  * remains the case.
761  */
762 static int
763 forkexec(zlog_t *zlogp, const char *path, char *const argv[])
764 {
765 	pid_t child_pid;
766 	int child_status = 0;
767 
768 	/*
769 	 * Do not let another thread localize a message while we are forking.
770 	 */
771 	(void) mutex_lock(&msglock);
772 	child_pid = fork();
773 	(void) mutex_unlock(&msglock);
774 	if (child_pid == -1) {
775 		zerror(zlogp, B_TRUE, "could not fork for %s", argv[0]);
776 		return (-1);
777 	} else if (child_pid == 0) {
778 		closefrom(0);
779 		/* redirect stdin, stdout & stderr to /dev/null */
780 		(void) open("/dev/null", O_RDONLY);	/* stdin */
781 		(void) open("/dev/null", O_WRONLY);	/* stdout */
782 		(void) open("/dev/null", O_WRONLY);	/* stderr */
783 		(void) execv(path, argv);
784 		/*
785 		 * Since we are in the child, there is no point calling zerror()
786 		 * since there is nobody waiting to consume it.  So exit with a
787 		 * special code that the parent will recognize and call zerror()
788 		 * accordingly.
789 		 */
790 
791 		_exit(ZEXIT_EXEC);
792 	} else {
793 		(void) waitpid(child_pid, &child_status, 0);
794 	}
795 
796 	if (WIFSIGNALED(child_status)) {
797 		zerror(zlogp, B_FALSE, "%s unexpectedly terminated due to "
798 		    "signal %d", path, WTERMSIG(child_status));
799 		return (-1);
800 	}
801 	assert(WIFEXITED(child_status));
802 	if (WEXITSTATUS(child_status) == ZEXIT_EXEC) {
803 		zerror(zlogp, B_FALSE, "failed to exec %s", path);
804 		return (-1);
805 	}
806 	return (WEXITSTATUS(child_status));
807 }
808 
809 static int
810 dofsck(zlog_t *zlogp, const char *fstype, const char *rawdev)
811 {
812 	char cmdbuf[MAXPATHLEN];
813 	char *argv[4];
814 	int status;
815 
816 	/*
817 	 * We could alternatively have called /usr/sbin/fsck -F <fstype>, but
818 	 * that would cost us an extra fork/exec without buying us anything.
819 	 */
820 	if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/fsck", fstype)
821 	    >= sizeof (cmdbuf)) {
822 		zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
823 		return (-1);
824 	}
825 
826 	argv[0] = "fsck";
827 	argv[1] = "-m";
828 	argv[2] = (char *)rawdev;
829 	argv[3] = NULL;
830 
831 	status = forkexec(zlogp, cmdbuf, argv);
832 	if (status == 0 || status == -1)
833 		return (status);
834 	zerror(zlogp, B_FALSE, "fsck of '%s' failed with exit status %d; "
835 	    "run fsck manually", rawdev, status);
836 	return (-1);
837 }
838 
839 static int
840 domount(zlog_t *zlogp, const char *fstype, const char *opts,
841     const char *special, const char *directory)
842 {
843 	char cmdbuf[MAXPATHLEN];
844 	char *argv[6];
845 	int status;
846 
847 	/*
848 	 * We could alternatively have called /usr/sbin/mount -F <fstype>, but
849 	 * that would cost us an extra fork/exec without buying us anything.
850 	 */
851 	if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/mount", fstype)
852 	    >= sizeof (cmdbuf)) {
853 		zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
854 		return (-1);
855 	}
856 	argv[0] = "mount";
857 	if (opts[0] == '\0') {
858 		argv[1] = (char *)special;
859 		argv[2] = (char *)directory;
860 		argv[3] = NULL;
861 	} else {
862 		argv[1] = "-o";
863 		argv[2] = (char *)opts;
864 		argv[3] = (char *)special;
865 		argv[4] = (char *)directory;
866 		argv[5] = NULL;
867 	}
868 
869 	status = forkexec(zlogp, cmdbuf, argv);
870 	if (status == 0 || status == -1)
871 		return (status);
872 	if (opts[0] == '\0')
873 		zerror(zlogp, B_FALSE, "\"%s %s %s\" "
874 		    "failed with exit code %d",
875 		    cmdbuf, special, directory, status);
876 	else
877 		zerror(zlogp, B_FALSE, "\"%s -o %s %s %s\" "
878 		    "failed with exit code %d",
879 		    cmdbuf, opts, special, directory, status);
880 	return (-1);
881 }
882 
883 /*
884  * Check if a given mount point path exists.
885  * If it does, make sure it doesn't contain any symlinks.
886  * Note that if "leaf" is false we're checking an intermediate
887  * component of the mount point path, so it must be a directory.
888  * If "leaf" is true, then we're checking the entire mount point
889  * path, so the mount point itself can be anything aside from a
890  * symbolic link.
891  *
892  * If the path is invalid then a negative value is returned.  If the
893  * path exists and is a valid mount point path then 0 is returned.
894  * If the path doesn't exist return a positive value.
895  */
896 static int
897 valid_mount_point(zlog_t *zlogp, const char *path, const boolean_t leaf)
898 {
899 	struct stat statbuf;
900 	char respath[MAXPATHLEN];
901 	int res;
902 
903 	if (lstat(path, &statbuf) != 0) {
904 		if (errno == ENOENT)
905 			return (1);
906 		zerror(zlogp, B_TRUE, "can't stat %s", path);
907 		return (-1);
908 	}
909 	if (S_ISLNK(statbuf.st_mode)) {
910 		zerror(zlogp, B_FALSE, "%s is a symlink", path);
911 		return (-1);
912 	}
913 	if (!leaf && !S_ISDIR(statbuf.st_mode)) {
914 		zerror(zlogp, B_FALSE, "%s is not a directory", path);
915 		return (-1);
916 	}
917 	if ((res = resolvepath(path, respath, sizeof (respath))) == -1) {
918 		zerror(zlogp, B_TRUE, "unable to resolve path %s", path);
919 		return (-1);
920 	}
921 	respath[res] = '\0';
922 	if (strcmp(path, respath) != 0) {
923 		/*
924 		 * We don't like ".."s, "."s, or "//"s throwing us off
925 		 */
926 		zerror(zlogp, B_FALSE, "%s is not a canonical path", path);
927 		return (-1);
928 	}
929 	return (0);
930 }
931 
932 /*
933  * Validate a mount point path.  A valid mount point path is an
934  * absolute path that either doesn't exist, or, if it does exists it
935  * must be an absolute canonical path that doesn't have any symbolic
936  * links in it.  The target of a mount point path can be any filesystem
937  * object.  (Different filesystems can support different mount points,
938  * for example "lofs" and "mntfs" both support files and directories
939  * while "ufs" just supports directories.)
940  *
941  * If the path is invalid then a negative value is returned.  If the
942  * path exists and is a valid mount point path then 0 is returned.
943  * If the path doesn't exist return a positive value.
944  */
945 int
946 valid_mount_path(zlog_t *zlogp, const char *rootpath, const char *spec,
947     const char *dir, const char *fstype)
948 {
949 	char abspath[MAXPATHLEN], *slashp, *slashp_next;
950 	int rv;
951 
952 	/*
953 	 * Sanity check the target mount point path.
954 	 * It must be a non-null string that starts with a '/'.
955 	 */
956 	if (dir[0] != '/') {
957 		if (spec[0] == '\0') {
958 			/*
959 			 * This must be an invalid ipd entry (see comments
960 			 * in mount_filesystems_ipdent()).
961 			 */
962 			zerror(zlogp, B_FALSE,
963 			    "invalid inherit-pkg-dir entry: \"%s\"", dir);
964 		} else {
965 			/* Something went wrong. */
966 			zerror(zlogp, B_FALSE, "invalid mount directory, "
967 			    "type: \"%s\", special: \"%s\", dir: \"%s\"",
968 			    fstype, spec, dir);
969 		}
970 		return (-1);
971 	}
972 
973 	/*
974 	 * Join rootpath and dir.  Make sure abspath ends with '/', this
975 	 * is added to all paths (even non-directory paths) to allow us
976 	 * to detect the end of paths below.  If the path already ends
977 	 * in a '/', then that's ok too (although we'll fail the
978 	 * cannonical path check in valid_mount_point()).
979 	 */
980 	if (snprintf(abspath, sizeof (abspath),
981 	    "%s%s/", rootpath, dir) >= sizeof (abspath)) {
982 		zerror(zlogp, B_FALSE, "pathname %s%s is too long",
983 		    rootpath, dir);
984 		return (-1);
985 	}
986 
987 	/*
988 	 * Starting with rootpath, verify the mount path one component
989 	 * at a time.  Continue until we've evaluated all of abspath.
990 	 */
991 	slashp = &abspath[strlen(rootpath)];
992 	assert(*slashp == '/');
993 	do {
994 		slashp_next = strchr(slashp + 1, '/');
995 		*slashp = '\0';
996 		if (slashp_next != NULL) {
997 			/* This is an intermediary mount path component. */
998 			rv = valid_mount_point(zlogp, abspath, B_FALSE);
999 		} else {
1000 			/* This is the last component of the mount path. */
1001 			rv = valid_mount_point(zlogp, abspath, B_TRUE);
1002 		}
1003 		if (rv < 0)
1004 			return (rv);
1005 		*slashp = '/';
1006 	} while ((slashp = slashp_next) != NULL);
1007 	return (rv);
1008 }
1009 
1010 static int
1011 mount_one_dev_device_cb(void *arg, const char *match, const char *name)
1012 {
1013 	di_prof_t prof = arg;
1014 
1015 	if (name == NULL)
1016 		return (di_prof_add_dev(prof, match));
1017 	return (di_prof_add_map(prof, match, name));
1018 }
1019 
1020 static int
1021 mount_one_dev_symlink_cb(void *arg, const char *source, const char *target)
1022 {
1023 	di_prof_t prof = arg;
1024 
1025 	return (di_prof_add_symlink(prof, source, target));
1026 }
1027 
1028 static int
1029 get_iptype(zlog_t *zlogp, zone_iptype_t *iptypep)
1030 {
1031 	zone_dochandle_t handle;
1032 
1033 	if ((handle = zonecfg_init_handle()) == NULL) {
1034 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
1035 		return (-1);
1036 	}
1037 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
1038 		zerror(zlogp, B_FALSE, "invalid configuration");
1039 		zonecfg_fini_handle(handle);
1040 		return (-1);
1041 	}
1042 	if (zonecfg_get_iptype(handle, iptypep) != Z_OK) {
1043 		zerror(zlogp, B_FALSE, "invalid ip-type configuration");
1044 		zonecfg_fini_handle(handle);
1045 		return (-1);
1046 	}
1047 	zonecfg_fini_handle(handle);
1048 	return (0);
1049 }
1050 
1051 /*
1052  * Apply the standard lists of devices/symlinks/mappings and the user-specified
1053  * list of devices (via zonecfg) to the /dev filesystem.  The filesystem will
1054  * use these as a profile/filter to determine what exists in /dev.
1055  */
1056 static int
1057 mount_one_dev(zlog_t *zlogp, char *devpath)
1058 {
1059 	char			brand[MAXNAMELEN];
1060 	zone_dochandle_t	handle = NULL;
1061 	brand_handle_t		bh = NULL;
1062 	struct zone_devtab	ztab;
1063 	di_prof_t		prof = NULL;
1064 	int			err;
1065 	int			retval = -1;
1066 	zone_iptype_t		iptype;
1067 	const char 		*curr_iptype;
1068 
1069 	if (di_prof_init(devpath, &prof)) {
1070 		zerror(zlogp, B_TRUE, "failed to initialize profile");
1071 		goto cleanup;
1072 	}
1073 
1074 	/* Get a handle to the brand info for this zone */
1075 	if ((zone_get_brand(zone_name, brand, sizeof (brand)) != Z_OK) ||
1076 	    (bh = brand_open(brand)) == NULL) {
1077 		zerror(zlogp, B_FALSE, "unable to determine zone brand");
1078 		goto cleanup;
1079 	}
1080 
1081 	if (get_iptype(zlogp, &iptype) < 0) {
1082 		zerror(zlogp, B_TRUE, "unable to determine ip-type");
1083 		goto cleanup;
1084 	}
1085 	switch (iptype) {
1086 	case ZS_SHARED:
1087 		curr_iptype = "shared";
1088 		break;
1089 	case ZS_EXCLUSIVE:
1090 		curr_iptype = "exclusive";
1091 		break;
1092 	}
1093 
1094 	if (brand_platform_iter_devices(bh, zone_name,
1095 	    mount_one_dev_device_cb, prof, curr_iptype) != 0) {
1096 		zerror(zlogp, B_TRUE, "failed to add standard device");
1097 		goto cleanup;
1098 	}
1099 
1100 	if (brand_platform_iter_link(bh,
1101 	    mount_one_dev_symlink_cb, prof) != 0) {
1102 		zerror(zlogp, B_TRUE, "failed to add standard symlink");
1103 		goto cleanup;
1104 	}
1105 
1106 	/* Add user-specified devices and directories */
1107 	if ((handle = zonecfg_init_handle()) == NULL) {
1108 		zerror(zlogp, B_FALSE, "can't initialize zone handle");
1109 		goto cleanup;
1110 	}
1111 	if (err = zonecfg_get_handle(zone_name, handle)) {
1112 		zerror(zlogp, B_FALSE, "can't get handle for zone "
1113 		    "%s: %s", zone_name, zonecfg_strerror(err));
1114 		goto cleanup;
1115 	}
1116 	if (err = zonecfg_setdevent(handle)) {
1117 		zerror(zlogp, B_FALSE, "%s: %s", zone_name,
1118 		    zonecfg_strerror(err));
1119 		goto cleanup;
1120 	}
1121 	while (zonecfg_getdevent(handle, &ztab) == Z_OK) {
1122 		if (di_prof_add_dev(prof, ztab.zone_dev_match)) {
1123 			zerror(zlogp, B_TRUE, "failed to add "
1124 			    "user-specified device");
1125 			goto cleanup;
1126 		}
1127 	}
1128 	(void) zonecfg_enddevent(handle);
1129 
1130 	/* Send profile to kernel */
1131 	if (di_prof_commit(prof)) {
1132 		zerror(zlogp, B_TRUE, "failed to commit profile");
1133 		goto cleanup;
1134 	}
1135 
1136 	retval = 0;
1137 
1138 cleanup:
1139 	if (bh != NULL)
1140 		brand_close(bh);
1141 	if (handle != NULL)
1142 		zonecfg_fini_handle(handle);
1143 	if (prof)
1144 		di_prof_fini(prof);
1145 	return (retval);
1146 }
1147 
1148 static int
1149 mount_one(zlog_t *zlogp, struct zone_fstab *fsptr, const char *rootpath)
1150 {
1151 	char path[MAXPATHLEN];
1152 	char specpath[MAXPATHLEN];
1153 	char optstr[MAX_MNTOPT_STR];
1154 	zone_fsopt_t *optptr;
1155 	int rv;
1156 
1157 	if ((rv = valid_mount_path(zlogp, rootpath, fsptr->zone_fs_special,
1158 	    fsptr->zone_fs_dir, fsptr->zone_fs_type)) < 0) {
1159 		zerror(zlogp, B_FALSE, "%s%s is not a valid mount point",
1160 		    rootpath, fsptr->zone_fs_dir);
1161 		return (-1);
1162 	} else if (rv > 0) {
1163 		/* The mount point path doesn't exist, create it now. */
1164 		if (make_one_dir(zlogp, rootpath, fsptr->zone_fs_dir,
1165 		    DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
1166 		    DEFAULT_DIR_GROUP) != 0) {
1167 			zerror(zlogp, B_FALSE, "failed to create mount point");
1168 			return (-1);
1169 		}
1170 
1171 		/*
1172 		 * Now this might seem weird, but we need to invoke
1173 		 * valid_mount_path() again.  Why?  Because it checks
1174 		 * to make sure that the mount point path is canonical,
1175 		 * which it can only do if the path exists, so now that
1176 		 * we've created the path we have to verify it again.
1177 		 */
1178 		if ((rv = valid_mount_path(zlogp, rootpath,
1179 		    fsptr->zone_fs_special, fsptr->zone_fs_dir,
1180 		    fsptr->zone_fs_type)) < 0) {
1181 			zerror(zlogp, B_FALSE,
1182 			    "%s%s is not a valid mount point",
1183 			    rootpath, fsptr->zone_fs_dir);
1184 			return (-1);
1185 		}
1186 	}
1187 
1188 	(void) snprintf(path, sizeof (path), "%s%s", rootpath,
1189 	    fsptr->zone_fs_dir);
1190 
1191 	if (strlen(fsptr->zone_fs_special) == 0) {
1192 		/*
1193 		 * A zero-length special is how we distinguish IPDs from
1194 		 * general-purpose FSs.  Make sure it mounts from a place that
1195 		 * can be seen via the alternate zone's root.
1196 		 */
1197 		if (snprintf(specpath, sizeof (specpath), "%s%s",
1198 		    zonecfg_get_root(), fsptr->zone_fs_dir) >=
1199 		    sizeof (specpath)) {
1200 			zerror(zlogp, B_FALSE, "cannot mount %s: path too "
1201 			    "long in alternate root", fsptr->zone_fs_dir);
1202 			return (-1);
1203 		}
1204 		if (zonecfg_in_alt_root())
1205 			resolve_lofs(zlogp, specpath, sizeof (specpath));
1206 		if (domount(zlogp, MNTTYPE_LOFS, IPD_DEFAULT_OPTS,
1207 		    specpath, path) != 0) {
1208 			zerror(zlogp, B_TRUE, "failed to loopback mount %s",
1209 			    specpath);
1210 			return (-1);
1211 		}
1212 		return (0);
1213 	}
1214 
1215 	/*
1216 	 * In general the strategy here is to do just as much verification as
1217 	 * necessary to avoid crashing or otherwise doing something bad; if the
1218 	 * administrator initiated the operation via zoneadm(1m), he'll get
1219 	 * auto-verification which will let him know what's wrong.  If he
1220 	 * modifies the zone configuration of a running zone and doesn't attempt
1221 	 * to verify that it's OK we won't crash but won't bother trying to be
1222 	 * too helpful either.  zoneadm verify is only a couple keystrokes away.
1223 	 */
1224 	if (!zonecfg_valid_fs_type(fsptr->zone_fs_type)) {
1225 		zerror(zlogp, B_FALSE, "cannot mount %s on %s: "
1226 		    "invalid file-system type %s", fsptr->zone_fs_special,
1227 		    fsptr->zone_fs_dir, fsptr->zone_fs_type);
1228 		return (-1);
1229 	}
1230 
1231 	/*
1232 	 * If we're looking at an alternate root environment, then construct
1233 	 * read-only loopback mounts as necessary.  Note that any special
1234 	 * paths for lofs zone mounts in an alternate root must have
1235 	 * already been pre-pended with any alternate root path by the
1236 	 * time we get here.
1237 	 */
1238 	if (zonecfg_in_alt_root()) {
1239 		struct stat64 st;
1240 
1241 		if (stat64(fsptr->zone_fs_special, &st) != -1 &&
1242 		    S_ISBLK(st.st_mode)) {
1243 			/*
1244 			 * If we're going to mount a block device we need
1245 			 * to check if that device is already mounted
1246 			 * somewhere else, and if so, do a lofs mount
1247 			 * of the device instead of a direct mount
1248 			 */
1249 			if (check_lofs_needed(zlogp, fsptr) == -1)
1250 				return (-1);
1251 		} else if (strcmp(fsptr->zone_fs_type, MNTTYPE_LOFS) == 0) {
1252 			/*
1253 			 * For lofs mounts, the special node is inside the
1254 			 * alternate root.  We need lofs resolution for
1255 			 * this case in order to get at the underlying
1256 			 * read-write path.
1257 			 */
1258 			resolve_lofs(zlogp, fsptr->zone_fs_special,
1259 			    sizeof (fsptr->zone_fs_special));
1260 		}
1261 	}
1262 
1263 	/*
1264 	 * Run 'fsck -m' if there's a device to fsck.
1265 	 */
1266 	if (fsptr->zone_fs_raw[0] != '\0' &&
1267 	    dofsck(zlogp, fsptr->zone_fs_type, fsptr->zone_fs_raw) != 0)
1268 		return (-1);
1269 
1270 	/*
1271 	 * Build up mount option string.
1272 	 */
1273 	optstr[0] = '\0';
1274 	if (fsptr->zone_fs_options != NULL) {
1275 		(void) strlcpy(optstr, fsptr->zone_fs_options->zone_fsopt_opt,
1276 		    sizeof (optstr));
1277 		for (optptr = fsptr->zone_fs_options->zone_fsopt_next;
1278 		    optptr != NULL; optptr = optptr->zone_fsopt_next) {
1279 			(void) strlcat(optstr, ",", sizeof (optstr));
1280 			(void) strlcat(optstr, optptr->zone_fsopt_opt,
1281 			    sizeof (optstr));
1282 		}
1283 	}
1284 
1285 	if ((rv = domount(zlogp, fsptr->zone_fs_type, optstr,
1286 	    fsptr->zone_fs_special, path)) != 0)
1287 		return (rv);
1288 
1289 	/*
1290 	 * The mount succeeded.  If this was not a mount of /dev then
1291 	 * we're done.
1292 	 */
1293 	if (strcmp(fsptr->zone_fs_type, MNTTYPE_DEV) != 0)
1294 		return (0);
1295 
1296 	/*
1297 	 * We just mounted an instance of a /dev filesystem, so now we
1298 	 * need to configure it.
1299 	 */
1300 	return (mount_one_dev(zlogp, path));
1301 }
1302 
1303 static void
1304 free_fs_data(struct zone_fstab *fsarray, uint_t nelem)
1305 {
1306 	uint_t i;
1307 
1308 	if (fsarray == NULL)
1309 		return;
1310 	for (i = 0; i < nelem; i++)
1311 		zonecfg_free_fs_option_list(fsarray[i].zone_fs_options);
1312 	free(fsarray);
1313 }
1314 
1315 /*
1316  * This function initiates the creation of a small Solaris Environment for
1317  * scratch zone. The Environment creation process is split up into two
1318  * functions(build_mounted_pre_var() and build_mounted_post_var()). It
1319  * is done this way because:
1320  * 	We need to have both /etc and /var in the root of the scratchzone.
1321  * 	We loopback mount zone's own /etc and /var into the root of the
1322  * 	scratch zone. Unlike /etc, /var can be a seperate filesystem. So we
1323  * 	need to delay the mount of /var till the zone's root gets populated.
1324  *	So mounting of localdirs[](/etc and /var) have been moved to the
1325  * 	build_mounted_post_var() which gets called only after the zone
1326  * 	specific filesystems are mounted.
1327  *
1328  * Note that the scratch zone we set up for updating the zone (Z_MNT_UPDATE)
1329  * does not loopback mount the zone's own /etc and /var into the root of the
1330  * scratch zone.
1331  */
1332 static boolean_t
1333 build_mounted_pre_var(zlog_t *zlogp, char *rootpath,
1334     size_t rootlen, const char *zonepath, char *luroot, size_t lurootlen)
1335 {
1336 	char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1337 	const char **cpp;
1338 	static const char *mkdirs[] = {
1339 		"/system", "/system/contract", "/system/object", "/proc",
1340 		"/dev", "/tmp", "/a", NULL
1341 	};
1342 	char *altstr;
1343 	FILE *fp;
1344 	uuid_t uuid;
1345 
1346 	assert(zone_isnative || zone_iscluster);
1347 
1348 	resolve_lofs(zlogp, rootpath, rootlen);
1349 	(void) snprintf(luroot, lurootlen, "%s/lu", zonepath);
1350 	resolve_lofs(zlogp, luroot, lurootlen);
1351 	(void) snprintf(tmp, sizeof (tmp), "%s/bin", luroot);
1352 	(void) symlink("./usr/bin", tmp);
1353 
1354 	/*
1355 	 * These are mostly special mount points; not handled here.  (See
1356 	 * zone_mount_early.)
1357 	 */
1358 	for (cpp = mkdirs; *cpp != NULL; cpp++) {
1359 		(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1360 		if (mkdir(tmp, 0755) != 0) {
1361 			zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1362 			return (B_FALSE);
1363 		}
1364 	}
1365 	/*
1366 	 * This is here to support lucopy.  If there's an instance of this same
1367 	 * zone on the current running system, then we mount its root up as
1368 	 * read-only inside the scratch zone.
1369 	 */
1370 	(void) zonecfg_get_uuid(zone_name, uuid);
1371 	altstr = strdup(zonecfg_get_root());
1372 	if (altstr == NULL) {
1373 		zerror(zlogp, B_TRUE, "memory allocation failed");
1374 		return (B_FALSE);
1375 	}
1376 	zonecfg_set_root("");
1377 	(void) strlcpy(tmp, zone_name, sizeof (tmp));
1378 	(void) zonecfg_get_name_by_uuid(uuid, tmp, sizeof (tmp));
1379 	if (zone_get_rootpath(tmp, fromdir, sizeof (fromdir)) == Z_OK &&
1380 	    strcmp(fromdir, rootpath) != 0) {
1381 		(void) snprintf(tmp, sizeof (tmp), "%s/b", luroot);
1382 		if (mkdir(tmp, 0755) != 0) {
1383 			zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1384 			return (B_FALSE);
1385 		}
1386 		if (domount(zlogp, MNTTYPE_LOFS, IPD_DEFAULT_OPTS, fromdir,
1387 		    tmp) != 0) {
1388 			zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1389 			    fromdir);
1390 			return (B_FALSE);
1391 		}
1392 	}
1393 	zonecfg_set_root(altstr);
1394 	free(altstr);
1395 
1396 	if ((fp = zonecfg_open_scratch(luroot, B_TRUE)) == NULL) {
1397 		zerror(zlogp, B_TRUE, "cannot open zone mapfile");
1398 		return (B_FALSE);
1399 	}
1400 	(void) ftruncate(fileno(fp), 0);
1401 	if (zonecfg_add_scratch(fp, zone_name, kernzone, "/") == -1) {
1402 		zerror(zlogp, B_TRUE, "cannot add zone mapfile entry");
1403 	}
1404 	zonecfg_close_scratch(fp);
1405 	(void) snprintf(tmp, sizeof (tmp), "%s/a", luroot);
1406 	if (domount(zlogp, MNTTYPE_LOFS, "", rootpath, tmp) != 0)
1407 		return (B_FALSE);
1408 	(void) strlcpy(rootpath, tmp, rootlen);
1409 	return (B_TRUE);
1410 }
1411 
1412 
1413 static boolean_t
1414 build_mounted_post_var(zlog_t *zlogp, zone_mnt_t mount_cmd, char *rootpath,
1415     const char *luroot)
1416 {
1417 	char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1418 	const char **cpp;
1419 	const char **loopdirs;
1420 	const char **tmpdirs;
1421 	static const char *localdirs[] = {
1422 		"/etc", "/var", NULL
1423 	};
1424 	static const char *scr_loopdirs[] = {
1425 		"/etc/lib", "/etc/fs", "/lib", "/sbin", "/platform",
1426 		"/usr", NULL
1427 	};
1428 	static const char *upd_loopdirs[] = {
1429 		"/etc", "/kernel", "/lib", "/opt", "/platform", "/sbin",
1430 		"/usr", "/var", NULL
1431 	};
1432 	static const char *scr_tmpdirs[] = {
1433 		"/tmp", "/var/run", NULL
1434 	};
1435 	static const char *upd_tmpdirs[] = {
1436 		"/tmp", "/var/run", "/var/tmp", NULL
1437 	};
1438 	struct stat st;
1439 
1440 	if (mount_cmd == Z_MNT_SCRATCH) {
1441 		/*
1442 		 * These are mounted read-write from the zone undergoing
1443 		 * upgrade.  We must be careful not to 'leak' things from the
1444 		 * main system into the zone, and this accomplishes that goal.
1445 		 */
1446 		for (cpp = localdirs; *cpp != NULL; cpp++) {
1447 			(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot,
1448 			    *cpp);
1449 			(void) snprintf(fromdir, sizeof (fromdir), "%s%s",
1450 			    rootpath, *cpp);
1451 			if (mkdir(tmp, 0755) != 0) {
1452 				zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1453 				return (B_FALSE);
1454 			}
1455 			if (domount(zlogp, MNTTYPE_LOFS, "", fromdir, tmp)
1456 			    != 0) {
1457 				zerror(zlogp, B_TRUE, "cannot mount %s on %s",
1458 				    tmp, *cpp);
1459 				return (B_FALSE);
1460 			}
1461 		}
1462 	}
1463 
1464 	if (mount_cmd == Z_MNT_UPDATE)
1465 		loopdirs = upd_loopdirs;
1466 	else
1467 		loopdirs = scr_loopdirs;
1468 
1469 	/*
1470 	 * These are things mounted read-only from the running system because
1471 	 * they contain binaries that must match system.
1472 	 */
1473 	for (cpp = loopdirs; *cpp != NULL; cpp++) {
1474 		(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1475 		if (mkdir(tmp, 0755) != 0) {
1476 			if (errno != EEXIST) {
1477 				zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1478 				return (B_FALSE);
1479 			}
1480 			if (lstat(tmp, &st) != 0) {
1481 				zerror(zlogp, B_TRUE, "cannot stat %s", tmp);
1482 				return (B_FALSE);
1483 			}
1484 			/*
1485 			 * Ignore any non-directories encountered.  These are
1486 			 * things that have been converted into symlinks
1487 			 * (/etc/fs and /etc/lib) and no longer need a lofs
1488 			 * fixup.
1489 			 */
1490 			if (!S_ISDIR(st.st_mode))
1491 				continue;
1492 		}
1493 		if (domount(zlogp, MNTTYPE_LOFS, IPD_DEFAULT_OPTS, *cpp,
1494 		    tmp) != 0) {
1495 			zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1496 			    *cpp);
1497 			return (B_FALSE);
1498 		}
1499 	}
1500 
1501 	if (mount_cmd == Z_MNT_UPDATE)
1502 		tmpdirs = upd_tmpdirs;
1503 	else
1504 		tmpdirs = scr_tmpdirs;
1505 
1506 	/*
1507 	 * These are things with tmpfs mounted inside.
1508 	 */
1509 	for (cpp = tmpdirs; *cpp != NULL; cpp++) {
1510 		(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1511 		if (mount_cmd == Z_MNT_SCRATCH && mkdir(tmp, 0755) != 0 &&
1512 		    errno != EEXIST) {
1513 			zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1514 			return (B_FALSE);
1515 		}
1516 
1517 		/*
1518 		 * We could set the mode for /tmp when we do the mkdir but
1519 		 * since that can be modified by the umask we will just set
1520 		 * the correct mode for /tmp now.
1521 		 */
1522 		if (strcmp(*cpp, "/tmp") == 0 && chmod(tmp, 01777) != 0) {
1523 			zerror(zlogp, B_TRUE, "cannot chmod %s", tmp);
1524 			return (B_FALSE);
1525 		}
1526 
1527 		if (domount(zlogp, MNTTYPE_TMPFS, "", "swap", tmp) != 0) {
1528 			zerror(zlogp, B_TRUE, "cannot mount swap on %s", *cpp);
1529 			return (B_FALSE);
1530 		}
1531 	}
1532 	return (B_TRUE);
1533 }
1534 
1535 typedef struct plat_gmount_cb_data {
1536 	zlog_t			*pgcd_zlogp;
1537 	struct zone_fstab	**pgcd_fs_tab;
1538 	int			*pgcd_num_fs;
1539 } plat_gmount_cb_data_t;
1540 
1541 /*
1542  * plat_gmount_cb() is a callback function invoked by libbrand to iterate
1543  * through all global brand platform mounts.
1544  */
1545 int
1546 plat_gmount_cb(void *data, const char *spec, const char *dir,
1547     const char *fstype, const char *opt)
1548 {
1549 	plat_gmount_cb_data_t	*cp = data;
1550 	zlog_t			*zlogp = cp->pgcd_zlogp;
1551 	struct zone_fstab	*fs_ptr = *cp->pgcd_fs_tab;
1552 	int			num_fs = *cp->pgcd_num_fs;
1553 	struct zone_fstab	*fsp, *tmp_ptr;
1554 
1555 	num_fs++;
1556 	if ((tmp_ptr = realloc(fs_ptr, num_fs * sizeof (*tmp_ptr))) == NULL) {
1557 		zerror(zlogp, B_TRUE, "memory allocation failed");
1558 		return (-1);
1559 	}
1560 
1561 	fs_ptr = tmp_ptr;
1562 	fsp = &fs_ptr[num_fs - 1];
1563 
1564 	/* update the callback struct passed in */
1565 	*cp->pgcd_fs_tab = fs_ptr;
1566 	*cp->pgcd_num_fs = num_fs;
1567 
1568 	fsp->zone_fs_raw[0] = '\0';
1569 	(void) strlcpy(fsp->zone_fs_special, spec,
1570 	    sizeof (fsp->zone_fs_special));
1571 	(void) strlcpy(fsp->zone_fs_dir, dir, sizeof (fsp->zone_fs_dir));
1572 	(void) strlcpy(fsp->zone_fs_type, fstype, sizeof (fsp->zone_fs_type));
1573 	fsp->zone_fs_options = NULL;
1574 	if ((opt != NULL) &&
1575 	    (zonecfg_add_fs_option(fsp, (char *)opt) != Z_OK)) {
1576 		zerror(zlogp, B_FALSE, "error adding property");
1577 		return (-1);
1578 	}
1579 
1580 	return (0);
1581 }
1582 
1583 static int
1584 mount_filesystems_ipdent(zone_dochandle_t handle, zlog_t *zlogp,
1585     struct zone_fstab **fs_tabp, int *num_fsp)
1586 {
1587 	struct zone_fstab *tmp_ptr, *fs_ptr, *fsp, fstab;
1588 	int num_fs;
1589 
1590 	num_fs = *num_fsp;
1591 	fs_ptr = *fs_tabp;
1592 
1593 	if (zonecfg_setipdent(handle) != Z_OK) {
1594 		zerror(zlogp, B_FALSE, "invalid configuration");
1595 		return (-1);
1596 	}
1597 	while (zonecfg_getipdent(handle, &fstab) == Z_OK) {
1598 		num_fs++;
1599 		if ((tmp_ptr = realloc(fs_ptr,
1600 		    num_fs * sizeof (*tmp_ptr))) == NULL) {
1601 			zerror(zlogp, B_TRUE, "memory allocation failed");
1602 			(void) zonecfg_endipdent(handle);
1603 			return (-1);
1604 		}
1605 
1606 		/* update the pointers passed in */
1607 		*fs_tabp = tmp_ptr;
1608 		*num_fsp = num_fs;
1609 
1610 		/*
1611 		 * IPDs logically only have a mount point; all other properties
1612 		 * are implied.
1613 		 */
1614 		fs_ptr = tmp_ptr;
1615 		fsp = &fs_ptr[num_fs - 1];
1616 		(void) strlcpy(fsp->zone_fs_dir,
1617 		    fstab.zone_fs_dir, sizeof (fsp->zone_fs_dir));
1618 		fsp->zone_fs_special[0] = '\0';
1619 		fsp->zone_fs_raw[0] = '\0';
1620 		fsp->zone_fs_type[0] = '\0';
1621 		fsp->zone_fs_options = NULL;
1622 	}
1623 	(void) zonecfg_endipdent(handle);
1624 	return (0);
1625 }
1626 
1627 static int
1628 mount_filesystems_fsent(zone_dochandle_t handle, zlog_t *zlogp,
1629     struct zone_fstab **fs_tabp, int *num_fsp, zone_mnt_t mount_cmd)
1630 {
1631 	struct zone_fstab *tmp_ptr, *fs_ptr, *fsp, fstab;
1632 	int num_fs;
1633 
1634 	num_fs = *num_fsp;
1635 	fs_ptr = *fs_tabp;
1636 
1637 	if (zonecfg_setfsent(handle) != Z_OK) {
1638 		zerror(zlogp, B_FALSE, "invalid configuration");
1639 		return (-1);
1640 	}
1641 	while (zonecfg_getfsent(handle, &fstab) == Z_OK) {
1642 		/*
1643 		 * ZFS filesystems will not be accessible under an alternate
1644 		 * root, since the pool will not be known.  Ignore them in this
1645 		 * case.
1646 		 */
1647 		if (ALT_MOUNT(mount_cmd) &&
1648 		    strcmp(fstab.zone_fs_type, MNTTYPE_ZFS) == 0)
1649 			continue;
1650 
1651 		num_fs++;
1652 		if ((tmp_ptr = realloc(fs_ptr,
1653 		    num_fs * sizeof (*tmp_ptr))) == NULL) {
1654 			zerror(zlogp, B_TRUE, "memory allocation failed");
1655 			(void) zonecfg_endfsent(handle);
1656 			return (-1);
1657 		}
1658 		/* update the pointers passed in */
1659 		*fs_tabp = tmp_ptr;
1660 		*num_fsp = num_fs;
1661 
1662 		fs_ptr = tmp_ptr;
1663 		fsp = &fs_ptr[num_fs - 1];
1664 		(void) strlcpy(fsp->zone_fs_dir,
1665 		    fstab.zone_fs_dir, sizeof (fsp->zone_fs_dir));
1666 		(void) strlcpy(fsp->zone_fs_raw, fstab.zone_fs_raw,
1667 		    sizeof (fsp->zone_fs_raw));
1668 		(void) strlcpy(fsp->zone_fs_type, fstab.zone_fs_type,
1669 		    sizeof (fsp->zone_fs_type));
1670 		fsp->zone_fs_options = fstab.zone_fs_options;
1671 
1672 		/*
1673 		 * For all lofs mounts, make sure that the 'special'
1674 		 * entry points inside the alternate root.  The
1675 		 * source path for a lofs mount in a given zone needs
1676 		 * to be relative to the root of the boot environment
1677 		 * that contains the zone.  Note that we don't do this
1678 		 * for non-lofs mounts since they will have a device
1679 		 * as a backing store and device paths must always be
1680 		 * specified relative to the current boot environment.
1681 		 */
1682 		fsp->zone_fs_special[0] = '\0';
1683 		if (strcmp(fsp->zone_fs_type, MNTTYPE_LOFS) == 0) {
1684 			(void) strlcat(fsp->zone_fs_special, zonecfg_get_root(),
1685 			    sizeof (fsp->zone_fs_special));
1686 		}
1687 		(void) strlcat(fsp->zone_fs_special, fstab.zone_fs_special,
1688 		    sizeof (fsp->zone_fs_special));
1689 	}
1690 	(void) zonecfg_endfsent(handle);
1691 	return (0);
1692 }
1693 
1694 static int
1695 mount_filesystems(zlog_t *zlogp, zone_mnt_t mount_cmd)
1696 {
1697 	char rootpath[MAXPATHLEN];
1698 	char zonepath[MAXPATHLEN];
1699 	char brand[MAXNAMELEN];
1700 	char luroot[MAXPATHLEN];
1701 	int i, num_fs = 0;
1702 	struct zone_fstab *fs_ptr = NULL;
1703 	zone_dochandle_t handle = NULL;
1704 	zone_state_t zstate;
1705 	brand_handle_t bh;
1706 	plat_gmount_cb_data_t cb;
1707 
1708 	if (zone_get_state(zone_name, &zstate) != Z_OK ||
1709 	    (zstate != ZONE_STATE_READY && zstate != ZONE_STATE_MOUNTED)) {
1710 		zerror(zlogp, B_FALSE,
1711 		    "zone must be in '%s' or '%s' state to mount file-systems",
1712 		    zone_state_str(ZONE_STATE_READY),
1713 		    zone_state_str(ZONE_STATE_MOUNTED));
1714 		goto bad;
1715 	}
1716 
1717 	if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
1718 		zerror(zlogp, B_TRUE, "unable to determine zone path");
1719 		goto bad;
1720 	}
1721 
1722 	if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
1723 		zerror(zlogp, B_TRUE, "unable to determine zone root");
1724 		goto bad;
1725 	}
1726 
1727 	if ((handle = zonecfg_init_handle()) == NULL) {
1728 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
1729 		goto bad;
1730 	}
1731 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK ||
1732 	    zonecfg_setfsent(handle) != Z_OK) {
1733 		zerror(zlogp, B_FALSE, "invalid configuration");
1734 		goto bad;
1735 	}
1736 
1737 	/* Get a handle to the brand info for this zone */
1738 	if ((zone_get_brand(zone_name, brand, sizeof (brand)) != Z_OK) ||
1739 	    (bh = brand_open(brand)) == NULL) {
1740 		zerror(zlogp, B_FALSE, "unable to determine zone brand");
1741 		zonecfg_fini_handle(handle);
1742 		return (-1);
1743 	}
1744 
1745 	/*
1746 	 * Get the list of global filesystems to mount from the brand
1747 	 * configuration.
1748 	 */
1749 	cb.pgcd_zlogp = zlogp;
1750 	cb.pgcd_fs_tab = &fs_ptr;
1751 	cb.pgcd_num_fs = &num_fs;
1752 	if (brand_platform_iter_gmounts(bh, zonepath,
1753 	    plat_gmount_cb, &cb) != 0) {
1754 		zerror(zlogp, B_FALSE, "unable to mount filesystems");
1755 		brand_close(bh);
1756 		zonecfg_fini_handle(handle);
1757 		return (-1);
1758 	}
1759 	brand_close(bh);
1760 
1761 	/*
1762 	 * Iterate through the rest of the filesystems, first the IPDs, then
1763 	 * the general FSs.  Sort them all, then mount them in sorted order.
1764 	 * This is to make sure the higher level directories (e.g., /usr)
1765 	 * get mounted before any beneath them (e.g., /usr/local).
1766 	 */
1767 	if (mount_filesystems_ipdent(handle, zlogp, &fs_ptr, &num_fs) != 0)
1768 		goto bad;
1769 
1770 	if (mount_filesystems_fsent(handle, zlogp, &fs_ptr, &num_fs,
1771 	    mount_cmd) != 0)
1772 		goto bad;
1773 
1774 	zonecfg_fini_handle(handle);
1775 	handle = NULL;
1776 
1777 	/*
1778 	 * Normally when we mount a zone all the zone filesystems
1779 	 * get mounted relative to rootpath, which is usually
1780 	 * <zonepath>/root.  But when mounting a zone for administration
1781 	 * purposes via the zone "mount" state, build_mounted_pre_var()
1782 	 * updates rootpath to be <zonepath>/lu/a so we'll mount all
1783 	 * the zones filesystems there instead.
1784 	 *
1785 	 * build_mounted_pre_var() and build_mounted_post_var() will
1786 	 * also do some extra work to create directories and lofs mount
1787 	 * a bunch of global zone file system paths into <zonepath>/lu.
1788 	 *
1789 	 * This allows us to be able to enter the zone (now rooted at
1790 	 * <zonepath>/lu) and run the upgrade/patch tools that are in the
1791 	 * global zone and have them upgrade the to-be-modified zone's
1792 	 * files mounted on /a.  (Which mirrors the existing standard
1793 	 * upgrade environment.)
1794 	 *
1795 	 * There is of course one catch.  When doing the upgrade
1796 	 * we need <zoneroot>/lu/dev to be the /dev filesystem
1797 	 * for the zone and we don't want to have any /dev filesystem
1798 	 * mounted at <zoneroot>/lu/a/dev.  Since /dev is specified
1799 	 * as a normal zone filesystem by default we'll try to mount
1800 	 * it at <zoneroot>/lu/a/dev, so we have to detect this
1801 	 * case and instead mount it at <zoneroot>/lu/dev.
1802 	 *
1803 	 * All this work is done in three phases:
1804 	 *   1) Create and populate lu directory (build_mounted_pre_var()).
1805 	 *   2) Mount the required filesystems as per the zone configuration.
1806 	 *   3) Set up the rest of the scratch zone environment
1807 	 *	(build_mounted_post_var()).
1808 	 */
1809 	if (ALT_MOUNT(mount_cmd) && !build_mounted_pre_var(zlogp,
1810 	    rootpath, sizeof (rootpath), zonepath, luroot, sizeof (luroot)))
1811 		goto bad;
1812 
1813 	qsort(fs_ptr, num_fs, sizeof (*fs_ptr), fs_compare);
1814 
1815 	for (i = 0; i < num_fs; i++) {
1816 		if (ALT_MOUNT(mount_cmd) &&
1817 		    strcmp(fs_ptr[i].zone_fs_dir, "/dev") == 0) {
1818 			size_t slen = strlen(rootpath) - 2;
1819 
1820 			/*
1821 			 * By default we'll try to mount /dev as /a/dev
1822 			 * but /dev is special and always goes at the top
1823 			 * so strip the trailing '/a' from the rootpath.
1824 			 */
1825 			assert(zone_isnative || zone_iscluster);
1826 			assert(strcmp(&rootpath[slen], "/a") == 0);
1827 			rootpath[slen] = '\0';
1828 			if (mount_one(zlogp, &fs_ptr[i], rootpath) != 0)
1829 				goto bad;
1830 			rootpath[slen] = '/';
1831 			continue;
1832 		}
1833 		if (mount_one(zlogp, &fs_ptr[i], rootpath) != 0)
1834 			goto bad;
1835 	}
1836 	if (ALT_MOUNT(mount_cmd) &&
1837 	    !build_mounted_post_var(zlogp, mount_cmd, rootpath, luroot))
1838 		goto bad;
1839 
1840 	/*
1841 	 * For Trusted Extensions cross-mount each lower level /export/home
1842 	 */
1843 	if (mount_cmd == Z_MNT_BOOT &&
1844 	    tsol_mounts(zlogp, zone_name, rootpath) != 0)
1845 		goto bad;
1846 
1847 	free_fs_data(fs_ptr, num_fs);
1848 
1849 	/*
1850 	 * Everything looks fine.
1851 	 */
1852 	return (0);
1853 
1854 bad:
1855 	if (handle != NULL)
1856 		zonecfg_fini_handle(handle);
1857 	free_fs_data(fs_ptr, num_fs);
1858 	return (-1);
1859 }
1860 
1861 /* caller makes sure neither parameter is NULL */
1862 static int
1863 addr2netmask(char *prefixstr, int maxprefixlen, uchar_t *maskstr)
1864 {
1865 	int prefixlen;
1866 
1867 	prefixlen = atoi(prefixstr);
1868 	if (prefixlen < 0 || prefixlen > maxprefixlen)
1869 		return (1);
1870 	while (prefixlen > 0) {
1871 		if (prefixlen >= 8) {
1872 			*maskstr++ = 0xFF;
1873 			prefixlen -= 8;
1874 			continue;
1875 		}
1876 		*maskstr |= 1 << (8 - prefixlen);
1877 		prefixlen--;
1878 	}
1879 	return (0);
1880 }
1881 
1882 /*
1883  * Tear down all interfaces belonging to the given zone.  This should
1884  * be called with the zone in a state other than "running", so that
1885  * interfaces can't be assigned to the zone after this returns.
1886  *
1887  * If anything goes wrong, log an error message and return an error.
1888  */
1889 static int
1890 unconfigure_shared_network_interfaces(zlog_t *zlogp, zoneid_t zone_id)
1891 {
1892 	struct lifnum lifn;
1893 	struct lifconf lifc;
1894 	struct lifreq *lifrp, lifrl;
1895 	int64_t lifc_flags = LIFC_NOXMIT | LIFC_ALLZONES;
1896 	int num_ifs, s, i, ret_code = 0;
1897 	uint_t bufsize;
1898 	char *buf = NULL;
1899 
1900 	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
1901 		zerror(zlogp, B_TRUE, "could not get socket");
1902 		ret_code = -1;
1903 		goto bad;
1904 	}
1905 	lifn.lifn_family = AF_UNSPEC;
1906 	lifn.lifn_flags = (int)lifc_flags;
1907 	if (ioctl(s, SIOCGLIFNUM, (char *)&lifn) < 0) {
1908 		zerror(zlogp, B_TRUE,
1909 		    "could not determine number of network interfaces");
1910 		ret_code = -1;
1911 		goto bad;
1912 	}
1913 	num_ifs = lifn.lifn_count;
1914 	bufsize = num_ifs * sizeof (struct lifreq);
1915 	if ((buf = malloc(bufsize)) == NULL) {
1916 		zerror(zlogp, B_TRUE, "memory allocation failed");
1917 		ret_code = -1;
1918 		goto bad;
1919 	}
1920 	lifc.lifc_family = AF_UNSPEC;
1921 	lifc.lifc_flags = (int)lifc_flags;
1922 	lifc.lifc_len = bufsize;
1923 	lifc.lifc_buf = buf;
1924 	if (ioctl(s, SIOCGLIFCONF, (char *)&lifc) < 0) {
1925 		zerror(zlogp, B_TRUE, "could not get configured network "
1926 		    "interfaces");
1927 		ret_code = -1;
1928 		goto bad;
1929 	}
1930 	lifrp = lifc.lifc_req;
1931 	for (i = lifc.lifc_len / sizeof (struct lifreq); i > 0; i--, lifrp++) {
1932 		(void) close(s);
1933 		if ((s = socket(lifrp->lifr_addr.ss_family, SOCK_DGRAM, 0)) <
1934 		    0) {
1935 			zerror(zlogp, B_TRUE, "%s: could not get socket",
1936 			    lifrl.lifr_name);
1937 			ret_code = -1;
1938 			continue;
1939 		}
1940 		(void) memset(&lifrl, 0, sizeof (lifrl));
1941 		(void) strncpy(lifrl.lifr_name, lifrp->lifr_name,
1942 		    sizeof (lifrl.lifr_name));
1943 		if (ioctl(s, SIOCGLIFZONE, (caddr_t)&lifrl) < 0) {
1944 			if (errno == ENXIO)
1945 				/*
1946 				 * Interface may have been removed by admin or
1947 				 * another zone halting.
1948 				 */
1949 				continue;
1950 			zerror(zlogp, B_TRUE,
1951 			    "%s: could not determine the zone to which this "
1952 			    "network interface is bound", lifrl.lifr_name);
1953 			ret_code = -1;
1954 			continue;
1955 		}
1956 		if (lifrl.lifr_zoneid == zone_id) {
1957 			if (ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifrl) < 0) {
1958 				zerror(zlogp, B_TRUE,
1959 				    "%s: could not remove network interface",
1960 				    lifrl.lifr_name);
1961 				ret_code = -1;
1962 				continue;
1963 			}
1964 		}
1965 	}
1966 bad:
1967 	if (s > 0)
1968 		(void) close(s);
1969 	if (buf)
1970 		free(buf);
1971 	return (ret_code);
1972 }
1973 
1974 static union	sockunion {
1975 	struct	sockaddr sa;
1976 	struct	sockaddr_in sin;
1977 	struct	sockaddr_dl sdl;
1978 	struct	sockaddr_in6 sin6;
1979 } so_dst, so_ifp;
1980 
1981 static struct {
1982 	struct	rt_msghdr hdr;
1983 	char	space[512];
1984 } rtmsg;
1985 
1986 static int
1987 salen(struct sockaddr *sa)
1988 {
1989 	switch (sa->sa_family) {
1990 	case AF_INET:
1991 		return (sizeof (struct sockaddr_in));
1992 	case AF_LINK:
1993 		return (sizeof (struct sockaddr_dl));
1994 	case AF_INET6:
1995 		return (sizeof (struct sockaddr_in6));
1996 	default:
1997 		return (sizeof (struct sockaddr));
1998 	}
1999 }
2000 
2001 #define	ROUNDUP_LONG(a) \
2002 	((a) > 0 ? (1 + (((a) - 1) | (sizeof (long) - 1))) : sizeof (long))
2003 
2004 /*
2005  * Look up which zone is using a given IP address.  The address in question
2006  * is expected to have been stuffed into the structure to which lifr points
2007  * via a previous SIOCGLIFADDR ioctl().
2008  *
2009  * This is done using black router socket magic.
2010  *
2011  * Return the name of the zone on success or NULL on failure.
2012  *
2013  * This is a lot of code for a simple task; a new ioctl request to take care
2014  * of this might be a useful RFE.
2015  */
2016 
2017 static char *
2018 who_is_using(zlog_t *zlogp, struct lifreq *lifr)
2019 {
2020 	static char answer[ZONENAME_MAX];
2021 	pid_t pid;
2022 	int s, rlen, l, i;
2023 	char *cp = rtmsg.space;
2024 	struct sockaddr_dl *ifp = NULL;
2025 	struct sockaddr *sa;
2026 	char save_if_name[LIFNAMSIZ];
2027 
2028 	answer[0] = '\0';
2029 
2030 	pid = getpid();
2031 	if ((s = socket(PF_ROUTE, SOCK_RAW, 0)) < 0) {
2032 		zerror(zlogp, B_TRUE, "could not get routing socket");
2033 		return (NULL);
2034 	}
2035 
2036 	if (lifr->lifr_addr.ss_family == AF_INET) {
2037 		struct sockaddr_in *sin4;
2038 
2039 		so_dst.sa.sa_family = AF_INET;
2040 		sin4 = (struct sockaddr_in *)&lifr->lifr_addr;
2041 		so_dst.sin.sin_addr = sin4->sin_addr;
2042 	} else {
2043 		struct sockaddr_in6 *sin6;
2044 
2045 		so_dst.sa.sa_family = AF_INET6;
2046 		sin6 = (struct sockaddr_in6 *)&lifr->lifr_addr;
2047 		so_dst.sin6.sin6_addr = sin6->sin6_addr;
2048 	}
2049 
2050 	so_ifp.sa.sa_family = AF_LINK;
2051 
2052 	(void) memset(&rtmsg, 0, sizeof (rtmsg));
2053 	rtmsg.hdr.rtm_type = RTM_GET;
2054 	rtmsg.hdr.rtm_flags = RTF_UP | RTF_HOST;
2055 	rtmsg.hdr.rtm_version = RTM_VERSION;
2056 	rtmsg.hdr.rtm_seq = ++rts_seqno;
2057 	rtmsg.hdr.rtm_addrs = RTA_IFP | RTA_DST;
2058 
2059 	l = ROUNDUP_LONG(salen(&so_dst.sa));
2060 	(void) memmove(cp, &(so_dst), l);
2061 	cp += l;
2062 	l = ROUNDUP_LONG(salen(&so_ifp.sa));
2063 	(void) memmove(cp, &(so_ifp), l);
2064 	cp += l;
2065 
2066 	rtmsg.hdr.rtm_msglen = l = cp - (char *)&rtmsg;
2067 
2068 	if ((rlen = write(s, &rtmsg, l)) < 0) {
2069 		zerror(zlogp, B_TRUE, "writing to routing socket");
2070 		return (NULL);
2071 	} else if (rlen < (int)rtmsg.hdr.rtm_msglen) {
2072 		zerror(zlogp, B_TRUE,
2073 		    "write to routing socket got only %d for len\n", rlen);
2074 		return (NULL);
2075 	}
2076 	do {
2077 		l = read(s, &rtmsg, sizeof (rtmsg));
2078 	} while (l > 0 && (rtmsg.hdr.rtm_seq != rts_seqno ||
2079 	    rtmsg.hdr.rtm_pid != pid));
2080 	if (l < 0) {
2081 		zerror(zlogp, B_TRUE, "reading from routing socket");
2082 		return (NULL);
2083 	}
2084 
2085 	if (rtmsg.hdr.rtm_version != RTM_VERSION) {
2086 		zerror(zlogp, B_FALSE,
2087 		    "routing message version %d not understood",
2088 		    rtmsg.hdr.rtm_version);
2089 		return (NULL);
2090 	}
2091 	if (rtmsg.hdr.rtm_msglen != (ushort_t)l) {
2092 		zerror(zlogp, B_FALSE, "message length mismatch, "
2093 		    "expected %d bytes, returned %d bytes",
2094 		    rtmsg.hdr.rtm_msglen, l);
2095 		return (NULL);
2096 	}
2097 	if (rtmsg.hdr.rtm_errno != 0)  {
2098 		errno = rtmsg.hdr.rtm_errno;
2099 		zerror(zlogp, B_TRUE, "RTM_GET routing socket message");
2100 		return (NULL);
2101 	}
2102 	if ((rtmsg.hdr.rtm_addrs & RTA_IFP) == 0) {
2103 		zerror(zlogp, B_FALSE, "network interface not found");
2104 		return (NULL);
2105 	}
2106 	cp = ((char *)(&rtmsg.hdr + 1));
2107 	for (i = 1; i != 0; i <<= 1) {
2108 		/* LINTED E_BAD_PTR_CAST_ALIGN */
2109 		sa = (struct sockaddr *)cp;
2110 		if (i != RTA_IFP) {
2111 			if ((i & rtmsg.hdr.rtm_addrs) != 0)
2112 				cp += ROUNDUP_LONG(salen(sa));
2113 			continue;
2114 		}
2115 		if (sa->sa_family == AF_LINK &&
2116 		    ((struct sockaddr_dl *)sa)->sdl_nlen != 0)
2117 			ifp = (struct sockaddr_dl *)sa;
2118 		break;
2119 	}
2120 	if (ifp == NULL) {
2121 		zerror(zlogp, B_FALSE, "network interface could not be "
2122 		    "determined");
2123 		return (NULL);
2124 	}
2125 
2126 	/*
2127 	 * We need to set the I/F name to what we got above, then do the
2128 	 * appropriate ioctl to get its zone name.  But lifr->lifr_name is
2129 	 * used by the calling function to do a REMOVEIF, so if we leave the
2130 	 * "good" zone's I/F name in place, *that* I/F will be removed instead
2131 	 * of the bad one.  So we save the old (bad) I/F name before over-
2132 	 * writing it and doing the ioctl, then restore it after the ioctl.
2133 	 */
2134 	(void) strlcpy(save_if_name, lifr->lifr_name, sizeof (save_if_name));
2135 	(void) strncpy(lifr->lifr_name, ifp->sdl_data, ifp->sdl_nlen);
2136 	lifr->lifr_name[ifp->sdl_nlen] = '\0';
2137 	i = ioctl(s, SIOCGLIFZONE, lifr);
2138 	(void) strlcpy(lifr->lifr_name, save_if_name, sizeof (save_if_name));
2139 	if (i < 0) {
2140 		zerror(zlogp, B_TRUE,
2141 		    "%s: could not determine the zone network interface "
2142 		    "belongs to", lifr->lifr_name);
2143 		return (NULL);
2144 	}
2145 	if (getzonenamebyid(lifr->lifr_zoneid, answer, sizeof (answer)) < 0)
2146 		(void) snprintf(answer, sizeof (answer), "%d",
2147 		    lifr->lifr_zoneid);
2148 
2149 	if (strlen(answer) > 0)
2150 		return (answer);
2151 	return (NULL);
2152 }
2153 
2154 typedef struct mcast_rtmsg_s {
2155 	struct rt_msghdr	m_rtm;
2156 	union {
2157 		struct {
2158 			struct sockaddr_in	m_dst;
2159 			struct sockaddr_in	m_gw;
2160 			struct sockaddr_in	m_netmask;
2161 		} m_v4;
2162 		struct {
2163 			struct sockaddr_in6	m_dst;
2164 			struct sockaddr_in6	m_gw;
2165 			struct sockaddr_in6	m_netmask;
2166 		} m_v6;
2167 	} m_u;
2168 } mcast_rtmsg_t;
2169 #define	m_dst4		m_u.m_v4.m_dst
2170 #define	m_dst6		m_u.m_v6.m_dst
2171 #define	m_gw4		m_u.m_v4.m_gw
2172 #define	m_gw6		m_u.m_v6.m_gw
2173 #define	m_netmask4	m_u.m_v4.m_netmask
2174 #define	m_netmask6	m_u.m_v6.m_netmask
2175 
2176 /*
2177  * Configures a single interface: a new virtual interface is added, based on
2178  * the physical interface nwiftabptr->zone_nwif_physical, with the address
2179  * specified in nwiftabptr->zone_nwif_address, for zone zone_id.  Note that
2180  * the "address" can be an IPv6 address (with a /prefixlength required), an
2181  * IPv4 address (with a /prefixlength optional), or a name; for the latter,
2182  * an IPv4 name-to-address resolution will be attempted.
2183  *
2184  * A default interface route for multicast is created on the first IPv4 and
2185  * IPv6 interfaces (that have the IFF_MULTICAST flag set), respectively.
2186  * This should really be done in the init scripts if we ever allow zones to
2187  * modify the routing tables.
2188  *
2189  * If anything goes wrong, we log an detailed error message, attempt to tear
2190  * down whatever we set up and return an error.
2191  */
2192 static int
2193 configure_one_interface(zlog_t *zlogp, zoneid_t zone_id,
2194     struct zone_nwiftab *nwiftabptr, boolean_t *mcast_rt_v4_setp,
2195     boolean_t *mcast_rt_v6_setp)
2196 {
2197 	struct lifreq lifr;
2198 	struct sockaddr_in netmask4;
2199 	struct sockaddr_in6 netmask6;
2200 	struct in_addr in4;
2201 	struct in6_addr in6;
2202 	sa_family_t af;
2203 	char *slashp = strchr(nwiftabptr->zone_nwif_address, '/');
2204 	mcast_rtmsg_t mcast_rtmsg;
2205 	int s;
2206 	int rs;
2207 	int rlen;
2208 	boolean_t got_netmask = B_FALSE;
2209 	char addrstr4[INET_ADDRSTRLEN];
2210 	int res;
2211 
2212 	res = zonecfg_valid_net_address(nwiftabptr->zone_nwif_address, &lifr);
2213 	if (res != Z_OK) {
2214 		zerror(zlogp, B_FALSE, "%s: %s", zonecfg_strerror(res),
2215 		    nwiftabptr->zone_nwif_address);
2216 		return (-1);
2217 	}
2218 	af = lifr.lifr_addr.ss_family;
2219 	if (af == AF_INET)
2220 		in4 = ((struct sockaddr_in *)(&lifr.lifr_addr))->sin_addr;
2221 	else
2222 		in6 = ((struct sockaddr_in6 *)(&lifr.lifr_addr))->sin6_addr;
2223 
2224 	if ((s = socket(af, SOCK_DGRAM, 0)) < 0) {
2225 		zerror(zlogp, B_TRUE, "could not get socket");
2226 		return (-1);
2227 	}
2228 
2229 	(void) strlcpy(lifr.lifr_name, nwiftabptr->zone_nwif_physical,
2230 	    sizeof (lifr.lifr_name));
2231 	if (ioctl(s, SIOCLIFADDIF, (caddr_t)&lifr) < 0) {
2232 		/*
2233 		 * Here, we know that the interface can't be brought up.
2234 		 * A similar warning message was already printed out to
2235 		 * the console by zoneadm(1M) so instead we log the
2236 		 * message to syslog and continue.
2237 		 */
2238 		zerror(&logsys, B_TRUE, "WARNING: skipping network interface "
2239 		    "'%s' which may not be present/plumbed in the "
2240 		    "global zone.", lifr.lifr_name);
2241 		(void) close(s);
2242 		return (Z_OK);
2243 	}
2244 
2245 	if (ioctl(s, SIOCSLIFADDR, (caddr_t)&lifr) < 0) {
2246 		zerror(zlogp, B_TRUE,
2247 		    "%s: could not set IP address to %s",
2248 		    lifr.lifr_name, nwiftabptr->zone_nwif_address);
2249 		goto bad;
2250 	}
2251 
2252 	/* Preserve literal IPv4 address for later potential printing. */
2253 	if (af == AF_INET)
2254 		(void) inet_ntop(AF_INET, &in4, addrstr4, INET_ADDRSTRLEN);
2255 
2256 	lifr.lifr_zoneid = zone_id;
2257 	if (ioctl(s, SIOCSLIFZONE, (caddr_t)&lifr) < 0) {
2258 		zerror(zlogp, B_TRUE, "%s: could not place network interface "
2259 		    "into zone", lifr.lifr_name);
2260 		goto bad;
2261 	}
2262 
2263 	if (strcmp(nwiftabptr->zone_nwif_physical, "lo0") == 0) {
2264 		got_netmask = B_TRUE;	/* default setting will be correct */
2265 	} else {
2266 		if (af == AF_INET) {
2267 			/*
2268 			 * The IPv4 netmask can be determined either
2269 			 * directly if a prefix length was supplied with
2270 			 * the address or via the netmasks database.  Not
2271 			 * being able to determine it is a common failure,
2272 			 * but it often is not fatal to operation of the
2273 			 * interface.  In that case, a warning will be
2274 			 * printed after the rest of the interface's
2275 			 * parameters have been configured.
2276 			 */
2277 			(void) memset(&netmask4, 0, sizeof (netmask4));
2278 			if (slashp != NULL) {
2279 				if (addr2netmask(slashp + 1, V4_ADDR_LEN,
2280 				    (uchar_t *)&netmask4.sin_addr) != 0) {
2281 					*slashp = '/';
2282 					zerror(zlogp, B_FALSE,
2283 					    "%s: invalid prefix length in %s",
2284 					    lifr.lifr_name,
2285 					    nwiftabptr->zone_nwif_address);
2286 					goto bad;
2287 				}
2288 				got_netmask = B_TRUE;
2289 			} else if (getnetmaskbyaddr(in4,
2290 			    &netmask4.sin_addr) == 0) {
2291 				got_netmask = B_TRUE;
2292 			}
2293 			if (got_netmask) {
2294 				netmask4.sin_family = af;
2295 				(void) memcpy(&lifr.lifr_addr, &netmask4,
2296 				    sizeof (netmask4));
2297 			}
2298 		} else {
2299 			(void) memset(&netmask6, 0, sizeof (netmask6));
2300 			if (addr2netmask(slashp + 1, V6_ADDR_LEN,
2301 			    (uchar_t *)&netmask6.sin6_addr) != 0) {
2302 				*slashp = '/';
2303 				zerror(zlogp, B_FALSE,
2304 				    "%s: invalid prefix length in %s",
2305 				    lifr.lifr_name,
2306 				    nwiftabptr->zone_nwif_address);
2307 				goto bad;
2308 			}
2309 			got_netmask = B_TRUE;
2310 			netmask6.sin6_family = af;
2311 			(void) memcpy(&lifr.lifr_addr, &netmask6,
2312 			    sizeof (netmask6));
2313 		}
2314 		if (got_netmask &&
2315 		    ioctl(s, SIOCSLIFNETMASK, (caddr_t)&lifr) < 0) {
2316 			zerror(zlogp, B_TRUE, "%s: could not set netmask",
2317 			    lifr.lifr_name);
2318 			goto bad;
2319 		}
2320 
2321 		/*
2322 		 * This doesn't set the broadcast address at all. Rather, it
2323 		 * gets, then sets the interface's address, relying on the fact
2324 		 * that resetting the address will reset the broadcast address.
2325 		 */
2326 		if (ioctl(s, SIOCGLIFADDR, (caddr_t)&lifr) < 0) {
2327 			zerror(zlogp, B_TRUE, "%s: could not get address",
2328 			    lifr.lifr_name);
2329 			goto bad;
2330 		}
2331 		if (ioctl(s, SIOCSLIFADDR, (caddr_t)&lifr) < 0) {
2332 			zerror(zlogp, B_TRUE,
2333 			    "%s: could not reset broadcast address",
2334 			    lifr.lifr_name);
2335 			goto bad;
2336 		}
2337 	}
2338 
2339 	if (ioctl(s, SIOCGLIFFLAGS, (caddr_t)&lifr) < 0) {
2340 		zerror(zlogp, B_TRUE, "%s: could not get flags",
2341 		    lifr.lifr_name);
2342 		goto bad;
2343 	}
2344 	lifr.lifr_flags |= IFF_UP;
2345 	if (ioctl(s, SIOCSLIFFLAGS, (caddr_t)&lifr) < 0) {
2346 		int save_errno = errno;
2347 		char *zone_using;
2348 
2349 		/*
2350 		 * If we failed with something other than EADDRNOTAVAIL,
2351 		 * then skip to the end.  Otherwise, look up our address,
2352 		 * then call a function to determine which zone is already
2353 		 * using that address.
2354 		 */
2355 		if (errno != EADDRNOTAVAIL) {
2356 			zerror(zlogp, B_TRUE,
2357 			    "%s: could not bring network interface up",
2358 			    lifr.lifr_name);
2359 			goto bad;
2360 		}
2361 		if (ioctl(s, SIOCGLIFADDR, (caddr_t)&lifr) < 0) {
2362 			zerror(zlogp, B_TRUE, "%s: could not get address",
2363 			    lifr.lifr_name);
2364 			goto bad;
2365 		}
2366 		zone_using = who_is_using(zlogp, &lifr);
2367 		errno = save_errno;
2368 		if (zone_using == NULL)
2369 			zerror(zlogp, B_TRUE,
2370 			    "%s: could not bring network interface up",
2371 			    lifr.lifr_name);
2372 		else
2373 			zerror(zlogp, B_TRUE, "%s: could not bring network "
2374 			    "interface up: address in use by zone '%s'",
2375 			    lifr.lifr_name, zone_using);
2376 		goto bad;
2377 	}
2378 	if ((lifr.lifr_flags & IFF_MULTICAST) && ((af == AF_INET &&
2379 	    mcast_rt_v4_setp != NULL && *mcast_rt_v4_setp == B_FALSE) ||
2380 	    (af == AF_INET6 &&
2381 	    mcast_rt_v6_setp != NULL && *mcast_rt_v6_setp == B_FALSE))) {
2382 		rs = socket(PF_ROUTE, SOCK_RAW, 0);
2383 		if (rs < 0) {
2384 			zerror(zlogp, B_TRUE, "%s: could not create "
2385 			    "routing socket", lifr.lifr_name);
2386 			goto bad;
2387 		}
2388 		(void) shutdown(rs, 0);
2389 		(void) memset((void *)&mcast_rtmsg, 0, sizeof (mcast_rtmsg_t));
2390 		mcast_rtmsg.m_rtm.rtm_msglen =  sizeof (struct rt_msghdr) +
2391 		    3 * (af == AF_INET ? sizeof (struct sockaddr_in) :
2392 		    sizeof (struct sockaddr_in6));
2393 		mcast_rtmsg.m_rtm.rtm_version = RTM_VERSION;
2394 		mcast_rtmsg.m_rtm.rtm_type = RTM_ADD;
2395 		mcast_rtmsg.m_rtm.rtm_flags = RTF_UP;
2396 		mcast_rtmsg.m_rtm.rtm_addrs =
2397 		    RTA_DST | RTA_GATEWAY | RTA_NETMASK;
2398 		mcast_rtmsg.m_rtm.rtm_seq = ++rts_seqno;
2399 		if (af == AF_INET) {
2400 			mcast_rtmsg.m_dst4.sin_family = AF_INET;
2401 			mcast_rtmsg.m_dst4.sin_addr.s_addr =
2402 			    htonl(INADDR_UNSPEC_GROUP);
2403 			mcast_rtmsg.m_gw4.sin_family = AF_INET;
2404 			mcast_rtmsg.m_gw4.sin_addr = in4;
2405 			mcast_rtmsg.m_netmask4.sin_family = AF_INET;
2406 			mcast_rtmsg.m_netmask4.sin_addr.s_addr =
2407 			    htonl(IN_CLASSD_NET);
2408 		} else {
2409 			mcast_rtmsg.m_dst6.sin6_family = AF_INET6;
2410 			mcast_rtmsg.m_dst6.sin6_addr.s6_addr[0] = 0xffU;
2411 			mcast_rtmsg.m_gw6.sin6_family = AF_INET6;
2412 			mcast_rtmsg.m_gw6.sin6_addr = in6;
2413 			mcast_rtmsg.m_netmask6.sin6_family = AF_INET6;
2414 			mcast_rtmsg.m_netmask6.sin6_addr.s6_addr[0] = 0xffU;
2415 		}
2416 		rlen = write(rs, (char *)&mcast_rtmsg,
2417 		    mcast_rtmsg.m_rtm.rtm_msglen);
2418 		/*
2419 		 * The write to the multicast socket will fail if the
2420 		 * interface belongs to a failed IPMP group. This is a
2421 		 * non-fatal error and the zone will continue booting.
2422 		 * While the zone is running, if any interface in the
2423 		 * failed IPMP group recovers, the zone will fallback to
2424 		 * using that interface.
2425 		 */
2426 		if (rlen < mcast_rtmsg.m_rtm.rtm_msglen) {
2427 			if (rlen < 0) {
2428 				zerror(zlogp, B_TRUE, "WARNING: network "
2429 				    "interface '%s' not available as default "
2430 				    "for multicast.", lifr.lifr_name);
2431 			} else {
2432 				zerror(zlogp, B_FALSE, "WARNING: network "
2433 				    "interface '%s' not available as default "
2434 				    "for multicast; routing socket returned "
2435 				    "unexpected %d bytes.",
2436 				    lifr.lifr_name, rlen);
2437 			}
2438 		} else {
2439 
2440 			if (af == AF_INET) {
2441 				*mcast_rt_v4_setp = B_TRUE;
2442 			} else {
2443 				*mcast_rt_v6_setp = B_TRUE;
2444 			}
2445 		}
2446 		(void) close(rs);
2447 	}
2448 
2449 	if (!got_netmask) {
2450 		/*
2451 		 * A common, but often non-fatal problem, is that the system
2452 		 * cannot find the netmask for an interface address. This is
2453 		 * often caused by it being only in /etc/inet/netmasks, but
2454 		 * /etc/nsswitch.conf says to use NIS or NIS+ and it's not
2455 		 * in that. This doesn't show up at boot because the netmask
2456 		 * is obtained from /etc/inet/netmasks when no network
2457 		 * interfaces are up, but isn't consulted when NIS/NIS+ is
2458 		 * available. We warn the user here that something like this
2459 		 * has happened and we're just running with a default and
2460 		 * possible incorrect netmask.
2461 		 */
2462 		char buffer[INET6_ADDRSTRLEN];
2463 		void  *addr;
2464 
2465 		if (af == AF_INET)
2466 			addr = &((struct sockaddr_in *)
2467 			    (&lifr.lifr_addr))->sin_addr;
2468 		else
2469 			addr = &((struct sockaddr_in6 *)
2470 			    (&lifr.lifr_addr))->sin6_addr;
2471 
2472 		/* Find out what netmask interface is going to be using */
2473 		if (ioctl(s, SIOCGLIFNETMASK, (caddr_t)&lifr) < 0 ||
2474 		    inet_ntop(af, addr, buffer, sizeof (buffer)) == NULL)
2475 			goto bad;
2476 		zerror(zlogp, B_FALSE,
2477 		    "WARNING: %s: no matching subnet found in netmasks(4) for "
2478 		    "%s; using default of %s.",
2479 		    lifr.lifr_name, addrstr4, buffer);
2480 	}
2481 
2482 	(void) close(s);
2483 	return (Z_OK);
2484 bad:
2485 	(void) ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifr);
2486 	(void) close(s);
2487 	return (-1);
2488 }
2489 
2490 /*
2491  * Sets up network interfaces based on information from the zone configuration.
2492  * An IPv4 loopback interface is set up "for free", modeling the global system.
2493  * If any of the configuration interfaces were IPv6, then an IPv6 loopback
2494  * address is set up as well.
2495  *
2496  * If anything goes wrong, we log a general error message, attempt to tear down
2497  * whatever we set up, and return an error.
2498  */
2499 static int
2500 configure_shared_network_interfaces(zlog_t *zlogp)
2501 {
2502 	zone_dochandle_t handle;
2503 	struct zone_nwiftab nwiftab, loopback_iftab;
2504 	boolean_t saw_v6 = B_FALSE;
2505 	boolean_t mcast_rt_v4_set = B_FALSE;
2506 	boolean_t mcast_rt_v6_set = B_FALSE;
2507 	zoneid_t zoneid;
2508 
2509 	if ((zoneid = getzoneidbyname(zone_name)) == ZONE_ID_UNDEFINED) {
2510 		zerror(zlogp, B_TRUE, "unable to get zoneid");
2511 		return (-1);
2512 	}
2513 
2514 	if ((handle = zonecfg_init_handle()) == NULL) {
2515 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
2516 		return (-1);
2517 	}
2518 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2519 		zerror(zlogp, B_FALSE, "invalid configuration");
2520 		zonecfg_fini_handle(handle);
2521 		return (-1);
2522 	}
2523 	if (zonecfg_setnwifent(handle) == Z_OK) {
2524 		for (;;) {
2525 			struct in6_addr in6;
2526 
2527 			if (zonecfg_getnwifent(handle, &nwiftab) != Z_OK)
2528 				break;
2529 			if (configure_one_interface(zlogp, zoneid,
2530 			    &nwiftab, &mcast_rt_v4_set, &mcast_rt_v6_set) !=
2531 			    Z_OK) {
2532 				(void) zonecfg_endnwifent(handle);
2533 				zonecfg_fini_handle(handle);
2534 				return (-1);
2535 			}
2536 			if (inet_pton(AF_INET6, nwiftab.zone_nwif_address,
2537 			    &in6) == 1)
2538 				saw_v6 = B_TRUE;
2539 		}
2540 		(void) zonecfg_endnwifent(handle);
2541 	}
2542 	zonecfg_fini_handle(handle);
2543 	if (is_system_labeled()) {
2544 		/*
2545 		 * Labeled zones share the loopback interface
2546 		 * so it is not plumbed for shared stack instances.
2547 		 */
2548 		return (0);
2549 	}
2550 	(void) strlcpy(loopback_iftab.zone_nwif_physical, "lo0",
2551 	    sizeof (loopback_iftab.zone_nwif_physical));
2552 	(void) strlcpy(loopback_iftab.zone_nwif_address, "127.0.0.1",
2553 	    sizeof (loopback_iftab.zone_nwif_address));
2554 	if (configure_one_interface(zlogp, zoneid, &loopback_iftab, NULL, NULL)
2555 	    != Z_OK) {
2556 		return (-1);
2557 	}
2558 	if (saw_v6) {
2559 		(void) strlcpy(loopback_iftab.zone_nwif_address, "::1/128",
2560 		    sizeof (loopback_iftab.zone_nwif_address));
2561 		if (configure_one_interface(zlogp, zoneid,
2562 		    &loopback_iftab, NULL, NULL) != Z_OK) {
2563 			return (-1);
2564 		}
2565 	}
2566 	return (0);
2567 }
2568 
2569 static void
2570 show_owner(zlog_t *zlogp, char *dlname)
2571 {
2572 	zoneid_t dl_owner_zid;
2573 	char dl_owner_zname[ZONENAME_MAX];
2574 
2575 	dl_owner_zid = ALL_ZONES;
2576 	if (zone_check_datalink(&dl_owner_zid, dlname) != 0)
2577 		(void) snprintf(dl_owner_zname, ZONENAME_MAX, "<unknown>");
2578 	else if (getzonenamebyid(dl_owner_zid, dl_owner_zname, ZONENAME_MAX)
2579 	    < 0)
2580 		(void) snprintf(dl_owner_zname, ZONENAME_MAX, "<%d>",
2581 		    dl_owner_zid);
2582 
2583 	errno = EPERM;
2584 	zerror(zlogp, B_TRUE, "WARNING: skipping network interface '%s' "
2585 	    "which is used by the non-global zone '%s'.\n",
2586 	    dlname, dl_owner_zname);
2587 }
2588 
2589 static int
2590 add_datalink(zlog_t *zlogp, zoneid_t zoneid, char *dlname)
2591 {
2592 	/* First check if it's in use by global zone. */
2593 	if (zonecfg_ifname_exists(AF_INET, dlname) ||
2594 	    zonecfg_ifname_exists(AF_INET6, dlname)) {
2595 		errno = EPERM;
2596 		zerror(zlogp, B_TRUE, "WARNING: skipping network interface "
2597 		    "'%s' which is used in the global zone.", dlname);
2598 		return (-1);
2599 	}
2600 
2601 	/* Add access control information */
2602 	if (zone_add_datalink(zoneid, dlname) != 0) {
2603 		/* If someone got this link before us, show its name */
2604 		if (errno == EPERM)
2605 			show_owner(zlogp, dlname);
2606 		else
2607 			zerror(zlogp, B_TRUE, "WARNING: unable to add network "
2608 			    "interface '%s'.", dlname);
2609 		return (-1);
2610 	}
2611 
2612 	/* Hold the link for this zone */
2613 	if (dladm_hold_link(dlname, zoneid, B_FALSE) < 0) {
2614 		int res, old_errno;
2615 		dladm_attr_t da;
2616 
2617 		/*
2618 		 * The following check is similar to 'dladm show-link'
2619 		 * to determine if this is a legacy interface.
2620 		 */
2621 		old_errno = errno;
2622 		res = dladm_info(dlname, &da);
2623 		if (res < 0 && errno == ENODEV) {
2624 			/*
2625 			 * Check if this is a link like 'ce*' which supports
2626 			 * a direct ioctl.
2627 			 */
2628 			res = driver_hold_link(dlname, zoneid);
2629 			if (res == 0)
2630 				return (0);
2631 
2632 			zerror(zlogp, B_FALSE, "WARNING: legacy network "
2633 			    "interface '%s'\nunsupported with an "
2634 			    "ip-type=exclusive configuration.", dlname);
2635 		} else {
2636 			errno = old_errno;
2637 			zerror(zlogp, B_TRUE, "WARNING: unable to hold network "
2638 			    "interface '%s'.", dlname);
2639 		}
2640 
2641 		(void) zone_remove_datalink(zoneid, dlname);
2642 		return (-1);
2643 	}
2644 
2645 	return (0);
2646 }
2647 
2648 static int
2649 remove_datalink(zlog_t *zlogp, zoneid_t zoneid, char *dlname)
2650 {
2651 	/*
2652 	 * Remove access control information.
2653 	 * If the errno is ENXIO, the interface is not added yet,
2654 	 * nothing to report then.
2655 	 */
2656 	if (zone_remove_datalink(zoneid, dlname) != 0) {
2657 		if (errno == ENXIO)
2658 			return (0);
2659 		zerror(zlogp, B_TRUE, "unable to remove network interface '%s'",
2660 		    dlname);
2661 		return (-1);
2662 	}
2663 
2664 	if (dladm_rele_link(dlname, 0, B_FALSE) < 0) {
2665 		/* Fallback to 'ce*' type link */
2666 		if (driver_rele_link(dlname, 0) < 0) {
2667 			zerror(zlogp, B_TRUE, "unable to release network "
2668 			    "interface '%s'", dlname);
2669 			return (-1);
2670 		}
2671 	}
2672 	return (0);
2673 }
2674 
2675 /*
2676  * Add the kernel access control information for the interface names.
2677  * If anything goes wrong, we log a general error message, attempt to tear down
2678  * whatever we set up, and return an error.
2679  */
2680 static int
2681 configure_exclusive_network_interfaces(zlog_t *zlogp)
2682 {
2683 	zone_dochandle_t handle;
2684 	struct zone_nwiftab nwiftab;
2685 	zoneid_t zoneid;
2686 	char rootpath[MAXPATHLEN];
2687 	char path[MAXPATHLEN];
2688 	di_prof_t prof = NULL;
2689 	boolean_t added = B_FALSE;
2690 
2691 	if ((zoneid = getzoneidbyname(zone_name)) == -1) {
2692 		zerror(zlogp, B_TRUE, "unable to get zoneid");
2693 		return (-1);
2694 	}
2695 
2696 	if ((handle = zonecfg_init_handle()) == NULL) {
2697 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
2698 		return (-1);
2699 	}
2700 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2701 		zerror(zlogp, B_FALSE, "invalid configuration");
2702 		zonecfg_fini_handle(handle);
2703 		return (-1);
2704 	}
2705 
2706 	if (zonecfg_setnwifent(handle) != Z_OK) {
2707 		zonecfg_fini_handle(handle);
2708 		return (0);
2709 	}
2710 
2711 	for (;;) {
2712 		if (zonecfg_getnwifent(handle, &nwiftab) != Z_OK)
2713 			break;
2714 
2715 		if (prof == NULL) {
2716 			if (zone_get_devroot(zone_name, rootpath,
2717 			    sizeof (rootpath)) != Z_OK) {
2718 				(void) zonecfg_endnwifent(handle);
2719 				zonecfg_fini_handle(handle);
2720 				zerror(zlogp, B_TRUE,
2721 				    "unable to determine dev root");
2722 				return (-1);
2723 			}
2724 			(void) snprintf(path, sizeof (path), "%s%s", rootpath,
2725 			    "/dev");
2726 			if (di_prof_init(path, &prof) != 0) {
2727 				(void) zonecfg_endnwifent(handle);
2728 				zonecfg_fini_handle(handle);
2729 				zerror(zlogp, B_TRUE,
2730 				    "failed to initialize profile");
2731 				return (-1);
2732 			}
2733 		}
2734 
2735 		/*
2736 		 * Only create the /dev entry if it's not in use.
2737 		 * Note here the zone still boots when the interfaces
2738 		 * assigned is inaccessible, used by others, etc.
2739 		 */
2740 		if (add_datalink(zlogp, zoneid, nwiftab.zone_nwif_physical)
2741 		    == 0) {
2742 			if (di_prof_add_dev(prof, nwiftab.zone_nwif_physical)
2743 			    != 0) {
2744 				(void) zonecfg_endnwifent(handle);
2745 				zonecfg_fini_handle(handle);
2746 				zerror(zlogp, B_TRUE,
2747 				    "failed to add network device");
2748 				return (-1);
2749 			}
2750 			added = B_TRUE;
2751 		}
2752 	}
2753 	(void) zonecfg_endnwifent(handle);
2754 	zonecfg_fini_handle(handle);
2755 
2756 	if (prof != NULL && added) {
2757 		if (di_prof_commit(prof) != 0) {
2758 			zerror(zlogp, B_TRUE, "failed to commit profile");
2759 			return (-1);
2760 		}
2761 	}
2762 	if (prof != NULL)
2763 		di_prof_fini(prof);
2764 
2765 	return (0);
2766 }
2767 
2768 /*
2769  * Get the list of the data-links from kernel, and try to remove it
2770  */
2771 static int
2772 unconfigure_exclusive_network_interfaces_run(zlog_t *zlogp, zoneid_t zoneid)
2773 {
2774 	char *dlnames, *ptr;
2775 	int dlnum, dlnum_saved, i;
2776 
2777 	dlnum = 0;
2778 	if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
2779 		zerror(zlogp, B_TRUE, "unable to list network interfaces");
2780 		return (-1);
2781 	}
2782 again:
2783 	/* this zone doesn't have any data-links */
2784 	if (dlnum == 0)
2785 		return (0);
2786 
2787 	dlnames = malloc(dlnum * LIFNAMSIZ);
2788 	if (dlnames == NULL) {
2789 		zerror(zlogp, B_TRUE, "memory allocation failed");
2790 		return (-1);
2791 	}
2792 	dlnum_saved = dlnum;
2793 
2794 	if (zone_list_datalink(zoneid, &dlnum, dlnames) != 0) {
2795 		zerror(zlogp, B_TRUE, "unable to list network interfaces");
2796 		free(dlnames);
2797 		return (-1);
2798 	}
2799 	if (dlnum_saved < dlnum) {
2800 		/* list increased, try again */
2801 		free(dlnames);
2802 		goto again;
2803 	}
2804 	ptr = dlnames;
2805 	for (i = 0; i < dlnum; i++) {
2806 		/* Remove access control information */
2807 		if (remove_datalink(zlogp, zoneid, ptr) != 0) {
2808 			free(dlnames);
2809 			return (-1);
2810 		}
2811 		ptr += LIFNAMSIZ;
2812 	}
2813 	free(dlnames);
2814 	return (0);
2815 }
2816 
2817 /*
2818  * Get the list of the data-links from configuration, and try to remove it
2819  */
2820 static int
2821 unconfigure_exclusive_network_interfaces_static(zlog_t *zlogp, zoneid_t zoneid)
2822 {
2823 	zone_dochandle_t handle;
2824 	struct zone_nwiftab nwiftab;
2825 
2826 	if ((handle = zonecfg_init_handle()) == NULL) {
2827 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
2828 		return (-1);
2829 	}
2830 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2831 		zerror(zlogp, B_FALSE, "invalid configuration");
2832 		zonecfg_fini_handle(handle);
2833 		return (-1);
2834 	}
2835 	if (zonecfg_setnwifent(handle) != Z_OK) {
2836 		zonecfg_fini_handle(handle);
2837 		return (0);
2838 	}
2839 	for (;;) {
2840 		if (zonecfg_getnwifent(handle, &nwiftab) != Z_OK)
2841 			break;
2842 		/* Remove access control information */
2843 		if (remove_datalink(zlogp, zoneid, nwiftab.zone_nwif_physical)
2844 		    != 0) {
2845 			(void) zonecfg_endnwifent(handle);
2846 			zonecfg_fini_handle(handle);
2847 			return (-1);
2848 		}
2849 	}
2850 	(void) zonecfg_endnwifent(handle);
2851 	zonecfg_fini_handle(handle);
2852 	return (0);
2853 }
2854 
2855 /*
2856  * Remove the access control information from the kernel for the exclusive
2857  * network interfaces.
2858  */
2859 static int
2860 unconfigure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
2861 {
2862 	if (unconfigure_exclusive_network_interfaces_run(zlogp, zoneid) != 0) {
2863 		return (unconfigure_exclusive_network_interfaces_static(zlogp,
2864 		    zoneid));
2865 	}
2866 
2867 	return (0);
2868 }
2869 
2870 static int
2871 tcp_abort_conn(zlog_t *zlogp, zoneid_t zoneid,
2872     const struct sockaddr_storage *local, const struct sockaddr_storage *remote)
2873 {
2874 	int fd;
2875 	struct strioctl ioc;
2876 	tcp_ioc_abort_conn_t conn;
2877 	int error;
2878 
2879 	conn.ac_local = *local;
2880 	conn.ac_remote = *remote;
2881 	conn.ac_start = TCPS_SYN_SENT;
2882 	conn.ac_end = TCPS_TIME_WAIT;
2883 	conn.ac_zoneid = zoneid;
2884 
2885 	ioc.ic_cmd = TCP_IOC_ABORT_CONN;
2886 	ioc.ic_timout = -1; /* infinite timeout */
2887 	ioc.ic_len = sizeof (conn);
2888 	ioc.ic_dp = (char *)&conn;
2889 
2890 	if ((fd = open("/dev/tcp", O_RDONLY)) < 0) {
2891 		zerror(zlogp, B_TRUE, "unable to open %s", "/dev/tcp");
2892 		return (-1);
2893 	}
2894 
2895 	error = ioctl(fd, I_STR, &ioc);
2896 	(void) close(fd);
2897 	if (error == 0 || errno == ENOENT)	/* ENOENT is not an error */
2898 		return (0);
2899 	return (-1);
2900 }
2901 
2902 static int
2903 tcp_abort_connections(zlog_t *zlogp, zoneid_t zoneid)
2904 {
2905 	struct sockaddr_storage l, r;
2906 	struct sockaddr_in *local, *remote;
2907 	struct sockaddr_in6 *local6, *remote6;
2908 	int error;
2909 
2910 	/*
2911 	 * Abort IPv4 connections.
2912 	 */
2913 	bzero(&l, sizeof (*local));
2914 	local = (struct sockaddr_in *)&l;
2915 	local->sin_family = AF_INET;
2916 	local->sin_addr.s_addr = INADDR_ANY;
2917 	local->sin_port = 0;
2918 
2919 	bzero(&r, sizeof (*remote));
2920 	remote = (struct sockaddr_in *)&r;
2921 	remote->sin_family = AF_INET;
2922 	remote->sin_addr.s_addr = INADDR_ANY;
2923 	remote->sin_port = 0;
2924 
2925 	if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
2926 		return (error);
2927 
2928 	/*
2929 	 * Abort IPv6 connections.
2930 	 */
2931 	bzero(&l, sizeof (*local6));
2932 	local6 = (struct sockaddr_in6 *)&l;
2933 	local6->sin6_family = AF_INET6;
2934 	local6->sin6_port = 0;
2935 	local6->sin6_addr = in6addr_any;
2936 
2937 	bzero(&r, sizeof (*remote6));
2938 	remote6 = (struct sockaddr_in6 *)&r;
2939 	remote6->sin6_family = AF_INET6;
2940 	remote6->sin6_port = 0;
2941 	remote6->sin6_addr = in6addr_any;
2942 
2943 	if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
2944 		return (error);
2945 	return (0);
2946 }
2947 
2948 static int
2949 get_privset(zlog_t *zlogp, priv_set_t *privs, zone_mnt_t mount_cmd)
2950 {
2951 	int error = -1;
2952 	zone_dochandle_t handle;
2953 	char *privname = NULL;
2954 
2955 	if ((handle = zonecfg_init_handle()) == NULL) {
2956 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
2957 		return (-1);
2958 	}
2959 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2960 		zerror(zlogp, B_FALSE, "invalid configuration");
2961 		zonecfg_fini_handle(handle);
2962 		return (-1);
2963 	}
2964 
2965 	if (ALT_MOUNT(mount_cmd)) {
2966 		zone_iptype_t	iptype;
2967 		const char	*curr_iptype;
2968 
2969 		if (zonecfg_get_iptype(handle, &iptype) != Z_OK) {
2970 			zerror(zlogp, B_TRUE, "unable to determine ip-type");
2971 			zonecfg_fini_handle(handle);
2972 			return (-1);
2973 		}
2974 
2975 		switch (iptype) {
2976 		case ZS_SHARED:
2977 			curr_iptype = "shared";
2978 			break;
2979 		case ZS_EXCLUSIVE:
2980 			curr_iptype = "exclusive";
2981 			break;
2982 		}
2983 
2984 		if (zonecfg_default_privset(privs, curr_iptype) == Z_OK) {
2985 			zonecfg_fini_handle(handle);
2986 			return (0);
2987 		}
2988 		zerror(zlogp, B_FALSE,
2989 		    "failed to determine the zone's default privilege set");
2990 		zonecfg_fini_handle(handle);
2991 		return (-1);
2992 	}
2993 
2994 	switch (zonecfg_get_privset(handle, privs, &privname)) {
2995 	case Z_OK:
2996 		error = 0;
2997 		break;
2998 	case Z_PRIV_PROHIBITED:
2999 		zerror(zlogp, B_FALSE, "privilege \"%s\" is not permitted "
3000 		    "within the zone's privilege set", privname);
3001 		break;
3002 	case Z_PRIV_REQUIRED:
3003 		zerror(zlogp, B_FALSE, "required privilege \"%s\" is missing "
3004 		    "from the zone's privilege set", privname);
3005 		break;
3006 	case Z_PRIV_UNKNOWN:
3007 		zerror(zlogp, B_FALSE, "unknown privilege \"%s\" specified "
3008 		    "in the zone's privilege set", privname);
3009 		break;
3010 	default:
3011 		zerror(zlogp, B_FALSE, "failed to determine the zone's "
3012 		    "privilege set");
3013 		break;
3014 	}
3015 
3016 	free(privname);
3017 	zonecfg_fini_handle(handle);
3018 	return (error);
3019 }
3020 
3021 static int
3022 get_rctls(zlog_t *zlogp, char **bufp, size_t *bufsizep)
3023 {
3024 	nvlist_t *nvl = NULL;
3025 	char *nvl_packed = NULL;
3026 	size_t nvl_size = 0;
3027 	nvlist_t **nvlv = NULL;
3028 	int rctlcount = 0;
3029 	int error = -1;
3030 	zone_dochandle_t handle;
3031 	struct zone_rctltab rctltab;
3032 	rctlblk_t *rctlblk = NULL;
3033 
3034 	*bufp = NULL;
3035 	*bufsizep = 0;
3036 
3037 	if ((handle = zonecfg_init_handle()) == NULL) {
3038 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
3039 		return (-1);
3040 	}
3041 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
3042 		zerror(zlogp, B_FALSE, "invalid configuration");
3043 		zonecfg_fini_handle(handle);
3044 		return (-1);
3045 	}
3046 
3047 	rctltab.zone_rctl_valptr = NULL;
3048 	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0) {
3049 		zerror(zlogp, B_TRUE, "%s failed", "nvlist_alloc");
3050 		goto out;
3051 	}
3052 
3053 	if (zonecfg_setrctlent(handle) != Z_OK) {
3054 		zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setrctlent");
3055 		goto out;
3056 	}
3057 
3058 	if ((rctlblk = malloc(rctlblk_size())) == NULL) {
3059 		zerror(zlogp, B_TRUE, "memory allocation failed");
3060 		goto out;
3061 	}
3062 	while (zonecfg_getrctlent(handle, &rctltab) == Z_OK) {
3063 		struct zone_rctlvaltab *rctlval;
3064 		uint_t i, count;
3065 		const char *name = rctltab.zone_rctl_name;
3066 
3067 		/* zoneadm should have already warned about unknown rctls. */
3068 		if (!zonecfg_is_rctl(name)) {
3069 			zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3070 			rctltab.zone_rctl_valptr = NULL;
3071 			continue;
3072 		}
3073 		count = 0;
3074 		for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
3075 		    rctlval = rctlval->zone_rctlval_next) {
3076 			count++;
3077 		}
3078 		if (count == 0) {	/* ignore */
3079 			continue;	/* Nothing to free */
3080 		}
3081 		if ((nvlv = malloc(sizeof (*nvlv) * count)) == NULL)
3082 			goto out;
3083 		i = 0;
3084 		for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
3085 		    rctlval = rctlval->zone_rctlval_next, i++) {
3086 			if (nvlist_alloc(&nvlv[i], NV_UNIQUE_NAME, 0) != 0) {
3087 				zerror(zlogp, B_TRUE, "%s failed",
3088 				    "nvlist_alloc");
3089 				goto out;
3090 			}
3091 			if (zonecfg_construct_rctlblk(rctlval, rctlblk)
3092 			    != Z_OK) {
3093 				zerror(zlogp, B_FALSE, "invalid rctl value: "
3094 				    "(priv=%s,limit=%s,action=%s)",
3095 				    rctlval->zone_rctlval_priv,
3096 				    rctlval->zone_rctlval_limit,
3097 				    rctlval->zone_rctlval_action);
3098 				goto out;
3099 			}
3100 			if (!zonecfg_valid_rctl(name, rctlblk)) {
3101 				zerror(zlogp, B_FALSE,
3102 				    "(priv=%s,limit=%s,action=%s) is not a "
3103 				    "valid value for rctl '%s'",
3104 				    rctlval->zone_rctlval_priv,
3105 				    rctlval->zone_rctlval_limit,
3106 				    rctlval->zone_rctlval_action,
3107 				    name);
3108 				goto out;
3109 			}
3110 			if (nvlist_add_uint64(nvlv[i], "privilege",
3111 			    rctlblk_get_privilege(rctlblk)) != 0) {
3112 				zerror(zlogp, B_FALSE, "%s failed",
3113 				    "nvlist_add_uint64");
3114 				goto out;
3115 			}
3116 			if (nvlist_add_uint64(nvlv[i], "limit",
3117 			    rctlblk_get_value(rctlblk)) != 0) {
3118 				zerror(zlogp, B_FALSE, "%s failed",
3119 				    "nvlist_add_uint64");
3120 				goto out;
3121 			}
3122 			if (nvlist_add_uint64(nvlv[i], "action",
3123 			    (uint_t)rctlblk_get_local_action(rctlblk, NULL))
3124 			    != 0) {
3125 				zerror(zlogp, B_FALSE, "%s failed",
3126 				    "nvlist_add_uint64");
3127 				goto out;
3128 			}
3129 		}
3130 		zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3131 		rctltab.zone_rctl_valptr = NULL;
3132 		if (nvlist_add_nvlist_array(nvl, (char *)name, nvlv, count)
3133 		    != 0) {
3134 			zerror(zlogp, B_FALSE, "%s failed",
3135 			    "nvlist_add_nvlist_array");
3136 			goto out;
3137 		}
3138 		for (i = 0; i < count; i++)
3139 			nvlist_free(nvlv[i]);
3140 		free(nvlv);
3141 		nvlv = NULL;
3142 		rctlcount++;
3143 	}
3144 	(void) zonecfg_endrctlent(handle);
3145 
3146 	if (rctlcount == 0) {
3147 		error = 0;
3148 		goto out;
3149 	}
3150 	if (nvlist_pack(nvl, &nvl_packed, &nvl_size, NV_ENCODE_NATIVE, 0)
3151 	    != 0) {
3152 		zerror(zlogp, B_FALSE, "%s failed", "nvlist_pack");
3153 		goto out;
3154 	}
3155 
3156 	error = 0;
3157 	*bufp = nvl_packed;
3158 	*bufsizep = nvl_size;
3159 
3160 out:
3161 	free(rctlblk);
3162 	zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3163 	if (error && nvl_packed != NULL)
3164 		free(nvl_packed);
3165 	if (nvl != NULL)
3166 		nvlist_free(nvl);
3167 	if (nvlv != NULL)
3168 		free(nvlv);
3169 	if (handle != NULL)
3170 		zonecfg_fini_handle(handle);
3171 	return (error);
3172 }
3173 
3174 static int
3175 get_datasets(zlog_t *zlogp, char **bufp, size_t *bufsizep)
3176 {
3177 	zone_dochandle_t handle;
3178 	struct zone_dstab dstab;
3179 	size_t total, offset, len;
3180 	int error = -1;
3181 	char *str = NULL;
3182 
3183 	*bufp = NULL;
3184 	*bufsizep = 0;
3185 
3186 	if ((handle = zonecfg_init_handle()) == NULL) {
3187 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
3188 		return (-1);
3189 	}
3190 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
3191 		zerror(zlogp, B_FALSE, "invalid configuration");
3192 		zonecfg_fini_handle(handle);
3193 		return (-1);
3194 	}
3195 
3196 	if (zonecfg_setdsent(handle) != Z_OK) {
3197 		zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
3198 		goto out;
3199 	}
3200 
3201 	total = 0;
3202 	while (zonecfg_getdsent(handle, &dstab) == Z_OK)
3203 		total += strlen(dstab.zone_dataset_name) + 1;
3204 	(void) zonecfg_enddsent(handle);
3205 
3206 	if (total == 0) {
3207 		error = 0;
3208 		goto out;
3209 	}
3210 
3211 	if ((str = malloc(total)) == NULL) {
3212 		zerror(zlogp, B_TRUE, "memory allocation failed");
3213 		goto out;
3214 	}
3215 
3216 	if (zonecfg_setdsent(handle) != Z_OK) {
3217 		zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
3218 		goto out;
3219 	}
3220 	offset = 0;
3221 	while (zonecfg_getdsent(handle, &dstab) == Z_OK) {
3222 		len = strlen(dstab.zone_dataset_name);
3223 		(void) strlcpy(str + offset, dstab.zone_dataset_name,
3224 		    total - offset);
3225 		offset += len;
3226 		if (offset < total - 1)
3227 			str[offset++] = ',';
3228 	}
3229 	(void) zonecfg_enddsent(handle);
3230 
3231 	error = 0;
3232 	*bufp = str;
3233 	*bufsizep = total;
3234 
3235 out:
3236 	if (error != 0 && str != NULL)
3237 		free(str);
3238 	if (handle != NULL)
3239 		zonecfg_fini_handle(handle);
3240 
3241 	return (error);
3242 }
3243 
3244 static int
3245 validate_datasets(zlog_t *zlogp)
3246 {
3247 	zone_dochandle_t handle;
3248 	struct zone_dstab dstab;
3249 	zfs_handle_t *zhp;
3250 	libzfs_handle_t *hdl;
3251 
3252 	if ((handle = zonecfg_init_handle()) == NULL) {
3253 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
3254 		return (-1);
3255 	}
3256 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
3257 		zerror(zlogp, B_FALSE, "invalid configuration");
3258 		zonecfg_fini_handle(handle);
3259 		return (-1);
3260 	}
3261 
3262 	if (zonecfg_setdsent(handle) != Z_OK) {
3263 		zerror(zlogp, B_FALSE, "invalid configuration");
3264 		zonecfg_fini_handle(handle);
3265 		return (-1);
3266 	}
3267 
3268 	if ((hdl = libzfs_init()) == NULL) {
3269 		zerror(zlogp, B_FALSE, "opening ZFS library");
3270 		zonecfg_fini_handle(handle);
3271 		return (-1);
3272 	}
3273 
3274 	while (zonecfg_getdsent(handle, &dstab) == Z_OK) {
3275 
3276 		if ((zhp = zfs_open(hdl, dstab.zone_dataset_name,
3277 		    ZFS_TYPE_FILESYSTEM)) == NULL) {
3278 			zerror(zlogp, B_FALSE, "cannot open ZFS dataset '%s'",
3279 			    dstab.zone_dataset_name);
3280 			zonecfg_fini_handle(handle);
3281 			libzfs_fini(hdl);
3282 			return (-1);
3283 		}
3284 
3285 		/*
3286 		 * Automatically set the 'zoned' property.  We check the value
3287 		 * first because we'll get EPERM if it is already set.
3288 		 */
3289 		if (!zfs_prop_get_int(zhp, ZFS_PROP_ZONED) &&
3290 		    zfs_prop_set(zhp, zfs_prop_to_name(ZFS_PROP_ZONED),
3291 		    "on") != 0) {
3292 			zerror(zlogp, B_FALSE, "cannot set 'zoned' "
3293 			    "property for ZFS dataset '%s'\n",
3294 			    dstab.zone_dataset_name);
3295 			zonecfg_fini_handle(handle);
3296 			zfs_close(zhp);
3297 			libzfs_fini(hdl);
3298 			return (-1);
3299 		}
3300 
3301 		zfs_close(zhp);
3302 	}
3303 	(void) zonecfg_enddsent(handle);
3304 
3305 	zonecfg_fini_handle(handle);
3306 	libzfs_fini(hdl);
3307 
3308 	return (0);
3309 }
3310 
3311 /*
3312  * Mount lower level home directories into/from current zone
3313  * Share exported directories specified in dfstab for zone
3314  */
3315 static int
3316 tsol_mounts(zlog_t *zlogp, char *zone_name, char *rootpath)
3317 {
3318 	zoneid_t *zids = NULL;
3319 	priv_set_t *zid_privs;
3320 	const priv_impl_info_t *ip = NULL;
3321 	uint_t nzents_saved;
3322 	uint_t nzents;
3323 	int i;
3324 	char readonly[] = "ro";
3325 	struct zone_fstab lower_fstab;
3326 	char *argv[4];
3327 
3328 	if (!is_system_labeled())
3329 		return (0);
3330 
3331 	if (zid_label == NULL) {
3332 		zid_label = m_label_alloc(MAC_LABEL);
3333 		if (zid_label == NULL)
3334 			return (-1);
3335 	}
3336 
3337 	/* Make sure our zone has an /export/home dir */
3338 	(void) make_one_dir(zlogp, rootpath, "/export/home",
3339 	    DEFAULT_DIR_MODE, DEFAULT_DIR_USER, DEFAULT_DIR_GROUP);
3340 
3341 	lower_fstab.zone_fs_raw[0] = '\0';
3342 	(void) strlcpy(lower_fstab.zone_fs_type, MNTTYPE_LOFS,
3343 	    sizeof (lower_fstab.zone_fs_type));
3344 	lower_fstab.zone_fs_options = NULL;
3345 	(void) zonecfg_add_fs_option(&lower_fstab, readonly);
3346 
3347 	/*
3348 	 * Get the list of zones from the kernel
3349 	 */
3350 	if (zone_list(NULL, &nzents) != 0) {
3351 		zerror(zlogp, B_TRUE, "unable to list zones");
3352 		zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3353 		return (-1);
3354 	}
3355 again:
3356 	if (nzents == 0) {
3357 		zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3358 		return (-1);
3359 	}
3360 
3361 	zids = malloc(nzents * sizeof (zoneid_t));
3362 	if (zids == NULL) {
3363 		zerror(zlogp, B_TRUE, "memory allocation failed");
3364 		return (-1);
3365 	}
3366 	nzents_saved = nzents;
3367 
3368 	if (zone_list(zids, &nzents) != 0) {
3369 		zerror(zlogp, B_TRUE, "unable to list zones");
3370 		zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3371 		free(zids);
3372 		return (-1);
3373 	}
3374 	if (nzents != nzents_saved) {
3375 		/* list changed, try again */
3376 		free(zids);
3377 		goto again;
3378 	}
3379 
3380 	ip = getprivimplinfo();
3381 	if ((zid_privs = priv_allocset()) == NULL) {
3382 		zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
3383 		zonecfg_free_fs_option_list(
3384 		    lower_fstab.zone_fs_options);
3385 		free(zids);
3386 		return (-1);
3387 	}
3388 
3389 	for (i = 0; i < nzents; i++) {
3390 		char zid_name[ZONENAME_MAX];
3391 		zone_state_t zid_state;
3392 		char zid_rpath[MAXPATHLEN];
3393 		struct stat stat_buf;
3394 
3395 		if (zids[i] == GLOBAL_ZONEID)
3396 			continue;
3397 
3398 		if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
3399 			continue;
3400 
3401 		/*
3402 		 * Do special setup for the zone we are booting
3403 		 */
3404 		if (strcmp(zid_name, zone_name) == 0) {
3405 			struct zone_fstab autofs_fstab;
3406 			char map_path[MAXPATHLEN];
3407 			int fd;
3408 
3409 			/*
3410 			 * Create auto_home_<zone> map for this zone
3411 			 * in the global zone. The non-global zone entry
3412 			 * will be created by automount when the zone
3413 			 * is booted.
3414 			 */
3415 
3416 			(void) snprintf(autofs_fstab.zone_fs_special,
3417 			    MAXPATHLEN, "auto_home_%s", zid_name);
3418 
3419 			(void) snprintf(autofs_fstab.zone_fs_dir, MAXPATHLEN,
3420 			    "/zone/%s/home", zid_name);
3421 
3422 			(void) snprintf(map_path, sizeof (map_path),
3423 			    "/etc/%s", autofs_fstab.zone_fs_special);
3424 			/*
3425 			 * If the map file doesn't exist create a template
3426 			 */
3427 			if ((fd = open(map_path, O_RDWR | O_CREAT | O_EXCL,
3428 			    S_IRUSR | S_IWUSR | S_IRGRP| S_IROTH)) != -1) {
3429 				int len;
3430 				char map_rec[MAXPATHLEN];
3431 
3432 				len = snprintf(map_rec, sizeof (map_rec),
3433 				    "+%s\n*\t-fstype=lofs\t:%s/export/home/&\n",
3434 				    autofs_fstab.zone_fs_special, rootpath);
3435 				(void) write(fd, map_rec, len);
3436 				(void) close(fd);
3437 			}
3438 
3439 			/*
3440 			 * Mount auto_home_<zone> in the global zone if absent.
3441 			 * If it's already of type autofs, then
3442 			 * don't mount it again.
3443 			 */
3444 			if ((stat(autofs_fstab.zone_fs_dir, &stat_buf) == -1) ||
3445 			    strcmp(stat_buf.st_fstype, MNTTYPE_AUTOFS) != 0) {
3446 				char optstr[] = "indirect,ignore,nobrowse";
3447 
3448 				(void) make_one_dir(zlogp, "",
3449 				    autofs_fstab.zone_fs_dir, DEFAULT_DIR_MODE,
3450 				    DEFAULT_DIR_USER, DEFAULT_DIR_GROUP);
3451 
3452 				/*
3453 				 * Mount will fail if automounter has already
3454 				 * processed the auto_home_<zonename> map
3455 				 */
3456 				(void) domount(zlogp, MNTTYPE_AUTOFS, optstr,
3457 				    autofs_fstab.zone_fs_special,
3458 				    autofs_fstab.zone_fs_dir);
3459 			}
3460 			continue;
3461 		}
3462 
3463 
3464 		if (zone_get_state(zid_name, &zid_state) != Z_OK ||
3465 		    (zid_state != ZONE_STATE_READY &&
3466 		    zid_state != ZONE_STATE_RUNNING))
3467 			/* Skip over zones without mounted filesystems */
3468 			continue;
3469 
3470 		if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
3471 		    sizeof (m_label_t)) < 0)
3472 			/* Skip over zones with unspecified label */
3473 			continue;
3474 
3475 		if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
3476 		    sizeof (zid_rpath)) == -1)
3477 			/* Skip over zones with bad path */
3478 			continue;
3479 
3480 		if (zone_getattr(zids[i], ZONE_ATTR_PRIVSET, zid_privs,
3481 		    sizeof (priv_chunk_t) * ip->priv_setsize) == -1)
3482 			/* Skip over zones with bad privs */
3483 			continue;
3484 
3485 		/*
3486 		 * Reading down is valid according to our label model
3487 		 * but some customers want to disable it because it
3488 		 * allows execute down and other possible attacks.
3489 		 * Therefore, we restrict this feature to zones that
3490 		 * have the NET_MAC_AWARE privilege which is required
3491 		 * for NFS read-down semantics.
3492 		 */
3493 		if ((bldominates(zlabel, zid_label)) &&
3494 		    (priv_ismember(zprivs, PRIV_NET_MAC_AWARE))) {
3495 			/*
3496 			 * Our zone dominates this one.
3497 			 * Create a lofs mount from lower zone's /export/home
3498 			 */
3499 			(void) snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
3500 			    "%s/zone/%s/export/home", rootpath, zid_name);
3501 
3502 			/*
3503 			 * If the target is already an LOFS mount
3504 			 * then don't do it again.
3505 			 */
3506 			if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
3507 			    strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
3508 
3509 				if (snprintf(lower_fstab.zone_fs_special,
3510 				    MAXPATHLEN, "%s/export",
3511 				    zid_rpath) > MAXPATHLEN)
3512 					continue;
3513 
3514 				/*
3515 				 * Make sure the lower-level home exists
3516 				 */
3517 				if (make_one_dir(zlogp,
3518 				    lower_fstab.zone_fs_special, "/home",
3519 				    DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
3520 				    DEFAULT_DIR_GROUP) != 0)
3521 					continue;
3522 
3523 				(void) strlcat(lower_fstab.zone_fs_special,
3524 				    "/home", MAXPATHLEN);
3525 
3526 				/*
3527 				 * Mount can fail because the lower-level
3528 				 * zone may have already done a mount up.
3529 				 */
3530 				(void) mount_one(zlogp, &lower_fstab, "");
3531 			}
3532 		} else if ((bldominates(zid_label, zlabel)) &&
3533 		    (priv_ismember(zid_privs, PRIV_NET_MAC_AWARE))) {
3534 			/*
3535 			 * This zone dominates our zone.
3536 			 * Create a lofs mount from our zone's /export/home
3537 			 */
3538 			if (snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
3539 			    "%s/zone/%s/export/home", zid_rpath,
3540 			    zone_name) > MAXPATHLEN)
3541 				continue;
3542 
3543 			/*
3544 			 * If the target is already an LOFS mount
3545 			 * then don't do it again.
3546 			 */
3547 			if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
3548 			    strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
3549 
3550 				(void) snprintf(lower_fstab.zone_fs_special,
3551 				    MAXPATHLEN, "%s/export/home", rootpath);
3552 
3553 				/*
3554 				 * Mount can fail because the higher-level
3555 				 * zone may have already done a mount down.
3556 				 */
3557 				(void) mount_one(zlogp, &lower_fstab, "");
3558 			}
3559 		}
3560 	}
3561 	zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3562 	priv_freeset(zid_privs);
3563 	free(zids);
3564 
3565 	/*
3566 	 * Now share any exported directories from this zone.
3567 	 * Each zone can have its own dfstab.
3568 	 */
3569 
3570 	argv[0] = "zoneshare";
3571 	argv[1] = "-z";
3572 	argv[2] = zone_name;
3573 	argv[3] = NULL;
3574 
3575 	(void) forkexec(zlogp, "/usr/lib/zones/zoneshare", argv);
3576 	/* Don't check for errors since they don't affect the zone */
3577 
3578 	return (0);
3579 }
3580 
3581 /*
3582  * Unmount lofs mounts from higher level zones
3583  * Unshare nfs exported directories
3584  */
3585 static void
3586 tsol_unmounts(zlog_t *zlogp, char *zone_name)
3587 {
3588 	zoneid_t *zids = NULL;
3589 	uint_t nzents_saved;
3590 	uint_t nzents;
3591 	int i;
3592 	char *argv[4];
3593 	char path[MAXPATHLEN];
3594 
3595 	if (!is_system_labeled())
3596 		return;
3597 
3598 	/*
3599 	 * Get the list of zones from the kernel
3600 	 */
3601 	if (zone_list(NULL, &nzents) != 0) {
3602 		return;
3603 	}
3604 
3605 	if (zid_label == NULL) {
3606 		zid_label = m_label_alloc(MAC_LABEL);
3607 		if (zid_label == NULL)
3608 			return;
3609 	}
3610 
3611 again:
3612 	if (nzents == 0)
3613 		return;
3614 
3615 	zids = malloc(nzents * sizeof (zoneid_t));
3616 	if (zids == NULL) {
3617 		zerror(zlogp, B_TRUE, "memory allocation failed");
3618 		return;
3619 	}
3620 	nzents_saved = nzents;
3621 
3622 	if (zone_list(zids, &nzents) != 0) {
3623 		free(zids);
3624 		return;
3625 	}
3626 	if (nzents != nzents_saved) {
3627 		/* list changed, try again */
3628 		free(zids);
3629 		goto again;
3630 	}
3631 
3632 	for (i = 0; i < nzents; i++) {
3633 		char zid_name[ZONENAME_MAX];
3634 		zone_state_t zid_state;
3635 		char zid_rpath[MAXPATHLEN];
3636 
3637 		if (zids[i] == GLOBAL_ZONEID)
3638 			continue;
3639 
3640 		if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
3641 			continue;
3642 
3643 		/*
3644 		 * Skip the zone we are halting
3645 		 */
3646 		if (strcmp(zid_name, zone_name) == 0)
3647 			continue;
3648 
3649 		if ((zone_getattr(zids[i], ZONE_ATTR_STATUS, &zid_state,
3650 		    sizeof (zid_state)) < 0) ||
3651 		    (zid_state < ZONE_IS_READY))
3652 			/* Skip over zones without mounted filesystems */
3653 			continue;
3654 
3655 		if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
3656 		    sizeof (m_label_t)) < 0)
3657 			/* Skip over zones with unspecified label */
3658 			continue;
3659 
3660 		if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
3661 		    sizeof (zid_rpath)) == -1)
3662 			/* Skip over zones with bad path */
3663 			continue;
3664 
3665 		if (zlabel != NULL && bldominates(zid_label, zlabel)) {
3666 			/*
3667 			 * This zone dominates our zone.
3668 			 * Unmount the lofs mount of our zone's /export/home
3669 			 */
3670 
3671 			if (snprintf(path, MAXPATHLEN,
3672 			    "%s/zone/%s/export/home", zid_rpath,
3673 			    zone_name) > MAXPATHLEN)
3674 				continue;
3675 
3676 			/* Skip over mount failures */
3677 			(void) umount(path);
3678 		}
3679 	}
3680 	free(zids);
3681 
3682 	/*
3683 	 * Unmount global zone autofs trigger for this zone
3684 	 */
3685 	(void) snprintf(path, MAXPATHLEN, "/zone/%s/home", zone_name);
3686 	/* Skip over mount failures */
3687 	(void) umount(path);
3688 
3689 	/*
3690 	 * Next unshare any exported directories from this zone.
3691 	 */
3692 
3693 	argv[0] = "zoneunshare";
3694 	argv[1] = "-z";
3695 	argv[2] = zone_name;
3696 	argv[3] = NULL;
3697 
3698 	(void) forkexec(zlogp, "/usr/lib/zones/zoneunshare", argv);
3699 	/* Don't check for errors since they don't affect the zone */
3700 
3701 	/*
3702 	 * Finally, deallocate any devices in the zone.
3703 	 */
3704 
3705 	argv[0] = "deallocate";
3706 	argv[1] = "-Isz";
3707 	argv[2] = zone_name;
3708 	argv[3] = NULL;
3709 
3710 	(void) forkexec(zlogp, "/usr/sbin/deallocate", argv);
3711 	/* Don't check for errors since they don't affect the zone */
3712 }
3713 
3714 /*
3715  * Fetch the Trusted Extensions label and multi-level ports (MLPs) for
3716  * this zone.
3717  */
3718 static tsol_zcent_t *
3719 get_zone_label(zlog_t *zlogp, priv_set_t *privs)
3720 {
3721 	FILE *fp;
3722 	tsol_zcent_t *zcent = NULL;
3723 	char line[MAXTNZLEN];
3724 
3725 	if ((fp = fopen(TNZONECFG_PATH, "r")) == NULL) {
3726 		zerror(zlogp, B_TRUE, "%s", TNZONECFG_PATH);
3727 		return (NULL);
3728 	}
3729 
3730 	while (fgets(line, sizeof (line), fp) != NULL) {
3731 		/*
3732 		 * Check for malformed database
3733 		 */
3734 		if (strlen(line) == MAXTNZLEN - 1)
3735 			break;
3736 		if ((zcent = tsol_sgetzcent(line, NULL, NULL)) == NULL)
3737 			continue;
3738 		if (strcmp(zcent->zc_name, zone_name) == 0)
3739 			break;
3740 		tsol_freezcent(zcent);
3741 		zcent = NULL;
3742 	}
3743 	(void) fclose(fp);
3744 
3745 	if (zcent == NULL) {
3746 		zerror(zlogp, B_FALSE, "zone requires a label assignment. "
3747 		    "See tnzonecfg(4)");
3748 	} else {
3749 		if (zlabel == NULL)
3750 			zlabel = m_label_alloc(MAC_LABEL);
3751 		/*
3752 		 * Save this zone's privileges for later read-down processing
3753 		 */
3754 		if ((zprivs = priv_allocset()) == NULL) {
3755 			zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
3756 			return (NULL);
3757 		} else {
3758 			priv_copyset(privs, zprivs);
3759 		}
3760 	}
3761 	return (zcent);
3762 }
3763 
3764 /*
3765  * Add the Trusted Extensions multi-level ports for this zone.
3766  */
3767 static void
3768 set_mlps(zlog_t *zlogp, zoneid_t zoneid, tsol_zcent_t *zcent)
3769 {
3770 	tsol_mlp_t *mlp;
3771 	tsol_mlpent_t tsme;
3772 
3773 	if (!is_system_labeled())
3774 		return;
3775 
3776 	tsme.tsme_zoneid = zoneid;
3777 	tsme.tsme_flags = 0;
3778 	for (mlp = zcent->zc_private_mlp; !TSOL_MLP_END(mlp); mlp++) {
3779 		tsme.tsme_mlp = *mlp;
3780 		if (tnmlp(TNDB_LOAD, &tsme) != 0) {
3781 			zerror(zlogp, B_TRUE, "cannot set zone-specific MLP "
3782 			    "on %d-%d/%d", mlp->mlp_port,
3783 			    mlp->mlp_port_upper, mlp->mlp_ipp);
3784 		}
3785 	}
3786 
3787 	tsme.tsme_flags = TSOL_MEF_SHARED;
3788 	for (mlp = zcent->zc_shared_mlp; !TSOL_MLP_END(mlp); mlp++) {
3789 		tsme.tsme_mlp = *mlp;
3790 		if (tnmlp(TNDB_LOAD, &tsme) != 0) {
3791 			zerror(zlogp, B_TRUE, "cannot set shared MLP "
3792 			    "on %d-%d/%d", mlp->mlp_port,
3793 			    mlp->mlp_port_upper, mlp->mlp_ipp);
3794 		}
3795 	}
3796 }
3797 
3798 static void
3799 remove_mlps(zlog_t *zlogp, zoneid_t zoneid)
3800 {
3801 	tsol_mlpent_t tsme;
3802 
3803 	if (!is_system_labeled())
3804 		return;
3805 
3806 	(void) memset(&tsme, 0, sizeof (tsme));
3807 	tsme.tsme_zoneid = zoneid;
3808 	if (tnmlp(TNDB_FLUSH, &tsme) != 0)
3809 		zerror(zlogp, B_TRUE, "cannot flush MLPs");
3810 }
3811 
3812 int
3813 prtmount(const char *fs, void *x) {
3814 	zerror((zlog_t *)x, B_FALSE, "  %s", fs);
3815 	return (0);
3816 }
3817 
3818 /*
3819  * Look for zones running on the main system that are using this root (or any
3820  * subdirectory of it).  Return B_TRUE and print an error if a conflicting zone
3821  * is found or if we can't tell.
3822  */
3823 static boolean_t
3824 duplicate_zone_root(zlog_t *zlogp, const char *rootpath)
3825 {
3826 	zoneid_t *zids = NULL;
3827 	uint_t nzids = 0;
3828 	boolean_t retv;
3829 	int rlen, zlen;
3830 	char zroot[MAXPATHLEN];
3831 	char zonename[ZONENAME_MAX];
3832 
3833 	for (;;) {
3834 		nzids += 10;
3835 		zids = malloc(nzids * sizeof (*zids));
3836 		if (zids == NULL) {
3837 			zerror(zlogp, B_TRUE, "memory allocation failed");
3838 			return (B_TRUE);
3839 		}
3840 		if (zone_list(zids, &nzids) == 0)
3841 			break;
3842 		free(zids);
3843 	}
3844 	retv = B_FALSE;
3845 	rlen = strlen(rootpath);
3846 	while (nzids > 0) {
3847 		/*
3848 		 * Ignore errors; they just mean that the zone has disappeared
3849 		 * while we were busy.
3850 		 */
3851 		if (zone_getattr(zids[--nzids], ZONE_ATTR_ROOT, zroot,
3852 		    sizeof (zroot)) == -1)
3853 			continue;
3854 		zlen = strlen(zroot);
3855 		if (zlen > rlen)
3856 			zlen = rlen;
3857 		if (strncmp(rootpath, zroot, zlen) == 0 &&
3858 		    (zroot[zlen] == '\0' || zroot[zlen] == '/') &&
3859 		    (rootpath[zlen] == '\0' || rootpath[zlen] == '/')) {
3860 			if (getzonenamebyid(zids[nzids], zonename,
3861 			    sizeof (zonename)) == -1)
3862 				(void) snprintf(zonename, sizeof (zonename),
3863 				    "id %d", (int)zids[nzids]);
3864 			zerror(zlogp, B_FALSE,
3865 			    "zone root %s already in use by zone %s",
3866 			    rootpath, zonename);
3867 			retv = B_TRUE;
3868 			break;
3869 		}
3870 	}
3871 	free(zids);
3872 	return (retv);
3873 }
3874 
3875 /*
3876  * Search for loopback mounts that use this same source node (same device and
3877  * inode).  Return B_TRUE if there is one or if we can't tell.
3878  */
3879 static boolean_t
3880 duplicate_reachable_path(zlog_t *zlogp, const char *rootpath)
3881 {
3882 	struct stat64 rst, zst;
3883 	struct mnttab *mnp;
3884 
3885 	if (stat64(rootpath, &rst) == -1) {
3886 		zerror(zlogp, B_TRUE, "can't stat %s", rootpath);
3887 		return (B_TRUE);
3888 	}
3889 	if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
3890 		return (B_TRUE);
3891 	for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max; mnp++) {
3892 		if (mnp->mnt_fstype == NULL ||
3893 		    strcmp(MNTTYPE_LOFS, mnp->mnt_fstype) != 0)
3894 			continue;
3895 		/* We're looking at a loopback mount.  Stat it. */
3896 		if (mnp->mnt_special != NULL &&
3897 		    stat64(mnp->mnt_special, &zst) != -1 &&
3898 		    rst.st_dev == zst.st_dev && rst.st_ino == zst.st_ino) {
3899 			zerror(zlogp, B_FALSE,
3900 			    "zone root %s is reachable through %s",
3901 			    rootpath, mnp->mnt_mountp);
3902 			return (B_TRUE);
3903 		}
3904 	}
3905 	return (B_FALSE);
3906 }
3907 
3908 /*
3909  * Set memory cap and pool info for the zone's resource management
3910  * configuration.
3911  */
3912 static int
3913 setup_zone_rm(zlog_t *zlogp, char *zone_name, zoneid_t zoneid)
3914 {
3915 	int res;
3916 	uint64_t tmp;
3917 	struct zone_mcaptab mcap;
3918 	char sched[MAXNAMELEN];
3919 	zone_dochandle_t handle = NULL;
3920 	char pool_err[128];
3921 
3922 	if ((handle = zonecfg_init_handle()) == NULL) {
3923 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
3924 		return (Z_BAD_HANDLE);
3925 	}
3926 
3927 	if ((res = zonecfg_get_snapshot_handle(zone_name, handle)) != Z_OK) {
3928 		zerror(zlogp, B_FALSE, "invalid configuration");
3929 		zonecfg_fini_handle(handle);
3930 		return (res);
3931 	}
3932 
3933 	/*
3934 	 * If a memory cap is configured, set the cap in the kernel using
3935 	 * zone_setattr() and make sure the rcapd SMF service is enabled.
3936 	 */
3937 	if (zonecfg_getmcapent(handle, &mcap) == Z_OK) {
3938 		uint64_t num;
3939 		char smf_err[128];
3940 
3941 		num = (uint64_t)strtoull(mcap.zone_physmem_cap, NULL, 10);
3942 		if (zone_setattr(zoneid, ZONE_ATTR_PHYS_MCAP, &num, 0) == -1) {
3943 			zerror(zlogp, B_TRUE, "could not set zone memory cap");
3944 			zonecfg_fini_handle(handle);
3945 			return (Z_INVAL);
3946 		}
3947 
3948 		if (zonecfg_enable_rcapd(smf_err, sizeof (smf_err)) != Z_OK) {
3949 			zerror(zlogp, B_FALSE, "enabling system/rcap service "
3950 			    "failed: %s", smf_err);
3951 			zonecfg_fini_handle(handle);
3952 			return (Z_INVAL);
3953 		}
3954 	}
3955 
3956 	/* Get the scheduling class set in the zone configuration. */
3957 	if (zonecfg_get_sched_class(handle, sched, sizeof (sched)) == Z_OK &&
3958 	    strlen(sched) > 0) {
3959 		if (zone_setattr(zoneid, ZONE_ATTR_SCHED_CLASS, sched,
3960 		    strlen(sched)) == -1)
3961 			zerror(zlogp, B_TRUE, "WARNING: unable to set the "
3962 			    "default scheduling class");
3963 
3964 	} else if (zonecfg_get_aliased_rctl(handle, ALIAS_SHARES, &tmp)
3965 	    == Z_OK) {
3966 		/*
3967 		 * If the zone has the zone.cpu-shares rctl set then we want to
3968 		 * use the Fair Share Scheduler (FSS) for processes in the
3969 		 * zone.  Check what scheduling class the zone would be running
3970 		 * in by default so we can print a warning and modify the class
3971 		 * if we wouldn't be using FSS.
3972 		 */
3973 		char class_name[PC_CLNMSZ];
3974 
3975 		if (zonecfg_get_dflt_sched_class(handle, class_name,
3976 		    sizeof (class_name)) != Z_OK) {
3977 			zerror(zlogp, B_FALSE, "WARNING: unable to determine "
3978 			    "the zone's scheduling class");
3979 
3980 		} else if (strcmp("FSS", class_name) != 0) {
3981 			zerror(zlogp, B_FALSE, "WARNING: The zone.cpu-shares "
3982 			    "rctl is set but\nFSS is not the default "
3983 			    "scheduling class for\nthis zone.  FSS will be "
3984 			    "used for processes\nin the zone but to get the "
3985 			    "full benefit of FSS,\nit should be the default "
3986 			    "scheduling class.\nSee dispadmin(1M) for more "
3987 			    "details.");
3988 
3989 			if (zone_setattr(zoneid, ZONE_ATTR_SCHED_CLASS, "FSS",
3990 			    strlen("FSS")) == -1)
3991 				zerror(zlogp, B_TRUE, "WARNING: unable to set "
3992 				    "zone scheduling class to FSS");
3993 		}
3994 	}
3995 
3996 	/*
3997 	 * The next few blocks of code attempt to set up temporary pools as
3998 	 * well as persistent pools.  In all cases we call the functions
3999 	 * unconditionally.  Within each funtion the code will check if the
4000 	 * zone is actually configured for a temporary pool or persistent pool
4001 	 * and just return if there is nothing to do.
4002 	 *
4003 	 * If we are rebooting we want to attempt to reuse any temporary pool
4004 	 * that was previously set up.  zonecfg_bind_tmp_pool() will do the
4005 	 * right thing in all cases (reuse or create) based on the current
4006 	 * zonecfg.
4007 	 */
4008 	if ((res = zonecfg_bind_tmp_pool(handle, zoneid, pool_err,
4009 	    sizeof (pool_err))) != Z_OK) {
4010 		if (res == Z_POOL || res == Z_POOL_CREATE || res == Z_POOL_BIND)
4011 			zerror(zlogp, B_FALSE, "%s: %s\ndedicated-cpu setting "
4012 			    "cannot be instantiated", zonecfg_strerror(res),
4013 			    pool_err);
4014 		else
4015 			zerror(zlogp, B_FALSE, "could not bind zone to "
4016 			    "temporary pool: %s", zonecfg_strerror(res));
4017 		zonecfg_fini_handle(handle);
4018 		return (Z_POOL_BIND);
4019 	}
4020 
4021 	/*
4022 	 * Check if we need to warn about poold not being enabled.
4023 	 */
4024 	if (zonecfg_warn_poold(handle)) {
4025 		zerror(zlogp, B_FALSE, "WARNING: A range of dedicated-cpus has "
4026 		    "been specified\nbut the dynamic pool service is not "
4027 		    "enabled.\nThe system will not dynamically adjust the\n"
4028 		    "processor allocation within the specified range\n"
4029 		    "until svc:/system/pools/dynamic is enabled.\n"
4030 		    "See poold(1M).");
4031 	}
4032 
4033 	/* The following is a warning, not an error. */
4034 	if ((res = zonecfg_bind_pool(handle, zoneid, pool_err,
4035 	    sizeof (pool_err))) != Z_OK) {
4036 		if (res == Z_POOL_BIND)
4037 			zerror(zlogp, B_FALSE, "WARNING: unable to bind to "
4038 			    "pool '%s'; using default pool.", pool_err);
4039 		else if (res == Z_POOL)
4040 			zerror(zlogp, B_FALSE, "WARNING: %s: %s",
4041 			    zonecfg_strerror(res), pool_err);
4042 		else
4043 			zerror(zlogp, B_FALSE, "WARNING: %s",
4044 			    zonecfg_strerror(res));
4045 	}
4046 
4047 	zonecfg_fini_handle(handle);
4048 	return (Z_OK);
4049 }
4050 
4051 zoneid_t
4052 vplat_create(zlog_t *zlogp, zone_mnt_t mount_cmd)
4053 {
4054 	zoneid_t rval = -1;
4055 	priv_set_t *privs;
4056 	char rootpath[MAXPATHLEN];
4057 	char modname[MAXPATHLEN];
4058 	struct brand_attr attr;
4059 	brand_handle_t bh;
4060 	char *rctlbuf = NULL;
4061 	size_t rctlbufsz = 0;
4062 	char *zfsbuf = NULL;
4063 	size_t zfsbufsz = 0;
4064 	zoneid_t zoneid = -1;
4065 	int xerr;
4066 	char *kzone;
4067 	FILE *fp = NULL;
4068 	tsol_zcent_t *zcent = NULL;
4069 	int match = 0;
4070 	int doi = 0;
4071 	int flags;
4072 	zone_iptype_t iptype;
4073 
4074 	if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
4075 		zerror(zlogp, B_TRUE, "unable to determine zone root");
4076 		return (-1);
4077 	}
4078 	if (zonecfg_in_alt_root())
4079 		resolve_lofs(zlogp, rootpath, sizeof (rootpath));
4080 
4081 	if (get_iptype(zlogp, &iptype) < 0) {
4082 		zerror(zlogp, B_TRUE, "unable to determine ip-type");
4083 		return (-1);
4084 	}
4085 	switch (iptype) {
4086 	case ZS_SHARED:
4087 		flags = 0;
4088 		break;
4089 	case ZS_EXCLUSIVE:
4090 		flags = ZCF_NET_EXCL;
4091 		break;
4092 	}
4093 
4094 	if ((privs = priv_allocset()) == NULL) {
4095 		zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
4096 		return (-1);
4097 	}
4098 	priv_emptyset(privs);
4099 	if (get_privset(zlogp, privs, mount_cmd) != 0)
4100 		goto error;
4101 
4102 	if (mount_cmd == Z_MNT_BOOT &&
4103 	    get_rctls(zlogp, &rctlbuf, &rctlbufsz) != 0) {
4104 		zerror(zlogp, B_FALSE, "Unable to get list of rctls");
4105 		goto error;
4106 	}
4107 
4108 	if (get_datasets(zlogp, &zfsbuf, &zfsbufsz) != 0) {
4109 		zerror(zlogp, B_FALSE, "Unable to get list of ZFS datasets");
4110 		goto error;
4111 	}
4112 
4113 	if (mount_cmd == Z_MNT_BOOT && is_system_labeled()) {
4114 		zcent = get_zone_label(zlogp, privs);
4115 		if (zcent != NULL) {
4116 			match = zcent->zc_match;
4117 			doi = zcent->zc_doi;
4118 			*zlabel = zcent->zc_label;
4119 		} else {
4120 			goto error;
4121 		}
4122 	}
4123 
4124 	kzone = zone_name;
4125 
4126 	/*
4127 	 * We must do this scan twice.  First, we look for zones running on the
4128 	 * main system that are using this root (or any subdirectory of it).
4129 	 * Next, we reduce to the shortest path and search for loopback mounts
4130 	 * that use this same source node (same device and inode).
4131 	 */
4132 	if (duplicate_zone_root(zlogp, rootpath))
4133 		goto error;
4134 	if (duplicate_reachable_path(zlogp, rootpath))
4135 		goto error;
4136 
4137 	if (ALT_MOUNT(mount_cmd)) {
4138 		assert(zone_isnative || zone_iscluster);
4139 		root_to_lu(zlogp, rootpath, sizeof (rootpath), B_TRUE);
4140 
4141 		/*
4142 		 * Forge up a special root for this zone.  When a zone is
4143 		 * mounted, we can't let the zone have its own root because the
4144 		 * tools that will be used in this "scratch zone" need access
4145 		 * to both the zone's resources and the running machine's
4146 		 * executables.
4147 		 *
4148 		 * Note that the mkdir here also catches read-only filesystems.
4149 		 */
4150 		if (mkdir(rootpath, 0755) != 0 && errno != EEXIST) {
4151 			zerror(zlogp, B_TRUE, "cannot create %s", rootpath);
4152 			goto error;
4153 		}
4154 		if (domount(zlogp, "tmpfs", "", "swap", rootpath) != 0)
4155 			goto error;
4156 	}
4157 
4158 	if (zonecfg_in_alt_root()) {
4159 		/*
4160 		 * If we are mounting up a zone in an alternate root partition,
4161 		 * then we have some additional work to do before starting the
4162 		 * zone.  First, resolve the root path down so that we're not
4163 		 * fooled by duplicates.  Then forge up an internal name for
4164 		 * the zone.
4165 		 */
4166 		if ((fp = zonecfg_open_scratch("", B_TRUE)) == NULL) {
4167 			zerror(zlogp, B_TRUE, "cannot open mapfile");
4168 			goto error;
4169 		}
4170 		if (zonecfg_lock_scratch(fp) != 0) {
4171 			zerror(zlogp, B_TRUE, "cannot lock mapfile");
4172 			goto error;
4173 		}
4174 		if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
4175 		    NULL, 0) == 0) {
4176 			zerror(zlogp, B_FALSE, "scratch zone already running");
4177 			goto error;
4178 		}
4179 		/* This is the preferred name */
4180 		(void) snprintf(kernzone, sizeof (kernzone), "SUNWlu-%s",
4181 		    zone_name);
4182 		srandom(getpid());
4183 		while (zonecfg_reverse_scratch(fp, kernzone, NULL, 0, NULL,
4184 		    0) == 0) {
4185 			/* This is just an arbitrary name; note "." usage */
4186 			(void) snprintf(kernzone, sizeof (kernzone),
4187 			    "SUNWlu.%08lX%08lX", random(), random());
4188 		}
4189 		kzone = kernzone;
4190 	}
4191 
4192 	xerr = 0;
4193 	if ((zoneid = zone_create(kzone, rootpath, privs, rctlbuf,
4194 	    rctlbufsz, zfsbuf, zfsbufsz, &xerr, match, doi, zlabel,
4195 	    flags)) == -1) {
4196 		if (xerr == ZE_AREMOUNTS) {
4197 			if (zonecfg_find_mounts(rootpath, NULL, NULL) < 1) {
4198 				zerror(zlogp, B_FALSE,
4199 				    "An unknown file-system is mounted on "
4200 				    "a subdirectory of %s", rootpath);
4201 			} else {
4202 
4203 				zerror(zlogp, B_FALSE,
4204 				    "These file-systems are mounted on "
4205 				    "subdirectories of %s:", rootpath);
4206 				(void) zonecfg_find_mounts(rootpath,
4207 				    prtmount, zlogp);
4208 			}
4209 		} else if (xerr == ZE_CHROOTED) {
4210 			zerror(zlogp, B_FALSE, "%s: "
4211 			    "cannot create a zone from a chrooted "
4212 			    "environment", "zone_create");
4213 		} else if (xerr == ZE_LABELINUSE) {
4214 			char zonename[ZONENAME_MAX];
4215 			(void) getzonenamebyid(getzoneidbylabel(zlabel),
4216 			    zonename, ZONENAME_MAX);
4217 			zerror(zlogp, B_FALSE, "The zone label is already "
4218 			    "used by the zone '%s'.", zonename);
4219 		} else {
4220 			zerror(zlogp, B_TRUE, "%s failed", "zone_create");
4221 		}
4222 		goto error;
4223 	}
4224 
4225 	if (zonecfg_in_alt_root() &&
4226 	    zonecfg_add_scratch(fp, zone_name, kernzone,
4227 	    zonecfg_get_root()) == -1) {
4228 		zerror(zlogp, B_TRUE, "cannot add mapfile entry");
4229 		goto error;
4230 	}
4231 
4232 	if ((zone_get_brand(zone_name, attr.ba_brandname,
4233 	    MAXNAMELEN) != Z_OK) ||
4234 	    (bh = brand_open(attr.ba_brandname)) == NULL) {
4235 		zerror(zlogp, B_FALSE, "unable to determine brand name");
4236 		return (-1);
4237 	}
4238 
4239 	/*
4240 	 * If this brand requires any kernel support, now is the time to
4241 	 * get it loaded and initialized.
4242 	 */
4243 	if (brand_get_modname(bh, modname, MAXPATHLEN) < 0) {
4244 		brand_close(bh);
4245 		zerror(zlogp, B_FALSE, "unable to determine brand kernel "
4246 		    "module");
4247 		return (-1);
4248 	}
4249 	brand_close(bh);
4250 
4251 	if (strlen(modname) > 0) {
4252 		(void) strlcpy(attr.ba_modname, modname, MAXPATHLEN);
4253 		if (zone_setattr(zoneid, ZONE_ATTR_BRAND, &attr,
4254 		    sizeof (attr) != 0)) {
4255 			zerror(zlogp, B_TRUE, "could not set zone brand "
4256 			    "attribute.");
4257 			goto error;
4258 		}
4259 	}
4260 
4261 	/*
4262 	 * The following actions are not performed when merely mounting a zone
4263 	 * for administrative use.
4264 	 */
4265 	if (mount_cmd == Z_MNT_BOOT) {
4266 		if (setup_zone_rm(zlogp, zone_name, zoneid) != Z_OK) {
4267 			(void) zone_shutdown(zoneid);
4268 			goto error;
4269 		}
4270 
4271 		set_mlps(zlogp, zoneid, zcent);
4272 	}
4273 
4274 	rval = zoneid;
4275 	zoneid = -1;
4276 
4277 error:
4278 	if (zoneid != -1)
4279 		(void) zone_destroy(zoneid);
4280 	if (rctlbuf != NULL)
4281 		free(rctlbuf);
4282 	priv_freeset(privs);
4283 	if (fp != NULL)
4284 		zonecfg_close_scratch(fp);
4285 	lofs_discard_mnttab();
4286 	if (zcent != NULL)
4287 		tsol_freezcent(zcent);
4288 	return (rval);
4289 }
4290 
4291 /*
4292  * Enter the zone and write a /etc/zones/index file there.  This allows
4293  * libzonecfg (and thus zoneadm) to report the UUID and potentially other zone
4294  * details from inside the zone.
4295  */
4296 static void
4297 write_index_file(zoneid_t zoneid)
4298 {
4299 	FILE *zef;
4300 	FILE *zet;
4301 	struct zoneent *zep;
4302 	pid_t child;
4303 	int tmpl_fd;
4304 	ctid_t ct;
4305 	int fd;
4306 	char uuidstr[UUID_PRINTABLE_STRING_LENGTH];
4307 
4308 	/* Locate the zone entry in the global zone's index file */
4309 	if ((zef = setzoneent()) == NULL)
4310 		return;
4311 	while ((zep = getzoneent_private(zef)) != NULL) {
4312 		if (strcmp(zep->zone_name, zone_name) == 0)
4313 			break;
4314 		free(zep);
4315 	}
4316 	endzoneent(zef);
4317 	if (zep == NULL)
4318 		return;
4319 
4320 	if ((tmpl_fd = init_template()) == -1) {
4321 		free(zep);
4322 		return;
4323 	}
4324 
4325 	if ((child = fork()) == -1) {
4326 		(void) ct_tmpl_clear(tmpl_fd);
4327 		(void) close(tmpl_fd);
4328 		free(zep);
4329 		return;
4330 	}
4331 
4332 	/* parent waits for child to finish */
4333 	if (child != 0) {
4334 		free(zep);
4335 		if (contract_latest(&ct) == -1)
4336 			ct = -1;
4337 		(void) ct_tmpl_clear(tmpl_fd);
4338 		(void) close(tmpl_fd);
4339 		(void) waitpid(child, NULL, 0);
4340 		(void) contract_abandon_id(ct);
4341 		return;
4342 	}
4343 
4344 	/* child enters zone and sets up index file */
4345 	(void) ct_tmpl_clear(tmpl_fd);
4346 	if (zone_enter(zoneid) != -1) {
4347 		(void) mkdir(ZONE_CONFIG_ROOT, ZONE_CONFIG_MODE);
4348 		(void) chown(ZONE_CONFIG_ROOT, ZONE_CONFIG_UID,
4349 		    ZONE_CONFIG_GID);
4350 		fd = open(ZONE_INDEX_FILE, O_WRONLY|O_CREAT|O_TRUNC,
4351 		    ZONE_INDEX_MODE);
4352 		if (fd != -1 && (zet = fdopen(fd, "w")) != NULL) {
4353 			(void) fchown(fd, ZONE_INDEX_UID, ZONE_INDEX_GID);
4354 			if (uuid_is_null(zep->zone_uuid))
4355 				uuidstr[0] = '\0';
4356 			else
4357 				uuid_unparse(zep->zone_uuid, uuidstr);
4358 			(void) fprintf(zet, "%s:%s:/:%s\n", zep->zone_name,
4359 			    zone_state_str(zep->zone_state),
4360 			    uuidstr);
4361 			(void) fclose(zet);
4362 		}
4363 	}
4364 	_exit(0);
4365 }
4366 
4367 int
4368 vplat_bringup(zlog_t *zlogp, zone_mnt_t mount_cmd, zoneid_t zoneid)
4369 {
4370 	char zonepath[MAXPATHLEN];
4371 
4372 	if (mount_cmd == Z_MNT_BOOT && validate_datasets(zlogp) != 0) {
4373 		lofs_discard_mnttab();
4374 		return (-1);
4375 	}
4376 
4377 	/*
4378 	 * Before we try to mount filesystems we need to create the
4379 	 * attribute backing store for /dev
4380 	 */
4381 	if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
4382 		lofs_discard_mnttab();
4383 		return (-1);
4384 	}
4385 	resolve_lofs(zlogp, zonepath, sizeof (zonepath));
4386 
4387 	/* Make /dev directory owned by root, grouped sys */
4388 	if (make_one_dir(zlogp, zonepath, "/dev", DEFAULT_DIR_MODE,
4389 	    0, 3) != 0) {
4390 		lofs_discard_mnttab();
4391 		return (-1);
4392 	}
4393 
4394 	if (mount_filesystems(zlogp, mount_cmd) != 0) {
4395 		lofs_discard_mnttab();
4396 		return (-1);
4397 	}
4398 
4399 	if (mount_cmd == Z_MNT_BOOT) {
4400 		zone_iptype_t iptype;
4401 
4402 		if (get_iptype(zlogp, &iptype) < 0) {
4403 			zerror(zlogp, B_TRUE, "unable to determine ip-type");
4404 			lofs_discard_mnttab();
4405 			return (-1);
4406 		}
4407 
4408 		switch (iptype) {
4409 		case ZS_SHARED:
4410 			/* Always do this to make lo0 get configured */
4411 			if (configure_shared_network_interfaces(zlogp) != 0) {
4412 				lofs_discard_mnttab();
4413 				return (-1);
4414 			}
4415 			break;
4416 		case ZS_EXCLUSIVE:
4417 			if (configure_exclusive_network_interfaces(zlogp) !=
4418 			    0) {
4419 				lofs_discard_mnttab();
4420 				return (-1);
4421 			}
4422 			break;
4423 		}
4424 	}
4425 
4426 	write_index_file(zoneid);
4427 
4428 	lofs_discard_mnttab();
4429 	return (0);
4430 }
4431 
4432 static int
4433 lu_root_teardown(zlog_t *zlogp)
4434 {
4435 	char zroot[MAXPATHLEN];
4436 
4437 	assert(zone_isnative || zone_iscluster);
4438 
4439 	if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
4440 		zerror(zlogp, B_FALSE, "unable to determine zone root");
4441 		return (-1);
4442 	}
4443 	root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
4444 
4445 	/*
4446 	 * At this point, the processes are gone, the filesystems (save the
4447 	 * root) are unmounted, and the zone is on death row.  But there may
4448 	 * still be creds floating about in the system that reference the
4449 	 * zone_t, and which pin down zone_rootvp causing this call to fail
4450 	 * with EBUSY.  Thus, we try for a little while before just giving up.
4451 	 * (How I wish this were not true, and umount2 just did the right
4452 	 * thing, or tmpfs supported MS_FORCE This is a gross hack.)
4453 	 */
4454 	if (umount2(zroot, MS_FORCE) != 0) {
4455 		if (errno == ENOTSUP && umount2(zroot, 0) == 0)
4456 			goto unmounted;
4457 		if (errno == EBUSY) {
4458 			int tries = 10;
4459 
4460 			while (--tries >= 0) {
4461 				(void) sleep(1);
4462 				if (umount2(zroot, 0) == 0)
4463 					goto unmounted;
4464 				if (errno != EBUSY)
4465 					break;
4466 			}
4467 		}
4468 		zerror(zlogp, B_TRUE, "unable to unmount '%s'", zroot);
4469 		return (-1);
4470 	}
4471 unmounted:
4472 
4473 	/*
4474 	 * Only zones in an alternate root environment have scratch zone
4475 	 * entries.
4476 	 */
4477 	if (zonecfg_in_alt_root()) {
4478 		FILE *fp;
4479 		int retv;
4480 
4481 		if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
4482 			zerror(zlogp, B_TRUE, "cannot open mapfile");
4483 			return (-1);
4484 		}
4485 		retv = -1;
4486 		if (zonecfg_lock_scratch(fp) != 0)
4487 			zerror(zlogp, B_TRUE, "cannot lock mapfile");
4488 		else if (zonecfg_delete_scratch(fp, kernzone) != 0)
4489 			zerror(zlogp, B_TRUE, "cannot delete map entry");
4490 		else
4491 			retv = 0;
4492 		zonecfg_close_scratch(fp);
4493 		return (retv);
4494 	} else {
4495 		return (0);
4496 	}
4497 }
4498 
4499 int
4500 vplat_teardown(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting)
4501 {
4502 	char *kzone;
4503 	zoneid_t zoneid;
4504 	int res;
4505 	char pool_err[128];
4506 	char zroot[MAXPATHLEN];
4507 	char cmdbuf[MAXPATHLEN];
4508 	char brand[MAXNAMELEN];
4509 	brand_handle_t bh = NULL;
4510 	ushort_t flags;
4511 
4512 	kzone = zone_name;
4513 	if (zonecfg_in_alt_root()) {
4514 		FILE *fp;
4515 
4516 		if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
4517 			zerror(zlogp, B_TRUE, "unable to open map file");
4518 			goto error;
4519 		}
4520 		if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
4521 		    kernzone, sizeof (kernzone)) != 0) {
4522 			zerror(zlogp, B_FALSE, "unable to find scratch zone");
4523 			zonecfg_close_scratch(fp);
4524 			goto error;
4525 		}
4526 		zonecfg_close_scratch(fp);
4527 		kzone = kernzone;
4528 	}
4529 
4530 	if ((zoneid = getzoneidbyname(kzone)) == ZONE_ID_UNDEFINED) {
4531 		if (!bringup_failure_recovery)
4532 			zerror(zlogp, B_TRUE, "unable to get zoneid");
4533 		if (unmount_cmd)
4534 			(void) lu_root_teardown(zlogp);
4535 		goto error;
4536 	}
4537 
4538 	if (zone_shutdown(zoneid) != 0) {
4539 		zerror(zlogp, B_TRUE, "unable to shutdown zone");
4540 		goto error;
4541 	}
4542 
4543 	/* Get the path to the root of this zone */
4544 	if (zone_get_zonepath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
4545 		zerror(zlogp, B_FALSE, "unable to determine zone root");
4546 		goto error;
4547 	}
4548 
4549 	/* Get a handle to the brand info for this zone */
4550 	if ((zone_get_brand(zone_name, brand, sizeof (brand)) != Z_OK) ||
4551 	    (bh = brand_open(brand)) == NULL) {
4552 		zerror(zlogp, B_FALSE, "unable to determine zone brand");
4553 		return (-1);
4554 	}
4555 	/*
4556 	 * If there is a brand 'halt' callback, execute it now to give the
4557 	 * brand a chance to cleanup any custom configuration.
4558 	 */
4559 	(void) strcpy(cmdbuf, EXEC_PREFIX);
4560 	if (brand_get_halt(bh, zone_name, zroot, cmdbuf + EXEC_LEN,
4561 	    sizeof (cmdbuf) - EXEC_LEN, 0, NULL) < 0) {
4562 		brand_close(bh);
4563 		zerror(zlogp, B_FALSE, "unable to determine branded zone's "
4564 		    "halt callback.");
4565 		goto error;
4566 	}
4567 	brand_close(bh);
4568 
4569 	if ((strlen(cmdbuf) > EXEC_LEN) &&
4570 	    (do_subproc(zlogp, cmdbuf) != Z_OK)) {
4571 		zerror(zlogp, B_FALSE, "%s failed", cmdbuf);
4572 		goto error;
4573 	}
4574 
4575 	if (!unmount_cmd) {
4576 		zone_iptype_t iptype;
4577 
4578 		if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
4579 		    sizeof (flags)) < 0) {
4580 			if (get_iptype(zlogp, &iptype) < 0) {
4581 				zerror(zlogp, B_TRUE, "unable to determine "
4582 				    "ip-type");
4583 				goto error;
4584 			}
4585 		} else {
4586 			if (flags & ZF_NET_EXCL)
4587 				iptype = ZS_EXCLUSIVE;
4588 			else
4589 				iptype = ZS_SHARED;
4590 		}
4591 
4592 		switch (iptype) {
4593 		case ZS_SHARED:
4594 			if (unconfigure_shared_network_interfaces(zlogp,
4595 			    zoneid) != 0) {
4596 				zerror(zlogp, B_FALSE, "unable to unconfigure "
4597 				    "network interfaces in zone");
4598 				goto error;
4599 			}
4600 			break;
4601 		case ZS_EXCLUSIVE:
4602 			if (unconfigure_exclusive_network_interfaces(zlogp,
4603 			    zoneid) != 0) {
4604 				zerror(zlogp, B_FALSE, "unable to unconfigure "
4605 				    "network interfaces in zone");
4606 				goto error;
4607 			}
4608 			break;
4609 		}
4610 	}
4611 
4612 	if (!unmount_cmd && tcp_abort_connections(zlogp, zoneid) != 0) {
4613 		zerror(zlogp, B_TRUE, "unable to abort TCP connections");
4614 		goto error;
4615 	}
4616 
4617 	/* destroy zconsole before umount /dev */
4618 	if (!unmount_cmd)
4619 		destroy_console_slave();
4620 
4621 	if (unmount_filesystems(zlogp, zoneid, unmount_cmd) != 0) {
4622 		zerror(zlogp, B_FALSE,
4623 		    "unable to unmount file systems in zone");
4624 		goto error;
4625 	}
4626 
4627 	/*
4628 	 * If we are rebooting then we normally don't want to destroy an
4629 	 * existing temporary pool at this point so that we can just reuse it
4630 	 * when the zone boots back up.  However, it is also possible we were
4631 	 * running with a temporary pool and the zone configuration has been
4632 	 * modified to no longer use a temporary pool.  In that case we need
4633 	 * to destroy the temporary pool now.  This case looks like the case
4634 	 * where we never had a temporary pool configured but
4635 	 * zonecfg_destroy_tmp_pool will do the right thing either way.
4636 	 */
4637 	if (!unmount_cmd) {
4638 		boolean_t destroy_tmp_pool = B_TRUE;
4639 
4640 		if (rebooting) {
4641 			struct zone_psettab pset_tab;
4642 			zone_dochandle_t handle;
4643 
4644 			if ((handle = zonecfg_init_handle()) != NULL &&
4645 			    zonecfg_get_handle(zone_name, handle) == Z_OK &&
4646 			    zonecfg_lookup_pset(handle, &pset_tab) == Z_OK)
4647 				destroy_tmp_pool = B_FALSE;
4648 
4649 			zonecfg_fini_handle(handle);
4650 		}
4651 
4652 		if (destroy_tmp_pool) {
4653 			if ((res = zonecfg_destroy_tmp_pool(zone_name, pool_err,
4654 			    sizeof (pool_err))) != Z_OK) {
4655 				if (res == Z_POOL)
4656 					zerror(zlogp, B_FALSE, pool_err);
4657 			}
4658 		}
4659 	}
4660 
4661 	remove_mlps(zlogp, zoneid);
4662 
4663 	if (zone_destroy(zoneid) != 0) {
4664 		zerror(zlogp, B_TRUE, "unable to destroy zone");
4665 		goto error;
4666 	}
4667 
4668 	/*
4669 	 * Special teardown for alternate boot environments: remove the tmpfs
4670 	 * root for the zone and then remove it from the map file.
4671 	 */
4672 	if (unmount_cmd && lu_root_teardown(zlogp) != 0)
4673 		goto error;
4674 
4675 	lofs_discard_mnttab();
4676 	return (0);
4677 
4678 error:
4679 	lofs_discard_mnttab();
4680 	return (-1);
4681 }
4682 
4683 /*
4684  * Common routine for driver_hold_link and driver_rele_link.
4685  * It invokes ioctl for a link like "ce*", for which the driver has been
4686  * enhanced to support DLDIOC{HOLD,RELE}VLAN.
4687  */
4688 static int
4689 driver_vlan_ioctl(const char *name, zoneid_t zoneid, int cmd)
4690 {
4691 	int		fd;
4692 	uint_t		ppa;
4693 	dld_hold_vlan_t	dhv;
4694 	struct strioctl istr;
4695 	char		providername[IFNAMSIZ];
4696 	char		path[MAXPATHLEN];
4697 
4698 	if (strlen(name) >= IFNAMSIZ) {
4699 		errno = EINVAL;
4700 		return (-1);
4701 	}
4702 
4703 	if (dlpi_parselink(name, providername, &ppa) != DLPI_SUCCESS) {
4704 		errno = EINVAL;
4705 		return (-1);
4706 	}
4707 
4708 	(void) snprintf(path, sizeof (path), "/dev/%s", providername);
4709 	fd = open(path, O_RDWR);
4710 	if (fd < 0)
4711 		return (-1);
4712 	bzero(&dhv, sizeof (dld_hold_vlan_t));
4713 	(void) strlcpy(dhv.dhv_name, name, IFNAMSIZ);
4714 	dhv.dhv_zid = zoneid;
4715 	dhv.dhv_docheck = B_FALSE;
4716 
4717 	istr.ic_cmd = cmd;
4718 	istr.ic_len = sizeof (dhv);
4719 	istr.ic_dp = (void *)&dhv;
4720 	istr.ic_timout = 0;
4721 
4722 	if (ioctl(fd, I_STR, &istr) < 0) {
4723 		int olderrno = errno;
4724 		(void) close(fd);
4725 		errno = olderrno;
4726 		return (-1);
4727 	}
4728 	(void) close(fd);
4729 	return (0);
4730 }
4731 
4732 /*
4733  * Hold a data-link where the style-2 datalink driver supports DLDIOCHOLDVLAN.
4734  */
4735 static int
4736 driver_hold_link(const char *name, zoneid_t zoneid)
4737 {
4738 	return (driver_vlan_ioctl(name, zoneid, DLDIOCHOLDVLAN));
4739 }
4740 
4741 /*
4742  * Release a data-link where the style-2 datalink driver supports
4743  * DLDIOC{HOLD,RELE}VLAN.
4744  */
4745 static int
4746 driver_rele_link(const char *name, zoneid_t zoneid)
4747 {
4748 	return (driver_vlan_ioctl(name, zoneid, DLDIOCRELEVLAN));
4749 }
4750