xref: /titanic_50/usr/src/cmd/zoneadmd/zoneadmd.c (revision 2b24ab6b3865caeede9eeb9db6b83e1d89dcd1ea)
17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
5ffbafc53Scomay  * Common Development and Distribution License (the "License").
6ffbafc53Scomay  * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate  * and limitations under the License.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * CDDL HEADER END
207c478bd9Sstevel@tonic-gate  */
21ffbafc53Scomay 
227c478bd9Sstevel@tonic-gate /*
239d5056eaSjv227347  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
247c478bd9Sstevel@tonic-gate  * Use is subject to license terms.
257c478bd9Sstevel@tonic-gate  */
267c478bd9Sstevel@tonic-gate 
277c478bd9Sstevel@tonic-gate /*
287c478bd9Sstevel@tonic-gate  * zoneadmd manages zones; one zoneadmd process is launched for each
297c478bd9Sstevel@tonic-gate  * non-global zone on the system.  This daemon juggles four jobs:
307c478bd9Sstevel@tonic-gate  *
317c478bd9Sstevel@tonic-gate  * - Implement setup and teardown of the zone "virtual platform": mount and
327c478bd9Sstevel@tonic-gate  *   unmount filesystems; create and destroy network interfaces; communicate
337c478bd9Sstevel@tonic-gate  *   with devfsadmd to lay out devices for the zone; instantiate the zone
347c478bd9Sstevel@tonic-gate  *   console device; configure process runtime attributes such as resource
357c478bd9Sstevel@tonic-gate  *   controls, pool bindings, fine-grained privileges.
367c478bd9Sstevel@tonic-gate  *
377c478bd9Sstevel@tonic-gate  * - Launch the zone's init(1M) process.
387c478bd9Sstevel@tonic-gate  *
397c478bd9Sstevel@tonic-gate  * - Implement a door server; clients (like zoneadm) connect to the door
407c478bd9Sstevel@tonic-gate  *   server and request zone state changes.  The kernel is also a client of
417c478bd9Sstevel@tonic-gate  *   this door server.  A request to halt or reboot the zone which originates
427c478bd9Sstevel@tonic-gate  *   *inside* the zone results in a door upcall from the kernel into zoneadmd.
437c478bd9Sstevel@tonic-gate  *
447c478bd9Sstevel@tonic-gate  *   One minor problem is that messages emitted by zoneadmd need to be passed
457c478bd9Sstevel@tonic-gate  *   back to the zoneadm process making the request.  These messages need to
467c478bd9Sstevel@tonic-gate  *   be rendered in the client's locale; so, this is passed in as part of the
477c478bd9Sstevel@tonic-gate  *   request.  The exception is the kernel upcall to zoneadmd, in which case
487c478bd9Sstevel@tonic-gate  *   messages are syslog'd.
497c478bd9Sstevel@tonic-gate  *
507c478bd9Sstevel@tonic-gate  *   To make all of this work, the Makefile adds -a to xgettext to extract *all*
517c478bd9Sstevel@tonic-gate  *   strings, and an exclusion file (zoneadmd.xcl) is used to exclude those
527c478bd9Sstevel@tonic-gate  *   strings which do not need to be translated.
537c478bd9Sstevel@tonic-gate  *
547c478bd9Sstevel@tonic-gate  * - Act as a console server for zlogin -C processes; see comments in zcons.c
557c478bd9Sstevel@tonic-gate  *   for more information about the zone console architecture.
567c478bd9Sstevel@tonic-gate  *
577c478bd9Sstevel@tonic-gate  * DESIGN NOTES
587c478bd9Sstevel@tonic-gate  *
597c478bd9Sstevel@tonic-gate  * Restart:
607c478bd9Sstevel@tonic-gate  *   A chief design constraint of zoneadmd is that it should be restartable in
617c478bd9Sstevel@tonic-gate  *   the case that the administrator kills it off, or it suffers a fatal error,
627c478bd9Sstevel@tonic-gate  *   without the running zone being impacted; this is akin to being able to
637c478bd9Sstevel@tonic-gate  *   reboot the service processor of a server without affecting the OS instance.
647c478bd9Sstevel@tonic-gate  */
657c478bd9Sstevel@tonic-gate 
667c478bd9Sstevel@tonic-gate #include <sys/param.h>
677c478bd9Sstevel@tonic-gate #include <sys/mman.h>
687c478bd9Sstevel@tonic-gate #include <sys/types.h>
697c478bd9Sstevel@tonic-gate #include <sys/stat.h>
707c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h>
717c478bd9Sstevel@tonic-gate 
727c478bd9Sstevel@tonic-gate #include <bsm/adt.h>
737c478bd9Sstevel@tonic-gate #include <bsm/adt_event.h>
747c478bd9Sstevel@tonic-gate 
757c478bd9Sstevel@tonic-gate #include <alloca.h>
767c478bd9Sstevel@tonic-gate #include <assert.h>
777c478bd9Sstevel@tonic-gate #include <errno.h>
787c478bd9Sstevel@tonic-gate #include <door.h>
797c478bd9Sstevel@tonic-gate #include <fcntl.h>
807c478bd9Sstevel@tonic-gate #include <locale.h>
817c478bd9Sstevel@tonic-gate #include <signal.h>
827c478bd9Sstevel@tonic-gate #include <stdarg.h>
837c478bd9Sstevel@tonic-gate #include <stdio.h>
847c478bd9Sstevel@tonic-gate #include <stdlib.h>
857c478bd9Sstevel@tonic-gate #include <string.h>
867c478bd9Sstevel@tonic-gate #include <strings.h>
877c478bd9Sstevel@tonic-gate #include <synch.h>
887c478bd9Sstevel@tonic-gate #include <syslog.h>
897c478bd9Sstevel@tonic-gate #include <thread.h>
907c478bd9Sstevel@tonic-gate #include <unistd.h>
917c478bd9Sstevel@tonic-gate #include <wait.h>
927c478bd9Sstevel@tonic-gate #include <limits.h>
937c478bd9Sstevel@tonic-gate #include <zone.h>
949acbbeafSnn35248 #include <libbrand.h>
950679f794S #include <sys/brand.h>
967c478bd9Sstevel@tonic-gate #include <libcontract.h>
977c478bd9Sstevel@tonic-gate #include <libcontract_priv.h>
987c478bd9Sstevel@tonic-gate #include <sys/contract/process.h>
997c478bd9Sstevel@tonic-gate #include <sys/ctfs.h>
100*2b24ab6bSSebastien Roy #include <libdladm.h>
101*2b24ab6bSSebastien Roy #include <sys/dls_mgmt.h>
1027c478bd9Sstevel@tonic-gate 
1037c478bd9Sstevel@tonic-gate #include <libzonecfg.h>
1047c478bd9Sstevel@tonic-gate #include "zoneadmd.h"
1057c478bd9Sstevel@tonic-gate 
1067c478bd9Sstevel@tonic-gate static char *progname;
1077c478bd9Sstevel@tonic-gate char *zone_name;	/* zone which we are managing */
1089acbbeafSnn35248 char brand_name[MAXNAMELEN];
1099acbbeafSnn35248 boolean_t zone_isnative;
11084561e8cStd153743 boolean_t zone_iscluster;
1119a5d73e0SRic Aleshire boolean_t zone_islabeled;
112108322fbScarlsonj static zoneid_t zone_id;
1134ac67f02SAnurag S. Maskey dladm_handle_t dld_handle = NULL;
1147c478bd9Sstevel@tonic-gate 
115c5cd6260S static char pre_statechg_hook[2 * MAXPATHLEN];
116c5cd6260S static char post_statechg_hook[2 * MAXPATHLEN];
117c5cd6260S char query_hook[2 * MAXPATHLEN];
118c5cd6260S 
11922321485Svp157776 zlog_t logsys;
1207c478bd9Sstevel@tonic-gate 
1217c478bd9Sstevel@tonic-gate mutex_t	lock = DEFAULTMUTEX;	/* to serialize stuff */
1227c478bd9Sstevel@tonic-gate mutex_t	msglock = DEFAULTMUTEX;	/* for calling setlocale() */
1237c478bd9Sstevel@tonic-gate 
124108322fbScarlsonj static sema_t scratch_sem;	/* for scratch zones */
125108322fbScarlsonj 
1267c478bd9Sstevel@tonic-gate static char	zone_door_path[MAXPATHLEN];
1277c478bd9Sstevel@tonic-gate static int	zone_door = -1;
1287c478bd9Sstevel@tonic-gate 
1297c478bd9Sstevel@tonic-gate boolean_t in_death_throes = B_FALSE;	/* daemon is dying */
1307c478bd9Sstevel@tonic-gate boolean_t bringup_failure_recovery = B_FALSE; /* ignore certain failures */
1317c478bd9Sstevel@tonic-gate 
1327c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN)		/* should be defined by cc -D */
1337c478bd9Sstevel@tonic-gate #define	TEXT_DOMAIN	"SYS_TEST"	/* Use this only if it wasn't */
1347c478bd9Sstevel@tonic-gate #endif
1357c478bd9Sstevel@tonic-gate 
1367c478bd9Sstevel@tonic-gate #define	DEFAULT_LOCALE	"C"
1377c478bd9Sstevel@tonic-gate 
138108322fbScarlsonj static const char *
139108322fbScarlsonj z_cmd_name(zone_cmd_t zcmd)
140108322fbScarlsonj {
141108322fbScarlsonj 	/* This list needs to match the enum in sys/zone.h */
142108322fbScarlsonj 	static const char *zcmdstr[] = {
1439acbbeafSnn35248 		"ready", "boot", "forceboot", "reboot", "halt",
1449acbbeafSnn35248 		"note_uninstalling", "mount", "forcemount", "unmount"
145108322fbScarlsonj 	};
146108322fbScarlsonj 
147108322fbScarlsonj 	if (zcmd >= sizeof (zcmdstr) / sizeof (*zcmdstr))
148108322fbScarlsonj 		return ("unknown");
149108322fbScarlsonj 	else
150108322fbScarlsonj 		return (zcmdstr[(int)zcmd]);
151108322fbScarlsonj }
152108322fbScarlsonj 
1537c478bd9Sstevel@tonic-gate static char *
1547c478bd9Sstevel@tonic-gate get_execbasename(char *execfullname)
1557c478bd9Sstevel@tonic-gate {
1567c478bd9Sstevel@tonic-gate 	char *last_slash, *execbasename;
1577c478bd9Sstevel@tonic-gate 
1587c478bd9Sstevel@tonic-gate 	/* guard against '/' at end of command invocation */
1597c478bd9Sstevel@tonic-gate 	for (;;) {
1607c478bd9Sstevel@tonic-gate 		last_slash = strrchr(execfullname, '/');
1617c478bd9Sstevel@tonic-gate 		if (last_slash == NULL) {
1627c478bd9Sstevel@tonic-gate 			execbasename = execfullname;
1637c478bd9Sstevel@tonic-gate 			break;
1647c478bd9Sstevel@tonic-gate 		} else {
1657c478bd9Sstevel@tonic-gate 			execbasename = last_slash + 1;
1667c478bd9Sstevel@tonic-gate 			if (*execbasename == '\0') {
1677c478bd9Sstevel@tonic-gate 				*last_slash = '\0';
1687c478bd9Sstevel@tonic-gate 				continue;
1697c478bd9Sstevel@tonic-gate 			}
1707c478bd9Sstevel@tonic-gate 			break;
1717c478bd9Sstevel@tonic-gate 		}
1727c478bd9Sstevel@tonic-gate 	}
1737c478bd9Sstevel@tonic-gate 	return (execbasename);
1747c478bd9Sstevel@tonic-gate }
1757c478bd9Sstevel@tonic-gate 
1767c478bd9Sstevel@tonic-gate static void
1777c478bd9Sstevel@tonic-gate usage(void)
1787c478bd9Sstevel@tonic-gate {
1797c478bd9Sstevel@tonic-gate 	(void) fprintf(stderr, gettext("Usage: %s -z zonename\n"), progname);
1807c478bd9Sstevel@tonic-gate 	(void) fprintf(stderr,
1817c478bd9Sstevel@tonic-gate 	    gettext("\tNote: %s should not be run directly.\n"), progname);
1827c478bd9Sstevel@tonic-gate 	exit(2);
1837c478bd9Sstevel@tonic-gate }
1847c478bd9Sstevel@tonic-gate 
1857c478bd9Sstevel@tonic-gate /* ARGSUSED */
1867c478bd9Sstevel@tonic-gate static void
1877c478bd9Sstevel@tonic-gate sigchld(int sig)
1887c478bd9Sstevel@tonic-gate {
1897c478bd9Sstevel@tonic-gate }
1907c478bd9Sstevel@tonic-gate 
1917c478bd9Sstevel@tonic-gate char *
1927c478bd9Sstevel@tonic-gate localize_msg(char *locale, const char *msg)
1937c478bd9Sstevel@tonic-gate {
1947c478bd9Sstevel@tonic-gate 	char *out;
1957c478bd9Sstevel@tonic-gate 
1967c478bd9Sstevel@tonic-gate 	(void) mutex_lock(&msglock);
1977c478bd9Sstevel@tonic-gate 	(void) setlocale(LC_MESSAGES, locale);
1987c478bd9Sstevel@tonic-gate 	out = gettext(msg);
1997c478bd9Sstevel@tonic-gate 	(void) setlocale(LC_MESSAGES, DEFAULT_LOCALE);
2007c478bd9Sstevel@tonic-gate 	(void) mutex_unlock(&msglock);
2017c478bd9Sstevel@tonic-gate 	return (out);
2027c478bd9Sstevel@tonic-gate }
2037c478bd9Sstevel@tonic-gate 
2047c478bd9Sstevel@tonic-gate /* PRINTFLIKE3 */
2057c478bd9Sstevel@tonic-gate void
2067c478bd9Sstevel@tonic-gate zerror(zlog_t *zlogp, boolean_t use_strerror, const char *fmt, ...)
2077c478bd9Sstevel@tonic-gate {
2087c478bd9Sstevel@tonic-gate 	va_list alist;
2097c478bd9Sstevel@tonic-gate 	char buf[MAXPATHLEN * 2]; /* enough space for err msg with a path */
2107c478bd9Sstevel@tonic-gate 	char *bp;
2117c478bd9Sstevel@tonic-gate 	int saved_errno = errno;
2127c478bd9Sstevel@tonic-gate 
2137c478bd9Sstevel@tonic-gate 	if (zlogp == NULL)
2147c478bd9Sstevel@tonic-gate 		return;
2157c478bd9Sstevel@tonic-gate 	if (zlogp == &logsys)
2167c478bd9Sstevel@tonic-gate 		(void) snprintf(buf, sizeof (buf), "[zone '%s'] ",
2177c478bd9Sstevel@tonic-gate 		    zone_name);
2187c478bd9Sstevel@tonic-gate 	else
2197c478bd9Sstevel@tonic-gate 		buf[0] = '\0';
2207c478bd9Sstevel@tonic-gate 	bp = &(buf[strlen(buf)]);
2217c478bd9Sstevel@tonic-gate 
2227c478bd9Sstevel@tonic-gate 	/*
2237c478bd9Sstevel@tonic-gate 	 * In theory, the locale pointer should be set to either "C" or a
2247c478bd9Sstevel@tonic-gate 	 * char array, so it should never be NULL
2257c478bd9Sstevel@tonic-gate 	 */
2267c478bd9Sstevel@tonic-gate 	assert(zlogp->locale != NULL);
2277c478bd9Sstevel@tonic-gate 	/* Locale is per process, but we are multi-threaded... */
2287c478bd9Sstevel@tonic-gate 	fmt = localize_msg(zlogp->locale, fmt);
2297c478bd9Sstevel@tonic-gate 
2307c478bd9Sstevel@tonic-gate 	va_start(alist, fmt);
2317c478bd9Sstevel@tonic-gate 	(void) vsnprintf(bp, sizeof (buf) - (bp - buf), fmt, alist);
2327c478bd9Sstevel@tonic-gate 	va_end(alist);
2337c478bd9Sstevel@tonic-gate 	bp = &(buf[strlen(buf)]);
2347c478bd9Sstevel@tonic-gate 	if (use_strerror)
2357c478bd9Sstevel@tonic-gate 		(void) snprintf(bp, sizeof (buf) - (bp - buf), ": %s",
2367c478bd9Sstevel@tonic-gate 		    strerror(saved_errno));
2377c478bd9Sstevel@tonic-gate 	if (zlogp == &logsys) {
2387c478bd9Sstevel@tonic-gate 		(void) syslog(LOG_ERR, "%s", buf);
2397c478bd9Sstevel@tonic-gate 	} else if (zlogp->logfile != NULL) {
2407c478bd9Sstevel@tonic-gate 		(void) fprintf(zlogp->logfile, "%s\n", buf);
2417c478bd9Sstevel@tonic-gate 	} else {
2427c478bd9Sstevel@tonic-gate 		size_t buflen;
2437c478bd9Sstevel@tonic-gate 		size_t copylen;
2447c478bd9Sstevel@tonic-gate 
2457c478bd9Sstevel@tonic-gate 		buflen = snprintf(zlogp->log, zlogp->loglen, "%s\n", buf);
2467c478bd9Sstevel@tonic-gate 		copylen = MIN(buflen, zlogp->loglen);
2477c478bd9Sstevel@tonic-gate 		zlogp->log += copylen;
2487c478bd9Sstevel@tonic-gate 		zlogp->loglen -= copylen;
2497c478bd9Sstevel@tonic-gate 	}
2507c478bd9Sstevel@tonic-gate }
2517c478bd9Sstevel@tonic-gate 
2523f2f09c1Sdp /*
2533f2f09c1Sdp  * Emit a warning for any boot arguments which are unrecognized.  Since
2543f2f09c1Sdp  * Solaris boot arguments are getopt(3c) compatible (see kernel(1m)), we
2553f2f09c1Sdp  * put the arguments into an argv style array, use getopt to process them,
2563f2f09c1Sdp  * and put the resultant argument string back into outargs.
2573f2f09c1Sdp  *
2583f2f09c1Sdp  * During the filtering, we pull out any arguments which are truly "boot"
2593f2f09c1Sdp  * arguments, leaving only those which are to be passed intact to the
2603f2f09c1Sdp  * progenitor process.  The one we support at the moment is -i, which
2613f2f09c1Sdp  * indicates to the kernel which program should be launched as 'init'.
2623f2f09c1Sdp  *
2633f2f09c1Sdp  * A return of Z_INVAL indicates specifically that the arguments are
2643f2f09c1Sdp  * not valid; this is a non-fatal error.  Except for Z_OK, all other return
2653f2f09c1Sdp  * values are treated as fatal.
2663f2f09c1Sdp  */
2673f2f09c1Sdp static int
2683f2f09c1Sdp filter_bootargs(zlog_t *zlogp, const char *inargs, char *outargs,
2693f2f09c1Sdp     char *init_file, char *badarg)
2703f2f09c1Sdp {
2713f2f09c1Sdp 	int argc = 0, argc_save;
2723f2f09c1Sdp 	int i;
2733f2f09c1Sdp 	int err;
2743f2f09c1Sdp 	char *arg, *lasts, **argv = NULL, **argv_save;
2753f2f09c1Sdp 	char zonecfg_args[BOOTARGS_MAX];
2763f2f09c1Sdp 	char scratchargs[BOOTARGS_MAX], *sargs;
2773f2f09c1Sdp 	char c;
2783f2f09c1Sdp 
2793f2f09c1Sdp 	bzero(outargs, BOOTARGS_MAX);
2803f2f09c1Sdp 	bzero(badarg, BOOTARGS_MAX);
2813f2f09c1Sdp 
2823f2f09c1Sdp 	/*
2833f2f09c1Sdp 	 * If the user didn't specify transient boot arguments, check
2843f2f09c1Sdp 	 * to see if there were any specified in the zone configuration,
2853f2f09c1Sdp 	 * and use them if applicable.
2863f2f09c1Sdp 	 */
2873f2f09c1Sdp 	if (inargs == NULL || inargs[0] == '\0')  {
2883f2f09c1Sdp 		zone_dochandle_t handle;
2893f2f09c1Sdp 		if ((handle = zonecfg_init_handle()) == NULL) {
2903f2f09c1Sdp 			zerror(zlogp, B_TRUE,
2913f2f09c1Sdp 			    "getting zone configuration handle");
2923f2f09c1Sdp 			return (Z_BAD_HANDLE);
2933f2f09c1Sdp 		}
2943f2f09c1Sdp 		err = zonecfg_get_snapshot_handle(zone_name, handle);
2953f2f09c1Sdp 		if (err != Z_OK) {
2963f2f09c1Sdp 			zerror(zlogp, B_FALSE,
2973f2f09c1Sdp 			    "invalid configuration snapshot");
2983f2f09c1Sdp 			zonecfg_fini_handle(handle);
2993f2f09c1Sdp 			return (Z_BAD_HANDLE);
3003f2f09c1Sdp 		}
3013f2f09c1Sdp 
3023f2f09c1Sdp 		bzero(zonecfg_args, sizeof (zonecfg_args));
3033f2f09c1Sdp 		(void) zonecfg_get_bootargs(handle, zonecfg_args,
3043f2f09c1Sdp 		    sizeof (zonecfg_args));
3053f2f09c1Sdp 		inargs = zonecfg_args;
3063f2f09c1Sdp 		zonecfg_fini_handle(handle);
3073f2f09c1Sdp 	}
3083f2f09c1Sdp 
3093f2f09c1Sdp 	if (strlen(inargs) >= BOOTARGS_MAX) {
3103f2f09c1Sdp 		zerror(zlogp, B_FALSE, "boot argument string too long");
3113f2f09c1Sdp 		return (Z_INVAL);
3123f2f09c1Sdp 	}
3133f2f09c1Sdp 
3143f2f09c1Sdp 	(void) strlcpy(scratchargs, inargs, sizeof (scratchargs));
3153f2f09c1Sdp 	sargs = scratchargs;
3163f2f09c1Sdp 	while ((arg = strtok_r(sargs, " \t", &lasts)) != NULL) {
3173f2f09c1Sdp 		sargs = NULL;
3183f2f09c1Sdp 		argc++;
3193f2f09c1Sdp 	}
3203f2f09c1Sdp 
3213f2f09c1Sdp 	if ((argv = calloc(argc + 1, sizeof (char *))) == NULL) {
3223f2f09c1Sdp 		zerror(zlogp, B_FALSE, "memory allocation failed");
3233f2f09c1Sdp 		return (Z_NOMEM);
3243f2f09c1Sdp 	}
3253f2f09c1Sdp 
3263f2f09c1Sdp 	argv_save = argv;
3273f2f09c1Sdp 	argc_save = argc;
3283f2f09c1Sdp 
3293f2f09c1Sdp 	(void) strlcpy(scratchargs, inargs, sizeof (scratchargs));
3303f2f09c1Sdp 	sargs = scratchargs;
3313f2f09c1Sdp 	i = 0;
3323f2f09c1Sdp 	while ((arg = strtok_r(sargs, " \t", &lasts)) != NULL) {
3333f2f09c1Sdp 		sargs = NULL;
3343f2f09c1Sdp 		if ((argv[i] = strdup(arg)) == NULL) {
3353f2f09c1Sdp 			err = Z_NOMEM;
3363f2f09c1Sdp 			zerror(zlogp, B_FALSE, "memory allocation failed");
3373f2f09c1Sdp 			goto done;
3383f2f09c1Sdp 		}
3393f2f09c1Sdp 		i++;
3403f2f09c1Sdp 	}
3413f2f09c1Sdp 
3423f2f09c1Sdp 	/*
3433f2f09c1Sdp 	 * We preserve compatibility with the Solaris system boot behavior,
3443f2f09c1Sdp 	 * which allows:
3453f2f09c1Sdp 	 *
3463f2f09c1Sdp 	 * 	# reboot kernel/unix -s -m verbose
3473f2f09c1Sdp 	 *
3483f2f09c1Sdp 	 * In this example, kernel/unix tells the booter what file to
3493f2f09c1Sdp 	 * boot.  We don't want reboot in a zone to be gratuitously different,
3503f2f09c1Sdp 	 * so we silently ignore the boot file, if necessary.
3513f2f09c1Sdp 	 */
3523f2f09c1Sdp 	if (argv[0] == NULL)
3533f2f09c1Sdp 		goto done;
3543f2f09c1Sdp 
3553f2f09c1Sdp 	assert(argv[0][0] != ' ');
3563f2f09c1Sdp 	assert(argv[0][0] != '\t');
3573f2f09c1Sdp 
3583f2f09c1Sdp 	if (argv[0][0] != '-' && argv[0][0] != '\0') {
3593f2f09c1Sdp 		argv = &argv[1];
3603f2f09c1Sdp 		argc--;
3613f2f09c1Sdp 	}
3623f2f09c1Sdp 
3633f2f09c1Sdp 	optind = 0;
3643f2f09c1Sdp 	opterr = 0;
3653f2f09c1Sdp 	err = Z_OK;
3669acbbeafSnn35248 	while ((c = getopt(argc, argv, "fi:m:s")) != -1) {
3673f2f09c1Sdp 		switch (c) {
3683f2f09c1Sdp 		case 'i':
3693f2f09c1Sdp 			/*
3703f2f09c1Sdp 			 * -i is handled by the runtime and is not passed
3713f2f09c1Sdp 			 * along to userland
3723f2f09c1Sdp 			 */
3733f2f09c1Sdp 			(void) strlcpy(init_file, optarg, MAXPATHLEN);
3743f2f09c1Sdp 			break;
3759acbbeafSnn35248 		case 'f':
3769acbbeafSnn35248 			/* This has already been processed by zoneadm */
3779acbbeafSnn35248 			break;
3783f2f09c1Sdp 		case 'm':
3793f2f09c1Sdp 		case 's':
3803f2f09c1Sdp 			/* These pass through unmolested */
3813f2f09c1Sdp 			(void) snprintf(outargs, BOOTARGS_MAX,
3823f2f09c1Sdp 			    "%s -%c %s ", outargs, c, optarg ? optarg : "");
3833f2f09c1Sdp 			break;
3843f2f09c1Sdp 		case '?':
3853f2f09c1Sdp 			/*
3863f2f09c1Sdp 			 * We warn about unknown arguments but pass them
3873f2f09c1Sdp 			 * along anyway-- if someone wants to develop their
3883f2f09c1Sdp 			 * own init replacement, they can pass it whatever
3893f2f09c1Sdp 			 * args they want.
3903f2f09c1Sdp 			 */
3913f2f09c1Sdp 			err = Z_INVAL;
3923f2f09c1Sdp 			(void) snprintf(outargs, BOOTARGS_MAX,
3933f2f09c1Sdp 			    "%s -%c", outargs, optopt);
3943f2f09c1Sdp 			(void) snprintf(badarg, BOOTARGS_MAX,
3953f2f09c1Sdp 			    "%s -%c", badarg, optopt);
3963f2f09c1Sdp 			break;
3973f2f09c1Sdp 		}
3983f2f09c1Sdp 	}
3993f2f09c1Sdp 
4003f2f09c1Sdp 	/*
4013f2f09c1Sdp 	 * For Solaris Zones we warn about and discard non-option arguments.
4023f2f09c1Sdp 	 * Hence 'boot foo bar baz gub' --> 'boot'.  However, to be similar
4033f2f09c1Sdp 	 * to the kernel, we concat up all the other remaining boot args.
4043f2f09c1Sdp 	 * and warn on them as a group.
4053f2f09c1Sdp 	 */
4063f2f09c1Sdp 	if (optind < argc) {
4073f2f09c1Sdp 		err = Z_INVAL;
4083f2f09c1Sdp 		while (optind < argc) {
4093f2f09c1Sdp 			(void) snprintf(badarg, BOOTARGS_MAX, "%s%s%s",
4103f2f09c1Sdp 			    badarg, strlen(badarg) > 0 ? " " : "",
4113f2f09c1Sdp 			    argv[optind]);
4123f2f09c1Sdp 			optind++;
4133f2f09c1Sdp 		}
4143f2f09c1Sdp 		zerror(zlogp, B_FALSE, "WARNING: Unused or invalid boot "
4153f2f09c1Sdp 		    "arguments `%s'.", badarg);
4163f2f09c1Sdp 	}
4173f2f09c1Sdp 
4183f2f09c1Sdp done:
4193f2f09c1Sdp 	for (i = 0; i < argc_save; i++) {
4203f2f09c1Sdp 		if (argv_save[i] != NULL)
4213f2f09c1Sdp 			free(argv_save[i]);
4223f2f09c1Sdp 	}
4233f2f09c1Sdp 	free(argv_save);
4243f2f09c1Sdp 	return (err);
4253f2f09c1Sdp }
4263f2f09c1Sdp 
4273f2f09c1Sdp 
4287c478bd9Sstevel@tonic-gate static int
4297c478bd9Sstevel@tonic-gate mkzonedir(zlog_t *zlogp)
4307c478bd9Sstevel@tonic-gate {
4317c478bd9Sstevel@tonic-gate 	struct stat st;
4327c478bd9Sstevel@tonic-gate 	/*
4337c478bd9Sstevel@tonic-gate 	 * We must create and lock everyone but root out of ZONES_TMPDIR
4347c478bd9Sstevel@tonic-gate 	 * since anyone can open any UNIX domain socket, regardless of
4357c478bd9Sstevel@tonic-gate 	 * its file system permissions.  Sigh...
4367c478bd9Sstevel@tonic-gate 	 */
4377c478bd9Sstevel@tonic-gate 	if (mkdir(ZONES_TMPDIR, S_IRWXU) < 0 && errno != EEXIST) {
4387c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "could not mkdir '%s'", ZONES_TMPDIR);
4397c478bd9Sstevel@tonic-gate 		return (-1);
4407c478bd9Sstevel@tonic-gate 	}
4417c478bd9Sstevel@tonic-gate 	/* paranoia */
4424bc0a2efScasper 	if ((stat(ZONES_TMPDIR, &st) < 0) || !S_ISDIR(st.st_mode)) {
4437c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "'%s' is not a directory", ZONES_TMPDIR);
4447c478bd9Sstevel@tonic-gate 		return (-1);
4457c478bd9Sstevel@tonic-gate 	}
4467c478bd9Sstevel@tonic-gate 	(void) chmod(ZONES_TMPDIR, S_IRWXU);
4477c478bd9Sstevel@tonic-gate 	return (0);
4487c478bd9Sstevel@tonic-gate }
4497c478bd9Sstevel@tonic-gate 
450108322fbScarlsonj /*
451c5cd6260S  * Run the brand's pre-state change callback, if it exists.
452c5cd6260S  */
453c5cd6260S static int
454c5cd6260S brand_prestatechg(zlog_t *zlogp, int state, int cmd)
455c5cd6260S {
456c5cd6260S 	char cmdbuf[2 * MAXPATHLEN];
457c5cd6260S 
458c5cd6260S 	if (pre_statechg_hook[0] == '\0')
459c5cd6260S 		return (0);
460c5cd6260S 
461c5cd6260S 	if (snprintf(cmdbuf, sizeof (cmdbuf), "%s %d %d", pre_statechg_hook,
462c5cd6260S 	    state, cmd) > sizeof (cmdbuf))
463c5cd6260S 		return (-1);
464c5cd6260S 
465c5cd6260S 	if (do_subproc(zlogp, cmdbuf, NULL) != 0)
466c5cd6260S 		return (-1);
467c5cd6260S 
468c5cd6260S 	return (0);
469c5cd6260S }
470c5cd6260S 
471c5cd6260S /*
472c5cd6260S  * Run the brand's post-state change callback, if it exists.
473c5cd6260S  */
474c5cd6260S static int
475c5cd6260S brand_poststatechg(zlog_t *zlogp, int state, int cmd)
476c5cd6260S {
477c5cd6260S 	char cmdbuf[2 * MAXPATHLEN];
478c5cd6260S 
479c5cd6260S 	if (post_statechg_hook[0] == '\0')
480c5cd6260S 		return (0);
481c5cd6260S 
482c5cd6260S 	if (snprintf(cmdbuf, sizeof (cmdbuf), "%s %d %d", post_statechg_hook,
483c5cd6260S 	    state, cmd) > sizeof (cmdbuf))
484c5cd6260S 		return (-1);
485c5cd6260S 
486c5cd6260S 	if (do_subproc(zlogp, cmdbuf, NULL) != 0)
487c5cd6260S 		return (-1);
488c5cd6260S 
489c5cd6260S 	return (0);
490c5cd6260S }
491c5cd6260S 
492c5cd6260S /*
493108322fbScarlsonj  * Bring a zone up to the pre-boot "ready" stage.  The mount_cmd argument is
494108322fbScarlsonj  * 'true' if this is being invoked as part of the processing for the "mount"
495108322fbScarlsonj  * subcommand.
496108322fbScarlsonj  */
497108322fbScarlsonj static int
498c5cd6260S zone_ready(zlog_t *zlogp, zone_mnt_t mount_cmd, int zstate)
4997c478bd9Sstevel@tonic-gate {
5007c478bd9Sstevel@tonic-gate 	int err;
5017c478bd9Sstevel@tonic-gate 
502c5cd6260S 	if (brand_prestatechg(zlogp, zstate, Z_READY) != 0)
503c5cd6260S 		return (-1);
504c5cd6260S 
5057c478bd9Sstevel@tonic-gate 	if ((err = zonecfg_create_snapshot(zone_name)) != Z_OK) {
5067c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_FALSE, "unable to create snapshot: %s",
5077c478bd9Sstevel@tonic-gate 		    zonecfg_strerror(err));
5088fe9fdf2SDan Price 		goto bad;
5097c478bd9Sstevel@tonic-gate 	}
5107c478bd9Sstevel@tonic-gate 
511108322fbScarlsonj 	if ((zone_id = vplat_create(zlogp, mount_cmd)) == -1) {
5127c478bd9Sstevel@tonic-gate 		if ((err = zonecfg_destroy_snapshot(zone_name)) != Z_OK)
5137c478bd9Sstevel@tonic-gate 			zerror(zlogp, B_FALSE, "destroying snapshot: %s",
5147c478bd9Sstevel@tonic-gate 			    zonecfg_strerror(err));
5158fe9fdf2SDan Price 		goto bad;
5167c478bd9Sstevel@tonic-gate 	}
517555afedfScarlsonj 	if (vplat_bringup(zlogp, mount_cmd, zone_id) != 0) {
5187c478bd9Sstevel@tonic-gate 		bringup_failure_recovery = B_TRUE;
5196cfd72c6Sgjelinek 		(void) vplat_teardown(NULL, (mount_cmd != Z_MNT_BOOT), B_FALSE);
5207c478bd9Sstevel@tonic-gate 		if ((err = zonecfg_destroy_snapshot(zone_name)) != Z_OK)
5217c478bd9Sstevel@tonic-gate 			zerror(zlogp, B_FALSE, "destroying snapshot: %s",
5227c478bd9Sstevel@tonic-gate 			    zonecfg_strerror(err));
5238fe9fdf2SDan Price 		goto bad;
5247c478bd9Sstevel@tonic-gate 	}
5257c478bd9Sstevel@tonic-gate 
526c5cd6260S 	if (brand_poststatechg(zlogp, zstate, Z_READY) != 0)
5278fe9fdf2SDan Price 		goto bad;
528c5cd6260S 
5297c478bd9Sstevel@tonic-gate 	return (0);
5308fe9fdf2SDan Price 
5318fe9fdf2SDan Price bad:
5328fe9fdf2SDan Price 	/*
5338fe9fdf2SDan Price 	 * If something goes wrong, we up the zones's state to the target
5348fe9fdf2SDan Price 	 * state, READY, and then invoke the hook as if we're halting.
5358fe9fdf2SDan Price 	 */
5368fe9fdf2SDan Price 	(void) brand_poststatechg(zlogp, ZONE_STATE_READY, Z_HALT);
5378fe9fdf2SDan Price 	return (-1);
5387c478bd9Sstevel@tonic-gate }
5397c478bd9Sstevel@tonic-gate 
540555afedfScarlsonj int
541555afedfScarlsonj init_template(void)
5427c478bd9Sstevel@tonic-gate {
5437c478bd9Sstevel@tonic-gate 	int fd;
5447c478bd9Sstevel@tonic-gate 	int err = 0;
5457c478bd9Sstevel@tonic-gate 
5467c478bd9Sstevel@tonic-gate 	fd = open64(CTFS_ROOT "/process/template", O_RDWR);
5477c478bd9Sstevel@tonic-gate 	if (fd == -1)
5487c478bd9Sstevel@tonic-gate 		return (-1);
5497c478bd9Sstevel@tonic-gate 
5507c478bd9Sstevel@tonic-gate 	/*
5517c478bd9Sstevel@tonic-gate 	 * For now, zoneadmd doesn't do anything with the contract.
5527c478bd9Sstevel@tonic-gate 	 * Deliver no events, don't inherit, and allow it to be orphaned.
5537c478bd9Sstevel@tonic-gate 	 */
5547c478bd9Sstevel@tonic-gate 	err |= ct_tmpl_set_critical(fd, 0);
5557c478bd9Sstevel@tonic-gate 	err |= ct_tmpl_set_informative(fd, 0);
5567c478bd9Sstevel@tonic-gate 	err |= ct_pr_tmpl_set_fatal(fd, CT_PR_EV_HWERR);
5577c478bd9Sstevel@tonic-gate 	err |= ct_pr_tmpl_set_param(fd, CT_PR_PGRPONLY | CT_PR_REGENT);
5587c478bd9Sstevel@tonic-gate 	if (err || ct_tmpl_activate(fd)) {
5597c478bd9Sstevel@tonic-gate 		(void) close(fd);
5607c478bd9Sstevel@tonic-gate 		return (-1);
5617c478bd9Sstevel@tonic-gate 	}
5627c478bd9Sstevel@tonic-gate 
5637c478bd9Sstevel@tonic-gate 	return (fd);
5647c478bd9Sstevel@tonic-gate }
5657c478bd9Sstevel@tonic-gate 
5669acbbeafSnn35248 typedef struct fs_callback {
5679acbbeafSnn35248 	zlog_t		*zlogp;
5689acbbeafSnn35248 	zoneid_t	zoneid;
569910f48daSedp 	boolean_t	mount_cmd;
5709acbbeafSnn35248 } fs_callback_t;
5719acbbeafSnn35248 
5727c478bd9Sstevel@tonic-gate static int
5739acbbeafSnn35248 mount_early_fs(void *data, const char *spec, const char *dir,
5749acbbeafSnn35248     const char *fstype, const char *opt)
5757c478bd9Sstevel@tonic-gate {
5769acbbeafSnn35248 	zlog_t *zlogp = ((fs_callback_t *)data)->zlogp;
5779acbbeafSnn35248 	zoneid_t zoneid = ((fs_callback_t *)data)->zoneid;
578910f48daSedp 	boolean_t mount_cmd = ((fs_callback_t *)data)->mount_cmd;
579d314f035Sedp 	char rootpath[MAXPATHLEN];
5807c478bd9Sstevel@tonic-gate 	pid_t child;
5817c478bd9Sstevel@tonic-gate 	int child_status;
5827c478bd9Sstevel@tonic-gate 	int tmpl_fd;
583d314f035Sedp 	int rv;
5847c478bd9Sstevel@tonic-gate 	ctid_t ct;
5857c478bd9Sstevel@tonic-gate 
586910f48daSedp 	/* determine the zone rootpath */
587910f48daSedp 	if (mount_cmd) {
588910f48daSedp 		char zonepath[MAXPATHLEN];
589910f48daSedp 		char luroot[MAXPATHLEN];
590910f48daSedp 
591910f48daSedp 		if (zone_get_zonepath(zone_name,
592910f48daSedp 		    zonepath, sizeof (zonepath)) != Z_OK) {
593910f48daSedp 			zerror(zlogp, B_FALSE, "unable to determine zone path");
594910f48daSedp 			return (-1);
595910f48daSedp 		}
596910f48daSedp 
597910f48daSedp 		(void) snprintf(luroot, sizeof (luroot), "%s/lu", zonepath);
598910f48daSedp 		resolve_lofs(zlogp, luroot, sizeof (luroot));
599910f48daSedp 		(void) strlcpy(rootpath, luroot, sizeof (rootpath));
600910f48daSedp 	} else {
601910f48daSedp 		if (zone_get_rootpath(zone_name,
602910f48daSedp 		    rootpath, sizeof (rootpath)) != Z_OK) {
603d314f035Sedp 			zerror(zlogp, B_FALSE, "unable to determine zone root");
604d314f035Sedp 			return (-1);
605d314f035Sedp 		}
606910f48daSedp 	}
607d314f035Sedp 
608d314f035Sedp 	if ((rv = valid_mount_path(zlogp, rootpath, spec, dir, fstype)) < 0) {
609d314f035Sedp 		zerror(zlogp, B_FALSE, "%s%s is not a valid mount point",
610d314f035Sedp 		    rootpath, dir);
611d314f035Sedp 		return (-1);
612d314f035Sedp 	} else if (rv > 0) {
613d314f035Sedp 		/* The mount point path doesn't exist, create it now. */
614d314f035Sedp 		if (make_one_dir(zlogp, rootpath, dir,
615d314f035Sedp 		    DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
616d314f035Sedp 		    DEFAULT_DIR_GROUP) != 0) {
617d314f035Sedp 			zerror(zlogp, B_FALSE, "failed to create mount point");
618d314f035Sedp 			return (-1);
619d314f035Sedp 		}
620d314f035Sedp 
621d314f035Sedp 		/*
622d314f035Sedp 		 * Now this might seem weird, but we need to invoke
623d314f035Sedp 		 * valid_mount_path() again.  Why?  Because it checks
624d314f035Sedp 		 * to make sure that the mount point path is canonical,
625d314f035Sedp 		 * which it can only do if the path exists, so now that
626d314f035Sedp 		 * we've created the path we have to verify it again.
627d314f035Sedp 		 */
628d314f035Sedp 		if ((rv = valid_mount_path(zlogp, rootpath, spec, dir,
629d314f035Sedp 		    fstype)) < 0) {
630d314f035Sedp 			zerror(zlogp, B_FALSE,
631d314f035Sedp 			    "%s%s is not a valid mount point", rootpath, dir);
632d314f035Sedp 			return (-1);
633d314f035Sedp 		}
634d314f035Sedp 	}
635d314f035Sedp 
6367c478bd9Sstevel@tonic-gate 	if ((tmpl_fd = init_template()) == -1) {
6377c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "failed to create contract");
6387c478bd9Sstevel@tonic-gate 		return (-1);
6397c478bd9Sstevel@tonic-gate 	}
6407c478bd9Sstevel@tonic-gate 
6417c478bd9Sstevel@tonic-gate 	if ((child = fork()) == -1) {
6427c478bd9Sstevel@tonic-gate 		(void) ct_tmpl_clear(tmpl_fd);
6437c478bd9Sstevel@tonic-gate 		(void) close(tmpl_fd);
6447c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "failed to fork");
6457c478bd9Sstevel@tonic-gate 		return (-1);
6467c478bd9Sstevel@tonic-gate 
6477c478bd9Sstevel@tonic-gate 	} else if (child == 0) {	/* child */
6489acbbeafSnn35248 		char opt_buf[MAX_MNTOPT_STR];
6499acbbeafSnn35248 		int optlen = 0;
6509acbbeafSnn35248 		int mflag = MS_DATA;
6519acbbeafSnn35248 
6527c478bd9Sstevel@tonic-gate 		(void) ct_tmpl_clear(tmpl_fd);
6537c478bd9Sstevel@tonic-gate 		/*
6547c478bd9Sstevel@tonic-gate 		 * Even though there are no procs running in the zone, we
6557c478bd9Sstevel@tonic-gate 		 * do this for paranoia's sake.
6567c478bd9Sstevel@tonic-gate 		 */
6577c478bd9Sstevel@tonic-gate 		(void) closefrom(0);
6587c478bd9Sstevel@tonic-gate 
6597c478bd9Sstevel@tonic-gate 		if (zone_enter(zoneid) == -1) {
6607c478bd9Sstevel@tonic-gate 			_exit(errno);
6617c478bd9Sstevel@tonic-gate 		}
6629acbbeafSnn35248 		if (opt != NULL) {
6639acbbeafSnn35248 			/*
6649acbbeafSnn35248 			 * The mount() system call is incredibly annoying.
6659acbbeafSnn35248 			 * If options are specified, we need to copy them
6669acbbeafSnn35248 			 * into a temporary buffer since the mount() system
6679acbbeafSnn35248 			 * call will overwrite the options string.  It will
6689acbbeafSnn35248 			 * also fail if the new option string it wants to
6699acbbeafSnn35248 			 * write is bigger than the one we passed in, so
6709acbbeafSnn35248 			 * you must pass in a buffer of the maximum possible
6719acbbeafSnn35248 			 * option string length.  sigh.
6729acbbeafSnn35248 			 */
6739acbbeafSnn35248 			(void) strlcpy(opt_buf, opt, sizeof (opt_buf));
6749acbbeafSnn35248 			opt = opt_buf;
6759acbbeafSnn35248 			optlen = MAX_MNTOPT_STR;
6769acbbeafSnn35248 			mflag = MS_OPTIONSTR;
6779acbbeafSnn35248 		}
6789acbbeafSnn35248 		if (mount(spec, dir, mflag, fstype, NULL, 0, opt, optlen) != 0)
6797c478bd9Sstevel@tonic-gate 			_exit(errno);
6807c478bd9Sstevel@tonic-gate 		_exit(0);
6817c478bd9Sstevel@tonic-gate 	}
6827c478bd9Sstevel@tonic-gate 
6837c478bd9Sstevel@tonic-gate 	/* parent */
6847c478bd9Sstevel@tonic-gate 	if (contract_latest(&ct) == -1)
6857c478bd9Sstevel@tonic-gate 		ct = -1;
6867c478bd9Sstevel@tonic-gate 	(void) ct_tmpl_clear(tmpl_fd);
6877c478bd9Sstevel@tonic-gate 	(void) close(tmpl_fd);
6887c478bd9Sstevel@tonic-gate 	if (waitpid(child, &child_status, 0) != child) {
6897c478bd9Sstevel@tonic-gate 		/* unexpected: we must have been signalled */
6907c478bd9Sstevel@tonic-gate 		(void) contract_abandon_id(ct);
6917c478bd9Sstevel@tonic-gate 		return (-1);
6927c478bd9Sstevel@tonic-gate 	}
6937c478bd9Sstevel@tonic-gate 	(void) contract_abandon_id(ct);
6947c478bd9Sstevel@tonic-gate 	if (WEXITSTATUS(child_status) != 0) {
6957c478bd9Sstevel@tonic-gate 		errno = WEXITSTATUS(child_status);
6967c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "mount of %s failed", dir);
6977c478bd9Sstevel@tonic-gate 		return (-1);
6987c478bd9Sstevel@tonic-gate 	}
6997c478bd9Sstevel@tonic-gate 
7007c478bd9Sstevel@tonic-gate 	return (0);
7017c478bd9Sstevel@tonic-gate }
7027c478bd9Sstevel@tonic-gate 
703c5cd6260S /*
704c5cd6260S  * If retstr is not NULL, the output of the subproc is returned in the str,
705c5cd6260S  * otherwise it is output using zerror().  Any memory allocated for retstr
706c5cd6260S  * should be freed by the caller.
707c5cd6260S  */
7089acbbeafSnn35248 int
709c5cd6260S do_subproc(zlog_t *zlogp, char *cmdbuf, char **retstr)
710108322fbScarlsonj {
711c5cd6260S 	char buf[1024];		/* arbitrary large amount */
712c5cd6260S 	char *inbuf;
7139acbbeafSnn35248 	FILE *file;
7149acbbeafSnn35248 	int status;
715c5cd6260S 	int rd_cnt;
716c5cd6260S 
717c5cd6260S 	if (retstr != NULL) {
718c5cd6260S 		if ((*retstr = malloc(1024)) == NULL) {
719c5cd6260S 			zerror(zlogp, B_FALSE, "out of memory");
720c5cd6260S 			return (-1);
721c5cd6260S 		}
722c5cd6260S 		inbuf = *retstr;
723c5cd6260S 		rd_cnt = 0;
724c5cd6260S 	} else {
725c5cd6260S 		inbuf = buf;
726c5cd6260S 	}
727108322fbScarlsonj 
7289acbbeafSnn35248 	file = popen(cmdbuf, "r");
7299acbbeafSnn35248 	if (file == NULL) {
7309acbbeafSnn35248 		zerror(zlogp, B_TRUE, "could not launch: %s", cmdbuf);
731108322fbScarlsonj 		return (-1);
7329acbbeafSnn35248 	}
733108322fbScarlsonj 
734c5cd6260S 	while (fgets(inbuf, 1024, file) != NULL) {
7351f314719S 		if (retstr == NULL) {
7361f314719S 			if (zlogp != &logsys)
7379acbbeafSnn35248 				zerror(zlogp, B_FALSE, "%s", inbuf);
738c5cd6260S 		} else {
739c5cd6260S 			char *p;
740c5cd6260S 
741c5cd6260S 			rd_cnt += 1024 - 1;
742c5cd6260S 			if ((p = realloc(*retstr, rd_cnt + 1024)) == NULL) {
743c5cd6260S 				zerror(zlogp, B_FALSE, "out of memory");
744c5cd6260S 				(void) pclose(file);
745c5cd6260S 				return (-1);
746c5cd6260S 			}
747c5cd6260S 
748c5cd6260S 			*retstr = p;
749c5cd6260S 			inbuf = *retstr + rd_cnt;
750c5cd6260S 		}
751c5cd6260S 	}
7529acbbeafSnn35248 	status = pclose(file);
7539acbbeafSnn35248 
7549acbbeafSnn35248 	if (WIFSIGNALED(status)) {
7559acbbeafSnn35248 		zerror(zlogp, B_FALSE, "%s unexpectedly terminated due to "
7569acbbeafSnn35248 		    "signal %d", cmdbuf, WTERMSIG(status));
7575518d15bSdp 		return (-1);
7589acbbeafSnn35248 	}
7599acbbeafSnn35248 	assert(WIFEXITED(status));
7609acbbeafSnn35248 	if (WEXITSTATUS(status) == ZEXIT_EXEC) {
7619acbbeafSnn35248 		zerror(zlogp, B_FALSE, "failed to exec %s", cmdbuf);
762108322fbScarlsonj 		return (-1);
7639acbbeafSnn35248 	}
7649acbbeafSnn35248 	return (WEXITSTATUS(status));
765108322fbScarlsonj }
766108322fbScarlsonj 
767108322fbScarlsonj static int
768c5cd6260S zone_bootup(zlog_t *zlogp, const char *bootargs, int zstate)
7697c478bd9Sstevel@tonic-gate {
7707c478bd9Sstevel@tonic-gate 	zoneid_t zoneid;
7717c478bd9Sstevel@tonic-gate 	struct stat st;
772ff17c8bfSgjelinek 	char zpath[MAXPATHLEN], initpath[MAXPATHLEN], init_file[MAXPATHLEN];
7733f2f09c1Sdp 	char nbootargs[BOOTARGS_MAX];
7749acbbeafSnn35248 	char cmdbuf[MAXPATHLEN];
7759acbbeafSnn35248 	fs_callback_t cb;
776123807fbSedp 	brand_handle_t bh;
777*2b24ab6bSSebastien Roy 	zone_iptype_t iptype;
778*2b24ab6bSSebastien Roy 	boolean_t links_loaded = B_FALSE;
779*2b24ab6bSSebastien Roy 	dladm_status_t status;
780*2b24ab6bSSebastien Roy 	char errmsg[DLADM_STRSIZE];
7813f2f09c1Sdp 	int err;
7827c478bd9Sstevel@tonic-gate 
783c5cd6260S 	if (brand_prestatechg(zlogp, zstate, Z_BOOT) != 0)
784c5cd6260S 		return (-1);
785c5cd6260S 
7867c478bd9Sstevel@tonic-gate 	if ((zoneid = getzoneidbyname(zone_name)) == -1) {
7877c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "unable to get zoneid");
7888fe9fdf2SDan Price 		goto bad;
7897c478bd9Sstevel@tonic-gate 	}
7907c478bd9Sstevel@tonic-gate 
7919acbbeafSnn35248 	cb.zlogp = zlogp;
7929acbbeafSnn35248 	cb.zoneid = zoneid;
793910f48daSedp 	cb.mount_cmd = B_FALSE;
7949acbbeafSnn35248 
7959acbbeafSnn35248 	/* Get a handle to the brand info for this zone */
796123807fbSedp 	if ((bh = brand_open(brand_name)) == NULL) {
7979acbbeafSnn35248 		zerror(zlogp, B_FALSE, "unable to determine zone brand");
7988fe9fdf2SDan Price 		goto bad;
7999acbbeafSnn35248 	}
8009acbbeafSnn35248 
8019acbbeafSnn35248 	/*
8029acbbeafSnn35248 	 * Get the list of filesystems to mount from the brand
8039acbbeafSnn35248 	 * configuration.  These mounts are done via a thread that will
8049acbbeafSnn35248 	 * enter the zone, so they are done from within the context of the
8059acbbeafSnn35248 	 * zone.
8069acbbeafSnn35248 	 */
807123807fbSedp 	if (brand_platform_iter_mounts(bh, mount_early_fs, &cb) != 0) {
8089acbbeafSnn35248 		zerror(zlogp, B_FALSE, "unable to mount filesystems");
809123807fbSedp 		brand_close(bh);
8108fe9fdf2SDan Price 		goto bad;
8119acbbeafSnn35248 	}
8129acbbeafSnn35248 
8139acbbeafSnn35248 	/*
8149acbbeafSnn35248 	 * Get the brand's boot callback if it exists.
8159acbbeafSnn35248 	 */
816ff17c8bfSgjelinek 	if (zone_get_zonepath(zone_name, zpath, sizeof (zpath)) != Z_OK) {
817ff17c8bfSgjelinek 		zerror(zlogp, B_FALSE, "unable to determine zone path");
818e767a340Sgjelinek 		brand_close(bh);
8198fe9fdf2SDan Price 		goto bad;
8209acbbeafSnn35248 	}
8219acbbeafSnn35248 	(void) strcpy(cmdbuf, EXEC_PREFIX);
822ff17c8bfSgjelinek 	if (brand_get_boot(bh, zone_name, zpath, cmdbuf + EXEC_LEN,
823ff17c8bfSgjelinek 	    sizeof (cmdbuf) - EXEC_LEN) != 0) {
8249acbbeafSnn35248 		zerror(zlogp, B_FALSE,
8259acbbeafSnn35248 		    "unable to determine branded zone's boot callback");
826123807fbSedp 		brand_close(bh);
8278fe9fdf2SDan Price 		goto bad;
8289acbbeafSnn35248 	}
8299acbbeafSnn35248 
8309acbbeafSnn35248 	/* Get the path for this zone's init(1M) (or equivalent) process.  */
831123807fbSedp 	if (brand_get_initname(bh, init_file, MAXPATHLEN) != 0) {
8329acbbeafSnn35248 		zerror(zlogp, B_FALSE,
8339acbbeafSnn35248 		    "unable to determine zone's init(1M) location");
834123807fbSedp 		brand_close(bh);
8358fe9fdf2SDan Price 		goto bad;
8369acbbeafSnn35248 	}
8379acbbeafSnn35248 
838123807fbSedp 	brand_close(bh);
8397c478bd9Sstevel@tonic-gate 
8403f2f09c1Sdp 	err = filter_bootargs(zlogp, bootargs, nbootargs, init_file,
8413f2f09c1Sdp 	    bad_boot_arg);
8423f2f09c1Sdp 	if (err == Z_INVAL)
8433f2f09c1Sdp 		eventstream_write(Z_EVT_ZONE_BADARGS);
8443f2f09c1Sdp 	else if (err != Z_OK)
8458fe9fdf2SDan Price 		goto bad;
8463f2f09c1Sdp 
8473f2f09c1Sdp 	assert(init_file[0] != '\0');
8483f2f09c1Sdp 
8499acbbeafSnn35248 	/* Try to anticipate possible problems: Make sure init is executable. */
850ff17c8bfSgjelinek 	if (zone_get_rootpath(zone_name, zpath, sizeof (zpath)) != Z_OK) {
8517c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_FALSE, "unable to determine zone root");
8528fe9fdf2SDan Price 		goto bad;
8537c478bd9Sstevel@tonic-gate 	}
8549acbbeafSnn35248 
855ff17c8bfSgjelinek 	(void) snprintf(initpath, sizeof (initpath), "%s%s", zpath, init_file);
8567c478bd9Sstevel@tonic-gate 
8577c478bd9Sstevel@tonic-gate 	if (stat(initpath, &st) == -1) {
8587c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "could not stat %s", initpath);
8598fe9fdf2SDan Price 		goto bad;
8607c478bd9Sstevel@tonic-gate 	}
8617c478bd9Sstevel@tonic-gate 
8627c478bd9Sstevel@tonic-gate 	if ((st.st_mode & S_IXUSR) == 0) {
8637c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_FALSE, "%s is not executable", initpath);
8648fe9fdf2SDan Price 		goto bad;
8657c478bd9Sstevel@tonic-gate 	}
8667c478bd9Sstevel@tonic-gate 
8679acbbeafSnn35248 	/*
868*2b24ab6bSSebastien Roy 	 * Exclusive stack zones interact with the dlmgmtd running in the
869*2b24ab6bSSebastien Roy 	 * global zone.  dladm_zone_boot() tells dlmgmtd that this zone is
870*2b24ab6bSSebastien Roy 	 * booting, and loads its datalinks from the zone's datalink
871*2b24ab6bSSebastien Roy 	 * configuration file.
872*2b24ab6bSSebastien Roy 	 */
873*2b24ab6bSSebastien Roy 	if (vplat_get_iptype(zlogp, &iptype) == 0 && iptype == ZS_EXCLUSIVE) {
874*2b24ab6bSSebastien Roy 		status = dladm_zone_boot(dld_handle, zoneid);
875*2b24ab6bSSebastien Roy 		if (status != DLADM_STATUS_OK) {
876*2b24ab6bSSebastien Roy 			zerror(zlogp, B_FALSE, "unable to load zone datalinks: "
877*2b24ab6bSSebastien Roy 			    " %s", dladm_status2str(status, errmsg));
878*2b24ab6bSSebastien Roy 			goto bad;
879*2b24ab6bSSebastien Roy 		}
880*2b24ab6bSSebastien Roy 		links_loaded = B_TRUE;
881*2b24ab6bSSebastien Roy 	}
882*2b24ab6bSSebastien Roy 
883*2b24ab6bSSebastien Roy 	/*
8849acbbeafSnn35248 	 * If there is a brand 'boot' callback, execute it now to give the
8859acbbeafSnn35248 	 * brand one last chance to do any additional setup before the zone
8869acbbeafSnn35248 	 * is booted.
8879acbbeafSnn35248 	 */
8889acbbeafSnn35248 	if ((strlen(cmdbuf) > EXEC_LEN) &&
889c5cd6260S 	    (do_subproc(zlogp, cmdbuf, NULL) != Z_OK)) {
8909acbbeafSnn35248 		zerror(zlogp, B_FALSE, "%s failed", cmdbuf);
8918fe9fdf2SDan Price 		goto bad;
8929acbbeafSnn35248 	}
8939acbbeafSnn35248 
8943f2f09c1Sdp 	if (zone_setattr(zoneid, ZONE_ATTR_INITNAME, init_file, 0) == -1) {
8953f2f09c1Sdp 		zerror(zlogp, B_TRUE, "could not set zone boot file");
8968fe9fdf2SDan Price 		goto bad;
8973f2f09c1Sdp 	}
8983f2f09c1Sdp 
8993f2f09c1Sdp 	if (zone_setattr(zoneid, ZONE_ATTR_BOOTARGS, nbootargs, 0) == -1) {
9003f2f09c1Sdp 		zerror(zlogp, B_TRUE, "could not set zone boot arguments");
9018fe9fdf2SDan Price 		goto bad;
9023f2f09c1Sdp 	}
9033f2f09c1Sdp 
9043f2f09c1Sdp 	if (zone_boot(zoneid) == -1) {
9057c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "unable to boot zone");
9068fe9fdf2SDan Price 		goto bad;
9077c478bd9Sstevel@tonic-gate 	}
9087c478bd9Sstevel@tonic-gate 
909c5cd6260S 	if (brand_poststatechg(zlogp, zstate, Z_BOOT) != 0)
9108fe9fdf2SDan Price 		goto bad;
911c5cd6260S 
9127c478bd9Sstevel@tonic-gate 	return (0);
9138fe9fdf2SDan Price 
9148fe9fdf2SDan Price bad:
9158fe9fdf2SDan Price 	/*
9168fe9fdf2SDan Price 	 * If something goes wrong, we up the zones's state to the target
9178fe9fdf2SDan Price 	 * state, RUNNING, and then invoke the hook as if we're halting.
9188fe9fdf2SDan Price 	 */
9198fe9fdf2SDan Price 	(void) brand_poststatechg(zlogp, ZONE_STATE_RUNNING, Z_HALT);
920*2b24ab6bSSebastien Roy 	if (links_loaded)
921*2b24ab6bSSebastien Roy 		(void) dladm_zone_halt(dld_handle, zoneid);
9228fe9fdf2SDan Price 	return (-1);
9237c478bd9Sstevel@tonic-gate }
9247c478bd9Sstevel@tonic-gate 
9257c478bd9Sstevel@tonic-gate static int
926c5cd6260S zone_halt(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting, int zstate)
9277c478bd9Sstevel@tonic-gate {
9287c478bd9Sstevel@tonic-gate 	int err;
9297c478bd9Sstevel@tonic-gate 
930c5cd6260S 	if (brand_prestatechg(zlogp, zstate, Z_HALT) != 0)
931c5cd6260S 		return (-1);
932c5cd6260S 
9330209230bSgjelinek 	if (vplat_teardown(zlogp, unmount_cmd, rebooting) != 0) {
9347c478bd9Sstevel@tonic-gate 		if (!bringup_failure_recovery)
9357c478bd9Sstevel@tonic-gate 			zerror(zlogp, B_FALSE, "unable to destroy zone");
9367c478bd9Sstevel@tonic-gate 		return (-1);
9377c478bd9Sstevel@tonic-gate 	}
9387c478bd9Sstevel@tonic-gate 
9397c478bd9Sstevel@tonic-gate 	if ((err = zonecfg_destroy_snapshot(zone_name)) != Z_OK)
9407c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_FALSE, "destroying snapshot: %s",
9417c478bd9Sstevel@tonic-gate 		    zonecfg_strerror(err));
9427c478bd9Sstevel@tonic-gate 
943c5cd6260S 	if (brand_poststatechg(zlogp, zstate, Z_HALT) != 0)
944c5cd6260S 		return (-1);
945c5cd6260S 
9467c478bd9Sstevel@tonic-gate 	return (0);
9477c478bd9Sstevel@tonic-gate }
9487c478bd9Sstevel@tonic-gate 
9497c478bd9Sstevel@tonic-gate /*
9507c478bd9Sstevel@tonic-gate  * Generate AUE_zone_state for a command that boots a zone.
9517c478bd9Sstevel@tonic-gate  */
9527c478bd9Sstevel@tonic-gate static void
9537c478bd9Sstevel@tonic-gate audit_put_record(zlog_t *zlogp, ucred_t *uc, int return_val,
9547c478bd9Sstevel@tonic-gate     char *new_state)
9557c478bd9Sstevel@tonic-gate {
9567c478bd9Sstevel@tonic-gate 	adt_session_data_t	*ah;
9577c478bd9Sstevel@tonic-gate 	adt_event_data_t	*event;
9587c478bd9Sstevel@tonic-gate 	int			pass_fail, fail_reason;
9597c478bd9Sstevel@tonic-gate 
9607c478bd9Sstevel@tonic-gate 	if (!adt_audit_enabled())
9617c478bd9Sstevel@tonic-gate 		return;
9627c478bd9Sstevel@tonic-gate 
9637c478bd9Sstevel@tonic-gate 	if (return_val == 0) {
9647c478bd9Sstevel@tonic-gate 		pass_fail = ADT_SUCCESS;
9657c478bd9Sstevel@tonic-gate 		fail_reason = ADT_SUCCESS;
9667c478bd9Sstevel@tonic-gate 	} else {
9677c478bd9Sstevel@tonic-gate 		pass_fail = ADT_FAILURE;
9687c478bd9Sstevel@tonic-gate 		fail_reason = ADT_FAIL_VALUE_PROGRAM;
9697c478bd9Sstevel@tonic-gate 	}
9707c478bd9Sstevel@tonic-gate 
9717c478bd9Sstevel@tonic-gate 	if (adt_start_session(&ah, NULL, 0)) {
9727c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, gettext("audit failure."));
9737c478bd9Sstevel@tonic-gate 		return;
9747c478bd9Sstevel@tonic-gate 	}
9757c478bd9Sstevel@tonic-gate 	if (adt_set_from_ucred(ah, uc, ADT_NEW)) {
9767c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, gettext("audit failure."));
9777c478bd9Sstevel@tonic-gate 		(void) adt_end_session(ah);
9787c478bd9Sstevel@tonic-gate 		return;
9797c478bd9Sstevel@tonic-gate 	}
9807c478bd9Sstevel@tonic-gate 
9817c478bd9Sstevel@tonic-gate 	event = adt_alloc_event(ah, ADT_zone_state);
9827c478bd9Sstevel@tonic-gate 	if (event == NULL) {
9837c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, gettext("audit failure."));
9847c478bd9Sstevel@tonic-gate 		(void) adt_end_session(ah);
9857c478bd9Sstevel@tonic-gate 		return;
9867c478bd9Sstevel@tonic-gate 	}
9877c478bd9Sstevel@tonic-gate 	event->adt_zone_state.zonename = zone_name;
9887c478bd9Sstevel@tonic-gate 	event->adt_zone_state.new_state = new_state;
9897c478bd9Sstevel@tonic-gate 
9907c478bd9Sstevel@tonic-gate 	if (adt_put_event(event, pass_fail, fail_reason))
9917c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, gettext("audit failure."));
9927c478bd9Sstevel@tonic-gate 
9937c478bd9Sstevel@tonic-gate 	adt_free_event(event);
9947c478bd9Sstevel@tonic-gate 
9957c478bd9Sstevel@tonic-gate 	(void) adt_end_session(ah);
9967c478bd9Sstevel@tonic-gate }
9977c478bd9Sstevel@tonic-gate 
9987c478bd9Sstevel@tonic-gate /*
9997c478bd9Sstevel@tonic-gate  * The main routine for the door server that deals with zone state transitions.
10007c478bd9Sstevel@tonic-gate  */
10017c478bd9Sstevel@tonic-gate /* ARGSUSED */
10027c478bd9Sstevel@tonic-gate static void
10037c478bd9Sstevel@tonic-gate server(void *cookie, char *args, size_t alen, door_desc_t *dp,
10047c478bd9Sstevel@tonic-gate     uint_t n_desc)
10057c478bd9Sstevel@tonic-gate {
10067c478bd9Sstevel@tonic-gate 	ucred_t *uc = NULL;
10077c478bd9Sstevel@tonic-gate 	const priv_set_t *eset;
10087c478bd9Sstevel@tonic-gate 
10097c478bd9Sstevel@tonic-gate 	zone_state_t zstate;
10107c478bd9Sstevel@tonic-gate 	zone_cmd_t cmd;
10117c478bd9Sstevel@tonic-gate 	zone_cmd_arg_t *zargp;
10127c478bd9Sstevel@tonic-gate 
10137c478bd9Sstevel@tonic-gate 	boolean_t kernelcall;
10147c478bd9Sstevel@tonic-gate 
10157c478bd9Sstevel@tonic-gate 	int rval = -1;
10167c478bd9Sstevel@tonic-gate 	uint64_t uniqid;
10177c478bd9Sstevel@tonic-gate 	zoneid_t zoneid = -1;
10187c478bd9Sstevel@tonic-gate 	zlog_t zlog;
10197c478bd9Sstevel@tonic-gate 	zlog_t *zlogp;
10207c478bd9Sstevel@tonic-gate 	zone_cmd_rval_t *rvalp;
10217c478bd9Sstevel@tonic-gate 	size_t rlen = getpagesize(); /* conservative */
10229acbbeafSnn35248 	fs_callback_t cb;
1023123807fbSedp 	brand_handle_t bh;
10247c478bd9Sstevel@tonic-gate 
10257c478bd9Sstevel@tonic-gate 	/* LINTED E_BAD_PTR_CAST_ALIGN */
10267c478bd9Sstevel@tonic-gate 	zargp = (zone_cmd_arg_t *)args;
10277c478bd9Sstevel@tonic-gate 
10287c478bd9Sstevel@tonic-gate 	/*
10297c478bd9Sstevel@tonic-gate 	 * When we get the door unref message, we've fdetach'd the door, and
10307c478bd9Sstevel@tonic-gate 	 * it is time for us to shut down zoneadmd.
10317c478bd9Sstevel@tonic-gate 	 */
10327c478bd9Sstevel@tonic-gate 	if (zargp == DOOR_UNREF_DATA) {
10337c478bd9Sstevel@tonic-gate 		/*
10347c478bd9Sstevel@tonic-gate 		 * See comment at end of main() for info on the last rites.
10357c478bd9Sstevel@tonic-gate 		 */
10367c478bd9Sstevel@tonic-gate 		exit(0);
10377c478bd9Sstevel@tonic-gate 	}
10387c478bd9Sstevel@tonic-gate 
10397c478bd9Sstevel@tonic-gate 	if (zargp == NULL) {
10407c478bd9Sstevel@tonic-gate 		(void) door_return(NULL, 0, 0, 0);
10417c478bd9Sstevel@tonic-gate 	}
10427c478bd9Sstevel@tonic-gate 
10437c478bd9Sstevel@tonic-gate 	rvalp = alloca(rlen);
10447c478bd9Sstevel@tonic-gate 	bzero(rvalp, rlen);
10457c478bd9Sstevel@tonic-gate 	zlog.logfile = NULL;
10467c478bd9Sstevel@tonic-gate 	zlog.buflen = zlog.loglen = rlen - sizeof (zone_cmd_rval_t) + 1;
10477c478bd9Sstevel@tonic-gate 	zlog.buf = rvalp->errbuf;
10487c478bd9Sstevel@tonic-gate 	zlog.log = zlog.buf;
10497c478bd9Sstevel@tonic-gate 	/* defer initialization of zlog.locale until after credential check */
10507c478bd9Sstevel@tonic-gate 	zlogp = &zlog;
10517c478bd9Sstevel@tonic-gate 
10527c478bd9Sstevel@tonic-gate 	if (alen != sizeof (zone_cmd_arg_t)) {
10537c478bd9Sstevel@tonic-gate 		/*
10547c478bd9Sstevel@tonic-gate 		 * This really shouldn't be happening.
10557c478bd9Sstevel@tonic-gate 		 */
10563f2f09c1Sdp 		zerror(&logsys, B_FALSE, "argument size (%d bytes) "
10573f2f09c1Sdp 		    "unexpected (expected %d bytes)", alen,
10583f2f09c1Sdp 		    sizeof (zone_cmd_arg_t));
10597c478bd9Sstevel@tonic-gate 		goto out;
10607c478bd9Sstevel@tonic-gate 	}
10617c478bd9Sstevel@tonic-gate 	cmd = zargp->cmd;
10627c478bd9Sstevel@tonic-gate 
10637c478bd9Sstevel@tonic-gate 	if (door_ucred(&uc) != 0) {
10647c478bd9Sstevel@tonic-gate 		zerror(&logsys, B_TRUE, "door_ucred");
10657c478bd9Sstevel@tonic-gate 		goto out;
10667c478bd9Sstevel@tonic-gate 	}
10677c478bd9Sstevel@tonic-gate 	eset = ucred_getprivset(uc, PRIV_EFFECTIVE);
10687c478bd9Sstevel@tonic-gate 	if (ucred_getzoneid(uc) != GLOBAL_ZONEID ||
10697c478bd9Sstevel@tonic-gate 	    (eset != NULL ? !priv_ismember(eset, PRIV_SYS_CONFIG) :
10707c478bd9Sstevel@tonic-gate 	    ucred_geteuid(uc) != 0)) {
10717c478bd9Sstevel@tonic-gate 		zerror(&logsys, B_FALSE, "insufficient privileges");
10727c478bd9Sstevel@tonic-gate 		goto out;
10737c478bd9Sstevel@tonic-gate 	}
10747c478bd9Sstevel@tonic-gate 
10757c478bd9Sstevel@tonic-gate 	kernelcall = ucred_getpid(uc) == 0;
10767c478bd9Sstevel@tonic-gate 
10777c478bd9Sstevel@tonic-gate 	/*
10787c478bd9Sstevel@tonic-gate 	 * This is safe because we only use a zlog_t throughout the
10797c478bd9Sstevel@tonic-gate 	 * duration of a door call; i.e., by the time the pointer
10807c478bd9Sstevel@tonic-gate 	 * might become invalid, the door call would be over.
10817c478bd9Sstevel@tonic-gate 	 */
10827c478bd9Sstevel@tonic-gate 	zlog.locale = kernelcall ? DEFAULT_LOCALE : zargp->locale;
10837c478bd9Sstevel@tonic-gate 
10847c478bd9Sstevel@tonic-gate 	(void) mutex_lock(&lock);
10857c478bd9Sstevel@tonic-gate 
10867c478bd9Sstevel@tonic-gate 	/*
10877c478bd9Sstevel@tonic-gate 	 * Once we start to really die off, we don't want more connections.
10887c478bd9Sstevel@tonic-gate 	 */
10897c478bd9Sstevel@tonic-gate 	if (in_death_throes) {
10907c478bd9Sstevel@tonic-gate 		(void) mutex_unlock(&lock);
10917c478bd9Sstevel@tonic-gate 		ucred_free(uc);
10927c478bd9Sstevel@tonic-gate 		(void) door_return(NULL, 0, 0, 0);
10937c478bd9Sstevel@tonic-gate 		thr_exit(NULL);
10947c478bd9Sstevel@tonic-gate 	}
10957c478bd9Sstevel@tonic-gate 
10967c478bd9Sstevel@tonic-gate 	/*
10977c478bd9Sstevel@tonic-gate 	 * Check for validity of command.
10987c478bd9Sstevel@tonic-gate 	 */
10999acbbeafSnn35248 	if (cmd != Z_READY && cmd != Z_BOOT && cmd != Z_FORCEBOOT &&
11009acbbeafSnn35248 	    cmd != Z_REBOOT && cmd != Z_HALT && cmd != Z_NOTE_UNINSTALLING &&
11019acbbeafSnn35248 	    cmd != Z_MOUNT && cmd != Z_FORCEMOUNT && cmd != Z_UNMOUNT) {
1102108322fbScarlsonj 		zerror(&logsys, B_FALSE, "invalid command %d", (int)cmd);
11037c478bd9Sstevel@tonic-gate 		goto out;
11047c478bd9Sstevel@tonic-gate 	}
11057c478bd9Sstevel@tonic-gate 
11067c478bd9Sstevel@tonic-gate 	if (kernelcall && (cmd != Z_HALT && cmd != Z_REBOOT)) {
11077c478bd9Sstevel@tonic-gate 		/*
11087c478bd9Sstevel@tonic-gate 		 * Can't happen
11097c478bd9Sstevel@tonic-gate 		 */
11107c478bd9Sstevel@tonic-gate 		zerror(&logsys, B_FALSE, "received unexpected kernel upcall %d",
11117c478bd9Sstevel@tonic-gate 		    cmd);
11127c478bd9Sstevel@tonic-gate 		goto out;
11137c478bd9Sstevel@tonic-gate 	}
11147c478bd9Sstevel@tonic-gate 	/*
11157c478bd9Sstevel@tonic-gate 	 * We ignore the possibility of someone calling zone_create(2)
11167c478bd9Sstevel@tonic-gate 	 * explicitly; all requests must come through zoneadmd.
11177c478bd9Sstevel@tonic-gate 	 */
11187c478bd9Sstevel@tonic-gate 	if (zone_get_state(zone_name, &zstate) != Z_OK) {
11197c478bd9Sstevel@tonic-gate 		/*
11207c478bd9Sstevel@tonic-gate 		 * Something terribly wrong happened
11217c478bd9Sstevel@tonic-gate 		 */
11227c478bd9Sstevel@tonic-gate 		zerror(&logsys, B_FALSE, "unable to determine state of zone");
11237c478bd9Sstevel@tonic-gate 		goto out;
11247c478bd9Sstevel@tonic-gate 	}
11257c478bd9Sstevel@tonic-gate 
11267c478bd9Sstevel@tonic-gate 	if (kernelcall) {
11277c478bd9Sstevel@tonic-gate 		/*
11287c478bd9Sstevel@tonic-gate 		 * Kernel-initiated requests may lose their validity if the
11297c478bd9Sstevel@tonic-gate 		 * zone_t the kernel was referring to has gone away.
11307c478bd9Sstevel@tonic-gate 		 */
11317c478bd9Sstevel@tonic-gate 		if ((zoneid = getzoneidbyname(zone_name)) == -1 ||
11327c478bd9Sstevel@tonic-gate 		    zone_getattr(zoneid, ZONE_ATTR_UNIQID, &uniqid,
11337c478bd9Sstevel@tonic-gate 		    sizeof (uniqid)) == -1 || uniqid != zargp->uniqid) {
11347c478bd9Sstevel@tonic-gate 			/*
11357c478bd9Sstevel@tonic-gate 			 * We're not talking about the same zone. The request
11367c478bd9Sstevel@tonic-gate 			 * must have arrived too late.  Return error.
11377c478bd9Sstevel@tonic-gate 			 */
11387c478bd9Sstevel@tonic-gate 			rval = -1;
11397c478bd9Sstevel@tonic-gate 			goto out;
11407c478bd9Sstevel@tonic-gate 		}
11417c478bd9Sstevel@tonic-gate 		zlogp = &logsys;	/* Log errors to syslog */
11427c478bd9Sstevel@tonic-gate 	}
11437c478bd9Sstevel@tonic-gate 
11449acbbeafSnn35248 	/*
11459acbbeafSnn35248 	 * If we are being asked to forcibly mount or boot a zone, we
11469acbbeafSnn35248 	 * pretend that an INCOMPLETE zone is actually INSTALLED.
11479acbbeafSnn35248 	 */
11489acbbeafSnn35248 	if (zstate == ZONE_STATE_INCOMPLETE &&
11499acbbeafSnn35248 	    (cmd == Z_FORCEBOOT || cmd == Z_FORCEMOUNT))
11509acbbeafSnn35248 		zstate = ZONE_STATE_INSTALLED;
11519acbbeafSnn35248 
11527c478bd9Sstevel@tonic-gate 	switch (zstate) {
11537c478bd9Sstevel@tonic-gate 	case ZONE_STATE_CONFIGURED:
11547c478bd9Sstevel@tonic-gate 	case ZONE_STATE_INCOMPLETE:
11557c478bd9Sstevel@tonic-gate 		/*
11567c478bd9Sstevel@tonic-gate 		 * Not our area of expertise; we just print a nice message
11577c478bd9Sstevel@tonic-gate 		 * and die off.
11587c478bd9Sstevel@tonic-gate 		 */
11597c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_FALSE,
11607c478bd9Sstevel@tonic-gate 		    "%s operation is invalid for zones in state '%s'",
1161108322fbScarlsonj 		    z_cmd_name(cmd), zone_state_str(zstate));
11627c478bd9Sstevel@tonic-gate 		break;
11637c478bd9Sstevel@tonic-gate 
11647c478bd9Sstevel@tonic-gate 	case ZONE_STATE_INSTALLED:
11657c478bd9Sstevel@tonic-gate 		switch (cmd) {
11667c478bd9Sstevel@tonic-gate 		case Z_READY:
1167c5cd6260S 			rval = zone_ready(zlogp, Z_MNT_BOOT, zstate);
11687c478bd9Sstevel@tonic-gate 			if (rval == 0)
11697c478bd9Sstevel@tonic-gate 				eventstream_write(Z_EVT_ZONE_READIED);
11707c478bd9Sstevel@tonic-gate 			break;
11717c478bd9Sstevel@tonic-gate 		case Z_BOOT:
11729acbbeafSnn35248 		case Z_FORCEBOOT:
11737c478bd9Sstevel@tonic-gate 			eventstream_write(Z_EVT_ZONE_BOOTING);
1174c5cd6260S 			if ((rval = zone_ready(zlogp, Z_MNT_BOOT, zstate))
1175c5cd6260S 			    == 0) {
1176c5cd6260S 				rval = zone_bootup(zlogp, zargp->bootbuf,
1177c5cd6260S 				    zstate);
1178c5cd6260S 			}
11797c478bd9Sstevel@tonic-gate 			audit_put_record(zlogp, uc, rval, "boot");
11807c478bd9Sstevel@tonic-gate 			if (rval != 0) {
11817c478bd9Sstevel@tonic-gate 				bringup_failure_recovery = B_TRUE;
1182c5cd6260S 				(void) zone_halt(zlogp, B_FALSE, B_FALSE,
1183c5cd6260S 				    zstate);
1184ffbafc53Scomay 				eventstream_write(Z_EVT_ZONE_BOOTFAILED);
11857c478bd9Sstevel@tonic-gate 			}
11867c478bd9Sstevel@tonic-gate 			break;
11877c478bd9Sstevel@tonic-gate 		case Z_HALT:
11887c478bd9Sstevel@tonic-gate 			if (kernelcall)	/* Invalid; can't happen */
11897c478bd9Sstevel@tonic-gate 				abort();
11907c478bd9Sstevel@tonic-gate 			/*
11917c478bd9Sstevel@tonic-gate 			 * We could have two clients racing to halt this
11927c478bd9Sstevel@tonic-gate 			 * zone; the second client loses, but his request
11937c478bd9Sstevel@tonic-gate 			 * doesn't fail, since the zone is now in the desired
11947c478bd9Sstevel@tonic-gate 			 * state.
11957c478bd9Sstevel@tonic-gate 			 */
11967c478bd9Sstevel@tonic-gate 			zerror(zlogp, B_FALSE, "zone is already halted");
11977c478bd9Sstevel@tonic-gate 			rval = 0;
11987c478bd9Sstevel@tonic-gate 			break;
11997c478bd9Sstevel@tonic-gate 		case Z_REBOOT:
12007c478bd9Sstevel@tonic-gate 			if (kernelcall)	/* Invalid; can't happen */
12017c478bd9Sstevel@tonic-gate 				abort();
12027c478bd9Sstevel@tonic-gate 			zerror(zlogp, B_FALSE, "%s operation is invalid "
1203108322fbScarlsonj 			    "for zones in state '%s'", z_cmd_name(cmd),
12047c478bd9Sstevel@tonic-gate 			    zone_state_str(zstate));
12057c478bd9Sstevel@tonic-gate 			rval = -1;
12067c478bd9Sstevel@tonic-gate 			break;
12077c478bd9Sstevel@tonic-gate 		case Z_NOTE_UNINSTALLING:
12087c478bd9Sstevel@tonic-gate 			if (kernelcall)	/* Invalid; can't happen */
12097c478bd9Sstevel@tonic-gate 				abort();
12107c478bd9Sstevel@tonic-gate 			/*
12117c478bd9Sstevel@tonic-gate 			 * Tell the console to print out a message about this.
12127c478bd9Sstevel@tonic-gate 			 * Once it does, we will be in_death_throes.
12137c478bd9Sstevel@tonic-gate 			 */
12147c478bd9Sstevel@tonic-gate 			eventstream_write(Z_EVT_ZONE_UNINSTALLING);
12157c478bd9Sstevel@tonic-gate 			break;
1216108322fbScarlsonj 		case Z_MOUNT:
12179acbbeafSnn35248 		case Z_FORCEMOUNT:
1218108322fbScarlsonj 			if (kernelcall)	/* Invalid; can't happen */
1219108322fbScarlsonj 				abort();
12209a5d73e0SRic Aleshire 			if (!zone_isnative && !zone_iscluster &&
12219a5d73e0SRic Aleshire 			    !zone_islabeled) {
12220679f794S 				/*
12230679f794S 				 * -U mounts the zone without lofs mounting
12240679f794S 				 * zone file systems back into the scratch
12250679f794S 				 * zone.  This is required when mounting
12260679f794S 				 * non-native branded zones.
12270679f794S 				 */
12280679f794S 				(void) strlcpy(zargp->bootbuf, "-U",
12290679f794S 				    BOOTARGS_MAX);
1230ffbafc53Scomay 			}
1231ffbafc53Scomay 
12326cfd72c6Sgjelinek 			rval = zone_ready(zlogp,
12336cfd72c6Sgjelinek 			    strcmp(zargp->bootbuf, "-U") == 0 ?
1234c5cd6260S 			    Z_MNT_UPDATE : Z_MNT_SCRATCH, zstate);
12359acbbeafSnn35248 			if (rval != 0)
12369acbbeafSnn35248 				break;
12379acbbeafSnn35248 
12389acbbeafSnn35248 			eventstream_write(Z_EVT_ZONE_READIED);
12399acbbeafSnn35248 
12400679f794S 			/*
12410679f794S 			 * Get a handle to the native brand info.
12420679f794S 			 * We must always use the native brand file system
12430679f794S 			 * list when mounting the zone.
12440679f794S 			 */
12450679f794S 			if ((bh = brand_open(NATIVE_BRAND_NAME)) == NULL) {
12469acbbeafSnn35248 				rval = -1;
12479acbbeafSnn35248 				break;
12489acbbeafSnn35248 			}
12499acbbeafSnn35248 
12509acbbeafSnn35248 			/*
12519acbbeafSnn35248 			 * Get the list of filesystems to mount from
12529acbbeafSnn35248 			 * the brand configuration.  These mounts are done
12539acbbeafSnn35248 			 * via a thread that will enter the zone, so they
12549acbbeafSnn35248 			 * are done from within the context of the zone.
12559acbbeafSnn35248 			 */
12569acbbeafSnn35248 			cb.zlogp = zlogp;
12579acbbeafSnn35248 			cb.zoneid = zone_id;
1258910f48daSedp 			cb.mount_cmd = B_TRUE;
1259123807fbSedp 			rval = brand_platform_iter_mounts(bh,
12609acbbeafSnn35248 			    mount_early_fs, &cb);
12619acbbeafSnn35248 
1262123807fbSedp 			brand_close(bh);
12639acbbeafSnn35248 
1264108322fbScarlsonj 			/*
1265108322fbScarlsonj 			 * Ordinarily, /dev/fd would be mounted inside the zone
1266108322fbScarlsonj 			 * by svc:/system/filesystem/usr:default, but since
1267108322fbScarlsonj 			 * we're not booting the zone, we need to do this
1268108322fbScarlsonj 			 * manually.
1269108322fbScarlsonj 			 */
1270108322fbScarlsonj 			if (rval == 0)
12719acbbeafSnn35248 				rval = mount_early_fs(&cb,
12729acbbeafSnn35248 				    "fd", "/dev/fd", "fd", NULL);
1273108322fbScarlsonj 			break;
1274108322fbScarlsonj 		case Z_UNMOUNT:
1275108322fbScarlsonj 			if (kernelcall)	/* Invalid; can't happen */
1276108322fbScarlsonj 				abort();
1277108322fbScarlsonj 			zerror(zlogp, B_FALSE, "zone is already unmounted");
1278108322fbScarlsonj 			rval = 0;
1279108322fbScarlsonj 			break;
12807c478bd9Sstevel@tonic-gate 		}
12817c478bd9Sstevel@tonic-gate 		break;
12827c478bd9Sstevel@tonic-gate 
12837c478bd9Sstevel@tonic-gate 	case ZONE_STATE_READY:
12847c478bd9Sstevel@tonic-gate 		switch (cmd) {
12857c478bd9Sstevel@tonic-gate 		case Z_READY:
12867c478bd9Sstevel@tonic-gate 			/*
12877c478bd9Sstevel@tonic-gate 			 * We could have two clients racing to ready this
12887c478bd9Sstevel@tonic-gate 			 * zone; the second client loses, but his request
12897c478bd9Sstevel@tonic-gate 			 * doesn't fail, since the zone is now in the desired
12907c478bd9Sstevel@tonic-gate 			 * state.
12917c478bd9Sstevel@tonic-gate 			 */
12927c478bd9Sstevel@tonic-gate 			zerror(zlogp, B_FALSE, "zone is already ready");
12937c478bd9Sstevel@tonic-gate 			rval = 0;
12947c478bd9Sstevel@tonic-gate 			break;
12957c478bd9Sstevel@tonic-gate 		case Z_BOOT:
12963f2f09c1Sdp 			(void) strlcpy(boot_args, zargp->bootbuf,
12973f2f09c1Sdp 			    sizeof (boot_args));
12987c478bd9Sstevel@tonic-gate 			eventstream_write(Z_EVT_ZONE_BOOTING);
1299c5cd6260S 			rval = zone_bootup(zlogp, zargp->bootbuf, zstate);
13007c478bd9Sstevel@tonic-gate 			audit_put_record(zlogp, uc, rval, "boot");
13017c478bd9Sstevel@tonic-gate 			if (rval != 0) {
13027c478bd9Sstevel@tonic-gate 				bringup_failure_recovery = B_TRUE;
1303c5cd6260S 				(void) zone_halt(zlogp, B_FALSE, B_TRUE,
1304c5cd6260S 				    zstate);
1305ffbafc53Scomay 				eventstream_write(Z_EVT_ZONE_BOOTFAILED);
13067c478bd9Sstevel@tonic-gate 			}
13073f2f09c1Sdp 			boot_args[0] = '\0';
13087c478bd9Sstevel@tonic-gate 			break;
13097c478bd9Sstevel@tonic-gate 		case Z_HALT:
13107c478bd9Sstevel@tonic-gate 			if (kernelcall)	/* Invalid; can't happen */
13117c478bd9Sstevel@tonic-gate 				abort();
1312c5cd6260S 			if ((rval = zone_halt(zlogp, B_FALSE, B_FALSE, zstate))
1313c5cd6260S 			    != 0)
13147c478bd9Sstevel@tonic-gate 				break;
13157c478bd9Sstevel@tonic-gate 			eventstream_write(Z_EVT_ZONE_HALTED);
13167c478bd9Sstevel@tonic-gate 			break;
13177c478bd9Sstevel@tonic-gate 		case Z_REBOOT:
1318108322fbScarlsonj 		case Z_NOTE_UNINSTALLING:
1319108322fbScarlsonj 		case Z_MOUNT:
1320108322fbScarlsonj 		case Z_UNMOUNT:
13217c478bd9Sstevel@tonic-gate 			if (kernelcall)	/* Invalid; can't happen */
13227c478bd9Sstevel@tonic-gate 				abort();
13237c478bd9Sstevel@tonic-gate 			zerror(zlogp, B_FALSE, "%s operation is invalid "
1324108322fbScarlsonj 			    "for zones in state '%s'", z_cmd_name(cmd),
13257c478bd9Sstevel@tonic-gate 			    zone_state_str(zstate));
13267c478bd9Sstevel@tonic-gate 			rval = -1;
13277c478bd9Sstevel@tonic-gate 			break;
1328108322fbScarlsonj 		}
1329108322fbScarlsonj 		break;
1330108322fbScarlsonj 
1331108322fbScarlsonj 	case ZONE_STATE_MOUNTED:
1332108322fbScarlsonj 		switch (cmd) {
1333108322fbScarlsonj 		case Z_UNMOUNT:
13347c478bd9Sstevel@tonic-gate 			if (kernelcall)	/* Invalid; can't happen */
13357c478bd9Sstevel@tonic-gate 				abort();
1336c5cd6260S 			rval = zone_halt(zlogp, B_TRUE, B_FALSE, zstate);
1337ffbafc53Scomay 			if (rval == 0) {
1338ffbafc53Scomay 				eventstream_write(Z_EVT_ZONE_HALTED);
1339108322fbScarlsonj 				(void) sema_post(&scratch_sem);
1340ffbafc53Scomay 			}
1341108322fbScarlsonj 			break;
1342108322fbScarlsonj 		default:
1343108322fbScarlsonj 			if (kernelcall)	/* Invalid; can't happen */
1344108322fbScarlsonj 				abort();
1345108322fbScarlsonj 			zerror(zlogp, B_FALSE, "%s operation is invalid "
1346108322fbScarlsonj 			    "for zones in state '%s'", z_cmd_name(cmd),
1347108322fbScarlsonj 			    zone_state_str(zstate));
13487c478bd9Sstevel@tonic-gate 			rval = -1;
13497c478bd9Sstevel@tonic-gate 			break;
13507c478bd9Sstevel@tonic-gate 		}
13517c478bd9Sstevel@tonic-gate 		break;
13527c478bd9Sstevel@tonic-gate 
13537c478bd9Sstevel@tonic-gate 	case ZONE_STATE_RUNNING:
13547c478bd9Sstevel@tonic-gate 	case ZONE_STATE_SHUTTING_DOWN:
13557c478bd9Sstevel@tonic-gate 	case ZONE_STATE_DOWN:
13567c478bd9Sstevel@tonic-gate 		switch (cmd) {
13577c478bd9Sstevel@tonic-gate 		case Z_READY:
1358c5cd6260S 			if ((rval = zone_halt(zlogp, B_FALSE, B_TRUE, zstate))
1359c5cd6260S 			    != 0)
13607c478bd9Sstevel@tonic-gate 				break;
1361c5cd6260S 			if ((rval = zone_ready(zlogp, Z_MNT_BOOT, zstate)) == 0)
13627c478bd9Sstevel@tonic-gate 				eventstream_write(Z_EVT_ZONE_READIED);
1363ffbafc53Scomay 			else
1364ffbafc53Scomay 				eventstream_write(Z_EVT_ZONE_HALTED);
13657c478bd9Sstevel@tonic-gate 			break;
13667c478bd9Sstevel@tonic-gate 		case Z_BOOT:
13677c478bd9Sstevel@tonic-gate 			/*
13687c478bd9Sstevel@tonic-gate 			 * We could have two clients racing to boot this
13697c478bd9Sstevel@tonic-gate 			 * zone; the second client loses, but his request
13707c478bd9Sstevel@tonic-gate 			 * doesn't fail, since the zone is now in the desired
13717c478bd9Sstevel@tonic-gate 			 * state.
13727c478bd9Sstevel@tonic-gate 			 */
13737c478bd9Sstevel@tonic-gate 			zerror(zlogp, B_FALSE, "zone is already booted");
13747c478bd9Sstevel@tonic-gate 			rval = 0;
13757c478bd9Sstevel@tonic-gate 			break;
13767c478bd9Sstevel@tonic-gate 		case Z_HALT:
1377c5cd6260S 			if ((rval = zone_halt(zlogp, B_FALSE, B_FALSE, zstate))
1378c5cd6260S 			    != 0)
13797c478bd9Sstevel@tonic-gate 				break;
13807c478bd9Sstevel@tonic-gate 			eventstream_write(Z_EVT_ZONE_HALTED);
13817c478bd9Sstevel@tonic-gate 			break;
13827c478bd9Sstevel@tonic-gate 		case Z_REBOOT:
13833f2f09c1Sdp 			(void) strlcpy(boot_args, zargp->bootbuf,
13843f2f09c1Sdp 			    sizeof (boot_args));
13857c478bd9Sstevel@tonic-gate 			eventstream_write(Z_EVT_ZONE_REBOOTING);
1386c5cd6260S 			if ((rval = zone_halt(zlogp, B_FALSE, B_TRUE, zstate))
1387c5cd6260S 			    != 0) {
1388ffbafc53Scomay 				eventstream_write(Z_EVT_ZONE_BOOTFAILED);
13893f2f09c1Sdp 				boot_args[0] = '\0';
13907c478bd9Sstevel@tonic-gate 				break;
1391ffbafc53Scomay 			}
1392c5cd6260S 			if ((rval = zone_ready(zlogp, Z_MNT_BOOT, zstate))
1393c5cd6260S 			    != 0) {
1394ffbafc53Scomay 				eventstream_write(Z_EVT_ZONE_BOOTFAILED);
13953f2f09c1Sdp 				boot_args[0] = '\0';
1396ffbafc53Scomay 				break;
1397ffbafc53Scomay 			}
1398c5cd6260S 			rval = zone_bootup(zlogp, zargp->bootbuf, zstate);
13997c478bd9Sstevel@tonic-gate 			audit_put_record(zlogp, uc, rval, "reboot");
1400ffbafc53Scomay 			if (rval != 0) {
1401c5cd6260S 				(void) zone_halt(zlogp, B_FALSE, B_TRUE,
1402c5cd6260S 				    zstate);
1403ffbafc53Scomay 				eventstream_write(Z_EVT_ZONE_BOOTFAILED);
14047c478bd9Sstevel@tonic-gate 			}
14053f2f09c1Sdp 			boot_args[0] = '\0';
14067c478bd9Sstevel@tonic-gate 			break;
14077c478bd9Sstevel@tonic-gate 		case Z_NOTE_UNINSTALLING:
1408108322fbScarlsonj 		case Z_MOUNT:
1409108322fbScarlsonj 		case Z_UNMOUNT:
1410108322fbScarlsonj 			zerror(zlogp, B_FALSE, "%s operation is invalid "
1411108322fbScarlsonj 			    "for zones in state '%s'", z_cmd_name(cmd),
1412108322fbScarlsonj 			    zone_state_str(zstate));
14137c478bd9Sstevel@tonic-gate 			rval = -1;
14147c478bd9Sstevel@tonic-gate 			break;
14157c478bd9Sstevel@tonic-gate 		}
14167c478bd9Sstevel@tonic-gate 		break;
14177c478bd9Sstevel@tonic-gate 	default:
14187c478bd9Sstevel@tonic-gate 		abort();
14197c478bd9Sstevel@tonic-gate 	}
14207c478bd9Sstevel@tonic-gate 
14217c478bd9Sstevel@tonic-gate 	/*
14227c478bd9Sstevel@tonic-gate 	 * Because the state of the zone may have changed, we make sure
14237c478bd9Sstevel@tonic-gate 	 * to wake the console poller, which is in charge of initiating
14247c478bd9Sstevel@tonic-gate 	 * the shutdown procedure as necessary.
14257c478bd9Sstevel@tonic-gate 	 */
14267c478bd9Sstevel@tonic-gate 	eventstream_write(Z_EVT_NULL);
14277c478bd9Sstevel@tonic-gate 
14287c478bd9Sstevel@tonic-gate out:
14297c478bd9Sstevel@tonic-gate 	(void) mutex_unlock(&lock);
14307c478bd9Sstevel@tonic-gate 	if (kernelcall) {
14317c478bd9Sstevel@tonic-gate 		rvalp = NULL;
14327c478bd9Sstevel@tonic-gate 		rlen = 0;
14337c478bd9Sstevel@tonic-gate 	} else {
14347c478bd9Sstevel@tonic-gate 		rvalp->rval = rval;
14357c478bd9Sstevel@tonic-gate 	}
14367c478bd9Sstevel@tonic-gate 	if (uc != NULL)
14377c478bd9Sstevel@tonic-gate 		ucred_free(uc);
14387c478bd9Sstevel@tonic-gate 	(void) door_return((char *)rvalp, rlen, NULL, 0);
14397c478bd9Sstevel@tonic-gate 	thr_exit(NULL);
14407c478bd9Sstevel@tonic-gate }
14417c478bd9Sstevel@tonic-gate 
14427c478bd9Sstevel@tonic-gate static int
14437c478bd9Sstevel@tonic-gate setup_door(zlog_t *zlogp)
14447c478bd9Sstevel@tonic-gate {
14457c478bd9Sstevel@tonic-gate 	if ((zone_door = door_create(server, NULL,
14467c478bd9Sstevel@tonic-gate 	    DOOR_UNREF | DOOR_REFUSE_DESC | DOOR_NO_CANCEL)) < 0) {
14477c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "%s failed", "door_create");
14487c478bd9Sstevel@tonic-gate 		return (-1);
14497c478bd9Sstevel@tonic-gate 	}
14507c478bd9Sstevel@tonic-gate 	(void) fdetach(zone_door_path);
14517c478bd9Sstevel@tonic-gate 
14527c478bd9Sstevel@tonic-gate 	if (fattach(zone_door, zone_door_path) != 0) {
14537c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "fattach to %s failed", zone_door_path);
14547c478bd9Sstevel@tonic-gate 		(void) door_revoke(zone_door);
14557c478bd9Sstevel@tonic-gate 		(void) fdetach(zone_door_path);
14567c478bd9Sstevel@tonic-gate 		zone_door = -1;
14577c478bd9Sstevel@tonic-gate 		return (-1);
14587c478bd9Sstevel@tonic-gate 	}
14597c478bd9Sstevel@tonic-gate 	return (0);
14607c478bd9Sstevel@tonic-gate }
14617c478bd9Sstevel@tonic-gate 
14627c478bd9Sstevel@tonic-gate /*
14637c478bd9Sstevel@tonic-gate  * zoneadm(1m) will start zoneadmd if it thinks it isn't running; this
14647c478bd9Sstevel@tonic-gate  * is where zoneadmd itself will check to see that another instance of
14657c478bd9Sstevel@tonic-gate  * zoneadmd isn't already controlling this zone.
14667c478bd9Sstevel@tonic-gate  *
14677c478bd9Sstevel@tonic-gate  * The idea here is that we want to open the path to which we will
14687c478bd9Sstevel@tonic-gate  * attach our door, lock it, and then make sure that no-one has beat us
14697c478bd9Sstevel@tonic-gate  * to fattach(3c)ing onto it.
14707c478bd9Sstevel@tonic-gate  *
14717c478bd9Sstevel@tonic-gate  * fattach(3c) is really a mount, so there are actually two possible
14727c478bd9Sstevel@tonic-gate  * vnodes we could be dealing with.  Our strategy is as follows:
14737c478bd9Sstevel@tonic-gate  *
14747c478bd9Sstevel@tonic-gate  * - If the file we opened is a regular file (common case):
14757c478bd9Sstevel@tonic-gate  * 	There is no fattach(3c)ed door, so we have a chance of becoming
14767c478bd9Sstevel@tonic-gate  * 	the managing zoneadmd. We attempt to lock the file: if it is
14777c478bd9Sstevel@tonic-gate  * 	already locked, that means someone else raced us here, so we
14787c478bd9Sstevel@tonic-gate  * 	lose and give up.  zoneadm(1m) will try to contact the zoneadmd
14797c478bd9Sstevel@tonic-gate  * 	that beat us to it.
14807c478bd9Sstevel@tonic-gate  *
14817c478bd9Sstevel@tonic-gate  * - If the file we opened is a namefs file:
14827c478bd9Sstevel@tonic-gate  * 	This means there is already an established door fattach(3c)'ed
14837c478bd9Sstevel@tonic-gate  * 	to the rendezvous path.  We've lost the race, so we give up.
14847c478bd9Sstevel@tonic-gate  * 	Note that in this case we also try to grab the file lock, and
14857c478bd9Sstevel@tonic-gate  * 	will succeed in acquiring it since the vnode locked by the
14867c478bd9Sstevel@tonic-gate  * 	"winning" zoneadmd was a regular one, and the one we locked was
14877c478bd9Sstevel@tonic-gate  * 	the fattach(3c)'ed door node.  At any rate, no harm is done, and
14887c478bd9Sstevel@tonic-gate  * 	we just return to zoneadm(1m) which knows to retry.
14897c478bd9Sstevel@tonic-gate  */
14907c478bd9Sstevel@tonic-gate static int
14917c478bd9Sstevel@tonic-gate make_daemon_exclusive(zlog_t *zlogp)
14927c478bd9Sstevel@tonic-gate {
14937c478bd9Sstevel@tonic-gate 	int doorfd = -1;
14947c478bd9Sstevel@tonic-gate 	int err, ret = -1;
14957c478bd9Sstevel@tonic-gate 	struct stat st;
14967c478bd9Sstevel@tonic-gate 	struct flock flock;
14977c478bd9Sstevel@tonic-gate 	zone_state_t zstate;
14987c478bd9Sstevel@tonic-gate 
14997c478bd9Sstevel@tonic-gate top:
15007c478bd9Sstevel@tonic-gate 	if ((err = zone_get_state(zone_name, &zstate)) != Z_OK) {
15013f2f09c1Sdp 		zerror(zlogp, B_FALSE, "failed to get zone state: %s",
15027c478bd9Sstevel@tonic-gate 		    zonecfg_strerror(err));
15037c478bd9Sstevel@tonic-gate 		goto out;
15047c478bd9Sstevel@tonic-gate 	}
15057c478bd9Sstevel@tonic-gate 	if ((doorfd = open(zone_door_path, O_CREAT|O_RDWR,
15067c478bd9Sstevel@tonic-gate 	    S_IREAD|S_IWRITE)) < 0) {
15077c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "failed to open %s", zone_door_path);
15087c478bd9Sstevel@tonic-gate 		goto out;
15097c478bd9Sstevel@tonic-gate 	}
15107c478bd9Sstevel@tonic-gate 	if (fstat(doorfd, &st) < 0) {
15117c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "failed to stat %s", zone_door_path);
15127c478bd9Sstevel@tonic-gate 		goto out;
15137c478bd9Sstevel@tonic-gate 	}
15147c478bd9Sstevel@tonic-gate 	/*
15157c478bd9Sstevel@tonic-gate 	 * Lock the file to synchronize with other zoneadmd
15167c478bd9Sstevel@tonic-gate 	 */
15177c478bd9Sstevel@tonic-gate 	flock.l_type = F_WRLCK;
15187c478bd9Sstevel@tonic-gate 	flock.l_whence = SEEK_SET;
15197c478bd9Sstevel@tonic-gate 	flock.l_start = (off_t)0;
15207c478bd9Sstevel@tonic-gate 	flock.l_len = (off_t)0;
15217c478bd9Sstevel@tonic-gate 	if (fcntl(doorfd, F_SETLK, &flock) < 0) {
15227c478bd9Sstevel@tonic-gate 		/*
15237c478bd9Sstevel@tonic-gate 		 * Someone else raced us here and grabbed the lock file
15247c478bd9Sstevel@tonic-gate 		 * first.  A warning here is inappropriate since nothing
15257c478bd9Sstevel@tonic-gate 		 * went wrong.
15267c478bd9Sstevel@tonic-gate 		 */
15277c478bd9Sstevel@tonic-gate 		goto out;
15287c478bd9Sstevel@tonic-gate 	}
15297c478bd9Sstevel@tonic-gate 
15307c478bd9Sstevel@tonic-gate 	if (strcmp(st.st_fstype, "namefs") == 0) {
15317c478bd9Sstevel@tonic-gate 		struct door_info info;
15327c478bd9Sstevel@tonic-gate 
15337c478bd9Sstevel@tonic-gate 		/*
15347c478bd9Sstevel@tonic-gate 		 * There is already something fattach()'ed to this file.
15357c478bd9Sstevel@tonic-gate 		 * Lets see what the door is up to.
15367c478bd9Sstevel@tonic-gate 		 */
15377c478bd9Sstevel@tonic-gate 		if (door_info(doorfd, &info) == 0 && info.di_target != -1) {
15387c478bd9Sstevel@tonic-gate 			/*
15397c478bd9Sstevel@tonic-gate 			 * Another zoneadmd process seems to be in
15407c478bd9Sstevel@tonic-gate 			 * control of the situation and we don't need to
15417c478bd9Sstevel@tonic-gate 			 * be here.  A warning here is inappropriate
15427c478bd9Sstevel@tonic-gate 			 * since nothing went wrong.
15437c478bd9Sstevel@tonic-gate 			 *
15447c478bd9Sstevel@tonic-gate 			 * If the door has been revoked, the zoneadmd
15457c478bd9Sstevel@tonic-gate 			 * process currently managing the zone is going
15467c478bd9Sstevel@tonic-gate 			 * away.  We'll return control to zoneadm(1m)
15477c478bd9Sstevel@tonic-gate 			 * which will try again (by which time zoneadmd
15487c478bd9Sstevel@tonic-gate 			 * will hopefully have exited).
15497c478bd9Sstevel@tonic-gate 			 */
15507c478bd9Sstevel@tonic-gate 			goto out;
15517c478bd9Sstevel@tonic-gate 		}
15527c478bd9Sstevel@tonic-gate 
15537c478bd9Sstevel@tonic-gate 		/*
15547c478bd9Sstevel@tonic-gate 		 * If we got this far, there's a fattach(3c)'ed door
15557c478bd9Sstevel@tonic-gate 		 * that belongs to a process that has exited, which can
15567c478bd9Sstevel@tonic-gate 		 * happen if the previous zoneadmd died unexpectedly.
15577c478bd9Sstevel@tonic-gate 		 *
15587c478bd9Sstevel@tonic-gate 		 * Let user know that something is amiss, but that we can
15597c478bd9Sstevel@tonic-gate 		 * recover; if the zone is in the installed state, then don't
15607c478bd9Sstevel@tonic-gate 		 * message, since having a running zoneadmd isn't really
15617c478bd9Sstevel@tonic-gate 		 * expected/needed.  We want to keep occurences of this message
15627c478bd9Sstevel@tonic-gate 		 * limited to times when zoneadmd is picking back up from a
15637c478bd9Sstevel@tonic-gate 		 * zoneadmd that died while the zone was in some non-trivial
15647c478bd9Sstevel@tonic-gate 		 * state.
15657c478bd9Sstevel@tonic-gate 		 */
15667c478bd9Sstevel@tonic-gate 		if (zstate > ZONE_STATE_INSTALLED) {
15677c478bd9Sstevel@tonic-gate 			zerror(zlogp, B_FALSE,
15687c478bd9Sstevel@tonic-gate 			    "zone '%s': WARNING: zone is in state '%s', but "
15697c478bd9Sstevel@tonic-gate 			    "zoneadmd does not appear to be available; "
15707c478bd9Sstevel@tonic-gate 			    "restarted zoneadmd to recover.",
15717c478bd9Sstevel@tonic-gate 			    zone_name, zone_state_str(zstate));
15727c478bd9Sstevel@tonic-gate 		}
15737c478bd9Sstevel@tonic-gate 
15747c478bd9Sstevel@tonic-gate 		(void) fdetach(zone_door_path);
15757c478bd9Sstevel@tonic-gate 		(void) close(doorfd);
15767c478bd9Sstevel@tonic-gate 		goto top;
15777c478bd9Sstevel@tonic-gate 	}
15787c478bd9Sstevel@tonic-gate 	ret = 0;
15797c478bd9Sstevel@tonic-gate out:
15807c478bd9Sstevel@tonic-gate 	(void) close(doorfd);
15817c478bd9Sstevel@tonic-gate 	return (ret);
15827c478bd9Sstevel@tonic-gate }
15837c478bd9Sstevel@tonic-gate 
1584c5cd6260S /*
1585c5cd6260S  * Setup the brand's pre and post state change callbacks, as well as the
1586c5cd6260S  * query callback, if any of these exist.
1587c5cd6260S  */
1588c5cd6260S static int
1589c5cd6260S brand_callback_init(brand_handle_t bh, char *zone_name)
1590c5cd6260S {
1591c5cd6260S 	char zpath[MAXPATHLEN];
1592c5cd6260S 
1593c5cd6260S 	if (zone_get_zonepath(zone_name, zpath, sizeof (zpath)) != Z_OK)
1594c5cd6260S 		return (-1);
1595c5cd6260S 
1596c5cd6260S 	(void) strlcpy(pre_statechg_hook, EXEC_PREFIX,
1597c5cd6260S 	    sizeof (pre_statechg_hook));
1598c5cd6260S 
1599c5cd6260S 	if (brand_get_prestatechange(bh, zone_name, zpath,
1600c5cd6260S 	    pre_statechg_hook + EXEC_LEN,
1601c5cd6260S 	    sizeof (pre_statechg_hook) - EXEC_LEN) != 0)
1602c5cd6260S 		return (-1);
1603c5cd6260S 
1604c5cd6260S 	if (strlen(pre_statechg_hook) <= EXEC_LEN)
1605c5cd6260S 		pre_statechg_hook[0] = '\0';
1606c5cd6260S 
1607c5cd6260S 	(void) strlcpy(post_statechg_hook, EXEC_PREFIX,
1608c5cd6260S 	    sizeof (post_statechg_hook));
1609c5cd6260S 
1610c5cd6260S 	if (brand_get_poststatechange(bh, zone_name, zpath,
1611c5cd6260S 	    post_statechg_hook + EXEC_LEN,
1612c5cd6260S 	    sizeof (post_statechg_hook) - EXEC_LEN) != 0)
1613c5cd6260S 		return (-1);
1614c5cd6260S 
1615c5cd6260S 	if (strlen(post_statechg_hook) <= EXEC_LEN)
1616c5cd6260S 		post_statechg_hook[0] = '\0';
1617c5cd6260S 
1618c5cd6260S 	(void) strlcpy(query_hook, EXEC_PREFIX,
1619c5cd6260S 	    sizeof (query_hook));
1620c5cd6260S 
1621c5cd6260S 	if (brand_get_query(bh, zone_name, zpath, query_hook + EXEC_LEN,
1622c5cd6260S 	    sizeof (query_hook) - EXEC_LEN) != 0)
1623c5cd6260S 		return (-1);
1624c5cd6260S 
1625c5cd6260S 	if (strlen(query_hook) <= EXEC_LEN)
1626c5cd6260S 		query_hook[0] = '\0';
1627c5cd6260S 
1628c5cd6260S 	return (0);
1629c5cd6260S }
1630c5cd6260S 
16317c478bd9Sstevel@tonic-gate int
16327c478bd9Sstevel@tonic-gate main(int argc, char *argv[])
16337c478bd9Sstevel@tonic-gate {
16347c478bd9Sstevel@tonic-gate 	int opt;
16357c478bd9Sstevel@tonic-gate 	zoneid_t zid;
16367c478bd9Sstevel@tonic-gate 	priv_set_t *privset;
16377c478bd9Sstevel@tonic-gate 	zone_state_t zstate;
16387c478bd9Sstevel@tonic-gate 	char parents_locale[MAXPATHLEN];
1639123807fbSedp 	brand_handle_t bh;
16407c478bd9Sstevel@tonic-gate 	int err;
16417c478bd9Sstevel@tonic-gate 
16427c478bd9Sstevel@tonic-gate 	pid_t pid;
16437c478bd9Sstevel@tonic-gate 	sigset_t blockset;
16447c478bd9Sstevel@tonic-gate 	sigset_t block_cld;
16457c478bd9Sstevel@tonic-gate 
16467c478bd9Sstevel@tonic-gate 	struct {
16477c478bd9Sstevel@tonic-gate 		sema_t sem;
16487c478bd9Sstevel@tonic-gate 		int status;
16497c478bd9Sstevel@tonic-gate 		zlog_t log;
16507c478bd9Sstevel@tonic-gate 	} *shstate;
16517c478bd9Sstevel@tonic-gate 	size_t shstatelen = getpagesize();
16527c478bd9Sstevel@tonic-gate 
16537c478bd9Sstevel@tonic-gate 	zlog_t errlog;
16547c478bd9Sstevel@tonic-gate 	zlog_t *zlogp;
16557c478bd9Sstevel@tonic-gate 
16565cb4571dSdp 	int ctfd;
16575cb4571dSdp 
16587c478bd9Sstevel@tonic-gate 	progname = get_execbasename(argv[0]);
16597c478bd9Sstevel@tonic-gate 
16607c478bd9Sstevel@tonic-gate 	/*
16617c478bd9Sstevel@tonic-gate 	 * Make sure stderr is unbuffered
16627c478bd9Sstevel@tonic-gate 	 */
16637c478bd9Sstevel@tonic-gate 	(void) setbuffer(stderr, NULL, 0);
16647c478bd9Sstevel@tonic-gate 
16657c478bd9Sstevel@tonic-gate 	/*
16667c478bd9Sstevel@tonic-gate 	 * Get out of the way of mounted filesystems, since we will daemonize
16677c478bd9Sstevel@tonic-gate 	 * soon.
16687c478bd9Sstevel@tonic-gate 	 */
16697c478bd9Sstevel@tonic-gate 	(void) chdir("/");
16707c478bd9Sstevel@tonic-gate 
16717c478bd9Sstevel@tonic-gate 	/*
16727c478bd9Sstevel@tonic-gate 	 * Use the default system umask per PSARC 1998/110 rather than
16737c478bd9Sstevel@tonic-gate 	 * anything that may have been set by the caller.
16747c478bd9Sstevel@tonic-gate 	 */
16757c478bd9Sstevel@tonic-gate 	(void) umask(CMASK);
16767c478bd9Sstevel@tonic-gate 
16777c478bd9Sstevel@tonic-gate 	/*
16787c478bd9Sstevel@tonic-gate 	 * Initially we want to use our parent's locale.
16797c478bd9Sstevel@tonic-gate 	 */
16807c478bd9Sstevel@tonic-gate 	(void) setlocale(LC_ALL, "");
16817c478bd9Sstevel@tonic-gate 	(void) textdomain(TEXT_DOMAIN);
16827c478bd9Sstevel@tonic-gate 	(void) strlcpy(parents_locale, setlocale(LC_MESSAGES, NULL),
16837c478bd9Sstevel@tonic-gate 	    sizeof (parents_locale));
16847c478bd9Sstevel@tonic-gate 
16857c478bd9Sstevel@tonic-gate 	/*
16867c478bd9Sstevel@tonic-gate 	 * This zlog_t is used for writing to stderr
16877c478bd9Sstevel@tonic-gate 	 */
16887c478bd9Sstevel@tonic-gate 	errlog.logfile = stderr;
16897c478bd9Sstevel@tonic-gate 	errlog.buflen = errlog.loglen = 0;
16907c478bd9Sstevel@tonic-gate 	errlog.buf = errlog.log = NULL;
16917c478bd9Sstevel@tonic-gate 	errlog.locale = parents_locale;
16927c478bd9Sstevel@tonic-gate 
16937c478bd9Sstevel@tonic-gate 	/*
16947c478bd9Sstevel@tonic-gate 	 * We start off writing to stderr until we're ready to daemonize.
16957c478bd9Sstevel@tonic-gate 	 */
16967c478bd9Sstevel@tonic-gate 	zlogp = &errlog;
16977c478bd9Sstevel@tonic-gate 
16987c478bd9Sstevel@tonic-gate 	/*
16997c478bd9Sstevel@tonic-gate 	 * Process options.
17007c478bd9Sstevel@tonic-gate 	 */
1701108322fbScarlsonj 	while ((opt = getopt(argc, argv, "R:z:")) != EOF) {
17027c478bd9Sstevel@tonic-gate 		switch (opt) {
1703108322fbScarlsonj 		case 'R':
1704108322fbScarlsonj 			zonecfg_set_root(optarg);
1705108322fbScarlsonj 			break;
17067c478bd9Sstevel@tonic-gate 		case 'z':
17077c478bd9Sstevel@tonic-gate 			zone_name = optarg;
17087c478bd9Sstevel@tonic-gate 			break;
17097c478bd9Sstevel@tonic-gate 		default:
17107c478bd9Sstevel@tonic-gate 			usage();
17117c478bd9Sstevel@tonic-gate 		}
17127c478bd9Sstevel@tonic-gate 	}
17137c478bd9Sstevel@tonic-gate 
17147c478bd9Sstevel@tonic-gate 	if (zone_name == NULL)
17157c478bd9Sstevel@tonic-gate 		usage();
17167c478bd9Sstevel@tonic-gate 
17177c478bd9Sstevel@tonic-gate 	/*
17187c478bd9Sstevel@tonic-gate 	 * Because usage() prints directly to stderr, it has gettext()
17197c478bd9Sstevel@tonic-gate 	 * wrapping, which depends on the locale.  But since zerror() calls
17207c478bd9Sstevel@tonic-gate 	 * localize() which tweaks the locale, it is not safe to call zerror()
17217c478bd9Sstevel@tonic-gate 	 * until after the last call to usage().  Fortunately, the last call
17227c478bd9Sstevel@tonic-gate 	 * to usage() is just above and the first call to zerror() is just
17237c478bd9Sstevel@tonic-gate 	 * below.  Don't mess this up.
17247c478bd9Sstevel@tonic-gate 	 */
17257c478bd9Sstevel@tonic-gate 	if (strcmp(zone_name, GLOBAL_ZONENAME) == 0) {
17267c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_FALSE, "cannot manage the %s zone",
17277c478bd9Sstevel@tonic-gate 		    GLOBAL_ZONENAME);
17287c478bd9Sstevel@tonic-gate 		return (1);
17297c478bd9Sstevel@tonic-gate 	}
17307c478bd9Sstevel@tonic-gate 
17317c478bd9Sstevel@tonic-gate 	if (zone_get_id(zone_name, &zid) != 0) {
17323f2f09c1Sdp 		zerror(zlogp, B_FALSE, "could not manage %s: %s", zone_name,
17337c478bd9Sstevel@tonic-gate 		    zonecfg_strerror(Z_NO_ZONE));
17347c478bd9Sstevel@tonic-gate 		return (1);
17357c478bd9Sstevel@tonic-gate 	}
17367c478bd9Sstevel@tonic-gate 
17377c478bd9Sstevel@tonic-gate 	if ((err = zone_get_state(zone_name, &zstate)) != Z_OK) {
17383f2f09c1Sdp 		zerror(zlogp, B_FALSE, "failed to get zone state: %s",
17397c478bd9Sstevel@tonic-gate 		    zonecfg_strerror(err));
17407c478bd9Sstevel@tonic-gate 		return (1);
17417c478bd9Sstevel@tonic-gate 	}
17429acbbeafSnn35248 	if (zstate < ZONE_STATE_INCOMPLETE) {
17437c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_FALSE,
17447c478bd9Sstevel@tonic-gate 		    "cannot manage a zone which is in state '%s'",
17457c478bd9Sstevel@tonic-gate 		    zone_state_str(zstate));
17467c478bd9Sstevel@tonic-gate 		return (1);
17477c478bd9Sstevel@tonic-gate 	}
17487c478bd9Sstevel@tonic-gate 
17499acbbeafSnn35248 	/* Get a handle to the brand info for this zone */
17509acbbeafSnn35248 	if ((zone_get_brand(zone_name, brand_name, sizeof (brand_name))
1751123807fbSedp 	    != Z_OK) || (bh = brand_open(brand_name)) == NULL) {
17529acbbeafSnn35248 		zerror(zlogp, B_FALSE, "unable to determine zone brand");
17539acbbeafSnn35248 		return (1);
17549acbbeafSnn35248 	}
1755123807fbSedp 	zone_isnative = brand_is_native(bh);
175684561e8cStd153743 	zone_iscluster = (strcmp(brand_name, CLUSTER_BRAND_NAME) == 0);
17579a5d73e0SRic Aleshire 	zone_islabeled = (strcmp(brand_name, LABELED_BRAND_NAME) == 0);
1758c5cd6260S 
1759c5cd6260S 	/* Get state change brand hooks. */
1760c5cd6260S 	if (brand_callback_init(bh, zone_name) == -1) {
1761c5cd6260S 		zerror(zlogp, B_TRUE,
1762c5cd6260S 		    "failed to initialize brand state change hooks");
1763c5cd6260S 		brand_close(bh);
1764c5cd6260S 		return (1);
1765c5cd6260S 	}
1766c5cd6260S 
1767123807fbSedp 	brand_close(bh);
17689acbbeafSnn35248 
17697c478bd9Sstevel@tonic-gate 	/*
17707c478bd9Sstevel@tonic-gate 	 * Check that we have all privileges.  It would be nice to pare
17717c478bd9Sstevel@tonic-gate 	 * this down, but this is at least a first cut.
17727c478bd9Sstevel@tonic-gate 	 */
17737c478bd9Sstevel@tonic-gate 	if ((privset = priv_allocset()) == NULL) {
17747c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
17757c478bd9Sstevel@tonic-gate 		return (1);
17767c478bd9Sstevel@tonic-gate 	}
17777c478bd9Sstevel@tonic-gate 
17787c478bd9Sstevel@tonic-gate 	if (getppriv(PRIV_EFFECTIVE, privset) != 0) {
17797c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "%s failed", "getppriv");
17807c478bd9Sstevel@tonic-gate 		priv_freeset(privset);
17817c478bd9Sstevel@tonic-gate 		return (1);
17827c478bd9Sstevel@tonic-gate 	}
17837c478bd9Sstevel@tonic-gate 
17847c478bd9Sstevel@tonic-gate 	if (priv_isfullset(privset) == B_FALSE) {
17857c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_FALSE, "You lack sufficient privilege to "
17863f2f09c1Sdp 		    "run this command (all privs required)");
17877c478bd9Sstevel@tonic-gate 		priv_freeset(privset);
17887c478bd9Sstevel@tonic-gate 		return (1);
17897c478bd9Sstevel@tonic-gate 	}
17907c478bd9Sstevel@tonic-gate 	priv_freeset(privset);
17917c478bd9Sstevel@tonic-gate 
17927c478bd9Sstevel@tonic-gate 	if (mkzonedir(zlogp) != 0)
17937c478bd9Sstevel@tonic-gate 		return (1);
17947c478bd9Sstevel@tonic-gate 
17957c478bd9Sstevel@tonic-gate 	/*
17967c478bd9Sstevel@tonic-gate 	 * Pre-fork: setup shared state
17977c478bd9Sstevel@tonic-gate 	 */
17987c478bd9Sstevel@tonic-gate 	if ((shstate = (void *)mmap(NULL, shstatelen,
17997c478bd9Sstevel@tonic-gate 	    PROT_READ|PROT_WRITE, MAP_SHARED|MAP_ANON, -1, (off_t)0)) ==
18007c478bd9Sstevel@tonic-gate 	    MAP_FAILED) {
18017c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "%s failed", "mmap");
18027c478bd9Sstevel@tonic-gate 		return (1);
18037c478bd9Sstevel@tonic-gate 	}
18047c478bd9Sstevel@tonic-gate 	if (sema_init(&shstate->sem, 0, USYNC_PROCESS, NULL) != 0) {
18057c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "%s failed", "sema_init()");
18067c478bd9Sstevel@tonic-gate 		(void) munmap((char *)shstate, shstatelen);
18077c478bd9Sstevel@tonic-gate 		return (1);
18087c478bd9Sstevel@tonic-gate 	}
18097c478bd9Sstevel@tonic-gate 	shstate->log.logfile = NULL;
18107c478bd9Sstevel@tonic-gate 	shstate->log.buflen = shstatelen - sizeof (*shstate);
18117c478bd9Sstevel@tonic-gate 	shstate->log.loglen = shstate->log.buflen;
18127c478bd9Sstevel@tonic-gate 	shstate->log.buf = (char *)shstate + sizeof (*shstate);
18137c478bd9Sstevel@tonic-gate 	shstate->log.log = shstate->log.buf;
18147c478bd9Sstevel@tonic-gate 	shstate->log.locale = parents_locale;
18157c478bd9Sstevel@tonic-gate 	shstate->status = -1;
18167c478bd9Sstevel@tonic-gate 
18177c478bd9Sstevel@tonic-gate 	/*
18187c478bd9Sstevel@tonic-gate 	 * We need a SIGCHLD handler so the sema_wait() below will wake
18197c478bd9Sstevel@tonic-gate 	 * up if the child dies without doing a sema_post().
18207c478bd9Sstevel@tonic-gate 	 */
18217c478bd9Sstevel@tonic-gate 	(void) sigset(SIGCHLD, sigchld);
18227c478bd9Sstevel@tonic-gate 	/*
18237c478bd9Sstevel@tonic-gate 	 * We must mask SIGCHLD until after we've coped with the fork
18247c478bd9Sstevel@tonic-gate 	 * sufficiently to deal with it; otherwise we can race and
18257c478bd9Sstevel@tonic-gate 	 * receive the signal before pid has been initialized
18267c478bd9Sstevel@tonic-gate 	 * (yes, this really happens).
18277c478bd9Sstevel@tonic-gate 	 */
18287c478bd9Sstevel@tonic-gate 	(void) sigemptyset(&block_cld);
18297c478bd9Sstevel@tonic-gate 	(void) sigaddset(&block_cld, SIGCHLD);
18307c478bd9Sstevel@tonic-gate 	(void) sigprocmask(SIG_BLOCK, &block_cld, NULL);
18317c478bd9Sstevel@tonic-gate 
18325cb4571dSdp 	if ((ctfd = init_template()) == -1) {
18335cb4571dSdp 		zerror(zlogp, B_TRUE, "failed to create contract");
18345cb4571dSdp 		return (1);
18355cb4571dSdp 	}
18365cb4571dSdp 
18377c478bd9Sstevel@tonic-gate 	/*
18387c478bd9Sstevel@tonic-gate 	 * Do not let another thread localize a message while we are forking.
18397c478bd9Sstevel@tonic-gate 	 */
18407c478bd9Sstevel@tonic-gate 	(void) mutex_lock(&msglock);
18417c478bd9Sstevel@tonic-gate 	pid = fork();
18427c478bd9Sstevel@tonic-gate 	(void) mutex_unlock(&msglock);
18435cb4571dSdp 
18445cb4571dSdp 	/*
18455cb4571dSdp 	 * In all cases (parent, child, and in the event of an error) we
18465cb4571dSdp 	 * don't want to cause creation of contracts on subsequent fork()s.
18475cb4571dSdp 	 */
18485cb4571dSdp 	(void) ct_tmpl_clear(ctfd);
18495cb4571dSdp 	(void) close(ctfd);
18505cb4571dSdp 
18517c478bd9Sstevel@tonic-gate 	if (pid == -1) {
18527c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "could not fork");
18537c478bd9Sstevel@tonic-gate 		return (1);
18547c478bd9Sstevel@tonic-gate 
18557c478bd9Sstevel@tonic-gate 	} else if (pid > 0) { /* parent */
18567c478bd9Sstevel@tonic-gate 		(void) sigprocmask(SIG_UNBLOCK, &block_cld, NULL);
18577c478bd9Sstevel@tonic-gate 		/*
18587c478bd9Sstevel@tonic-gate 		 * This marks a window of vulnerability in which we receive
18597c478bd9Sstevel@tonic-gate 		 * the SIGCLD before falling into sema_wait (normally we would
18607c478bd9Sstevel@tonic-gate 		 * get woken up from sema_wait with EINTR upon receipt of
18617c478bd9Sstevel@tonic-gate 		 * SIGCLD).  So we may need to use some other scheme like
18627c478bd9Sstevel@tonic-gate 		 * sema_posting in the sigcld handler.
18637c478bd9Sstevel@tonic-gate 		 * blech
18647c478bd9Sstevel@tonic-gate 		 */
18657c478bd9Sstevel@tonic-gate 		(void) sema_wait(&shstate->sem);
18667c478bd9Sstevel@tonic-gate 		(void) sema_destroy(&shstate->sem);
18677c478bd9Sstevel@tonic-gate 		if (shstate->status != 0)
18687c478bd9Sstevel@tonic-gate 			(void) waitpid(pid, NULL, WNOHANG);
18697c478bd9Sstevel@tonic-gate 		/*
18707c478bd9Sstevel@tonic-gate 		 * It's ok if we die with SIGPIPE.  It's not like we could have
18717c478bd9Sstevel@tonic-gate 		 * done anything about it.
18727c478bd9Sstevel@tonic-gate 		 */
18737c478bd9Sstevel@tonic-gate 		(void) fprintf(stderr, "%s", shstate->log.buf);
18747c478bd9Sstevel@tonic-gate 		_exit(shstate->status == 0 ? 0 : 1);
18757c478bd9Sstevel@tonic-gate 	}
18767c478bd9Sstevel@tonic-gate 
18777c478bd9Sstevel@tonic-gate 	/*
18787c478bd9Sstevel@tonic-gate 	 * The child charges on.
18797c478bd9Sstevel@tonic-gate 	 */
18807c478bd9Sstevel@tonic-gate 	(void) sigset(SIGCHLD, SIG_DFL);
18817c478bd9Sstevel@tonic-gate 	(void) sigprocmask(SIG_UNBLOCK, &block_cld, NULL);
18827c478bd9Sstevel@tonic-gate 
18837c478bd9Sstevel@tonic-gate 	/*
18847c478bd9Sstevel@tonic-gate 	 * SIGPIPE can be delivered if we write to a socket for which the
18857c478bd9Sstevel@tonic-gate 	 * peer endpoint is gone.  That can lead to too-early termination
18867c478bd9Sstevel@tonic-gate 	 * of zoneadmd, and that's not good eats.
18877c478bd9Sstevel@tonic-gate 	 */
18887c478bd9Sstevel@tonic-gate 	(void) sigset(SIGPIPE, SIG_IGN);
18897c478bd9Sstevel@tonic-gate 	/*
18907c478bd9Sstevel@tonic-gate 	 * Stop using stderr
18917c478bd9Sstevel@tonic-gate 	 */
18927c478bd9Sstevel@tonic-gate 	zlogp = &shstate->log;
18937c478bd9Sstevel@tonic-gate 
18947c478bd9Sstevel@tonic-gate 	/*
18957c478bd9Sstevel@tonic-gate 	 * We don't need stdout/stderr from now on.
18967c478bd9Sstevel@tonic-gate 	 */
18977c478bd9Sstevel@tonic-gate 	closefrom(0);
18987c478bd9Sstevel@tonic-gate 
18997c478bd9Sstevel@tonic-gate 	/*
19007c478bd9Sstevel@tonic-gate 	 * Initialize the syslog zlog_t.  This needs to be done after
19017c478bd9Sstevel@tonic-gate 	 * the call to closefrom().
19027c478bd9Sstevel@tonic-gate 	 */
19037c478bd9Sstevel@tonic-gate 	logsys.buf = logsys.log = NULL;
19047c478bd9Sstevel@tonic-gate 	logsys.buflen = logsys.loglen = 0;
19057c478bd9Sstevel@tonic-gate 	logsys.logfile = NULL;
19067c478bd9Sstevel@tonic-gate 	logsys.locale = DEFAULT_LOCALE;
19077c478bd9Sstevel@tonic-gate 
19087c478bd9Sstevel@tonic-gate 	openlog("zoneadmd", LOG_PID, LOG_DAEMON);
19097c478bd9Sstevel@tonic-gate 
19107c478bd9Sstevel@tonic-gate 	/*
19117c478bd9Sstevel@tonic-gate 	 * The eventstream is used to publish state changes in the zone
19127c478bd9Sstevel@tonic-gate 	 * from the door threads to the console I/O poller.
19137c478bd9Sstevel@tonic-gate 	 */
19147c478bd9Sstevel@tonic-gate 	if (eventstream_init() == -1) {
19157c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "unable to create eventstream");
19167c478bd9Sstevel@tonic-gate 		goto child_out;
19177c478bd9Sstevel@tonic-gate 	}
19187c478bd9Sstevel@tonic-gate 
19197c478bd9Sstevel@tonic-gate 	(void) snprintf(zone_door_path, sizeof (zone_door_path),
1920108322fbScarlsonj 	    "%s" ZONE_DOOR_PATH, zonecfg_get_root(), zone_name);
19217c478bd9Sstevel@tonic-gate 
19227c478bd9Sstevel@tonic-gate 	/*
19237c478bd9Sstevel@tonic-gate 	 * See if another zoneadmd is running for this zone.  If not, then we
19247c478bd9Sstevel@tonic-gate 	 * can now modify system state.
19257c478bd9Sstevel@tonic-gate 	 */
19267c478bd9Sstevel@tonic-gate 	if (make_daemon_exclusive(zlogp) == -1)
19277c478bd9Sstevel@tonic-gate 		goto child_out;
19287c478bd9Sstevel@tonic-gate 
19297c478bd9Sstevel@tonic-gate 
19307c478bd9Sstevel@tonic-gate 	/*
19317c478bd9Sstevel@tonic-gate 	 * Create/join a new session; we need to be careful of what we do with
19327c478bd9Sstevel@tonic-gate 	 * the console from now on so we don't end up being the session leader
19337c478bd9Sstevel@tonic-gate 	 * for the terminal we're going to be handing out.
19347c478bd9Sstevel@tonic-gate 	 */
19357c478bd9Sstevel@tonic-gate 	(void) setsid();
19367c478bd9Sstevel@tonic-gate 
19377c478bd9Sstevel@tonic-gate 	/*
19387c478bd9Sstevel@tonic-gate 	 * This thread shouldn't be receiving any signals; in particular,
19397c478bd9Sstevel@tonic-gate 	 * SIGCHLD should be received by the thread doing the fork().
19407c478bd9Sstevel@tonic-gate 	 */
19417c478bd9Sstevel@tonic-gate 	(void) sigfillset(&blockset);
19427c478bd9Sstevel@tonic-gate 	(void) thr_sigsetmask(SIG_BLOCK, &blockset, NULL);
19437c478bd9Sstevel@tonic-gate 
19447c478bd9Sstevel@tonic-gate 	/*
19457c478bd9Sstevel@tonic-gate 	 * Setup the console device and get ready to serve the console;
19467c478bd9Sstevel@tonic-gate 	 * once this has completed, we're ready to let console clients
19477c478bd9Sstevel@tonic-gate 	 * make an attempt to connect (they will block until
19487c478bd9Sstevel@tonic-gate 	 * serve_console_sock() below gets called, and any pending
19497c478bd9Sstevel@tonic-gate 	 * connection is accept()ed).
19507c478bd9Sstevel@tonic-gate 	 */
19519d5056eaSjv227347 	if (!zonecfg_in_alt_root() && init_console(zlogp) < 0)
19527c478bd9Sstevel@tonic-gate 		goto child_out;
19537c478bd9Sstevel@tonic-gate 
19547c478bd9Sstevel@tonic-gate 	/*
19557c478bd9Sstevel@tonic-gate 	 * Take the lock now, so that when the door server gets going, we
19567c478bd9Sstevel@tonic-gate 	 * are guaranteed that it won't take a request until we are sure
19577c478bd9Sstevel@tonic-gate 	 * that everything is completely set up.  See the child_out: label
19587c478bd9Sstevel@tonic-gate 	 * below to see why this matters.
19597c478bd9Sstevel@tonic-gate 	 */
19607c478bd9Sstevel@tonic-gate 	(void) mutex_lock(&lock);
19617c478bd9Sstevel@tonic-gate 
1962108322fbScarlsonj 	/* Init semaphore for scratch zones. */
1963108322fbScarlsonj 	if (sema_init(&scratch_sem, 0, USYNC_THREAD, NULL) == -1) {
1964108322fbScarlsonj 		zerror(zlogp, B_TRUE,
1965108322fbScarlsonj 		    "failed to initialize semaphore for scratch zone");
1966108322fbScarlsonj 		goto child_out;
1967108322fbScarlsonj 	}
1968108322fbScarlsonj 
19694ac67f02SAnurag S. Maskey 	/* open the dladm handle */
19704ac67f02SAnurag S. Maskey 	if (dladm_open(&dld_handle) != DLADM_STATUS_OK) {
19714ac67f02SAnurag S. Maskey 		zerror(zlogp, B_FALSE, "failed to open dladm handle");
19724ac67f02SAnurag S. Maskey 		goto child_out;
19734ac67f02SAnurag S. Maskey 	}
19744ac67f02SAnurag S. Maskey 
19757c478bd9Sstevel@tonic-gate 	/*
19767c478bd9Sstevel@tonic-gate 	 * Note: door setup must occur *after* the console is setup.
19777c478bd9Sstevel@tonic-gate 	 * This is so that as zlogin tests the door to see if zoneadmd
19787c478bd9Sstevel@tonic-gate 	 * is ready yet, we know that the console will get serviced
19797c478bd9Sstevel@tonic-gate 	 * once door_info() indicates that the door is "up".
19807c478bd9Sstevel@tonic-gate 	 */
19817c478bd9Sstevel@tonic-gate 	if (setup_door(zlogp) == -1)
19827c478bd9Sstevel@tonic-gate 		goto child_out;
19837c478bd9Sstevel@tonic-gate 
19847c478bd9Sstevel@tonic-gate 	/*
19857c478bd9Sstevel@tonic-gate 	 * Things seem OK so far; tell the parent process that we're done
19867c478bd9Sstevel@tonic-gate 	 * with setup tasks.  This will cause the parent to exit, signalling
19877c478bd9Sstevel@tonic-gate 	 * to zoneadm, zlogin, or whatever forked it that we are ready to
19887c478bd9Sstevel@tonic-gate 	 * service requests.
19897c478bd9Sstevel@tonic-gate 	 */
19907c478bd9Sstevel@tonic-gate 	shstate->status = 0;
19917c478bd9Sstevel@tonic-gate 	(void) sema_post(&shstate->sem);
19927c478bd9Sstevel@tonic-gate 	(void) munmap((char *)shstate, shstatelen);
19937c478bd9Sstevel@tonic-gate 	shstate = NULL;
19947c478bd9Sstevel@tonic-gate 
19957c478bd9Sstevel@tonic-gate 	(void) mutex_unlock(&lock);
19967c478bd9Sstevel@tonic-gate 
19977c478bd9Sstevel@tonic-gate 	/*
19987c478bd9Sstevel@tonic-gate 	 * zlogp is now invalid, so reset it to the syslog logger.
19997c478bd9Sstevel@tonic-gate 	 */
20007c478bd9Sstevel@tonic-gate 	zlogp = &logsys;
20017c478bd9Sstevel@tonic-gate 
20027c478bd9Sstevel@tonic-gate 	/*
20037c478bd9Sstevel@tonic-gate 	 * Now that we are free of any parents, switch to the default locale.
20047c478bd9Sstevel@tonic-gate 	 */
20057c478bd9Sstevel@tonic-gate 	(void) setlocale(LC_ALL, DEFAULT_LOCALE);
20067c478bd9Sstevel@tonic-gate 
20077c478bd9Sstevel@tonic-gate 	/*
20087c478bd9Sstevel@tonic-gate 	 * At this point the setup portion of main() is basically done, so
20097c478bd9Sstevel@tonic-gate 	 * we reuse this thread to manage the zone console.  When
20107c478bd9Sstevel@tonic-gate 	 * serve_console() has returned, we are past the point of no return
20117c478bd9Sstevel@tonic-gate 	 * in the life of this zoneadmd.
20127c478bd9Sstevel@tonic-gate 	 */
2013108322fbScarlsonj 	if (zonecfg_in_alt_root()) {
2014108322fbScarlsonj 		/*
2015108322fbScarlsonj 		 * This is just awful, but mounted scratch zones don't (and
2016108322fbScarlsonj 		 * can't) have consoles.  We just wait for unmount instead.
2017108322fbScarlsonj 		 */
2018108322fbScarlsonj 		while (sema_wait(&scratch_sem) == EINTR)
2019108322fbScarlsonj 			;
2020108322fbScarlsonj 	} else {
20217c478bd9Sstevel@tonic-gate 		serve_console(zlogp);
20227c478bd9Sstevel@tonic-gate 		assert(in_death_throes);
2023108322fbScarlsonj 	}
20247c478bd9Sstevel@tonic-gate 
20257c478bd9Sstevel@tonic-gate 	/*
20267c478bd9Sstevel@tonic-gate 	 * This is the next-to-last part of the exit interlock.  Upon calling
20277c478bd9Sstevel@tonic-gate 	 * fdetach(), the door will go unreferenced; once any
20287c478bd9Sstevel@tonic-gate 	 * outstanding requests (like the door thread doing Z_HALT) are
20297c478bd9Sstevel@tonic-gate 	 * done, the door will get an UNREF notification; when it handles
20307c478bd9Sstevel@tonic-gate 	 * the UNREF, the door server will cause the exit.
20317c478bd9Sstevel@tonic-gate 	 */
20327c478bd9Sstevel@tonic-gate 	assert(!MUTEX_HELD(&lock));
20337c478bd9Sstevel@tonic-gate 	(void) fdetach(zone_door_path);
20344ac67f02SAnurag S. Maskey 
20357c478bd9Sstevel@tonic-gate 	for (;;)
20367c478bd9Sstevel@tonic-gate 		(void) pause();
20377c478bd9Sstevel@tonic-gate 
20387c478bd9Sstevel@tonic-gate child_out:
20397c478bd9Sstevel@tonic-gate 	assert(pid == 0);
20407c478bd9Sstevel@tonic-gate 	if (shstate != NULL) {
20417c478bd9Sstevel@tonic-gate 		shstate->status = -1;
20427c478bd9Sstevel@tonic-gate 		(void) sema_post(&shstate->sem);
20437c478bd9Sstevel@tonic-gate 		(void) munmap((char *)shstate, shstatelen);
20447c478bd9Sstevel@tonic-gate 	}
20457c478bd9Sstevel@tonic-gate 
20467c478bd9Sstevel@tonic-gate 	/*
20477c478bd9Sstevel@tonic-gate 	 * This might trigger an unref notification, but if so,
20487c478bd9Sstevel@tonic-gate 	 * we are still holding the lock, so our call to exit will
20497c478bd9Sstevel@tonic-gate 	 * ultimately win the race and will publish the right exit
20507c478bd9Sstevel@tonic-gate 	 * code.
20517c478bd9Sstevel@tonic-gate 	 */
20527c478bd9Sstevel@tonic-gate 	if (zone_door != -1) {
20537c478bd9Sstevel@tonic-gate 		assert(MUTEX_HELD(&lock));
20547c478bd9Sstevel@tonic-gate 		(void) door_revoke(zone_door);
20557c478bd9Sstevel@tonic-gate 		(void) fdetach(zone_door_path);
20567c478bd9Sstevel@tonic-gate 	}
20574ac67f02SAnurag S. Maskey 
20584ac67f02SAnurag S. Maskey 	if (dld_handle != NULL)
20594ac67f02SAnurag S. Maskey 		dladm_close(dld_handle);
20604ac67f02SAnurag S. Maskey 
20617c478bd9Sstevel@tonic-gate 	return (1); /* return from main() forcibly exits an MT process */
20627c478bd9Sstevel@tonic-gate }
2063