17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5ffbafc53Scomay * Common Development and Distribution License (the "License"). 6ffbafc53Scomay * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 21ffbafc53Scomay 227c478bd9Sstevel@tonic-gate /* 239d5056eaSjv227347 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 247c478bd9Sstevel@tonic-gate * Use is subject to license terms. 257c478bd9Sstevel@tonic-gate */ 267c478bd9Sstevel@tonic-gate 277c478bd9Sstevel@tonic-gate /* 287c478bd9Sstevel@tonic-gate * zoneadmd manages zones; one zoneadmd process is launched for each 297c478bd9Sstevel@tonic-gate * non-global zone on the system. This daemon juggles four jobs: 307c478bd9Sstevel@tonic-gate * 317c478bd9Sstevel@tonic-gate * - Implement setup and teardown of the zone "virtual platform": mount and 327c478bd9Sstevel@tonic-gate * unmount filesystems; create and destroy network interfaces; communicate 337c478bd9Sstevel@tonic-gate * with devfsadmd to lay out devices for the zone; instantiate the zone 347c478bd9Sstevel@tonic-gate * console device; configure process runtime attributes such as resource 357c478bd9Sstevel@tonic-gate * controls, pool bindings, fine-grained privileges. 367c478bd9Sstevel@tonic-gate * 377c478bd9Sstevel@tonic-gate * - Launch the zone's init(1M) process. 387c478bd9Sstevel@tonic-gate * 397c478bd9Sstevel@tonic-gate * - Implement a door server; clients (like zoneadm) connect to the door 407c478bd9Sstevel@tonic-gate * server and request zone state changes. The kernel is also a client of 417c478bd9Sstevel@tonic-gate * this door server. A request to halt or reboot the zone which originates 427c478bd9Sstevel@tonic-gate * *inside* the zone results in a door upcall from the kernel into zoneadmd. 437c478bd9Sstevel@tonic-gate * 447c478bd9Sstevel@tonic-gate * One minor problem is that messages emitted by zoneadmd need to be passed 457c478bd9Sstevel@tonic-gate * back to the zoneadm process making the request. These messages need to 467c478bd9Sstevel@tonic-gate * be rendered in the client's locale; so, this is passed in as part of the 477c478bd9Sstevel@tonic-gate * request. The exception is the kernel upcall to zoneadmd, in which case 487c478bd9Sstevel@tonic-gate * messages are syslog'd. 497c478bd9Sstevel@tonic-gate * 507c478bd9Sstevel@tonic-gate * To make all of this work, the Makefile adds -a to xgettext to extract *all* 517c478bd9Sstevel@tonic-gate * strings, and an exclusion file (zoneadmd.xcl) is used to exclude those 527c478bd9Sstevel@tonic-gate * strings which do not need to be translated. 537c478bd9Sstevel@tonic-gate * 547c478bd9Sstevel@tonic-gate * - Act as a console server for zlogin -C processes; see comments in zcons.c 557c478bd9Sstevel@tonic-gate * for more information about the zone console architecture. 567c478bd9Sstevel@tonic-gate * 577c478bd9Sstevel@tonic-gate * DESIGN NOTES 587c478bd9Sstevel@tonic-gate * 597c478bd9Sstevel@tonic-gate * Restart: 607c478bd9Sstevel@tonic-gate * A chief design constraint of zoneadmd is that it should be restartable in 617c478bd9Sstevel@tonic-gate * the case that the administrator kills it off, or it suffers a fatal error, 627c478bd9Sstevel@tonic-gate * without the running zone being impacted; this is akin to being able to 637c478bd9Sstevel@tonic-gate * reboot the service processor of a server without affecting the OS instance. 647c478bd9Sstevel@tonic-gate */ 657c478bd9Sstevel@tonic-gate 667c478bd9Sstevel@tonic-gate #include <sys/param.h> 677c478bd9Sstevel@tonic-gate #include <sys/mman.h> 687c478bd9Sstevel@tonic-gate #include <sys/types.h> 697c478bd9Sstevel@tonic-gate #include <sys/stat.h> 707c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h> 717c478bd9Sstevel@tonic-gate 727c478bd9Sstevel@tonic-gate #include <bsm/adt.h> 737c478bd9Sstevel@tonic-gate #include <bsm/adt_event.h> 747c478bd9Sstevel@tonic-gate 757c478bd9Sstevel@tonic-gate #include <alloca.h> 767c478bd9Sstevel@tonic-gate #include <assert.h> 777c478bd9Sstevel@tonic-gate #include <errno.h> 787c478bd9Sstevel@tonic-gate #include <door.h> 797c478bd9Sstevel@tonic-gate #include <fcntl.h> 807c478bd9Sstevel@tonic-gate #include <locale.h> 817c478bd9Sstevel@tonic-gate #include <signal.h> 827c478bd9Sstevel@tonic-gate #include <stdarg.h> 837c478bd9Sstevel@tonic-gate #include <stdio.h> 847c478bd9Sstevel@tonic-gate #include <stdlib.h> 857c478bd9Sstevel@tonic-gate #include <string.h> 867c478bd9Sstevel@tonic-gate #include <strings.h> 877c478bd9Sstevel@tonic-gate #include <synch.h> 887c478bd9Sstevel@tonic-gate #include <syslog.h> 897c478bd9Sstevel@tonic-gate #include <thread.h> 907c478bd9Sstevel@tonic-gate #include <unistd.h> 917c478bd9Sstevel@tonic-gate #include <wait.h> 927c478bd9Sstevel@tonic-gate #include <limits.h> 937c478bd9Sstevel@tonic-gate #include <zone.h> 949acbbeafSnn35248 #include <libbrand.h> 950679f794S #include <sys/brand.h> 967c478bd9Sstevel@tonic-gate #include <libcontract.h> 977c478bd9Sstevel@tonic-gate #include <libcontract_priv.h> 987c478bd9Sstevel@tonic-gate #include <sys/contract/process.h> 997c478bd9Sstevel@tonic-gate #include <sys/ctfs.h> 100*2b24ab6bSSebastien Roy #include <libdladm.h> 101*2b24ab6bSSebastien Roy #include <sys/dls_mgmt.h> 1027c478bd9Sstevel@tonic-gate 1037c478bd9Sstevel@tonic-gate #include <libzonecfg.h> 1047c478bd9Sstevel@tonic-gate #include "zoneadmd.h" 1057c478bd9Sstevel@tonic-gate 1067c478bd9Sstevel@tonic-gate static char *progname; 1077c478bd9Sstevel@tonic-gate char *zone_name; /* zone which we are managing */ 1089acbbeafSnn35248 char brand_name[MAXNAMELEN]; 1099acbbeafSnn35248 boolean_t zone_isnative; 11084561e8cStd153743 boolean_t zone_iscluster; 1119a5d73e0SRic Aleshire boolean_t zone_islabeled; 112108322fbScarlsonj static zoneid_t zone_id; 1134ac67f02SAnurag S. Maskey dladm_handle_t dld_handle = NULL; 1147c478bd9Sstevel@tonic-gate 115c5cd6260S static char pre_statechg_hook[2 * MAXPATHLEN]; 116c5cd6260S static char post_statechg_hook[2 * MAXPATHLEN]; 117c5cd6260S char query_hook[2 * MAXPATHLEN]; 118c5cd6260S 11922321485Svp157776 zlog_t logsys; 1207c478bd9Sstevel@tonic-gate 1217c478bd9Sstevel@tonic-gate mutex_t lock = DEFAULTMUTEX; /* to serialize stuff */ 1227c478bd9Sstevel@tonic-gate mutex_t msglock = DEFAULTMUTEX; /* for calling setlocale() */ 1237c478bd9Sstevel@tonic-gate 124108322fbScarlsonj static sema_t scratch_sem; /* for scratch zones */ 125108322fbScarlsonj 1267c478bd9Sstevel@tonic-gate static char zone_door_path[MAXPATHLEN]; 1277c478bd9Sstevel@tonic-gate static int zone_door = -1; 1287c478bd9Sstevel@tonic-gate 1297c478bd9Sstevel@tonic-gate boolean_t in_death_throes = B_FALSE; /* daemon is dying */ 1307c478bd9Sstevel@tonic-gate boolean_t bringup_failure_recovery = B_FALSE; /* ignore certain failures */ 1317c478bd9Sstevel@tonic-gate 1327c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) /* should be defined by cc -D */ 1337c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "SYS_TEST" /* Use this only if it wasn't */ 1347c478bd9Sstevel@tonic-gate #endif 1357c478bd9Sstevel@tonic-gate 1367c478bd9Sstevel@tonic-gate #define DEFAULT_LOCALE "C" 1377c478bd9Sstevel@tonic-gate 138108322fbScarlsonj static const char * 139108322fbScarlsonj z_cmd_name(zone_cmd_t zcmd) 140108322fbScarlsonj { 141108322fbScarlsonj /* This list needs to match the enum in sys/zone.h */ 142108322fbScarlsonj static const char *zcmdstr[] = { 1439acbbeafSnn35248 "ready", "boot", "forceboot", "reboot", "halt", 1449acbbeafSnn35248 "note_uninstalling", "mount", "forcemount", "unmount" 145108322fbScarlsonj }; 146108322fbScarlsonj 147108322fbScarlsonj if (zcmd >= sizeof (zcmdstr) / sizeof (*zcmdstr)) 148108322fbScarlsonj return ("unknown"); 149108322fbScarlsonj else 150108322fbScarlsonj return (zcmdstr[(int)zcmd]); 151108322fbScarlsonj } 152108322fbScarlsonj 1537c478bd9Sstevel@tonic-gate static char * 1547c478bd9Sstevel@tonic-gate get_execbasename(char *execfullname) 1557c478bd9Sstevel@tonic-gate { 1567c478bd9Sstevel@tonic-gate char *last_slash, *execbasename; 1577c478bd9Sstevel@tonic-gate 1587c478bd9Sstevel@tonic-gate /* guard against '/' at end of command invocation */ 1597c478bd9Sstevel@tonic-gate for (;;) { 1607c478bd9Sstevel@tonic-gate last_slash = strrchr(execfullname, '/'); 1617c478bd9Sstevel@tonic-gate if (last_slash == NULL) { 1627c478bd9Sstevel@tonic-gate execbasename = execfullname; 1637c478bd9Sstevel@tonic-gate break; 1647c478bd9Sstevel@tonic-gate } else { 1657c478bd9Sstevel@tonic-gate execbasename = last_slash + 1; 1667c478bd9Sstevel@tonic-gate if (*execbasename == '\0') { 1677c478bd9Sstevel@tonic-gate *last_slash = '\0'; 1687c478bd9Sstevel@tonic-gate continue; 1697c478bd9Sstevel@tonic-gate } 1707c478bd9Sstevel@tonic-gate break; 1717c478bd9Sstevel@tonic-gate } 1727c478bd9Sstevel@tonic-gate } 1737c478bd9Sstevel@tonic-gate return (execbasename); 1747c478bd9Sstevel@tonic-gate } 1757c478bd9Sstevel@tonic-gate 1767c478bd9Sstevel@tonic-gate static void 1777c478bd9Sstevel@tonic-gate usage(void) 1787c478bd9Sstevel@tonic-gate { 1797c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("Usage: %s -z zonename\n"), progname); 1807c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 1817c478bd9Sstevel@tonic-gate gettext("\tNote: %s should not be run directly.\n"), progname); 1827c478bd9Sstevel@tonic-gate exit(2); 1837c478bd9Sstevel@tonic-gate } 1847c478bd9Sstevel@tonic-gate 1857c478bd9Sstevel@tonic-gate /* ARGSUSED */ 1867c478bd9Sstevel@tonic-gate static void 1877c478bd9Sstevel@tonic-gate sigchld(int sig) 1887c478bd9Sstevel@tonic-gate { 1897c478bd9Sstevel@tonic-gate } 1907c478bd9Sstevel@tonic-gate 1917c478bd9Sstevel@tonic-gate char * 1927c478bd9Sstevel@tonic-gate localize_msg(char *locale, const char *msg) 1937c478bd9Sstevel@tonic-gate { 1947c478bd9Sstevel@tonic-gate char *out; 1957c478bd9Sstevel@tonic-gate 1967c478bd9Sstevel@tonic-gate (void) mutex_lock(&msglock); 1977c478bd9Sstevel@tonic-gate (void) setlocale(LC_MESSAGES, locale); 1987c478bd9Sstevel@tonic-gate out = gettext(msg); 1997c478bd9Sstevel@tonic-gate (void) setlocale(LC_MESSAGES, DEFAULT_LOCALE); 2007c478bd9Sstevel@tonic-gate (void) mutex_unlock(&msglock); 2017c478bd9Sstevel@tonic-gate return (out); 2027c478bd9Sstevel@tonic-gate } 2037c478bd9Sstevel@tonic-gate 2047c478bd9Sstevel@tonic-gate /* PRINTFLIKE3 */ 2057c478bd9Sstevel@tonic-gate void 2067c478bd9Sstevel@tonic-gate zerror(zlog_t *zlogp, boolean_t use_strerror, const char *fmt, ...) 2077c478bd9Sstevel@tonic-gate { 2087c478bd9Sstevel@tonic-gate va_list alist; 2097c478bd9Sstevel@tonic-gate char buf[MAXPATHLEN * 2]; /* enough space for err msg with a path */ 2107c478bd9Sstevel@tonic-gate char *bp; 2117c478bd9Sstevel@tonic-gate int saved_errno = errno; 2127c478bd9Sstevel@tonic-gate 2137c478bd9Sstevel@tonic-gate if (zlogp == NULL) 2147c478bd9Sstevel@tonic-gate return; 2157c478bd9Sstevel@tonic-gate if (zlogp == &logsys) 2167c478bd9Sstevel@tonic-gate (void) snprintf(buf, sizeof (buf), "[zone '%s'] ", 2177c478bd9Sstevel@tonic-gate zone_name); 2187c478bd9Sstevel@tonic-gate else 2197c478bd9Sstevel@tonic-gate buf[0] = '\0'; 2207c478bd9Sstevel@tonic-gate bp = &(buf[strlen(buf)]); 2217c478bd9Sstevel@tonic-gate 2227c478bd9Sstevel@tonic-gate /* 2237c478bd9Sstevel@tonic-gate * In theory, the locale pointer should be set to either "C" or a 2247c478bd9Sstevel@tonic-gate * char array, so it should never be NULL 2257c478bd9Sstevel@tonic-gate */ 2267c478bd9Sstevel@tonic-gate assert(zlogp->locale != NULL); 2277c478bd9Sstevel@tonic-gate /* Locale is per process, but we are multi-threaded... */ 2287c478bd9Sstevel@tonic-gate fmt = localize_msg(zlogp->locale, fmt); 2297c478bd9Sstevel@tonic-gate 2307c478bd9Sstevel@tonic-gate va_start(alist, fmt); 2317c478bd9Sstevel@tonic-gate (void) vsnprintf(bp, sizeof (buf) - (bp - buf), fmt, alist); 2327c478bd9Sstevel@tonic-gate va_end(alist); 2337c478bd9Sstevel@tonic-gate bp = &(buf[strlen(buf)]); 2347c478bd9Sstevel@tonic-gate if (use_strerror) 2357c478bd9Sstevel@tonic-gate (void) snprintf(bp, sizeof (buf) - (bp - buf), ": %s", 2367c478bd9Sstevel@tonic-gate strerror(saved_errno)); 2377c478bd9Sstevel@tonic-gate if (zlogp == &logsys) { 2387c478bd9Sstevel@tonic-gate (void) syslog(LOG_ERR, "%s", buf); 2397c478bd9Sstevel@tonic-gate } else if (zlogp->logfile != NULL) { 2407c478bd9Sstevel@tonic-gate (void) fprintf(zlogp->logfile, "%s\n", buf); 2417c478bd9Sstevel@tonic-gate } else { 2427c478bd9Sstevel@tonic-gate size_t buflen; 2437c478bd9Sstevel@tonic-gate size_t copylen; 2447c478bd9Sstevel@tonic-gate 2457c478bd9Sstevel@tonic-gate buflen = snprintf(zlogp->log, zlogp->loglen, "%s\n", buf); 2467c478bd9Sstevel@tonic-gate copylen = MIN(buflen, zlogp->loglen); 2477c478bd9Sstevel@tonic-gate zlogp->log += copylen; 2487c478bd9Sstevel@tonic-gate zlogp->loglen -= copylen; 2497c478bd9Sstevel@tonic-gate } 2507c478bd9Sstevel@tonic-gate } 2517c478bd9Sstevel@tonic-gate 2523f2f09c1Sdp /* 2533f2f09c1Sdp * Emit a warning for any boot arguments which are unrecognized. Since 2543f2f09c1Sdp * Solaris boot arguments are getopt(3c) compatible (see kernel(1m)), we 2553f2f09c1Sdp * put the arguments into an argv style array, use getopt to process them, 2563f2f09c1Sdp * and put the resultant argument string back into outargs. 2573f2f09c1Sdp * 2583f2f09c1Sdp * During the filtering, we pull out any arguments which are truly "boot" 2593f2f09c1Sdp * arguments, leaving only those which are to be passed intact to the 2603f2f09c1Sdp * progenitor process. The one we support at the moment is -i, which 2613f2f09c1Sdp * indicates to the kernel which program should be launched as 'init'. 2623f2f09c1Sdp * 2633f2f09c1Sdp * A return of Z_INVAL indicates specifically that the arguments are 2643f2f09c1Sdp * not valid; this is a non-fatal error. Except for Z_OK, all other return 2653f2f09c1Sdp * values are treated as fatal. 2663f2f09c1Sdp */ 2673f2f09c1Sdp static int 2683f2f09c1Sdp filter_bootargs(zlog_t *zlogp, const char *inargs, char *outargs, 2693f2f09c1Sdp char *init_file, char *badarg) 2703f2f09c1Sdp { 2713f2f09c1Sdp int argc = 0, argc_save; 2723f2f09c1Sdp int i; 2733f2f09c1Sdp int err; 2743f2f09c1Sdp char *arg, *lasts, **argv = NULL, **argv_save; 2753f2f09c1Sdp char zonecfg_args[BOOTARGS_MAX]; 2763f2f09c1Sdp char scratchargs[BOOTARGS_MAX], *sargs; 2773f2f09c1Sdp char c; 2783f2f09c1Sdp 2793f2f09c1Sdp bzero(outargs, BOOTARGS_MAX); 2803f2f09c1Sdp bzero(badarg, BOOTARGS_MAX); 2813f2f09c1Sdp 2823f2f09c1Sdp /* 2833f2f09c1Sdp * If the user didn't specify transient boot arguments, check 2843f2f09c1Sdp * to see if there were any specified in the zone configuration, 2853f2f09c1Sdp * and use them if applicable. 2863f2f09c1Sdp */ 2873f2f09c1Sdp if (inargs == NULL || inargs[0] == '\0') { 2883f2f09c1Sdp zone_dochandle_t handle; 2893f2f09c1Sdp if ((handle = zonecfg_init_handle()) == NULL) { 2903f2f09c1Sdp zerror(zlogp, B_TRUE, 2913f2f09c1Sdp "getting zone configuration handle"); 2923f2f09c1Sdp return (Z_BAD_HANDLE); 2933f2f09c1Sdp } 2943f2f09c1Sdp err = zonecfg_get_snapshot_handle(zone_name, handle); 2953f2f09c1Sdp if (err != Z_OK) { 2963f2f09c1Sdp zerror(zlogp, B_FALSE, 2973f2f09c1Sdp "invalid configuration snapshot"); 2983f2f09c1Sdp zonecfg_fini_handle(handle); 2993f2f09c1Sdp return (Z_BAD_HANDLE); 3003f2f09c1Sdp } 3013f2f09c1Sdp 3023f2f09c1Sdp bzero(zonecfg_args, sizeof (zonecfg_args)); 3033f2f09c1Sdp (void) zonecfg_get_bootargs(handle, zonecfg_args, 3043f2f09c1Sdp sizeof (zonecfg_args)); 3053f2f09c1Sdp inargs = zonecfg_args; 3063f2f09c1Sdp zonecfg_fini_handle(handle); 3073f2f09c1Sdp } 3083f2f09c1Sdp 3093f2f09c1Sdp if (strlen(inargs) >= BOOTARGS_MAX) { 3103f2f09c1Sdp zerror(zlogp, B_FALSE, "boot argument string too long"); 3113f2f09c1Sdp return (Z_INVAL); 3123f2f09c1Sdp } 3133f2f09c1Sdp 3143f2f09c1Sdp (void) strlcpy(scratchargs, inargs, sizeof (scratchargs)); 3153f2f09c1Sdp sargs = scratchargs; 3163f2f09c1Sdp while ((arg = strtok_r(sargs, " \t", &lasts)) != NULL) { 3173f2f09c1Sdp sargs = NULL; 3183f2f09c1Sdp argc++; 3193f2f09c1Sdp } 3203f2f09c1Sdp 3213f2f09c1Sdp if ((argv = calloc(argc + 1, sizeof (char *))) == NULL) { 3223f2f09c1Sdp zerror(zlogp, B_FALSE, "memory allocation failed"); 3233f2f09c1Sdp return (Z_NOMEM); 3243f2f09c1Sdp } 3253f2f09c1Sdp 3263f2f09c1Sdp argv_save = argv; 3273f2f09c1Sdp argc_save = argc; 3283f2f09c1Sdp 3293f2f09c1Sdp (void) strlcpy(scratchargs, inargs, sizeof (scratchargs)); 3303f2f09c1Sdp sargs = scratchargs; 3313f2f09c1Sdp i = 0; 3323f2f09c1Sdp while ((arg = strtok_r(sargs, " \t", &lasts)) != NULL) { 3333f2f09c1Sdp sargs = NULL; 3343f2f09c1Sdp if ((argv[i] = strdup(arg)) == NULL) { 3353f2f09c1Sdp err = Z_NOMEM; 3363f2f09c1Sdp zerror(zlogp, B_FALSE, "memory allocation failed"); 3373f2f09c1Sdp goto done; 3383f2f09c1Sdp } 3393f2f09c1Sdp i++; 3403f2f09c1Sdp } 3413f2f09c1Sdp 3423f2f09c1Sdp /* 3433f2f09c1Sdp * We preserve compatibility with the Solaris system boot behavior, 3443f2f09c1Sdp * which allows: 3453f2f09c1Sdp * 3463f2f09c1Sdp * # reboot kernel/unix -s -m verbose 3473f2f09c1Sdp * 3483f2f09c1Sdp * In this example, kernel/unix tells the booter what file to 3493f2f09c1Sdp * boot. We don't want reboot in a zone to be gratuitously different, 3503f2f09c1Sdp * so we silently ignore the boot file, if necessary. 3513f2f09c1Sdp */ 3523f2f09c1Sdp if (argv[0] == NULL) 3533f2f09c1Sdp goto done; 3543f2f09c1Sdp 3553f2f09c1Sdp assert(argv[0][0] != ' '); 3563f2f09c1Sdp assert(argv[0][0] != '\t'); 3573f2f09c1Sdp 3583f2f09c1Sdp if (argv[0][0] != '-' && argv[0][0] != '\0') { 3593f2f09c1Sdp argv = &argv[1]; 3603f2f09c1Sdp argc--; 3613f2f09c1Sdp } 3623f2f09c1Sdp 3633f2f09c1Sdp optind = 0; 3643f2f09c1Sdp opterr = 0; 3653f2f09c1Sdp err = Z_OK; 3669acbbeafSnn35248 while ((c = getopt(argc, argv, "fi:m:s")) != -1) { 3673f2f09c1Sdp switch (c) { 3683f2f09c1Sdp case 'i': 3693f2f09c1Sdp /* 3703f2f09c1Sdp * -i is handled by the runtime and is not passed 3713f2f09c1Sdp * along to userland 3723f2f09c1Sdp */ 3733f2f09c1Sdp (void) strlcpy(init_file, optarg, MAXPATHLEN); 3743f2f09c1Sdp break; 3759acbbeafSnn35248 case 'f': 3769acbbeafSnn35248 /* This has already been processed by zoneadm */ 3779acbbeafSnn35248 break; 3783f2f09c1Sdp case 'm': 3793f2f09c1Sdp case 's': 3803f2f09c1Sdp /* These pass through unmolested */ 3813f2f09c1Sdp (void) snprintf(outargs, BOOTARGS_MAX, 3823f2f09c1Sdp "%s -%c %s ", outargs, c, optarg ? optarg : ""); 3833f2f09c1Sdp break; 3843f2f09c1Sdp case '?': 3853f2f09c1Sdp /* 3863f2f09c1Sdp * We warn about unknown arguments but pass them 3873f2f09c1Sdp * along anyway-- if someone wants to develop their 3883f2f09c1Sdp * own init replacement, they can pass it whatever 3893f2f09c1Sdp * args they want. 3903f2f09c1Sdp */ 3913f2f09c1Sdp err = Z_INVAL; 3923f2f09c1Sdp (void) snprintf(outargs, BOOTARGS_MAX, 3933f2f09c1Sdp "%s -%c", outargs, optopt); 3943f2f09c1Sdp (void) snprintf(badarg, BOOTARGS_MAX, 3953f2f09c1Sdp "%s -%c", badarg, optopt); 3963f2f09c1Sdp break; 3973f2f09c1Sdp } 3983f2f09c1Sdp } 3993f2f09c1Sdp 4003f2f09c1Sdp /* 4013f2f09c1Sdp * For Solaris Zones we warn about and discard non-option arguments. 4023f2f09c1Sdp * Hence 'boot foo bar baz gub' --> 'boot'. However, to be similar 4033f2f09c1Sdp * to the kernel, we concat up all the other remaining boot args. 4043f2f09c1Sdp * and warn on them as a group. 4053f2f09c1Sdp */ 4063f2f09c1Sdp if (optind < argc) { 4073f2f09c1Sdp err = Z_INVAL; 4083f2f09c1Sdp while (optind < argc) { 4093f2f09c1Sdp (void) snprintf(badarg, BOOTARGS_MAX, "%s%s%s", 4103f2f09c1Sdp badarg, strlen(badarg) > 0 ? " " : "", 4113f2f09c1Sdp argv[optind]); 4123f2f09c1Sdp optind++; 4133f2f09c1Sdp } 4143f2f09c1Sdp zerror(zlogp, B_FALSE, "WARNING: Unused or invalid boot " 4153f2f09c1Sdp "arguments `%s'.", badarg); 4163f2f09c1Sdp } 4173f2f09c1Sdp 4183f2f09c1Sdp done: 4193f2f09c1Sdp for (i = 0; i < argc_save; i++) { 4203f2f09c1Sdp if (argv_save[i] != NULL) 4213f2f09c1Sdp free(argv_save[i]); 4223f2f09c1Sdp } 4233f2f09c1Sdp free(argv_save); 4243f2f09c1Sdp return (err); 4253f2f09c1Sdp } 4263f2f09c1Sdp 4273f2f09c1Sdp 4287c478bd9Sstevel@tonic-gate static int 4297c478bd9Sstevel@tonic-gate mkzonedir(zlog_t *zlogp) 4307c478bd9Sstevel@tonic-gate { 4317c478bd9Sstevel@tonic-gate struct stat st; 4327c478bd9Sstevel@tonic-gate /* 4337c478bd9Sstevel@tonic-gate * We must create and lock everyone but root out of ZONES_TMPDIR 4347c478bd9Sstevel@tonic-gate * since anyone can open any UNIX domain socket, regardless of 4357c478bd9Sstevel@tonic-gate * its file system permissions. Sigh... 4367c478bd9Sstevel@tonic-gate */ 4377c478bd9Sstevel@tonic-gate if (mkdir(ZONES_TMPDIR, S_IRWXU) < 0 && errno != EEXIST) { 4387c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "could not mkdir '%s'", ZONES_TMPDIR); 4397c478bd9Sstevel@tonic-gate return (-1); 4407c478bd9Sstevel@tonic-gate } 4417c478bd9Sstevel@tonic-gate /* paranoia */ 4424bc0a2efScasper if ((stat(ZONES_TMPDIR, &st) < 0) || !S_ISDIR(st.st_mode)) { 4437c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "'%s' is not a directory", ZONES_TMPDIR); 4447c478bd9Sstevel@tonic-gate return (-1); 4457c478bd9Sstevel@tonic-gate } 4467c478bd9Sstevel@tonic-gate (void) chmod(ZONES_TMPDIR, S_IRWXU); 4477c478bd9Sstevel@tonic-gate return (0); 4487c478bd9Sstevel@tonic-gate } 4497c478bd9Sstevel@tonic-gate 450108322fbScarlsonj /* 451c5cd6260S * Run the brand's pre-state change callback, if it exists. 452c5cd6260S */ 453c5cd6260S static int 454c5cd6260S brand_prestatechg(zlog_t *zlogp, int state, int cmd) 455c5cd6260S { 456c5cd6260S char cmdbuf[2 * MAXPATHLEN]; 457c5cd6260S 458c5cd6260S if (pre_statechg_hook[0] == '\0') 459c5cd6260S return (0); 460c5cd6260S 461c5cd6260S if (snprintf(cmdbuf, sizeof (cmdbuf), "%s %d %d", pre_statechg_hook, 462c5cd6260S state, cmd) > sizeof (cmdbuf)) 463c5cd6260S return (-1); 464c5cd6260S 465c5cd6260S if (do_subproc(zlogp, cmdbuf, NULL) != 0) 466c5cd6260S return (-1); 467c5cd6260S 468c5cd6260S return (0); 469c5cd6260S } 470c5cd6260S 471c5cd6260S /* 472c5cd6260S * Run the brand's post-state change callback, if it exists. 473c5cd6260S */ 474c5cd6260S static int 475c5cd6260S brand_poststatechg(zlog_t *zlogp, int state, int cmd) 476c5cd6260S { 477c5cd6260S char cmdbuf[2 * MAXPATHLEN]; 478c5cd6260S 479c5cd6260S if (post_statechg_hook[0] == '\0') 480c5cd6260S return (0); 481c5cd6260S 482c5cd6260S if (snprintf(cmdbuf, sizeof (cmdbuf), "%s %d %d", post_statechg_hook, 483c5cd6260S state, cmd) > sizeof (cmdbuf)) 484c5cd6260S return (-1); 485c5cd6260S 486c5cd6260S if (do_subproc(zlogp, cmdbuf, NULL) != 0) 487c5cd6260S return (-1); 488c5cd6260S 489c5cd6260S return (0); 490c5cd6260S } 491c5cd6260S 492c5cd6260S /* 493108322fbScarlsonj * Bring a zone up to the pre-boot "ready" stage. The mount_cmd argument is 494108322fbScarlsonj * 'true' if this is being invoked as part of the processing for the "mount" 495108322fbScarlsonj * subcommand. 496108322fbScarlsonj */ 497108322fbScarlsonj static int 498c5cd6260S zone_ready(zlog_t *zlogp, zone_mnt_t mount_cmd, int zstate) 4997c478bd9Sstevel@tonic-gate { 5007c478bd9Sstevel@tonic-gate int err; 5017c478bd9Sstevel@tonic-gate 502c5cd6260S if (brand_prestatechg(zlogp, zstate, Z_READY) != 0) 503c5cd6260S return (-1); 504c5cd6260S 5057c478bd9Sstevel@tonic-gate if ((err = zonecfg_create_snapshot(zone_name)) != Z_OK) { 5067c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "unable to create snapshot: %s", 5077c478bd9Sstevel@tonic-gate zonecfg_strerror(err)); 5088fe9fdf2SDan Price goto bad; 5097c478bd9Sstevel@tonic-gate } 5107c478bd9Sstevel@tonic-gate 511108322fbScarlsonj if ((zone_id = vplat_create(zlogp, mount_cmd)) == -1) { 5127c478bd9Sstevel@tonic-gate if ((err = zonecfg_destroy_snapshot(zone_name)) != Z_OK) 5137c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "destroying snapshot: %s", 5147c478bd9Sstevel@tonic-gate zonecfg_strerror(err)); 5158fe9fdf2SDan Price goto bad; 5167c478bd9Sstevel@tonic-gate } 517555afedfScarlsonj if (vplat_bringup(zlogp, mount_cmd, zone_id) != 0) { 5187c478bd9Sstevel@tonic-gate bringup_failure_recovery = B_TRUE; 5196cfd72c6Sgjelinek (void) vplat_teardown(NULL, (mount_cmd != Z_MNT_BOOT), B_FALSE); 5207c478bd9Sstevel@tonic-gate if ((err = zonecfg_destroy_snapshot(zone_name)) != Z_OK) 5217c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "destroying snapshot: %s", 5227c478bd9Sstevel@tonic-gate zonecfg_strerror(err)); 5238fe9fdf2SDan Price goto bad; 5247c478bd9Sstevel@tonic-gate } 5257c478bd9Sstevel@tonic-gate 526c5cd6260S if (brand_poststatechg(zlogp, zstate, Z_READY) != 0) 5278fe9fdf2SDan Price goto bad; 528c5cd6260S 5297c478bd9Sstevel@tonic-gate return (0); 5308fe9fdf2SDan Price 5318fe9fdf2SDan Price bad: 5328fe9fdf2SDan Price /* 5338fe9fdf2SDan Price * If something goes wrong, we up the zones's state to the target 5348fe9fdf2SDan Price * state, READY, and then invoke the hook as if we're halting. 5358fe9fdf2SDan Price */ 5368fe9fdf2SDan Price (void) brand_poststatechg(zlogp, ZONE_STATE_READY, Z_HALT); 5378fe9fdf2SDan Price return (-1); 5387c478bd9Sstevel@tonic-gate } 5397c478bd9Sstevel@tonic-gate 540555afedfScarlsonj int 541555afedfScarlsonj init_template(void) 5427c478bd9Sstevel@tonic-gate { 5437c478bd9Sstevel@tonic-gate int fd; 5447c478bd9Sstevel@tonic-gate int err = 0; 5457c478bd9Sstevel@tonic-gate 5467c478bd9Sstevel@tonic-gate fd = open64(CTFS_ROOT "/process/template", O_RDWR); 5477c478bd9Sstevel@tonic-gate if (fd == -1) 5487c478bd9Sstevel@tonic-gate return (-1); 5497c478bd9Sstevel@tonic-gate 5507c478bd9Sstevel@tonic-gate /* 5517c478bd9Sstevel@tonic-gate * For now, zoneadmd doesn't do anything with the contract. 5527c478bd9Sstevel@tonic-gate * Deliver no events, don't inherit, and allow it to be orphaned. 5537c478bd9Sstevel@tonic-gate */ 5547c478bd9Sstevel@tonic-gate err |= ct_tmpl_set_critical(fd, 0); 5557c478bd9Sstevel@tonic-gate err |= ct_tmpl_set_informative(fd, 0); 5567c478bd9Sstevel@tonic-gate err |= ct_pr_tmpl_set_fatal(fd, CT_PR_EV_HWERR); 5577c478bd9Sstevel@tonic-gate err |= ct_pr_tmpl_set_param(fd, CT_PR_PGRPONLY | CT_PR_REGENT); 5587c478bd9Sstevel@tonic-gate if (err || ct_tmpl_activate(fd)) { 5597c478bd9Sstevel@tonic-gate (void) close(fd); 5607c478bd9Sstevel@tonic-gate return (-1); 5617c478bd9Sstevel@tonic-gate } 5627c478bd9Sstevel@tonic-gate 5637c478bd9Sstevel@tonic-gate return (fd); 5647c478bd9Sstevel@tonic-gate } 5657c478bd9Sstevel@tonic-gate 5669acbbeafSnn35248 typedef struct fs_callback { 5679acbbeafSnn35248 zlog_t *zlogp; 5689acbbeafSnn35248 zoneid_t zoneid; 569910f48daSedp boolean_t mount_cmd; 5709acbbeafSnn35248 } fs_callback_t; 5719acbbeafSnn35248 5727c478bd9Sstevel@tonic-gate static int 5739acbbeafSnn35248 mount_early_fs(void *data, const char *spec, const char *dir, 5749acbbeafSnn35248 const char *fstype, const char *opt) 5757c478bd9Sstevel@tonic-gate { 5769acbbeafSnn35248 zlog_t *zlogp = ((fs_callback_t *)data)->zlogp; 5779acbbeafSnn35248 zoneid_t zoneid = ((fs_callback_t *)data)->zoneid; 578910f48daSedp boolean_t mount_cmd = ((fs_callback_t *)data)->mount_cmd; 579d314f035Sedp char rootpath[MAXPATHLEN]; 5807c478bd9Sstevel@tonic-gate pid_t child; 5817c478bd9Sstevel@tonic-gate int child_status; 5827c478bd9Sstevel@tonic-gate int tmpl_fd; 583d314f035Sedp int rv; 5847c478bd9Sstevel@tonic-gate ctid_t ct; 5857c478bd9Sstevel@tonic-gate 586910f48daSedp /* determine the zone rootpath */ 587910f48daSedp if (mount_cmd) { 588910f48daSedp char zonepath[MAXPATHLEN]; 589910f48daSedp char luroot[MAXPATHLEN]; 590910f48daSedp 591910f48daSedp if (zone_get_zonepath(zone_name, 592910f48daSedp zonepath, sizeof (zonepath)) != Z_OK) { 593910f48daSedp zerror(zlogp, B_FALSE, "unable to determine zone path"); 594910f48daSedp return (-1); 595910f48daSedp } 596910f48daSedp 597910f48daSedp (void) snprintf(luroot, sizeof (luroot), "%s/lu", zonepath); 598910f48daSedp resolve_lofs(zlogp, luroot, sizeof (luroot)); 599910f48daSedp (void) strlcpy(rootpath, luroot, sizeof (rootpath)); 600910f48daSedp } else { 601910f48daSedp if (zone_get_rootpath(zone_name, 602910f48daSedp rootpath, sizeof (rootpath)) != Z_OK) { 603d314f035Sedp zerror(zlogp, B_FALSE, "unable to determine zone root"); 604d314f035Sedp return (-1); 605d314f035Sedp } 606910f48daSedp } 607d314f035Sedp 608d314f035Sedp if ((rv = valid_mount_path(zlogp, rootpath, spec, dir, fstype)) < 0) { 609d314f035Sedp zerror(zlogp, B_FALSE, "%s%s is not a valid mount point", 610d314f035Sedp rootpath, dir); 611d314f035Sedp return (-1); 612d314f035Sedp } else if (rv > 0) { 613d314f035Sedp /* The mount point path doesn't exist, create it now. */ 614d314f035Sedp if (make_one_dir(zlogp, rootpath, dir, 615d314f035Sedp DEFAULT_DIR_MODE, DEFAULT_DIR_USER, 616d314f035Sedp DEFAULT_DIR_GROUP) != 0) { 617d314f035Sedp zerror(zlogp, B_FALSE, "failed to create mount point"); 618d314f035Sedp return (-1); 619d314f035Sedp } 620d314f035Sedp 621d314f035Sedp /* 622d314f035Sedp * Now this might seem weird, but we need to invoke 623d314f035Sedp * valid_mount_path() again. Why? Because it checks 624d314f035Sedp * to make sure that the mount point path is canonical, 625d314f035Sedp * which it can only do if the path exists, so now that 626d314f035Sedp * we've created the path we have to verify it again. 627d314f035Sedp */ 628d314f035Sedp if ((rv = valid_mount_path(zlogp, rootpath, spec, dir, 629d314f035Sedp fstype)) < 0) { 630d314f035Sedp zerror(zlogp, B_FALSE, 631d314f035Sedp "%s%s is not a valid mount point", rootpath, dir); 632d314f035Sedp return (-1); 633d314f035Sedp } 634d314f035Sedp } 635d314f035Sedp 6367c478bd9Sstevel@tonic-gate if ((tmpl_fd = init_template()) == -1) { 6377c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "failed to create contract"); 6387c478bd9Sstevel@tonic-gate return (-1); 6397c478bd9Sstevel@tonic-gate } 6407c478bd9Sstevel@tonic-gate 6417c478bd9Sstevel@tonic-gate if ((child = fork()) == -1) { 6427c478bd9Sstevel@tonic-gate (void) ct_tmpl_clear(tmpl_fd); 6437c478bd9Sstevel@tonic-gate (void) close(tmpl_fd); 6447c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "failed to fork"); 6457c478bd9Sstevel@tonic-gate return (-1); 6467c478bd9Sstevel@tonic-gate 6477c478bd9Sstevel@tonic-gate } else if (child == 0) { /* child */ 6489acbbeafSnn35248 char opt_buf[MAX_MNTOPT_STR]; 6499acbbeafSnn35248 int optlen = 0; 6509acbbeafSnn35248 int mflag = MS_DATA; 6519acbbeafSnn35248 6527c478bd9Sstevel@tonic-gate (void) ct_tmpl_clear(tmpl_fd); 6537c478bd9Sstevel@tonic-gate /* 6547c478bd9Sstevel@tonic-gate * Even though there are no procs running in the zone, we 6557c478bd9Sstevel@tonic-gate * do this for paranoia's sake. 6567c478bd9Sstevel@tonic-gate */ 6577c478bd9Sstevel@tonic-gate (void) closefrom(0); 6587c478bd9Sstevel@tonic-gate 6597c478bd9Sstevel@tonic-gate if (zone_enter(zoneid) == -1) { 6607c478bd9Sstevel@tonic-gate _exit(errno); 6617c478bd9Sstevel@tonic-gate } 6629acbbeafSnn35248 if (opt != NULL) { 6639acbbeafSnn35248 /* 6649acbbeafSnn35248 * The mount() system call is incredibly annoying. 6659acbbeafSnn35248 * If options are specified, we need to copy them 6669acbbeafSnn35248 * into a temporary buffer since the mount() system 6679acbbeafSnn35248 * call will overwrite the options string. It will 6689acbbeafSnn35248 * also fail if the new option string it wants to 6699acbbeafSnn35248 * write is bigger than the one we passed in, so 6709acbbeafSnn35248 * you must pass in a buffer of the maximum possible 6719acbbeafSnn35248 * option string length. sigh. 6729acbbeafSnn35248 */ 6739acbbeafSnn35248 (void) strlcpy(opt_buf, opt, sizeof (opt_buf)); 6749acbbeafSnn35248 opt = opt_buf; 6759acbbeafSnn35248 optlen = MAX_MNTOPT_STR; 6769acbbeafSnn35248 mflag = MS_OPTIONSTR; 6779acbbeafSnn35248 } 6789acbbeafSnn35248 if (mount(spec, dir, mflag, fstype, NULL, 0, opt, optlen) != 0) 6797c478bd9Sstevel@tonic-gate _exit(errno); 6807c478bd9Sstevel@tonic-gate _exit(0); 6817c478bd9Sstevel@tonic-gate } 6827c478bd9Sstevel@tonic-gate 6837c478bd9Sstevel@tonic-gate /* parent */ 6847c478bd9Sstevel@tonic-gate if (contract_latest(&ct) == -1) 6857c478bd9Sstevel@tonic-gate ct = -1; 6867c478bd9Sstevel@tonic-gate (void) ct_tmpl_clear(tmpl_fd); 6877c478bd9Sstevel@tonic-gate (void) close(tmpl_fd); 6887c478bd9Sstevel@tonic-gate if (waitpid(child, &child_status, 0) != child) { 6897c478bd9Sstevel@tonic-gate /* unexpected: we must have been signalled */ 6907c478bd9Sstevel@tonic-gate (void) contract_abandon_id(ct); 6917c478bd9Sstevel@tonic-gate return (-1); 6927c478bd9Sstevel@tonic-gate } 6937c478bd9Sstevel@tonic-gate (void) contract_abandon_id(ct); 6947c478bd9Sstevel@tonic-gate if (WEXITSTATUS(child_status) != 0) { 6957c478bd9Sstevel@tonic-gate errno = WEXITSTATUS(child_status); 6967c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "mount of %s failed", dir); 6977c478bd9Sstevel@tonic-gate return (-1); 6987c478bd9Sstevel@tonic-gate } 6997c478bd9Sstevel@tonic-gate 7007c478bd9Sstevel@tonic-gate return (0); 7017c478bd9Sstevel@tonic-gate } 7027c478bd9Sstevel@tonic-gate 703c5cd6260S /* 704c5cd6260S * If retstr is not NULL, the output of the subproc is returned in the str, 705c5cd6260S * otherwise it is output using zerror(). Any memory allocated for retstr 706c5cd6260S * should be freed by the caller. 707c5cd6260S */ 7089acbbeafSnn35248 int 709c5cd6260S do_subproc(zlog_t *zlogp, char *cmdbuf, char **retstr) 710108322fbScarlsonj { 711c5cd6260S char buf[1024]; /* arbitrary large amount */ 712c5cd6260S char *inbuf; 7139acbbeafSnn35248 FILE *file; 7149acbbeafSnn35248 int status; 715c5cd6260S int rd_cnt; 716c5cd6260S 717c5cd6260S if (retstr != NULL) { 718c5cd6260S if ((*retstr = malloc(1024)) == NULL) { 719c5cd6260S zerror(zlogp, B_FALSE, "out of memory"); 720c5cd6260S return (-1); 721c5cd6260S } 722c5cd6260S inbuf = *retstr; 723c5cd6260S rd_cnt = 0; 724c5cd6260S } else { 725c5cd6260S inbuf = buf; 726c5cd6260S } 727108322fbScarlsonj 7289acbbeafSnn35248 file = popen(cmdbuf, "r"); 7299acbbeafSnn35248 if (file == NULL) { 7309acbbeafSnn35248 zerror(zlogp, B_TRUE, "could not launch: %s", cmdbuf); 731108322fbScarlsonj return (-1); 7329acbbeafSnn35248 } 733108322fbScarlsonj 734c5cd6260S while (fgets(inbuf, 1024, file) != NULL) { 7351f314719S if (retstr == NULL) { 7361f314719S if (zlogp != &logsys) 7379acbbeafSnn35248 zerror(zlogp, B_FALSE, "%s", inbuf); 738c5cd6260S } else { 739c5cd6260S char *p; 740c5cd6260S 741c5cd6260S rd_cnt += 1024 - 1; 742c5cd6260S if ((p = realloc(*retstr, rd_cnt + 1024)) == NULL) { 743c5cd6260S zerror(zlogp, B_FALSE, "out of memory"); 744c5cd6260S (void) pclose(file); 745c5cd6260S return (-1); 746c5cd6260S } 747c5cd6260S 748c5cd6260S *retstr = p; 749c5cd6260S inbuf = *retstr + rd_cnt; 750c5cd6260S } 751c5cd6260S } 7529acbbeafSnn35248 status = pclose(file); 7539acbbeafSnn35248 7549acbbeafSnn35248 if (WIFSIGNALED(status)) { 7559acbbeafSnn35248 zerror(zlogp, B_FALSE, "%s unexpectedly terminated due to " 7569acbbeafSnn35248 "signal %d", cmdbuf, WTERMSIG(status)); 7575518d15bSdp return (-1); 7589acbbeafSnn35248 } 7599acbbeafSnn35248 assert(WIFEXITED(status)); 7609acbbeafSnn35248 if (WEXITSTATUS(status) == ZEXIT_EXEC) { 7619acbbeafSnn35248 zerror(zlogp, B_FALSE, "failed to exec %s", cmdbuf); 762108322fbScarlsonj return (-1); 7639acbbeafSnn35248 } 7649acbbeafSnn35248 return (WEXITSTATUS(status)); 765108322fbScarlsonj } 766108322fbScarlsonj 767108322fbScarlsonj static int 768c5cd6260S zone_bootup(zlog_t *zlogp, const char *bootargs, int zstate) 7697c478bd9Sstevel@tonic-gate { 7707c478bd9Sstevel@tonic-gate zoneid_t zoneid; 7717c478bd9Sstevel@tonic-gate struct stat st; 772ff17c8bfSgjelinek char zpath[MAXPATHLEN], initpath[MAXPATHLEN], init_file[MAXPATHLEN]; 7733f2f09c1Sdp char nbootargs[BOOTARGS_MAX]; 7749acbbeafSnn35248 char cmdbuf[MAXPATHLEN]; 7759acbbeafSnn35248 fs_callback_t cb; 776123807fbSedp brand_handle_t bh; 777*2b24ab6bSSebastien Roy zone_iptype_t iptype; 778*2b24ab6bSSebastien Roy boolean_t links_loaded = B_FALSE; 779*2b24ab6bSSebastien Roy dladm_status_t status; 780*2b24ab6bSSebastien Roy char errmsg[DLADM_STRSIZE]; 7813f2f09c1Sdp int err; 7827c478bd9Sstevel@tonic-gate 783c5cd6260S if (brand_prestatechg(zlogp, zstate, Z_BOOT) != 0) 784c5cd6260S return (-1); 785c5cd6260S 7867c478bd9Sstevel@tonic-gate if ((zoneid = getzoneidbyname(zone_name)) == -1) { 7877c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "unable to get zoneid"); 7888fe9fdf2SDan Price goto bad; 7897c478bd9Sstevel@tonic-gate } 7907c478bd9Sstevel@tonic-gate 7919acbbeafSnn35248 cb.zlogp = zlogp; 7929acbbeafSnn35248 cb.zoneid = zoneid; 793910f48daSedp cb.mount_cmd = B_FALSE; 7949acbbeafSnn35248 7959acbbeafSnn35248 /* Get a handle to the brand info for this zone */ 796123807fbSedp if ((bh = brand_open(brand_name)) == NULL) { 7979acbbeafSnn35248 zerror(zlogp, B_FALSE, "unable to determine zone brand"); 7988fe9fdf2SDan Price goto bad; 7999acbbeafSnn35248 } 8009acbbeafSnn35248 8019acbbeafSnn35248 /* 8029acbbeafSnn35248 * Get the list of filesystems to mount from the brand 8039acbbeafSnn35248 * configuration. These mounts are done via a thread that will 8049acbbeafSnn35248 * enter the zone, so they are done from within the context of the 8059acbbeafSnn35248 * zone. 8069acbbeafSnn35248 */ 807123807fbSedp if (brand_platform_iter_mounts(bh, mount_early_fs, &cb) != 0) { 8089acbbeafSnn35248 zerror(zlogp, B_FALSE, "unable to mount filesystems"); 809123807fbSedp brand_close(bh); 8108fe9fdf2SDan Price goto bad; 8119acbbeafSnn35248 } 8129acbbeafSnn35248 8139acbbeafSnn35248 /* 8149acbbeafSnn35248 * Get the brand's boot callback if it exists. 8159acbbeafSnn35248 */ 816ff17c8bfSgjelinek if (zone_get_zonepath(zone_name, zpath, sizeof (zpath)) != Z_OK) { 817ff17c8bfSgjelinek zerror(zlogp, B_FALSE, "unable to determine zone path"); 818e767a340Sgjelinek brand_close(bh); 8198fe9fdf2SDan Price goto bad; 8209acbbeafSnn35248 } 8219acbbeafSnn35248 (void) strcpy(cmdbuf, EXEC_PREFIX); 822ff17c8bfSgjelinek if (brand_get_boot(bh, zone_name, zpath, cmdbuf + EXEC_LEN, 823ff17c8bfSgjelinek sizeof (cmdbuf) - EXEC_LEN) != 0) { 8249acbbeafSnn35248 zerror(zlogp, B_FALSE, 8259acbbeafSnn35248 "unable to determine branded zone's boot callback"); 826123807fbSedp brand_close(bh); 8278fe9fdf2SDan Price goto bad; 8289acbbeafSnn35248 } 8299acbbeafSnn35248 8309acbbeafSnn35248 /* Get the path for this zone's init(1M) (or equivalent) process. */ 831123807fbSedp if (brand_get_initname(bh, init_file, MAXPATHLEN) != 0) { 8329acbbeafSnn35248 zerror(zlogp, B_FALSE, 8339acbbeafSnn35248 "unable to determine zone's init(1M) location"); 834123807fbSedp brand_close(bh); 8358fe9fdf2SDan Price goto bad; 8369acbbeafSnn35248 } 8379acbbeafSnn35248 838123807fbSedp brand_close(bh); 8397c478bd9Sstevel@tonic-gate 8403f2f09c1Sdp err = filter_bootargs(zlogp, bootargs, nbootargs, init_file, 8413f2f09c1Sdp bad_boot_arg); 8423f2f09c1Sdp if (err == Z_INVAL) 8433f2f09c1Sdp eventstream_write(Z_EVT_ZONE_BADARGS); 8443f2f09c1Sdp else if (err != Z_OK) 8458fe9fdf2SDan Price goto bad; 8463f2f09c1Sdp 8473f2f09c1Sdp assert(init_file[0] != '\0'); 8483f2f09c1Sdp 8499acbbeafSnn35248 /* Try to anticipate possible problems: Make sure init is executable. */ 850ff17c8bfSgjelinek if (zone_get_rootpath(zone_name, zpath, sizeof (zpath)) != Z_OK) { 8517c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "unable to determine zone root"); 8528fe9fdf2SDan Price goto bad; 8537c478bd9Sstevel@tonic-gate } 8549acbbeafSnn35248 855ff17c8bfSgjelinek (void) snprintf(initpath, sizeof (initpath), "%s%s", zpath, init_file); 8567c478bd9Sstevel@tonic-gate 8577c478bd9Sstevel@tonic-gate if (stat(initpath, &st) == -1) { 8587c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "could not stat %s", initpath); 8598fe9fdf2SDan Price goto bad; 8607c478bd9Sstevel@tonic-gate } 8617c478bd9Sstevel@tonic-gate 8627c478bd9Sstevel@tonic-gate if ((st.st_mode & S_IXUSR) == 0) { 8637c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "%s is not executable", initpath); 8648fe9fdf2SDan Price goto bad; 8657c478bd9Sstevel@tonic-gate } 8667c478bd9Sstevel@tonic-gate 8679acbbeafSnn35248 /* 868*2b24ab6bSSebastien Roy * Exclusive stack zones interact with the dlmgmtd running in the 869*2b24ab6bSSebastien Roy * global zone. dladm_zone_boot() tells dlmgmtd that this zone is 870*2b24ab6bSSebastien Roy * booting, and loads its datalinks from the zone's datalink 871*2b24ab6bSSebastien Roy * configuration file. 872*2b24ab6bSSebastien Roy */ 873*2b24ab6bSSebastien Roy if (vplat_get_iptype(zlogp, &iptype) == 0 && iptype == ZS_EXCLUSIVE) { 874*2b24ab6bSSebastien Roy status = dladm_zone_boot(dld_handle, zoneid); 875*2b24ab6bSSebastien Roy if (status != DLADM_STATUS_OK) { 876*2b24ab6bSSebastien Roy zerror(zlogp, B_FALSE, "unable to load zone datalinks: " 877*2b24ab6bSSebastien Roy " %s", dladm_status2str(status, errmsg)); 878*2b24ab6bSSebastien Roy goto bad; 879*2b24ab6bSSebastien Roy } 880*2b24ab6bSSebastien Roy links_loaded = B_TRUE; 881*2b24ab6bSSebastien Roy } 882*2b24ab6bSSebastien Roy 883*2b24ab6bSSebastien Roy /* 8849acbbeafSnn35248 * If there is a brand 'boot' callback, execute it now to give the 8859acbbeafSnn35248 * brand one last chance to do any additional setup before the zone 8869acbbeafSnn35248 * is booted. 8879acbbeafSnn35248 */ 8889acbbeafSnn35248 if ((strlen(cmdbuf) > EXEC_LEN) && 889c5cd6260S (do_subproc(zlogp, cmdbuf, NULL) != Z_OK)) { 8909acbbeafSnn35248 zerror(zlogp, B_FALSE, "%s failed", cmdbuf); 8918fe9fdf2SDan Price goto bad; 8929acbbeafSnn35248 } 8939acbbeafSnn35248 8943f2f09c1Sdp if (zone_setattr(zoneid, ZONE_ATTR_INITNAME, init_file, 0) == -1) { 8953f2f09c1Sdp zerror(zlogp, B_TRUE, "could not set zone boot file"); 8968fe9fdf2SDan Price goto bad; 8973f2f09c1Sdp } 8983f2f09c1Sdp 8993f2f09c1Sdp if (zone_setattr(zoneid, ZONE_ATTR_BOOTARGS, nbootargs, 0) == -1) { 9003f2f09c1Sdp zerror(zlogp, B_TRUE, "could not set zone boot arguments"); 9018fe9fdf2SDan Price goto bad; 9023f2f09c1Sdp } 9033f2f09c1Sdp 9043f2f09c1Sdp if (zone_boot(zoneid) == -1) { 9057c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "unable to boot zone"); 9068fe9fdf2SDan Price goto bad; 9077c478bd9Sstevel@tonic-gate } 9087c478bd9Sstevel@tonic-gate 909c5cd6260S if (brand_poststatechg(zlogp, zstate, Z_BOOT) != 0) 9108fe9fdf2SDan Price goto bad; 911c5cd6260S 9127c478bd9Sstevel@tonic-gate return (0); 9138fe9fdf2SDan Price 9148fe9fdf2SDan Price bad: 9158fe9fdf2SDan Price /* 9168fe9fdf2SDan Price * If something goes wrong, we up the zones's state to the target 9178fe9fdf2SDan Price * state, RUNNING, and then invoke the hook as if we're halting. 9188fe9fdf2SDan Price */ 9198fe9fdf2SDan Price (void) brand_poststatechg(zlogp, ZONE_STATE_RUNNING, Z_HALT); 920*2b24ab6bSSebastien Roy if (links_loaded) 921*2b24ab6bSSebastien Roy (void) dladm_zone_halt(dld_handle, zoneid); 9228fe9fdf2SDan Price return (-1); 9237c478bd9Sstevel@tonic-gate } 9247c478bd9Sstevel@tonic-gate 9257c478bd9Sstevel@tonic-gate static int 926c5cd6260S zone_halt(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting, int zstate) 9277c478bd9Sstevel@tonic-gate { 9287c478bd9Sstevel@tonic-gate int err; 9297c478bd9Sstevel@tonic-gate 930c5cd6260S if (brand_prestatechg(zlogp, zstate, Z_HALT) != 0) 931c5cd6260S return (-1); 932c5cd6260S 9330209230bSgjelinek if (vplat_teardown(zlogp, unmount_cmd, rebooting) != 0) { 9347c478bd9Sstevel@tonic-gate if (!bringup_failure_recovery) 9357c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "unable to destroy zone"); 9367c478bd9Sstevel@tonic-gate return (-1); 9377c478bd9Sstevel@tonic-gate } 9387c478bd9Sstevel@tonic-gate 9397c478bd9Sstevel@tonic-gate if ((err = zonecfg_destroy_snapshot(zone_name)) != Z_OK) 9407c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "destroying snapshot: %s", 9417c478bd9Sstevel@tonic-gate zonecfg_strerror(err)); 9427c478bd9Sstevel@tonic-gate 943c5cd6260S if (brand_poststatechg(zlogp, zstate, Z_HALT) != 0) 944c5cd6260S return (-1); 945c5cd6260S 9467c478bd9Sstevel@tonic-gate return (0); 9477c478bd9Sstevel@tonic-gate } 9487c478bd9Sstevel@tonic-gate 9497c478bd9Sstevel@tonic-gate /* 9507c478bd9Sstevel@tonic-gate * Generate AUE_zone_state for a command that boots a zone. 9517c478bd9Sstevel@tonic-gate */ 9527c478bd9Sstevel@tonic-gate static void 9537c478bd9Sstevel@tonic-gate audit_put_record(zlog_t *zlogp, ucred_t *uc, int return_val, 9547c478bd9Sstevel@tonic-gate char *new_state) 9557c478bd9Sstevel@tonic-gate { 9567c478bd9Sstevel@tonic-gate adt_session_data_t *ah; 9577c478bd9Sstevel@tonic-gate adt_event_data_t *event; 9587c478bd9Sstevel@tonic-gate int pass_fail, fail_reason; 9597c478bd9Sstevel@tonic-gate 9607c478bd9Sstevel@tonic-gate if (!adt_audit_enabled()) 9617c478bd9Sstevel@tonic-gate return; 9627c478bd9Sstevel@tonic-gate 9637c478bd9Sstevel@tonic-gate if (return_val == 0) { 9647c478bd9Sstevel@tonic-gate pass_fail = ADT_SUCCESS; 9657c478bd9Sstevel@tonic-gate fail_reason = ADT_SUCCESS; 9667c478bd9Sstevel@tonic-gate } else { 9677c478bd9Sstevel@tonic-gate pass_fail = ADT_FAILURE; 9687c478bd9Sstevel@tonic-gate fail_reason = ADT_FAIL_VALUE_PROGRAM; 9697c478bd9Sstevel@tonic-gate } 9707c478bd9Sstevel@tonic-gate 9717c478bd9Sstevel@tonic-gate if (adt_start_session(&ah, NULL, 0)) { 9727c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, gettext("audit failure.")); 9737c478bd9Sstevel@tonic-gate return; 9747c478bd9Sstevel@tonic-gate } 9757c478bd9Sstevel@tonic-gate if (adt_set_from_ucred(ah, uc, ADT_NEW)) { 9767c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, gettext("audit failure.")); 9777c478bd9Sstevel@tonic-gate (void) adt_end_session(ah); 9787c478bd9Sstevel@tonic-gate return; 9797c478bd9Sstevel@tonic-gate } 9807c478bd9Sstevel@tonic-gate 9817c478bd9Sstevel@tonic-gate event = adt_alloc_event(ah, ADT_zone_state); 9827c478bd9Sstevel@tonic-gate if (event == NULL) { 9837c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, gettext("audit failure.")); 9847c478bd9Sstevel@tonic-gate (void) adt_end_session(ah); 9857c478bd9Sstevel@tonic-gate return; 9867c478bd9Sstevel@tonic-gate } 9877c478bd9Sstevel@tonic-gate event->adt_zone_state.zonename = zone_name; 9887c478bd9Sstevel@tonic-gate event->adt_zone_state.new_state = new_state; 9897c478bd9Sstevel@tonic-gate 9907c478bd9Sstevel@tonic-gate if (adt_put_event(event, pass_fail, fail_reason)) 9917c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, gettext("audit failure.")); 9927c478bd9Sstevel@tonic-gate 9937c478bd9Sstevel@tonic-gate adt_free_event(event); 9947c478bd9Sstevel@tonic-gate 9957c478bd9Sstevel@tonic-gate (void) adt_end_session(ah); 9967c478bd9Sstevel@tonic-gate } 9977c478bd9Sstevel@tonic-gate 9987c478bd9Sstevel@tonic-gate /* 9997c478bd9Sstevel@tonic-gate * The main routine for the door server that deals with zone state transitions. 10007c478bd9Sstevel@tonic-gate */ 10017c478bd9Sstevel@tonic-gate /* ARGSUSED */ 10027c478bd9Sstevel@tonic-gate static void 10037c478bd9Sstevel@tonic-gate server(void *cookie, char *args, size_t alen, door_desc_t *dp, 10047c478bd9Sstevel@tonic-gate uint_t n_desc) 10057c478bd9Sstevel@tonic-gate { 10067c478bd9Sstevel@tonic-gate ucred_t *uc = NULL; 10077c478bd9Sstevel@tonic-gate const priv_set_t *eset; 10087c478bd9Sstevel@tonic-gate 10097c478bd9Sstevel@tonic-gate zone_state_t zstate; 10107c478bd9Sstevel@tonic-gate zone_cmd_t cmd; 10117c478bd9Sstevel@tonic-gate zone_cmd_arg_t *zargp; 10127c478bd9Sstevel@tonic-gate 10137c478bd9Sstevel@tonic-gate boolean_t kernelcall; 10147c478bd9Sstevel@tonic-gate 10157c478bd9Sstevel@tonic-gate int rval = -1; 10167c478bd9Sstevel@tonic-gate uint64_t uniqid; 10177c478bd9Sstevel@tonic-gate zoneid_t zoneid = -1; 10187c478bd9Sstevel@tonic-gate zlog_t zlog; 10197c478bd9Sstevel@tonic-gate zlog_t *zlogp; 10207c478bd9Sstevel@tonic-gate zone_cmd_rval_t *rvalp; 10217c478bd9Sstevel@tonic-gate size_t rlen = getpagesize(); /* conservative */ 10229acbbeafSnn35248 fs_callback_t cb; 1023123807fbSedp brand_handle_t bh; 10247c478bd9Sstevel@tonic-gate 10257c478bd9Sstevel@tonic-gate /* LINTED E_BAD_PTR_CAST_ALIGN */ 10267c478bd9Sstevel@tonic-gate zargp = (zone_cmd_arg_t *)args; 10277c478bd9Sstevel@tonic-gate 10287c478bd9Sstevel@tonic-gate /* 10297c478bd9Sstevel@tonic-gate * When we get the door unref message, we've fdetach'd the door, and 10307c478bd9Sstevel@tonic-gate * it is time for us to shut down zoneadmd. 10317c478bd9Sstevel@tonic-gate */ 10327c478bd9Sstevel@tonic-gate if (zargp == DOOR_UNREF_DATA) { 10337c478bd9Sstevel@tonic-gate /* 10347c478bd9Sstevel@tonic-gate * See comment at end of main() for info on the last rites. 10357c478bd9Sstevel@tonic-gate */ 10367c478bd9Sstevel@tonic-gate exit(0); 10377c478bd9Sstevel@tonic-gate } 10387c478bd9Sstevel@tonic-gate 10397c478bd9Sstevel@tonic-gate if (zargp == NULL) { 10407c478bd9Sstevel@tonic-gate (void) door_return(NULL, 0, 0, 0); 10417c478bd9Sstevel@tonic-gate } 10427c478bd9Sstevel@tonic-gate 10437c478bd9Sstevel@tonic-gate rvalp = alloca(rlen); 10447c478bd9Sstevel@tonic-gate bzero(rvalp, rlen); 10457c478bd9Sstevel@tonic-gate zlog.logfile = NULL; 10467c478bd9Sstevel@tonic-gate zlog.buflen = zlog.loglen = rlen - sizeof (zone_cmd_rval_t) + 1; 10477c478bd9Sstevel@tonic-gate zlog.buf = rvalp->errbuf; 10487c478bd9Sstevel@tonic-gate zlog.log = zlog.buf; 10497c478bd9Sstevel@tonic-gate /* defer initialization of zlog.locale until after credential check */ 10507c478bd9Sstevel@tonic-gate zlogp = &zlog; 10517c478bd9Sstevel@tonic-gate 10527c478bd9Sstevel@tonic-gate if (alen != sizeof (zone_cmd_arg_t)) { 10537c478bd9Sstevel@tonic-gate /* 10547c478bd9Sstevel@tonic-gate * This really shouldn't be happening. 10557c478bd9Sstevel@tonic-gate */ 10563f2f09c1Sdp zerror(&logsys, B_FALSE, "argument size (%d bytes) " 10573f2f09c1Sdp "unexpected (expected %d bytes)", alen, 10583f2f09c1Sdp sizeof (zone_cmd_arg_t)); 10597c478bd9Sstevel@tonic-gate goto out; 10607c478bd9Sstevel@tonic-gate } 10617c478bd9Sstevel@tonic-gate cmd = zargp->cmd; 10627c478bd9Sstevel@tonic-gate 10637c478bd9Sstevel@tonic-gate if (door_ucred(&uc) != 0) { 10647c478bd9Sstevel@tonic-gate zerror(&logsys, B_TRUE, "door_ucred"); 10657c478bd9Sstevel@tonic-gate goto out; 10667c478bd9Sstevel@tonic-gate } 10677c478bd9Sstevel@tonic-gate eset = ucred_getprivset(uc, PRIV_EFFECTIVE); 10687c478bd9Sstevel@tonic-gate if (ucred_getzoneid(uc) != GLOBAL_ZONEID || 10697c478bd9Sstevel@tonic-gate (eset != NULL ? !priv_ismember(eset, PRIV_SYS_CONFIG) : 10707c478bd9Sstevel@tonic-gate ucred_geteuid(uc) != 0)) { 10717c478bd9Sstevel@tonic-gate zerror(&logsys, B_FALSE, "insufficient privileges"); 10727c478bd9Sstevel@tonic-gate goto out; 10737c478bd9Sstevel@tonic-gate } 10747c478bd9Sstevel@tonic-gate 10757c478bd9Sstevel@tonic-gate kernelcall = ucred_getpid(uc) == 0; 10767c478bd9Sstevel@tonic-gate 10777c478bd9Sstevel@tonic-gate /* 10787c478bd9Sstevel@tonic-gate * This is safe because we only use a zlog_t throughout the 10797c478bd9Sstevel@tonic-gate * duration of a door call; i.e., by the time the pointer 10807c478bd9Sstevel@tonic-gate * might become invalid, the door call would be over. 10817c478bd9Sstevel@tonic-gate */ 10827c478bd9Sstevel@tonic-gate zlog.locale = kernelcall ? DEFAULT_LOCALE : zargp->locale; 10837c478bd9Sstevel@tonic-gate 10847c478bd9Sstevel@tonic-gate (void) mutex_lock(&lock); 10857c478bd9Sstevel@tonic-gate 10867c478bd9Sstevel@tonic-gate /* 10877c478bd9Sstevel@tonic-gate * Once we start to really die off, we don't want more connections. 10887c478bd9Sstevel@tonic-gate */ 10897c478bd9Sstevel@tonic-gate if (in_death_throes) { 10907c478bd9Sstevel@tonic-gate (void) mutex_unlock(&lock); 10917c478bd9Sstevel@tonic-gate ucred_free(uc); 10927c478bd9Sstevel@tonic-gate (void) door_return(NULL, 0, 0, 0); 10937c478bd9Sstevel@tonic-gate thr_exit(NULL); 10947c478bd9Sstevel@tonic-gate } 10957c478bd9Sstevel@tonic-gate 10967c478bd9Sstevel@tonic-gate /* 10977c478bd9Sstevel@tonic-gate * Check for validity of command. 10987c478bd9Sstevel@tonic-gate */ 10999acbbeafSnn35248 if (cmd != Z_READY && cmd != Z_BOOT && cmd != Z_FORCEBOOT && 11009acbbeafSnn35248 cmd != Z_REBOOT && cmd != Z_HALT && cmd != Z_NOTE_UNINSTALLING && 11019acbbeafSnn35248 cmd != Z_MOUNT && cmd != Z_FORCEMOUNT && cmd != Z_UNMOUNT) { 1102108322fbScarlsonj zerror(&logsys, B_FALSE, "invalid command %d", (int)cmd); 11037c478bd9Sstevel@tonic-gate goto out; 11047c478bd9Sstevel@tonic-gate } 11057c478bd9Sstevel@tonic-gate 11067c478bd9Sstevel@tonic-gate if (kernelcall && (cmd != Z_HALT && cmd != Z_REBOOT)) { 11077c478bd9Sstevel@tonic-gate /* 11087c478bd9Sstevel@tonic-gate * Can't happen 11097c478bd9Sstevel@tonic-gate */ 11107c478bd9Sstevel@tonic-gate zerror(&logsys, B_FALSE, "received unexpected kernel upcall %d", 11117c478bd9Sstevel@tonic-gate cmd); 11127c478bd9Sstevel@tonic-gate goto out; 11137c478bd9Sstevel@tonic-gate } 11147c478bd9Sstevel@tonic-gate /* 11157c478bd9Sstevel@tonic-gate * We ignore the possibility of someone calling zone_create(2) 11167c478bd9Sstevel@tonic-gate * explicitly; all requests must come through zoneadmd. 11177c478bd9Sstevel@tonic-gate */ 11187c478bd9Sstevel@tonic-gate if (zone_get_state(zone_name, &zstate) != Z_OK) { 11197c478bd9Sstevel@tonic-gate /* 11207c478bd9Sstevel@tonic-gate * Something terribly wrong happened 11217c478bd9Sstevel@tonic-gate */ 11227c478bd9Sstevel@tonic-gate zerror(&logsys, B_FALSE, "unable to determine state of zone"); 11237c478bd9Sstevel@tonic-gate goto out; 11247c478bd9Sstevel@tonic-gate } 11257c478bd9Sstevel@tonic-gate 11267c478bd9Sstevel@tonic-gate if (kernelcall) { 11277c478bd9Sstevel@tonic-gate /* 11287c478bd9Sstevel@tonic-gate * Kernel-initiated requests may lose their validity if the 11297c478bd9Sstevel@tonic-gate * zone_t the kernel was referring to has gone away. 11307c478bd9Sstevel@tonic-gate */ 11317c478bd9Sstevel@tonic-gate if ((zoneid = getzoneidbyname(zone_name)) == -1 || 11327c478bd9Sstevel@tonic-gate zone_getattr(zoneid, ZONE_ATTR_UNIQID, &uniqid, 11337c478bd9Sstevel@tonic-gate sizeof (uniqid)) == -1 || uniqid != zargp->uniqid) { 11347c478bd9Sstevel@tonic-gate /* 11357c478bd9Sstevel@tonic-gate * We're not talking about the same zone. The request 11367c478bd9Sstevel@tonic-gate * must have arrived too late. Return error. 11377c478bd9Sstevel@tonic-gate */ 11387c478bd9Sstevel@tonic-gate rval = -1; 11397c478bd9Sstevel@tonic-gate goto out; 11407c478bd9Sstevel@tonic-gate } 11417c478bd9Sstevel@tonic-gate zlogp = &logsys; /* Log errors to syslog */ 11427c478bd9Sstevel@tonic-gate } 11437c478bd9Sstevel@tonic-gate 11449acbbeafSnn35248 /* 11459acbbeafSnn35248 * If we are being asked to forcibly mount or boot a zone, we 11469acbbeafSnn35248 * pretend that an INCOMPLETE zone is actually INSTALLED. 11479acbbeafSnn35248 */ 11489acbbeafSnn35248 if (zstate == ZONE_STATE_INCOMPLETE && 11499acbbeafSnn35248 (cmd == Z_FORCEBOOT || cmd == Z_FORCEMOUNT)) 11509acbbeafSnn35248 zstate = ZONE_STATE_INSTALLED; 11519acbbeafSnn35248 11527c478bd9Sstevel@tonic-gate switch (zstate) { 11537c478bd9Sstevel@tonic-gate case ZONE_STATE_CONFIGURED: 11547c478bd9Sstevel@tonic-gate case ZONE_STATE_INCOMPLETE: 11557c478bd9Sstevel@tonic-gate /* 11567c478bd9Sstevel@tonic-gate * Not our area of expertise; we just print a nice message 11577c478bd9Sstevel@tonic-gate * and die off. 11587c478bd9Sstevel@tonic-gate */ 11597c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, 11607c478bd9Sstevel@tonic-gate "%s operation is invalid for zones in state '%s'", 1161108322fbScarlsonj z_cmd_name(cmd), zone_state_str(zstate)); 11627c478bd9Sstevel@tonic-gate break; 11637c478bd9Sstevel@tonic-gate 11647c478bd9Sstevel@tonic-gate case ZONE_STATE_INSTALLED: 11657c478bd9Sstevel@tonic-gate switch (cmd) { 11667c478bd9Sstevel@tonic-gate case Z_READY: 1167c5cd6260S rval = zone_ready(zlogp, Z_MNT_BOOT, zstate); 11687c478bd9Sstevel@tonic-gate if (rval == 0) 11697c478bd9Sstevel@tonic-gate eventstream_write(Z_EVT_ZONE_READIED); 11707c478bd9Sstevel@tonic-gate break; 11717c478bd9Sstevel@tonic-gate case Z_BOOT: 11729acbbeafSnn35248 case Z_FORCEBOOT: 11737c478bd9Sstevel@tonic-gate eventstream_write(Z_EVT_ZONE_BOOTING); 1174c5cd6260S if ((rval = zone_ready(zlogp, Z_MNT_BOOT, zstate)) 1175c5cd6260S == 0) { 1176c5cd6260S rval = zone_bootup(zlogp, zargp->bootbuf, 1177c5cd6260S zstate); 1178c5cd6260S } 11797c478bd9Sstevel@tonic-gate audit_put_record(zlogp, uc, rval, "boot"); 11807c478bd9Sstevel@tonic-gate if (rval != 0) { 11817c478bd9Sstevel@tonic-gate bringup_failure_recovery = B_TRUE; 1182c5cd6260S (void) zone_halt(zlogp, B_FALSE, B_FALSE, 1183c5cd6260S zstate); 1184ffbafc53Scomay eventstream_write(Z_EVT_ZONE_BOOTFAILED); 11857c478bd9Sstevel@tonic-gate } 11867c478bd9Sstevel@tonic-gate break; 11877c478bd9Sstevel@tonic-gate case Z_HALT: 11887c478bd9Sstevel@tonic-gate if (kernelcall) /* Invalid; can't happen */ 11897c478bd9Sstevel@tonic-gate abort(); 11907c478bd9Sstevel@tonic-gate /* 11917c478bd9Sstevel@tonic-gate * We could have two clients racing to halt this 11927c478bd9Sstevel@tonic-gate * zone; the second client loses, but his request 11937c478bd9Sstevel@tonic-gate * doesn't fail, since the zone is now in the desired 11947c478bd9Sstevel@tonic-gate * state. 11957c478bd9Sstevel@tonic-gate */ 11967c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "zone is already halted"); 11977c478bd9Sstevel@tonic-gate rval = 0; 11987c478bd9Sstevel@tonic-gate break; 11997c478bd9Sstevel@tonic-gate case Z_REBOOT: 12007c478bd9Sstevel@tonic-gate if (kernelcall) /* Invalid; can't happen */ 12017c478bd9Sstevel@tonic-gate abort(); 12027c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "%s operation is invalid " 1203108322fbScarlsonj "for zones in state '%s'", z_cmd_name(cmd), 12047c478bd9Sstevel@tonic-gate zone_state_str(zstate)); 12057c478bd9Sstevel@tonic-gate rval = -1; 12067c478bd9Sstevel@tonic-gate break; 12077c478bd9Sstevel@tonic-gate case Z_NOTE_UNINSTALLING: 12087c478bd9Sstevel@tonic-gate if (kernelcall) /* Invalid; can't happen */ 12097c478bd9Sstevel@tonic-gate abort(); 12107c478bd9Sstevel@tonic-gate /* 12117c478bd9Sstevel@tonic-gate * Tell the console to print out a message about this. 12127c478bd9Sstevel@tonic-gate * Once it does, we will be in_death_throes. 12137c478bd9Sstevel@tonic-gate */ 12147c478bd9Sstevel@tonic-gate eventstream_write(Z_EVT_ZONE_UNINSTALLING); 12157c478bd9Sstevel@tonic-gate break; 1216108322fbScarlsonj case Z_MOUNT: 12179acbbeafSnn35248 case Z_FORCEMOUNT: 1218108322fbScarlsonj if (kernelcall) /* Invalid; can't happen */ 1219108322fbScarlsonj abort(); 12209a5d73e0SRic Aleshire if (!zone_isnative && !zone_iscluster && 12219a5d73e0SRic Aleshire !zone_islabeled) { 12220679f794S /* 12230679f794S * -U mounts the zone without lofs mounting 12240679f794S * zone file systems back into the scratch 12250679f794S * zone. This is required when mounting 12260679f794S * non-native branded zones. 12270679f794S */ 12280679f794S (void) strlcpy(zargp->bootbuf, "-U", 12290679f794S BOOTARGS_MAX); 1230ffbafc53Scomay } 1231ffbafc53Scomay 12326cfd72c6Sgjelinek rval = zone_ready(zlogp, 12336cfd72c6Sgjelinek strcmp(zargp->bootbuf, "-U") == 0 ? 1234c5cd6260S Z_MNT_UPDATE : Z_MNT_SCRATCH, zstate); 12359acbbeafSnn35248 if (rval != 0) 12369acbbeafSnn35248 break; 12379acbbeafSnn35248 12389acbbeafSnn35248 eventstream_write(Z_EVT_ZONE_READIED); 12399acbbeafSnn35248 12400679f794S /* 12410679f794S * Get a handle to the native brand info. 12420679f794S * We must always use the native brand file system 12430679f794S * list when mounting the zone. 12440679f794S */ 12450679f794S if ((bh = brand_open(NATIVE_BRAND_NAME)) == NULL) { 12469acbbeafSnn35248 rval = -1; 12479acbbeafSnn35248 break; 12489acbbeafSnn35248 } 12499acbbeafSnn35248 12509acbbeafSnn35248 /* 12519acbbeafSnn35248 * Get the list of filesystems to mount from 12529acbbeafSnn35248 * the brand configuration. These mounts are done 12539acbbeafSnn35248 * via a thread that will enter the zone, so they 12549acbbeafSnn35248 * are done from within the context of the zone. 12559acbbeafSnn35248 */ 12569acbbeafSnn35248 cb.zlogp = zlogp; 12579acbbeafSnn35248 cb.zoneid = zone_id; 1258910f48daSedp cb.mount_cmd = B_TRUE; 1259123807fbSedp rval = brand_platform_iter_mounts(bh, 12609acbbeafSnn35248 mount_early_fs, &cb); 12619acbbeafSnn35248 1262123807fbSedp brand_close(bh); 12639acbbeafSnn35248 1264108322fbScarlsonj /* 1265108322fbScarlsonj * Ordinarily, /dev/fd would be mounted inside the zone 1266108322fbScarlsonj * by svc:/system/filesystem/usr:default, but since 1267108322fbScarlsonj * we're not booting the zone, we need to do this 1268108322fbScarlsonj * manually. 1269108322fbScarlsonj */ 1270108322fbScarlsonj if (rval == 0) 12719acbbeafSnn35248 rval = mount_early_fs(&cb, 12729acbbeafSnn35248 "fd", "/dev/fd", "fd", NULL); 1273108322fbScarlsonj break; 1274108322fbScarlsonj case Z_UNMOUNT: 1275108322fbScarlsonj if (kernelcall) /* Invalid; can't happen */ 1276108322fbScarlsonj abort(); 1277108322fbScarlsonj zerror(zlogp, B_FALSE, "zone is already unmounted"); 1278108322fbScarlsonj rval = 0; 1279108322fbScarlsonj break; 12807c478bd9Sstevel@tonic-gate } 12817c478bd9Sstevel@tonic-gate break; 12827c478bd9Sstevel@tonic-gate 12837c478bd9Sstevel@tonic-gate case ZONE_STATE_READY: 12847c478bd9Sstevel@tonic-gate switch (cmd) { 12857c478bd9Sstevel@tonic-gate case Z_READY: 12867c478bd9Sstevel@tonic-gate /* 12877c478bd9Sstevel@tonic-gate * We could have two clients racing to ready this 12887c478bd9Sstevel@tonic-gate * zone; the second client loses, but his request 12897c478bd9Sstevel@tonic-gate * doesn't fail, since the zone is now in the desired 12907c478bd9Sstevel@tonic-gate * state. 12917c478bd9Sstevel@tonic-gate */ 12927c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "zone is already ready"); 12937c478bd9Sstevel@tonic-gate rval = 0; 12947c478bd9Sstevel@tonic-gate break; 12957c478bd9Sstevel@tonic-gate case Z_BOOT: 12963f2f09c1Sdp (void) strlcpy(boot_args, zargp->bootbuf, 12973f2f09c1Sdp sizeof (boot_args)); 12987c478bd9Sstevel@tonic-gate eventstream_write(Z_EVT_ZONE_BOOTING); 1299c5cd6260S rval = zone_bootup(zlogp, zargp->bootbuf, zstate); 13007c478bd9Sstevel@tonic-gate audit_put_record(zlogp, uc, rval, "boot"); 13017c478bd9Sstevel@tonic-gate if (rval != 0) { 13027c478bd9Sstevel@tonic-gate bringup_failure_recovery = B_TRUE; 1303c5cd6260S (void) zone_halt(zlogp, B_FALSE, B_TRUE, 1304c5cd6260S zstate); 1305ffbafc53Scomay eventstream_write(Z_EVT_ZONE_BOOTFAILED); 13067c478bd9Sstevel@tonic-gate } 13073f2f09c1Sdp boot_args[0] = '\0'; 13087c478bd9Sstevel@tonic-gate break; 13097c478bd9Sstevel@tonic-gate case Z_HALT: 13107c478bd9Sstevel@tonic-gate if (kernelcall) /* Invalid; can't happen */ 13117c478bd9Sstevel@tonic-gate abort(); 1312c5cd6260S if ((rval = zone_halt(zlogp, B_FALSE, B_FALSE, zstate)) 1313c5cd6260S != 0) 13147c478bd9Sstevel@tonic-gate break; 13157c478bd9Sstevel@tonic-gate eventstream_write(Z_EVT_ZONE_HALTED); 13167c478bd9Sstevel@tonic-gate break; 13177c478bd9Sstevel@tonic-gate case Z_REBOOT: 1318108322fbScarlsonj case Z_NOTE_UNINSTALLING: 1319108322fbScarlsonj case Z_MOUNT: 1320108322fbScarlsonj case Z_UNMOUNT: 13217c478bd9Sstevel@tonic-gate if (kernelcall) /* Invalid; can't happen */ 13227c478bd9Sstevel@tonic-gate abort(); 13237c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "%s operation is invalid " 1324108322fbScarlsonj "for zones in state '%s'", z_cmd_name(cmd), 13257c478bd9Sstevel@tonic-gate zone_state_str(zstate)); 13267c478bd9Sstevel@tonic-gate rval = -1; 13277c478bd9Sstevel@tonic-gate break; 1328108322fbScarlsonj } 1329108322fbScarlsonj break; 1330108322fbScarlsonj 1331108322fbScarlsonj case ZONE_STATE_MOUNTED: 1332108322fbScarlsonj switch (cmd) { 1333108322fbScarlsonj case Z_UNMOUNT: 13347c478bd9Sstevel@tonic-gate if (kernelcall) /* Invalid; can't happen */ 13357c478bd9Sstevel@tonic-gate abort(); 1336c5cd6260S rval = zone_halt(zlogp, B_TRUE, B_FALSE, zstate); 1337ffbafc53Scomay if (rval == 0) { 1338ffbafc53Scomay eventstream_write(Z_EVT_ZONE_HALTED); 1339108322fbScarlsonj (void) sema_post(&scratch_sem); 1340ffbafc53Scomay } 1341108322fbScarlsonj break; 1342108322fbScarlsonj default: 1343108322fbScarlsonj if (kernelcall) /* Invalid; can't happen */ 1344108322fbScarlsonj abort(); 1345108322fbScarlsonj zerror(zlogp, B_FALSE, "%s operation is invalid " 1346108322fbScarlsonj "for zones in state '%s'", z_cmd_name(cmd), 1347108322fbScarlsonj zone_state_str(zstate)); 13487c478bd9Sstevel@tonic-gate rval = -1; 13497c478bd9Sstevel@tonic-gate break; 13507c478bd9Sstevel@tonic-gate } 13517c478bd9Sstevel@tonic-gate break; 13527c478bd9Sstevel@tonic-gate 13537c478bd9Sstevel@tonic-gate case ZONE_STATE_RUNNING: 13547c478bd9Sstevel@tonic-gate case ZONE_STATE_SHUTTING_DOWN: 13557c478bd9Sstevel@tonic-gate case ZONE_STATE_DOWN: 13567c478bd9Sstevel@tonic-gate switch (cmd) { 13577c478bd9Sstevel@tonic-gate case Z_READY: 1358c5cd6260S if ((rval = zone_halt(zlogp, B_FALSE, B_TRUE, zstate)) 1359c5cd6260S != 0) 13607c478bd9Sstevel@tonic-gate break; 1361c5cd6260S if ((rval = zone_ready(zlogp, Z_MNT_BOOT, zstate)) == 0) 13627c478bd9Sstevel@tonic-gate eventstream_write(Z_EVT_ZONE_READIED); 1363ffbafc53Scomay else 1364ffbafc53Scomay eventstream_write(Z_EVT_ZONE_HALTED); 13657c478bd9Sstevel@tonic-gate break; 13667c478bd9Sstevel@tonic-gate case Z_BOOT: 13677c478bd9Sstevel@tonic-gate /* 13687c478bd9Sstevel@tonic-gate * We could have two clients racing to boot this 13697c478bd9Sstevel@tonic-gate * zone; the second client loses, but his request 13707c478bd9Sstevel@tonic-gate * doesn't fail, since the zone is now in the desired 13717c478bd9Sstevel@tonic-gate * state. 13727c478bd9Sstevel@tonic-gate */ 13737c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "zone is already booted"); 13747c478bd9Sstevel@tonic-gate rval = 0; 13757c478bd9Sstevel@tonic-gate break; 13767c478bd9Sstevel@tonic-gate case Z_HALT: 1377c5cd6260S if ((rval = zone_halt(zlogp, B_FALSE, B_FALSE, zstate)) 1378c5cd6260S != 0) 13797c478bd9Sstevel@tonic-gate break; 13807c478bd9Sstevel@tonic-gate eventstream_write(Z_EVT_ZONE_HALTED); 13817c478bd9Sstevel@tonic-gate break; 13827c478bd9Sstevel@tonic-gate case Z_REBOOT: 13833f2f09c1Sdp (void) strlcpy(boot_args, zargp->bootbuf, 13843f2f09c1Sdp sizeof (boot_args)); 13857c478bd9Sstevel@tonic-gate eventstream_write(Z_EVT_ZONE_REBOOTING); 1386c5cd6260S if ((rval = zone_halt(zlogp, B_FALSE, B_TRUE, zstate)) 1387c5cd6260S != 0) { 1388ffbafc53Scomay eventstream_write(Z_EVT_ZONE_BOOTFAILED); 13893f2f09c1Sdp boot_args[0] = '\0'; 13907c478bd9Sstevel@tonic-gate break; 1391ffbafc53Scomay } 1392c5cd6260S if ((rval = zone_ready(zlogp, Z_MNT_BOOT, zstate)) 1393c5cd6260S != 0) { 1394ffbafc53Scomay eventstream_write(Z_EVT_ZONE_BOOTFAILED); 13953f2f09c1Sdp boot_args[0] = '\0'; 1396ffbafc53Scomay break; 1397ffbafc53Scomay } 1398c5cd6260S rval = zone_bootup(zlogp, zargp->bootbuf, zstate); 13997c478bd9Sstevel@tonic-gate audit_put_record(zlogp, uc, rval, "reboot"); 1400ffbafc53Scomay if (rval != 0) { 1401c5cd6260S (void) zone_halt(zlogp, B_FALSE, B_TRUE, 1402c5cd6260S zstate); 1403ffbafc53Scomay eventstream_write(Z_EVT_ZONE_BOOTFAILED); 14047c478bd9Sstevel@tonic-gate } 14053f2f09c1Sdp boot_args[0] = '\0'; 14067c478bd9Sstevel@tonic-gate break; 14077c478bd9Sstevel@tonic-gate case Z_NOTE_UNINSTALLING: 1408108322fbScarlsonj case Z_MOUNT: 1409108322fbScarlsonj case Z_UNMOUNT: 1410108322fbScarlsonj zerror(zlogp, B_FALSE, "%s operation is invalid " 1411108322fbScarlsonj "for zones in state '%s'", z_cmd_name(cmd), 1412108322fbScarlsonj zone_state_str(zstate)); 14137c478bd9Sstevel@tonic-gate rval = -1; 14147c478bd9Sstevel@tonic-gate break; 14157c478bd9Sstevel@tonic-gate } 14167c478bd9Sstevel@tonic-gate break; 14177c478bd9Sstevel@tonic-gate default: 14187c478bd9Sstevel@tonic-gate abort(); 14197c478bd9Sstevel@tonic-gate } 14207c478bd9Sstevel@tonic-gate 14217c478bd9Sstevel@tonic-gate /* 14227c478bd9Sstevel@tonic-gate * Because the state of the zone may have changed, we make sure 14237c478bd9Sstevel@tonic-gate * to wake the console poller, which is in charge of initiating 14247c478bd9Sstevel@tonic-gate * the shutdown procedure as necessary. 14257c478bd9Sstevel@tonic-gate */ 14267c478bd9Sstevel@tonic-gate eventstream_write(Z_EVT_NULL); 14277c478bd9Sstevel@tonic-gate 14287c478bd9Sstevel@tonic-gate out: 14297c478bd9Sstevel@tonic-gate (void) mutex_unlock(&lock); 14307c478bd9Sstevel@tonic-gate if (kernelcall) { 14317c478bd9Sstevel@tonic-gate rvalp = NULL; 14327c478bd9Sstevel@tonic-gate rlen = 0; 14337c478bd9Sstevel@tonic-gate } else { 14347c478bd9Sstevel@tonic-gate rvalp->rval = rval; 14357c478bd9Sstevel@tonic-gate } 14367c478bd9Sstevel@tonic-gate if (uc != NULL) 14377c478bd9Sstevel@tonic-gate ucred_free(uc); 14387c478bd9Sstevel@tonic-gate (void) door_return((char *)rvalp, rlen, NULL, 0); 14397c478bd9Sstevel@tonic-gate thr_exit(NULL); 14407c478bd9Sstevel@tonic-gate } 14417c478bd9Sstevel@tonic-gate 14427c478bd9Sstevel@tonic-gate static int 14437c478bd9Sstevel@tonic-gate setup_door(zlog_t *zlogp) 14447c478bd9Sstevel@tonic-gate { 14457c478bd9Sstevel@tonic-gate if ((zone_door = door_create(server, NULL, 14467c478bd9Sstevel@tonic-gate DOOR_UNREF | DOOR_REFUSE_DESC | DOOR_NO_CANCEL)) < 0) { 14477c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "%s failed", "door_create"); 14487c478bd9Sstevel@tonic-gate return (-1); 14497c478bd9Sstevel@tonic-gate } 14507c478bd9Sstevel@tonic-gate (void) fdetach(zone_door_path); 14517c478bd9Sstevel@tonic-gate 14527c478bd9Sstevel@tonic-gate if (fattach(zone_door, zone_door_path) != 0) { 14537c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "fattach to %s failed", zone_door_path); 14547c478bd9Sstevel@tonic-gate (void) door_revoke(zone_door); 14557c478bd9Sstevel@tonic-gate (void) fdetach(zone_door_path); 14567c478bd9Sstevel@tonic-gate zone_door = -1; 14577c478bd9Sstevel@tonic-gate return (-1); 14587c478bd9Sstevel@tonic-gate } 14597c478bd9Sstevel@tonic-gate return (0); 14607c478bd9Sstevel@tonic-gate } 14617c478bd9Sstevel@tonic-gate 14627c478bd9Sstevel@tonic-gate /* 14637c478bd9Sstevel@tonic-gate * zoneadm(1m) will start zoneadmd if it thinks it isn't running; this 14647c478bd9Sstevel@tonic-gate * is where zoneadmd itself will check to see that another instance of 14657c478bd9Sstevel@tonic-gate * zoneadmd isn't already controlling this zone. 14667c478bd9Sstevel@tonic-gate * 14677c478bd9Sstevel@tonic-gate * The idea here is that we want to open the path to which we will 14687c478bd9Sstevel@tonic-gate * attach our door, lock it, and then make sure that no-one has beat us 14697c478bd9Sstevel@tonic-gate * to fattach(3c)ing onto it. 14707c478bd9Sstevel@tonic-gate * 14717c478bd9Sstevel@tonic-gate * fattach(3c) is really a mount, so there are actually two possible 14727c478bd9Sstevel@tonic-gate * vnodes we could be dealing with. Our strategy is as follows: 14737c478bd9Sstevel@tonic-gate * 14747c478bd9Sstevel@tonic-gate * - If the file we opened is a regular file (common case): 14757c478bd9Sstevel@tonic-gate * There is no fattach(3c)ed door, so we have a chance of becoming 14767c478bd9Sstevel@tonic-gate * the managing zoneadmd. We attempt to lock the file: if it is 14777c478bd9Sstevel@tonic-gate * already locked, that means someone else raced us here, so we 14787c478bd9Sstevel@tonic-gate * lose and give up. zoneadm(1m) will try to contact the zoneadmd 14797c478bd9Sstevel@tonic-gate * that beat us to it. 14807c478bd9Sstevel@tonic-gate * 14817c478bd9Sstevel@tonic-gate * - If the file we opened is a namefs file: 14827c478bd9Sstevel@tonic-gate * This means there is already an established door fattach(3c)'ed 14837c478bd9Sstevel@tonic-gate * to the rendezvous path. We've lost the race, so we give up. 14847c478bd9Sstevel@tonic-gate * Note that in this case we also try to grab the file lock, and 14857c478bd9Sstevel@tonic-gate * will succeed in acquiring it since the vnode locked by the 14867c478bd9Sstevel@tonic-gate * "winning" zoneadmd was a regular one, and the one we locked was 14877c478bd9Sstevel@tonic-gate * the fattach(3c)'ed door node. At any rate, no harm is done, and 14887c478bd9Sstevel@tonic-gate * we just return to zoneadm(1m) which knows to retry. 14897c478bd9Sstevel@tonic-gate */ 14907c478bd9Sstevel@tonic-gate static int 14917c478bd9Sstevel@tonic-gate make_daemon_exclusive(zlog_t *zlogp) 14927c478bd9Sstevel@tonic-gate { 14937c478bd9Sstevel@tonic-gate int doorfd = -1; 14947c478bd9Sstevel@tonic-gate int err, ret = -1; 14957c478bd9Sstevel@tonic-gate struct stat st; 14967c478bd9Sstevel@tonic-gate struct flock flock; 14977c478bd9Sstevel@tonic-gate zone_state_t zstate; 14987c478bd9Sstevel@tonic-gate 14997c478bd9Sstevel@tonic-gate top: 15007c478bd9Sstevel@tonic-gate if ((err = zone_get_state(zone_name, &zstate)) != Z_OK) { 15013f2f09c1Sdp zerror(zlogp, B_FALSE, "failed to get zone state: %s", 15027c478bd9Sstevel@tonic-gate zonecfg_strerror(err)); 15037c478bd9Sstevel@tonic-gate goto out; 15047c478bd9Sstevel@tonic-gate } 15057c478bd9Sstevel@tonic-gate if ((doorfd = open(zone_door_path, O_CREAT|O_RDWR, 15067c478bd9Sstevel@tonic-gate S_IREAD|S_IWRITE)) < 0) { 15077c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "failed to open %s", zone_door_path); 15087c478bd9Sstevel@tonic-gate goto out; 15097c478bd9Sstevel@tonic-gate } 15107c478bd9Sstevel@tonic-gate if (fstat(doorfd, &st) < 0) { 15117c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "failed to stat %s", zone_door_path); 15127c478bd9Sstevel@tonic-gate goto out; 15137c478bd9Sstevel@tonic-gate } 15147c478bd9Sstevel@tonic-gate /* 15157c478bd9Sstevel@tonic-gate * Lock the file to synchronize with other zoneadmd 15167c478bd9Sstevel@tonic-gate */ 15177c478bd9Sstevel@tonic-gate flock.l_type = F_WRLCK; 15187c478bd9Sstevel@tonic-gate flock.l_whence = SEEK_SET; 15197c478bd9Sstevel@tonic-gate flock.l_start = (off_t)0; 15207c478bd9Sstevel@tonic-gate flock.l_len = (off_t)0; 15217c478bd9Sstevel@tonic-gate if (fcntl(doorfd, F_SETLK, &flock) < 0) { 15227c478bd9Sstevel@tonic-gate /* 15237c478bd9Sstevel@tonic-gate * Someone else raced us here and grabbed the lock file 15247c478bd9Sstevel@tonic-gate * first. A warning here is inappropriate since nothing 15257c478bd9Sstevel@tonic-gate * went wrong. 15267c478bd9Sstevel@tonic-gate */ 15277c478bd9Sstevel@tonic-gate goto out; 15287c478bd9Sstevel@tonic-gate } 15297c478bd9Sstevel@tonic-gate 15307c478bd9Sstevel@tonic-gate if (strcmp(st.st_fstype, "namefs") == 0) { 15317c478bd9Sstevel@tonic-gate struct door_info info; 15327c478bd9Sstevel@tonic-gate 15337c478bd9Sstevel@tonic-gate /* 15347c478bd9Sstevel@tonic-gate * There is already something fattach()'ed to this file. 15357c478bd9Sstevel@tonic-gate * Lets see what the door is up to. 15367c478bd9Sstevel@tonic-gate */ 15377c478bd9Sstevel@tonic-gate if (door_info(doorfd, &info) == 0 && info.di_target != -1) { 15387c478bd9Sstevel@tonic-gate /* 15397c478bd9Sstevel@tonic-gate * Another zoneadmd process seems to be in 15407c478bd9Sstevel@tonic-gate * control of the situation and we don't need to 15417c478bd9Sstevel@tonic-gate * be here. A warning here is inappropriate 15427c478bd9Sstevel@tonic-gate * since nothing went wrong. 15437c478bd9Sstevel@tonic-gate * 15447c478bd9Sstevel@tonic-gate * If the door has been revoked, the zoneadmd 15457c478bd9Sstevel@tonic-gate * process currently managing the zone is going 15467c478bd9Sstevel@tonic-gate * away. We'll return control to zoneadm(1m) 15477c478bd9Sstevel@tonic-gate * which will try again (by which time zoneadmd 15487c478bd9Sstevel@tonic-gate * will hopefully have exited). 15497c478bd9Sstevel@tonic-gate */ 15507c478bd9Sstevel@tonic-gate goto out; 15517c478bd9Sstevel@tonic-gate } 15527c478bd9Sstevel@tonic-gate 15537c478bd9Sstevel@tonic-gate /* 15547c478bd9Sstevel@tonic-gate * If we got this far, there's a fattach(3c)'ed door 15557c478bd9Sstevel@tonic-gate * that belongs to a process that has exited, which can 15567c478bd9Sstevel@tonic-gate * happen if the previous zoneadmd died unexpectedly. 15577c478bd9Sstevel@tonic-gate * 15587c478bd9Sstevel@tonic-gate * Let user know that something is amiss, but that we can 15597c478bd9Sstevel@tonic-gate * recover; if the zone is in the installed state, then don't 15607c478bd9Sstevel@tonic-gate * message, since having a running zoneadmd isn't really 15617c478bd9Sstevel@tonic-gate * expected/needed. We want to keep occurences of this message 15627c478bd9Sstevel@tonic-gate * limited to times when zoneadmd is picking back up from a 15637c478bd9Sstevel@tonic-gate * zoneadmd that died while the zone was in some non-trivial 15647c478bd9Sstevel@tonic-gate * state. 15657c478bd9Sstevel@tonic-gate */ 15667c478bd9Sstevel@tonic-gate if (zstate > ZONE_STATE_INSTALLED) { 15677c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, 15687c478bd9Sstevel@tonic-gate "zone '%s': WARNING: zone is in state '%s', but " 15697c478bd9Sstevel@tonic-gate "zoneadmd does not appear to be available; " 15707c478bd9Sstevel@tonic-gate "restarted zoneadmd to recover.", 15717c478bd9Sstevel@tonic-gate zone_name, zone_state_str(zstate)); 15727c478bd9Sstevel@tonic-gate } 15737c478bd9Sstevel@tonic-gate 15747c478bd9Sstevel@tonic-gate (void) fdetach(zone_door_path); 15757c478bd9Sstevel@tonic-gate (void) close(doorfd); 15767c478bd9Sstevel@tonic-gate goto top; 15777c478bd9Sstevel@tonic-gate } 15787c478bd9Sstevel@tonic-gate ret = 0; 15797c478bd9Sstevel@tonic-gate out: 15807c478bd9Sstevel@tonic-gate (void) close(doorfd); 15817c478bd9Sstevel@tonic-gate return (ret); 15827c478bd9Sstevel@tonic-gate } 15837c478bd9Sstevel@tonic-gate 1584c5cd6260S /* 1585c5cd6260S * Setup the brand's pre and post state change callbacks, as well as the 1586c5cd6260S * query callback, if any of these exist. 1587c5cd6260S */ 1588c5cd6260S static int 1589c5cd6260S brand_callback_init(brand_handle_t bh, char *zone_name) 1590c5cd6260S { 1591c5cd6260S char zpath[MAXPATHLEN]; 1592c5cd6260S 1593c5cd6260S if (zone_get_zonepath(zone_name, zpath, sizeof (zpath)) != Z_OK) 1594c5cd6260S return (-1); 1595c5cd6260S 1596c5cd6260S (void) strlcpy(pre_statechg_hook, EXEC_PREFIX, 1597c5cd6260S sizeof (pre_statechg_hook)); 1598c5cd6260S 1599c5cd6260S if (brand_get_prestatechange(bh, zone_name, zpath, 1600c5cd6260S pre_statechg_hook + EXEC_LEN, 1601c5cd6260S sizeof (pre_statechg_hook) - EXEC_LEN) != 0) 1602c5cd6260S return (-1); 1603c5cd6260S 1604c5cd6260S if (strlen(pre_statechg_hook) <= EXEC_LEN) 1605c5cd6260S pre_statechg_hook[0] = '\0'; 1606c5cd6260S 1607c5cd6260S (void) strlcpy(post_statechg_hook, EXEC_PREFIX, 1608c5cd6260S sizeof (post_statechg_hook)); 1609c5cd6260S 1610c5cd6260S if (brand_get_poststatechange(bh, zone_name, zpath, 1611c5cd6260S post_statechg_hook + EXEC_LEN, 1612c5cd6260S sizeof (post_statechg_hook) - EXEC_LEN) != 0) 1613c5cd6260S return (-1); 1614c5cd6260S 1615c5cd6260S if (strlen(post_statechg_hook) <= EXEC_LEN) 1616c5cd6260S post_statechg_hook[0] = '\0'; 1617c5cd6260S 1618c5cd6260S (void) strlcpy(query_hook, EXEC_PREFIX, 1619c5cd6260S sizeof (query_hook)); 1620c5cd6260S 1621c5cd6260S if (brand_get_query(bh, zone_name, zpath, query_hook + EXEC_LEN, 1622c5cd6260S sizeof (query_hook) - EXEC_LEN) != 0) 1623c5cd6260S return (-1); 1624c5cd6260S 1625c5cd6260S if (strlen(query_hook) <= EXEC_LEN) 1626c5cd6260S query_hook[0] = '\0'; 1627c5cd6260S 1628c5cd6260S return (0); 1629c5cd6260S } 1630c5cd6260S 16317c478bd9Sstevel@tonic-gate int 16327c478bd9Sstevel@tonic-gate main(int argc, char *argv[]) 16337c478bd9Sstevel@tonic-gate { 16347c478bd9Sstevel@tonic-gate int opt; 16357c478bd9Sstevel@tonic-gate zoneid_t zid; 16367c478bd9Sstevel@tonic-gate priv_set_t *privset; 16377c478bd9Sstevel@tonic-gate zone_state_t zstate; 16387c478bd9Sstevel@tonic-gate char parents_locale[MAXPATHLEN]; 1639123807fbSedp brand_handle_t bh; 16407c478bd9Sstevel@tonic-gate int err; 16417c478bd9Sstevel@tonic-gate 16427c478bd9Sstevel@tonic-gate pid_t pid; 16437c478bd9Sstevel@tonic-gate sigset_t blockset; 16447c478bd9Sstevel@tonic-gate sigset_t block_cld; 16457c478bd9Sstevel@tonic-gate 16467c478bd9Sstevel@tonic-gate struct { 16477c478bd9Sstevel@tonic-gate sema_t sem; 16487c478bd9Sstevel@tonic-gate int status; 16497c478bd9Sstevel@tonic-gate zlog_t log; 16507c478bd9Sstevel@tonic-gate } *shstate; 16517c478bd9Sstevel@tonic-gate size_t shstatelen = getpagesize(); 16527c478bd9Sstevel@tonic-gate 16537c478bd9Sstevel@tonic-gate zlog_t errlog; 16547c478bd9Sstevel@tonic-gate zlog_t *zlogp; 16557c478bd9Sstevel@tonic-gate 16565cb4571dSdp int ctfd; 16575cb4571dSdp 16587c478bd9Sstevel@tonic-gate progname = get_execbasename(argv[0]); 16597c478bd9Sstevel@tonic-gate 16607c478bd9Sstevel@tonic-gate /* 16617c478bd9Sstevel@tonic-gate * Make sure stderr is unbuffered 16627c478bd9Sstevel@tonic-gate */ 16637c478bd9Sstevel@tonic-gate (void) setbuffer(stderr, NULL, 0); 16647c478bd9Sstevel@tonic-gate 16657c478bd9Sstevel@tonic-gate /* 16667c478bd9Sstevel@tonic-gate * Get out of the way of mounted filesystems, since we will daemonize 16677c478bd9Sstevel@tonic-gate * soon. 16687c478bd9Sstevel@tonic-gate */ 16697c478bd9Sstevel@tonic-gate (void) chdir("/"); 16707c478bd9Sstevel@tonic-gate 16717c478bd9Sstevel@tonic-gate /* 16727c478bd9Sstevel@tonic-gate * Use the default system umask per PSARC 1998/110 rather than 16737c478bd9Sstevel@tonic-gate * anything that may have been set by the caller. 16747c478bd9Sstevel@tonic-gate */ 16757c478bd9Sstevel@tonic-gate (void) umask(CMASK); 16767c478bd9Sstevel@tonic-gate 16777c478bd9Sstevel@tonic-gate /* 16787c478bd9Sstevel@tonic-gate * Initially we want to use our parent's locale. 16797c478bd9Sstevel@tonic-gate */ 16807c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 16817c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 16827c478bd9Sstevel@tonic-gate (void) strlcpy(parents_locale, setlocale(LC_MESSAGES, NULL), 16837c478bd9Sstevel@tonic-gate sizeof (parents_locale)); 16847c478bd9Sstevel@tonic-gate 16857c478bd9Sstevel@tonic-gate /* 16867c478bd9Sstevel@tonic-gate * This zlog_t is used for writing to stderr 16877c478bd9Sstevel@tonic-gate */ 16887c478bd9Sstevel@tonic-gate errlog.logfile = stderr; 16897c478bd9Sstevel@tonic-gate errlog.buflen = errlog.loglen = 0; 16907c478bd9Sstevel@tonic-gate errlog.buf = errlog.log = NULL; 16917c478bd9Sstevel@tonic-gate errlog.locale = parents_locale; 16927c478bd9Sstevel@tonic-gate 16937c478bd9Sstevel@tonic-gate /* 16947c478bd9Sstevel@tonic-gate * We start off writing to stderr until we're ready to daemonize. 16957c478bd9Sstevel@tonic-gate */ 16967c478bd9Sstevel@tonic-gate zlogp = &errlog; 16977c478bd9Sstevel@tonic-gate 16987c478bd9Sstevel@tonic-gate /* 16997c478bd9Sstevel@tonic-gate * Process options. 17007c478bd9Sstevel@tonic-gate */ 1701108322fbScarlsonj while ((opt = getopt(argc, argv, "R:z:")) != EOF) { 17027c478bd9Sstevel@tonic-gate switch (opt) { 1703108322fbScarlsonj case 'R': 1704108322fbScarlsonj zonecfg_set_root(optarg); 1705108322fbScarlsonj break; 17067c478bd9Sstevel@tonic-gate case 'z': 17077c478bd9Sstevel@tonic-gate zone_name = optarg; 17087c478bd9Sstevel@tonic-gate break; 17097c478bd9Sstevel@tonic-gate default: 17107c478bd9Sstevel@tonic-gate usage(); 17117c478bd9Sstevel@tonic-gate } 17127c478bd9Sstevel@tonic-gate } 17137c478bd9Sstevel@tonic-gate 17147c478bd9Sstevel@tonic-gate if (zone_name == NULL) 17157c478bd9Sstevel@tonic-gate usage(); 17167c478bd9Sstevel@tonic-gate 17177c478bd9Sstevel@tonic-gate /* 17187c478bd9Sstevel@tonic-gate * Because usage() prints directly to stderr, it has gettext() 17197c478bd9Sstevel@tonic-gate * wrapping, which depends on the locale. But since zerror() calls 17207c478bd9Sstevel@tonic-gate * localize() which tweaks the locale, it is not safe to call zerror() 17217c478bd9Sstevel@tonic-gate * until after the last call to usage(). Fortunately, the last call 17227c478bd9Sstevel@tonic-gate * to usage() is just above and the first call to zerror() is just 17237c478bd9Sstevel@tonic-gate * below. Don't mess this up. 17247c478bd9Sstevel@tonic-gate */ 17257c478bd9Sstevel@tonic-gate if (strcmp(zone_name, GLOBAL_ZONENAME) == 0) { 17267c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "cannot manage the %s zone", 17277c478bd9Sstevel@tonic-gate GLOBAL_ZONENAME); 17287c478bd9Sstevel@tonic-gate return (1); 17297c478bd9Sstevel@tonic-gate } 17307c478bd9Sstevel@tonic-gate 17317c478bd9Sstevel@tonic-gate if (zone_get_id(zone_name, &zid) != 0) { 17323f2f09c1Sdp zerror(zlogp, B_FALSE, "could not manage %s: %s", zone_name, 17337c478bd9Sstevel@tonic-gate zonecfg_strerror(Z_NO_ZONE)); 17347c478bd9Sstevel@tonic-gate return (1); 17357c478bd9Sstevel@tonic-gate } 17367c478bd9Sstevel@tonic-gate 17377c478bd9Sstevel@tonic-gate if ((err = zone_get_state(zone_name, &zstate)) != Z_OK) { 17383f2f09c1Sdp zerror(zlogp, B_FALSE, "failed to get zone state: %s", 17397c478bd9Sstevel@tonic-gate zonecfg_strerror(err)); 17407c478bd9Sstevel@tonic-gate return (1); 17417c478bd9Sstevel@tonic-gate } 17429acbbeafSnn35248 if (zstate < ZONE_STATE_INCOMPLETE) { 17437c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, 17447c478bd9Sstevel@tonic-gate "cannot manage a zone which is in state '%s'", 17457c478bd9Sstevel@tonic-gate zone_state_str(zstate)); 17467c478bd9Sstevel@tonic-gate return (1); 17477c478bd9Sstevel@tonic-gate } 17487c478bd9Sstevel@tonic-gate 17499acbbeafSnn35248 /* Get a handle to the brand info for this zone */ 17509acbbeafSnn35248 if ((zone_get_brand(zone_name, brand_name, sizeof (brand_name)) 1751123807fbSedp != Z_OK) || (bh = brand_open(brand_name)) == NULL) { 17529acbbeafSnn35248 zerror(zlogp, B_FALSE, "unable to determine zone brand"); 17539acbbeafSnn35248 return (1); 17549acbbeafSnn35248 } 1755123807fbSedp zone_isnative = brand_is_native(bh); 175684561e8cStd153743 zone_iscluster = (strcmp(brand_name, CLUSTER_BRAND_NAME) == 0); 17579a5d73e0SRic Aleshire zone_islabeled = (strcmp(brand_name, LABELED_BRAND_NAME) == 0); 1758c5cd6260S 1759c5cd6260S /* Get state change brand hooks. */ 1760c5cd6260S if (brand_callback_init(bh, zone_name) == -1) { 1761c5cd6260S zerror(zlogp, B_TRUE, 1762c5cd6260S "failed to initialize brand state change hooks"); 1763c5cd6260S brand_close(bh); 1764c5cd6260S return (1); 1765c5cd6260S } 1766c5cd6260S 1767123807fbSedp brand_close(bh); 17689acbbeafSnn35248 17697c478bd9Sstevel@tonic-gate /* 17707c478bd9Sstevel@tonic-gate * Check that we have all privileges. It would be nice to pare 17717c478bd9Sstevel@tonic-gate * this down, but this is at least a first cut. 17727c478bd9Sstevel@tonic-gate */ 17737c478bd9Sstevel@tonic-gate if ((privset = priv_allocset()) == NULL) { 17747c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "%s failed", "priv_allocset"); 17757c478bd9Sstevel@tonic-gate return (1); 17767c478bd9Sstevel@tonic-gate } 17777c478bd9Sstevel@tonic-gate 17787c478bd9Sstevel@tonic-gate if (getppriv(PRIV_EFFECTIVE, privset) != 0) { 17797c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "%s failed", "getppriv"); 17807c478bd9Sstevel@tonic-gate priv_freeset(privset); 17817c478bd9Sstevel@tonic-gate return (1); 17827c478bd9Sstevel@tonic-gate } 17837c478bd9Sstevel@tonic-gate 17847c478bd9Sstevel@tonic-gate if (priv_isfullset(privset) == B_FALSE) { 17857c478bd9Sstevel@tonic-gate zerror(zlogp, B_FALSE, "You lack sufficient privilege to " 17863f2f09c1Sdp "run this command (all privs required)"); 17877c478bd9Sstevel@tonic-gate priv_freeset(privset); 17887c478bd9Sstevel@tonic-gate return (1); 17897c478bd9Sstevel@tonic-gate } 17907c478bd9Sstevel@tonic-gate priv_freeset(privset); 17917c478bd9Sstevel@tonic-gate 17927c478bd9Sstevel@tonic-gate if (mkzonedir(zlogp) != 0) 17937c478bd9Sstevel@tonic-gate return (1); 17947c478bd9Sstevel@tonic-gate 17957c478bd9Sstevel@tonic-gate /* 17967c478bd9Sstevel@tonic-gate * Pre-fork: setup shared state 17977c478bd9Sstevel@tonic-gate */ 17987c478bd9Sstevel@tonic-gate if ((shstate = (void *)mmap(NULL, shstatelen, 17997c478bd9Sstevel@tonic-gate PROT_READ|PROT_WRITE, MAP_SHARED|MAP_ANON, -1, (off_t)0)) == 18007c478bd9Sstevel@tonic-gate MAP_FAILED) { 18017c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "%s failed", "mmap"); 18027c478bd9Sstevel@tonic-gate return (1); 18037c478bd9Sstevel@tonic-gate } 18047c478bd9Sstevel@tonic-gate if (sema_init(&shstate->sem, 0, USYNC_PROCESS, NULL) != 0) { 18057c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "%s failed", "sema_init()"); 18067c478bd9Sstevel@tonic-gate (void) munmap((char *)shstate, shstatelen); 18077c478bd9Sstevel@tonic-gate return (1); 18087c478bd9Sstevel@tonic-gate } 18097c478bd9Sstevel@tonic-gate shstate->log.logfile = NULL; 18107c478bd9Sstevel@tonic-gate shstate->log.buflen = shstatelen - sizeof (*shstate); 18117c478bd9Sstevel@tonic-gate shstate->log.loglen = shstate->log.buflen; 18127c478bd9Sstevel@tonic-gate shstate->log.buf = (char *)shstate + sizeof (*shstate); 18137c478bd9Sstevel@tonic-gate shstate->log.log = shstate->log.buf; 18147c478bd9Sstevel@tonic-gate shstate->log.locale = parents_locale; 18157c478bd9Sstevel@tonic-gate shstate->status = -1; 18167c478bd9Sstevel@tonic-gate 18177c478bd9Sstevel@tonic-gate /* 18187c478bd9Sstevel@tonic-gate * We need a SIGCHLD handler so the sema_wait() below will wake 18197c478bd9Sstevel@tonic-gate * up if the child dies without doing a sema_post(). 18207c478bd9Sstevel@tonic-gate */ 18217c478bd9Sstevel@tonic-gate (void) sigset(SIGCHLD, sigchld); 18227c478bd9Sstevel@tonic-gate /* 18237c478bd9Sstevel@tonic-gate * We must mask SIGCHLD until after we've coped with the fork 18247c478bd9Sstevel@tonic-gate * sufficiently to deal with it; otherwise we can race and 18257c478bd9Sstevel@tonic-gate * receive the signal before pid has been initialized 18267c478bd9Sstevel@tonic-gate * (yes, this really happens). 18277c478bd9Sstevel@tonic-gate */ 18287c478bd9Sstevel@tonic-gate (void) sigemptyset(&block_cld); 18297c478bd9Sstevel@tonic-gate (void) sigaddset(&block_cld, SIGCHLD); 18307c478bd9Sstevel@tonic-gate (void) sigprocmask(SIG_BLOCK, &block_cld, NULL); 18317c478bd9Sstevel@tonic-gate 18325cb4571dSdp if ((ctfd = init_template()) == -1) { 18335cb4571dSdp zerror(zlogp, B_TRUE, "failed to create contract"); 18345cb4571dSdp return (1); 18355cb4571dSdp } 18365cb4571dSdp 18377c478bd9Sstevel@tonic-gate /* 18387c478bd9Sstevel@tonic-gate * Do not let another thread localize a message while we are forking. 18397c478bd9Sstevel@tonic-gate */ 18407c478bd9Sstevel@tonic-gate (void) mutex_lock(&msglock); 18417c478bd9Sstevel@tonic-gate pid = fork(); 18427c478bd9Sstevel@tonic-gate (void) mutex_unlock(&msglock); 18435cb4571dSdp 18445cb4571dSdp /* 18455cb4571dSdp * In all cases (parent, child, and in the event of an error) we 18465cb4571dSdp * don't want to cause creation of contracts on subsequent fork()s. 18475cb4571dSdp */ 18485cb4571dSdp (void) ct_tmpl_clear(ctfd); 18495cb4571dSdp (void) close(ctfd); 18505cb4571dSdp 18517c478bd9Sstevel@tonic-gate if (pid == -1) { 18527c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "could not fork"); 18537c478bd9Sstevel@tonic-gate return (1); 18547c478bd9Sstevel@tonic-gate 18557c478bd9Sstevel@tonic-gate } else if (pid > 0) { /* parent */ 18567c478bd9Sstevel@tonic-gate (void) sigprocmask(SIG_UNBLOCK, &block_cld, NULL); 18577c478bd9Sstevel@tonic-gate /* 18587c478bd9Sstevel@tonic-gate * This marks a window of vulnerability in which we receive 18597c478bd9Sstevel@tonic-gate * the SIGCLD before falling into sema_wait (normally we would 18607c478bd9Sstevel@tonic-gate * get woken up from sema_wait with EINTR upon receipt of 18617c478bd9Sstevel@tonic-gate * SIGCLD). So we may need to use some other scheme like 18627c478bd9Sstevel@tonic-gate * sema_posting in the sigcld handler. 18637c478bd9Sstevel@tonic-gate * blech 18647c478bd9Sstevel@tonic-gate */ 18657c478bd9Sstevel@tonic-gate (void) sema_wait(&shstate->sem); 18667c478bd9Sstevel@tonic-gate (void) sema_destroy(&shstate->sem); 18677c478bd9Sstevel@tonic-gate if (shstate->status != 0) 18687c478bd9Sstevel@tonic-gate (void) waitpid(pid, NULL, WNOHANG); 18697c478bd9Sstevel@tonic-gate /* 18707c478bd9Sstevel@tonic-gate * It's ok if we die with SIGPIPE. It's not like we could have 18717c478bd9Sstevel@tonic-gate * done anything about it. 18727c478bd9Sstevel@tonic-gate */ 18737c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "%s", shstate->log.buf); 18747c478bd9Sstevel@tonic-gate _exit(shstate->status == 0 ? 0 : 1); 18757c478bd9Sstevel@tonic-gate } 18767c478bd9Sstevel@tonic-gate 18777c478bd9Sstevel@tonic-gate /* 18787c478bd9Sstevel@tonic-gate * The child charges on. 18797c478bd9Sstevel@tonic-gate */ 18807c478bd9Sstevel@tonic-gate (void) sigset(SIGCHLD, SIG_DFL); 18817c478bd9Sstevel@tonic-gate (void) sigprocmask(SIG_UNBLOCK, &block_cld, NULL); 18827c478bd9Sstevel@tonic-gate 18837c478bd9Sstevel@tonic-gate /* 18847c478bd9Sstevel@tonic-gate * SIGPIPE can be delivered if we write to a socket for which the 18857c478bd9Sstevel@tonic-gate * peer endpoint is gone. That can lead to too-early termination 18867c478bd9Sstevel@tonic-gate * of zoneadmd, and that's not good eats. 18877c478bd9Sstevel@tonic-gate */ 18887c478bd9Sstevel@tonic-gate (void) sigset(SIGPIPE, SIG_IGN); 18897c478bd9Sstevel@tonic-gate /* 18907c478bd9Sstevel@tonic-gate * Stop using stderr 18917c478bd9Sstevel@tonic-gate */ 18927c478bd9Sstevel@tonic-gate zlogp = &shstate->log; 18937c478bd9Sstevel@tonic-gate 18947c478bd9Sstevel@tonic-gate /* 18957c478bd9Sstevel@tonic-gate * We don't need stdout/stderr from now on. 18967c478bd9Sstevel@tonic-gate */ 18977c478bd9Sstevel@tonic-gate closefrom(0); 18987c478bd9Sstevel@tonic-gate 18997c478bd9Sstevel@tonic-gate /* 19007c478bd9Sstevel@tonic-gate * Initialize the syslog zlog_t. This needs to be done after 19017c478bd9Sstevel@tonic-gate * the call to closefrom(). 19027c478bd9Sstevel@tonic-gate */ 19037c478bd9Sstevel@tonic-gate logsys.buf = logsys.log = NULL; 19047c478bd9Sstevel@tonic-gate logsys.buflen = logsys.loglen = 0; 19057c478bd9Sstevel@tonic-gate logsys.logfile = NULL; 19067c478bd9Sstevel@tonic-gate logsys.locale = DEFAULT_LOCALE; 19077c478bd9Sstevel@tonic-gate 19087c478bd9Sstevel@tonic-gate openlog("zoneadmd", LOG_PID, LOG_DAEMON); 19097c478bd9Sstevel@tonic-gate 19107c478bd9Sstevel@tonic-gate /* 19117c478bd9Sstevel@tonic-gate * The eventstream is used to publish state changes in the zone 19127c478bd9Sstevel@tonic-gate * from the door threads to the console I/O poller. 19137c478bd9Sstevel@tonic-gate */ 19147c478bd9Sstevel@tonic-gate if (eventstream_init() == -1) { 19157c478bd9Sstevel@tonic-gate zerror(zlogp, B_TRUE, "unable to create eventstream"); 19167c478bd9Sstevel@tonic-gate goto child_out; 19177c478bd9Sstevel@tonic-gate } 19187c478bd9Sstevel@tonic-gate 19197c478bd9Sstevel@tonic-gate (void) snprintf(zone_door_path, sizeof (zone_door_path), 1920108322fbScarlsonj "%s" ZONE_DOOR_PATH, zonecfg_get_root(), zone_name); 19217c478bd9Sstevel@tonic-gate 19227c478bd9Sstevel@tonic-gate /* 19237c478bd9Sstevel@tonic-gate * See if another zoneadmd is running for this zone. If not, then we 19247c478bd9Sstevel@tonic-gate * can now modify system state. 19257c478bd9Sstevel@tonic-gate */ 19267c478bd9Sstevel@tonic-gate if (make_daemon_exclusive(zlogp) == -1) 19277c478bd9Sstevel@tonic-gate goto child_out; 19287c478bd9Sstevel@tonic-gate 19297c478bd9Sstevel@tonic-gate 19307c478bd9Sstevel@tonic-gate /* 19317c478bd9Sstevel@tonic-gate * Create/join a new session; we need to be careful of what we do with 19327c478bd9Sstevel@tonic-gate * the console from now on so we don't end up being the session leader 19337c478bd9Sstevel@tonic-gate * for the terminal we're going to be handing out. 19347c478bd9Sstevel@tonic-gate */ 19357c478bd9Sstevel@tonic-gate (void) setsid(); 19367c478bd9Sstevel@tonic-gate 19377c478bd9Sstevel@tonic-gate /* 19387c478bd9Sstevel@tonic-gate * This thread shouldn't be receiving any signals; in particular, 19397c478bd9Sstevel@tonic-gate * SIGCHLD should be received by the thread doing the fork(). 19407c478bd9Sstevel@tonic-gate */ 19417c478bd9Sstevel@tonic-gate (void) sigfillset(&blockset); 19427c478bd9Sstevel@tonic-gate (void) thr_sigsetmask(SIG_BLOCK, &blockset, NULL); 19437c478bd9Sstevel@tonic-gate 19447c478bd9Sstevel@tonic-gate /* 19457c478bd9Sstevel@tonic-gate * Setup the console device and get ready to serve the console; 19467c478bd9Sstevel@tonic-gate * once this has completed, we're ready to let console clients 19477c478bd9Sstevel@tonic-gate * make an attempt to connect (they will block until 19487c478bd9Sstevel@tonic-gate * serve_console_sock() below gets called, and any pending 19497c478bd9Sstevel@tonic-gate * connection is accept()ed). 19507c478bd9Sstevel@tonic-gate */ 19519d5056eaSjv227347 if (!zonecfg_in_alt_root() && init_console(zlogp) < 0) 19527c478bd9Sstevel@tonic-gate goto child_out; 19537c478bd9Sstevel@tonic-gate 19547c478bd9Sstevel@tonic-gate /* 19557c478bd9Sstevel@tonic-gate * Take the lock now, so that when the door server gets going, we 19567c478bd9Sstevel@tonic-gate * are guaranteed that it won't take a request until we are sure 19577c478bd9Sstevel@tonic-gate * that everything is completely set up. See the child_out: label 19587c478bd9Sstevel@tonic-gate * below to see why this matters. 19597c478bd9Sstevel@tonic-gate */ 19607c478bd9Sstevel@tonic-gate (void) mutex_lock(&lock); 19617c478bd9Sstevel@tonic-gate 1962108322fbScarlsonj /* Init semaphore for scratch zones. */ 1963108322fbScarlsonj if (sema_init(&scratch_sem, 0, USYNC_THREAD, NULL) == -1) { 1964108322fbScarlsonj zerror(zlogp, B_TRUE, 1965108322fbScarlsonj "failed to initialize semaphore for scratch zone"); 1966108322fbScarlsonj goto child_out; 1967108322fbScarlsonj } 1968108322fbScarlsonj 19694ac67f02SAnurag S. Maskey /* open the dladm handle */ 19704ac67f02SAnurag S. Maskey if (dladm_open(&dld_handle) != DLADM_STATUS_OK) { 19714ac67f02SAnurag S. Maskey zerror(zlogp, B_FALSE, "failed to open dladm handle"); 19724ac67f02SAnurag S. Maskey goto child_out; 19734ac67f02SAnurag S. Maskey } 19744ac67f02SAnurag S. Maskey 19757c478bd9Sstevel@tonic-gate /* 19767c478bd9Sstevel@tonic-gate * Note: door setup must occur *after* the console is setup. 19777c478bd9Sstevel@tonic-gate * This is so that as zlogin tests the door to see if zoneadmd 19787c478bd9Sstevel@tonic-gate * is ready yet, we know that the console will get serviced 19797c478bd9Sstevel@tonic-gate * once door_info() indicates that the door is "up". 19807c478bd9Sstevel@tonic-gate */ 19817c478bd9Sstevel@tonic-gate if (setup_door(zlogp) == -1) 19827c478bd9Sstevel@tonic-gate goto child_out; 19837c478bd9Sstevel@tonic-gate 19847c478bd9Sstevel@tonic-gate /* 19857c478bd9Sstevel@tonic-gate * Things seem OK so far; tell the parent process that we're done 19867c478bd9Sstevel@tonic-gate * with setup tasks. This will cause the parent to exit, signalling 19877c478bd9Sstevel@tonic-gate * to zoneadm, zlogin, or whatever forked it that we are ready to 19887c478bd9Sstevel@tonic-gate * service requests. 19897c478bd9Sstevel@tonic-gate */ 19907c478bd9Sstevel@tonic-gate shstate->status = 0; 19917c478bd9Sstevel@tonic-gate (void) sema_post(&shstate->sem); 19927c478bd9Sstevel@tonic-gate (void) munmap((char *)shstate, shstatelen); 19937c478bd9Sstevel@tonic-gate shstate = NULL; 19947c478bd9Sstevel@tonic-gate 19957c478bd9Sstevel@tonic-gate (void) mutex_unlock(&lock); 19967c478bd9Sstevel@tonic-gate 19977c478bd9Sstevel@tonic-gate /* 19987c478bd9Sstevel@tonic-gate * zlogp is now invalid, so reset it to the syslog logger. 19997c478bd9Sstevel@tonic-gate */ 20007c478bd9Sstevel@tonic-gate zlogp = &logsys; 20017c478bd9Sstevel@tonic-gate 20027c478bd9Sstevel@tonic-gate /* 20037c478bd9Sstevel@tonic-gate * Now that we are free of any parents, switch to the default locale. 20047c478bd9Sstevel@tonic-gate */ 20057c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, DEFAULT_LOCALE); 20067c478bd9Sstevel@tonic-gate 20077c478bd9Sstevel@tonic-gate /* 20087c478bd9Sstevel@tonic-gate * At this point the setup portion of main() is basically done, so 20097c478bd9Sstevel@tonic-gate * we reuse this thread to manage the zone console. When 20107c478bd9Sstevel@tonic-gate * serve_console() has returned, we are past the point of no return 20117c478bd9Sstevel@tonic-gate * in the life of this zoneadmd. 20127c478bd9Sstevel@tonic-gate */ 2013108322fbScarlsonj if (zonecfg_in_alt_root()) { 2014108322fbScarlsonj /* 2015108322fbScarlsonj * This is just awful, but mounted scratch zones don't (and 2016108322fbScarlsonj * can't) have consoles. We just wait for unmount instead. 2017108322fbScarlsonj */ 2018108322fbScarlsonj while (sema_wait(&scratch_sem) == EINTR) 2019108322fbScarlsonj ; 2020108322fbScarlsonj } else { 20217c478bd9Sstevel@tonic-gate serve_console(zlogp); 20227c478bd9Sstevel@tonic-gate assert(in_death_throes); 2023108322fbScarlsonj } 20247c478bd9Sstevel@tonic-gate 20257c478bd9Sstevel@tonic-gate /* 20267c478bd9Sstevel@tonic-gate * This is the next-to-last part of the exit interlock. Upon calling 20277c478bd9Sstevel@tonic-gate * fdetach(), the door will go unreferenced; once any 20287c478bd9Sstevel@tonic-gate * outstanding requests (like the door thread doing Z_HALT) are 20297c478bd9Sstevel@tonic-gate * done, the door will get an UNREF notification; when it handles 20307c478bd9Sstevel@tonic-gate * the UNREF, the door server will cause the exit. 20317c478bd9Sstevel@tonic-gate */ 20327c478bd9Sstevel@tonic-gate assert(!MUTEX_HELD(&lock)); 20337c478bd9Sstevel@tonic-gate (void) fdetach(zone_door_path); 20344ac67f02SAnurag S. Maskey 20357c478bd9Sstevel@tonic-gate for (;;) 20367c478bd9Sstevel@tonic-gate (void) pause(); 20377c478bd9Sstevel@tonic-gate 20387c478bd9Sstevel@tonic-gate child_out: 20397c478bd9Sstevel@tonic-gate assert(pid == 0); 20407c478bd9Sstevel@tonic-gate if (shstate != NULL) { 20417c478bd9Sstevel@tonic-gate shstate->status = -1; 20427c478bd9Sstevel@tonic-gate (void) sema_post(&shstate->sem); 20437c478bd9Sstevel@tonic-gate (void) munmap((char *)shstate, shstatelen); 20447c478bd9Sstevel@tonic-gate } 20457c478bd9Sstevel@tonic-gate 20467c478bd9Sstevel@tonic-gate /* 20477c478bd9Sstevel@tonic-gate * This might trigger an unref notification, but if so, 20487c478bd9Sstevel@tonic-gate * we are still holding the lock, so our call to exit will 20497c478bd9Sstevel@tonic-gate * ultimately win the race and will publish the right exit 20507c478bd9Sstevel@tonic-gate * code. 20517c478bd9Sstevel@tonic-gate */ 20527c478bd9Sstevel@tonic-gate if (zone_door != -1) { 20537c478bd9Sstevel@tonic-gate assert(MUTEX_HELD(&lock)); 20547c478bd9Sstevel@tonic-gate (void) door_revoke(zone_door); 20557c478bd9Sstevel@tonic-gate (void) fdetach(zone_door_path); 20567c478bd9Sstevel@tonic-gate } 20574ac67f02SAnurag S. Maskey 20584ac67f02SAnurag S. Maskey if (dld_handle != NULL) 20594ac67f02SAnurag S. Maskey dladm_close(dld_handle); 20604ac67f02SAnurag S. Maskey 20617c478bd9Sstevel@tonic-gate return (1); /* return from main() forcibly exits an MT process */ 20627c478bd9Sstevel@tonic-gate } 2063