xref: /titanic_50/usr/src/uts/common/contract/process.c (revision 10d63b7db37a83b39c7f511cf9426c9d03ea0760)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #include <sys/mutex.h>
27 #include <sys/debug.h>
28 #include <sys/types.h>
29 #include <sys/param.h>
30 #include <sys/kmem.h>
31 #include <sys/thread.h>
32 #include <sys/id_space.h>
33 #include <sys/avl.h>
34 #include <sys/list.h>
35 #include <sys/sysmacros.h>
36 #include <sys/proc.h>
37 #include <sys/contract.h>
38 #include <sys/contract_impl.h>
39 #include <sys/contract/process.h>
40 #include <sys/contract/process_impl.h>
41 #include <sys/cmn_err.h>
42 #include <sys/nvpair.h>
43 #include <sys/policy.h>
44 #include <sys/refstr.h>
45 #include <sys/sunddi.h>
46 
47 /*
48  * Process Contracts
49  * -----------------
50  *
51  * Generally speaking, a process contract is a contract between a
52  * process and a set of its descendent processes.  In some cases, when
53  * the child processes outlive the author of the contract, the contract
54  * may be held by (and therefore be between the child processes and) a
55  * successor process which adopts the contract after the death of the
56  * original author.
57  *
58  * The process contract adds two new concepts to the Solaris process
59  * model.  The first is that a process contract forms a rigid fault
60  * boundary around a set of processes.  Hardware, software, and even
61  * administrator errors impacting a process in a process contract
62  * generate specific events and can be requested to atomically shutdown
63  * all processes in the contract.  The second is that a process
64  * contract is a process collective whose leader is not a member of the
65  * collective.  This means that the leader can reliably react to events
66  * in the collective, and may also act upon the collective without
67  * special casing itself.
68  *
69  * A composite outcome of these two concepts is that we can now create
70  * a tree of process contracts, rooted at init(1M), which represent
71  * services and subservices that are reliably observed and can be
72  * restarted when fatal errors occur.  The service management framework
73  * (SMF) realizes this structure.
74  *
75  * For more details, see the "restart agreements" case, PSARC 2003/193.
76  *
77  * There are four sets of routines in this file: the process contract
78  * standard template operations, the process contract standard contract
79  * operations, a couple routines used only by the contract subsystem to
80  * handle process contracts' unique role as a temporary holder of
81  * abandoned contracts, and the interfaces which allow the system to
82  * create and act upon process contracts.  The first two are defined by
83  * the contracts framework and won't be discussed further.  As for the
84  * remaining two:
85  *
86  * Special framework interfaces
87  * ----------------------------
88  *
89  * contract_process_accept - determines if a process contract is a
90  *   regent, i.e. if it can inherit other contracts.
91  *
92  * contract_process_take - tells a regent process contract to inherit
93  *   an abandoned contract
94  *
95  * contract_process_adopt - tells a regent process contract that a
96  *   contract it has inherited is being adopted by a process.
97  *
98  * Process contract interfaces
99  * ---------------------------
100  *
101  * contract_process_fork - called when a process is created; adds the
102  *   new process to an existing contract or to a newly created one.
103  *
104  * contract_process_exit - called when a process exits
105  *
106  * contract_process_core - called when a process would have dumped core
107  *   (even if a core file wasn't generated)
108  *
109  * contract_process_hwerr - called when a process was killed because of
110  *   an uncorrectable hardware error
111  *
112  * contract_process_sig - called when a process was killed by a fatal
113  *   signal sent by a process in another process contract
114  *
115  */
116 
117 ct_type_t *process_type;
118 ctmpl_process_t *sys_process_tmpl;
119 refstr_t *conp_svc_aux_default;
120 
121 /*
122  * Macro predicates for determining when events should be sent and how.
123  */
124 #define	EVSENDP(ctp, flag) \
125 	((ctp->conp_contract.ct_ev_info | ctp->conp_contract.ct_ev_crit) & flag)
126 
127 #define	EVINFOP(ctp, flag) \
128 	((ctp->conp_contract.ct_ev_crit & flag) == 0)
129 
130 #define	EVFATALP(ctp, flag) \
131 	(ctp->conp_ev_fatal & flag)
132 
133 
134 /*
135  * Process contract template implementation
136  */
137 
138 /*
139  * ctmpl_process_dup
140  *
141  * The process contract template dup entry point.  Other than the
142  * to-be-subsumed contract, which must be held, this simply copies all
143  * the fields of the original.
144  */
145 static struct ct_template *
146 ctmpl_process_dup(struct ct_template *template)
147 {
148 	ctmpl_process_t *new;
149 	ctmpl_process_t *old = template->ctmpl_data;
150 
151 	new = kmem_alloc(sizeof (ctmpl_process_t), KM_SLEEP);
152 
153 	ctmpl_copy(&new->ctp_ctmpl, template);
154 	new->ctp_ctmpl.ctmpl_data = new;
155 
156 	new->ctp_subsume = old->ctp_subsume;
157 	if (new->ctp_subsume)
158 		contract_hold(new->ctp_subsume);
159 	new->ctp_params = old->ctp_params;
160 	new->ctp_ev_fatal = old->ctp_ev_fatal;
161 	new->ctp_svc_fmri = old->ctp_svc_fmri;
162 	if (new->ctp_svc_fmri != NULL) {
163 		refstr_hold(new->ctp_svc_fmri);
164 	}
165 	new->ctp_svc_aux = old->ctp_svc_aux;
166 	if (new->ctp_svc_aux != NULL) {
167 		refstr_hold(new->ctp_svc_aux);
168 	}
169 
170 	return (&new->ctp_ctmpl);
171 }
172 
173 /*
174  * ctmpl_process_free
175  *
176  * The process contract template free entry point.  Just releases a
177  * to-be-subsumed contract and frees the template.
178  */
179 static void
180 ctmpl_process_free(struct ct_template *template)
181 {
182 	ctmpl_process_t *ctp = template->ctmpl_data;
183 
184 	if (ctp->ctp_subsume)
185 		contract_rele(ctp->ctp_subsume);
186 	if (ctp->ctp_svc_fmri != NULL) {
187 		refstr_rele(ctp->ctp_svc_fmri);
188 	}
189 	if (ctp->ctp_svc_aux != NULL) {
190 		refstr_rele(ctp->ctp_svc_aux);
191 	}
192 	kmem_free(template, sizeof (ctmpl_process_t));
193 }
194 
195 /*
196  * SAFE_EV is the set of events which a non-privileged process is
197  * allowed to make critical but not fatal or if the PGRPONLY parameter
198  * is set.  EXCESS tells us if "value", a critical event set, requires
199  * additional privilege given the template "ctp".
200  */
201 #define	SAFE_EV			(CT_PR_EV_EMPTY)
202 #define	EXCESS(ctp, value)	\
203 	(((value) & ~((ctp)->ctp_ev_fatal | SAFE_EV)) || \
204 	(((value) & ~SAFE_EV) && (ctp->ctp_params & CT_PR_PGRPONLY)))
205 
206 /*
207  * ctmpl_process_set
208  *
209  * The process contract template set entry point.  None of the terms
210  * may be unconditionally set, and setting the parameters or fatal
211  * event set may result in events being implicitly removed from to the
212  * critical event set and added to the informative event set.  The
213  * (admittedly subtle) reason we implicitly change the critical event
214  * set when the parameter or fatal event set is modified but not the
215  * other way around is because a change to the critical event set only
216  * affects the contract's owner, whereas a change to the parameter set
217  * and fatal set can affect the execution of the application running in
218  * the contract (and should therefore be only made explicitly).  We
219  * allow implicit changes at all so that setting contract terms doesn't
220  * become a complex dance dependent on the template's initial state and
221  * the desired terms.
222  */
223 static int
224 ctmpl_process_set(struct ct_template *tmpl, ct_kparam_t *kparam,
225     const cred_t *cr)
226 {
227 	ctmpl_process_t *ctp = tmpl->ctmpl_data;
228 	ct_param_t *param = &kparam->param;
229 	contract_t *ct;
230 	int error;
231 	uint64_t param_value;
232 	char *str_value;
233 
234 	if ((param->ctpm_id == CTPP_SVC_FMRI) ||
235 	    (param->ctpm_id == CTPP_CREATOR_AUX)) {
236 		str_value = (char *)kparam->ctpm_kbuf;
237 		str_value[param->ctpm_size - 1] = '\0';
238 	} else {
239 		if (param->ctpm_size < sizeof (uint64_t))
240 			return (EINVAL);
241 		param_value = *(uint64_t *)kparam->ctpm_kbuf;
242 		/*
243 		 * No process contract parameters are > 32 bits.
244 		 * Unless it is a string.
245 		 */
246 		if (param_value & ~UINT32_MAX)
247 			return (EINVAL);
248 	}
249 
250 	switch (param->ctpm_id) {
251 	case CTPP_SUBSUME:
252 		if (param_value != 0) {
253 			/*
254 			 * Ensure that the contract exists, that we
255 			 * hold the contract, and that the contract is
256 			 * empty.
257 			 */
258 			ct = contract_type_ptr(process_type, param_value,
259 			    curproc->p_zone->zone_uniqid);
260 			if (ct == NULL)
261 				return (ESRCH);
262 			if (ct->ct_owner != curproc) {
263 				contract_rele(ct);
264 				return (EACCES);
265 			}
266 			if (((cont_process_t *)ct->ct_data)->conp_nmembers) {
267 				contract_rele(ct);
268 				return (ENOTEMPTY);
269 			}
270 		} else {
271 			ct = NULL;
272 		}
273 		if (ctp->ctp_subsume)
274 			contract_rele(ctp->ctp_subsume);
275 		ctp->ctp_subsume = ct;
276 		break;
277 	case CTPP_PARAMS:
278 		if (param_value & ~CT_PR_ALLPARAM)
279 			return (EINVAL);
280 		ctp->ctp_params = param_value;
281 		/*
282 		 * If an unprivileged process requests that
283 		 * CT_PR_PGRPONLY be set, remove any unsafe events from
284 		 * the critical event set and add them to the
285 		 * informative event set.
286 		 */
287 		if ((ctp->ctp_params & CT_PR_PGRPONLY) &&
288 		    EXCESS(ctp, tmpl->ctmpl_ev_crit) &&
289 		    !secpolicy_contract_event_choice(cr)) {
290 			tmpl->ctmpl_ev_info |= (tmpl->ctmpl_ev_crit & ~SAFE_EV);
291 			tmpl->ctmpl_ev_crit &= SAFE_EV;
292 		}
293 
294 		break;
295 	case CTPP_SVC_FMRI:
296 		if (error = secpolicy_contract_identity(cr))
297 			return (error);
298 		if (ctp->ctp_svc_fmri != NULL)
299 			refstr_rele(ctp->ctp_svc_fmri);
300 		if (strcmp(CT_PR_SVC_DEFAULT, str_value) == 0)
301 			ctp->ctp_svc_fmri = NULL;
302 		else
303 			ctp->ctp_svc_fmri =
304 			    refstr_alloc(str_value);
305 		break;
306 	case CTPP_CREATOR_AUX:
307 		if (ctp->ctp_svc_aux != NULL)
308 			refstr_rele(ctp->ctp_svc_aux);
309 		if (param->ctpm_size == 1) /* empty string */
310 			ctp->ctp_svc_aux = NULL;
311 		else
312 			ctp->ctp_svc_aux =
313 			    refstr_alloc(str_value);
314 		break;
315 	case CTP_EV_CRITICAL:
316 		/*
317 		 * We simply don't allow adding events to the critical
318 		 * event set which aren't permitted by our policy or by
319 		 * privilege.
320 		 */
321 		if (EXCESS(ctp, param_value) &&
322 		    (error = secpolicy_contract_event(cr)) != 0)
323 			return (error);
324 		tmpl->ctmpl_ev_crit = param_value;
325 		break;
326 	case CTPP_EV_FATAL:
327 		if (param_value & ~CT_PR_ALLFATAL)
328 			return (EINVAL);
329 		ctp->ctp_ev_fatal = param_value;
330 		/*
331 		 * Check to see if an unprivileged process is
332 		 * requesting that events be removed from the fatal
333 		 * event set which are still in the critical event set.
334 		 */
335 		if (EXCESS(ctp, tmpl->ctmpl_ev_crit) &&
336 		    !secpolicy_contract_event_choice(cr)) {
337 			int allowed =
338 			    SAFE_EV | (ctp->ctp_params & CT_PR_PGRPONLY) ?
339 			    0 : ctp->ctp_ev_fatal;
340 			tmpl->ctmpl_ev_info |= (tmpl->ctmpl_ev_crit & ~allowed);
341 			tmpl->ctmpl_ev_crit &= allowed;
342 		}
343 		break;
344 	default:
345 		return (EINVAL);
346 	}
347 
348 	return (0);
349 }
350 
351 /*
352  * ctmpl_process_get
353  *
354  * The process contract template get entry point.  Simply fetches and
355  * returns the requested term.
356  */
357 static int
358 ctmpl_process_get(struct ct_template *template, ct_kparam_t *kparam)
359 {
360 	ctmpl_process_t *ctp = template->ctmpl_data;
361 	ct_param_t *param = &kparam->param;
362 	uint64_t *param_value = kparam->ctpm_kbuf;
363 
364 	if (param->ctpm_id == CTPP_SUBSUME ||
365 	    param->ctpm_id == CTPP_PARAMS ||
366 	    param->ctpm_id == CTPP_EV_FATAL) {
367 		if (param->ctpm_size < sizeof (uint64_t))
368 			return (EINVAL);
369 		kparam->ret_size = sizeof (uint64_t);
370 	}
371 
372 	switch (param->ctpm_id) {
373 	case CTPP_SUBSUME:
374 		*param_value = ctp->ctp_subsume ?
375 		    ctp->ctp_subsume->ct_id : 0;
376 		break;
377 	case CTPP_PARAMS:
378 		*param_value = ctp->ctp_params;
379 		break;
380 	case CTPP_SVC_FMRI:
381 		if (ctp->ctp_svc_fmri == NULL) {
382 			kparam->ret_size =
383 			    strlcpy((char *)kparam->ctpm_kbuf,
384 			    CT_PR_SVC_DEFAULT, param->ctpm_size);
385 		} else {
386 			kparam->ret_size =
387 			    strlcpy((char *)kparam->ctpm_kbuf,
388 			    refstr_value(ctp->ctp_svc_fmri), param->ctpm_size);
389 		}
390 		kparam->ret_size++;
391 		break;
392 	case CTPP_CREATOR_AUX:
393 		if (ctp->ctp_svc_aux == NULL) {
394 			kparam->ret_size =
395 			    strlcpy((char *)kparam->ctpm_kbuf,
396 			    refstr_value(conp_svc_aux_default),
397 			    param->ctpm_size);
398 		} else {
399 			kparam->ret_size =
400 			    strlcpy((char *)kparam->ctpm_kbuf,
401 			    refstr_value(ctp->ctp_svc_aux), param->ctpm_size);
402 		}
403 		kparam->ret_size++;
404 		break;
405 	case CTPP_EV_FATAL:
406 		*param_value = ctp->ctp_ev_fatal;
407 		break;
408 	default:
409 		return (EINVAL);
410 	}
411 
412 	return (0);
413 }
414 
415 static ctmplops_t ctmpl_process_ops = {
416 	ctmpl_process_dup,		/* ctop_dup */
417 	ctmpl_process_free,		/* ctop_free */
418 	ctmpl_process_set,		/* ctop_set */
419 	ctmpl_process_get,		/* ctop_get */
420 	ctmpl_create_inval,		/* ctop_create */
421 	CT_PR_ALLEVENT
422 };
423 
424 
425 /*
426  * Process contract implementation
427  */
428 
429 /*
430  * ctmpl_process_default
431  *
432  * The process contract default template entry point.  Creates a
433  * process contract template with no parameters set, with informative
434  * core and signal events, critical empty and hwerr events, and fatal
435  * hwerr events.
436  */
437 static ct_template_t *
438 contract_process_default(void)
439 {
440 	ctmpl_process_t *new;
441 
442 	new = kmem_alloc(sizeof (ctmpl_process_t), KM_SLEEP);
443 	ctmpl_init(&new->ctp_ctmpl, &ctmpl_process_ops, process_type, new);
444 
445 	new->ctp_subsume = NULL;
446 	new->ctp_params = 0;
447 	new->ctp_ctmpl.ctmpl_ev_info = CT_PR_EV_CORE | CT_PR_EV_SIGNAL;
448 	new->ctp_ctmpl.ctmpl_ev_crit = CT_PR_EV_EMPTY | CT_PR_EV_HWERR;
449 	new->ctp_ev_fatal = CT_PR_EV_HWERR;
450 	new->ctp_svc_fmri = NULL;
451 	new->ctp_svc_aux = NULL;
452 
453 	return (&new->ctp_ctmpl);
454 }
455 
456 /*
457  * contract_process_free
458  *
459  * The process contract free entry point.
460  */
461 static void
462 contract_process_free(contract_t *ct)
463 {
464 	cont_process_t *ctp = ct->ct_data;
465 	crfree(ctp->conp_cred);
466 	list_destroy(&ctp->conp_members);
467 	list_destroy(&ctp->conp_inherited);
468 	if (ctp->conp_svc_fmri != NULL) {
469 		refstr_rele(ctp->conp_svc_fmri);
470 	}
471 	if (ctp->conp_svc_aux != NULL) {
472 		refstr_rele(ctp->conp_svc_aux);
473 	}
474 	if (ctp->conp_svc_creator != NULL) {
475 		refstr_rele(ctp->conp_svc_creator);
476 	}
477 	kmem_free(ctp, sizeof (cont_process_t));
478 }
479 
480 /*
481  * contract_process_cankill
482  *
483  * Determine if the contract author had or if the process generating
484  * the event, sp, has adequate privileges to kill process tp.
485  */
486 static int
487 contract_process_cankill(proc_t *tp, proc_t *sp, cont_process_t *ctp)
488 {
489 	int cankill;
490 
491 	mutex_enter(&tp->p_crlock);
492 	cankill = hasprocperm(tp->p_cred, ctp->conp_cred);
493 	mutex_exit(&tp->p_crlock);
494 	if (cankill || (sp && prochasprocperm(tp, sp, CRED())))
495 		return (1);
496 
497 	return (0);
498 }
499 
500 /*
501  * contract_process_kill
502  *
503  * Kills all processes in a contract, or all processes in the
504  * intersection of a contract and ex's process group (if ex is non-NULL
505  * and the contract's PGRPONLY parameter is set).  If checkpriv is
506  * true, only those processes which may be signaled by the contract
507  * author or ex are killed.
508  */
509 static void
510 contract_process_kill(contract_t *ct, proc_t *ex, int checkpriv)
511 {
512 	cont_process_t *ctp = ct->ct_data;
513 	proc_t *p;
514 	pid_t pgrp = -1;
515 
516 	ASSERT(MUTEX_HELD(&ct->ct_lock));
517 
518 	if (ex && (ctp->conp_params & CT_PR_PGRPONLY)) {
519 		pgrp = ex->p_pgrp;
520 		mutex_enter(&pidlock);
521 	}
522 
523 	for (p = list_head(&ctp->conp_members); p != NULL;
524 	    p = list_next(&ctp->conp_members, p)) {
525 		if ((p == ex) ||
526 		    (pgrp != -1 && (p->p_stat == SIDL || p->p_pgrp != pgrp)) ||
527 		    (checkpriv && !contract_process_cankill(p, ex, ctp)))
528 			continue;
529 
530 		psignal(p, SIGKILL);
531 	}
532 
533 	if (pgrp != -1)
534 		mutex_exit(&pidlock);
535 }
536 
537 
538 /*
539  * contract_process_accept
540  *
541  * Tests if the process contract is willing to act as a regent for
542  * inherited contracts.  Though brief and only called from one place,
543  * this functionality is kept here to avoid including knowledge of
544  * process contract implementation in the generic contract code.
545  */
546 int
547 contract_process_accept(contract_t *parent)
548 {
549 	cont_process_t *ctp = parent->ct_data;
550 
551 	ASSERT(parent->ct_type == process_type);
552 
553 	return (ctp->conp_params & CT_PR_REGENT);
554 }
555 
556 /*
557  * contract_process_take
558  *
559  * Executes the process contract side of inheriting a contract.
560  */
561 void
562 contract_process_take(contract_t *parent, contract_t *child)
563 {
564 	cont_process_t *ctp = parent->ct_data;
565 
566 	ASSERT(MUTEX_HELD(&parent->ct_lock));
567 	ASSERT(MUTEX_HELD(&child->ct_lock));
568 	ASSERT(parent->ct_type == process_type);
569 	ASSERT(ctp->conp_params & CT_PR_REGENT);
570 
571 	list_insert_head(&ctp->conp_inherited, child);
572 	ctp->conp_ninherited++;
573 }
574 
575 /*
576  * contract_process_adopt
577  *
578  * Executes the process contract side of adopting a contract.
579  */
580 void
581 contract_process_adopt(contract_t *ct, proc_t *p)
582 {
583 	cont_process_t *parent = p->p_ct_process;
584 
585 	ASSERT(MUTEX_HELD(&parent->conp_contract.ct_lock));
586 	ASSERT(MUTEX_HELD(&ct->ct_lock));
587 
588 	list_remove(&parent->conp_inherited, ct);
589 	parent->conp_ninherited--;
590 
591 	/*
592 	 * We drop the parent lock first because a) we are passing the
593 	 * contract reference to the child, and b) contract_adopt
594 	 * expects us to return with the contract lock held.
595 	 */
596 	mutex_exit(&parent->conp_contract.ct_lock);
597 }
598 
599 /*
600  * contract_process_abandon
601  *
602  * The process contract abandon entry point.
603  */
604 static void
605 contract_process_abandon(contract_t *ct)
606 {
607 	cont_process_t *ctp = ct->ct_data;
608 
609 	ASSERT(MUTEX_HELD(&ct->ct_lock));
610 
611 	/*
612 	 * Shall we stay or shall we go?
613 	 */
614 	if (list_head(&ctp->conp_members) == NULL) {
615 		contract_destroy(ct);
616 	} else {
617 		/*
618 		 * Strictly speaking, we actually do orphan the contract.
619 		 * Assuming our credentials allow us to kill all
620 		 * processes in the contract, this is only temporary.
621 		 */
622 		if (ctp->conp_params & CT_PR_NOORPHAN)
623 			contract_process_kill(ct, NULL, B_TRUE);
624 		contract_orphan(ct);
625 		mutex_exit(&ct->ct_lock);
626 		contract_rele(ct);
627 	}
628 }
629 
630 /*
631  * contract_process_destroy
632  *
633  * The process contract destroy entry point.
634  */
635 static void
636 contract_process_destroy(contract_t *ct)
637 {
638 	cont_process_t *ctp = ct->ct_data;
639 	contract_t *cct;
640 
641 	ASSERT(MUTEX_HELD(&ct->ct_lock));
642 
643 	/*
644 	 * contract_destroy all empty children, kill or orphan the rest
645 	 */
646 	while (cct = list_head(&ctp->conp_inherited)) {
647 		mutex_enter(&cct->ct_lock);
648 
649 		ASSERT(cct->ct_state == CTS_INHERITED);
650 
651 		list_remove(&ctp->conp_inherited, cct);
652 		ctp->conp_ninherited--;
653 		cct->ct_regent = NULL;
654 		cct->ct_type->ct_type_ops->contop_abandon(cct);
655 	}
656 }
657 
658 /*
659  * contract_process_status
660  *
661  * The process contract status entry point.
662  */
663 static void
664 contract_process_status(contract_t *ct, zone_t *zone, int detail, nvlist_t *nvl,
665     void *status, model_t model)
666 {
667 	cont_process_t *ctp = ct->ct_data;
668 	uint32_t *pids, *ctids;
669 	uint_t npids, nctids;
670 	uint_t spids, sctids;
671 	ctid_t local_svc_zone_enter;
672 
673 	if (detail == CTD_FIXED) {
674 		mutex_enter(&ct->ct_lock);
675 		contract_status_common(ct, zone, status, model);
676 		local_svc_zone_enter = ctp->conp_svc_zone_enter;
677 		mutex_exit(&ct->ct_lock);
678 	} else {
679 		contract_t *cnext;
680 		proc_t *pnext;
681 		uint_t loc;
682 
683 		ASSERT(detail == CTD_ALL);
684 		mutex_enter(&ct->ct_lock);
685 		for (;;) {
686 			spids = ctp->conp_nmembers + 5;
687 			sctids = ctp->conp_ninherited + 5;
688 			mutex_exit(&ct->ct_lock);
689 
690 			pids = kmem_alloc(spids * sizeof (uint32_t), KM_SLEEP);
691 			ctids = kmem_alloc(sctids * sizeof (uint32_t),
692 			    KM_SLEEP);
693 
694 			mutex_enter(&ct->ct_lock);
695 			npids = ctp->conp_nmembers;
696 			nctids = ctp->conp_ninherited;
697 			if (spids >= npids && sctids >= nctids)
698 				break;
699 
700 			kmem_free(pids, spids * sizeof (uint32_t));
701 			kmem_free(ctids, sctids * sizeof (uint32_t));
702 		}
703 		contract_status_common(ct, zone, status, model);
704 		for (loc = 0, cnext = list_head(&ctp->conp_inherited); cnext;
705 		    cnext = list_next(&ctp->conp_inherited, cnext))
706 			ctids[loc++] = cnext->ct_id;
707 		ASSERT(loc == nctids);
708 		for (loc = 0, pnext = list_head(&ctp->conp_members); pnext;
709 		    pnext = list_next(&ctp->conp_members, pnext))
710 			pids[loc++] = pnext->p_pid;
711 		ASSERT(loc == npids);
712 		local_svc_zone_enter = ctp->conp_svc_zone_enter;
713 		mutex_exit(&ct->ct_lock);
714 	}
715 
716 	/*
717 	 * Contract terms are static; there's no need to hold the
718 	 * contract lock while accessing them.
719 	 */
720 	VERIFY(nvlist_add_uint32(nvl, CTPS_PARAMS, ctp->conp_params) == 0);
721 	VERIFY(nvlist_add_uint32(nvl, CTPS_EV_FATAL, ctp->conp_ev_fatal) == 0);
722 	if (detail == CTD_ALL) {
723 		VERIFY(nvlist_add_uint32_array(nvl, CTPS_MEMBERS, pids,
724 		    npids) == 0);
725 		VERIFY(nvlist_add_uint32_array(nvl, CTPS_CONTRACTS, ctids,
726 		    nctids) == 0);
727 		VERIFY(nvlist_add_string(nvl, CTPS_CREATOR_AUX,
728 		    refstr_value(ctp->conp_svc_aux)) == 0);
729 		VERIFY(nvlist_add_string(nvl, CTPS_SVC_CREATOR,
730 		    refstr_value(ctp->conp_svc_creator)) == 0);
731 		kmem_free(pids, spids * sizeof (uint32_t));
732 		kmem_free(ctids, sctids * sizeof (uint32_t));
733 	}
734 
735 	/*
736 	 * if we are in a local zone and svc_fmri was inherited from
737 	 * the global zone, we provide fake svc_fmri and svc_ctid
738 	 */
739 	if (local_svc_zone_enter == 0||
740 	    zone->zone_uniqid == GLOBAL_ZONEUNIQID) {
741 		if (detail > CTD_COMMON) {
742 			VERIFY(nvlist_add_int32(nvl, CTPS_SVC_CTID,
743 			    ctp->conp_svc_ctid) == 0);
744 		}
745 		if (detail == CTD_ALL) {
746 			VERIFY(nvlist_add_string(nvl, CTPS_SVC_FMRI,
747 			    refstr_value(ctp->conp_svc_fmri)) == 0);
748 		}
749 	} else {
750 		if (detail > CTD_COMMON) {
751 			VERIFY(nvlist_add_int32(nvl, CTPS_SVC_CTID,
752 			    local_svc_zone_enter) == 0);
753 		}
754 		if (detail == CTD_ALL) {
755 			VERIFY(nvlist_add_string(nvl, CTPS_SVC_FMRI,
756 			    CT_PR_SVC_FMRI_ZONE_ENTER) == 0);
757 		}
758 	}
759 }
760 
761 /*ARGSUSED*/
762 static int
763 contract_process_newct(contract_t *ct)
764 {
765 	return (0);
766 }
767 
768 /* process contracts don't negotiate */
769 static contops_t contract_process_ops = {
770 	contract_process_free,		/* contop_free */
771 	contract_process_abandon,	/* contop_abandon */
772 	contract_process_destroy,	/* contop_destroy */
773 	contract_process_status,	/* contop_status */
774 	contract_ack_inval,		/* contop_ack */
775 	contract_ack_inval,		/* contop_nack */
776 	contract_qack_inval,		/* contop_qack */
777 	contract_process_newct		/* contop_newct */
778 };
779 
780 /*
781  * contract_process_init
782  *
783  * Initializes the process contract type.  Also creates a template for
784  * use by newproc() when it creates user processes.
785  */
786 void
787 contract_process_init(void)
788 {
789 	process_type = contract_type_init(CTT_PROCESS, "process",
790 	    &contract_process_ops, contract_process_default);
791 
792 	/*
793 	 * Create a template for use with init(1M) and other
794 	 * kernel-started processes.
795 	 */
796 	sys_process_tmpl = kmem_alloc(sizeof (ctmpl_process_t), KM_SLEEP);
797 	ctmpl_init(&sys_process_tmpl->ctp_ctmpl, &ctmpl_process_ops,
798 	    process_type, sys_process_tmpl);
799 	sys_process_tmpl->ctp_subsume = NULL;
800 	sys_process_tmpl->ctp_params = CT_PR_NOORPHAN;
801 	sys_process_tmpl->ctp_ev_fatal = CT_PR_EV_HWERR;
802 	sys_process_tmpl->ctp_svc_fmri =
803 	    refstr_alloc("svc:/system/init:default");
804 	sys_process_tmpl->ctp_svc_aux = refstr_alloc("");
805 	conp_svc_aux_default = sys_process_tmpl->ctp_svc_aux;
806 	refstr_hold(conp_svc_aux_default);
807 }
808 
809 /*
810  * contract_process_create
811  *
812  * create a process contract given template "tmpl" and parent process
813  * "parent".  May fail and return NULL if project.max-contracts would
814  * have been exceeded.
815  */
816 static cont_process_t *
817 contract_process_create(ctmpl_process_t *tmpl, proc_t *parent, int canfail)
818 {
819 	cont_process_t *ctp;
820 
821 	ASSERT(tmpl != NULL);
822 
823 	(void) contract_type_pbundle(process_type, parent);
824 
825 	ctp = kmem_zalloc(sizeof (cont_process_t), KM_SLEEP);
826 
827 	list_create(&ctp->conp_members, sizeof (proc_t),
828 	    offsetof(proc_t, p_ct_member));
829 	list_create(&ctp->conp_inherited, sizeof (contract_t),
830 	    offsetof(contract_t, ct_ctlist));
831 	mutex_enter(&tmpl->ctp_ctmpl.ctmpl_lock);
832 	ctp->conp_params = tmpl->ctp_params;
833 	ctp->conp_ev_fatal = tmpl->ctp_ev_fatal;
834 	crhold(ctp->conp_cred = CRED());
835 
836 	if (contract_ctor(&ctp->conp_contract, process_type, &tmpl->ctp_ctmpl,
837 	    ctp, (ctp->conp_params & CT_PR_INHERIT) ? CTF_INHERIT : 0,
838 	    parent, canfail)) {
839 		mutex_exit(&tmpl->ctp_ctmpl.ctmpl_lock);
840 		contract_process_free(&ctp->conp_contract);
841 		return (NULL);
842 	}
843 
844 	/*
845 	 * inherit svc_fmri if not defined by consumer. In this case, inherit
846 	 * also svc_ctid to keep track of the contract id where
847 	 * svc_fmri was set
848 	 */
849 	if (tmpl->ctp_svc_fmri == NULL) {
850 		ctp->conp_svc_fmri = parent->p_ct_process->conp_svc_fmri;
851 		ctp->conp_svc_ctid = parent->p_ct_process->conp_svc_ctid;
852 		ctp->conp_svc_zone_enter =
853 		    parent->p_ct_process->conp_svc_zone_enter;
854 	} else {
855 		ctp->conp_svc_fmri = tmpl->ctp_svc_fmri;
856 		ctp->conp_svc_ctid = ctp->conp_contract.ct_id;
857 		/* make svc_zone_enter flag false when svc_fmri is set */
858 		ctp->conp_svc_zone_enter = 0;
859 	}
860 	refstr_hold(ctp->conp_svc_fmri);
861 	/* set svc_aux to default value if not defined in template */
862 	if (tmpl->ctp_svc_aux == NULL) {
863 		ctp->conp_svc_aux = conp_svc_aux_default;
864 	} else {
865 		ctp->conp_svc_aux = tmpl->ctp_svc_aux;
866 	}
867 	refstr_hold(ctp->conp_svc_aux);
868 	/*
869 	 * set svc_creator to execname
870 	 * We special case pid0 because when newproc() creates
871 	 * the init process, the p_user.u_comm field of sched's proc_t
872 	 * has not been populated yet.
873 	 */
874 	if (parent->p_pidp == &pid0) /* if the kernel is the creator */
875 		ctp->conp_svc_creator = refstr_alloc("sched");
876 	else
877 		ctp->conp_svc_creator = refstr_alloc(parent->p_user.u_comm);
878 
879 	/*
880 	 * Transfer subcontracts only after new contract is visible.
881 	 * Also, only transfer contracts if the parent matches -- we
882 	 * don't want to create a cycle in the tree of contracts.
883 	 */
884 	if (tmpl->ctp_subsume && tmpl->ctp_subsume->ct_owner == parent) {
885 		cont_process_t *sct = tmpl->ctp_subsume->ct_data;
886 		contract_t *ct;
887 
888 		mutex_enter(&tmpl->ctp_subsume->ct_lock);
889 		mutex_enter(&ctp->conp_contract.ct_lock);
890 		while (ct = list_head(&sct->conp_inherited)) {
891 			mutex_enter(&ct->ct_lock);
892 			list_remove(&sct->conp_inherited, ct);
893 			list_insert_tail(&ctp->conp_inherited, ct);
894 			ct->ct_regent = &ctp->conp_contract;
895 			mutex_exit(&ct->ct_lock);
896 		}
897 		ctp->conp_ninherited += sct->conp_ninherited;
898 		sct->conp_ninherited = 0;
899 		mutex_exit(&ctp->conp_contract.ct_lock);
900 		mutex_exit(&tmpl->ctp_subsume->ct_lock);
901 
902 		/*
903 		 * Automatically abandon the contract.
904 		 */
905 		(void) contract_abandon(tmpl->ctp_subsume, parent, 1);
906 	}
907 
908 	mutex_exit(&tmpl->ctp_ctmpl.ctmpl_lock);
909 
910 	return (ctp);
911 }
912 
913 /*
914  * contract_process_exit
915  *
916  * Called on process exit.  Removes process p from process contract
917  * ctp.  Generates an exit event, if requested.  Generates an empty
918  * event, if p is the last member of the the process contract and empty
919  * events were requested.
920  */
921 void
922 contract_process_exit(cont_process_t *ctp, proc_t *p, int exitstatus)
923 {
924 	contract_t *ct = &ctp->conp_contract;
925 	ct_kevent_t *event;
926 	int empty;
927 
928 	/*
929 	 * Remove self from process contract.
930 	 */
931 	mutex_enter(&ct->ct_lock);
932 	list_remove(&ctp->conp_members, p);
933 	ctp->conp_nmembers--;
934 	mutex_enter(&p->p_lock);	/* in case /proc is watching */
935 	p->p_ct_process = NULL;
936 	mutex_exit(&p->p_lock);
937 
938 	/*
939 	 * We check for emptiness before dropping the contract lock to
940 	 * send the exit event, otherwise we could end up with two
941 	 * empty events.
942 	 */
943 	empty = (list_head(&ctp->conp_members) == NULL);
944 	if (EVSENDP(ctp, CT_PR_EV_EXIT)) {
945 		nvlist_t *nvl;
946 
947 		mutex_exit(&ct->ct_lock);
948 		VERIFY(nvlist_alloc(&nvl, NV_UNIQUE_NAME, KM_SLEEP) == 0);
949 		VERIFY(nvlist_add_uint32(nvl, CTPE_PID, p->p_pid) == 0);
950 		VERIFY(nvlist_add_int32(nvl, CTPE_EXITSTATUS, exitstatus) == 0);
951 
952 		event = kmem_zalloc(sizeof (ct_kevent_t), KM_SLEEP);
953 		event->cte_flags = EVINFOP(ctp, CT_PR_EV_EXIT) ? CTE_INFO : 0;
954 		event->cte_type = CT_PR_EV_EXIT;
955 		(void) cte_publish_all(ct, event, nvl, NULL);
956 		mutex_enter(&ct->ct_lock);
957 	}
958 	if (empty) {
959 		/*
960 		 * Send EMPTY message.
961 		 */
962 		if (EVSENDP(ctp, CT_PR_EV_EMPTY)) {
963 			nvlist_t *nvl;
964 
965 			mutex_exit(&ct->ct_lock);
966 			VERIFY(nvlist_alloc(&nvl, NV_UNIQUE_NAME,
967 			    KM_SLEEP) == 0);
968 			VERIFY(nvlist_add_uint32(nvl, CTPE_PID, p->p_pid) == 0);
969 
970 			event = kmem_zalloc(sizeof (ct_kevent_t), KM_SLEEP);
971 			event->cte_flags = EVINFOP(ctp, CT_PR_EV_EMPTY) ?
972 			    CTE_INFO : 0;
973 			event->cte_type = CT_PR_EV_EMPTY;
974 			(void) cte_publish_all(ct, event, nvl, NULL);
975 			mutex_enter(&ct->ct_lock);
976 		}
977 
978 		/*
979 		 * The last one to leave an orphaned contract turns out
980 		 * the lights.
981 		 */
982 		if (ct->ct_state == CTS_ORPHAN) {
983 			contract_destroy(ct);
984 			return;
985 		}
986 	}
987 	mutex_exit(&ct->ct_lock);
988 	contract_rele(ct);
989 }
990 
991 /*
992  * contract_process_fork
993  *
994  * Called on process fork.  If the current lwp has a active process
995  * contract template, we attempt to create a new process contract.
996  * Failure to create a process contract when required is a failure in
997  * fork so, in such an event, we return NULL.
998  *
999  * Assuming we succeeded or skipped the previous step, we add the child
1000  * process to the new contract (success) or to the parent's process
1001  * contract (skip).  If requested, we also send a fork event to that
1002  * contract.
1003  *
1004  * Because contract_process_fork() may fail, and because we would
1005  * prefer that process contracts not be created for processes which
1006  * don't complete forking, this should be the last function called
1007  * before the "all clear" point in cfork.
1008  */
1009 cont_process_t *
1010 contract_process_fork(ctmpl_process_t *rtmpl, proc_t *cp, proc_t *pp,
1011     int canfail)
1012 {
1013 	contract_t *ct;
1014 	cont_process_t *ctp;
1015 	ct_kevent_t *event;
1016 	ct_template_t *tmpl;
1017 
1018 	if (rtmpl == NULL && (tmpl = ttolwp(curthread)->lwp_ct_active[
1019 	    process_type->ct_type_index]) != NULL)
1020 		rtmpl = tmpl->ctmpl_data;
1021 
1022 	if (rtmpl == NULL)
1023 		ctp = curproc->p_ct_process;
1024 	else if ((ctp = contract_process_create(rtmpl, pp, canfail)) == NULL)
1025 		return (NULL);
1026 
1027 	ct = &ctp->conp_contract;
1028 	/*
1029 	 * Prevent contract_process_kill() from missing forked children
1030 	 * by failing forks by parents that have just been killed.
1031 	 * It's not worth hoisting the ctp test since contract creation
1032 	 * is by no means the common case.
1033 	 */
1034 	mutex_enter(&ct->ct_lock);
1035 	mutex_enter(&pp->p_lock);
1036 	if (ctp == curproc->p_ct_process && (pp->p_flag & SKILLED) != 0 &&
1037 	    canfail) {
1038 		mutex_exit(&pp->p_lock);
1039 		mutex_exit(&ct->ct_lock);
1040 		return (NULL);
1041 	}
1042 	cp->p_ct_process = ctp;
1043 	mutex_exit(&pp->p_lock);
1044 	contract_hold(ct);
1045 	list_insert_head(&ctp->conp_members, cp);
1046 	ctp->conp_nmembers++;
1047 	mutex_exit(&ct->ct_lock);
1048 	if (EVSENDP(ctp, CT_PR_EV_FORK)) {
1049 		nvlist_t *nvl;
1050 
1051 		VERIFY(nvlist_alloc(&nvl, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1052 		VERIFY(nvlist_add_uint32(nvl, CTPE_PID, cp->p_pid) == 0);
1053 		VERIFY(nvlist_add_uint32(nvl, CTPE_PPID, pp->p_pid) == 0);
1054 
1055 		event = kmem_zalloc(sizeof (ct_kevent_t), KM_SLEEP);
1056 		event->cte_flags = EVINFOP(ctp, CT_PR_EV_FORK) ? CTE_INFO : 0;
1057 		event->cte_type = CT_PR_EV_FORK;
1058 		(void) cte_publish_all(ct, event, nvl, NULL);
1059 	}
1060 	return (ctp);
1061 }
1062 
1063 /*
1064  * contract_process_core
1065  *
1066  * Called on core file generation attempts.  Generates a core event, if
1067  * requested, containing the names of the process, global, and
1068  * system-global ("zone") core files.  If dumping core is in the fatal
1069  * event set, calls contract_process_kill().
1070  */
1071 void
1072 contract_process_core(cont_process_t *ctp, proc_t *p, int sig,
1073     const char *process, const char *global, const char *zone)
1074 {
1075 	contract_t *ct = &ctp->conp_contract;
1076 
1077 	if (EVSENDP(ctp, CT_PR_EV_CORE)) {
1078 		ct_kevent_t *event;
1079 		nvlist_t *nvl, *gnvl = NULL;
1080 
1081 		VERIFY(nvlist_alloc(&nvl, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1082 		VERIFY(nvlist_add_uint32(nvl, CTPE_PID, p->p_pid) == 0);
1083 		VERIFY(nvlist_add_uint32(nvl, CTPE_SIGNAL, sig) == 0);
1084 		if (process)
1085 			VERIFY(nvlist_add_string(nvl, CTPE_PCOREFILE,
1086 			    (char *)process) == 0);
1087 		if (global)
1088 			VERIFY(nvlist_add_string(nvl, CTPE_GCOREFILE,
1089 			    (char *)global) == 0);
1090 
1091 		if (zone) {
1092 			/*
1093 			 * Only the global zone is informed of the
1094 			 * local-zone generated global-zone core.
1095 			 */
1096 			VERIFY(nvlist_alloc(&gnvl, NV_UNIQUE_NAME,
1097 			    KM_SLEEP) == 0);
1098 			VERIFY(nvlist_add_string(gnvl, CTPE_ZCOREFILE,
1099 			    (char *)zone) == 0);
1100 		}
1101 
1102 		event = kmem_zalloc(sizeof (ct_kevent_t), KM_SLEEP);
1103 		event->cte_flags = EVINFOP(ctp, CT_PR_EV_CORE) ? CTE_INFO : 0;
1104 		event->cte_type = CT_PR_EV_CORE;
1105 		(void) cte_publish_all(ct, event, nvl, gnvl);
1106 	}
1107 
1108 	if (EVFATALP(ctp, CT_PR_EV_CORE)) {
1109 		mutex_enter(&ct->ct_lock);
1110 		contract_process_kill(ct, p, B_TRUE);
1111 		mutex_exit(&ct->ct_lock);
1112 	}
1113 }
1114 
1115 /*
1116  * contract_process_hwerr
1117  *
1118  * Called when a process is killed by an unrecoverable hardware error.
1119  * Generates an hwerr event, if requested.  If hardware errors are in
1120  * the fatal event set, calls contract_process_kill().
1121  */
1122 void
1123 contract_process_hwerr(cont_process_t *ctp, proc_t *p)
1124 {
1125 	contract_t *ct = &ctp->conp_contract;
1126 
1127 	if (EVSENDP(ctp, CT_PR_EV_HWERR)) {
1128 		ct_kevent_t *event;
1129 		nvlist_t *nvl;
1130 
1131 		VERIFY(nvlist_alloc(&nvl, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1132 		VERIFY(nvlist_add_uint32(nvl, CTPE_PID, p->p_pid) == 0);
1133 
1134 		event = kmem_zalloc(sizeof (ct_kevent_t), KM_SLEEP);
1135 		event->cte_flags = EVINFOP(ctp, CT_PR_EV_HWERR) ? CTE_INFO : 0;
1136 		event->cte_type = CT_PR_EV_HWERR;
1137 		(void) cte_publish_all(ct, event, nvl, NULL);
1138 	}
1139 
1140 	if (EVFATALP(ctp, CT_PR_EV_HWERR)) {
1141 		mutex_enter(&ct->ct_lock);
1142 		contract_process_kill(ct, p, B_FALSE);
1143 		mutex_exit(&ct->ct_lock);
1144 	}
1145 }
1146 
1147 /*
1148  * contract_process_sig
1149  *
1150  * Called when a process is killed by a signal originating from a
1151  * process outside of its process contract or its process contract's
1152  * holder.  Generates an signal event, if requested, containing the
1153  * signal number, and the sender's pid and contract id (if available).
1154  * If signals are in the fatal event set, calls
1155  * contract_process_kill().
1156  */
1157 void
1158 contract_process_sig(cont_process_t *ctp, proc_t *p, int sig, pid_t pid,
1159     ctid_t ctid, zoneid_t zoneid)
1160 {
1161 	contract_t *ct = &ctp->conp_contract;
1162 
1163 	if (EVSENDP(ctp, CT_PR_EV_SIGNAL)) {
1164 		ct_kevent_t *event;
1165 		nvlist_t *dest, *nvl, *gnvl = NULL;
1166 
1167 		VERIFY(nvlist_alloc(&nvl, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1168 		VERIFY(nvlist_add_uint32(nvl, CTPE_PID, p->p_pid) == 0);
1169 		VERIFY(nvlist_add_uint32(nvl, CTPE_SIGNAL, sig) == 0);
1170 
1171 		if (zoneid >= 0 && p->p_zone->zone_id != zoneid) {
1172 			VERIFY(nvlist_alloc(&gnvl, NV_UNIQUE_NAME,
1173 			    KM_SLEEP) == 0);
1174 			dest = gnvl;
1175 		} else {
1176 			dest = nvl;
1177 		}
1178 
1179 		if (pid != -1)
1180 			VERIFY(nvlist_add_uint32(dest, CTPE_SENDER, pid) == 0);
1181 		if (ctid != 0)
1182 			VERIFY(nvlist_add_uint32(dest, CTPE_SENDCT, ctid) == 0);
1183 
1184 		event = kmem_zalloc(sizeof (ct_kevent_t), KM_SLEEP);
1185 		event->cte_flags = EVINFOP(ctp, CT_PR_EV_SIGNAL) ? CTE_INFO : 0;
1186 		event->cte_type = CT_PR_EV_SIGNAL;
1187 		(void) cte_publish_all(ct, event, nvl, gnvl);
1188 	}
1189 
1190 	if (EVFATALP(ctp, CT_PR_EV_SIGNAL)) {
1191 		mutex_enter(&ct->ct_lock);
1192 		contract_process_kill(ct, p, B_TRUE);
1193 		mutex_exit(&ct->ct_lock);
1194 	}
1195 }
1196