xref: /titanic_51/usr/src/cmd/zoneadmd/vplat.c (revision ccdeb6b6d71f3c9aa7e78b688f7b34fff109a817)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Copyright (c) 2013, Joyent Inc. All rights reserved.
25  * Copyright (c) 2015 by Delphix. All rights reserved.
26  */
27 
28 /*
29  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
30  */
31 
32 /*
33  * This module contains functions used to bring up and tear down the
34  * Virtual Platform: [un]mounting file-systems, [un]plumbing network
35  * interfaces, [un]configuring devices, establishing resource controls,
36  * and creating/destroying the zone in the kernel.  These actions, on
37  * the way up, ready the zone; on the way down, they halt the zone.
38  * See the much longer block comment at the beginning of zoneadmd.c
39  * for a bigger picture of how the whole program functions.
40  *
41  * This module also has primary responsibility for the layout of "scratch
42  * zones."  These are mounted, but inactive, zones that are used during
43  * operating system upgrade and potentially other administrative action.  The
44  * scratch zone environment is similar to the miniroot environment.  The zone's
45  * actual root is mounted read-write on /a, and the standard paths (/usr,
46  * /sbin, /lib) all lead to read-only copies of the running system's binaries.
47  * This allows the administrative tools to manipulate the zone using "-R /a"
48  * without relying on any binaries in the zone itself.
49  *
50  * If the scratch zone is on an alternate root (Live Upgrade [LU] boot
51  * environment), then we must resolve the lofs mounts used there to uncover
52  * writable (unshared) resources.  Shared resources, though, are always
53  * read-only.  In addition, if the "same" zone with a different root path is
54  * currently running, then "/b" inside the zone points to the running zone's
55  * root.  This allows LU to synchronize configuration files during the upgrade
56  * process.
57  *
58  * To construct this environment, this module creates a tmpfs mount on
59  * $ZONEPATH/lu.  Inside this scratch area, the miniroot-like environment as
60  * described above is constructed on the fly.  The zone is then created using
61  * $ZONEPATH/lu as the root.
62  *
63  * Note that scratch zones are inactive.  The zone's bits are not running and
64  * likely cannot be run correctly until upgrade is done.  Init is not running
65  * there, nor is SMF.  Because of this, the "mounted" state of a scratch zone
66  * is not a part of the usual halt/ready/boot state machine.
67  */
68 
69 #include <sys/param.h>
70 #include <sys/mount.h>
71 #include <sys/mntent.h>
72 #include <sys/socket.h>
73 #include <sys/utsname.h>
74 #include <sys/types.h>
75 #include <sys/stat.h>
76 #include <sys/sockio.h>
77 #include <sys/stropts.h>
78 #include <sys/conf.h>
79 #include <sys/systeminfo.h>
80 
81 #include <libdlpi.h>
82 #include <libdllink.h>
83 #include <libdlvlan.h>
84 
85 #include <inet/tcp.h>
86 #include <arpa/inet.h>
87 #include <netinet/in.h>
88 #include <net/route.h>
89 
90 #include <stdio.h>
91 #include <errno.h>
92 #include <fcntl.h>
93 #include <unistd.h>
94 #include <rctl.h>
95 #include <stdlib.h>
96 #include <string.h>
97 #include <strings.h>
98 #include <wait.h>
99 #include <limits.h>
100 #include <libgen.h>
101 #include <libzfs.h>
102 #include <libdevinfo.h>
103 #include <zone.h>
104 #include <assert.h>
105 #include <libcontract.h>
106 #include <libcontract_priv.h>
107 #include <uuid/uuid.h>
108 
109 #include <sys/mntio.h>
110 #include <sys/mnttab.h>
111 #include <sys/fs/autofs.h>	/* for _autofssys() */
112 #include <sys/fs/lofs_info.h>
113 #include <sys/fs/zfs.h>
114 
115 #include <pool.h>
116 #include <sys/pool.h>
117 #include <sys/priocntl.h>
118 
119 #include <libbrand.h>
120 #include <sys/brand.h>
121 #include <libzonecfg.h>
122 #include <synch.h>
123 
124 #include "zoneadmd.h"
125 #include <tsol/label.h>
126 #include <libtsnet.h>
127 #include <sys/priv.h>
128 #include <libinetutil.h>
129 
130 #define	V4_ADDR_LEN	32
131 #define	V6_ADDR_LEN	128
132 
133 #define	RESOURCE_DEFAULT_OPTS \
134 	MNTOPT_RO "," MNTOPT_LOFS_NOSUB "," MNTOPT_NODEVICES
135 
136 #define	DFSTYPES	"/etc/dfs/fstypes"
137 #define	MAXTNZLEN	2048
138 
139 #define	ALT_MOUNT(mount_cmd) 	((mount_cmd) != Z_MNT_BOOT)
140 
141 /* a reasonable estimate for the number of lwps per process */
142 #define	LWPS_PER_PROCESS	10
143 
144 /* for routing socket */
145 static int rts_seqno = 0;
146 
147 /* mangled zone name when mounting in an alternate root environment */
148 static char kernzone[ZONENAME_MAX];
149 
150 /* array of cached mount entries for resolve_lofs */
151 static struct mnttab *resolve_lofs_mnts, *resolve_lofs_mnt_max;
152 
153 /* for Trusted Extensions */
154 static tsol_zcent_t *get_zone_label(zlog_t *, priv_set_t *);
155 static int tsol_mounts(zlog_t *, char *, char *);
156 static void tsol_unmounts(zlog_t *, char *);
157 
158 static m_label_t *zlabel = NULL;
159 static m_label_t *zid_label = NULL;
160 static priv_set_t *zprivs = NULL;
161 
162 static const char *DFLT_FS_ALLOWED = "hsfs,smbfs,nfs,nfs3,nfs4,nfsdyn";
163 
164 /* from libsocket, not in any header file */
165 extern int getnetmaskbyaddr(struct in_addr, struct in_addr *);
166 
167 /* from zoneadmd */
168 extern char query_hook[];
169 
170 /*
171  * For each "net" resource configured in zonecfg, we track a zone_addr_list_t
172  * node in a linked list that is sorted by linkid.  The list is constructed as
173  * the xml configuration file is parsed, and the information
174  * contained in each node is added to the kernel before the zone is
175  * booted, to be retrieved and applied from within the exclusive-IP NGZ
176  * on boot.
177  */
178 typedef struct zone_addr_list {
179 	struct zone_addr_list *za_next;
180 	datalink_id_t za_linkid;	/* datalink_id_t of interface */
181 	struct zone_nwiftab za_nwiftab; /* address, defrouter properties */
182 } zone_addr_list_t;
183 
184 /*
185  * An optimization for build_mnttable: reallocate (and potentially copy the
186  * data) only once every N times through the loop.
187  */
188 #define	MNTTAB_HUNK	32
189 
190 /* some handy macros */
191 #define	SIN(s)	((struct sockaddr_in *)s)
192 #define	SIN6(s)	((struct sockaddr_in6 *)s)
193 
194 /*
195  * Private autofs system call
196  */
197 extern int _autofssys(int, void *);
198 
199 static int
200 autofs_cleanup(zoneid_t zoneid)
201 {
202 	/*
203 	 * Ask autofs to unmount all trigger nodes in the given zone.
204 	 */
205 	return (_autofssys(AUTOFS_UNMOUNTALL, (void *)zoneid));
206 }
207 
208 static void
209 free_mnttable(struct mnttab *mnt_array, uint_t nelem)
210 {
211 	uint_t i;
212 
213 	if (mnt_array == NULL)
214 		return;
215 	for (i = 0; i < nelem; i++) {
216 		free(mnt_array[i].mnt_mountp);
217 		free(mnt_array[i].mnt_fstype);
218 		free(mnt_array[i].mnt_special);
219 		free(mnt_array[i].mnt_mntopts);
220 		assert(mnt_array[i].mnt_time == NULL);
221 	}
222 	free(mnt_array);
223 }
224 
225 /*
226  * Build the mount table for the zone rooted at "zroot", storing the resulting
227  * array of struct mnttabs in "mnt_arrayp" and the number of elements in the
228  * array in "nelemp".
229  */
230 static int
231 build_mnttable(zlog_t *zlogp, const char *zroot, size_t zrootlen, FILE *mnttab,
232     struct mnttab **mnt_arrayp, uint_t *nelemp)
233 {
234 	struct mnttab mnt;
235 	struct mnttab *mnts;
236 	struct mnttab *mnp;
237 	uint_t nmnt;
238 
239 	rewind(mnttab);
240 	resetmnttab(mnttab);
241 	nmnt = 0;
242 	mnts = NULL;
243 	while (getmntent(mnttab, &mnt) == 0) {
244 		struct mnttab *tmp_array;
245 
246 		if (strncmp(mnt.mnt_mountp, zroot, zrootlen) != 0)
247 			continue;
248 		if (nmnt % MNTTAB_HUNK == 0) {
249 			tmp_array = realloc(mnts,
250 			    (nmnt + MNTTAB_HUNK) * sizeof (*mnts));
251 			if (tmp_array == NULL) {
252 				free_mnttable(mnts, nmnt);
253 				return (-1);
254 			}
255 			mnts = tmp_array;
256 		}
257 		mnp = &mnts[nmnt++];
258 
259 		/*
260 		 * Zero out any fields we're not using.
261 		 */
262 		(void) memset(mnp, 0, sizeof (*mnp));
263 
264 		if (mnt.mnt_special != NULL)
265 			mnp->mnt_special = strdup(mnt.mnt_special);
266 		if (mnt.mnt_mntopts != NULL)
267 			mnp->mnt_mntopts = strdup(mnt.mnt_mntopts);
268 		mnp->mnt_mountp = strdup(mnt.mnt_mountp);
269 		mnp->mnt_fstype = strdup(mnt.mnt_fstype);
270 		if ((mnt.mnt_special != NULL && mnp->mnt_special == NULL) ||
271 		    (mnt.mnt_mntopts != NULL && mnp->mnt_mntopts == NULL) ||
272 		    mnp->mnt_mountp == NULL || mnp->mnt_fstype == NULL) {
273 			zerror(zlogp, B_TRUE, "memory allocation failed");
274 			free_mnttable(mnts, nmnt);
275 			return (-1);
276 		}
277 	}
278 	*mnt_arrayp = mnts;
279 	*nelemp = nmnt;
280 	return (0);
281 }
282 
283 /*
284  * This is an optimization.  The resolve_lofs function is used quite frequently
285  * to manipulate file paths, and on a machine with a large number of zones,
286  * there will be a huge number of mounted file systems.  Thus, we trigger a
287  * reread of the list of mount points
288  */
289 static void
290 lofs_discard_mnttab(void)
291 {
292 	free_mnttable(resolve_lofs_mnts,
293 	    resolve_lofs_mnt_max - resolve_lofs_mnts);
294 	resolve_lofs_mnts = resolve_lofs_mnt_max = NULL;
295 }
296 
297 static int
298 lofs_read_mnttab(zlog_t *zlogp)
299 {
300 	FILE *mnttab;
301 	uint_t nmnts;
302 
303 	if ((mnttab = fopen(MNTTAB, "r")) == NULL)
304 		return (-1);
305 	if (build_mnttable(zlogp, "", 0, mnttab, &resolve_lofs_mnts,
306 	    &nmnts) == -1) {
307 		(void) fclose(mnttab);
308 		return (-1);
309 	}
310 	(void) fclose(mnttab);
311 	resolve_lofs_mnt_max = resolve_lofs_mnts + nmnts;
312 	return (0);
313 }
314 
315 /*
316  * This function loops over potential loopback mounts and symlinks in a given
317  * path and resolves them all down to an absolute path.
318  */
319 void
320 resolve_lofs(zlog_t *zlogp, char *path, size_t pathlen)
321 {
322 	int len, arlen;
323 	const char *altroot;
324 	char tmppath[MAXPATHLEN];
325 	boolean_t outside_altroot;
326 
327 	if ((len = resolvepath(path, tmppath, sizeof (tmppath))) == -1)
328 		return;
329 	tmppath[len] = '\0';
330 	(void) strlcpy(path, tmppath, sizeof (tmppath));
331 
332 	/* This happens once per zoneadmd operation. */
333 	if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
334 		return;
335 
336 	altroot = zonecfg_get_root();
337 	arlen = strlen(altroot);
338 	outside_altroot = B_FALSE;
339 	for (;;) {
340 		struct mnttab *mnp;
341 
342 		/* Search in reverse order to find longest match */
343 		for (mnp = resolve_lofs_mnt_max - 1; mnp >= resolve_lofs_mnts;
344 		    mnp--) {
345 			if (mnp->mnt_fstype == NULL ||
346 			    mnp->mnt_mountp == NULL ||
347 			    mnp->mnt_special == NULL)
348 				continue;
349 			len = strlen(mnp->mnt_mountp);
350 			if (strncmp(mnp->mnt_mountp, path, len) == 0 &&
351 			    (path[len] == '/' || path[len] == '\0'))
352 				break;
353 		}
354 		if (mnp < resolve_lofs_mnts)
355 			break;
356 		/* If it's not a lofs then we're done */
357 		if (strcmp(mnp->mnt_fstype, MNTTYPE_LOFS) != 0)
358 			break;
359 		if (outside_altroot) {
360 			char *cp;
361 			int olen = sizeof (MNTOPT_RO) - 1;
362 
363 			/*
364 			 * If we run into a read-only mount outside of the
365 			 * alternate root environment, then the user doesn't
366 			 * want this path to be made read-write.
367 			 */
368 			if (mnp->mnt_mntopts != NULL &&
369 			    (cp = strstr(mnp->mnt_mntopts, MNTOPT_RO)) !=
370 			    NULL &&
371 			    (cp == mnp->mnt_mntopts || cp[-1] == ',') &&
372 			    (cp[olen] == '\0' || cp[olen] == ',')) {
373 				break;
374 			}
375 		} else if (arlen > 0 &&
376 		    (strncmp(mnp->mnt_special, altroot, arlen) != 0 ||
377 		    (mnp->mnt_special[arlen] != '\0' &&
378 		    mnp->mnt_special[arlen] != '/'))) {
379 			outside_altroot = B_TRUE;
380 		}
381 		/* use temporary buffer because new path might be longer */
382 		(void) snprintf(tmppath, sizeof (tmppath), "%s%s",
383 		    mnp->mnt_special, path + len);
384 		if ((len = resolvepath(tmppath, path, pathlen)) == -1)
385 			break;
386 		path[len] = '\0';
387 	}
388 }
389 
390 /*
391  * For a regular mount, check if a replacement lofs mount is needed because the
392  * referenced device is already mounted somewhere.
393  */
394 static int
395 check_lofs_needed(zlog_t *zlogp, struct zone_fstab *fsptr)
396 {
397 	struct mnttab *mnp;
398 	zone_fsopt_t *optptr, *onext;
399 
400 	/* This happens once per zoneadmd operation. */
401 	if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
402 		return (-1);
403 
404 	/*
405 	 * If this special node isn't already in use, then it's ours alone;
406 	 * no need to worry about conflicting mounts.
407 	 */
408 	for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max;
409 	    mnp++) {
410 		if (strcmp(mnp->mnt_special, fsptr->zone_fs_special) == 0)
411 			break;
412 	}
413 	if (mnp >= resolve_lofs_mnt_max)
414 		return (0);
415 
416 	/*
417 	 * Convert this duplicate mount into a lofs mount.
418 	 */
419 	(void) strlcpy(fsptr->zone_fs_special, mnp->mnt_mountp,
420 	    sizeof (fsptr->zone_fs_special));
421 	(void) strlcpy(fsptr->zone_fs_type, MNTTYPE_LOFS,
422 	    sizeof (fsptr->zone_fs_type));
423 	fsptr->zone_fs_raw[0] = '\0';
424 
425 	/*
426 	 * Discard all but one of the original options and set that to our
427 	 * default set of options used for resources.
428 	 */
429 	optptr = fsptr->zone_fs_options;
430 	if (optptr == NULL) {
431 		optptr = malloc(sizeof (*optptr));
432 		if (optptr == NULL) {
433 			zerror(zlogp, B_TRUE, "cannot mount %s",
434 			    fsptr->zone_fs_dir);
435 			return (-1);
436 		}
437 	} else {
438 		while ((onext = optptr->zone_fsopt_next) != NULL) {
439 			optptr->zone_fsopt_next = onext->zone_fsopt_next;
440 			free(onext);
441 		}
442 	}
443 	(void) strcpy(optptr->zone_fsopt_opt, RESOURCE_DEFAULT_OPTS);
444 	optptr->zone_fsopt_next = NULL;
445 	fsptr->zone_fs_options = optptr;
446 	return (0);
447 }
448 
449 int
450 make_one_dir(zlog_t *zlogp, const char *prefix, const char *subdir, mode_t mode,
451     uid_t userid, gid_t groupid)
452 {
453 	char path[MAXPATHLEN];
454 	struct stat st;
455 
456 	if (snprintf(path, sizeof (path), "%s%s", prefix, subdir) >
457 	    sizeof (path)) {
458 		zerror(zlogp, B_FALSE, "pathname %s%s is too long", prefix,
459 		    subdir);
460 		return (-1);
461 	}
462 
463 	if (lstat(path, &st) == 0) {
464 		/*
465 		 * We don't check the file mode since presumably the zone
466 		 * administrator may have had good reason to change the mode,
467 		 * and we don't need to second guess him.
468 		 */
469 		if (!S_ISDIR(st.st_mode)) {
470 			if (S_ISREG(st.st_mode)) {
471 				/*
472 				 * Allow readonly mounts of /etc/ files; this
473 				 * is needed most by Trusted Extensions.
474 				 */
475 				if (strncmp(subdir, "/etc/",
476 				    strlen("/etc/")) != 0) {
477 					zerror(zlogp, B_FALSE,
478 					    "%s is not in /etc", path);
479 					return (-1);
480 				}
481 			} else {
482 				zerror(zlogp, B_FALSE,
483 				    "%s is not a directory", path);
484 				return (-1);
485 			}
486 		}
487 		return (0);
488 	}
489 
490 	if (mkdirp(path, mode) != 0) {
491 		if (errno == EROFS)
492 			zerror(zlogp, B_FALSE, "Could not mkdir %s.\nIt is on "
493 			    "a read-only file system in this local zone.\nMake "
494 			    "sure %s exists in the global zone.", path, subdir);
495 		else
496 			zerror(zlogp, B_TRUE, "mkdirp of %s failed", path);
497 		return (-1);
498 	}
499 
500 	(void) chown(path, userid, groupid);
501 	return (0);
502 }
503 
504 static void
505 free_remote_fstypes(char **types)
506 {
507 	uint_t i;
508 
509 	if (types == NULL)
510 		return;
511 	for (i = 0; types[i] != NULL; i++)
512 		free(types[i]);
513 	free(types);
514 }
515 
516 static char **
517 get_remote_fstypes(zlog_t *zlogp)
518 {
519 	char **types = NULL;
520 	FILE *fp;
521 	char buf[MAXPATHLEN];
522 	char fstype[MAXPATHLEN];
523 	uint_t lines = 0;
524 	uint_t i;
525 
526 	if ((fp = fopen(DFSTYPES, "r")) == NULL) {
527 		zerror(zlogp, B_TRUE, "failed to open %s", DFSTYPES);
528 		return (NULL);
529 	}
530 	/*
531 	 * Count the number of lines
532 	 */
533 	while (fgets(buf, sizeof (buf), fp) != NULL)
534 		lines++;
535 	if (lines == 0)	/* didn't read anything; empty file */
536 		goto out;
537 	rewind(fp);
538 	/*
539 	 * Allocate enough space for a NULL-terminated array.
540 	 */
541 	types = calloc(lines + 1, sizeof (char *));
542 	if (types == NULL) {
543 		zerror(zlogp, B_TRUE, "memory allocation failed");
544 		goto out;
545 	}
546 	i = 0;
547 	while (fgets(buf, sizeof (buf), fp) != NULL) {
548 		/* LINTED - fstype is big enough to hold buf */
549 		if (sscanf(buf, "%s", fstype) == 0) {
550 			zerror(zlogp, B_FALSE, "unable to parse %s", DFSTYPES);
551 			free_remote_fstypes(types);
552 			types = NULL;
553 			goto out;
554 		}
555 		types[i] = strdup(fstype);
556 		if (types[i] == NULL) {
557 			zerror(zlogp, B_TRUE, "memory allocation failed");
558 			free_remote_fstypes(types);
559 			types = NULL;
560 			goto out;
561 		}
562 		i++;
563 	}
564 out:
565 	(void) fclose(fp);
566 	return (types);
567 }
568 
569 static boolean_t
570 is_remote_fstype(const char *fstype, char *const *remote_fstypes)
571 {
572 	uint_t i;
573 
574 	if (remote_fstypes == NULL)
575 		return (B_FALSE);
576 	for (i = 0; remote_fstypes[i] != NULL; i++) {
577 		if (strcmp(remote_fstypes[i], fstype) == 0)
578 			return (B_TRUE);
579 	}
580 	return (B_FALSE);
581 }
582 
583 /*
584  * This converts a zone root path (normally of the form .../root) to a Live
585  * Upgrade scratch zone root (of the form .../lu).
586  */
587 static void
588 root_to_lu(zlog_t *zlogp, char *zroot, size_t zrootlen, boolean_t isresolved)
589 {
590 	if (!isresolved && zonecfg_in_alt_root())
591 		resolve_lofs(zlogp, zroot, zrootlen);
592 	(void) strcpy(strrchr(zroot, '/') + 1, "lu");
593 }
594 
595 /*
596  * The general strategy for unmounting filesystems is as follows:
597  *
598  * - Remote filesystems may be dead, and attempting to contact them as
599  * part of a regular unmount may hang forever; we want to always try to
600  * forcibly unmount such filesystems and only fall back to regular
601  * unmounts if the filesystem doesn't support forced unmounts.
602  *
603  * - We don't want to unnecessarily corrupt metadata on local
604  * filesystems (ie UFS), so we want to start off with graceful unmounts,
605  * and only escalate to doing forced unmounts if we get stuck.
606  *
607  * We start off walking backwards through the mount table.  This doesn't
608  * give us strict ordering but ensures that we try to unmount submounts
609  * first.  We thus limit the number of failed umount2(2) calls.
610  *
611  * The mechanism for determining if we're stuck is to count the number
612  * of failed unmounts each iteration through the mount table.  This
613  * gives us an upper bound on the number of filesystems which remain
614  * mounted (autofs trigger nodes are dealt with separately).  If at the
615  * end of one unmount+autofs_cleanup cycle we still have the same number
616  * of mounts that we started out with, we're stuck and try a forced
617  * unmount.  If that fails (filesystem doesn't support forced unmounts)
618  * then we bail and are unable to teardown the zone.  If it succeeds,
619  * we're no longer stuck so we continue with our policy of trying
620  * graceful mounts first.
621  *
622  * Zone must be down (ie, no processes or threads active).
623  */
624 static int
625 unmount_filesystems(zlog_t *zlogp, zoneid_t zoneid, boolean_t unmount_cmd)
626 {
627 	int error = 0;
628 	FILE *mnttab;
629 	struct mnttab *mnts;
630 	uint_t nmnt;
631 	char zroot[MAXPATHLEN + 1];
632 	size_t zrootlen;
633 	uint_t oldcount = UINT_MAX;
634 	boolean_t stuck = B_FALSE;
635 	char **remote_fstypes = NULL;
636 
637 	if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
638 		zerror(zlogp, B_FALSE, "unable to determine zone root");
639 		return (-1);
640 	}
641 	if (unmount_cmd)
642 		root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
643 
644 	(void) strcat(zroot, "/");
645 	zrootlen = strlen(zroot);
646 
647 	/*
648 	 * For Trusted Extensions unmount each higher level zone's mount
649 	 * of our zone's /export/home
650 	 */
651 	if (!unmount_cmd)
652 		tsol_unmounts(zlogp, zone_name);
653 
654 	if ((mnttab = fopen(MNTTAB, "r")) == NULL) {
655 		zerror(zlogp, B_TRUE, "failed to open %s", MNTTAB);
656 		return (-1);
657 	}
658 	/*
659 	 * Use our hacky mntfs ioctl so we see everything, even mounts with
660 	 * MS_NOMNTTAB.
661 	 */
662 	if (ioctl(fileno(mnttab), MNTIOC_SHOWHIDDEN, NULL) < 0) {
663 		zerror(zlogp, B_TRUE, "unable to configure %s", MNTTAB);
664 		error++;
665 		goto out;
666 	}
667 
668 	/*
669 	 * Build the list of remote fstypes so we know which ones we
670 	 * should forcibly unmount.
671 	 */
672 	remote_fstypes = get_remote_fstypes(zlogp);
673 	for (; /* ever */; ) {
674 		uint_t newcount = 0;
675 		boolean_t unmounted;
676 		struct mnttab *mnp;
677 		char *path;
678 		uint_t i;
679 
680 		mnts = NULL;
681 		nmnt = 0;
682 		/*
683 		 * MNTTAB gives us a way to walk through mounted
684 		 * filesystems; we need to be able to walk them in
685 		 * reverse order, so we build a list of all mounted
686 		 * filesystems.
687 		 */
688 		if (build_mnttable(zlogp, zroot, zrootlen, mnttab, &mnts,
689 		    &nmnt) != 0) {
690 			error++;
691 			goto out;
692 		}
693 		for (i = 0; i < nmnt; i++) {
694 			mnp = &mnts[nmnt - i - 1]; /* access in reverse order */
695 			path = mnp->mnt_mountp;
696 			unmounted = B_FALSE;
697 			/*
698 			 * Try forced unmount first for remote filesystems.
699 			 *
700 			 * Not all remote filesystems support forced unmounts,
701 			 * so if this fails (ENOTSUP) we'll continue on
702 			 * and try a regular unmount.
703 			 */
704 			if (is_remote_fstype(mnp->mnt_fstype, remote_fstypes)) {
705 				if (umount2(path, MS_FORCE) == 0)
706 					unmounted = B_TRUE;
707 			}
708 			/*
709 			 * Try forced unmount if we're stuck.
710 			 */
711 			if (stuck) {
712 				if (umount2(path, MS_FORCE) == 0) {
713 					unmounted = B_TRUE;
714 					stuck = B_FALSE;
715 				} else {
716 					/*
717 					 * The first failure indicates a
718 					 * mount we won't be able to get
719 					 * rid of automatically, so we
720 					 * bail.
721 					 */
722 					error++;
723 					zerror(zlogp, B_FALSE,
724 					    "unable to unmount '%s'", path);
725 					free_mnttable(mnts, nmnt);
726 					goto out;
727 				}
728 			}
729 			/*
730 			 * Try regular unmounts for everything else.
731 			 */
732 			if (!unmounted && umount2(path, 0) != 0)
733 				newcount++;
734 		}
735 		free_mnttable(mnts, nmnt);
736 
737 		if (newcount == 0)
738 			break;
739 		if (newcount >= oldcount) {
740 			/*
741 			 * Last round didn't unmount anything; we're stuck and
742 			 * should start trying forced unmounts.
743 			 */
744 			stuck = B_TRUE;
745 		}
746 		oldcount = newcount;
747 
748 		/*
749 		 * Autofs doesn't let you unmount its trigger nodes from
750 		 * userland so we have to tell the kernel to cleanup for us.
751 		 */
752 		if (autofs_cleanup(zoneid) != 0) {
753 			zerror(zlogp, B_TRUE, "unable to remove autofs nodes");
754 			error++;
755 			goto out;
756 		}
757 	}
758 
759 out:
760 	free_remote_fstypes(remote_fstypes);
761 	(void) fclose(mnttab);
762 	return (error ? -1 : 0);
763 }
764 
765 static int
766 fs_compare(const void *m1, const void *m2)
767 {
768 	struct zone_fstab *i = (struct zone_fstab *)m1;
769 	struct zone_fstab *j = (struct zone_fstab *)m2;
770 
771 	return (strcmp(i->zone_fs_dir, j->zone_fs_dir));
772 }
773 
774 /*
775  * Fork and exec (and wait for) the mentioned binary with the provided
776  * arguments.  Returns (-1) if something went wrong with fork(2) or exec(2),
777  * returns the exit status otherwise.
778  *
779  * If we were unable to exec the provided pathname (for whatever
780  * reason), we return the special token ZEXIT_EXEC.  The current value
781  * of ZEXIT_EXEC doesn't conflict with legitimate exit codes of the
782  * consumers of this function; any future consumers must make sure this
783  * remains the case.
784  */
785 static int
786 forkexec(zlog_t *zlogp, const char *path, char *const argv[])
787 {
788 	pid_t child_pid;
789 	int child_status = 0;
790 
791 	/*
792 	 * Do not let another thread localize a message while we are forking.
793 	 */
794 	(void) mutex_lock(&msglock);
795 	child_pid = fork();
796 	(void) mutex_unlock(&msglock);
797 	if (child_pid == -1) {
798 		zerror(zlogp, B_TRUE, "could not fork for %s", argv[0]);
799 		return (-1);
800 	} else if (child_pid == 0) {
801 		closefrom(0);
802 		/* redirect stdin, stdout & stderr to /dev/null */
803 		(void) open("/dev/null", O_RDONLY);	/* stdin */
804 		(void) open("/dev/null", O_WRONLY);	/* stdout */
805 		(void) open("/dev/null", O_WRONLY);	/* stderr */
806 		(void) execv(path, argv);
807 		/*
808 		 * Since we are in the child, there is no point calling zerror()
809 		 * since there is nobody waiting to consume it.  So exit with a
810 		 * special code that the parent will recognize and call zerror()
811 		 * accordingly.
812 		 */
813 
814 		_exit(ZEXIT_EXEC);
815 	} else {
816 		(void) waitpid(child_pid, &child_status, 0);
817 	}
818 
819 	if (WIFSIGNALED(child_status)) {
820 		zerror(zlogp, B_FALSE, "%s unexpectedly terminated due to "
821 		    "signal %d", path, WTERMSIG(child_status));
822 		return (-1);
823 	}
824 	assert(WIFEXITED(child_status));
825 	if (WEXITSTATUS(child_status) == ZEXIT_EXEC) {
826 		zerror(zlogp, B_FALSE, "failed to exec %s", path);
827 		return (-1);
828 	}
829 	return (WEXITSTATUS(child_status));
830 }
831 
832 static int
833 isregfile(const char *path)
834 {
835 	struct stat64 st;
836 
837 	if (stat64(path, &st) == -1)
838 		return (-1);
839 
840 	return (S_ISREG(st.st_mode));
841 }
842 
843 static int
844 dofsck(zlog_t *zlogp, const char *fstype, const char *rawdev)
845 {
846 	char cmdbuf[MAXPATHLEN];
847 	char *argv[5];
848 	int status;
849 
850 	/*
851 	 * We could alternatively have called /usr/sbin/fsck -F <fstype>, but
852 	 * that would cost us an extra fork/exec without buying us anything.
853 	 */
854 	if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/fsck", fstype)
855 	    >= sizeof (cmdbuf)) {
856 		zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
857 		return (-1);
858 	}
859 
860 	/*
861 	 * If it doesn't exist, that's OK: we verified this previously
862 	 * in zoneadm.
863 	 */
864 	if (isregfile(cmdbuf) == -1)
865 		return (0);
866 
867 	argv[0] = "fsck";
868 	argv[1] = "-o";
869 	argv[2] = "p";
870 	argv[3] = (char *)rawdev;
871 	argv[4] = NULL;
872 
873 	status = forkexec(zlogp, cmdbuf, argv);
874 	if (status == 0 || status == -1)
875 		return (status);
876 	zerror(zlogp, B_FALSE, "fsck of '%s' failed with exit status %d; "
877 	    "run fsck manually", rawdev, status);
878 	return (-1);
879 }
880 
881 static int
882 domount(zlog_t *zlogp, const char *fstype, const char *opts,
883     const char *special, const char *directory)
884 {
885 	char cmdbuf[MAXPATHLEN];
886 	char *argv[6];
887 	int status;
888 
889 	/*
890 	 * We could alternatively have called /usr/sbin/mount -F <fstype>, but
891 	 * that would cost us an extra fork/exec without buying us anything.
892 	 */
893 	if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/mount", fstype)
894 	    >= sizeof (cmdbuf)) {
895 		zerror(zlogp, B_FALSE, "file-system type %s too long", fstype);
896 		return (-1);
897 	}
898 	argv[0] = "mount";
899 	if (opts[0] == '\0') {
900 		argv[1] = (char *)special;
901 		argv[2] = (char *)directory;
902 		argv[3] = NULL;
903 	} else {
904 		argv[1] = "-o";
905 		argv[2] = (char *)opts;
906 		argv[3] = (char *)special;
907 		argv[4] = (char *)directory;
908 		argv[5] = NULL;
909 	}
910 
911 	status = forkexec(zlogp, cmdbuf, argv);
912 	if (status == 0 || status == -1)
913 		return (status);
914 	if (opts[0] == '\0')
915 		zerror(zlogp, B_FALSE, "\"%s %s %s\" "
916 		    "failed with exit code %d",
917 		    cmdbuf, special, directory, status);
918 	else
919 		zerror(zlogp, B_FALSE, "\"%s -o %s %s %s\" "
920 		    "failed with exit code %d",
921 		    cmdbuf, opts, special, directory, status);
922 	return (-1);
923 }
924 
925 /*
926  * Check if a given mount point path exists.
927  * If it does, make sure it doesn't contain any symlinks.
928  * Note that if "leaf" is false we're checking an intermediate
929  * component of the mount point path, so it must be a directory.
930  * If "leaf" is true, then we're checking the entire mount point
931  * path, so the mount point itself can be anything aside from a
932  * symbolic link.
933  *
934  * If the path is invalid then a negative value is returned.  If the
935  * path exists and is a valid mount point path then 0 is returned.
936  * If the path doesn't exist return a positive value.
937  */
938 static int
939 valid_mount_point(zlog_t *zlogp, const char *path, const boolean_t leaf)
940 {
941 	struct stat statbuf;
942 	char respath[MAXPATHLEN];
943 	int res;
944 
945 	if (lstat(path, &statbuf) != 0) {
946 		if (errno == ENOENT)
947 			return (1);
948 		zerror(zlogp, B_TRUE, "can't stat %s", path);
949 		return (-1);
950 	}
951 	if (S_ISLNK(statbuf.st_mode)) {
952 		zerror(zlogp, B_FALSE, "%s is a symlink", path);
953 		return (-1);
954 	}
955 	if (!leaf && !S_ISDIR(statbuf.st_mode)) {
956 		zerror(zlogp, B_FALSE, "%s is not a directory", path);
957 		return (-1);
958 	}
959 	if ((res = resolvepath(path, respath, sizeof (respath))) == -1) {
960 		zerror(zlogp, B_TRUE, "unable to resolve path %s", path);
961 		return (-1);
962 	}
963 	respath[res] = '\0';
964 	if (strcmp(path, respath) != 0) {
965 		/*
966 		 * We don't like ".."s, "."s, or "//"s throwing us off
967 		 */
968 		zerror(zlogp, B_FALSE, "%s is not a canonical path", path);
969 		return (-1);
970 	}
971 	return (0);
972 }
973 
974 /*
975  * Validate a mount point path.  A valid mount point path is an
976  * absolute path that either doesn't exist, or, if it does exists it
977  * must be an absolute canonical path that doesn't have any symbolic
978  * links in it.  The target of a mount point path can be any filesystem
979  * object.  (Different filesystems can support different mount points,
980  * for example "lofs" and "mntfs" both support files and directories
981  * while "ufs" just supports directories.)
982  *
983  * If the path is invalid then a negative value is returned.  If the
984  * path exists and is a valid mount point path then 0 is returned.
985  * If the path doesn't exist return a positive value.
986  */
987 int
988 valid_mount_path(zlog_t *zlogp, const char *rootpath, const char *spec,
989     const char *dir, const char *fstype)
990 {
991 	char abspath[MAXPATHLEN], *slashp, *slashp_next;
992 	int rv;
993 
994 	/*
995 	 * Sanity check the target mount point path.
996 	 * It must be a non-null string that starts with a '/'.
997 	 */
998 	if (dir[0] != '/') {
999 		/* Something went wrong. */
1000 		zerror(zlogp, B_FALSE, "invalid mount directory, "
1001 		    "type: \"%s\", special: \"%s\", dir: \"%s\"",
1002 		    fstype, spec, dir);
1003 		return (-1);
1004 	}
1005 
1006 	/*
1007 	 * Join rootpath and dir.  Make sure abspath ends with '/', this
1008 	 * is added to all paths (even non-directory paths) to allow us
1009 	 * to detect the end of paths below.  If the path already ends
1010 	 * in a '/', then that's ok too (although we'll fail the
1011 	 * cannonical path check in valid_mount_point()).
1012 	 */
1013 	if (snprintf(abspath, sizeof (abspath),
1014 	    "%s%s/", rootpath, dir) >= sizeof (abspath)) {
1015 		zerror(zlogp, B_FALSE, "pathname %s%s is too long",
1016 		    rootpath, dir);
1017 		return (-1);
1018 	}
1019 
1020 	/*
1021 	 * Starting with rootpath, verify the mount path one component
1022 	 * at a time.  Continue until we've evaluated all of abspath.
1023 	 */
1024 	slashp = &abspath[strlen(rootpath)];
1025 	assert(*slashp == '/');
1026 	do {
1027 		slashp_next = strchr(slashp + 1, '/');
1028 		*slashp = '\0';
1029 		if (slashp_next != NULL) {
1030 			/* This is an intermediary mount path component. */
1031 			rv = valid_mount_point(zlogp, abspath, B_FALSE);
1032 		} else {
1033 			/* This is the last component of the mount path. */
1034 			rv = valid_mount_point(zlogp, abspath, B_TRUE);
1035 		}
1036 		if (rv < 0)
1037 			return (rv);
1038 		*slashp = '/';
1039 	} while ((slashp = slashp_next) != NULL);
1040 	return (rv);
1041 }
1042 
1043 static int
1044 mount_one_dev_device_cb(void *arg, const char *match, const char *name)
1045 {
1046 	di_prof_t prof = arg;
1047 
1048 	if (name == NULL)
1049 		return (di_prof_add_dev(prof, match));
1050 	return (di_prof_add_map(prof, match, name));
1051 }
1052 
1053 static int
1054 mount_one_dev_symlink_cb(void *arg, const char *source, const char *target)
1055 {
1056 	di_prof_t prof = arg;
1057 
1058 	return (di_prof_add_symlink(prof, source, target));
1059 }
1060 
1061 int
1062 vplat_get_iptype(zlog_t *zlogp, zone_iptype_t *iptypep)
1063 {
1064 	zone_dochandle_t handle;
1065 
1066 	if ((handle = zonecfg_init_handle()) == NULL) {
1067 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
1068 		return (-1);
1069 	}
1070 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
1071 		zerror(zlogp, B_FALSE, "invalid configuration");
1072 		zonecfg_fini_handle(handle);
1073 		return (-1);
1074 	}
1075 	if (zonecfg_get_iptype(handle, iptypep) != Z_OK) {
1076 		zerror(zlogp, B_FALSE, "invalid ip-type configuration");
1077 		zonecfg_fini_handle(handle);
1078 		return (-1);
1079 	}
1080 	zonecfg_fini_handle(handle);
1081 	return (0);
1082 }
1083 
1084 /*
1085  * Apply the standard lists of devices/symlinks/mappings and the user-specified
1086  * list of devices (via zonecfg) to the /dev filesystem.  The filesystem will
1087  * use these as a profile/filter to determine what exists in /dev.
1088  */
1089 static int
1090 mount_one_dev(zlog_t *zlogp, char *devpath, zone_mnt_t mount_cmd)
1091 {
1092 	char			brand[MAXNAMELEN];
1093 	zone_dochandle_t	handle = NULL;
1094 	brand_handle_t		bh = NULL;
1095 	struct zone_devtab	ztab;
1096 	di_prof_t		prof = NULL;
1097 	int			err;
1098 	int			retval = -1;
1099 	zone_iptype_t		iptype;
1100 	const char 		*curr_iptype;
1101 
1102 	if (di_prof_init(devpath, &prof)) {
1103 		zerror(zlogp, B_TRUE, "failed to initialize profile");
1104 		goto cleanup;
1105 	}
1106 
1107 	/*
1108 	 * Get a handle to the brand info for this zone.
1109 	 * If we are mounting the zone, then we must always use the default
1110 	 * brand device mounts.
1111 	 */
1112 	if (ALT_MOUNT(mount_cmd)) {
1113 		(void) strlcpy(brand, default_brand, sizeof (brand));
1114 	} else {
1115 		(void) strlcpy(brand, brand_name, sizeof (brand));
1116 	}
1117 
1118 	if ((bh = brand_open(brand)) == NULL) {
1119 		zerror(zlogp, B_FALSE, "unable to determine zone brand");
1120 		goto cleanup;
1121 	}
1122 
1123 	if (vplat_get_iptype(zlogp, &iptype) < 0) {
1124 		zerror(zlogp, B_TRUE, "unable to determine ip-type");
1125 		goto cleanup;
1126 	}
1127 	switch (iptype) {
1128 	case ZS_SHARED:
1129 		curr_iptype = "shared";
1130 		break;
1131 	case ZS_EXCLUSIVE:
1132 		curr_iptype = "exclusive";
1133 		break;
1134 	}
1135 
1136 	if (brand_platform_iter_devices(bh, zone_name,
1137 	    mount_one_dev_device_cb, prof, curr_iptype) != 0) {
1138 		zerror(zlogp, B_TRUE, "failed to add standard device");
1139 		goto cleanup;
1140 	}
1141 
1142 	if (brand_platform_iter_link(bh,
1143 	    mount_one_dev_symlink_cb, prof) != 0) {
1144 		zerror(zlogp, B_TRUE, "failed to add standard symlink");
1145 		goto cleanup;
1146 	}
1147 
1148 	/* Add user-specified devices and directories */
1149 	if ((handle = zonecfg_init_handle()) == NULL) {
1150 		zerror(zlogp, B_FALSE, "can't initialize zone handle");
1151 		goto cleanup;
1152 	}
1153 	if (err = zonecfg_get_handle(zone_name, handle)) {
1154 		zerror(zlogp, B_FALSE, "can't get handle for zone "
1155 		    "%s: %s", zone_name, zonecfg_strerror(err));
1156 		goto cleanup;
1157 	}
1158 	if (err = zonecfg_setdevent(handle)) {
1159 		zerror(zlogp, B_FALSE, "%s: %s", zone_name,
1160 		    zonecfg_strerror(err));
1161 		goto cleanup;
1162 	}
1163 	while (zonecfg_getdevent(handle, &ztab) == Z_OK) {
1164 		if (di_prof_add_dev(prof, ztab.zone_dev_match)) {
1165 			zerror(zlogp, B_TRUE, "failed to add "
1166 			    "user-specified device");
1167 			goto cleanup;
1168 		}
1169 	}
1170 	(void) zonecfg_enddevent(handle);
1171 
1172 	/* Send profile to kernel */
1173 	if (di_prof_commit(prof)) {
1174 		zerror(zlogp, B_TRUE, "failed to commit profile");
1175 		goto cleanup;
1176 	}
1177 
1178 	retval = 0;
1179 
1180 cleanup:
1181 	if (bh != NULL)
1182 		brand_close(bh);
1183 	if (handle != NULL)
1184 		zonecfg_fini_handle(handle);
1185 	if (prof)
1186 		di_prof_fini(prof);
1187 	return (retval);
1188 }
1189 
1190 static int
1191 mount_one(zlog_t *zlogp, struct zone_fstab *fsptr, const char *rootpath,
1192     zone_mnt_t mount_cmd)
1193 {
1194 	char path[MAXPATHLEN];
1195 	char optstr[MAX_MNTOPT_STR];
1196 	zone_fsopt_t *optptr;
1197 	int rv;
1198 
1199 	if ((rv = valid_mount_path(zlogp, rootpath, fsptr->zone_fs_special,
1200 	    fsptr->zone_fs_dir, fsptr->zone_fs_type)) < 0) {
1201 		zerror(zlogp, B_FALSE, "%s%s is not a valid mount point",
1202 		    rootpath, fsptr->zone_fs_dir);
1203 		return (-1);
1204 	} else if (rv > 0) {
1205 		/* The mount point path doesn't exist, create it now. */
1206 		if (make_one_dir(zlogp, rootpath, fsptr->zone_fs_dir,
1207 		    DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
1208 		    DEFAULT_DIR_GROUP) != 0) {
1209 			zerror(zlogp, B_FALSE, "failed to create mount point");
1210 			return (-1);
1211 		}
1212 
1213 		/*
1214 		 * Now this might seem weird, but we need to invoke
1215 		 * valid_mount_path() again.  Why?  Because it checks
1216 		 * to make sure that the mount point path is canonical,
1217 		 * which it can only do if the path exists, so now that
1218 		 * we've created the path we have to verify it again.
1219 		 */
1220 		if ((rv = valid_mount_path(zlogp, rootpath,
1221 		    fsptr->zone_fs_special, fsptr->zone_fs_dir,
1222 		    fsptr->zone_fs_type)) < 0) {
1223 			zerror(zlogp, B_FALSE,
1224 			    "%s%s is not a valid mount point",
1225 			    rootpath, fsptr->zone_fs_dir);
1226 			return (-1);
1227 		}
1228 	}
1229 
1230 	(void) snprintf(path, sizeof (path), "%s%s", rootpath,
1231 	    fsptr->zone_fs_dir);
1232 
1233 	/*
1234 	 * In general the strategy here is to do just as much verification as
1235 	 * necessary to avoid crashing or otherwise doing something bad; if the
1236 	 * administrator initiated the operation via zoneadm(1m), he'll get
1237 	 * auto-verification which will let him know what's wrong.  If he
1238 	 * modifies the zone configuration of a running zone and doesn't attempt
1239 	 * to verify that it's OK we won't crash but won't bother trying to be
1240 	 * too helpful either.  zoneadm verify is only a couple keystrokes away.
1241 	 */
1242 	if (!zonecfg_valid_fs_type(fsptr->zone_fs_type)) {
1243 		zerror(zlogp, B_FALSE, "cannot mount %s on %s: "
1244 		    "invalid file-system type %s", fsptr->zone_fs_special,
1245 		    fsptr->zone_fs_dir, fsptr->zone_fs_type);
1246 		return (-1);
1247 	}
1248 
1249 	/*
1250 	 * If we're looking at an alternate root environment, then construct
1251 	 * read-only loopback mounts as necessary.  Note that any special
1252 	 * paths for lofs zone mounts in an alternate root must have
1253 	 * already been pre-pended with any alternate root path by the
1254 	 * time we get here.
1255 	 */
1256 	if (zonecfg_in_alt_root()) {
1257 		struct stat64 st;
1258 
1259 		if (stat64(fsptr->zone_fs_special, &st) != -1 &&
1260 		    S_ISBLK(st.st_mode)) {
1261 			/*
1262 			 * If we're going to mount a block device we need
1263 			 * to check if that device is already mounted
1264 			 * somewhere else, and if so, do a lofs mount
1265 			 * of the device instead of a direct mount
1266 			 */
1267 			if (check_lofs_needed(zlogp, fsptr) == -1)
1268 				return (-1);
1269 		} else if (strcmp(fsptr->zone_fs_type, MNTTYPE_LOFS) == 0) {
1270 			/*
1271 			 * For lofs mounts, the special node is inside the
1272 			 * alternate root.  We need lofs resolution for
1273 			 * this case in order to get at the underlying
1274 			 * read-write path.
1275 			 */
1276 			resolve_lofs(zlogp, fsptr->zone_fs_special,
1277 			    sizeof (fsptr->zone_fs_special));
1278 		}
1279 	}
1280 
1281 	/*
1282 	 * Run 'fsck -m' if there's a device to fsck.
1283 	 */
1284 	if (fsptr->zone_fs_raw[0] != '\0' &&
1285 	    dofsck(zlogp, fsptr->zone_fs_type, fsptr->zone_fs_raw) != 0) {
1286 		return (-1);
1287 	} else if (isregfile(fsptr->zone_fs_special) == 1 &&
1288 	    dofsck(zlogp, fsptr->zone_fs_type, fsptr->zone_fs_special) != 0) {
1289 		return (-1);
1290 	}
1291 
1292 	/*
1293 	 * Build up mount option string.
1294 	 */
1295 	optstr[0] = '\0';
1296 	if (fsptr->zone_fs_options != NULL) {
1297 		(void) strlcpy(optstr, fsptr->zone_fs_options->zone_fsopt_opt,
1298 		    sizeof (optstr));
1299 		for (optptr = fsptr->zone_fs_options->zone_fsopt_next;
1300 		    optptr != NULL; optptr = optptr->zone_fsopt_next) {
1301 			(void) strlcat(optstr, ",", sizeof (optstr));
1302 			(void) strlcat(optstr, optptr->zone_fsopt_opt,
1303 			    sizeof (optstr));
1304 		}
1305 	}
1306 
1307 	if ((rv = domount(zlogp, fsptr->zone_fs_type, optstr,
1308 	    fsptr->zone_fs_special, path)) != 0)
1309 		return (rv);
1310 
1311 	/*
1312 	 * The mount succeeded.  If this was not a mount of /dev then
1313 	 * we're done.
1314 	 */
1315 	if (strcmp(fsptr->zone_fs_type, MNTTYPE_DEV) != 0)
1316 		return (0);
1317 
1318 	/*
1319 	 * We just mounted an instance of a /dev filesystem, so now we
1320 	 * need to configure it.
1321 	 */
1322 	return (mount_one_dev(zlogp, path, mount_cmd));
1323 }
1324 
1325 static void
1326 free_fs_data(struct zone_fstab *fsarray, uint_t nelem)
1327 {
1328 	uint_t i;
1329 
1330 	if (fsarray == NULL)
1331 		return;
1332 	for (i = 0; i < nelem; i++)
1333 		zonecfg_free_fs_option_list(fsarray[i].zone_fs_options);
1334 	free(fsarray);
1335 }
1336 
1337 /*
1338  * This function initiates the creation of a small Solaris Environment for
1339  * scratch zone. The Environment creation process is split up into two
1340  * functions(build_mounted_pre_var() and build_mounted_post_var()). It
1341  * is done this way because:
1342  * 	We need to have both /etc and /var in the root of the scratchzone.
1343  * 	We loopback mount zone's own /etc and /var into the root of the
1344  * 	scratch zone. Unlike /etc, /var can be a seperate filesystem. So we
1345  * 	need to delay the mount of /var till the zone's root gets populated.
1346  *	So mounting of localdirs[](/etc and /var) have been moved to the
1347  * 	build_mounted_post_var() which gets called only after the zone
1348  * 	specific filesystems are mounted.
1349  *
1350  * Note that the scratch zone we set up for updating the zone (Z_MNT_UPDATE)
1351  * does not loopback mount the zone's own /etc and /var into the root of the
1352  * scratch zone.
1353  */
1354 static boolean_t
1355 build_mounted_pre_var(zlog_t *zlogp, char *rootpath,
1356     size_t rootlen, const char *zonepath, char *luroot, size_t lurootlen)
1357 {
1358 	char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1359 	const char **cpp;
1360 	static const char *mkdirs[] = {
1361 		"/system", "/system/contract", "/system/object", "/proc",
1362 		"/dev", "/tmp", "/a", NULL
1363 	};
1364 	char *altstr;
1365 	FILE *fp;
1366 	uuid_t uuid;
1367 
1368 	resolve_lofs(zlogp, rootpath, rootlen);
1369 	(void) snprintf(luroot, lurootlen, "%s/lu", zonepath);
1370 	resolve_lofs(zlogp, luroot, lurootlen);
1371 	(void) snprintf(tmp, sizeof (tmp), "%s/bin", luroot);
1372 	(void) symlink("./usr/bin", tmp);
1373 
1374 	/*
1375 	 * These are mostly special mount points; not handled here.  (See
1376 	 * zone_mount_early.)
1377 	 */
1378 	for (cpp = mkdirs; *cpp != NULL; cpp++) {
1379 		(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1380 		if (mkdir(tmp, 0755) != 0) {
1381 			zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1382 			return (B_FALSE);
1383 		}
1384 	}
1385 	/*
1386 	 * This is here to support lucopy.  If there's an instance of this same
1387 	 * zone on the current running system, then we mount its root up as
1388 	 * read-only inside the scratch zone.
1389 	 */
1390 	(void) zonecfg_get_uuid(zone_name, uuid);
1391 	altstr = strdup(zonecfg_get_root());
1392 	if (altstr == NULL) {
1393 		zerror(zlogp, B_TRUE, "memory allocation failed");
1394 		return (B_FALSE);
1395 	}
1396 	zonecfg_set_root("");
1397 	(void) strlcpy(tmp, zone_name, sizeof (tmp));
1398 	(void) zonecfg_get_name_by_uuid(uuid, tmp, sizeof (tmp));
1399 	if (zone_get_rootpath(tmp, fromdir, sizeof (fromdir)) == Z_OK &&
1400 	    strcmp(fromdir, rootpath) != 0) {
1401 		(void) snprintf(tmp, sizeof (tmp), "%s/b", luroot);
1402 		if (mkdir(tmp, 0755) != 0) {
1403 			zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1404 			return (B_FALSE);
1405 		}
1406 		if (domount(zlogp, MNTTYPE_LOFS, RESOURCE_DEFAULT_OPTS, fromdir,
1407 		    tmp) != 0) {
1408 			zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1409 			    fromdir);
1410 			return (B_FALSE);
1411 		}
1412 	}
1413 	zonecfg_set_root(altstr);
1414 	free(altstr);
1415 
1416 	if ((fp = zonecfg_open_scratch(luroot, B_TRUE)) == NULL) {
1417 		zerror(zlogp, B_TRUE, "cannot open zone mapfile");
1418 		return (B_FALSE);
1419 	}
1420 	(void) ftruncate(fileno(fp), 0);
1421 	if (zonecfg_add_scratch(fp, zone_name, kernzone, "/") == -1) {
1422 		zerror(zlogp, B_TRUE, "cannot add zone mapfile entry");
1423 	}
1424 	zonecfg_close_scratch(fp);
1425 	(void) snprintf(tmp, sizeof (tmp), "%s/a", luroot);
1426 	if (domount(zlogp, MNTTYPE_LOFS, "", rootpath, tmp) != 0)
1427 		return (B_FALSE);
1428 	(void) strlcpy(rootpath, tmp, rootlen);
1429 	return (B_TRUE);
1430 }
1431 
1432 
1433 static boolean_t
1434 build_mounted_post_var(zlog_t *zlogp, zone_mnt_t mount_cmd, char *rootpath,
1435     const char *luroot)
1436 {
1437 	char tmp[MAXPATHLEN], fromdir[MAXPATHLEN];
1438 	const char **cpp;
1439 	const char **loopdirs;
1440 	const char **tmpdirs;
1441 	static const char *localdirs[] = {
1442 		"/etc", "/var", NULL
1443 	};
1444 	static const char *scr_loopdirs[] = {
1445 		"/etc/lib", "/etc/fs", "/lib", "/sbin", "/platform",
1446 		"/usr", NULL
1447 	};
1448 	static const char *upd_loopdirs[] = {
1449 		"/etc", "/kernel", "/lib", "/opt", "/platform", "/sbin",
1450 		"/usr", "/var", NULL
1451 	};
1452 	static const char *scr_tmpdirs[] = {
1453 		"/tmp", "/var/run", NULL
1454 	};
1455 	static const char *upd_tmpdirs[] = {
1456 		"/tmp", "/var/run", "/var/tmp", NULL
1457 	};
1458 	struct stat st;
1459 
1460 	if (mount_cmd == Z_MNT_SCRATCH) {
1461 		/*
1462 		 * These are mounted read-write from the zone undergoing
1463 		 * upgrade.  We must be careful not to 'leak' things from the
1464 		 * main system into the zone, and this accomplishes that goal.
1465 		 */
1466 		for (cpp = localdirs; *cpp != NULL; cpp++) {
1467 			(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot,
1468 			    *cpp);
1469 			(void) snprintf(fromdir, sizeof (fromdir), "%s%s",
1470 			    rootpath, *cpp);
1471 			if (mkdir(tmp, 0755) != 0) {
1472 				zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1473 				return (B_FALSE);
1474 			}
1475 			if (domount(zlogp, MNTTYPE_LOFS, "", fromdir, tmp)
1476 			    != 0) {
1477 				zerror(zlogp, B_TRUE, "cannot mount %s on %s",
1478 				    tmp, *cpp);
1479 				return (B_FALSE);
1480 			}
1481 		}
1482 	}
1483 
1484 	if (mount_cmd == Z_MNT_UPDATE)
1485 		loopdirs = upd_loopdirs;
1486 	else
1487 		loopdirs = scr_loopdirs;
1488 
1489 	/*
1490 	 * These are things mounted read-only from the running system because
1491 	 * they contain binaries that must match system.
1492 	 */
1493 	for (cpp = loopdirs; *cpp != NULL; cpp++) {
1494 		(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1495 		if (mkdir(tmp, 0755) != 0) {
1496 			if (errno != EEXIST) {
1497 				zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1498 				return (B_FALSE);
1499 			}
1500 			if (lstat(tmp, &st) != 0) {
1501 				zerror(zlogp, B_TRUE, "cannot stat %s", tmp);
1502 				return (B_FALSE);
1503 			}
1504 			/*
1505 			 * Ignore any non-directories encountered.  These are
1506 			 * things that have been converted into symlinks
1507 			 * (/etc/fs and /etc/lib) and no longer need a lofs
1508 			 * fixup.
1509 			 */
1510 			if (!S_ISDIR(st.st_mode))
1511 				continue;
1512 		}
1513 		if (domount(zlogp, MNTTYPE_LOFS, RESOURCE_DEFAULT_OPTS, *cpp,
1514 		    tmp) != 0) {
1515 			zerror(zlogp, B_TRUE, "cannot mount %s on %s", tmp,
1516 			    *cpp);
1517 			return (B_FALSE);
1518 		}
1519 	}
1520 
1521 	if (mount_cmd == Z_MNT_UPDATE)
1522 		tmpdirs = upd_tmpdirs;
1523 	else
1524 		tmpdirs = scr_tmpdirs;
1525 
1526 	/*
1527 	 * These are things with tmpfs mounted inside.
1528 	 */
1529 	for (cpp = tmpdirs; *cpp != NULL; cpp++) {
1530 		(void) snprintf(tmp, sizeof (tmp), "%s%s", luroot, *cpp);
1531 		if (mount_cmd == Z_MNT_SCRATCH && mkdir(tmp, 0755) != 0 &&
1532 		    errno != EEXIST) {
1533 			zerror(zlogp, B_TRUE, "cannot create %s", tmp);
1534 			return (B_FALSE);
1535 		}
1536 
1537 		/*
1538 		 * We could set the mode for /tmp when we do the mkdir but
1539 		 * since that can be modified by the umask we will just set
1540 		 * the correct mode for /tmp now.
1541 		 */
1542 		if (strcmp(*cpp, "/tmp") == 0 && chmod(tmp, 01777) != 0) {
1543 			zerror(zlogp, B_TRUE, "cannot chmod %s", tmp);
1544 			return (B_FALSE);
1545 		}
1546 
1547 		if (domount(zlogp, MNTTYPE_TMPFS, "", "swap", tmp) != 0) {
1548 			zerror(zlogp, B_TRUE, "cannot mount swap on %s", *cpp);
1549 			return (B_FALSE);
1550 		}
1551 	}
1552 	return (B_TRUE);
1553 }
1554 
1555 typedef struct plat_gmount_cb_data {
1556 	zlog_t			*pgcd_zlogp;
1557 	struct zone_fstab	**pgcd_fs_tab;
1558 	int			*pgcd_num_fs;
1559 } plat_gmount_cb_data_t;
1560 
1561 /*
1562  * plat_gmount_cb() is a callback function invoked by libbrand to iterate
1563  * through all global brand platform mounts.
1564  */
1565 int
1566 plat_gmount_cb(void *data, const char *spec, const char *dir,
1567     const char *fstype, const char *opt)
1568 {
1569 	plat_gmount_cb_data_t	*cp = data;
1570 	zlog_t			*zlogp = cp->pgcd_zlogp;
1571 	struct zone_fstab	*fs_ptr = *cp->pgcd_fs_tab;
1572 	int			num_fs = *cp->pgcd_num_fs;
1573 	struct zone_fstab	*fsp, *tmp_ptr;
1574 
1575 	num_fs++;
1576 	if ((tmp_ptr = realloc(fs_ptr, num_fs * sizeof (*tmp_ptr))) == NULL) {
1577 		zerror(zlogp, B_TRUE, "memory allocation failed");
1578 		return (-1);
1579 	}
1580 
1581 	fs_ptr = tmp_ptr;
1582 	fsp = &fs_ptr[num_fs - 1];
1583 
1584 	/* update the callback struct passed in */
1585 	*cp->pgcd_fs_tab = fs_ptr;
1586 	*cp->pgcd_num_fs = num_fs;
1587 
1588 	fsp->zone_fs_raw[0] = '\0';
1589 	(void) strlcpy(fsp->zone_fs_special, spec,
1590 	    sizeof (fsp->zone_fs_special));
1591 	(void) strlcpy(fsp->zone_fs_dir, dir, sizeof (fsp->zone_fs_dir));
1592 	(void) strlcpy(fsp->zone_fs_type, fstype, sizeof (fsp->zone_fs_type));
1593 	fsp->zone_fs_options = NULL;
1594 	if ((opt != NULL) &&
1595 	    (zonecfg_add_fs_option(fsp, (char *)opt) != Z_OK)) {
1596 		zerror(zlogp, B_FALSE, "error adding property");
1597 		return (-1);
1598 	}
1599 
1600 	return (0);
1601 }
1602 
1603 static int
1604 mount_filesystems_fsent(zone_dochandle_t handle, zlog_t *zlogp,
1605     struct zone_fstab **fs_tabp, int *num_fsp, zone_mnt_t mount_cmd)
1606 {
1607 	struct zone_fstab *tmp_ptr, *fs_ptr, *fsp, fstab;
1608 	int num_fs;
1609 
1610 	num_fs = *num_fsp;
1611 	fs_ptr = *fs_tabp;
1612 
1613 	if (zonecfg_setfsent(handle) != Z_OK) {
1614 		zerror(zlogp, B_FALSE, "invalid configuration");
1615 		return (-1);
1616 	}
1617 	while (zonecfg_getfsent(handle, &fstab) == Z_OK) {
1618 		/*
1619 		 * ZFS filesystems will not be accessible under an alternate
1620 		 * root, since the pool will not be known.  Ignore them in this
1621 		 * case.
1622 		 */
1623 		if (ALT_MOUNT(mount_cmd) &&
1624 		    strcmp(fstab.zone_fs_type, MNTTYPE_ZFS) == 0)
1625 			continue;
1626 
1627 		num_fs++;
1628 		if ((tmp_ptr = realloc(fs_ptr,
1629 		    num_fs * sizeof (*tmp_ptr))) == NULL) {
1630 			zerror(zlogp, B_TRUE, "memory allocation failed");
1631 			(void) zonecfg_endfsent(handle);
1632 			return (-1);
1633 		}
1634 		/* update the pointers passed in */
1635 		*fs_tabp = tmp_ptr;
1636 		*num_fsp = num_fs;
1637 
1638 		fs_ptr = tmp_ptr;
1639 		fsp = &fs_ptr[num_fs - 1];
1640 		(void) strlcpy(fsp->zone_fs_dir,
1641 		    fstab.zone_fs_dir, sizeof (fsp->zone_fs_dir));
1642 		(void) strlcpy(fsp->zone_fs_raw, fstab.zone_fs_raw,
1643 		    sizeof (fsp->zone_fs_raw));
1644 		(void) strlcpy(fsp->zone_fs_type, fstab.zone_fs_type,
1645 		    sizeof (fsp->zone_fs_type));
1646 		fsp->zone_fs_options = fstab.zone_fs_options;
1647 
1648 		/*
1649 		 * For all lofs mounts, make sure that the 'special'
1650 		 * entry points inside the alternate root.  The
1651 		 * source path for a lofs mount in a given zone needs
1652 		 * to be relative to the root of the boot environment
1653 		 * that contains the zone.  Note that we don't do this
1654 		 * for non-lofs mounts since they will have a device
1655 		 * as a backing store and device paths must always be
1656 		 * specified relative to the current boot environment.
1657 		 */
1658 		fsp->zone_fs_special[0] = '\0';
1659 		if (strcmp(fsp->zone_fs_type, MNTTYPE_LOFS) == 0) {
1660 			(void) strlcat(fsp->zone_fs_special, zonecfg_get_root(),
1661 			    sizeof (fsp->zone_fs_special));
1662 		}
1663 		(void) strlcat(fsp->zone_fs_special, fstab.zone_fs_special,
1664 		    sizeof (fsp->zone_fs_special));
1665 	}
1666 	(void) zonecfg_endfsent(handle);
1667 	return (0);
1668 }
1669 
1670 static int
1671 mount_filesystems(zlog_t *zlogp, zone_mnt_t mount_cmd)
1672 {
1673 	char rootpath[MAXPATHLEN];
1674 	char zonepath[MAXPATHLEN];
1675 	char brand[MAXNAMELEN];
1676 	char luroot[MAXPATHLEN];
1677 	int i, num_fs = 0;
1678 	struct zone_fstab *fs_ptr = NULL;
1679 	zone_dochandle_t handle = NULL;
1680 	zone_state_t zstate;
1681 	brand_handle_t bh;
1682 	plat_gmount_cb_data_t cb;
1683 
1684 	if (zone_get_state(zone_name, &zstate) != Z_OK ||
1685 	    (zstate != ZONE_STATE_READY && zstate != ZONE_STATE_MOUNTED)) {
1686 		zerror(zlogp, B_FALSE,
1687 		    "zone must be in '%s' or '%s' state to mount file-systems",
1688 		    zone_state_str(ZONE_STATE_READY),
1689 		    zone_state_str(ZONE_STATE_MOUNTED));
1690 		goto bad;
1691 	}
1692 
1693 	if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
1694 		zerror(zlogp, B_TRUE, "unable to determine zone path");
1695 		goto bad;
1696 	}
1697 
1698 	if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
1699 		zerror(zlogp, B_TRUE, "unable to determine zone root");
1700 		goto bad;
1701 	}
1702 
1703 	if ((handle = zonecfg_init_handle()) == NULL) {
1704 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
1705 		goto bad;
1706 	}
1707 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK ||
1708 	    zonecfg_setfsent(handle) != Z_OK) {
1709 		zerror(zlogp, B_FALSE, "invalid configuration");
1710 		goto bad;
1711 	}
1712 
1713 	/*
1714 	 * If we are mounting the zone, then we must always use the default
1715 	 * brand global mounts.
1716 	 */
1717 	if (ALT_MOUNT(mount_cmd)) {
1718 		(void) strlcpy(brand, default_brand, sizeof (brand));
1719 	} else {
1720 		(void) strlcpy(brand, brand_name, sizeof (brand));
1721 	}
1722 
1723 	/* Get a handle to the brand info for this zone */
1724 	if ((bh = brand_open(brand)) == NULL) {
1725 		zerror(zlogp, B_FALSE, "unable to determine zone brand");
1726 		zonecfg_fini_handle(handle);
1727 		return (-1);
1728 	}
1729 
1730 	/*
1731 	 * Get the list of global filesystems to mount from the brand
1732 	 * configuration.
1733 	 */
1734 	cb.pgcd_zlogp = zlogp;
1735 	cb.pgcd_fs_tab = &fs_ptr;
1736 	cb.pgcd_num_fs = &num_fs;
1737 	if (brand_platform_iter_gmounts(bh, zonepath,
1738 	    plat_gmount_cb, &cb) != 0) {
1739 		zerror(zlogp, B_FALSE, "unable to mount filesystems");
1740 		brand_close(bh);
1741 		zonecfg_fini_handle(handle);
1742 		return (-1);
1743 	}
1744 	brand_close(bh);
1745 
1746 	/*
1747 	 * Iterate through the rest of the filesystems. Sort them all,
1748 	 * then mount them in sorted order. This is to make sure the
1749 	 * higher level directories (e.g., /usr) get mounted before
1750 	 * any beneath them (e.g., /usr/local).
1751 	 */
1752 	if (mount_filesystems_fsent(handle, zlogp, &fs_ptr, &num_fs,
1753 	    mount_cmd) != 0)
1754 		goto bad;
1755 
1756 	zonecfg_fini_handle(handle);
1757 	handle = NULL;
1758 
1759 	/*
1760 	 * Normally when we mount a zone all the zone filesystems
1761 	 * get mounted relative to rootpath, which is usually
1762 	 * <zonepath>/root.  But when mounting a zone for administration
1763 	 * purposes via the zone "mount" state, build_mounted_pre_var()
1764 	 * updates rootpath to be <zonepath>/lu/a so we'll mount all
1765 	 * the zones filesystems there instead.
1766 	 *
1767 	 * build_mounted_pre_var() and build_mounted_post_var() will
1768 	 * also do some extra work to create directories and lofs mount
1769 	 * a bunch of global zone file system paths into <zonepath>/lu.
1770 	 *
1771 	 * This allows us to be able to enter the zone (now rooted at
1772 	 * <zonepath>/lu) and run the upgrade/patch tools that are in the
1773 	 * global zone and have them upgrade the to-be-modified zone's
1774 	 * files mounted on /a.  (Which mirrors the existing standard
1775 	 * upgrade environment.)
1776 	 *
1777 	 * There is of course one catch.  When doing the upgrade
1778 	 * we need <zoneroot>/lu/dev to be the /dev filesystem
1779 	 * for the zone and we don't want to have any /dev filesystem
1780 	 * mounted at <zoneroot>/lu/a/dev.  Since /dev is specified
1781 	 * as a normal zone filesystem by default we'll try to mount
1782 	 * it at <zoneroot>/lu/a/dev, so we have to detect this
1783 	 * case and instead mount it at <zoneroot>/lu/dev.
1784 	 *
1785 	 * All this work is done in three phases:
1786 	 *   1) Create and populate lu directory (build_mounted_pre_var()).
1787 	 *   2) Mount the required filesystems as per the zone configuration.
1788 	 *   3) Set up the rest of the scratch zone environment
1789 	 *	(build_mounted_post_var()).
1790 	 */
1791 	if (ALT_MOUNT(mount_cmd) && !build_mounted_pre_var(zlogp,
1792 	    rootpath, sizeof (rootpath), zonepath, luroot, sizeof (luroot)))
1793 		goto bad;
1794 
1795 	qsort(fs_ptr, num_fs, sizeof (*fs_ptr), fs_compare);
1796 
1797 	for (i = 0; i < num_fs; i++) {
1798 		if (ALT_MOUNT(mount_cmd) &&
1799 		    strcmp(fs_ptr[i].zone_fs_dir, "/dev") == 0) {
1800 			size_t slen = strlen(rootpath) - 2;
1801 
1802 			/*
1803 			 * By default we'll try to mount /dev as /a/dev
1804 			 * but /dev is special and always goes at the top
1805 			 * so strip the trailing '/a' from the rootpath.
1806 			 */
1807 			assert(strcmp(&rootpath[slen], "/a") == 0);
1808 			rootpath[slen] = '\0';
1809 			if (mount_one(zlogp, &fs_ptr[i], rootpath, mount_cmd)
1810 			    != 0)
1811 				goto bad;
1812 			rootpath[slen] = '/';
1813 			continue;
1814 		}
1815 		if (mount_one(zlogp, &fs_ptr[i], rootpath, mount_cmd) != 0)
1816 			goto bad;
1817 	}
1818 	if (ALT_MOUNT(mount_cmd) &&
1819 	    !build_mounted_post_var(zlogp, mount_cmd, rootpath, luroot))
1820 		goto bad;
1821 
1822 	/*
1823 	 * For Trusted Extensions cross-mount each lower level /export/home
1824 	 */
1825 	if (mount_cmd == Z_MNT_BOOT &&
1826 	    tsol_mounts(zlogp, zone_name, rootpath) != 0)
1827 		goto bad;
1828 
1829 	free_fs_data(fs_ptr, num_fs);
1830 
1831 	/*
1832 	 * Everything looks fine.
1833 	 */
1834 	return (0);
1835 
1836 bad:
1837 	if (handle != NULL)
1838 		zonecfg_fini_handle(handle);
1839 	free_fs_data(fs_ptr, num_fs);
1840 	return (-1);
1841 }
1842 
1843 /* caller makes sure neither parameter is NULL */
1844 static int
1845 addr2netmask(char *prefixstr, int maxprefixlen, uchar_t *maskstr)
1846 {
1847 	int prefixlen;
1848 
1849 	prefixlen = atoi(prefixstr);
1850 	if (prefixlen < 0 || prefixlen > maxprefixlen)
1851 		return (1);
1852 	while (prefixlen > 0) {
1853 		if (prefixlen >= 8) {
1854 			*maskstr++ = 0xFF;
1855 			prefixlen -= 8;
1856 			continue;
1857 		}
1858 		*maskstr |= 1 << (8 - prefixlen);
1859 		prefixlen--;
1860 	}
1861 	return (0);
1862 }
1863 
1864 /*
1865  * Tear down all interfaces belonging to the given zone.  This should
1866  * be called with the zone in a state other than "running", so that
1867  * interfaces can't be assigned to the zone after this returns.
1868  *
1869  * If anything goes wrong, log an error message and return an error.
1870  */
1871 static int
1872 unconfigure_shared_network_interfaces(zlog_t *zlogp, zoneid_t zone_id)
1873 {
1874 	struct lifnum lifn;
1875 	struct lifconf lifc;
1876 	struct lifreq *lifrp, lifrl;
1877 	int64_t lifc_flags = LIFC_NOXMIT | LIFC_ALLZONES;
1878 	int num_ifs, s, i, ret_code = 0;
1879 	uint_t bufsize;
1880 	char *buf = NULL;
1881 
1882 	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
1883 		zerror(zlogp, B_TRUE, "could not get socket");
1884 		ret_code = -1;
1885 		goto bad;
1886 	}
1887 	lifn.lifn_family = AF_UNSPEC;
1888 	lifn.lifn_flags = (int)lifc_flags;
1889 	if (ioctl(s, SIOCGLIFNUM, (char *)&lifn) < 0) {
1890 		zerror(zlogp, B_TRUE,
1891 		    "could not determine number of network interfaces");
1892 		ret_code = -1;
1893 		goto bad;
1894 	}
1895 	num_ifs = lifn.lifn_count;
1896 	bufsize = num_ifs * sizeof (struct lifreq);
1897 	if ((buf = malloc(bufsize)) == NULL) {
1898 		zerror(zlogp, B_TRUE, "memory allocation failed");
1899 		ret_code = -1;
1900 		goto bad;
1901 	}
1902 	lifc.lifc_family = AF_UNSPEC;
1903 	lifc.lifc_flags = (int)lifc_flags;
1904 	lifc.lifc_len = bufsize;
1905 	lifc.lifc_buf = buf;
1906 	if (ioctl(s, SIOCGLIFCONF, (char *)&lifc) < 0) {
1907 		zerror(zlogp, B_TRUE, "could not get configured network "
1908 		    "interfaces");
1909 		ret_code = -1;
1910 		goto bad;
1911 	}
1912 	lifrp = lifc.lifc_req;
1913 	for (i = lifc.lifc_len / sizeof (struct lifreq); i > 0; i--, lifrp++) {
1914 		(void) close(s);
1915 		if ((s = socket(lifrp->lifr_addr.ss_family, SOCK_DGRAM, 0)) <
1916 		    0) {
1917 			zerror(zlogp, B_TRUE, "%s: could not get socket",
1918 			    lifrl.lifr_name);
1919 			ret_code = -1;
1920 			continue;
1921 		}
1922 		(void) memset(&lifrl, 0, sizeof (lifrl));
1923 		(void) strncpy(lifrl.lifr_name, lifrp->lifr_name,
1924 		    sizeof (lifrl.lifr_name));
1925 		if (ioctl(s, SIOCGLIFZONE, (caddr_t)&lifrl) < 0) {
1926 			if (errno == ENXIO)
1927 				/*
1928 				 * Interface may have been removed by admin or
1929 				 * another zone halting.
1930 				 */
1931 				continue;
1932 			zerror(zlogp, B_TRUE,
1933 			    "%s: could not determine the zone to which this "
1934 			    "network interface is bound", lifrl.lifr_name);
1935 			ret_code = -1;
1936 			continue;
1937 		}
1938 		if (lifrl.lifr_zoneid == zone_id) {
1939 			if (ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifrl) < 0) {
1940 				zerror(zlogp, B_TRUE,
1941 				    "%s: could not remove network interface",
1942 				    lifrl.lifr_name);
1943 				ret_code = -1;
1944 				continue;
1945 			}
1946 		}
1947 	}
1948 bad:
1949 	if (s > 0)
1950 		(void) close(s);
1951 	if (buf)
1952 		free(buf);
1953 	return (ret_code);
1954 }
1955 
1956 static union	sockunion {
1957 	struct	sockaddr sa;
1958 	struct	sockaddr_in sin;
1959 	struct	sockaddr_dl sdl;
1960 	struct	sockaddr_in6 sin6;
1961 } so_dst, so_ifp;
1962 
1963 static struct {
1964 	struct	rt_msghdr hdr;
1965 	char	space[512];
1966 } rtmsg;
1967 
1968 static int
1969 salen(struct sockaddr *sa)
1970 {
1971 	switch (sa->sa_family) {
1972 	case AF_INET:
1973 		return (sizeof (struct sockaddr_in));
1974 	case AF_LINK:
1975 		return (sizeof (struct sockaddr_dl));
1976 	case AF_INET6:
1977 		return (sizeof (struct sockaddr_in6));
1978 	default:
1979 		return (sizeof (struct sockaddr));
1980 	}
1981 }
1982 
1983 #define	ROUNDUP_LONG(a) \
1984 	((a) > 0 ? (1 + (((a) - 1) | (sizeof (long) - 1))) : sizeof (long))
1985 
1986 /*
1987  * Look up which zone is using a given IP address.  The address in question
1988  * is expected to have been stuffed into the structure to which lifr points
1989  * via a previous SIOCGLIFADDR ioctl().
1990  *
1991  * This is done using black router socket magic.
1992  *
1993  * Return the name of the zone on success or NULL on failure.
1994  *
1995  * This is a lot of code for a simple task; a new ioctl request to take care
1996  * of this might be a useful RFE.
1997  */
1998 
1999 static char *
2000 who_is_using(zlog_t *zlogp, struct lifreq *lifr)
2001 {
2002 	static char answer[ZONENAME_MAX];
2003 	pid_t pid;
2004 	int s, rlen, l, i;
2005 	char *cp = rtmsg.space;
2006 	struct sockaddr_dl *ifp = NULL;
2007 	struct sockaddr *sa;
2008 	char save_if_name[LIFNAMSIZ];
2009 
2010 	answer[0] = '\0';
2011 
2012 	pid = getpid();
2013 	if ((s = socket(PF_ROUTE, SOCK_RAW, 0)) < 0) {
2014 		zerror(zlogp, B_TRUE, "could not get routing socket");
2015 		return (NULL);
2016 	}
2017 
2018 	if (lifr->lifr_addr.ss_family == AF_INET) {
2019 		struct sockaddr_in *sin4;
2020 
2021 		so_dst.sa.sa_family = AF_INET;
2022 		sin4 = (struct sockaddr_in *)&lifr->lifr_addr;
2023 		so_dst.sin.sin_addr = sin4->sin_addr;
2024 	} else {
2025 		struct sockaddr_in6 *sin6;
2026 
2027 		so_dst.sa.sa_family = AF_INET6;
2028 		sin6 = (struct sockaddr_in6 *)&lifr->lifr_addr;
2029 		so_dst.sin6.sin6_addr = sin6->sin6_addr;
2030 	}
2031 
2032 	so_ifp.sa.sa_family = AF_LINK;
2033 
2034 	(void) memset(&rtmsg, 0, sizeof (rtmsg));
2035 	rtmsg.hdr.rtm_type = RTM_GET;
2036 	rtmsg.hdr.rtm_flags = RTF_UP | RTF_HOST;
2037 	rtmsg.hdr.rtm_version = RTM_VERSION;
2038 	rtmsg.hdr.rtm_seq = ++rts_seqno;
2039 	rtmsg.hdr.rtm_addrs = RTA_IFP | RTA_DST;
2040 
2041 	l = ROUNDUP_LONG(salen(&so_dst.sa));
2042 	(void) memmove(cp, &(so_dst), l);
2043 	cp += l;
2044 	l = ROUNDUP_LONG(salen(&so_ifp.sa));
2045 	(void) memmove(cp, &(so_ifp), l);
2046 	cp += l;
2047 
2048 	rtmsg.hdr.rtm_msglen = l = cp - (char *)&rtmsg;
2049 
2050 	if ((rlen = write(s, &rtmsg, l)) < 0) {
2051 		zerror(zlogp, B_TRUE, "writing to routing socket");
2052 		return (NULL);
2053 	} else if (rlen < (int)rtmsg.hdr.rtm_msglen) {
2054 		zerror(zlogp, B_TRUE,
2055 		    "write to routing socket got only %d for len\n", rlen);
2056 		return (NULL);
2057 	}
2058 	do {
2059 		l = read(s, &rtmsg, sizeof (rtmsg));
2060 	} while (l > 0 && (rtmsg.hdr.rtm_seq != rts_seqno ||
2061 	    rtmsg.hdr.rtm_pid != pid));
2062 	if (l < 0) {
2063 		zerror(zlogp, B_TRUE, "reading from routing socket");
2064 		return (NULL);
2065 	}
2066 
2067 	if (rtmsg.hdr.rtm_version != RTM_VERSION) {
2068 		zerror(zlogp, B_FALSE,
2069 		    "routing message version %d not understood",
2070 		    rtmsg.hdr.rtm_version);
2071 		return (NULL);
2072 	}
2073 	if (rtmsg.hdr.rtm_msglen != (ushort_t)l) {
2074 		zerror(zlogp, B_FALSE, "message length mismatch, "
2075 		    "expected %d bytes, returned %d bytes",
2076 		    rtmsg.hdr.rtm_msglen, l);
2077 		return (NULL);
2078 	}
2079 	if (rtmsg.hdr.rtm_errno != 0)  {
2080 		errno = rtmsg.hdr.rtm_errno;
2081 		zerror(zlogp, B_TRUE, "RTM_GET routing socket message");
2082 		return (NULL);
2083 	}
2084 	if ((rtmsg.hdr.rtm_addrs & RTA_IFP) == 0) {
2085 		zerror(zlogp, B_FALSE, "network interface not found");
2086 		return (NULL);
2087 	}
2088 	cp = ((char *)(&rtmsg.hdr + 1));
2089 	for (i = 1; i != 0; i <<= 1) {
2090 		/* LINTED E_BAD_PTR_CAST_ALIGN */
2091 		sa = (struct sockaddr *)cp;
2092 		if (i != RTA_IFP) {
2093 			if ((i & rtmsg.hdr.rtm_addrs) != 0)
2094 				cp += ROUNDUP_LONG(salen(sa));
2095 			continue;
2096 		}
2097 		if (sa->sa_family == AF_LINK &&
2098 		    ((struct sockaddr_dl *)sa)->sdl_nlen != 0)
2099 			ifp = (struct sockaddr_dl *)sa;
2100 		break;
2101 	}
2102 	if (ifp == NULL) {
2103 		zerror(zlogp, B_FALSE, "network interface could not be "
2104 		    "determined");
2105 		return (NULL);
2106 	}
2107 
2108 	/*
2109 	 * We need to set the I/F name to what we got above, then do the
2110 	 * appropriate ioctl to get its zone name.  But lifr->lifr_name is
2111 	 * used by the calling function to do a REMOVEIF, so if we leave the
2112 	 * "good" zone's I/F name in place, *that* I/F will be removed instead
2113 	 * of the bad one.  So we save the old (bad) I/F name before over-
2114 	 * writing it and doing the ioctl, then restore it after the ioctl.
2115 	 */
2116 	(void) strlcpy(save_if_name, lifr->lifr_name, sizeof (save_if_name));
2117 	(void) strncpy(lifr->lifr_name, ifp->sdl_data, ifp->sdl_nlen);
2118 	lifr->lifr_name[ifp->sdl_nlen] = '\0';
2119 	i = ioctl(s, SIOCGLIFZONE, lifr);
2120 	(void) strlcpy(lifr->lifr_name, save_if_name, sizeof (save_if_name));
2121 	if (i < 0) {
2122 		zerror(zlogp, B_TRUE,
2123 		    "%s: could not determine the zone network interface "
2124 		    "belongs to", lifr->lifr_name);
2125 		return (NULL);
2126 	}
2127 	if (getzonenamebyid(lifr->lifr_zoneid, answer, sizeof (answer)) < 0)
2128 		(void) snprintf(answer, sizeof (answer), "%d",
2129 		    lifr->lifr_zoneid);
2130 
2131 	if (strlen(answer) > 0)
2132 		return (answer);
2133 	return (NULL);
2134 }
2135 
2136 /*
2137  * Configures a single interface: a new virtual interface is added, based on
2138  * the physical interface nwiftabptr->zone_nwif_physical, with the address
2139  * specified in nwiftabptr->zone_nwif_address, for zone zone_id.  Note that
2140  * the "address" can be an IPv6 address (with a /prefixlength required), an
2141  * IPv4 address (with a /prefixlength optional), or a name; for the latter,
2142  * an IPv4 name-to-address resolution will be attempted.
2143  *
2144  * If anything goes wrong, we log an detailed error message, attempt to tear
2145  * down whatever we set up and return an error.
2146  */
2147 static int
2148 configure_one_interface(zlog_t *zlogp, zoneid_t zone_id,
2149     struct zone_nwiftab *nwiftabptr)
2150 {
2151 	struct lifreq lifr;
2152 	struct sockaddr_in netmask4;
2153 	struct sockaddr_in6 netmask6;
2154 	struct sockaddr_storage laddr;
2155 	struct in_addr in4;
2156 	sa_family_t af;
2157 	char *slashp = strchr(nwiftabptr->zone_nwif_address, '/');
2158 	int s;
2159 	boolean_t got_netmask = B_FALSE;
2160 	boolean_t is_loopback = B_FALSE;
2161 	char addrstr4[INET_ADDRSTRLEN];
2162 	int res;
2163 
2164 	res = zonecfg_valid_net_address(nwiftabptr->zone_nwif_address, &lifr);
2165 	if (res != Z_OK) {
2166 		zerror(zlogp, B_FALSE, "%s: %s", zonecfg_strerror(res),
2167 		    nwiftabptr->zone_nwif_address);
2168 		return (-1);
2169 	}
2170 	af = lifr.lifr_addr.ss_family;
2171 	if (af == AF_INET)
2172 		in4 = ((struct sockaddr_in *)(&lifr.lifr_addr))->sin_addr;
2173 	if ((s = socket(af, SOCK_DGRAM, 0)) < 0) {
2174 		zerror(zlogp, B_TRUE, "could not get socket");
2175 		return (-1);
2176 	}
2177 
2178 	/*
2179 	 * This is a similar kind of "hack" like in addif() to get around
2180 	 * the problem of SIOCLIFADDIF.  The problem is that this ioctl
2181 	 * does not include the netmask when adding a logical interface.
2182 	 * To get around this problem, we first add the logical interface
2183 	 * with a 0 address.  After that, we set the netmask if provided.
2184 	 * Finally we set the interface address.
2185 	 */
2186 	laddr = lifr.lifr_addr;
2187 	(void) strlcpy(lifr.lifr_name, nwiftabptr->zone_nwif_physical,
2188 	    sizeof (lifr.lifr_name));
2189 	(void) memset(&lifr.lifr_addr, 0, sizeof (lifr.lifr_addr));
2190 
2191 	if (ioctl(s, SIOCLIFADDIF, (caddr_t)&lifr) < 0) {
2192 		/*
2193 		 * Here, we know that the interface can't be brought up.
2194 		 * A similar warning message was already printed out to
2195 		 * the console by zoneadm(1M) so instead we log the
2196 		 * message to syslog and continue.
2197 		 */
2198 		zerror(&logsys, B_TRUE, "WARNING: skipping network interface "
2199 		    "'%s' which may not be present/plumbed in the "
2200 		    "global zone.", lifr.lifr_name);
2201 		(void) close(s);
2202 		return (Z_OK);
2203 	}
2204 
2205 	/* Preserve literal IPv4 address for later potential printing. */
2206 	if (af == AF_INET)
2207 		(void) inet_ntop(AF_INET, &in4, addrstr4, INET_ADDRSTRLEN);
2208 
2209 	lifr.lifr_zoneid = zone_id;
2210 	if (ioctl(s, SIOCSLIFZONE, (caddr_t)&lifr) < 0) {
2211 		zerror(zlogp, B_TRUE, "%s: could not place network interface "
2212 		    "into zone", lifr.lifr_name);
2213 		goto bad;
2214 	}
2215 
2216 	/*
2217 	 * Loopback interface will use the default netmask assigned, if no
2218 	 * netmask is found.
2219 	 */
2220 	if (strcmp(nwiftabptr->zone_nwif_physical, "lo0") == 0) {
2221 		is_loopback = B_TRUE;
2222 	}
2223 	if (af == AF_INET) {
2224 		/*
2225 		 * The IPv4 netmask can be determined either
2226 		 * directly if a prefix length was supplied with
2227 		 * the address or via the netmasks database.  Not
2228 		 * being able to determine it is a common failure,
2229 		 * but it often is not fatal to operation of the
2230 		 * interface.  In that case, a warning will be
2231 		 * printed after the rest of the interface's
2232 		 * parameters have been configured.
2233 		 */
2234 		(void) memset(&netmask4, 0, sizeof (netmask4));
2235 		if (slashp != NULL) {
2236 			if (addr2netmask(slashp + 1, V4_ADDR_LEN,
2237 			    (uchar_t *)&netmask4.sin_addr) != 0) {
2238 				*slashp = '/';
2239 				zerror(zlogp, B_FALSE,
2240 				    "%s: invalid prefix length in %s",
2241 				    lifr.lifr_name,
2242 				    nwiftabptr->zone_nwif_address);
2243 				goto bad;
2244 			}
2245 			got_netmask = B_TRUE;
2246 		} else if (getnetmaskbyaddr(in4,
2247 		    &netmask4.sin_addr) == 0) {
2248 			got_netmask = B_TRUE;
2249 		}
2250 		if (got_netmask) {
2251 			netmask4.sin_family = af;
2252 			(void) memcpy(&lifr.lifr_addr, &netmask4,
2253 			    sizeof (netmask4));
2254 		}
2255 	} else {
2256 		(void) memset(&netmask6, 0, sizeof (netmask6));
2257 		if (addr2netmask(slashp + 1, V6_ADDR_LEN,
2258 		    (uchar_t *)&netmask6.sin6_addr) != 0) {
2259 			*slashp = '/';
2260 			zerror(zlogp, B_FALSE,
2261 			    "%s: invalid prefix length in %s",
2262 			    lifr.lifr_name,
2263 			    nwiftabptr->zone_nwif_address);
2264 			goto bad;
2265 		}
2266 		got_netmask = B_TRUE;
2267 		netmask6.sin6_family = af;
2268 		(void) memcpy(&lifr.lifr_addr, &netmask6,
2269 		    sizeof (netmask6));
2270 	}
2271 	if (got_netmask &&
2272 	    ioctl(s, SIOCSLIFNETMASK, (caddr_t)&lifr) < 0) {
2273 		zerror(zlogp, B_TRUE, "%s: could not set netmask",
2274 		    lifr.lifr_name);
2275 		goto bad;
2276 	}
2277 
2278 	/* Set the interface address */
2279 	lifr.lifr_addr = laddr;
2280 	if (ioctl(s, SIOCSLIFADDR, (caddr_t)&lifr) < 0) {
2281 		zerror(zlogp, B_TRUE,
2282 		    "%s: could not set IP address to %s",
2283 		    lifr.lifr_name, nwiftabptr->zone_nwif_address);
2284 		goto bad;
2285 	}
2286 
2287 	if (ioctl(s, SIOCGLIFFLAGS, (caddr_t)&lifr) < 0) {
2288 		zerror(zlogp, B_TRUE, "%s: could not get flags",
2289 		    lifr.lifr_name);
2290 		goto bad;
2291 	}
2292 	lifr.lifr_flags |= IFF_UP;
2293 	if (ioctl(s, SIOCSLIFFLAGS, (caddr_t)&lifr) < 0) {
2294 		int save_errno = errno;
2295 		char *zone_using;
2296 
2297 		/*
2298 		 * If we failed with something other than EADDRNOTAVAIL,
2299 		 * then skip to the end.  Otherwise, look up our address,
2300 		 * then call a function to determine which zone is already
2301 		 * using that address.
2302 		 */
2303 		if (errno != EADDRNOTAVAIL) {
2304 			zerror(zlogp, B_TRUE,
2305 			    "%s: could not bring network interface up",
2306 			    lifr.lifr_name);
2307 			goto bad;
2308 		}
2309 		if (ioctl(s, SIOCGLIFADDR, (caddr_t)&lifr) < 0) {
2310 			zerror(zlogp, B_TRUE, "%s: could not get address",
2311 			    lifr.lifr_name);
2312 			goto bad;
2313 		}
2314 		zone_using = who_is_using(zlogp, &lifr);
2315 		errno = save_errno;
2316 		if (zone_using == NULL)
2317 			zerror(zlogp, B_TRUE,
2318 			    "%s: could not bring network interface up",
2319 			    lifr.lifr_name);
2320 		else
2321 			zerror(zlogp, B_TRUE, "%s: could not bring network "
2322 			    "interface up: address in use by zone '%s'",
2323 			    lifr.lifr_name, zone_using);
2324 		goto bad;
2325 	}
2326 
2327 	if (!got_netmask && !is_loopback) {
2328 		/*
2329 		 * A common, but often non-fatal problem, is that the system
2330 		 * cannot find the netmask for an interface address. This is
2331 		 * often caused by it being only in /etc/inet/netmasks, but
2332 		 * /etc/nsswitch.conf says to use NIS or NIS+ and it's not
2333 		 * in that. This doesn't show up at boot because the netmask
2334 		 * is obtained from /etc/inet/netmasks when no network
2335 		 * interfaces are up, but isn't consulted when NIS/NIS+ is
2336 		 * available. We warn the user here that something like this
2337 		 * has happened and we're just running with a default and
2338 		 * possible incorrect netmask.
2339 		 */
2340 		char buffer[INET6_ADDRSTRLEN];
2341 		void  *addr;
2342 		const char *nomatch = "no matching subnet found in netmasks(4)";
2343 
2344 		if (af == AF_INET)
2345 			addr = &((struct sockaddr_in *)
2346 			    (&lifr.lifr_addr))->sin_addr;
2347 		else
2348 			addr = &((struct sockaddr_in6 *)
2349 			    (&lifr.lifr_addr))->sin6_addr;
2350 
2351 		/*
2352 		 * Find out what netmask the interface is going to be using.
2353 		 * If we just brought up an IPMP data address on an underlying
2354 		 * interface above, the address will have already migrated, so
2355 		 * the SIOCGLIFNETMASK won't be able to find it (but we need
2356 		 * to bring the address up to get the actual netmask).  Just
2357 		 * omit printing the actual netmask in this corner-case.
2358 		 */
2359 		if (ioctl(s, SIOCGLIFNETMASK, (caddr_t)&lifr) < 0 ||
2360 		    inet_ntop(af, addr, buffer, sizeof (buffer)) == NULL) {
2361 			zerror(zlogp, B_FALSE, "WARNING: %s; using default.",
2362 			    nomatch);
2363 		} else {
2364 			zerror(zlogp, B_FALSE,
2365 			    "WARNING: %s: %s: %s; using default of %s.",
2366 			    lifr.lifr_name, nomatch, addrstr4, buffer);
2367 		}
2368 	}
2369 
2370 	/*
2371 	 * If a default router was specified for this interface
2372 	 * set the route now. Ignore if already set.
2373 	 */
2374 	if (strlen(nwiftabptr->zone_nwif_defrouter) > 0) {
2375 		int status;
2376 		char *argv[7];
2377 
2378 		argv[0] = "route";
2379 		argv[1] = "add";
2380 		argv[2] = "-ifp";
2381 		argv[3] = nwiftabptr->zone_nwif_physical;
2382 		argv[4] = "default";
2383 		argv[5] = nwiftabptr->zone_nwif_defrouter;
2384 		argv[6] = NULL;
2385 
2386 		status = forkexec(zlogp, "/usr/sbin/route", argv);
2387 		if (status != 0 && status != EEXIST)
2388 			zerror(zlogp, B_FALSE, "Unable to set route for "
2389 			    "interface %s to %s\n",
2390 			    nwiftabptr->zone_nwif_physical,
2391 			    nwiftabptr->zone_nwif_defrouter);
2392 	}
2393 
2394 	(void) close(s);
2395 	return (Z_OK);
2396 bad:
2397 	(void) ioctl(s, SIOCLIFREMOVEIF, (caddr_t)&lifr);
2398 	(void) close(s);
2399 	return (-1);
2400 }
2401 
2402 /*
2403  * Sets up network interfaces based on information from the zone configuration.
2404  * IPv4 and IPv6 loopback interfaces are set up "for free", modeling the global
2405  * system.
2406  *
2407  * If anything goes wrong, we log a general error message, attempt to tear down
2408  * whatever we set up, and return an error.
2409  */
2410 static int
2411 configure_shared_network_interfaces(zlog_t *zlogp)
2412 {
2413 	zone_dochandle_t handle;
2414 	struct zone_nwiftab nwiftab, loopback_iftab;
2415 	zoneid_t zoneid;
2416 
2417 	if ((zoneid = getzoneidbyname(zone_name)) == ZONE_ID_UNDEFINED) {
2418 		zerror(zlogp, B_TRUE, "unable to get zoneid");
2419 		return (-1);
2420 	}
2421 
2422 	if ((handle = zonecfg_init_handle()) == NULL) {
2423 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
2424 		return (-1);
2425 	}
2426 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2427 		zerror(zlogp, B_FALSE, "invalid configuration");
2428 		zonecfg_fini_handle(handle);
2429 		return (-1);
2430 	}
2431 	if (zonecfg_setnwifent(handle) == Z_OK) {
2432 		for (;;) {
2433 			if (zonecfg_getnwifent(handle, &nwiftab) != Z_OK)
2434 				break;
2435 			if (configure_one_interface(zlogp, zoneid, &nwiftab) !=
2436 			    Z_OK) {
2437 				(void) zonecfg_endnwifent(handle);
2438 				zonecfg_fini_handle(handle);
2439 				return (-1);
2440 			}
2441 		}
2442 		(void) zonecfg_endnwifent(handle);
2443 	}
2444 	zonecfg_fini_handle(handle);
2445 	if (is_system_labeled()) {
2446 		/*
2447 		 * Labeled zones share the loopback interface
2448 		 * so it is not plumbed for shared stack instances.
2449 		 */
2450 		return (0);
2451 	}
2452 	(void) strlcpy(loopback_iftab.zone_nwif_physical, "lo0",
2453 	    sizeof (loopback_iftab.zone_nwif_physical));
2454 	(void) strlcpy(loopback_iftab.zone_nwif_address, "127.0.0.1",
2455 	    sizeof (loopback_iftab.zone_nwif_address));
2456 	loopback_iftab.zone_nwif_defrouter[0] = '\0';
2457 	if (configure_one_interface(zlogp, zoneid, &loopback_iftab) != Z_OK)
2458 		return (-1);
2459 
2460 	/* Always plumb up the IPv6 loopback interface. */
2461 	(void) strlcpy(loopback_iftab.zone_nwif_address, "::1/128",
2462 	    sizeof (loopback_iftab.zone_nwif_address));
2463 	if (configure_one_interface(zlogp, zoneid, &loopback_iftab) != Z_OK)
2464 		return (-1);
2465 	return (0);
2466 }
2467 
2468 static void
2469 zdlerror(zlog_t *zlogp, dladm_status_t err, const char *dlname, const char *str)
2470 {
2471 	char errmsg[DLADM_STRSIZE];
2472 
2473 	(void) dladm_status2str(err, errmsg);
2474 	zerror(zlogp, B_FALSE, "%s '%s': %s", str, dlname, errmsg);
2475 }
2476 
2477 static int
2478 add_datalink(zlog_t *zlogp, char *zone_name, datalink_id_t linkid, char *dlname)
2479 {
2480 	dladm_status_t err;
2481 	boolean_t cpuset, poolset;
2482 	char *poolp;
2483 
2484 	/* First check if it's in use by global zone. */
2485 	if (zonecfg_ifname_exists(AF_INET, dlname) ||
2486 	    zonecfg_ifname_exists(AF_INET6, dlname)) {
2487 		zerror(zlogp, B_FALSE, "WARNING: skipping network interface "
2488 		    "'%s' which is used in the global zone", dlname);
2489 		return (-1);
2490 	}
2491 
2492 	/* Set zoneid of this link. */
2493 	err = dladm_set_linkprop(dld_handle, linkid, "zone", &zone_name, 1,
2494 	    DLADM_OPT_ACTIVE);
2495 	if (err != DLADM_STATUS_OK) {
2496 		zdlerror(zlogp, err, dlname,
2497 		    "WARNING: unable to add network interface");
2498 		return (-1);
2499 	}
2500 
2501 	/*
2502 	 * Set the pool of this link if the zone has a pool and
2503 	 * neither the cpus nor the pool datalink property is
2504 	 * already set.
2505 	 */
2506 	err = dladm_linkprop_is_set(dld_handle, linkid, DLADM_PROP_VAL_CURRENT,
2507 	    "cpus", &cpuset);
2508 	if (err != DLADM_STATUS_OK) {
2509 		zdlerror(zlogp, err, dlname,
2510 		    "WARNING: unable to check if cpus link property is set");
2511 	}
2512 	err = dladm_linkprop_is_set(dld_handle, linkid, DLADM_PROP_VAL_CURRENT,
2513 	    "pool", &poolset);
2514 	if (err != DLADM_STATUS_OK) {
2515 		zdlerror(zlogp, err, dlname,
2516 		    "WARNING: unable to check if pool link property is set");
2517 	}
2518 
2519 	if ((strlen(pool_name) != 0) && !cpuset && !poolset) {
2520 		poolp = pool_name;
2521 		err = dladm_set_linkprop(dld_handle, linkid, "pool",
2522 		    &poolp, 1, DLADM_OPT_ACTIVE);
2523 		if (err != DLADM_STATUS_OK) {
2524 			zerror(zlogp, B_FALSE, "WARNING: unable to set "
2525 			    "pool %s to datalink %s", pool_name, dlname);
2526 			bzero(pool_name, sizeof (pool_name));
2527 		}
2528 	} else {
2529 		bzero(pool_name, sizeof (pool_name));
2530 	}
2531 	return (0);
2532 }
2533 
2534 static boolean_t
2535 sockaddr_to_str(sa_family_t af, const struct sockaddr *sockaddr,
2536     char *straddr, size_t len)
2537 {
2538 	struct sockaddr_in *sin;
2539 	struct sockaddr_in6 *sin6;
2540 	const char *str = NULL;
2541 
2542 	if (af == AF_INET) {
2543 		/* LINTED E_BAD_PTR_CAST_ALIGN */
2544 		sin = SIN(sockaddr);
2545 		str = inet_ntop(AF_INET, (void *)&sin->sin_addr, straddr, len);
2546 	} else if (af == AF_INET6) {
2547 		/* LINTED E_BAD_PTR_CAST_ALIGN */
2548 		sin6 = SIN6(sockaddr);
2549 		str = inet_ntop(AF_INET6, (void *)&sin6->sin6_addr, straddr,
2550 		    len);
2551 	}
2552 
2553 	return (str != NULL);
2554 }
2555 
2556 static int
2557 ipv4_prefixlen(struct sockaddr_in *sin)
2558 {
2559 	struct sockaddr_in *m;
2560 	struct sockaddr_storage mask;
2561 
2562 	m = SIN(&mask);
2563 	m->sin_family = AF_INET;
2564 	if (getnetmaskbyaddr(sin->sin_addr, &m->sin_addr) == 0) {
2565 		return (mask2plen((struct sockaddr *)&mask));
2566 	} else if (IN_CLASSA(htonl(sin->sin_addr.s_addr))) {
2567 		return (8);
2568 	} else if (IN_CLASSB(ntohl(sin->sin_addr.s_addr))) {
2569 		return (16);
2570 	} else if (IN_CLASSC(ntohl(sin->sin_addr.s_addr))) {
2571 		return (24);
2572 	}
2573 	return (0);
2574 }
2575 
2576 static int
2577 zone_setattr_network(int type, zoneid_t zoneid, datalink_id_t linkid,
2578     void *buf, size_t bufsize)
2579 {
2580 	zone_net_data_t *zndata;
2581 	size_t znsize;
2582 	int err;
2583 
2584 	znsize = sizeof (*zndata) + bufsize;
2585 	zndata = calloc(1, znsize);
2586 	if (zndata == NULL)
2587 		return (ENOMEM);
2588 	zndata->zn_type = type;
2589 	zndata->zn_len = bufsize;
2590 	zndata->zn_linkid = linkid;
2591 	bcopy(buf, zndata->zn_val, zndata->zn_len);
2592 	err = zone_setattr(zoneid, ZONE_ATTR_NETWORK, zndata, znsize);
2593 	free(zndata);
2594 	return (err);
2595 }
2596 
2597 static int
2598 add_net_for_linkid(zlog_t *zlogp, zoneid_t zoneid, zone_addr_list_t *start)
2599 {
2600 	struct lifreq lifr;
2601 	char **astr, *address;
2602 	dladm_status_t dlstatus;
2603 	char *ip_nospoof = "ip-nospoof";
2604 	int nnet, naddr, err = 0, j;
2605 	size_t zlen, cpleft;
2606 	zone_addr_list_t *ptr, *end;
2607 	char  tmp[INET6_ADDRSTRLEN], *maskstr;
2608 	char *zaddr, *cp;
2609 	struct in6_addr *routes = NULL;
2610 	boolean_t is_set;
2611 	datalink_id_t linkid;
2612 
2613 	assert(start != NULL);
2614 	naddr = 0; /* number of addresses */
2615 	nnet = 0; /* number of net resources */
2616 	linkid = start->za_linkid;
2617 	for (ptr = start; ptr != NULL && ptr->za_linkid == linkid;
2618 	    ptr = ptr->za_next) {
2619 		nnet++;
2620 	}
2621 	end = ptr;
2622 	zlen = nnet * (INET6_ADDRSTRLEN + 1);
2623 	astr = calloc(1, nnet * sizeof (uintptr_t));
2624 	zaddr = calloc(1, zlen);
2625 	if (astr == NULL || zaddr == NULL) {
2626 		err = ENOMEM;
2627 		goto done;
2628 	}
2629 	cp = zaddr;
2630 	cpleft = zlen;
2631 	j = 0;
2632 	for (ptr = start; ptr != end; ptr = ptr->za_next) {
2633 		address = ptr->za_nwiftab.zone_nwif_allowed_address;
2634 		if (address[0] == '\0')
2635 			continue;
2636 		(void) snprintf(tmp, sizeof (tmp), "%s", address);
2637 		/*
2638 		 * Validate the data. zonecfg_valid_net_address() clobbers
2639 		 * the /<mask> in the address string.
2640 		 */
2641 		if (zonecfg_valid_net_address(address, &lifr) != Z_OK) {
2642 			zerror(zlogp, B_FALSE, "invalid address [%s]\n",
2643 			    address);
2644 			err = EINVAL;
2645 			goto done;
2646 		}
2647 		/*
2648 		 * convert any hostnames to numeric address strings.
2649 		 */
2650 		if (!sockaddr_to_str(lifr.lifr_addr.ss_family,
2651 		    (const struct sockaddr *)&lifr.lifr_addr, cp, cpleft)) {
2652 			err = EINVAL;
2653 			goto done;
2654 		}
2655 		/*
2656 		 * make a copy of the numeric string for the data needed
2657 		 * by the "allowed-ips" datalink property.
2658 		 */
2659 		astr[j] = strdup(cp);
2660 		if (astr[j] == NULL) {
2661 			err = ENOMEM;
2662 			goto done;
2663 		}
2664 		j++;
2665 		/*
2666 		 * compute the default netmask from the address, if necessary
2667 		 */
2668 		if ((maskstr = strchr(tmp, '/')) == NULL) {
2669 			int prefixlen;
2670 
2671 			if (lifr.lifr_addr.ss_family == AF_INET) {
2672 				prefixlen = ipv4_prefixlen(
2673 				    SIN(&lifr.lifr_addr));
2674 			} else {
2675 				struct sockaddr_in6 *sin6;
2676 
2677 				sin6 = SIN6(&lifr.lifr_addr);
2678 				if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2679 					prefixlen = 10;
2680 				else
2681 					prefixlen = 64;
2682 			}
2683 			(void) snprintf(tmp, sizeof (tmp), "%d", prefixlen);
2684 			maskstr = tmp;
2685 		} else {
2686 			maskstr++;
2687 		}
2688 		/* append the "/<netmask>" */
2689 		(void) strlcat(cp, "/", cpleft);
2690 		(void) strlcat(cp, maskstr, cpleft);
2691 		(void) strlcat(cp, ",", cpleft);
2692 		cp += strnlen(cp, zlen);
2693 		cpleft = &zaddr[INET6_ADDRSTRLEN] - cp;
2694 	}
2695 	naddr = j; /* the actual number of addresses in the net resource */
2696 	assert(naddr <= nnet);
2697 
2698 	/*
2699 	 * zonecfg has already verified that the defrouter property can only
2700 	 * be set if there is at least one address defined for the net resource.
2701 	 * If j is 0, there are no addresses defined, and therefore no routers
2702 	 * to configure, and we are done at that point.
2703 	 */
2704 	if (j == 0)
2705 		goto done;
2706 
2707 	/* over-write last ',' with '\0' */
2708 	zaddr[strnlen(zaddr, zlen) + 1] = '\0';
2709 
2710 	/*
2711 	 * First make sure L3 protection is not already set on the link.
2712 	 */
2713 	dlstatus = dladm_linkprop_is_set(dld_handle, linkid, DLADM_OPT_ACTIVE,
2714 	    "protection", &is_set);
2715 	if (dlstatus != DLADM_STATUS_OK) {
2716 		err = EINVAL;
2717 		zerror(zlogp, B_FALSE, "unable to check if protection is set");
2718 		goto done;
2719 	}
2720 	if (is_set) {
2721 		err = EINVAL;
2722 		zerror(zlogp, B_FALSE, "Protection is already set");
2723 		goto done;
2724 	}
2725 	dlstatus = dladm_linkprop_is_set(dld_handle, linkid, DLADM_OPT_ACTIVE,
2726 	    "allowed-ips", &is_set);
2727 	if (dlstatus != DLADM_STATUS_OK) {
2728 		err = EINVAL;
2729 		zerror(zlogp, B_FALSE, "unable to check if allowed-ips is set");
2730 		goto done;
2731 	}
2732 	if (is_set) {
2733 		zerror(zlogp, B_FALSE, "allowed-ips is already set");
2734 		err = EINVAL;
2735 		goto done;
2736 	}
2737 
2738 	/*
2739 	 * Enable ip-nospoof for the link, and add address to the allowed-ips
2740 	 * list.
2741 	 */
2742 	dlstatus = dladm_set_linkprop(dld_handle, linkid, "protection",
2743 	    &ip_nospoof, 1, DLADM_OPT_ACTIVE);
2744 	if (dlstatus != DLADM_STATUS_OK) {
2745 		zerror(zlogp, B_FALSE, "could not set protection\n");
2746 		err = EINVAL;
2747 		goto done;
2748 	}
2749 	dlstatus = dladm_set_linkprop(dld_handle, linkid, "allowed-ips",
2750 	    astr, naddr, DLADM_OPT_ACTIVE);
2751 	if (dlstatus != DLADM_STATUS_OK) {
2752 		zerror(zlogp, B_FALSE, "could not set allowed-ips\n");
2753 		err = EINVAL;
2754 		goto done;
2755 	}
2756 
2757 	/* now set the address in the data-store */
2758 	err = zone_setattr_network(ZONE_NETWORK_ADDRESS, zoneid, linkid,
2759 	    zaddr, strnlen(zaddr, zlen) + 1);
2760 	if (err != 0)
2761 		goto done;
2762 
2763 	/*
2764 	 * add the defaultrouters
2765 	 */
2766 	routes = calloc(1, nnet * sizeof (*routes));
2767 	j = 0;
2768 	for (ptr = start; ptr != end; ptr = ptr->za_next) {
2769 		address = ptr->za_nwiftab.zone_nwif_defrouter;
2770 		if (address[0] == '\0')
2771 			continue;
2772 		if (strchr(address, '/') == NULL && strchr(address, ':') != 0) {
2773 			/*
2774 			 * zonecfg_valid_net_address() expects numeric IPv6
2775 			 * addresses to have a CIDR format netmask.
2776 			 */
2777 			(void) snprintf(tmp, sizeof (tmp), "/%d", V6_ADDR_LEN);
2778 			(void) strlcat(address, tmp, INET6_ADDRSTRLEN);
2779 		}
2780 		if (zonecfg_valid_net_address(address, &lifr) != Z_OK) {
2781 			zerror(zlogp, B_FALSE,
2782 			    "invalid router [%s]\n", address);
2783 			err = EINVAL;
2784 			goto done;
2785 		}
2786 		if (lifr.lifr_addr.ss_family == AF_INET6) {
2787 			routes[j] = SIN6(&lifr.lifr_addr)->sin6_addr;
2788 		} else {
2789 			IN6_INADDR_TO_V4MAPPED(&SIN(&lifr.lifr_addr)->sin_addr,
2790 			    &routes[j]);
2791 		}
2792 		j++;
2793 	}
2794 	assert(j <= nnet);
2795 	if (j > 0) {
2796 		err = zone_setattr_network(ZONE_NETWORK_DEFROUTER, zoneid,
2797 		    linkid, routes, j * sizeof (*routes));
2798 	}
2799 done:
2800 	free(routes);
2801 	for (j = 0; j < naddr; j++)
2802 		free(astr[j]);
2803 	free(astr);
2804 	free(zaddr);
2805 	return (err);
2806 
2807 }
2808 
2809 static int
2810 add_net(zlog_t *zlogp, zoneid_t zoneid, zone_addr_list_t *zalist)
2811 {
2812 	zone_addr_list_t *ptr;
2813 	datalink_id_t linkid;
2814 	int err;
2815 
2816 	if (zalist == NULL)
2817 		return (0);
2818 
2819 	linkid = zalist->za_linkid;
2820 
2821 	err = add_net_for_linkid(zlogp, zoneid, zalist);
2822 	if (err != 0)
2823 		return (err);
2824 
2825 	for (ptr = zalist; ptr != NULL; ptr = ptr->za_next) {
2826 		if (ptr->za_linkid == linkid)
2827 			continue;
2828 		linkid = ptr->za_linkid;
2829 		err = add_net_for_linkid(zlogp, zoneid, ptr);
2830 		if (err != 0)
2831 			return (err);
2832 	}
2833 	return (0);
2834 }
2835 
2836 /*
2837  * Add "new" to the list of network interfaces to be configured  by
2838  * add_net on zone boot in "old". The list of interfaces in "old" is
2839  * sorted by datalink_id_t, with interfaces sorted FIFO for a given
2840  * datalink_id_t.
2841  *
2842  * Returns the merged list of IP interfaces containing "old" and "new"
2843  */
2844 static zone_addr_list_t *
2845 add_ip_interface(zone_addr_list_t *old, zone_addr_list_t *new)
2846 {
2847 	zone_addr_list_t *ptr, *next;
2848 	datalink_id_t linkid = new->za_linkid;
2849 
2850 	assert(old != new);
2851 
2852 	if (old == NULL)
2853 		return (new);
2854 	for (ptr = old; ptr != NULL; ptr = ptr->za_next) {
2855 		if (ptr->za_linkid == linkid)
2856 			break;
2857 	}
2858 	if (ptr == NULL) {
2859 		/* linkid does not already exist, add to the beginning */
2860 		new->za_next = old;
2861 		return (new);
2862 	}
2863 	/*
2864 	 * adding to the middle of the list; ptr points at the first
2865 	 * occurrence of linkid. Find the last occurrence.
2866 	 */
2867 	while ((next = ptr->za_next) != NULL) {
2868 		if (next->za_linkid != linkid)
2869 			break;
2870 		ptr = next;
2871 	}
2872 	/* insert new after ptr */
2873 	new->za_next = next;
2874 	ptr->za_next = new;
2875 	return (old);
2876 }
2877 
2878 void
2879 free_ip_interface(zone_addr_list_t *zalist)
2880 {
2881 	zone_addr_list_t *ptr, *new;
2882 
2883 	for (ptr = zalist; ptr != NULL; ) {
2884 		new = ptr;
2885 		ptr = ptr->za_next;
2886 		free(new);
2887 	}
2888 }
2889 
2890 /*
2891  * Add the kernel access control information for the interface names.
2892  * If anything goes wrong, we log a general error message, attempt to tear down
2893  * whatever we set up, and return an error.
2894  */
2895 static int
2896 configure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
2897 {
2898 	zone_dochandle_t handle;
2899 	struct zone_nwiftab nwiftab;
2900 	char rootpath[MAXPATHLEN];
2901 	char path[MAXPATHLEN];
2902 	datalink_id_t linkid;
2903 	di_prof_t prof = NULL;
2904 	boolean_t added = B_FALSE;
2905 	zone_addr_list_t *zalist = NULL, *new;
2906 
2907 	if ((handle = zonecfg_init_handle()) == NULL) {
2908 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
2909 		return (-1);
2910 	}
2911 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
2912 		zerror(zlogp, B_FALSE, "invalid configuration");
2913 		zonecfg_fini_handle(handle);
2914 		return (-1);
2915 	}
2916 
2917 	if (zonecfg_setnwifent(handle) != Z_OK) {
2918 		zonecfg_fini_handle(handle);
2919 		return (0);
2920 	}
2921 
2922 	for (;;) {
2923 		if (zonecfg_getnwifent(handle, &nwiftab) != Z_OK)
2924 			break;
2925 
2926 		if (prof == NULL) {
2927 			if (zone_get_devroot(zone_name, rootpath,
2928 			    sizeof (rootpath)) != Z_OK) {
2929 				(void) zonecfg_endnwifent(handle);
2930 				zonecfg_fini_handle(handle);
2931 				zerror(zlogp, B_TRUE,
2932 				    "unable to determine dev root");
2933 				return (-1);
2934 			}
2935 			(void) snprintf(path, sizeof (path), "%s%s", rootpath,
2936 			    "/dev");
2937 			if (di_prof_init(path, &prof) != 0) {
2938 				(void) zonecfg_endnwifent(handle);
2939 				zonecfg_fini_handle(handle);
2940 				zerror(zlogp, B_TRUE,
2941 				    "failed to initialize profile");
2942 				return (-1);
2943 			}
2944 		}
2945 
2946 		/*
2947 		 * Create the /dev entry for backward compatibility.
2948 		 * Only create the /dev entry if it's not in use.
2949 		 * Note that the zone still boots when the assigned
2950 		 * interface is inaccessible, used by others, etc.
2951 		 * Also, when vanity naming is used, some interface do
2952 		 * do not have corresponding /dev node names (for example,
2953 		 * vanity named aggregations).  The /dev entry is not
2954 		 * created in that case.  The /dev/net entry is always
2955 		 * accessible.
2956 		 */
2957 		if (dladm_name2info(dld_handle, nwiftab.zone_nwif_physical,
2958 		    &linkid, NULL, NULL, NULL) == DLADM_STATUS_OK &&
2959 		    add_datalink(zlogp, zone_name, linkid,
2960 		    nwiftab.zone_nwif_physical) == 0) {
2961 			added = B_TRUE;
2962 		} else {
2963 			(void) zonecfg_endnwifent(handle);
2964 			zonecfg_fini_handle(handle);
2965 			zerror(zlogp, B_TRUE, "failed to add network device");
2966 			return (-1);
2967 		}
2968 		/* set up the new IP interface, and add them all later */
2969 		new = malloc(sizeof (*new));
2970 		if (new == NULL) {
2971 			zerror(zlogp, B_TRUE, "no memory for %s",
2972 			    nwiftab.zone_nwif_physical);
2973 			zonecfg_fini_handle(handle);
2974 			free_ip_interface(zalist);
2975 		}
2976 		bzero(new, sizeof (*new));
2977 		new->za_nwiftab = nwiftab;
2978 		new->za_linkid = linkid;
2979 		zalist = add_ip_interface(zalist, new);
2980 	}
2981 	if (zalist != NULL) {
2982 		if ((errno = add_net(zlogp, zoneid, zalist)) != 0) {
2983 			(void) zonecfg_endnwifent(handle);
2984 			zonecfg_fini_handle(handle);
2985 			zerror(zlogp, B_TRUE, "failed to add address");
2986 			free_ip_interface(zalist);
2987 			return (-1);
2988 		}
2989 		free_ip_interface(zalist);
2990 	}
2991 	(void) zonecfg_endnwifent(handle);
2992 	zonecfg_fini_handle(handle);
2993 
2994 	if (prof != NULL && added) {
2995 		if (di_prof_commit(prof) != 0) {
2996 			zerror(zlogp, B_TRUE, "failed to commit profile");
2997 			return (-1);
2998 		}
2999 	}
3000 	if (prof != NULL)
3001 		di_prof_fini(prof);
3002 
3003 	return (0);
3004 }
3005 
3006 static int
3007 remove_datalink_pool(zlog_t *zlogp, zoneid_t zoneid)
3008 {
3009 	ushort_t flags;
3010 	zone_iptype_t iptype;
3011 	int i, dlnum = 0;
3012 	datalink_id_t *dllink, *dllinks = NULL;
3013 	dladm_status_t err;
3014 
3015 	if (strlen(pool_name) == 0)
3016 		return (0);
3017 
3018 	if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
3019 	    sizeof (flags)) < 0) {
3020 		if (vplat_get_iptype(zlogp, &iptype) < 0) {
3021 			zerror(zlogp, B_FALSE, "unable to determine ip-type");
3022 			return (-1);
3023 		}
3024 	} else {
3025 		if (flags & ZF_NET_EXCL)
3026 			iptype = ZS_EXCLUSIVE;
3027 		else
3028 			iptype = ZS_SHARED;
3029 	}
3030 
3031 	if (iptype == ZS_EXCLUSIVE) {
3032 		/*
3033 		 * Get the datalink count and for each datalink,
3034 		 * attempt to clear the pool property and clear
3035 		 * the pool_name.
3036 		 */
3037 		if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
3038 			zerror(zlogp, B_TRUE, "unable to count network "
3039 			    "interfaces");
3040 			return (-1);
3041 		}
3042 
3043 		if (dlnum == 0)
3044 			return (0);
3045 
3046 		if ((dllinks = malloc(dlnum * sizeof (datalink_id_t)))
3047 		    == NULL) {
3048 			zerror(zlogp, B_TRUE, "memory allocation failed");
3049 			return (-1);
3050 		}
3051 		if (zone_list_datalink(zoneid, &dlnum, dllinks) != 0) {
3052 			zerror(zlogp, B_TRUE, "unable to list network "
3053 			    "interfaces");
3054 			return (-1);
3055 		}
3056 
3057 		bzero(pool_name, sizeof (pool_name));
3058 		for (i = 0, dllink = dllinks; i < dlnum; i++, dllink++) {
3059 			err = dladm_set_linkprop(dld_handle, *dllink, "pool",
3060 			    NULL, 0, DLADM_OPT_ACTIVE);
3061 			if (err != DLADM_STATUS_OK) {
3062 				zerror(zlogp, B_TRUE,
3063 				    "WARNING: unable to clear pool");
3064 			}
3065 		}
3066 		free(dllinks);
3067 	}
3068 	return (0);
3069 }
3070 
3071 static int
3072 remove_datalink_protect(zlog_t *zlogp, zoneid_t zoneid)
3073 {
3074 	ushort_t flags;
3075 	zone_iptype_t iptype;
3076 	int i, dlnum = 0;
3077 	dladm_status_t dlstatus;
3078 	datalink_id_t *dllink, *dllinks = NULL;
3079 
3080 	if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
3081 	    sizeof (flags)) < 0) {
3082 		if (vplat_get_iptype(zlogp, &iptype) < 0) {
3083 			zerror(zlogp, B_FALSE, "unable to determine ip-type");
3084 			return (-1);
3085 		}
3086 	} else {
3087 		if (flags & ZF_NET_EXCL)
3088 			iptype = ZS_EXCLUSIVE;
3089 		else
3090 			iptype = ZS_SHARED;
3091 	}
3092 
3093 	if (iptype != ZS_EXCLUSIVE)
3094 		return (0);
3095 
3096 	/*
3097 	 * Get the datalink count and for each datalink,
3098 	 * attempt to clear the pool property and clear
3099 	 * the pool_name.
3100 	 */
3101 	if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
3102 		zerror(zlogp, B_TRUE, "unable to count network interfaces");
3103 		return (-1);
3104 	}
3105 
3106 	if (dlnum == 0)
3107 		return (0);
3108 
3109 	if ((dllinks = malloc(dlnum * sizeof (datalink_id_t))) == NULL) {
3110 		zerror(zlogp, B_TRUE, "memory allocation failed");
3111 		return (-1);
3112 	}
3113 	if (zone_list_datalink(zoneid, &dlnum, dllinks) != 0) {
3114 		zerror(zlogp, B_TRUE, "unable to list network interfaces");
3115 		free(dllinks);
3116 		return (-1);
3117 	}
3118 
3119 	for (i = 0, dllink = dllinks; i < dlnum; i++, dllink++) {
3120 		char dlerr[DLADM_STRSIZE];
3121 
3122 		dlstatus = dladm_set_linkprop(dld_handle, *dllink,
3123 		    "protection", NULL, 0, DLADM_OPT_ACTIVE);
3124 		if (dlstatus == DLADM_STATUS_NOTFOUND) {
3125 			/* datalink does not belong to the GZ */
3126 			continue;
3127 		}
3128 		if (dlstatus != DLADM_STATUS_OK) {
3129 			zerror(zlogp, B_FALSE,
3130 			    dladm_status2str(dlstatus, dlerr));
3131 			free(dllinks);
3132 			return (-1);
3133 		}
3134 		dlstatus = dladm_set_linkprop(dld_handle, *dllink,
3135 		    "allowed-ips", NULL, 0, DLADM_OPT_ACTIVE);
3136 		if (dlstatus != DLADM_STATUS_OK) {
3137 			zerror(zlogp, B_FALSE,
3138 			    dladm_status2str(dlstatus, dlerr));
3139 			free(dllinks);
3140 			return (-1);
3141 		}
3142 	}
3143 	free(dllinks);
3144 	return (0);
3145 }
3146 
3147 static int
3148 unconfigure_exclusive_network_interfaces(zlog_t *zlogp, zoneid_t zoneid)
3149 {
3150 	int dlnum = 0;
3151 
3152 	/*
3153 	 * The kernel shutdown callback for the dls module should have removed
3154 	 * all datalinks from this zone.  If any remain, then there's a
3155 	 * problem.
3156 	 */
3157 	if (zone_list_datalink(zoneid, &dlnum, NULL) != 0) {
3158 		zerror(zlogp, B_TRUE, "unable to list network interfaces");
3159 		return (-1);
3160 	}
3161 	if (dlnum != 0) {
3162 		zerror(zlogp, B_FALSE,
3163 		    "datalinks remain in zone after shutdown");
3164 		return (-1);
3165 	}
3166 	return (0);
3167 }
3168 
3169 static int
3170 tcp_abort_conn(zlog_t *zlogp, zoneid_t zoneid,
3171     const struct sockaddr_storage *local, const struct sockaddr_storage *remote)
3172 {
3173 	int fd;
3174 	struct strioctl ioc;
3175 	tcp_ioc_abort_conn_t conn;
3176 	int error;
3177 
3178 	conn.ac_local = *local;
3179 	conn.ac_remote = *remote;
3180 	conn.ac_start = TCPS_SYN_SENT;
3181 	conn.ac_end = TCPS_TIME_WAIT;
3182 	conn.ac_zoneid = zoneid;
3183 
3184 	ioc.ic_cmd = TCP_IOC_ABORT_CONN;
3185 	ioc.ic_timout = -1; /* infinite timeout */
3186 	ioc.ic_len = sizeof (conn);
3187 	ioc.ic_dp = (char *)&conn;
3188 
3189 	if ((fd = open("/dev/tcp", O_RDONLY)) < 0) {
3190 		zerror(zlogp, B_TRUE, "unable to open %s", "/dev/tcp");
3191 		return (-1);
3192 	}
3193 
3194 	error = ioctl(fd, I_STR, &ioc);
3195 	(void) close(fd);
3196 	if (error == 0 || errno == ENOENT)	/* ENOENT is not an error */
3197 		return (0);
3198 	return (-1);
3199 }
3200 
3201 static int
3202 tcp_abort_connections(zlog_t *zlogp, zoneid_t zoneid)
3203 {
3204 	struct sockaddr_storage l, r;
3205 	struct sockaddr_in *local, *remote;
3206 	struct sockaddr_in6 *local6, *remote6;
3207 	int error;
3208 
3209 	/*
3210 	 * Abort IPv4 connections.
3211 	 */
3212 	bzero(&l, sizeof (*local));
3213 	local = (struct sockaddr_in *)&l;
3214 	local->sin_family = AF_INET;
3215 	local->sin_addr.s_addr = INADDR_ANY;
3216 	local->sin_port = 0;
3217 
3218 	bzero(&r, sizeof (*remote));
3219 	remote = (struct sockaddr_in *)&r;
3220 	remote->sin_family = AF_INET;
3221 	remote->sin_addr.s_addr = INADDR_ANY;
3222 	remote->sin_port = 0;
3223 
3224 	if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
3225 		return (error);
3226 
3227 	/*
3228 	 * Abort IPv6 connections.
3229 	 */
3230 	bzero(&l, sizeof (*local6));
3231 	local6 = (struct sockaddr_in6 *)&l;
3232 	local6->sin6_family = AF_INET6;
3233 	local6->sin6_port = 0;
3234 	local6->sin6_addr = in6addr_any;
3235 
3236 	bzero(&r, sizeof (*remote6));
3237 	remote6 = (struct sockaddr_in6 *)&r;
3238 	remote6->sin6_family = AF_INET6;
3239 	remote6->sin6_port = 0;
3240 	remote6->sin6_addr = in6addr_any;
3241 
3242 	if ((error = tcp_abort_conn(zlogp, zoneid, &l, &r)) != 0)
3243 		return (error);
3244 	return (0);
3245 }
3246 
3247 static int
3248 get_privset(zlog_t *zlogp, priv_set_t *privs, zone_mnt_t mount_cmd)
3249 {
3250 	int error = -1;
3251 	zone_dochandle_t handle;
3252 	char *privname = NULL;
3253 
3254 	if ((handle = zonecfg_init_handle()) == NULL) {
3255 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
3256 		return (-1);
3257 	}
3258 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
3259 		zerror(zlogp, B_FALSE, "invalid configuration");
3260 		zonecfg_fini_handle(handle);
3261 		return (-1);
3262 	}
3263 
3264 	if (ALT_MOUNT(mount_cmd)) {
3265 		zone_iptype_t	iptype;
3266 		const char	*curr_iptype;
3267 
3268 		if (zonecfg_get_iptype(handle, &iptype) != Z_OK) {
3269 			zerror(zlogp, B_TRUE, "unable to determine ip-type");
3270 			zonecfg_fini_handle(handle);
3271 			return (-1);
3272 		}
3273 
3274 		switch (iptype) {
3275 		case ZS_SHARED:
3276 			curr_iptype = "shared";
3277 			break;
3278 		case ZS_EXCLUSIVE:
3279 			curr_iptype = "exclusive";
3280 			break;
3281 		}
3282 
3283 		if (zonecfg_default_privset(privs, curr_iptype) == Z_OK) {
3284 			zonecfg_fini_handle(handle);
3285 			return (0);
3286 		}
3287 		zerror(zlogp, B_FALSE,
3288 		    "failed to determine the zone's default privilege set");
3289 		zonecfg_fini_handle(handle);
3290 		return (-1);
3291 	}
3292 
3293 	switch (zonecfg_get_privset(handle, privs, &privname)) {
3294 	case Z_OK:
3295 		error = 0;
3296 		break;
3297 	case Z_PRIV_PROHIBITED:
3298 		zerror(zlogp, B_FALSE, "privilege \"%s\" is not permitted "
3299 		    "within the zone's privilege set", privname);
3300 		break;
3301 	case Z_PRIV_REQUIRED:
3302 		zerror(zlogp, B_FALSE, "required privilege \"%s\" is missing "
3303 		    "from the zone's privilege set", privname);
3304 		break;
3305 	case Z_PRIV_UNKNOWN:
3306 		zerror(zlogp, B_FALSE, "unknown privilege \"%s\" specified "
3307 		    "in the zone's privilege set", privname);
3308 		break;
3309 	default:
3310 		zerror(zlogp, B_FALSE, "failed to determine the zone's "
3311 		    "privilege set");
3312 		break;
3313 	}
3314 
3315 	free(privname);
3316 	zonecfg_fini_handle(handle);
3317 	return (error);
3318 }
3319 
3320 static int
3321 get_rctls(zlog_t *zlogp, char **bufp, size_t *bufsizep)
3322 {
3323 	nvlist_t *nvl = NULL;
3324 	char *nvl_packed = NULL;
3325 	size_t nvl_size = 0;
3326 	nvlist_t **nvlv = NULL;
3327 	int rctlcount = 0;
3328 	int error = -1;
3329 	zone_dochandle_t handle;
3330 	struct zone_rctltab rctltab;
3331 	rctlblk_t *rctlblk = NULL;
3332 	uint64_t maxlwps;
3333 	uint64_t maxprocs;
3334 
3335 	*bufp = NULL;
3336 	*bufsizep = 0;
3337 
3338 	if ((handle = zonecfg_init_handle()) == NULL) {
3339 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
3340 		return (-1);
3341 	}
3342 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
3343 		zerror(zlogp, B_FALSE, "invalid configuration");
3344 		zonecfg_fini_handle(handle);
3345 		return (-1);
3346 	}
3347 
3348 	rctltab.zone_rctl_valptr = NULL;
3349 	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0) {
3350 		zerror(zlogp, B_TRUE, "%s failed", "nvlist_alloc");
3351 		goto out;
3352 	}
3353 
3354 	/*
3355 	 * Allow the administrator to control both the maximum number of
3356 	 * process table slots and the maximum number of lwps with just the
3357 	 * max-processes property.  If only the max-processes property is set,
3358 	 * we add a max-lwps property with a limit derived from max-processes.
3359 	 */
3360 	if (zonecfg_get_aliased_rctl(handle, ALIAS_MAXPROCS, &maxprocs)
3361 	    == Z_OK &&
3362 	    zonecfg_get_aliased_rctl(handle, ALIAS_MAXLWPS, &maxlwps)
3363 	    == Z_NO_ENTRY) {
3364 		if (zonecfg_set_aliased_rctl(handle, ALIAS_MAXLWPS,
3365 		    maxprocs * LWPS_PER_PROCESS) != Z_OK) {
3366 			zerror(zlogp, B_FALSE, "unable to set max-lwps alias");
3367 			goto out;
3368 		}
3369 	}
3370 
3371 	if (zonecfg_setrctlent(handle) != Z_OK) {
3372 		zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setrctlent");
3373 		goto out;
3374 	}
3375 
3376 	if ((rctlblk = malloc(rctlblk_size())) == NULL) {
3377 		zerror(zlogp, B_TRUE, "memory allocation failed");
3378 		goto out;
3379 	}
3380 	while (zonecfg_getrctlent(handle, &rctltab) == Z_OK) {
3381 		struct zone_rctlvaltab *rctlval;
3382 		uint_t i, count;
3383 		const char *name = rctltab.zone_rctl_name;
3384 
3385 		/* zoneadm should have already warned about unknown rctls. */
3386 		if (!zonecfg_is_rctl(name)) {
3387 			zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3388 			rctltab.zone_rctl_valptr = NULL;
3389 			continue;
3390 		}
3391 		count = 0;
3392 		for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
3393 		    rctlval = rctlval->zone_rctlval_next) {
3394 			count++;
3395 		}
3396 		if (count == 0) {	/* ignore */
3397 			continue;	/* Nothing to free */
3398 		}
3399 		if ((nvlv = malloc(sizeof (*nvlv) * count)) == NULL)
3400 			goto out;
3401 		i = 0;
3402 		for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL;
3403 		    rctlval = rctlval->zone_rctlval_next, i++) {
3404 			if (nvlist_alloc(&nvlv[i], NV_UNIQUE_NAME, 0) != 0) {
3405 				zerror(zlogp, B_TRUE, "%s failed",
3406 				    "nvlist_alloc");
3407 				goto out;
3408 			}
3409 			if (zonecfg_construct_rctlblk(rctlval, rctlblk)
3410 			    != Z_OK) {
3411 				zerror(zlogp, B_FALSE, "invalid rctl value: "
3412 				    "(priv=%s,limit=%s,action=%s)",
3413 				    rctlval->zone_rctlval_priv,
3414 				    rctlval->zone_rctlval_limit,
3415 				    rctlval->zone_rctlval_action);
3416 				goto out;
3417 			}
3418 			if (!zonecfg_valid_rctl(name, rctlblk)) {
3419 				zerror(zlogp, B_FALSE,
3420 				    "(priv=%s,limit=%s,action=%s) is not a "
3421 				    "valid value for rctl '%s'",
3422 				    rctlval->zone_rctlval_priv,
3423 				    rctlval->zone_rctlval_limit,
3424 				    rctlval->zone_rctlval_action,
3425 				    name);
3426 				goto out;
3427 			}
3428 			if (nvlist_add_uint64(nvlv[i], "privilege",
3429 			    rctlblk_get_privilege(rctlblk)) != 0) {
3430 				zerror(zlogp, B_FALSE, "%s failed",
3431 				    "nvlist_add_uint64");
3432 				goto out;
3433 			}
3434 			if (nvlist_add_uint64(nvlv[i], "limit",
3435 			    rctlblk_get_value(rctlblk)) != 0) {
3436 				zerror(zlogp, B_FALSE, "%s failed",
3437 				    "nvlist_add_uint64");
3438 				goto out;
3439 			}
3440 			if (nvlist_add_uint64(nvlv[i], "action",
3441 			    (uint_t)rctlblk_get_local_action(rctlblk, NULL))
3442 			    != 0) {
3443 				zerror(zlogp, B_FALSE, "%s failed",
3444 				    "nvlist_add_uint64");
3445 				goto out;
3446 			}
3447 		}
3448 		zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3449 		rctltab.zone_rctl_valptr = NULL;
3450 		if (nvlist_add_nvlist_array(nvl, (char *)name, nvlv, count)
3451 		    != 0) {
3452 			zerror(zlogp, B_FALSE, "%s failed",
3453 			    "nvlist_add_nvlist_array");
3454 			goto out;
3455 		}
3456 		for (i = 0; i < count; i++)
3457 			nvlist_free(nvlv[i]);
3458 		free(nvlv);
3459 		nvlv = NULL;
3460 		rctlcount++;
3461 	}
3462 	(void) zonecfg_endrctlent(handle);
3463 
3464 	if (rctlcount == 0) {
3465 		error = 0;
3466 		goto out;
3467 	}
3468 	if (nvlist_pack(nvl, &nvl_packed, &nvl_size, NV_ENCODE_NATIVE, 0)
3469 	    != 0) {
3470 		zerror(zlogp, B_FALSE, "%s failed", "nvlist_pack");
3471 		goto out;
3472 	}
3473 
3474 	error = 0;
3475 	*bufp = nvl_packed;
3476 	*bufsizep = nvl_size;
3477 
3478 out:
3479 	free(rctlblk);
3480 	zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr);
3481 	if (error && nvl_packed != NULL)
3482 		free(nvl_packed);
3483 	nvlist_free(nvl);
3484 	if (nvlv != NULL)
3485 		free(nvlv);
3486 	if (handle != NULL)
3487 		zonecfg_fini_handle(handle);
3488 	return (error);
3489 }
3490 
3491 static int
3492 get_implicit_datasets(zlog_t *zlogp, char **retstr)
3493 {
3494 	char cmdbuf[2 * MAXPATHLEN];
3495 
3496 	if (query_hook[0] == '\0')
3497 		return (0);
3498 
3499 	if (snprintf(cmdbuf, sizeof (cmdbuf), "%s datasets", query_hook)
3500 	    > sizeof (cmdbuf))
3501 		return (-1);
3502 
3503 	if (do_subproc(zlogp, cmdbuf, retstr) != 0)
3504 		return (-1);
3505 
3506 	return (0);
3507 }
3508 
3509 static int
3510 get_datasets(zlog_t *zlogp, char **bufp, size_t *bufsizep)
3511 {
3512 	zone_dochandle_t handle;
3513 	struct zone_dstab dstab;
3514 	size_t total, offset, len;
3515 	int error = -1;
3516 	char *str = NULL;
3517 	char *implicit_datasets = NULL;
3518 	int implicit_len = 0;
3519 
3520 	*bufp = NULL;
3521 	*bufsizep = 0;
3522 
3523 	if ((handle = zonecfg_init_handle()) == NULL) {
3524 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
3525 		return (-1);
3526 	}
3527 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
3528 		zerror(zlogp, B_FALSE, "invalid configuration");
3529 		zonecfg_fini_handle(handle);
3530 		return (-1);
3531 	}
3532 
3533 	if (get_implicit_datasets(zlogp, &implicit_datasets) != 0) {
3534 		zerror(zlogp, B_FALSE, "getting implicit datasets failed");
3535 		goto out;
3536 	}
3537 
3538 	if (zonecfg_setdsent(handle) != Z_OK) {
3539 		zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
3540 		goto out;
3541 	}
3542 
3543 	total = 0;
3544 	while (zonecfg_getdsent(handle, &dstab) == Z_OK)
3545 		total += strlen(dstab.zone_dataset_name) + 1;
3546 	(void) zonecfg_enddsent(handle);
3547 
3548 	if (implicit_datasets != NULL)
3549 		implicit_len = strlen(implicit_datasets);
3550 	if (implicit_len > 0)
3551 		total += implicit_len + 1;
3552 
3553 	if (total == 0) {
3554 		error = 0;
3555 		goto out;
3556 	}
3557 
3558 	if ((str = malloc(total)) == NULL) {
3559 		zerror(zlogp, B_TRUE, "memory allocation failed");
3560 		goto out;
3561 	}
3562 
3563 	if (zonecfg_setdsent(handle) != Z_OK) {
3564 		zerror(zlogp, B_FALSE, "%s failed", "zonecfg_setdsent");
3565 		goto out;
3566 	}
3567 	offset = 0;
3568 	while (zonecfg_getdsent(handle, &dstab) == Z_OK) {
3569 		len = strlen(dstab.zone_dataset_name);
3570 		(void) strlcpy(str + offset, dstab.zone_dataset_name,
3571 		    total - offset);
3572 		offset += len;
3573 		if (offset < total - 1)
3574 			str[offset++] = ',';
3575 	}
3576 	(void) zonecfg_enddsent(handle);
3577 
3578 	if (implicit_len > 0)
3579 		(void) strlcpy(str + offset, implicit_datasets, total - offset);
3580 
3581 	error = 0;
3582 	*bufp = str;
3583 	*bufsizep = total;
3584 
3585 out:
3586 	if (error != 0 && str != NULL)
3587 		free(str);
3588 	if (handle != NULL)
3589 		zonecfg_fini_handle(handle);
3590 	if (implicit_datasets != NULL)
3591 		free(implicit_datasets);
3592 
3593 	return (error);
3594 }
3595 
3596 static int
3597 validate_datasets(zlog_t *zlogp)
3598 {
3599 	zone_dochandle_t handle;
3600 	struct zone_dstab dstab;
3601 	zfs_handle_t *zhp;
3602 	libzfs_handle_t *hdl;
3603 
3604 	if ((handle = zonecfg_init_handle()) == NULL) {
3605 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
3606 		return (-1);
3607 	}
3608 	if (zonecfg_get_snapshot_handle(zone_name, handle) != Z_OK) {
3609 		zerror(zlogp, B_FALSE, "invalid configuration");
3610 		zonecfg_fini_handle(handle);
3611 		return (-1);
3612 	}
3613 
3614 	if (zonecfg_setdsent(handle) != Z_OK) {
3615 		zerror(zlogp, B_FALSE, "invalid configuration");
3616 		zonecfg_fini_handle(handle);
3617 		return (-1);
3618 	}
3619 
3620 	if ((hdl = libzfs_init()) == NULL) {
3621 		zerror(zlogp, B_FALSE, "opening ZFS library");
3622 		zonecfg_fini_handle(handle);
3623 		return (-1);
3624 	}
3625 
3626 	while (zonecfg_getdsent(handle, &dstab) == Z_OK) {
3627 
3628 		if ((zhp = zfs_open(hdl, dstab.zone_dataset_name,
3629 		    ZFS_TYPE_FILESYSTEM)) == NULL) {
3630 			zerror(zlogp, B_FALSE, "cannot open ZFS dataset '%s'",
3631 			    dstab.zone_dataset_name);
3632 			zonecfg_fini_handle(handle);
3633 			libzfs_fini(hdl);
3634 			return (-1);
3635 		}
3636 
3637 		/*
3638 		 * Automatically set the 'zoned' property.  We check the value
3639 		 * first because we'll get EPERM if it is already set.
3640 		 */
3641 		if (!zfs_prop_get_int(zhp, ZFS_PROP_ZONED) &&
3642 		    zfs_prop_set(zhp, zfs_prop_to_name(ZFS_PROP_ZONED),
3643 		    "on") != 0) {
3644 			zerror(zlogp, B_FALSE, "cannot set 'zoned' "
3645 			    "property for ZFS dataset '%s'\n",
3646 			    dstab.zone_dataset_name);
3647 			zonecfg_fini_handle(handle);
3648 			zfs_close(zhp);
3649 			libzfs_fini(hdl);
3650 			return (-1);
3651 		}
3652 
3653 		zfs_close(zhp);
3654 	}
3655 	(void) zonecfg_enddsent(handle);
3656 
3657 	zonecfg_fini_handle(handle);
3658 	libzfs_fini(hdl);
3659 
3660 	return (0);
3661 }
3662 
3663 /*
3664  * Return true if the path is its own zfs file system.  We determine this
3665  * by stat-ing the path to see if it is zfs and stat-ing the parent to see
3666  * if it is a different fs.
3667  */
3668 boolean_t
3669 is_zonepath_zfs(char *zonepath)
3670 {
3671 	int res;
3672 	char *path;
3673 	char *parent;
3674 	struct statvfs64 buf1, buf2;
3675 
3676 	if (statvfs64(zonepath, &buf1) != 0)
3677 		return (B_FALSE);
3678 
3679 	if (strcmp(buf1.f_basetype, "zfs") != 0)
3680 		return (B_FALSE);
3681 
3682 	if ((path = strdup(zonepath)) == NULL)
3683 		return (B_FALSE);
3684 
3685 	parent = dirname(path);
3686 	res = statvfs64(parent, &buf2);
3687 	free(path);
3688 
3689 	if (res != 0)
3690 		return (B_FALSE);
3691 
3692 	if (buf1.f_fsid == buf2.f_fsid)
3693 		return (B_FALSE);
3694 
3695 	return (B_TRUE);
3696 }
3697 
3698 /*
3699  * Verify the MAC label in the root dataset for the zone.
3700  * If the label exists, it must match the label configured for the zone.
3701  * Otherwise if there's no label on the dataset, create one here.
3702  */
3703 
3704 static int
3705 validate_rootds_label(zlog_t *zlogp, char *rootpath, m_label_t *zone_sl)
3706 {
3707 	int		error = -1;
3708 	zfs_handle_t	*zhp;
3709 	libzfs_handle_t	*hdl;
3710 	m_label_t	ds_sl;
3711 	char		zonepath[MAXPATHLEN];
3712 	char		ds_hexsl[MAXNAMELEN];
3713 
3714 	if (!is_system_labeled())
3715 		return (0);
3716 
3717 	if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
3718 		zerror(zlogp, B_TRUE, "unable to determine zone path");
3719 		return (-1);
3720 	}
3721 
3722 	if (!is_zonepath_zfs(zonepath))
3723 		return (0);
3724 
3725 	if ((hdl = libzfs_init()) == NULL) {
3726 		zerror(zlogp, B_FALSE, "opening ZFS library");
3727 		return (-1);
3728 	}
3729 
3730 	if ((zhp = zfs_path_to_zhandle(hdl, rootpath,
3731 	    ZFS_TYPE_FILESYSTEM)) == NULL) {
3732 		zerror(zlogp, B_FALSE, "cannot open ZFS dataset for path '%s'",
3733 		    rootpath);
3734 		libzfs_fini(hdl);
3735 		return (-1);
3736 	}
3737 
3738 	/* Get the mlslabel property if it exists. */
3739 	if ((zfs_prop_get(zhp, ZFS_PROP_MLSLABEL, ds_hexsl, MAXNAMELEN,
3740 	    NULL, NULL, 0, B_TRUE) != 0) ||
3741 	    (strcmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) == 0)) {
3742 		char		*str2 = NULL;
3743 
3744 		/*
3745 		 * No label on the dataset (or default only); create one.
3746 		 * (Only do this automatic labeling for the labeled brand.)
3747 		 */
3748 		if (strcmp(brand_name, LABELED_BRAND_NAME) != 0) {
3749 			error = 0;
3750 			goto out;
3751 		}
3752 
3753 		error = l_to_str_internal(zone_sl, &str2);
3754 		if (error)
3755 			goto out;
3756 		if (str2 == NULL) {
3757 			error = -1;
3758 			goto out;
3759 		}
3760 		if ((error = zfs_prop_set(zhp,
3761 		    zfs_prop_to_name(ZFS_PROP_MLSLABEL), str2)) != 0) {
3762 			zerror(zlogp, B_FALSE, "cannot set 'mlslabel' "
3763 			    "property for root dataset at '%s'\n", rootpath);
3764 		}
3765 		free(str2);
3766 		goto out;
3767 	}
3768 
3769 	/* Convert the retrieved dataset label to binary form. */
3770 	error = hexstr_to_label(ds_hexsl, &ds_sl);
3771 	if (error) {
3772 		zerror(zlogp, B_FALSE, "invalid 'mlslabel' "
3773 		    "property on root dataset at '%s'\n", rootpath);
3774 		goto out;			/* exit with error */
3775 	}
3776 
3777 	/*
3778 	 * Perform a MAC check by comparing the zone label with the
3779 	 * dataset label.
3780 	 */
3781 	error = (!blequal(zone_sl, &ds_sl));
3782 	if (error)
3783 		zerror(zlogp, B_FALSE, "Rootpath dataset has mismatched label");
3784 out:
3785 	zfs_close(zhp);
3786 	libzfs_fini(hdl);
3787 
3788 	return (error);
3789 }
3790 
3791 /*
3792  * Mount lower level home directories into/from current zone
3793  * Share exported directories specified in dfstab for zone
3794  */
3795 static int
3796 tsol_mounts(zlog_t *zlogp, char *zone_name, char *rootpath)
3797 {
3798 	zoneid_t *zids = NULL;
3799 	priv_set_t *zid_privs;
3800 	const priv_impl_info_t *ip = NULL;
3801 	uint_t nzents_saved;
3802 	uint_t nzents;
3803 	int i;
3804 	char readonly[] = "ro";
3805 	struct zone_fstab lower_fstab;
3806 	char *argv[4];
3807 
3808 	if (!is_system_labeled())
3809 		return (0);
3810 
3811 	if (zid_label == NULL) {
3812 		zid_label = m_label_alloc(MAC_LABEL);
3813 		if (zid_label == NULL)
3814 			return (-1);
3815 	}
3816 
3817 	/* Make sure our zone has an /export/home dir */
3818 	(void) make_one_dir(zlogp, rootpath, "/export/home",
3819 	    DEFAULT_DIR_MODE, DEFAULT_DIR_USER, DEFAULT_DIR_GROUP);
3820 
3821 	lower_fstab.zone_fs_raw[0] = '\0';
3822 	(void) strlcpy(lower_fstab.zone_fs_type, MNTTYPE_LOFS,
3823 	    sizeof (lower_fstab.zone_fs_type));
3824 	lower_fstab.zone_fs_options = NULL;
3825 	(void) zonecfg_add_fs_option(&lower_fstab, readonly);
3826 
3827 	/*
3828 	 * Get the list of zones from the kernel
3829 	 */
3830 	if (zone_list(NULL, &nzents) != 0) {
3831 		zerror(zlogp, B_TRUE, "unable to list zones");
3832 		zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3833 		return (-1);
3834 	}
3835 again:
3836 	if (nzents == 0) {
3837 		zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3838 		return (-1);
3839 	}
3840 
3841 	zids = malloc(nzents * sizeof (zoneid_t));
3842 	if (zids == NULL) {
3843 		zerror(zlogp, B_TRUE, "memory allocation failed");
3844 		return (-1);
3845 	}
3846 	nzents_saved = nzents;
3847 
3848 	if (zone_list(zids, &nzents) != 0) {
3849 		zerror(zlogp, B_TRUE, "unable to list zones");
3850 		zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
3851 		free(zids);
3852 		return (-1);
3853 	}
3854 	if (nzents != nzents_saved) {
3855 		/* list changed, try again */
3856 		free(zids);
3857 		goto again;
3858 	}
3859 
3860 	ip = getprivimplinfo();
3861 	if ((zid_privs = priv_allocset()) == NULL) {
3862 		zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
3863 		zonecfg_free_fs_option_list(
3864 		    lower_fstab.zone_fs_options);
3865 		free(zids);
3866 		return (-1);
3867 	}
3868 
3869 	for (i = 0; i < nzents; i++) {
3870 		char zid_name[ZONENAME_MAX];
3871 		zone_state_t zid_state;
3872 		char zid_rpath[MAXPATHLEN];
3873 		struct stat stat_buf;
3874 
3875 		if (zids[i] == GLOBAL_ZONEID)
3876 			continue;
3877 
3878 		if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
3879 			continue;
3880 
3881 		/*
3882 		 * Do special setup for the zone we are booting
3883 		 */
3884 		if (strcmp(zid_name, zone_name) == 0) {
3885 			struct zone_fstab autofs_fstab;
3886 			char map_path[MAXPATHLEN];
3887 			int fd;
3888 
3889 			/*
3890 			 * Create auto_home_<zone> map for this zone
3891 			 * in the global zone. The non-global zone entry
3892 			 * will be created by automount when the zone
3893 			 * is booted.
3894 			 */
3895 
3896 			(void) snprintf(autofs_fstab.zone_fs_special,
3897 			    MAXPATHLEN, "auto_home_%s", zid_name);
3898 
3899 			(void) snprintf(autofs_fstab.zone_fs_dir, MAXPATHLEN,
3900 			    "/zone/%s/home", zid_name);
3901 
3902 			(void) snprintf(map_path, sizeof (map_path),
3903 			    "/etc/%s", autofs_fstab.zone_fs_special);
3904 			/*
3905 			 * If the map file doesn't exist create a template
3906 			 */
3907 			if ((fd = open(map_path, O_RDWR | O_CREAT | O_EXCL,
3908 			    S_IRUSR | S_IWUSR | S_IRGRP| S_IROTH)) != -1) {
3909 				int len;
3910 				char map_rec[MAXPATHLEN];
3911 
3912 				len = snprintf(map_rec, sizeof (map_rec),
3913 				    "+%s\n*\t-fstype=lofs\t:%s/export/home/&\n",
3914 				    autofs_fstab.zone_fs_special, rootpath);
3915 				(void) write(fd, map_rec, len);
3916 				(void) close(fd);
3917 			}
3918 
3919 			/*
3920 			 * Mount auto_home_<zone> in the global zone if absent.
3921 			 * If it's already of type autofs, then
3922 			 * don't mount it again.
3923 			 */
3924 			if ((stat(autofs_fstab.zone_fs_dir, &stat_buf) == -1) ||
3925 			    strcmp(stat_buf.st_fstype, MNTTYPE_AUTOFS) != 0) {
3926 				char optstr[] = "indirect,ignore,nobrowse";
3927 
3928 				(void) make_one_dir(zlogp, "",
3929 				    autofs_fstab.zone_fs_dir, DEFAULT_DIR_MODE,
3930 				    DEFAULT_DIR_USER, DEFAULT_DIR_GROUP);
3931 
3932 				/*
3933 				 * Mount will fail if automounter has already
3934 				 * processed the auto_home_<zonename> map
3935 				 */
3936 				(void) domount(zlogp, MNTTYPE_AUTOFS, optstr,
3937 				    autofs_fstab.zone_fs_special,
3938 				    autofs_fstab.zone_fs_dir);
3939 			}
3940 			continue;
3941 		}
3942 
3943 
3944 		if (zone_get_state(zid_name, &zid_state) != Z_OK ||
3945 		    (zid_state != ZONE_STATE_READY &&
3946 		    zid_state != ZONE_STATE_RUNNING))
3947 			/* Skip over zones without mounted filesystems */
3948 			continue;
3949 
3950 		if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
3951 		    sizeof (m_label_t)) < 0)
3952 			/* Skip over zones with unspecified label */
3953 			continue;
3954 
3955 		if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
3956 		    sizeof (zid_rpath)) == -1)
3957 			/* Skip over zones with bad path */
3958 			continue;
3959 
3960 		if (zone_getattr(zids[i], ZONE_ATTR_PRIVSET, zid_privs,
3961 		    sizeof (priv_chunk_t) * ip->priv_setsize) == -1)
3962 			/* Skip over zones with bad privs */
3963 			continue;
3964 
3965 		/*
3966 		 * Reading down is valid according to our label model
3967 		 * but some customers want to disable it because it
3968 		 * allows execute down and other possible attacks.
3969 		 * Therefore, we restrict this feature to zones that
3970 		 * have the NET_MAC_AWARE privilege which is required
3971 		 * for NFS read-down semantics.
3972 		 */
3973 		if ((bldominates(zlabel, zid_label)) &&
3974 		    (priv_ismember(zprivs, PRIV_NET_MAC_AWARE))) {
3975 			/*
3976 			 * Our zone dominates this one.
3977 			 * Create a lofs mount from lower zone's /export/home
3978 			 */
3979 			(void) snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
3980 			    "%s/zone/%s/export/home", rootpath, zid_name);
3981 
3982 			/*
3983 			 * If the target is already an LOFS mount
3984 			 * then don't do it again.
3985 			 */
3986 			if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
3987 			    strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
3988 
3989 				if (snprintf(lower_fstab.zone_fs_special,
3990 				    MAXPATHLEN, "%s/export",
3991 				    zid_rpath) > MAXPATHLEN)
3992 					continue;
3993 
3994 				/*
3995 				 * Make sure the lower-level home exists
3996 				 */
3997 				if (make_one_dir(zlogp,
3998 				    lower_fstab.zone_fs_special, "/home",
3999 				    DEFAULT_DIR_MODE, DEFAULT_DIR_USER,
4000 				    DEFAULT_DIR_GROUP) != 0)
4001 					continue;
4002 
4003 				(void) strlcat(lower_fstab.zone_fs_special,
4004 				    "/home", MAXPATHLEN);
4005 
4006 				/*
4007 				 * Mount can fail because the lower-level
4008 				 * zone may have already done a mount up.
4009 				 */
4010 				(void) mount_one(zlogp, &lower_fstab, "",
4011 				    Z_MNT_BOOT);
4012 			}
4013 		} else if ((bldominates(zid_label, zlabel)) &&
4014 		    (priv_ismember(zid_privs, PRIV_NET_MAC_AWARE))) {
4015 			/*
4016 			 * This zone dominates our zone.
4017 			 * Create a lofs mount from our zone's /export/home
4018 			 */
4019 			if (snprintf(lower_fstab.zone_fs_dir, MAXPATHLEN,
4020 			    "%s/zone/%s/export/home", zid_rpath,
4021 			    zone_name) > MAXPATHLEN)
4022 				continue;
4023 
4024 			/*
4025 			 * If the target is already an LOFS mount
4026 			 * then don't do it again.
4027 			 */
4028 			if ((stat(lower_fstab.zone_fs_dir, &stat_buf) == -1) ||
4029 			    strcmp(stat_buf.st_fstype, MNTTYPE_LOFS) != 0) {
4030 
4031 				(void) snprintf(lower_fstab.zone_fs_special,
4032 				    MAXPATHLEN, "%s/export/home", rootpath);
4033 
4034 				/*
4035 				 * Mount can fail because the higher-level
4036 				 * zone may have already done a mount down.
4037 				 */
4038 				(void) mount_one(zlogp, &lower_fstab, "",
4039 				    Z_MNT_BOOT);
4040 			}
4041 		}
4042 	}
4043 	zonecfg_free_fs_option_list(lower_fstab.zone_fs_options);
4044 	priv_freeset(zid_privs);
4045 	free(zids);
4046 
4047 	/*
4048 	 * Now share any exported directories from this zone.
4049 	 * Each zone can have its own dfstab.
4050 	 */
4051 
4052 	argv[0] = "zoneshare";
4053 	argv[1] = "-z";
4054 	argv[2] = zone_name;
4055 	argv[3] = NULL;
4056 
4057 	(void) forkexec(zlogp, "/usr/lib/zones/zoneshare", argv);
4058 	/* Don't check for errors since they don't affect the zone */
4059 
4060 	return (0);
4061 }
4062 
4063 /*
4064  * Unmount lofs mounts from higher level zones
4065  * Unshare nfs exported directories
4066  */
4067 static void
4068 tsol_unmounts(zlog_t *zlogp, char *zone_name)
4069 {
4070 	zoneid_t *zids = NULL;
4071 	uint_t nzents_saved;
4072 	uint_t nzents;
4073 	int i;
4074 	char *argv[4];
4075 	char path[MAXPATHLEN];
4076 
4077 	if (!is_system_labeled())
4078 		return;
4079 
4080 	/*
4081 	 * Get the list of zones from the kernel
4082 	 */
4083 	if (zone_list(NULL, &nzents) != 0) {
4084 		return;
4085 	}
4086 
4087 	if (zid_label == NULL) {
4088 		zid_label = m_label_alloc(MAC_LABEL);
4089 		if (zid_label == NULL)
4090 			return;
4091 	}
4092 
4093 again:
4094 	if (nzents == 0)
4095 		return;
4096 
4097 	zids = malloc(nzents * sizeof (zoneid_t));
4098 	if (zids == NULL) {
4099 		zerror(zlogp, B_TRUE, "memory allocation failed");
4100 		return;
4101 	}
4102 	nzents_saved = nzents;
4103 
4104 	if (zone_list(zids, &nzents) != 0) {
4105 		free(zids);
4106 		return;
4107 	}
4108 	if (nzents != nzents_saved) {
4109 		/* list changed, try again */
4110 		free(zids);
4111 		goto again;
4112 	}
4113 
4114 	for (i = 0; i < nzents; i++) {
4115 		char zid_name[ZONENAME_MAX];
4116 		zone_state_t zid_state;
4117 		char zid_rpath[MAXPATHLEN];
4118 
4119 		if (zids[i] == GLOBAL_ZONEID)
4120 			continue;
4121 
4122 		if (getzonenamebyid(zids[i], zid_name, ZONENAME_MAX) == -1)
4123 			continue;
4124 
4125 		/*
4126 		 * Skip the zone we are halting
4127 		 */
4128 		if (strcmp(zid_name, zone_name) == 0)
4129 			continue;
4130 
4131 		if ((zone_getattr(zids[i], ZONE_ATTR_STATUS, &zid_state,
4132 		    sizeof (zid_state)) < 0) ||
4133 		    (zid_state < ZONE_IS_READY))
4134 			/* Skip over zones without mounted filesystems */
4135 			continue;
4136 
4137 		if (zone_getattr(zids[i], ZONE_ATTR_SLBL, zid_label,
4138 		    sizeof (m_label_t)) < 0)
4139 			/* Skip over zones with unspecified label */
4140 			continue;
4141 
4142 		if (zone_getattr(zids[i], ZONE_ATTR_ROOT, zid_rpath,
4143 		    sizeof (zid_rpath)) == -1)
4144 			/* Skip over zones with bad path */
4145 			continue;
4146 
4147 		if (zlabel != NULL && bldominates(zid_label, zlabel)) {
4148 			/*
4149 			 * This zone dominates our zone.
4150 			 * Unmount the lofs mount of our zone's /export/home
4151 			 */
4152 
4153 			if (snprintf(path, MAXPATHLEN,
4154 			    "%s/zone/%s/export/home", zid_rpath,
4155 			    zone_name) > MAXPATHLEN)
4156 				continue;
4157 
4158 			/* Skip over mount failures */
4159 			(void) umount(path);
4160 		}
4161 	}
4162 	free(zids);
4163 
4164 	/*
4165 	 * Unmount global zone autofs trigger for this zone
4166 	 */
4167 	(void) snprintf(path, MAXPATHLEN, "/zone/%s/home", zone_name);
4168 	/* Skip over mount failures */
4169 	(void) umount(path);
4170 
4171 	/*
4172 	 * Next unshare any exported directories from this zone.
4173 	 */
4174 
4175 	argv[0] = "zoneunshare";
4176 	argv[1] = "-z";
4177 	argv[2] = zone_name;
4178 	argv[3] = NULL;
4179 
4180 	(void) forkexec(zlogp, "/usr/lib/zones/zoneunshare", argv);
4181 	/* Don't check for errors since they don't affect the zone */
4182 
4183 	/*
4184 	 * Finally, deallocate any devices in the zone.
4185 	 */
4186 
4187 	argv[0] = "deallocate";
4188 	argv[1] = "-Isz";
4189 	argv[2] = zone_name;
4190 	argv[3] = NULL;
4191 
4192 	(void) forkexec(zlogp, "/usr/sbin/deallocate", argv);
4193 	/* Don't check for errors since they don't affect the zone */
4194 }
4195 
4196 /*
4197  * Fetch the Trusted Extensions label and multi-level ports (MLPs) for
4198  * this zone.
4199  */
4200 static tsol_zcent_t *
4201 get_zone_label(zlog_t *zlogp, priv_set_t *privs)
4202 {
4203 	FILE *fp;
4204 	tsol_zcent_t *zcent = NULL;
4205 	char line[MAXTNZLEN];
4206 
4207 	if ((fp = fopen(TNZONECFG_PATH, "r")) == NULL) {
4208 		zerror(zlogp, B_TRUE, "%s", TNZONECFG_PATH);
4209 		return (NULL);
4210 	}
4211 
4212 	while (fgets(line, sizeof (line), fp) != NULL) {
4213 		/*
4214 		 * Check for malformed database
4215 		 */
4216 		if (strlen(line) == MAXTNZLEN - 1)
4217 			break;
4218 		if ((zcent = tsol_sgetzcent(line, NULL, NULL)) == NULL)
4219 			continue;
4220 		if (strcmp(zcent->zc_name, zone_name) == 0)
4221 			break;
4222 		tsol_freezcent(zcent);
4223 		zcent = NULL;
4224 	}
4225 	(void) fclose(fp);
4226 
4227 	if (zcent == NULL) {
4228 		zerror(zlogp, B_FALSE, "zone requires a label assignment. "
4229 		    "See tnzonecfg(4)");
4230 	} else {
4231 		if (zlabel == NULL)
4232 			zlabel = m_label_alloc(MAC_LABEL);
4233 		/*
4234 		 * Save this zone's privileges for later read-down processing
4235 		 */
4236 		if ((zprivs = priv_allocset()) == NULL) {
4237 			zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
4238 			return (NULL);
4239 		} else {
4240 			priv_copyset(privs, zprivs);
4241 		}
4242 	}
4243 	return (zcent);
4244 }
4245 
4246 /*
4247  * Add the Trusted Extensions multi-level ports for this zone.
4248  */
4249 static void
4250 set_mlps(zlog_t *zlogp, zoneid_t zoneid, tsol_zcent_t *zcent)
4251 {
4252 	tsol_mlp_t *mlp;
4253 	tsol_mlpent_t tsme;
4254 
4255 	if (!is_system_labeled())
4256 		return;
4257 
4258 	tsme.tsme_zoneid = zoneid;
4259 	tsme.tsme_flags = 0;
4260 	for (mlp = zcent->zc_private_mlp; !TSOL_MLP_END(mlp); mlp++) {
4261 		tsme.tsme_mlp = *mlp;
4262 		if (tnmlp(TNDB_LOAD, &tsme) != 0) {
4263 			zerror(zlogp, B_TRUE, "cannot set zone-specific MLP "
4264 			    "on %d-%d/%d", mlp->mlp_port,
4265 			    mlp->mlp_port_upper, mlp->mlp_ipp);
4266 		}
4267 	}
4268 
4269 	tsme.tsme_flags = TSOL_MEF_SHARED;
4270 	for (mlp = zcent->zc_shared_mlp; !TSOL_MLP_END(mlp); mlp++) {
4271 		tsme.tsme_mlp = *mlp;
4272 		if (tnmlp(TNDB_LOAD, &tsme) != 0) {
4273 			zerror(zlogp, B_TRUE, "cannot set shared MLP "
4274 			    "on %d-%d/%d", mlp->mlp_port,
4275 			    mlp->mlp_port_upper, mlp->mlp_ipp);
4276 		}
4277 	}
4278 }
4279 
4280 static void
4281 remove_mlps(zlog_t *zlogp, zoneid_t zoneid)
4282 {
4283 	tsol_mlpent_t tsme;
4284 
4285 	if (!is_system_labeled())
4286 		return;
4287 
4288 	(void) memset(&tsme, 0, sizeof (tsme));
4289 	tsme.tsme_zoneid = zoneid;
4290 	if (tnmlp(TNDB_FLUSH, &tsme) != 0)
4291 		zerror(zlogp, B_TRUE, "cannot flush MLPs");
4292 }
4293 
4294 int
4295 prtmount(const struct mnttab *fs, void *x)
4296 {
4297 	zerror((zlog_t *)x, B_FALSE, "  %s", fs->mnt_mountp);
4298 	return (0);
4299 }
4300 
4301 /*
4302  * Look for zones running on the main system that are using this root (or any
4303  * subdirectory of it).  Return B_TRUE and print an error if a conflicting zone
4304  * is found or if we can't tell.
4305  */
4306 static boolean_t
4307 duplicate_zone_root(zlog_t *zlogp, const char *rootpath)
4308 {
4309 	zoneid_t *zids = NULL;
4310 	uint_t nzids = 0;
4311 	boolean_t retv;
4312 	int rlen, zlen;
4313 	char zroot[MAXPATHLEN];
4314 	char zonename[ZONENAME_MAX];
4315 
4316 	for (;;) {
4317 		nzids += 10;
4318 		zids = malloc(nzids * sizeof (*zids));
4319 		if (zids == NULL) {
4320 			zerror(zlogp, B_TRUE, "memory allocation failed");
4321 			return (B_TRUE);
4322 		}
4323 		if (zone_list(zids, &nzids) == 0)
4324 			break;
4325 		free(zids);
4326 	}
4327 	retv = B_FALSE;
4328 	rlen = strlen(rootpath);
4329 	while (nzids > 0) {
4330 		/*
4331 		 * Ignore errors; they just mean that the zone has disappeared
4332 		 * while we were busy.
4333 		 */
4334 		if (zone_getattr(zids[--nzids], ZONE_ATTR_ROOT, zroot,
4335 		    sizeof (zroot)) == -1)
4336 			continue;
4337 		zlen = strlen(zroot);
4338 		if (zlen > rlen)
4339 			zlen = rlen;
4340 		if (strncmp(rootpath, zroot, zlen) == 0 &&
4341 		    (zroot[zlen] == '\0' || zroot[zlen] == '/') &&
4342 		    (rootpath[zlen] == '\0' || rootpath[zlen] == '/')) {
4343 			if (getzonenamebyid(zids[nzids], zonename,
4344 			    sizeof (zonename)) == -1)
4345 				(void) snprintf(zonename, sizeof (zonename),
4346 				    "id %d", (int)zids[nzids]);
4347 			zerror(zlogp, B_FALSE,
4348 			    "zone root %s already in use by zone %s",
4349 			    rootpath, zonename);
4350 			retv = B_TRUE;
4351 			break;
4352 		}
4353 	}
4354 	free(zids);
4355 	return (retv);
4356 }
4357 
4358 /*
4359  * Search for loopback mounts that use this same source node (same device and
4360  * inode).  Return B_TRUE if there is one or if we can't tell.
4361  */
4362 static boolean_t
4363 duplicate_reachable_path(zlog_t *zlogp, const char *rootpath)
4364 {
4365 	struct stat64 rst, zst;
4366 	struct mnttab *mnp;
4367 
4368 	if (stat64(rootpath, &rst) == -1) {
4369 		zerror(zlogp, B_TRUE, "can't stat %s", rootpath);
4370 		return (B_TRUE);
4371 	}
4372 	if (resolve_lofs_mnts == NULL && lofs_read_mnttab(zlogp) == -1)
4373 		return (B_TRUE);
4374 	for (mnp = resolve_lofs_mnts; mnp < resolve_lofs_mnt_max; mnp++) {
4375 		if (mnp->mnt_fstype == NULL ||
4376 		    strcmp(MNTTYPE_LOFS, mnp->mnt_fstype) != 0)
4377 			continue;
4378 		/* We're looking at a loopback mount.  Stat it. */
4379 		if (mnp->mnt_special != NULL &&
4380 		    stat64(mnp->mnt_special, &zst) != -1 &&
4381 		    rst.st_dev == zst.st_dev && rst.st_ino == zst.st_ino) {
4382 			zerror(zlogp, B_FALSE,
4383 			    "zone root %s is reachable through %s",
4384 			    rootpath, mnp->mnt_mountp);
4385 			return (B_TRUE);
4386 		}
4387 	}
4388 	return (B_FALSE);
4389 }
4390 
4391 /*
4392  * Set memory cap and pool info for the zone's resource management
4393  * configuration.
4394  */
4395 static int
4396 setup_zone_rm(zlog_t *zlogp, char *zone_name, zoneid_t zoneid)
4397 {
4398 	int res;
4399 	uint64_t tmp;
4400 	struct zone_mcaptab mcap;
4401 	char sched[MAXNAMELEN];
4402 	zone_dochandle_t handle = NULL;
4403 	char pool_err[128];
4404 
4405 	if ((handle = zonecfg_init_handle()) == NULL) {
4406 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
4407 		return (Z_BAD_HANDLE);
4408 	}
4409 
4410 	if ((res = zonecfg_get_snapshot_handle(zone_name, handle)) != Z_OK) {
4411 		zerror(zlogp, B_FALSE, "invalid configuration");
4412 		zonecfg_fini_handle(handle);
4413 		return (res);
4414 	}
4415 
4416 	/*
4417 	 * If a memory cap is configured, set the cap in the kernel using
4418 	 * zone_setattr() and make sure the rcapd SMF service is enabled.
4419 	 */
4420 	if (zonecfg_getmcapent(handle, &mcap) == Z_OK) {
4421 		uint64_t num;
4422 		char smf_err[128];
4423 
4424 		num = (uint64_t)strtoull(mcap.zone_physmem_cap, NULL, 10);
4425 		if (zone_setattr(zoneid, ZONE_ATTR_PHYS_MCAP, &num, 0) == -1) {
4426 			zerror(zlogp, B_TRUE, "could not set zone memory cap");
4427 			zonecfg_fini_handle(handle);
4428 			return (Z_INVAL);
4429 		}
4430 
4431 		if (zonecfg_enable_rcapd(smf_err, sizeof (smf_err)) != Z_OK) {
4432 			zerror(zlogp, B_FALSE, "enabling system/rcap service "
4433 			    "failed: %s", smf_err);
4434 			zonecfg_fini_handle(handle);
4435 			return (Z_INVAL);
4436 		}
4437 	}
4438 
4439 	/* Get the scheduling class set in the zone configuration. */
4440 	if (zonecfg_get_sched_class(handle, sched, sizeof (sched)) == Z_OK &&
4441 	    strlen(sched) > 0) {
4442 		if (zone_setattr(zoneid, ZONE_ATTR_SCHED_CLASS, sched,
4443 		    strlen(sched)) == -1)
4444 			zerror(zlogp, B_TRUE, "WARNING: unable to set the "
4445 			    "default scheduling class");
4446 
4447 	} else if (zonecfg_get_aliased_rctl(handle, ALIAS_SHARES, &tmp)
4448 	    == Z_OK) {
4449 		/*
4450 		 * If the zone has the zone.cpu-shares rctl set then we want to
4451 		 * use the Fair Share Scheduler (FSS) for processes in the
4452 		 * zone.  Check what scheduling class the zone would be running
4453 		 * in by default so we can print a warning and modify the class
4454 		 * if we wouldn't be using FSS.
4455 		 */
4456 		char class_name[PC_CLNMSZ];
4457 
4458 		if (zonecfg_get_dflt_sched_class(handle, class_name,
4459 		    sizeof (class_name)) != Z_OK) {
4460 			zerror(zlogp, B_FALSE, "WARNING: unable to determine "
4461 			    "the zone's scheduling class");
4462 
4463 		} else if (strcmp("FSS", class_name) != 0) {
4464 			zerror(zlogp, B_FALSE, "WARNING: The zone.cpu-shares "
4465 			    "rctl is set but\nFSS is not the default "
4466 			    "scheduling class for\nthis zone.  FSS will be "
4467 			    "used for processes\nin the zone but to get the "
4468 			    "full benefit of FSS,\nit should be the default "
4469 			    "scheduling class.\nSee dispadmin(1M) for more "
4470 			    "details.");
4471 
4472 			if (zone_setattr(zoneid, ZONE_ATTR_SCHED_CLASS, "FSS",
4473 			    strlen("FSS")) == -1)
4474 				zerror(zlogp, B_TRUE, "WARNING: unable to set "
4475 				    "zone scheduling class to FSS");
4476 		}
4477 	}
4478 
4479 	/*
4480 	 * The next few blocks of code attempt to set up temporary pools as
4481 	 * well as persistent pools.  In all cases we call the functions
4482 	 * unconditionally.  Within each funtion the code will check if the
4483 	 * zone is actually configured for a temporary pool or persistent pool
4484 	 * and just return if there is nothing to do.
4485 	 *
4486 	 * If we are rebooting we want to attempt to reuse any temporary pool
4487 	 * that was previously set up.  zonecfg_bind_tmp_pool() will do the
4488 	 * right thing in all cases (reuse or create) based on the current
4489 	 * zonecfg.
4490 	 */
4491 	if ((res = zonecfg_bind_tmp_pool(handle, zoneid, pool_err,
4492 	    sizeof (pool_err))) != Z_OK) {
4493 		if (res == Z_POOL || res == Z_POOL_CREATE || res == Z_POOL_BIND)
4494 			zerror(zlogp, B_FALSE, "%s: %s\ndedicated-cpu setting "
4495 			    "cannot be instantiated", zonecfg_strerror(res),
4496 			    pool_err);
4497 		else
4498 			zerror(zlogp, B_FALSE, "could not bind zone to "
4499 			    "temporary pool: %s", zonecfg_strerror(res));
4500 		zonecfg_fini_handle(handle);
4501 		return (Z_POOL_BIND);
4502 	}
4503 
4504 	/*
4505 	 * Check if we need to warn about poold not being enabled.
4506 	 */
4507 	if (zonecfg_warn_poold(handle)) {
4508 		zerror(zlogp, B_FALSE, "WARNING: A range of dedicated-cpus has "
4509 		    "been specified\nbut the dynamic pool service is not "
4510 		    "enabled.\nThe system will not dynamically adjust the\n"
4511 		    "processor allocation within the specified range\n"
4512 		    "until svc:/system/pools/dynamic is enabled.\n"
4513 		    "See poold(1M).");
4514 	}
4515 
4516 	/* The following is a warning, not an error. */
4517 	if ((res = zonecfg_bind_pool(handle, zoneid, pool_err,
4518 	    sizeof (pool_err))) != Z_OK) {
4519 		if (res == Z_POOL_BIND)
4520 			zerror(zlogp, B_FALSE, "WARNING: unable to bind to "
4521 			    "pool '%s'; using default pool.", pool_err);
4522 		else if (res == Z_POOL)
4523 			zerror(zlogp, B_FALSE, "WARNING: %s: %s",
4524 			    zonecfg_strerror(res), pool_err);
4525 		else
4526 			zerror(zlogp, B_FALSE, "WARNING: %s",
4527 			    zonecfg_strerror(res));
4528 	}
4529 
4530 	/* Update saved pool name in case it has changed */
4531 	(void) zonecfg_get_poolname(handle, zone_name, pool_name,
4532 	    sizeof (pool_name));
4533 
4534 	zonecfg_fini_handle(handle);
4535 	return (Z_OK);
4536 }
4537 
4538 static void
4539 report_prop_err(zlog_t *zlogp, const char *name, const char *value, int res)
4540 {
4541 	switch (res) {
4542 	case Z_TOO_BIG:
4543 		zerror(zlogp, B_FALSE, "%s property value is too large.", name);
4544 		break;
4545 
4546 	case Z_INVALID_PROPERTY:
4547 		zerror(zlogp, B_FALSE, "%s property value \"%s\" is not valid",
4548 		    name, value);
4549 		break;
4550 
4551 	default:
4552 		zerror(zlogp, B_TRUE, "fetching property %s: %d", name, res);
4553 		break;
4554 	}
4555 }
4556 
4557 /*
4558  * Sets the hostid of the new zone based on its configured value.  The zone's
4559  * zone_t structure must already exist in kernel memory.  'zlogp' refers to the
4560  * log used to report errors and warnings and must be non-NULL.  'zone_namep'
4561  * is the name of the new zone and must be non-NULL.  'zoneid' is the numeric
4562  * ID of the new zone.
4563  *
4564  * This function returns zero on success and a nonzero error code on failure.
4565  */
4566 static int
4567 setup_zone_hostid(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4568 {
4569 	int res;
4570 	char hostidp[HW_HOSTID_LEN];
4571 	unsigned int hostid;
4572 
4573 	res = zonecfg_get_hostid(handle, hostidp, sizeof (hostidp));
4574 
4575 	if (res == Z_BAD_PROPERTY) {
4576 		return (Z_OK);
4577 	} else if (res != Z_OK) {
4578 		report_prop_err(zlogp, "hostid", hostidp, res);
4579 		return (res);
4580 	}
4581 
4582 	hostid = (unsigned int)strtoul(hostidp, NULL, 16);
4583 	if ((res = zone_setattr(zoneid, ZONE_ATTR_HOSTID, &hostid,
4584 	    sizeof (hostid))) != 0) {
4585 		zerror(zlogp, B_TRUE,
4586 		    "zone hostid is not valid: %s: %d", hostidp, res);
4587 		return (Z_SYSTEM);
4588 	}
4589 
4590 	return (res);
4591 }
4592 
4593 static int
4594 setup_zone_fs_allowed(zone_dochandle_t handle, zlog_t *zlogp, zoneid_t zoneid)
4595 {
4596 	char fsallowed[ZONE_FS_ALLOWED_MAX];
4597 	char *fsallowedp = fsallowed;
4598 	int len = sizeof (fsallowed);
4599 	int res;
4600 
4601 	res = zonecfg_get_fs_allowed(handle, fsallowed, len);
4602 
4603 	if (res == Z_BAD_PROPERTY) {
4604 		/* No value, set the defaults */
4605 		(void) strlcpy(fsallowed, DFLT_FS_ALLOWED, len);
4606 	} else if (res != Z_OK) {
4607 		report_prop_err(zlogp, "fs-allowed", fsallowed, res);
4608 		return (res);
4609 	} else if (fsallowed[0] == '-') {
4610 		/* dropping default privs - use remaining list */
4611 		if (fsallowed[1] != ',')
4612 			return (Z_OK);
4613 		fsallowedp += 2;
4614 		len -= 2;
4615 	} else {
4616 		/* Has a value, append the defaults */
4617 		if (strlcat(fsallowed, ",", len) >= len ||
4618 		    strlcat(fsallowed, DFLT_FS_ALLOWED, len) >= len) {
4619 			report_prop_err(zlogp, "fs-allowed", fsallowed,
4620 			    Z_TOO_BIG);
4621 			return (Z_TOO_BIG);
4622 		}
4623 	}
4624 
4625 	if (zone_setattr(zoneid, ZONE_ATTR_FS_ALLOWED, fsallowedp, len) != 0) {
4626 		zerror(zlogp, B_TRUE,
4627 		    "fs-allowed couldn't be set: %s: %d", fsallowedp, res);
4628 		return (Z_SYSTEM);
4629 	}
4630 
4631 	return (Z_OK);
4632 }
4633 
4634 static int
4635 setup_zone_attrs(zlog_t *zlogp, char *zone_namep, zoneid_t zoneid)
4636 {
4637 	zone_dochandle_t handle;
4638 	int res = Z_OK;
4639 
4640 	if ((handle = zonecfg_init_handle()) == NULL) {
4641 		zerror(zlogp, B_TRUE, "getting zone configuration handle");
4642 		return (Z_BAD_HANDLE);
4643 	}
4644 	if ((res = zonecfg_get_snapshot_handle(zone_namep, handle)) != Z_OK) {
4645 		zerror(zlogp, B_FALSE, "invalid configuration");
4646 		goto out;
4647 	}
4648 
4649 	if ((res = setup_zone_hostid(handle, zlogp, zoneid)) != Z_OK)
4650 		goto out;
4651 
4652 	if ((res = setup_zone_fs_allowed(handle, zlogp, zoneid)) != Z_OK)
4653 		goto out;
4654 
4655 out:
4656 	zonecfg_fini_handle(handle);
4657 	return (res);
4658 }
4659 
4660 zoneid_t
4661 vplat_create(zlog_t *zlogp, zone_mnt_t mount_cmd)
4662 {
4663 	zoneid_t rval = -1;
4664 	priv_set_t *privs;
4665 	char rootpath[MAXPATHLEN];
4666 	char *rctlbuf = NULL;
4667 	size_t rctlbufsz = 0;
4668 	char *zfsbuf = NULL;
4669 	size_t zfsbufsz = 0;
4670 	zoneid_t zoneid = -1;
4671 	int xerr;
4672 	char *kzone;
4673 	FILE *fp = NULL;
4674 	tsol_zcent_t *zcent = NULL;
4675 	int match = 0;
4676 	int doi = 0;
4677 	int flags;
4678 	zone_iptype_t iptype;
4679 
4680 	if (zone_get_rootpath(zone_name, rootpath, sizeof (rootpath)) != Z_OK) {
4681 		zerror(zlogp, B_TRUE, "unable to determine zone root");
4682 		return (-1);
4683 	}
4684 	if (zonecfg_in_alt_root())
4685 		resolve_lofs(zlogp, rootpath, sizeof (rootpath));
4686 
4687 	if (vplat_get_iptype(zlogp, &iptype) < 0) {
4688 		zerror(zlogp, B_TRUE, "unable to determine ip-type");
4689 		return (-1);
4690 	}
4691 	switch (iptype) {
4692 	case ZS_SHARED:
4693 		flags = 0;
4694 		break;
4695 	case ZS_EXCLUSIVE:
4696 		flags = ZCF_NET_EXCL;
4697 		break;
4698 	}
4699 
4700 	if ((privs = priv_allocset()) == NULL) {
4701 		zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
4702 		return (-1);
4703 	}
4704 	priv_emptyset(privs);
4705 	if (get_privset(zlogp, privs, mount_cmd) != 0)
4706 		goto error;
4707 
4708 	if (mount_cmd == Z_MNT_BOOT &&
4709 	    get_rctls(zlogp, &rctlbuf, &rctlbufsz) != 0) {
4710 		zerror(zlogp, B_FALSE, "Unable to get list of rctls");
4711 		goto error;
4712 	}
4713 
4714 	if (get_datasets(zlogp, &zfsbuf, &zfsbufsz) != 0) {
4715 		zerror(zlogp, B_FALSE, "Unable to get list of ZFS datasets");
4716 		goto error;
4717 	}
4718 
4719 	if (mount_cmd == Z_MNT_BOOT && is_system_labeled()) {
4720 		zcent = get_zone_label(zlogp, privs);
4721 		if (zcent != NULL) {
4722 			match = zcent->zc_match;
4723 			doi = zcent->zc_doi;
4724 			*zlabel = zcent->zc_label;
4725 		} else {
4726 			goto error;
4727 		}
4728 		if (validate_rootds_label(zlogp, rootpath, zlabel) != 0)
4729 			goto error;
4730 	}
4731 
4732 	kzone = zone_name;
4733 
4734 	/*
4735 	 * We must do this scan twice.  First, we look for zones running on the
4736 	 * main system that are using this root (or any subdirectory of it).
4737 	 * Next, we reduce to the shortest path and search for loopback mounts
4738 	 * that use this same source node (same device and inode).
4739 	 */
4740 	if (duplicate_zone_root(zlogp, rootpath))
4741 		goto error;
4742 	if (duplicate_reachable_path(zlogp, rootpath))
4743 		goto error;
4744 
4745 	if (ALT_MOUNT(mount_cmd)) {
4746 		root_to_lu(zlogp, rootpath, sizeof (rootpath), B_TRUE);
4747 
4748 		/*
4749 		 * Forge up a special root for this zone.  When a zone is
4750 		 * mounted, we can't let the zone have its own root because the
4751 		 * tools that will be used in this "scratch zone" need access
4752 		 * to both the zone's resources and the running machine's
4753 		 * executables.
4754 		 *
4755 		 * Note that the mkdir here also catches read-only filesystems.
4756 		 */
4757 		if (mkdir(rootpath, 0755) != 0 && errno != EEXIST) {
4758 			zerror(zlogp, B_TRUE, "cannot create %s", rootpath);
4759 			goto error;
4760 		}
4761 		if (domount(zlogp, "tmpfs", "", "swap", rootpath) != 0)
4762 			goto error;
4763 	}
4764 
4765 	if (zonecfg_in_alt_root()) {
4766 		/*
4767 		 * If we are mounting up a zone in an alternate root partition,
4768 		 * then we have some additional work to do before starting the
4769 		 * zone.  First, resolve the root path down so that we're not
4770 		 * fooled by duplicates.  Then forge up an internal name for
4771 		 * the zone.
4772 		 */
4773 		if ((fp = zonecfg_open_scratch("", B_TRUE)) == NULL) {
4774 			zerror(zlogp, B_TRUE, "cannot open mapfile");
4775 			goto error;
4776 		}
4777 		if (zonecfg_lock_scratch(fp) != 0) {
4778 			zerror(zlogp, B_TRUE, "cannot lock mapfile");
4779 			goto error;
4780 		}
4781 		if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
4782 		    NULL, 0) == 0) {
4783 			zerror(zlogp, B_FALSE, "scratch zone already running");
4784 			goto error;
4785 		}
4786 		/* This is the preferred name */
4787 		(void) snprintf(kernzone, sizeof (kernzone), "SUNWlu-%s",
4788 		    zone_name);
4789 		srandom(getpid());
4790 		while (zonecfg_reverse_scratch(fp, kernzone, NULL, 0, NULL,
4791 		    0) == 0) {
4792 			/* This is just an arbitrary name; note "." usage */
4793 			(void) snprintf(kernzone, sizeof (kernzone),
4794 			    "SUNWlu.%08lX%08lX", random(), random());
4795 		}
4796 		kzone = kernzone;
4797 	}
4798 
4799 	xerr = 0;
4800 	if ((zoneid = zone_create(kzone, rootpath, privs, rctlbuf,
4801 	    rctlbufsz, zfsbuf, zfsbufsz, &xerr, match, doi, zlabel,
4802 	    flags)) == -1) {
4803 		if (xerr == ZE_AREMOUNTS) {
4804 			if (zonecfg_find_mounts(rootpath, NULL, NULL) < 1) {
4805 				zerror(zlogp, B_FALSE,
4806 				    "An unknown file-system is mounted on "
4807 				    "a subdirectory of %s", rootpath);
4808 			} else {
4809 
4810 				zerror(zlogp, B_FALSE,
4811 				    "These file-systems are mounted on "
4812 				    "subdirectories of %s:", rootpath);
4813 				(void) zonecfg_find_mounts(rootpath,
4814 				    prtmount, zlogp);
4815 			}
4816 		} else if (xerr == ZE_CHROOTED) {
4817 			zerror(zlogp, B_FALSE, "%s: "
4818 			    "cannot create a zone from a chrooted "
4819 			    "environment", "zone_create");
4820 		} else if (xerr == ZE_LABELINUSE) {
4821 			char zonename[ZONENAME_MAX];
4822 			(void) getzonenamebyid(getzoneidbylabel(zlabel),
4823 			    zonename, ZONENAME_MAX);
4824 			zerror(zlogp, B_FALSE, "The zone label is already "
4825 			    "used by the zone '%s'.", zonename);
4826 		} else {
4827 			zerror(zlogp, B_TRUE, "%s failed", "zone_create");
4828 		}
4829 		goto error;
4830 	}
4831 
4832 	if (zonecfg_in_alt_root() &&
4833 	    zonecfg_add_scratch(fp, zone_name, kernzone,
4834 	    zonecfg_get_root()) == -1) {
4835 		zerror(zlogp, B_TRUE, "cannot add mapfile entry");
4836 		goto error;
4837 	}
4838 
4839 	/*
4840 	 * The following actions are not performed when merely mounting a zone
4841 	 * for administrative use.
4842 	 */
4843 	if (mount_cmd == Z_MNT_BOOT) {
4844 		brand_handle_t bh;
4845 		struct brand_attr attr;
4846 		char modname[MAXPATHLEN];
4847 
4848 		if (setup_zone_attrs(zlogp, zone_name, zoneid) != Z_OK)
4849 			goto error;
4850 
4851 		if ((bh = brand_open(brand_name)) == NULL) {
4852 			zerror(zlogp, B_FALSE,
4853 			    "unable to determine brand name");
4854 			goto error;
4855 		}
4856 
4857 		if (!is_system_labeled() &&
4858 		    (strcmp(brand_name, LABELED_BRAND_NAME) == 0)) {
4859 			brand_close(bh);
4860 			zerror(zlogp, B_FALSE,
4861 			    "cannot boot labeled zone on unlabeled system");
4862 			goto error;
4863 		}
4864 
4865 		/*
4866 		 * If this brand requires any kernel support, now is the time to
4867 		 * get it loaded and initialized.
4868 		 */
4869 		if (brand_get_modname(bh, modname, MAXPATHLEN) < 0) {
4870 			brand_close(bh);
4871 			zerror(zlogp, B_FALSE,
4872 			    "unable to determine brand kernel module");
4873 			goto error;
4874 		}
4875 		brand_close(bh);
4876 
4877 		if (strlen(modname) > 0) {
4878 			(void) strlcpy(attr.ba_brandname, brand_name,
4879 			    sizeof (attr.ba_brandname));
4880 			(void) strlcpy(attr.ba_modname, modname,
4881 			    sizeof (attr.ba_modname));
4882 			if (zone_setattr(zoneid, ZONE_ATTR_BRAND, &attr,
4883 			    sizeof (attr) != 0)) {
4884 				zerror(zlogp, B_TRUE,
4885 				    "could not set zone brand attribute.");
4886 				goto error;
4887 			}
4888 		}
4889 
4890 		if (setup_zone_rm(zlogp, zone_name, zoneid) != Z_OK)
4891 			goto error;
4892 
4893 		set_mlps(zlogp, zoneid, zcent);
4894 	}
4895 
4896 	rval = zoneid;
4897 	zoneid = -1;
4898 
4899 error:
4900 	if (zoneid != -1) {
4901 		(void) zone_shutdown(zoneid);
4902 		(void) zone_destroy(zoneid);
4903 	}
4904 	if (rctlbuf != NULL)
4905 		free(rctlbuf);
4906 	priv_freeset(privs);
4907 	if (fp != NULL)
4908 		zonecfg_close_scratch(fp);
4909 	lofs_discard_mnttab();
4910 	if (zcent != NULL)
4911 		tsol_freezcent(zcent);
4912 	return (rval);
4913 }
4914 
4915 /*
4916  * Enter the zone and write a /etc/zones/index file there.  This allows
4917  * libzonecfg (and thus zoneadm) to report the UUID and potentially other zone
4918  * details from inside the zone.
4919  */
4920 static void
4921 write_index_file(zoneid_t zoneid)
4922 {
4923 	FILE *zef;
4924 	FILE *zet;
4925 	struct zoneent *zep;
4926 	pid_t child;
4927 	int tmpl_fd;
4928 	ctid_t ct;
4929 	int fd;
4930 	char uuidstr[UUID_PRINTABLE_STRING_LENGTH];
4931 
4932 	/* Locate the zone entry in the global zone's index file */
4933 	if ((zef = setzoneent()) == NULL)
4934 		return;
4935 	while ((zep = getzoneent_private(zef)) != NULL) {
4936 		if (strcmp(zep->zone_name, zone_name) == 0)
4937 			break;
4938 		free(zep);
4939 	}
4940 	endzoneent(zef);
4941 	if (zep == NULL)
4942 		return;
4943 
4944 	if ((tmpl_fd = init_template()) == -1) {
4945 		free(zep);
4946 		return;
4947 	}
4948 
4949 	if ((child = fork()) == -1) {
4950 		(void) ct_tmpl_clear(tmpl_fd);
4951 		(void) close(tmpl_fd);
4952 		free(zep);
4953 		return;
4954 	}
4955 
4956 	/* parent waits for child to finish */
4957 	if (child != 0) {
4958 		free(zep);
4959 		if (contract_latest(&ct) == -1)
4960 			ct = -1;
4961 		(void) ct_tmpl_clear(tmpl_fd);
4962 		(void) close(tmpl_fd);
4963 		(void) waitpid(child, NULL, 0);
4964 		(void) contract_abandon_id(ct);
4965 		return;
4966 	}
4967 
4968 	/* child enters zone and sets up index file */
4969 	(void) ct_tmpl_clear(tmpl_fd);
4970 	if (zone_enter(zoneid) != -1) {
4971 		(void) mkdir(ZONE_CONFIG_ROOT, ZONE_CONFIG_MODE);
4972 		(void) chown(ZONE_CONFIG_ROOT, ZONE_CONFIG_UID,
4973 		    ZONE_CONFIG_GID);
4974 		fd = open(ZONE_INDEX_FILE, O_WRONLY|O_CREAT|O_TRUNC,
4975 		    ZONE_INDEX_MODE);
4976 		if (fd != -1 && (zet = fdopen(fd, "w")) != NULL) {
4977 			(void) fchown(fd, ZONE_INDEX_UID, ZONE_INDEX_GID);
4978 			if (uuid_is_null(zep->zone_uuid))
4979 				uuidstr[0] = '\0';
4980 			else
4981 				uuid_unparse(zep->zone_uuid, uuidstr);
4982 			(void) fprintf(zet, "%s:%s:/:%s\n", zep->zone_name,
4983 			    zone_state_str(zep->zone_state),
4984 			    uuidstr);
4985 			(void) fclose(zet);
4986 		}
4987 	}
4988 	_exit(0);
4989 }
4990 
4991 int
4992 vplat_bringup(zlog_t *zlogp, zone_mnt_t mount_cmd, zoneid_t zoneid)
4993 {
4994 	char zonepath[MAXPATHLEN];
4995 
4996 	if (mount_cmd == Z_MNT_BOOT && validate_datasets(zlogp) != 0) {
4997 		lofs_discard_mnttab();
4998 		return (-1);
4999 	}
5000 
5001 	/*
5002 	 * Before we try to mount filesystems we need to create the
5003 	 * attribute backing store for /dev
5004 	 */
5005 	if (zone_get_zonepath(zone_name, zonepath, sizeof (zonepath)) != Z_OK) {
5006 		lofs_discard_mnttab();
5007 		return (-1);
5008 	}
5009 	resolve_lofs(zlogp, zonepath, sizeof (zonepath));
5010 
5011 	/* Make /dev directory owned by root, grouped sys */
5012 	if (make_one_dir(zlogp, zonepath, "/dev", DEFAULT_DIR_MODE,
5013 	    0, 3) != 0) {
5014 		lofs_discard_mnttab();
5015 		return (-1);
5016 	}
5017 
5018 	if (mount_filesystems(zlogp, mount_cmd) != 0) {
5019 		lofs_discard_mnttab();
5020 		return (-1);
5021 	}
5022 
5023 	if (mount_cmd == Z_MNT_BOOT) {
5024 		zone_iptype_t iptype;
5025 
5026 		if (vplat_get_iptype(zlogp, &iptype) < 0) {
5027 			zerror(zlogp, B_TRUE, "unable to determine ip-type");
5028 			lofs_discard_mnttab();
5029 			return (-1);
5030 		}
5031 
5032 		switch (iptype) {
5033 		case ZS_SHARED:
5034 			/* Always do this to make lo0 get configured */
5035 			if (configure_shared_network_interfaces(zlogp) != 0) {
5036 				lofs_discard_mnttab();
5037 				return (-1);
5038 			}
5039 			break;
5040 		case ZS_EXCLUSIVE:
5041 			if (configure_exclusive_network_interfaces(zlogp,
5042 			    zoneid) !=
5043 			    0) {
5044 				lofs_discard_mnttab();
5045 				return (-1);
5046 			}
5047 			break;
5048 		}
5049 	}
5050 
5051 	write_index_file(zoneid);
5052 
5053 	lofs_discard_mnttab();
5054 	return (0);
5055 }
5056 
5057 static int
5058 lu_root_teardown(zlog_t *zlogp)
5059 {
5060 	char zroot[MAXPATHLEN];
5061 
5062 	if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
5063 		zerror(zlogp, B_FALSE, "unable to determine zone root");
5064 		return (-1);
5065 	}
5066 	root_to_lu(zlogp, zroot, sizeof (zroot), B_FALSE);
5067 
5068 	/*
5069 	 * At this point, the processes are gone, the filesystems (save the
5070 	 * root) are unmounted, and the zone is on death row.  But there may
5071 	 * still be creds floating about in the system that reference the
5072 	 * zone_t, and which pin down zone_rootvp causing this call to fail
5073 	 * with EBUSY.  Thus, we try for a little while before just giving up.
5074 	 * (How I wish this were not true, and umount2 just did the right
5075 	 * thing, or tmpfs supported MS_FORCE This is a gross hack.)
5076 	 */
5077 	if (umount2(zroot, MS_FORCE) != 0) {
5078 		if (errno == ENOTSUP && umount2(zroot, 0) == 0)
5079 			goto unmounted;
5080 		if (errno == EBUSY) {
5081 			int tries = 10;
5082 
5083 			while (--tries >= 0) {
5084 				(void) sleep(1);
5085 				if (umount2(zroot, 0) == 0)
5086 					goto unmounted;
5087 				if (errno != EBUSY)
5088 					break;
5089 			}
5090 		}
5091 		zerror(zlogp, B_TRUE, "unable to unmount '%s'", zroot);
5092 		return (-1);
5093 	}
5094 unmounted:
5095 
5096 	/*
5097 	 * Only zones in an alternate root environment have scratch zone
5098 	 * entries.
5099 	 */
5100 	if (zonecfg_in_alt_root()) {
5101 		FILE *fp;
5102 		int retv;
5103 
5104 		if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
5105 			zerror(zlogp, B_TRUE, "cannot open mapfile");
5106 			return (-1);
5107 		}
5108 		retv = -1;
5109 		if (zonecfg_lock_scratch(fp) != 0)
5110 			zerror(zlogp, B_TRUE, "cannot lock mapfile");
5111 		else if (zonecfg_delete_scratch(fp, kernzone) != 0)
5112 			zerror(zlogp, B_TRUE, "cannot delete map entry");
5113 		else
5114 			retv = 0;
5115 		zonecfg_close_scratch(fp);
5116 		return (retv);
5117 	} else {
5118 		return (0);
5119 	}
5120 }
5121 
5122 int
5123 vplat_teardown(zlog_t *zlogp, boolean_t unmount_cmd, boolean_t rebooting)
5124 {
5125 	char *kzone;
5126 	zoneid_t zoneid;
5127 	int res;
5128 	char pool_err[128];
5129 	char zpath[MAXPATHLEN];
5130 	char cmdbuf[MAXPATHLEN];
5131 	brand_handle_t bh = NULL;
5132 	dladm_status_t status;
5133 	char errmsg[DLADM_STRSIZE];
5134 	ushort_t flags;
5135 
5136 	kzone = zone_name;
5137 	if (zonecfg_in_alt_root()) {
5138 		FILE *fp;
5139 
5140 		if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) {
5141 			zerror(zlogp, B_TRUE, "unable to open map file");
5142 			goto error;
5143 		}
5144 		if (zonecfg_find_scratch(fp, zone_name, zonecfg_get_root(),
5145 		    kernzone, sizeof (kernzone)) != 0) {
5146 			zerror(zlogp, B_FALSE, "unable to find scratch zone");
5147 			zonecfg_close_scratch(fp);
5148 			goto error;
5149 		}
5150 		zonecfg_close_scratch(fp);
5151 		kzone = kernzone;
5152 	}
5153 
5154 	if ((zoneid = getzoneidbyname(kzone)) == ZONE_ID_UNDEFINED) {
5155 		if (!bringup_failure_recovery)
5156 			zerror(zlogp, B_TRUE, "unable to get zoneid");
5157 		if (unmount_cmd)
5158 			(void) lu_root_teardown(zlogp);
5159 		goto error;
5160 	}
5161 
5162 	if (remove_datalink_pool(zlogp, zoneid) != 0) {
5163 		zerror(zlogp, B_FALSE, "unable clear datalink pool property");
5164 		goto error;
5165 	}
5166 
5167 	if (remove_datalink_protect(zlogp, zoneid) != 0) {
5168 		zerror(zlogp, B_FALSE,
5169 		    "unable clear datalink protect property");
5170 		goto error;
5171 	}
5172 
5173 	/*
5174 	 * The datalinks assigned to the zone will be removed from the NGZ as
5175 	 * part of zone_shutdown() so that we need to remove protect/pool etc.
5176 	 * before zone_shutdown(). Even if the shutdown itself fails, the zone
5177 	 * will not be able to violate any constraints applied because the
5178 	 * datalinks are no longer available to the zone.
5179 	 */
5180 	if (zone_shutdown(zoneid) != 0) {
5181 		zerror(zlogp, B_TRUE, "unable to shutdown zone");
5182 		goto error;
5183 	}
5184 
5185 	/* Get the zonepath of this zone */
5186 	if (zone_get_zonepath(zone_name, zpath, sizeof (zpath)) != Z_OK) {
5187 		zerror(zlogp, B_FALSE, "unable to determine zone path");
5188 		goto error;
5189 	}
5190 
5191 	/* Get a handle to the brand info for this zone */
5192 	if ((bh = brand_open(brand_name)) == NULL) {
5193 		zerror(zlogp, B_FALSE, "unable to determine zone brand");
5194 		return (-1);
5195 	}
5196 	/*
5197 	 * If there is a brand 'halt' callback, execute it now to give the
5198 	 * brand a chance to cleanup any custom configuration.
5199 	 */
5200 	(void) strcpy(cmdbuf, EXEC_PREFIX);
5201 	if (brand_get_halt(bh, zone_name, zpath, cmdbuf + EXEC_LEN,
5202 	    sizeof (cmdbuf) - EXEC_LEN) < 0) {
5203 		brand_close(bh);
5204 		zerror(zlogp, B_FALSE, "unable to determine branded zone's "
5205 		    "halt callback.");
5206 		goto error;
5207 	}
5208 	brand_close(bh);
5209 
5210 	if ((strlen(cmdbuf) > EXEC_LEN) &&
5211 	    (do_subproc(zlogp, cmdbuf, NULL) != Z_OK)) {
5212 		zerror(zlogp, B_FALSE, "%s failed", cmdbuf);
5213 		goto error;
5214 	}
5215 
5216 	if (!unmount_cmd) {
5217 		zone_iptype_t iptype;
5218 
5219 		if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &flags,
5220 		    sizeof (flags)) < 0) {
5221 			if (vplat_get_iptype(zlogp, &iptype) < 0) {
5222 				zerror(zlogp, B_TRUE, "unable to determine "
5223 				    "ip-type");
5224 				goto error;
5225 			}
5226 		} else {
5227 			if (flags & ZF_NET_EXCL)
5228 				iptype = ZS_EXCLUSIVE;
5229 			else
5230 				iptype = ZS_SHARED;
5231 		}
5232 
5233 		switch (iptype) {
5234 		case ZS_SHARED:
5235 			if (unconfigure_shared_network_interfaces(zlogp,
5236 			    zoneid) != 0) {
5237 				zerror(zlogp, B_FALSE, "unable to unconfigure "
5238 				    "network interfaces in zone");
5239 				goto error;
5240 			}
5241 			break;
5242 		case ZS_EXCLUSIVE:
5243 			if (unconfigure_exclusive_network_interfaces(zlogp,
5244 			    zoneid) != 0) {
5245 				zerror(zlogp, B_FALSE, "unable to unconfigure "
5246 				    "network interfaces in zone");
5247 				goto error;
5248 			}
5249 			status = dladm_zone_halt(dld_handle, zoneid);
5250 			if (status != DLADM_STATUS_OK) {
5251 				zerror(zlogp, B_FALSE, "unable to notify "
5252 				    "dlmgmtd of zone halt: %s",
5253 				    dladm_status2str(status, errmsg));
5254 			}
5255 			break;
5256 		}
5257 	}
5258 
5259 	if (!unmount_cmd && tcp_abort_connections(zlogp, zoneid) != 0) {
5260 		zerror(zlogp, B_TRUE, "unable to abort TCP connections");
5261 		goto error;
5262 	}
5263 
5264 	if (unmount_filesystems(zlogp, zoneid, unmount_cmd) != 0) {
5265 		zerror(zlogp, B_FALSE,
5266 		    "unable to unmount file systems in zone");
5267 		goto error;
5268 	}
5269 
5270 	/*
5271 	 * If we are rebooting then we normally don't want to destroy an
5272 	 * existing temporary pool at this point so that we can just reuse it
5273 	 * when the zone boots back up.  However, it is also possible we were
5274 	 * running with a temporary pool and the zone configuration has been
5275 	 * modified to no longer use a temporary pool.  In that case we need
5276 	 * to destroy the temporary pool now.  This case looks like the case
5277 	 * where we never had a temporary pool configured but
5278 	 * zonecfg_destroy_tmp_pool will do the right thing either way.
5279 	 */
5280 	if (!unmount_cmd) {
5281 		boolean_t destroy_tmp_pool = B_TRUE;
5282 
5283 		if (rebooting) {
5284 			struct zone_psettab pset_tab;
5285 			zone_dochandle_t handle;
5286 
5287 			if ((handle = zonecfg_init_handle()) != NULL &&
5288 			    zonecfg_get_handle(zone_name, handle) == Z_OK &&
5289 			    zonecfg_lookup_pset(handle, &pset_tab) == Z_OK)
5290 				destroy_tmp_pool = B_FALSE;
5291 
5292 			zonecfg_fini_handle(handle);
5293 		}
5294 
5295 		if (destroy_tmp_pool) {
5296 			if ((res = zonecfg_destroy_tmp_pool(zone_name, pool_err,
5297 			    sizeof (pool_err))) != Z_OK) {
5298 				if (res == Z_POOL)
5299 					zerror(zlogp, B_FALSE, pool_err);
5300 			}
5301 		}
5302 	}
5303 
5304 	remove_mlps(zlogp, zoneid);
5305 
5306 	if (zone_destroy(zoneid) != 0) {
5307 		zerror(zlogp, B_TRUE, "unable to destroy zone");
5308 		goto error;
5309 	}
5310 
5311 	/*
5312 	 * Special teardown for alternate boot environments: remove the tmpfs
5313 	 * root for the zone and then remove it from the map file.
5314 	 */
5315 	if (unmount_cmd && lu_root_teardown(zlogp) != 0)
5316 		goto error;
5317 
5318 	lofs_discard_mnttab();
5319 	return (0);
5320 
5321 error:
5322 	lofs_discard_mnttab();
5323 	return (-1);
5324 }
5325