xref: /titanic_51/usr/src/cmd/zoneadmd/zoneadmd.c (revision 4bc0a2ef2b7ba50a7a717e7ddbf31472ad28e358)
17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
57c478bd9Sstevel@tonic-gate  * Common Development and Distribution License, Version 1.0 only
67c478bd9Sstevel@tonic-gate  * (the "License").  You may not use this file except in compliance
77c478bd9Sstevel@tonic-gate  * with the License.
87c478bd9Sstevel@tonic-gate  *
97c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
107c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
117c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
127c478bd9Sstevel@tonic-gate  * and limitations under the License.
137c478bd9Sstevel@tonic-gate  *
147c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
157c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
167c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
177c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
187c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
197c478bd9Sstevel@tonic-gate  *
207c478bd9Sstevel@tonic-gate  * CDDL HEADER END
217c478bd9Sstevel@tonic-gate  */
227c478bd9Sstevel@tonic-gate /*
237c478bd9Sstevel@tonic-gate  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
247c478bd9Sstevel@tonic-gate  * Use is subject to license terms.
257c478bd9Sstevel@tonic-gate  */
267c478bd9Sstevel@tonic-gate 
277c478bd9Sstevel@tonic-gate #pragma ident	"%Z%%M%	%I%	%E% SMI"
287c478bd9Sstevel@tonic-gate 
297c478bd9Sstevel@tonic-gate /*
307c478bd9Sstevel@tonic-gate  * zoneadmd manages zones; one zoneadmd process is launched for each
317c478bd9Sstevel@tonic-gate  * non-global zone on the system.  This daemon juggles four jobs:
327c478bd9Sstevel@tonic-gate  *
337c478bd9Sstevel@tonic-gate  * - Implement setup and teardown of the zone "virtual platform": mount and
347c478bd9Sstevel@tonic-gate  *   unmount filesystems; create and destroy network interfaces; communicate
357c478bd9Sstevel@tonic-gate  *   with devfsadmd to lay out devices for the zone; instantiate the zone
367c478bd9Sstevel@tonic-gate  *   console device; configure process runtime attributes such as resource
377c478bd9Sstevel@tonic-gate  *   controls, pool bindings, fine-grained privileges.
387c478bd9Sstevel@tonic-gate  *
397c478bd9Sstevel@tonic-gate  * - Launch the zone's init(1M) process.
407c478bd9Sstevel@tonic-gate  *
417c478bd9Sstevel@tonic-gate  * - Implement a door server; clients (like zoneadm) connect to the door
427c478bd9Sstevel@tonic-gate  *   server and request zone state changes.  The kernel is also a client of
437c478bd9Sstevel@tonic-gate  *   this door server.  A request to halt or reboot the zone which originates
447c478bd9Sstevel@tonic-gate  *   *inside* the zone results in a door upcall from the kernel into zoneadmd.
457c478bd9Sstevel@tonic-gate  *
467c478bd9Sstevel@tonic-gate  *   One minor problem is that messages emitted by zoneadmd need to be passed
477c478bd9Sstevel@tonic-gate  *   back to the zoneadm process making the request.  These messages need to
487c478bd9Sstevel@tonic-gate  *   be rendered in the client's locale; so, this is passed in as part of the
497c478bd9Sstevel@tonic-gate  *   request.  The exception is the kernel upcall to zoneadmd, in which case
507c478bd9Sstevel@tonic-gate  *   messages are syslog'd.
517c478bd9Sstevel@tonic-gate  *
527c478bd9Sstevel@tonic-gate  *   To make all of this work, the Makefile adds -a to xgettext to extract *all*
537c478bd9Sstevel@tonic-gate  *   strings, and an exclusion file (zoneadmd.xcl) is used to exclude those
547c478bd9Sstevel@tonic-gate  *   strings which do not need to be translated.
557c478bd9Sstevel@tonic-gate  *
567c478bd9Sstevel@tonic-gate  * - Act as a console server for zlogin -C processes; see comments in zcons.c
577c478bd9Sstevel@tonic-gate  *   for more information about the zone console architecture.
587c478bd9Sstevel@tonic-gate  *
597c478bd9Sstevel@tonic-gate  * DESIGN NOTES
607c478bd9Sstevel@tonic-gate  *
617c478bd9Sstevel@tonic-gate  * Restart:
627c478bd9Sstevel@tonic-gate  *   A chief design constraint of zoneadmd is that it should be restartable in
637c478bd9Sstevel@tonic-gate  *   the case that the administrator kills it off, or it suffers a fatal error,
647c478bd9Sstevel@tonic-gate  *   without the running zone being impacted; this is akin to being able to
657c478bd9Sstevel@tonic-gate  *   reboot the service processor of a server without affecting the OS instance.
667c478bd9Sstevel@tonic-gate  */
677c478bd9Sstevel@tonic-gate 
687c478bd9Sstevel@tonic-gate #include <sys/param.h>
697c478bd9Sstevel@tonic-gate #include <sys/mman.h>
707c478bd9Sstevel@tonic-gate #include <sys/types.h>
717c478bd9Sstevel@tonic-gate #include <sys/stat.h>
727c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h>
737c478bd9Sstevel@tonic-gate 
747c478bd9Sstevel@tonic-gate #include <bsm/adt.h>
757c478bd9Sstevel@tonic-gate #include <bsm/adt_event.h>
767c478bd9Sstevel@tonic-gate 
777c478bd9Sstevel@tonic-gate #include <alloca.h>
787c478bd9Sstevel@tonic-gate #include <assert.h>
797c478bd9Sstevel@tonic-gate #include <errno.h>
807c478bd9Sstevel@tonic-gate #include <door.h>
817c478bd9Sstevel@tonic-gate #include <fcntl.h>
827c478bd9Sstevel@tonic-gate #include <locale.h>
837c478bd9Sstevel@tonic-gate #include <signal.h>
847c478bd9Sstevel@tonic-gate #include <stdarg.h>
857c478bd9Sstevel@tonic-gate #include <stdio.h>
867c478bd9Sstevel@tonic-gate #include <stdlib.h>
877c478bd9Sstevel@tonic-gate #include <string.h>
887c478bd9Sstevel@tonic-gate #include <strings.h>
897c478bd9Sstevel@tonic-gate #include <synch.h>
907c478bd9Sstevel@tonic-gate #include <syslog.h>
917c478bd9Sstevel@tonic-gate #include <thread.h>
927c478bd9Sstevel@tonic-gate #include <unistd.h>
937c478bd9Sstevel@tonic-gate #include <wait.h>
947c478bd9Sstevel@tonic-gate #include <limits.h>
957c478bd9Sstevel@tonic-gate #include <zone.h>
967c478bd9Sstevel@tonic-gate #include <libcontract.h>
977c478bd9Sstevel@tonic-gate #include <libcontract_priv.h>
987c478bd9Sstevel@tonic-gate #include <sys/contract/process.h>
997c478bd9Sstevel@tonic-gate #include <sys/ctfs.h>
1007c478bd9Sstevel@tonic-gate 
1017c478bd9Sstevel@tonic-gate #include <libzonecfg.h>
1027c478bd9Sstevel@tonic-gate #include "zoneadmd.h"
1037c478bd9Sstevel@tonic-gate 
1047c478bd9Sstevel@tonic-gate static char *progname;
1057c478bd9Sstevel@tonic-gate char *zone_name;	/* zone which we are managing */
106108322fbScarlsonj static zoneid_t zone_id;
1077c478bd9Sstevel@tonic-gate 
1087c478bd9Sstevel@tonic-gate static zlog_t logsys;
1097c478bd9Sstevel@tonic-gate 
1107c478bd9Sstevel@tonic-gate mutex_t	lock = DEFAULTMUTEX;	/* to serialize stuff */
1117c478bd9Sstevel@tonic-gate mutex_t	msglock = DEFAULTMUTEX;	/* for calling setlocale() */
1127c478bd9Sstevel@tonic-gate 
113108322fbScarlsonj static sema_t scratch_sem;	/* for scratch zones */
114108322fbScarlsonj 
1157c478bd9Sstevel@tonic-gate static char	zone_door_path[MAXPATHLEN];
1167c478bd9Sstevel@tonic-gate static int	zone_door = -1;
1177c478bd9Sstevel@tonic-gate 
1187c478bd9Sstevel@tonic-gate boolean_t in_death_throes = B_FALSE;	/* daemon is dying */
1197c478bd9Sstevel@tonic-gate boolean_t bringup_failure_recovery = B_FALSE; /* ignore certain failures */
1207c478bd9Sstevel@tonic-gate 
1217c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN)		/* should be defined by cc -D */
1227c478bd9Sstevel@tonic-gate #define	TEXT_DOMAIN	"SYS_TEST"	/* Use this only if it wasn't */
1237c478bd9Sstevel@tonic-gate #endif
1247c478bd9Sstevel@tonic-gate 
1257c478bd9Sstevel@tonic-gate #define	PATH_TO_INIT	"/sbin/init"
1267c478bd9Sstevel@tonic-gate 
1277c478bd9Sstevel@tonic-gate #define	DEFAULT_LOCALE	"C"
1287c478bd9Sstevel@tonic-gate 
129108322fbScarlsonj static const char *
130108322fbScarlsonj z_cmd_name(zone_cmd_t zcmd)
131108322fbScarlsonj {
132108322fbScarlsonj 	/* This list needs to match the enum in sys/zone.h */
133108322fbScarlsonj 	static const char *zcmdstr[] = {
134108322fbScarlsonj 		"ready", "boot", "reboot", "halt", "note_uninstalling",
135108322fbScarlsonj 		"mount", "unmount"
136108322fbScarlsonj 	};
137108322fbScarlsonj 
138108322fbScarlsonj 	if (zcmd >= sizeof (zcmdstr) / sizeof (*zcmdstr))
139108322fbScarlsonj 		return ("unknown");
140108322fbScarlsonj 	else
141108322fbScarlsonj 		return (zcmdstr[(int)zcmd]);
142108322fbScarlsonj }
143108322fbScarlsonj 
1447c478bd9Sstevel@tonic-gate static char *
1457c478bd9Sstevel@tonic-gate get_execbasename(char *execfullname)
1467c478bd9Sstevel@tonic-gate {
1477c478bd9Sstevel@tonic-gate 	char *last_slash, *execbasename;
1487c478bd9Sstevel@tonic-gate 
1497c478bd9Sstevel@tonic-gate 	/* guard against '/' at end of command invocation */
1507c478bd9Sstevel@tonic-gate 	for (;;) {
1517c478bd9Sstevel@tonic-gate 		last_slash = strrchr(execfullname, '/');
1527c478bd9Sstevel@tonic-gate 		if (last_slash == NULL) {
1537c478bd9Sstevel@tonic-gate 			execbasename = execfullname;
1547c478bd9Sstevel@tonic-gate 			break;
1557c478bd9Sstevel@tonic-gate 		} else {
1567c478bd9Sstevel@tonic-gate 			execbasename = last_slash + 1;
1577c478bd9Sstevel@tonic-gate 			if (*execbasename == '\0') {
1587c478bd9Sstevel@tonic-gate 				*last_slash = '\0';
1597c478bd9Sstevel@tonic-gate 				continue;
1607c478bd9Sstevel@tonic-gate 			}
1617c478bd9Sstevel@tonic-gate 			break;
1627c478bd9Sstevel@tonic-gate 		}
1637c478bd9Sstevel@tonic-gate 	}
1647c478bd9Sstevel@tonic-gate 	return (execbasename);
1657c478bd9Sstevel@tonic-gate }
1667c478bd9Sstevel@tonic-gate 
1677c478bd9Sstevel@tonic-gate static void
1687c478bd9Sstevel@tonic-gate usage(void)
1697c478bd9Sstevel@tonic-gate {
1707c478bd9Sstevel@tonic-gate 	(void) fprintf(stderr, gettext("Usage: %s -z zonename\n"), progname);
1717c478bd9Sstevel@tonic-gate 	(void) fprintf(stderr,
1727c478bd9Sstevel@tonic-gate 	    gettext("\tNote: %s should not be run directly.\n"), progname);
1737c478bd9Sstevel@tonic-gate 	exit(2);
1747c478bd9Sstevel@tonic-gate }
1757c478bd9Sstevel@tonic-gate 
1767c478bd9Sstevel@tonic-gate /* ARGSUSED */
1777c478bd9Sstevel@tonic-gate static void
1787c478bd9Sstevel@tonic-gate sigchld(int sig)
1797c478bd9Sstevel@tonic-gate {
1807c478bd9Sstevel@tonic-gate }
1817c478bd9Sstevel@tonic-gate 
1827c478bd9Sstevel@tonic-gate char *
1837c478bd9Sstevel@tonic-gate localize_msg(char *locale, const char *msg)
1847c478bd9Sstevel@tonic-gate {
1857c478bd9Sstevel@tonic-gate 	char *out;
1867c478bd9Sstevel@tonic-gate 
1877c478bd9Sstevel@tonic-gate 	(void) mutex_lock(&msglock);
1887c478bd9Sstevel@tonic-gate 	(void) setlocale(LC_MESSAGES, locale);
1897c478bd9Sstevel@tonic-gate 	out = gettext(msg);
1907c478bd9Sstevel@tonic-gate 	(void) setlocale(LC_MESSAGES, DEFAULT_LOCALE);
1917c478bd9Sstevel@tonic-gate 	(void) mutex_unlock(&msglock);
1927c478bd9Sstevel@tonic-gate 	return (out);
1937c478bd9Sstevel@tonic-gate }
1947c478bd9Sstevel@tonic-gate 
1957c478bd9Sstevel@tonic-gate /* PRINTFLIKE3 */
1967c478bd9Sstevel@tonic-gate void
1977c478bd9Sstevel@tonic-gate zerror(zlog_t *zlogp, boolean_t use_strerror, const char *fmt, ...)
1987c478bd9Sstevel@tonic-gate {
1997c478bd9Sstevel@tonic-gate 	va_list alist;
2007c478bd9Sstevel@tonic-gate 	char buf[MAXPATHLEN * 2]; /* enough space for err msg with a path */
2017c478bd9Sstevel@tonic-gate 	char *bp;
2027c478bd9Sstevel@tonic-gate 	int saved_errno = errno;
2037c478bd9Sstevel@tonic-gate 
2047c478bd9Sstevel@tonic-gate 	if (zlogp == NULL)
2057c478bd9Sstevel@tonic-gate 		return;
2067c478bd9Sstevel@tonic-gate 	if (zlogp == &logsys)
2077c478bd9Sstevel@tonic-gate 		(void) snprintf(buf, sizeof (buf), "[zone '%s'] ",
2087c478bd9Sstevel@tonic-gate 		    zone_name);
2097c478bd9Sstevel@tonic-gate 	else
2107c478bd9Sstevel@tonic-gate 		buf[0] = '\0';
2117c478bd9Sstevel@tonic-gate 	bp = &(buf[strlen(buf)]);
2127c478bd9Sstevel@tonic-gate 
2137c478bd9Sstevel@tonic-gate 	/*
2147c478bd9Sstevel@tonic-gate 	 * In theory, the locale pointer should be set to either "C" or a
2157c478bd9Sstevel@tonic-gate 	 * char array, so it should never be NULL
2167c478bd9Sstevel@tonic-gate 	 */
2177c478bd9Sstevel@tonic-gate 	assert(zlogp->locale != NULL);
2187c478bd9Sstevel@tonic-gate 	/* Locale is per process, but we are multi-threaded... */
2197c478bd9Sstevel@tonic-gate 	fmt = localize_msg(zlogp->locale, fmt);
2207c478bd9Sstevel@tonic-gate 
2217c478bd9Sstevel@tonic-gate 	va_start(alist, fmt);
2227c478bd9Sstevel@tonic-gate 	(void) vsnprintf(bp, sizeof (buf) - (bp - buf), fmt, alist);
2237c478bd9Sstevel@tonic-gate 	va_end(alist);
2247c478bd9Sstevel@tonic-gate 	bp = &(buf[strlen(buf)]);
2257c478bd9Sstevel@tonic-gate 	if (use_strerror)
2267c478bd9Sstevel@tonic-gate 		(void) snprintf(bp, sizeof (buf) - (bp - buf), ": %s",
2277c478bd9Sstevel@tonic-gate 		    strerror(saved_errno));
2287c478bd9Sstevel@tonic-gate 	if (zlogp == &logsys) {
2297c478bd9Sstevel@tonic-gate 		(void) syslog(LOG_ERR, "%s", buf);
2307c478bd9Sstevel@tonic-gate 	} else if (zlogp->logfile != NULL) {
2317c478bd9Sstevel@tonic-gate 		(void) fprintf(zlogp->logfile, "%s\n", buf);
2327c478bd9Sstevel@tonic-gate 	} else {
2337c478bd9Sstevel@tonic-gate 		size_t buflen;
2347c478bd9Sstevel@tonic-gate 		size_t copylen;
2357c478bd9Sstevel@tonic-gate 
2367c478bd9Sstevel@tonic-gate 		buflen = snprintf(zlogp->log, zlogp->loglen, "%s\n", buf);
2377c478bd9Sstevel@tonic-gate 		copylen = MIN(buflen, zlogp->loglen);
2387c478bd9Sstevel@tonic-gate 		zlogp->log += copylen;
2397c478bd9Sstevel@tonic-gate 		zlogp->loglen -= copylen;
2407c478bd9Sstevel@tonic-gate 	}
2417c478bd9Sstevel@tonic-gate }
2427c478bd9Sstevel@tonic-gate 
2437c478bd9Sstevel@tonic-gate static int
2447c478bd9Sstevel@tonic-gate mkzonedir(zlog_t *zlogp)
2457c478bd9Sstevel@tonic-gate {
2467c478bd9Sstevel@tonic-gate 	struct stat st;
2477c478bd9Sstevel@tonic-gate 	/*
2487c478bd9Sstevel@tonic-gate 	 * We must create and lock everyone but root out of ZONES_TMPDIR
2497c478bd9Sstevel@tonic-gate 	 * since anyone can open any UNIX domain socket, regardless of
2507c478bd9Sstevel@tonic-gate 	 * its file system permissions.  Sigh...
2517c478bd9Sstevel@tonic-gate 	 */
2527c478bd9Sstevel@tonic-gate 	if (mkdir(ZONES_TMPDIR, S_IRWXU) < 0 && errno != EEXIST) {
2537c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "could not mkdir '%s'", ZONES_TMPDIR);
2547c478bd9Sstevel@tonic-gate 		return (-1);
2557c478bd9Sstevel@tonic-gate 	}
2567c478bd9Sstevel@tonic-gate 	/* paranoia */
257*4bc0a2efScasper 	if ((stat(ZONES_TMPDIR, &st) < 0) || !S_ISDIR(st.st_mode)) {
2587c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "'%s' is not a directory", ZONES_TMPDIR);
2597c478bd9Sstevel@tonic-gate 		return (-1);
2607c478bd9Sstevel@tonic-gate 	}
2617c478bd9Sstevel@tonic-gate 	(void) chmod(ZONES_TMPDIR, S_IRWXU);
2627c478bd9Sstevel@tonic-gate 	return (0);
2637c478bd9Sstevel@tonic-gate }
2647c478bd9Sstevel@tonic-gate 
265108322fbScarlsonj /*
266108322fbScarlsonj  * Bring a zone up to the pre-boot "ready" stage.  The mount_cmd argument is
267108322fbScarlsonj  * 'true' if this is being invoked as part of the processing for the "mount"
268108322fbScarlsonj  * subcommand.
269108322fbScarlsonj  */
270108322fbScarlsonj static int
271108322fbScarlsonj zone_ready(zlog_t *zlogp, boolean_t mount_cmd)
2727c478bd9Sstevel@tonic-gate {
2737c478bd9Sstevel@tonic-gate 	int err;
2747c478bd9Sstevel@tonic-gate 
2757c478bd9Sstevel@tonic-gate 	if ((err = zonecfg_create_snapshot(zone_name)) != Z_OK) {
2767c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_FALSE, "unable to create snapshot: %s",
2777c478bd9Sstevel@tonic-gate 		    zonecfg_strerror(err));
2787c478bd9Sstevel@tonic-gate 		return (-1);
2797c478bd9Sstevel@tonic-gate 	}
2807c478bd9Sstevel@tonic-gate 
281108322fbScarlsonj 	if ((zone_id = vplat_create(zlogp, mount_cmd)) == -1) {
2827c478bd9Sstevel@tonic-gate 		if ((err = zonecfg_destroy_snapshot(zone_name)) != Z_OK)
2837c478bd9Sstevel@tonic-gate 			zerror(zlogp, B_FALSE, "destroying snapshot: %s",
2847c478bd9Sstevel@tonic-gate 			    zonecfg_strerror(err));
2857c478bd9Sstevel@tonic-gate 		return (-1);
2867c478bd9Sstevel@tonic-gate 	}
287108322fbScarlsonj 	if (vplat_bringup(zlogp, mount_cmd) != 0) {
2887c478bd9Sstevel@tonic-gate 		bringup_failure_recovery = B_TRUE;
289108322fbScarlsonj 		(void) vplat_teardown(NULL, mount_cmd);
2907c478bd9Sstevel@tonic-gate 		if ((err = zonecfg_destroy_snapshot(zone_name)) != Z_OK)
2917c478bd9Sstevel@tonic-gate 			zerror(zlogp, B_FALSE, "destroying snapshot: %s",
2927c478bd9Sstevel@tonic-gate 			    zonecfg_strerror(err));
2937c478bd9Sstevel@tonic-gate 		return (-1);
2947c478bd9Sstevel@tonic-gate 	}
2957c478bd9Sstevel@tonic-gate 
2967c478bd9Sstevel@tonic-gate 	return (0);
2977c478bd9Sstevel@tonic-gate }
2987c478bd9Sstevel@tonic-gate 
2997c478bd9Sstevel@tonic-gate static int
3007c478bd9Sstevel@tonic-gate init_template()
3017c478bd9Sstevel@tonic-gate {
3027c478bd9Sstevel@tonic-gate 	int fd;
3037c478bd9Sstevel@tonic-gate 	int err = 0;
3047c478bd9Sstevel@tonic-gate 
3057c478bd9Sstevel@tonic-gate 	fd = open64(CTFS_ROOT "/process/template", O_RDWR);
3067c478bd9Sstevel@tonic-gate 	if (fd == -1)
3077c478bd9Sstevel@tonic-gate 		return (-1);
3087c478bd9Sstevel@tonic-gate 
3097c478bd9Sstevel@tonic-gate 	/*
3107c478bd9Sstevel@tonic-gate 	 * For now, zoneadmd doesn't do anything with the contract.
3117c478bd9Sstevel@tonic-gate 	 * Deliver no events, don't inherit, and allow it to be orphaned.
3127c478bd9Sstevel@tonic-gate 	 */
3137c478bd9Sstevel@tonic-gate 	err |= ct_tmpl_set_critical(fd, 0);
3147c478bd9Sstevel@tonic-gate 	err |= ct_tmpl_set_informative(fd, 0);
3157c478bd9Sstevel@tonic-gate 	err |= ct_pr_tmpl_set_fatal(fd, CT_PR_EV_HWERR);
3167c478bd9Sstevel@tonic-gate 	err |= ct_pr_tmpl_set_param(fd, CT_PR_PGRPONLY | CT_PR_REGENT);
3177c478bd9Sstevel@tonic-gate 	if (err || ct_tmpl_activate(fd)) {
3187c478bd9Sstevel@tonic-gate 		(void) close(fd);
3197c478bd9Sstevel@tonic-gate 		return (-1);
3207c478bd9Sstevel@tonic-gate 	}
3217c478bd9Sstevel@tonic-gate 
3227c478bd9Sstevel@tonic-gate 	return (fd);
3237c478bd9Sstevel@tonic-gate }
3247c478bd9Sstevel@tonic-gate 
3257c478bd9Sstevel@tonic-gate static int
3267c478bd9Sstevel@tonic-gate mount_early_fs(zlog_t *zlogp, zoneid_t zoneid, const char *spec,
3277c478bd9Sstevel@tonic-gate     const char *dir, char *fstype)
3287c478bd9Sstevel@tonic-gate {
3297c478bd9Sstevel@tonic-gate 	pid_t child;
3307c478bd9Sstevel@tonic-gate 	int child_status;
3317c478bd9Sstevel@tonic-gate 	int tmpl_fd;
3327c478bd9Sstevel@tonic-gate 	ctid_t ct;
3337c478bd9Sstevel@tonic-gate 
3347c478bd9Sstevel@tonic-gate 	if ((tmpl_fd = init_template()) == -1) {
3357c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "failed to create contract");
3367c478bd9Sstevel@tonic-gate 		return (-1);
3377c478bd9Sstevel@tonic-gate 	}
3387c478bd9Sstevel@tonic-gate 
3397c478bd9Sstevel@tonic-gate 	if ((child = fork()) == -1) {
3407c478bd9Sstevel@tonic-gate 		(void) ct_tmpl_clear(tmpl_fd);
3417c478bd9Sstevel@tonic-gate 		(void) close(tmpl_fd);
3427c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "failed to fork");
3437c478bd9Sstevel@tonic-gate 		return (-1);
3447c478bd9Sstevel@tonic-gate 
3457c478bd9Sstevel@tonic-gate 	} else if (child == 0) {	/* child */
3467c478bd9Sstevel@tonic-gate 		(void) ct_tmpl_clear(tmpl_fd);
3477c478bd9Sstevel@tonic-gate 		/*
3487c478bd9Sstevel@tonic-gate 		 * Even though there are no procs running in the zone, we
3497c478bd9Sstevel@tonic-gate 		 * do this for paranoia's sake.
3507c478bd9Sstevel@tonic-gate 		 */
3517c478bd9Sstevel@tonic-gate 		(void) closefrom(0);
3527c478bd9Sstevel@tonic-gate 
3537c478bd9Sstevel@tonic-gate 		if (zone_enter(zoneid) == -1) {
3547c478bd9Sstevel@tonic-gate 			_exit(errno);
3557c478bd9Sstevel@tonic-gate 		}
3567c478bd9Sstevel@tonic-gate 		if (mount(spec, dir, MS_DATA, fstype, NULL, 0, NULL, 0) != 0)
3577c478bd9Sstevel@tonic-gate 			_exit(errno);
3587c478bd9Sstevel@tonic-gate 		_exit(0);
3597c478bd9Sstevel@tonic-gate 	}
3607c478bd9Sstevel@tonic-gate 
3617c478bd9Sstevel@tonic-gate 	/* parent */
3627c478bd9Sstevel@tonic-gate 	if (contract_latest(&ct) == -1)
3637c478bd9Sstevel@tonic-gate 		ct = -1;
3647c478bd9Sstevel@tonic-gate 	(void) ct_tmpl_clear(tmpl_fd);
3657c478bd9Sstevel@tonic-gate 	(void) close(tmpl_fd);
3667c478bd9Sstevel@tonic-gate 	if (waitpid(child, &child_status, 0) != child) {
3677c478bd9Sstevel@tonic-gate 		/* unexpected: we must have been signalled */
3687c478bd9Sstevel@tonic-gate 		(void) contract_abandon_id(ct);
3697c478bd9Sstevel@tonic-gate 		return (-1);
3707c478bd9Sstevel@tonic-gate 	}
3717c478bd9Sstevel@tonic-gate 	(void) contract_abandon_id(ct);
3727c478bd9Sstevel@tonic-gate 	if (WEXITSTATUS(child_status) != 0) {
3737c478bd9Sstevel@tonic-gate 		errno = WEXITSTATUS(child_status);
3747c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "mount of %s failed", dir);
3757c478bd9Sstevel@tonic-gate 		return (-1);
3767c478bd9Sstevel@tonic-gate 	}
3777c478bd9Sstevel@tonic-gate 
3787c478bd9Sstevel@tonic-gate 	return (0);
3797c478bd9Sstevel@tonic-gate }
3807c478bd9Sstevel@tonic-gate 
3817c478bd9Sstevel@tonic-gate static int
382108322fbScarlsonj zone_mount_early(zlog_t *zlogp, zoneid_t zoneid)
383108322fbScarlsonj {
384108322fbScarlsonj 	if (mount_early_fs(zlogp, zoneid, "/proc", "/proc", "proc") != 0)
385108322fbScarlsonj 		return (-1);
386108322fbScarlsonj 
387108322fbScarlsonj 	if (mount_early_fs(zlogp, zoneid, "ctfs", CTFS_ROOT, "ctfs") != 0)
388108322fbScarlsonj 		return (-1);
389108322fbScarlsonj 
390108322fbScarlsonj 	if (mount_early_fs(zlogp, zoneid, "swap", "/etc/svc/volatile",
391108322fbScarlsonj 	    "tmpfs") != 0)
392108322fbScarlsonj 		return (-1);
393108322fbScarlsonj 
394108322fbScarlsonj 	if (mount_early_fs(zlogp, zoneid, "mnttab", "/etc/mnttab",
395108322fbScarlsonj 	    "mntfs") != 0)
396108322fbScarlsonj 		return (-1);
397108322fbScarlsonj 
398108322fbScarlsonj 	return (0);
399108322fbScarlsonj }
400108322fbScarlsonj 
401108322fbScarlsonj static int
4027c478bd9Sstevel@tonic-gate zone_bootup(zlog_t *zlogp, const char *bootargs)
4037c478bd9Sstevel@tonic-gate {
4047c478bd9Sstevel@tonic-gate 	zoneid_t zoneid;
4057c478bd9Sstevel@tonic-gate 	struct stat st;
4067c478bd9Sstevel@tonic-gate 	char zroot[MAXPATHLEN], initpath[MAXPATHLEN];
4077c478bd9Sstevel@tonic-gate 
4087c478bd9Sstevel@tonic-gate 	if (init_console_slave(zlogp) != 0)
4097c478bd9Sstevel@tonic-gate 		return (-1);
4107c478bd9Sstevel@tonic-gate 	reset_slave_terminal(zlogp);
4117c478bd9Sstevel@tonic-gate 
4127c478bd9Sstevel@tonic-gate 	if ((zoneid = getzoneidbyname(zone_name)) == -1) {
4137c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "unable to get zoneid");
4147c478bd9Sstevel@tonic-gate 		return (-1);
4157c478bd9Sstevel@tonic-gate 	}
4167c478bd9Sstevel@tonic-gate 
417108322fbScarlsonj 	if (zone_mount_early(zlogp, zoneid) != 0)
4187c478bd9Sstevel@tonic-gate 		return (-1);
4197c478bd9Sstevel@tonic-gate 
4207c478bd9Sstevel@tonic-gate 	/*
4217c478bd9Sstevel@tonic-gate 	 * Try to anticipate possible problems: Make sure init is executable.
4227c478bd9Sstevel@tonic-gate 	 */
4237c478bd9Sstevel@tonic-gate 	if (zone_get_rootpath(zone_name, zroot, sizeof (zroot)) != Z_OK) {
4247c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_FALSE, "unable to determine zone root");
4257c478bd9Sstevel@tonic-gate 		return (-1);
4267c478bd9Sstevel@tonic-gate 	}
4277c478bd9Sstevel@tonic-gate 	(void) snprintf(initpath, sizeof (initpath), "%s%s", zroot,
4287c478bd9Sstevel@tonic-gate 	    PATH_TO_INIT);
4297c478bd9Sstevel@tonic-gate 
4307c478bd9Sstevel@tonic-gate 	if (stat(initpath, &st) == -1) {
4317c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "could not stat %s", initpath);
4327c478bd9Sstevel@tonic-gate 		return (-1);
4337c478bd9Sstevel@tonic-gate 	}
4347c478bd9Sstevel@tonic-gate 
4357c478bd9Sstevel@tonic-gate 	if ((st.st_mode & S_IXUSR) == 0) {
4367c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_FALSE, "%s is not executable", initpath);
4377c478bd9Sstevel@tonic-gate 		return (-1);
4387c478bd9Sstevel@tonic-gate 	}
4397c478bd9Sstevel@tonic-gate 
4407c478bd9Sstevel@tonic-gate 	if (zone_boot(zoneid, bootargs) == -1) {
4417c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "unable to boot zone");
4427c478bd9Sstevel@tonic-gate 		return (-1);
4437c478bd9Sstevel@tonic-gate 	}
4447c478bd9Sstevel@tonic-gate 
4457c478bd9Sstevel@tonic-gate 	return (0);
4467c478bd9Sstevel@tonic-gate }
4477c478bd9Sstevel@tonic-gate 
4487c478bd9Sstevel@tonic-gate static int
449108322fbScarlsonj zone_halt(zlog_t *zlogp, boolean_t unmount_cmd)
4507c478bd9Sstevel@tonic-gate {
4517c478bd9Sstevel@tonic-gate 	int err;
4527c478bd9Sstevel@tonic-gate 
453108322fbScarlsonj 	if (vplat_teardown(zlogp, unmount_cmd) != 0) {
4547c478bd9Sstevel@tonic-gate 		if (!bringup_failure_recovery)
4557c478bd9Sstevel@tonic-gate 			zerror(zlogp, B_FALSE, "unable to destroy zone");
4567c478bd9Sstevel@tonic-gate 		return (-1);
4577c478bd9Sstevel@tonic-gate 	}
4587c478bd9Sstevel@tonic-gate 
4597c478bd9Sstevel@tonic-gate 	if ((err = zonecfg_destroy_snapshot(zone_name)) != Z_OK)
4607c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_FALSE, "destroying snapshot: %s",
4617c478bd9Sstevel@tonic-gate 		    zonecfg_strerror(err));
4627c478bd9Sstevel@tonic-gate 
4637c478bd9Sstevel@tonic-gate 	return (0);
4647c478bd9Sstevel@tonic-gate }
4657c478bd9Sstevel@tonic-gate 
4667c478bd9Sstevel@tonic-gate /*
4677c478bd9Sstevel@tonic-gate  * Generate AUE_zone_state for a command that boots a zone.
4687c478bd9Sstevel@tonic-gate  */
4697c478bd9Sstevel@tonic-gate static void
4707c478bd9Sstevel@tonic-gate audit_put_record(zlog_t *zlogp, ucred_t *uc, int return_val,
4717c478bd9Sstevel@tonic-gate     char *new_state)
4727c478bd9Sstevel@tonic-gate {
4737c478bd9Sstevel@tonic-gate 	adt_session_data_t	*ah;
4747c478bd9Sstevel@tonic-gate 	adt_event_data_t	*event;
4757c478bd9Sstevel@tonic-gate 	int			pass_fail, fail_reason;
4767c478bd9Sstevel@tonic-gate 
4777c478bd9Sstevel@tonic-gate 	if (!adt_audit_enabled())
4787c478bd9Sstevel@tonic-gate 		return;
4797c478bd9Sstevel@tonic-gate 
4807c478bd9Sstevel@tonic-gate 	if (return_val == 0) {
4817c478bd9Sstevel@tonic-gate 		pass_fail = ADT_SUCCESS;
4827c478bd9Sstevel@tonic-gate 		fail_reason = ADT_SUCCESS;
4837c478bd9Sstevel@tonic-gate 	} else {
4847c478bd9Sstevel@tonic-gate 		pass_fail = ADT_FAILURE;
4857c478bd9Sstevel@tonic-gate 		fail_reason = ADT_FAIL_VALUE_PROGRAM;
4867c478bd9Sstevel@tonic-gate 	}
4877c478bd9Sstevel@tonic-gate 
4887c478bd9Sstevel@tonic-gate 	if (adt_start_session(&ah, NULL, 0)) {
4897c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, gettext("audit failure."));
4907c478bd9Sstevel@tonic-gate 		return;
4917c478bd9Sstevel@tonic-gate 	}
4927c478bd9Sstevel@tonic-gate 	if (adt_set_from_ucred(ah, uc, ADT_NEW)) {
4937c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, gettext("audit failure."));
4947c478bd9Sstevel@tonic-gate 		(void) adt_end_session(ah);
4957c478bd9Sstevel@tonic-gate 		return;
4967c478bd9Sstevel@tonic-gate 	}
4977c478bd9Sstevel@tonic-gate 
4987c478bd9Sstevel@tonic-gate 	event = adt_alloc_event(ah, ADT_zone_state);
4997c478bd9Sstevel@tonic-gate 	if (event == NULL) {
5007c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, gettext("audit failure."));
5017c478bd9Sstevel@tonic-gate 		(void) adt_end_session(ah);
5027c478bd9Sstevel@tonic-gate 		return;
5037c478bd9Sstevel@tonic-gate 	}
5047c478bd9Sstevel@tonic-gate 	event->adt_zone_state.zonename = zone_name;
5057c478bd9Sstevel@tonic-gate 	event->adt_zone_state.new_state = new_state;
5067c478bd9Sstevel@tonic-gate 
5077c478bd9Sstevel@tonic-gate 	if (adt_put_event(event, pass_fail, fail_reason))
5087c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, gettext("audit failure."));
5097c478bd9Sstevel@tonic-gate 
5107c478bd9Sstevel@tonic-gate 	adt_free_event(event);
5117c478bd9Sstevel@tonic-gate 
5127c478bd9Sstevel@tonic-gate 	(void) adt_end_session(ah);
5137c478bd9Sstevel@tonic-gate }
5147c478bd9Sstevel@tonic-gate 
5157c478bd9Sstevel@tonic-gate /*
5167c478bd9Sstevel@tonic-gate  * The main routine for the door server that deals with zone state transitions.
5177c478bd9Sstevel@tonic-gate  */
5187c478bd9Sstevel@tonic-gate /* ARGSUSED */
5197c478bd9Sstevel@tonic-gate static void
5207c478bd9Sstevel@tonic-gate server(void *cookie, char *args, size_t alen, door_desc_t *dp,
5217c478bd9Sstevel@tonic-gate     uint_t n_desc)
5227c478bd9Sstevel@tonic-gate {
5237c478bd9Sstevel@tonic-gate 	ucred_t *uc = NULL;
5247c478bd9Sstevel@tonic-gate 	const priv_set_t *eset;
5257c478bd9Sstevel@tonic-gate 
5267c478bd9Sstevel@tonic-gate 	zone_state_t zstate;
5277c478bd9Sstevel@tonic-gate 	zone_cmd_t cmd;
5287c478bd9Sstevel@tonic-gate 	zone_cmd_arg_t *zargp;
5297c478bd9Sstevel@tonic-gate 
5307c478bd9Sstevel@tonic-gate 	boolean_t kernelcall;
5317c478bd9Sstevel@tonic-gate 
5327c478bd9Sstevel@tonic-gate 	int rval = -1;
5337c478bd9Sstevel@tonic-gate 	uint64_t uniqid;
5347c478bd9Sstevel@tonic-gate 	zoneid_t zoneid = -1;
5357c478bd9Sstevel@tonic-gate 	zlog_t zlog;
5367c478bd9Sstevel@tonic-gate 	zlog_t *zlogp;
5377c478bd9Sstevel@tonic-gate 	zone_cmd_rval_t *rvalp;
5387c478bd9Sstevel@tonic-gate 	size_t rlen = getpagesize(); /* conservative */
5397c478bd9Sstevel@tonic-gate 
5407c478bd9Sstevel@tonic-gate 	/* LINTED E_BAD_PTR_CAST_ALIGN */
5417c478bd9Sstevel@tonic-gate 	zargp = (zone_cmd_arg_t *)args;
5427c478bd9Sstevel@tonic-gate 
5437c478bd9Sstevel@tonic-gate 	/*
5447c478bd9Sstevel@tonic-gate 	 * When we get the door unref message, we've fdetach'd the door, and
5457c478bd9Sstevel@tonic-gate 	 * it is time for us to shut down zoneadmd.
5467c478bd9Sstevel@tonic-gate 	 */
5477c478bd9Sstevel@tonic-gate 	if (zargp == DOOR_UNREF_DATA) {
5487c478bd9Sstevel@tonic-gate 		/*
5497c478bd9Sstevel@tonic-gate 		 * See comment at end of main() for info on the last rites.
5507c478bd9Sstevel@tonic-gate 		 */
5517c478bd9Sstevel@tonic-gate 		exit(0);
5527c478bd9Sstevel@tonic-gate 	}
5537c478bd9Sstevel@tonic-gate 
5547c478bd9Sstevel@tonic-gate 	if (zargp == NULL) {
5557c478bd9Sstevel@tonic-gate 		(void) door_return(NULL, 0, 0, 0);
5567c478bd9Sstevel@tonic-gate 	}
5577c478bd9Sstevel@tonic-gate 
5587c478bd9Sstevel@tonic-gate 	rvalp = alloca(rlen);
5597c478bd9Sstevel@tonic-gate 	bzero(rvalp, rlen);
5607c478bd9Sstevel@tonic-gate 	zlog.logfile = NULL;
5617c478bd9Sstevel@tonic-gate 	zlog.buflen = zlog.loglen = rlen - sizeof (zone_cmd_rval_t) + 1;
5627c478bd9Sstevel@tonic-gate 	zlog.buf = rvalp->errbuf;
5637c478bd9Sstevel@tonic-gate 	zlog.log = zlog.buf;
5647c478bd9Sstevel@tonic-gate 	/* defer initialization of zlog.locale until after credential check */
5657c478bd9Sstevel@tonic-gate 	zlogp = &zlog;
5667c478bd9Sstevel@tonic-gate 
5677c478bd9Sstevel@tonic-gate 	if (alen != sizeof (zone_cmd_arg_t)) {
5687c478bd9Sstevel@tonic-gate 		/*
5697c478bd9Sstevel@tonic-gate 		 * This really shouldn't be happening.
5707c478bd9Sstevel@tonic-gate 		 */
5717c478bd9Sstevel@tonic-gate 		zerror(&logsys, B_FALSE, "invalid argument");
5727c478bd9Sstevel@tonic-gate 		goto out;
5737c478bd9Sstevel@tonic-gate 	}
5747c478bd9Sstevel@tonic-gate 	cmd = zargp->cmd;
5757c478bd9Sstevel@tonic-gate 
5767c478bd9Sstevel@tonic-gate 	if (door_ucred(&uc) != 0) {
5777c478bd9Sstevel@tonic-gate 		zerror(&logsys, B_TRUE, "door_ucred");
5787c478bd9Sstevel@tonic-gate 		goto out;
5797c478bd9Sstevel@tonic-gate 	}
5807c478bd9Sstevel@tonic-gate 	eset = ucred_getprivset(uc, PRIV_EFFECTIVE);
5817c478bd9Sstevel@tonic-gate 	if (ucred_getzoneid(uc) != GLOBAL_ZONEID ||
5827c478bd9Sstevel@tonic-gate 	    (eset != NULL ? !priv_ismember(eset, PRIV_SYS_CONFIG) :
5837c478bd9Sstevel@tonic-gate 	    ucred_geteuid(uc) != 0)) {
5847c478bd9Sstevel@tonic-gate 		zerror(&logsys, B_FALSE, "insufficient privileges");
5857c478bd9Sstevel@tonic-gate 		goto out;
5867c478bd9Sstevel@tonic-gate 	}
5877c478bd9Sstevel@tonic-gate 
5887c478bd9Sstevel@tonic-gate 	kernelcall = ucred_getpid(uc) == 0;
5897c478bd9Sstevel@tonic-gate 
5907c478bd9Sstevel@tonic-gate 	/*
5917c478bd9Sstevel@tonic-gate 	 * This is safe because we only use a zlog_t throughout the
5927c478bd9Sstevel@tonic-gate 	 * duration of a door call; i.e., by the time the pointer
5937c478bd9Sstevel@tonic-gate 	 * might become invalid, the door call would be over.
5947c478bd9Sstevel@tonic-gate 	 */
5957c478bd9Sstevel@tonic-gate 	zlog.locale = kernelcall ? DEFAULT_LOCALE : zargp->locale;
5967c478bd9Sstevel@tonic-gate 
5977c478bd9Sstevel@tonic-gate 	(void) mutex_lock(&lock);
5987c478bd9Sstevel@tonic-gate 
5997c478bd9Sstevel@tonic-gate 	/*
6007c478bd9Sstevel@tonic-gate 	 * Once we start to really die off, we don't want more connections.
6017c478bd9Sstevel@tonic-gate 	 */
6027c478bd9Sstevel@tonic-gate 	if (in_death_throes) {
6037c478bd9Sstevel@tonic-gate 		(void) mutex_unlock(&lock);
6047c478bd9Sstevel@tonic-gate 		ucred_free(uc);
6057c478bd9Sstevel@tonic-gate 		(void) door_return(NULL, 0, 0, 0);
6067c478bd9Sstevel@tonic-gate 		thr_exit(NULL);
6077c478bd9Sstevel@tonic-gate 	}
6087c478bd9Sstevel@tonic-gate 
6097c478bd9Sstevel@tonic-gate 	/*
6107c478bd9Sstevel@tonic-gate 	 * Check for validity of command.
6117c478bd9Sstevel@tonic-gate 	 */
6127c478bd9Sstevel@tonic-gate 	if (cmd != Z_READY && cmd != Z_BOOT && cmd != Z_REBOOT &&
613108322fbScarlsonj 	    cmd != Z_HALT && cmd != Z_NOTE_UNINSTALLING && cmd != Z_MOUNT &&
614108322fbScarlsonj 	    cmd != Z_UNMOUNT) {
615108322fbScarlsonj 		zerror(&logsys, B_FALSE, "invalid command %d", (int)cmd);
6167c478bd9Sstevel@tonic-gate 		goto out;
6177c478bd9Sstevel@tonic-gate 	}
6187c478bd9Sstevel@tonic-gate 
6197c478bd9Sstevel@tonic-gate 	if (kernelcall && (cmd != Z_HALT && cmd != Z_REBOOT)) {
6207c478bd9Sstevel@tonic-gate 		/*
6217c478bd9Sstevel@tonic-gate 		 * Can't happen
6227c478bd9Sstevel@tonic-gate 		 */
6237c478bd9Sstevel@tonic-gate 		zerror(&logsys, B_FALSE, "received unexpected kernel upcall %d",
6247c478bd9Sstevel@tonic-gate 		    cmd);
6257c478bd9Sstevel@tonic-gate 		goto out;
6267c478bd9Sstevel@tonic-gate 	}
6277c478bd9Sstevel@tonic-gate 	/*
6287c478bd9Sstevel@tonic-gate 	 * We ignore the possibility of someone calling zone_create(2)
6297c478bd9Sstevel@tonic-gate 	 * explicitly; all requests must come through zoneadmd.
6307c478bd9Sstevel@tonic-gate 	 */
6317c478bd9Sstevel@tonic-gate 	if (zone_get_state(zone_name, &zstate) != Z_OK) {
6327c478bd9Sstevel@tonic-gate 		/*
6337c478bd9Sstevel@tonic-gate 		 * Something terribly wrong happened
6347c478bd9Sstevel@tonic-gate 		 */
6357c478bd9Sstevel@tonic-gate 		zerror(&logsys, B_FALSE, "unable to determine state of zone");
6367c478bd9Sstevel@tonic-gate 		goto out;
6377c478bd9Sstevel@tonic-gate 	}
6387c478bd9Sstevel@tonic-gate 
6397c478bd9Sstevel@tonic-gate 	if (kernelcall) {
6407c478bd9Sstevel@tonic-gate 		/*
6417c478bd9Sstevel@tonic-gate 		 * Kernel-initiated requests may lose their validity if the
6427c478bd9Sstevel@tonic-gate 		 * zone_t the kernel was referring to has gone away.
6437c478bd9Sstevel@tonic-gate 		 */
6447c478bd9Sstevel@tonic-gate 		if ((zoneid = getzoneidbyname(zone_name)) == -1 ||
6457c478bd9Sstevel@tonic-gate 		    zone_getattr(zoneid, ZONE_ATTR_UNIQID, &uniqid,
6467c478bd9Sstevel@tonic-gate 		    sizeof (uniqid)) == -1 || uniqid != zargp->uniqid) {
6477c478bd9Sstevel@tonic-gate 			/*
6487c478bd9Sstevel@tonic-gate 			 * We're not talking about the same zone. The request
6497c478bd9Sstevel@tonic-gate 			 * must have arrived too late.  Return error.
6507c478bd9Sstevel@tonic-gate 			 */
6517c478bd9Sstevel@tonic-gate 			rval = -1;
6527c478bd9Sstevel@tonic-gate 			goto out;
6537c478bd9Sstevel@tonic-gate 		}
6547c478bd9Sstevel@tonic-gate 		zlogp = &logsys;	/* Log errors to syslog */
6557c478bd9Sstevel@tonic-gate 	}
6567c478bd9Sstevel@tonic-gate 
6577c478bd9Sstevel@tonic-gate 	switch (zstate) {
6587c478bd9Sstevel@tonic-gate 	case ZONE_STATE_CONFIGURED:
6597c478bd9Sstevel@tonic-gate 	case ZONE_STATE_INCOMPLETE:
6607c478bd9Sstevel@tonic-gate 		/*
6617c478bd9Sstevel@tonic-gate 		 * Not our area of expertise; we just print a nice message
6627c478bd9Sstevel@tonic-gate 		 * and die off.
6637c478bd9Sstevel@tonic-gate 		 */
6647c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_FALSE,
6657c478bd9Sstevel@tonic-gate 		    "%s operation is invalid for zones in state '%s'",
666108322fbScarlsonj 		    z_cmd_name(cmd), zone_state_str(zstate));
6677c478bd9Sstevel@tonic-gate 		break;
6687c478bd9Sstevel@tonic-gate 
6697c478bd9Sstevel@tonic-gate 	case ZONE_STATE_INSTALLED:
6707c478bd9Sstevel@tonic-gate 		switch (cmd) {
6717c478bd9Sstevel@tonic-gate 		case Z_READY:
672108322fbScarlsonj 			rval = zone_ready(zlogp, B_FALSE);
6737c478bd9Sstevel@tonic-gate 			if (rval == 0)
6747c478bd9Sstevel@tonic-gate 				eventstream_write(Z_EVT_ZONE_READIED);
6757c478bd9Sstevel@tonic-gate 			break;
6767c478bd9Sstevel@tonic-gate 		case Z_BOOT:
6777c478bd9Sstevel@tonic-gate 			eventstream_write(Z_EVT_ZONE_BOOTING);
678108322fbScarlsonj 			if ((rval = zone_ready(zlogp, B_FALSE)) == 0)
6797c478bd9Sstevel@tonic-gate 				rval = zone_bootup(zlogp, zargp->bootbuf);
6807c478bd9Sstevel@tonic-gate 			audit_put_record(zlogp, uc, rval, "boot");
6817c478bd9Sstevel@tonic-gate 			if (rval != 0) {
6827c478bd9Sstevel@tonic-gate 				bringup_failure_recovery = B_TRUE;
683108322fbScarlsonj 				(void) zone_halt(zlogp, B_FALSE);
6847c478bd9Sstevel@tonic-gate 			}
6857c478bd9Sstevel@tonic-gate 			break;
6867c478bd9Sstevel@tonic-gate 		case Z_HALT:
6877c478bd9Sstevel@tonic-gate 			if (kernelcall)	/* Invalid; can't happen */
6887c478bd9Sstevel@tonic-gate 				abort();
6897c478bd9Sstevel@tonic-gate 			/*
6907c478bd9Sstevel@tonic-gate 			 * We could have two clients racing to halt this
6917c478bd9Sstevel@tonic-gate 			 * zone; the second client loses, but his request
6927c478bd9Sstevel@tonic-gate 			 * doesn't fail, since the zone is now in the desired
6937c478bd9Sstevel@tonic-gate 			 * state.
6947c478bd9Sstevel@tonic-gate 			 */
6957c478bd9Sstevel@tonic-gate 			zerror(zlogp, B_FALSE, "zone is already halted");
6967c478bd9Sstevel@tonic-gate 			rval = 0;
6977c478bd9Sstevel@tonic-gate 			break;
6987c478bd9Sstevel@tonic-gate 		case Z_REBOOT:
6997c478bd9Sstevel@tonic-gate 			if (kernelcall)	/* Invalid; can't happen */
7007c478bd9Sstevel@tonic-gate 				abort();
7017c478bd9Sstevel@tonic-gate 			zerror(zlogp, B_FALSE, "%s operation is invalid "
702108322fbScarlsonj 			    "for zones in state '%s'", z_cmd_name(cmd),
7037c478bd9Sstevel@tonic-gate 			    zone_state_str(zstate));
7047c478bd9Sstevel@tonic-gate 			rval = -1;
7057c478bd9Sstevel@tonic-gate 			break;
7067c478bd9Sstevel@tonic-gate 		case Z_NOTE_UNINSTALLING:
7077c478bd9Sstevel@tonic-gate 			if (kernelcall)	/* Invalid; can't happen */
7087c478bd9Sstevel@tonic-gate 				abort();
7097c478bd9Sstevel@tonic-gate 			/*
7107c478bd9Sstevel@tonic-gate 			 * Tell the console to print out a message about this.
7117c478bd9Sstevel@tonic-gate 			 * Once it does, we will be in_death_throes.
7127c478bd9Sstevel@tonic-gate 			 */
7137c478bd9Sstevel@tonic-gate 			eventstream_write(Z_EVT_ZONE_UNINSTALLING);
7147c478bd9Sstevel@tonic-gate 			break;
715108322fbScarlsonj 		case Z_MOUNT:
716108322fbScarlsonj 			if (kernelcall)	/* Invalid; can't happen */
717108322fbScarlsonj 				abort();
718108322fbScarlsonj 			rval = zone_ready(zlogp, B_TRUE);
719108322fbScarlsonj 			if (rval == 0)
720108322fbScarlsonj 				rval = zone_mount_early(zlogp, zone_id);
721108322fbScarlsonj 			/*
722108322fbScarlsonj 			 * Ordinarily, /dev/fd would be mounted inside the zone
723108322fbScarlsonj 			 * by svc:/system/filesystem/usr:default, but since
724108322fbScarlsonj 			 * we're not booting the zone, we need to do this
725108322fbScarlsonj 			 * manually.
726108322fbScarlsonj 			 */
727108322fbScarlsonj 			if (rval == 0)
728108322fbScarlsonj 				rval = mount_early_fs(zlogp, zone_id, "fd",
729108322fbScarlsonj 				    "/dev/fd", "fd");
730108322fbScarlsonj 			break;
731108322fbScarlsonj 		case Z_UNMOUNT:
732108322fbScarlsonj 			if (kernelcall)	/* Invalid; can't happen */
733108322fbScarlsonj 				abort();
734108322fbScarlsonj 			zerror(zlogp, B_FALSE, "zone is already unmounted");
735108322fbScarlsonj 			rval = 0;
736108322fbScarlsonj 			break;
7377c478bd9Sstevel@tonic-gate 		}
7387c478bd9Sstevel@tonic-gate 		break;
7397c478bd9Sstevel@tonic-gate 
7407c478bd9Sstevel@tonic-gate 	case ZONE_STATE_READY:
7417c478bd9Sstevel@tonic-gate 		switch (cmd) {
7427c478bd9Sstevel@tonic-gate 		case Z_READY:
7437c478bd9Sstevel@tonic-gate 			/*
7447c478bd9Sstevel@tonic-gate 			 * We could have two clients racing to ready this
7457c478bd9Sstevel@tonic-gate 			 * zone; the second client loses, but his request
7467c478bd9Sstevel@tonic-gate 			 * doesn't fail, since the zone is now in the desired
7477c478bd9Sstevel@tonic-gate 			 * state.
7487c478bd9Sstevel@tonic-gate 			 */
7497c478bd9Sstevel@tonic-gate 			zerror(zlogp, B_FALSE, "zone is already ready");
7507c478bd9Sstevel@tonic-gate 			rval = 0;
7517c478bd9Sstevel@tonic-gate 			break;
7527c478bd9Sstevel@tonic-gate 		case Z_BOOT:
7537c478bd9Sstevel@tonic-gate 			eventstream_write(Z_EVT_ZONE_BOOTING);
7547c478bd9Sstevel@tonic-gate 			rval = zone_bootup(zlogp, zargp->bootbuf);
7557c478bd9Sstevel@tonic-gate 			audit_put_record(zlogp, uc, rval, "boot");
7567c478bd9Sstevel@tonic-gate 			if (rval != 0) {
7577c478bd9Sstevel@tonic-gate 				bringup_failure_recovery = B_TRUE;
758108322fbScarlsonj 				(void) zone_halt(zlogp, B_FALSE);
7597c478bd9Sstevel@tonic-gate 			}
7607c478bd9Sstevel@tonic-gate 			break;
7617c478bd9Sstevel@tonic-gate 		case Z_HALT:
7627c478bd9Sstevel@tonic-gate 			if (kernelcall)	/* Invalid; can't happen */
7637c478bd9Sstevel@tonic-gate 				abort();
764108322fbScarlsonj 			if ((rval = zone_halt(zlogp, B_FALSE)) != 0)
7657c478bd9Sstevel@tonic-gate 				break;
7667c478bd9Sstevel@tonic-gate 			eventstream_write(Z_EVT_ZONE_HALTED);
7677c478bd9Sstevel@tonic-gate 			break;
7687c478bd9Sstevel@tonic-gate 		case Z_REBOOT:
769108322fbScarlsonj 		case Z_NOTE_UNINSTALLING:
770108322fbScarlsonj 		case Z_MOUNT:
771108322fbScarlsonj 		case Z_UNMOUNT:
7727c478bd9Sstevel@tonic-gate 			if (kernelcall)	/* Invalid; can't happen */
7737c478bd9Sstevel@tonic-gate 				abort();
7747c478bd9Sstevel@tonic-gate 			zerror(zlogp, B_FALSE, "%s operation is invalid "
775108322fbScarlsonj 			    "for zones in state '%s'", z_cmd_name(cmd),
7767c478bd9Sstevel@tonic-gate 			    zone_state_str(zstate));
7777c478bd9Sstevel@tonic-gate 			rval = -1;
7787c478bd9Sstevel@tonic-gate 			break;
779108322fbScarlsonj 		}
780108322fbScarlsonj 		break;
781108322fbScarlsonj 
782108322fbScarlsonj 	case ZONE_STATE_MOUNTED:
783108322fbScarlsonj 		switch (cmd) {
784108322fbScarlsonj 		case Z_UNMOUNT:
7857c478bd9Sstevel@tonic-gate 			if (kernelcall)	/* Invalid; can't happen */
7867c478bd9Sstevel@tonic-gate 				abort();
787108322fbScarlsonj 			rval = zone_halt(zlogp, B_TRUE);
788108322fbScarlsonj 			if (rval == 0)
789108322fbScarlsonj 				(void) sema_post(&scratch_sem);
790108322fbScarlsonj 			break;
791108322fbScarlsonj 		default:
792108322fbScarlsonj 			if (kernelcall)	/* Invalid; can't happen */
793108322fbScarlsonj 				abort();
794108322fbScarlsonj 			zerror(zlogp, B_FALSE, "%s operation is invalid "
795108322fbScarlsonj 			    "for zones in state '%s'", z_cmd_name(cmd),
796108322fbScarlsonj 			    zone_state_str(zstate));
7977c478bd9Sstevel@tonic-gate 			rval = -1;
7987c478bd9Sstevel@tonic-gate 			break;
7997c478bd9Sstevel@tonic-gate 		}
8007c478bd9Sstevel@tonic-gate 		break;
8017c478bd9Sstevel@tonic-gate 
8027c478bd9Sstevel@tonic-gate 	case ZONE_STATE_RUNNING:
8037c478bd9Sstevel@tonic-gate 	case ZONE_STATE_SHUTTING_DOWN:
8047c478bd9Sstevel@tonic-gate 	case ZONE_STATE_DOWN:
8057c478bd9Sstevel@tonic-gate 		switch (cmd) {
8067c478bd9Sstevel@tonic-gate 		case Z_READY:
807108322fbScarlsonj 			if ((rval = zone_halt(zlogp, B_FALSE)) != 0)
8087c478bd9Sstevel@tonic-gate 				break;
809108322fbScarlsonj 			if ((rval = zone_ready(zlogp, B_FALSE)) == 0)
8107c478bd9Sstevel@tonic-gate 				eventstream_write(Z_EVT_ZONE_READIED);
8117c478bd9Sstevel@tonic-gate 			break;
8127c478bd9Sstevel@tonic-gate 		case Z_BOOT:
8137c478bd9Sstevel@tonic-gate 			/*
8147c478bd9Sstevel@tonic-gate 			 * We could have two clients racing to boot this
8157c478bd9Sstevel@tonic-gate 			 * zone; the second client loses, but his request
8167c478bd9Sstevel@tonic-gate 			 * doesn't fail, since the zone is now in the desired
8177c478bd9Sstevel@tonic-gate 			 * state.
8187c478bd9Sstevel@tonic-gate 			 */
8197c478bd9Sstevel@tonic-gate 			zerror(zlogp, B_FALSE, "zone is already booted");
8207c478bd9Sstevel@tonic-gate 			rval = 0;
8217c478bd9Sstevel@tonic-gate 			break;
8227c478bd9Sstevel@tonic-gate 		case Z_HALT:
823108322fbScarlsonj 			if ((rval = zone_halt(zlogp, B_FALSE)) != 0)
8247c478bd9Sstevel@tonic-gate 				break;
8257c478bd9Sstevel@tonic-gate 			eventstream_write(Z_EVT_ZONE_HALTED);
8267c478bd9Sstevel@tonic-gate 			break;
8277c478bd9Sstevel@tonic-gate 		case Z_REBOOT:
8287c478bd9Sstevel@tonic-gate 			eventstream_write(Z_EVT_ZONE_REBOOTING);
829108322fbScarlsonj 			if ((rval = zone_halt(zlogp, B_FALSE)) != 0)
8307c478bd9Sstevel@tonic-gate 				break;
831108322fbScarlsonj 			if ((rval = zone_ready(zlogp, B_FALSE)) == 0) {
8327c478bd9Sstevel@tonic-gate 				rval = zone_bootup(zlogp, "");
8337c478bd9Sstevel@tonic-gate 				audit_put_record(zlogp, uc, rval, "reboot");
8347c478bd9Sstevel@tonic-gate 				if (rval != 0)
835108322fbScarlsonj 					(void) zone_halt(zlogp, B_FALSE);
8367c478bd9Sstevel@tonic-gate 			}
8377c478bd9Sstevel@tonic-gate 			break;
8387c478bd9Sstevel@tonic-gate 		case Z_NOTE_UNINSTALLING:
839108322fbScarlsonj 		case Z_MOUNT:
840108322fbScarlsonj 		case Z_UNMOUNT:
841108322fbScarlsonj 			zerror(zlogp, B_FALSE, "%s operation is invalid "
842108322fbScarlsonj 			    "for zones in state '%s'", z_cmd_name(cmd),
843108322fbScarlsonj 			    zone_state_str(zstate));
8447c478bd9Sstevel@tonic-gate 			rval = -1;
8457c478bd9Sstevel@tonic-gate 			break;
8467c478bd9Sstevel@tonic-gate 		}
8477c478bd9Sstevel@tonic-gate 		break;
8487c478bd9Sstevel@tonic-gate 	default:
8497c478bd9Sstevel@tonic-gate 		abort();
8507c478bd9Sstevel@tonic-gate 	}
8517c478bd9Sstevel@tonic-gate 
8527c478bd9Sstevel@tonic-gate 	/*
8537c478bd9Sstevel@tonic-gate 	 * Because the state of the zone may have changed, we make sure
8547c478bd9Sstevel@tonic-gate 	 * to wake the console poller, which is in charge of initiating
8557c478bd9Sstevel@tonic-gate 	 * the shutdown procedure as necessary.
8567c478bd9Sstevel@tonic-gate 	 */
8577c478bd9Sstevel@tonic-gate 	eventstream_write(Z_EVT_NULL);
8587c478bd9Sstevel@tonic-gate 
8597c478bd9Sstevel@tonic-gate out:
8607c478bd9Sstevel@tonic-gate 	(void) mutex_unlock(&lock);
8617c478bd9Sstevel@tonic-gate 	if (kernelcall) {
8627c478bd9Sstevel@tonic-gate 		rvalp = NULL;
8637c478bd9Sstevel@tonic-gate 		rlen = 0;
8647c478bd9Sstevel@tonic-gate 	} else {
8657c478bd9Sstevel@tonic-gate 		rvalp->rval = rval;
8667c478bd9Sstevel@tonic-gate 	}
8677c478bd9Sstevel@tonic-gate 	if (uc != NULL)
8687c478bd9Sstevel@tonic-gate 		ucred_free(uc);
8697c478bd9Sstevel@tonic-gate 	(void) door_return((char *)rvalp, rlen, NULL, 0);
8707c478bd9Sstevel@tonic-gate 	thr_exit(NULL);
8717c478bd9Sstevel@tonic-gate }
8727c478bd9Sstevel@tonic-gate 
8737c478bd9Sstevel@tonic-gate static int
8747c478bd9Sstevel@tonic-gate setup_door(zlog_t *zlogp)
8757c478bd9Sstevel@tonic-gate {
8767c478bd9Sstevel@tonic-gate 	if ((zone_door = door_create(server, NULL,
8777c478bd9Sstevel@tonic-gate 	    DOOR_UNREF | DOOR_REFUSE_DESC | DOOR_NO_CANCEL)) < 0) {
8787c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "%s failed", "door_create");
8797c478bd9Sstevel@tonic-gate 		return (-1);
8807c478bd9Sstevel@tonic-gate 	}
8817c478bd9Sstevel@tonic-gate 	(void) fdetach(zone_door_path);
8827c478bd9Sstevel@tonic-gate 
8837c478bd9Sstevel@tonic-gate 	if (fattach(zone_door, zone_door_path) != 0) {
8847c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "fattach to %s failed", zone_door_path);
8857c478bd9Sstevel@tonic-gate 		(void) door_revoke(zone_door);
8867c478bd9Sstevel@tonic-gate 		(void) fdetach(zone_door_path);
8877c478bd9Sstevel@tonic-gate 		zone_door = -1;
8887c478bd9Sstevel@tonic-gate 		return (-1);
8897c478bd9Sstevel@tonic-gate 	}
8907c478bd9Sstevel@tonic-gate 	return (0);
8917c478bd9Sstevel@tonic-gate }
8927c478bd9Sstevel@tonic-gate 
8937c478bd9Sstevel@tonic-gate /*
8947c478bd9Sstevel@tonic-gate  * zoneadm(1m) will start zoneadmd if it thinks it isn't running; this
8957c478bd9Sstevel@tonic-gate  * is where zoneadmd itself will check to see that another instance of
8967c478bd9Sstevel@tonic-gate  * zoneadmd isn't already controlling this zone.
8977c478bd9Sstevel@tonic-gate  *
8987c478bd9Sstevel@tonic-gate  * The idea here is that we want to open the path to which we will
8997c478bd9Sstevel@tonic-gate  * attach our door, lock it, and then make sure that no-one has beat us
9007c478bd9Sstevel@tonic-gate  * to fattach(3c)ing onto it.
9017c478bd9Sstevel@tonic-gate  *
9027c478bd9Sstevel@tonic-gate  * fattach(3c) is really a mount, so there are actually two possible
9037c478bd9Sstevel@tonic-gate  * vnodes we could be dealing with.  Our strategy is as follows:
9047c478bd9Sstevel@tonic-gate  *
9057c478bd9Sstevel@tonic-gate  * - If the file we opened is a regular file (common case):
9067c478bd9Sstevel@tonic-gate  * 	There is no fattach(3c)ed door, so we have a chance of becoming
9077c478bd9Sstevel@tonic-gate  * 	the managing zoneadmd. We attempt to lock the file: if it is
9087c478bd9Sstevel@tonic-gate  * 	already locked, that means someone else raced us here, so we
9097c478bd9Sstevel@tonic-gate  * 	lose and give up.  zoneadm(1m) will try to contact the zoneadmd
9107c478bd9Sstevel@tonic-gate  * 	that beat us to it.
9117c478bd9Sstevel@tonic-gate  *
9127c478bd9Sstevel@tonic-gate  * - If the file we opened is a namefs file:
9137c478bd9Sstevel@tonic-gate  * 	This means there is already an established door fattach(3c)'ed
9147c478bd9Sstevel@tonic-gate  * 	to the rendezvous path.  We've lost the race, so we give up.
9157c478bd9Sstevel@tonic-gate  * 	Note that in this case we also try to grab the file lock, and
9167c478bd9Sstevel@tonic-gate  * 	will succeed in acquiring it since the vnode locked by the
9177c478bd9Sstevel@tonic-gate  * 	"winning" zoneadmd was a regular one, and the one we locked was
9187c478bd9Sstevel@tonic-gate  * 	the fattach(3c)'ed door node.  At any rate, no harm is done, and
9197c478bd9Sstevel@tonic-gate  * 	we just return to zoneadm(1m) which knows to retry.
9207c478bd9Sstevel@tonic-gate  */
9217c478bd9Sstevel@tonic-gate static int
9227c478bd9Sstevel@tonic-gate make_daemon_exclusive(zlog_t *zlogp)
9237c478bd9Sstevel@tonic-gate {
9247c478bd9Sstevel@tonic-gate 	int doorfd = -1;
9257c478bd9Sstevel@tonic-gate 	int err, ret = -1;
9267c478bd9Sstevel@tonic-gate 	struct stat st;
9277c478bd9Sstevel@tonic-gate 	struct flock flock;
9287c478bd9Sstevel@tonic-gate 	zone_state_t zstate;
9297c478bd9Sstevel@tonic-gate 
9307c478bd9Sstevel@tonic-gate top:
9317c478bd9Sstevel@tonic-gate 	if ((err = zone_get_state(zone_name, &zstate)) != Z_OK) {
9327c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_FALSE, "failed to get zone state: %s\n",
9337c478bd9Sstevel@tonic-gate 		    zonecfg_strerror(err));
9347c478bd9Sstevel@tonic-gate 		goto out;
9357c478bd9Sstevel@tonic-gate 	}
9367c478bd9Sstevel@tonic-gate 	if ((doorfd = open(zone_door_path, O_CREAT|O_RDWR,
9377c478bd9Sstevel@tonic-gate 	    S_IREAD|S_IWRITE)) < 0) {
9387c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "failed to open %s", zone_door_path);
9397c478bd9Sstevel@tonic-gate 		goto out;
9407c478bd9Sstevel@tonic-gate 	}
9417c478bd9Sstevel@tonic-gate 	if (fstat(doorfd, &st) < 0) {
9427c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "failed to stat %s", zone_door_path);
9437c478bd9Sstevel@tonic-gate 		goto out;
9447c478bd9Sstevel@tonic-gate 	}
9457c478bd9Sstevel@tonic-gate 	/*
9467c478bd9Sstevel@tonic-gate 	 * Lock the file to synchronize with other zoneadmd
9477c478bd9Sstevel@tonic-gate 	 */
9487c478bd9Sstevel@tonic-gate 	flock.l_type = F_WRLCK;
9497c478bd9Sstevel@tonic-gate 	flock.l_whence = SEEK_SET;
9507c478bd9Sstevel@tonic-gate 	flock.l_start = (off_t)0;
9517c478bd9Sstevel@tonic-gate 	flock.l_len = (off_t)0;
9527c478bd9Sstevel@tonic-gate 	if (fcntl(doorfd, F_SETLK, &flock) < 0) {
9537c478bd9Sstevel@tonic-gate 		/*
9547c478bd9Sstevel@tonic-gate 		 * Someone else raced us here and grabbed the lock file
9557c478bd9Sstevel@tonic-gate 		 * first.  A warning here is inappropriate since nothing
9567c478bd9Sstevel@tonic-gate 		 * went wrong.
9577c478bd9Sstevel@tonic-gate 		 */
9587c478bd9Sstevel@tonic-gate 		goto out;
9597c478bd9Sstevel@tonic-gate 	}
9607c478bd9Sstevel@tonic-gate 
9617c478bd9Sstevel@tonic-gate 	if (strcmp(st.st_fstype, "namefs") == 0) {
9627c478bd9Sstevel@tonic-gate 		struct door_info info;
9637c478bd9Sstevel@tonic-gate 
9647c478bd9Sstevel@tonic-gate 		/*
9657c478bd9Sstevel@tonic-gate 		 * There is already something fattach()'ed to this file.
9667c478bd9Sstevel@tonic-gate 		 * Lets see what the door is up to.
9677c478bd9Sstevel@tonic-gate 		 */
9687c478bd9Sstevel@tonic-gate 		if (door_info(doorfd, &info) == 0 && info.di_target != -1) {
9697c478bd9Sstevel@tonic-gate 			/*
9707c478bd9Sstevel@tonic-gate 			 * Another zoneadmd process seems to be in
9717c478bd9Sstevel@tonic-gate 			 * control of the situation and we don't need to
9727c478bd9Sstevel@tonic-gate 			 * be here.  A warning here is inappropriate
9737c478bd9Sstevel@tonic-gate 			 * since nothing went wrong.
9747c478bd9Sstevel@tonic-gate 			 *
9757c478bd9Sstevel@tonic-gate 			 * If the door has been revoked, the zoneadmd
9767c478bd9Sstevel@tonic-gate 			 * process currently managing the zone is going
9777c478bd9Sstevel@tonic-gate 			 * away.  We'll return control to zoneadm(1m)
9787c478bd9Sstevel@tonic-gate 			 * which will try again (by which time zoneadmd
9797c478bd9Sstevel@tonic-gate 			 * will hopefully have exited).
9807c478bd9Sstevel@tonic-gate 			 */
9817c478bd9Sstevel@tonic-gate 			goto out;
9827c478bd9Sstevel@tonic-gate 		}
9837c478bd9Sstevel@tonic-gate 
9847c478bd9Sstevel@tonic-gate 		/*
9857c478bd9Sstevel@tonic-gate 		 * If we got this far, there's a fattach(3c)'ed door
9867c478bd9Sstevel@tonic-gate 		 * that belongs to a process that has exited, which can
9877c478bd9Sstevel@tonic-gate 		 * happen if the previous zoneadmd died unexpectedly.
9887c478bd9Sstevel@tonic-gate 		 *
9897c478bd9Sstevel@tonic-gate 		 * Let user know that something is amiss, but that we can
9907c478bd9Sstevel@tonic-gate 		 * recover; if the zone is in the installed state, then don't
9917c478bd9Sstevel@tonic-gate 		 * message, since having a running zoneadmd isn't really
9927c478bd9Sstevel@tonic-gate 		 * expected/needed.  We want to keep occurences of this message
9937c478bd9Sstevel@tonic-gate 		 * limited to times when zoneadmd is picking back up from a
9947c478bd9Sstevel@tonic-gate 		 * zoneadmd that died while the zone was in some non-trivial
9957c478bd9Sstevel@tonic-gate 		 * state.
9967c478bd9Sstevel@tonic-gate 		 */
9977c478bd9Sstevel@tonic-gate 		if (zstate > ZONE_STATE_INSTALLED) {
9987c478bd9Sstevel@tonic-gate 			zerror(zlogp, B_FALSE,
9997c478bd9Sstevel@tonic-gate 			    "zone '%s': WARNING: zone is in state '%s', but "
10007c478bd9Sstevel@tonic-gate 			    "zoneadmd does not appear to be available; "
10017c478bd9Sstevel@tonic-gate 			    "restarted zoneadmd to recover.",
10027c478bd9Sstevel@tonic-gate 			    zone_name, zone_state_str(zstate));
10037c478bd9Sstevel@tonic-gate 		}
10047c478bd9Sstevel@tonic-gate 
10057c478bd9Sstevel@tonic-gate 		(void) fdetach(zone_door_path);
10067c478bd9Sstevel@tonic-gate 		(void) close(doorfd);
10077c478bd9Sstevel@tonic-gate 		goto top;
10087c478bd9Sstevel@tonic-gate 	}
10097c478bd9Sstevel@tonic-gate 	ret = 0;
10107c478bd9Sstevel@tonic-gate out:
10117c478bd9Sstevel@tonic-gate 	(void) close(doorfd);
10127c478bd9Sstevel@tonic-gate 	return (ret);
10137c478bd9Sstevel@tonic-gate }
10147c478bd9Sstevel@tonic-gate 
10157c478bd9Sstevel@tonic-gate int
10167c478bd9Sstevel@tonic-gate main(int argc, char *argv[])
10177c478bd9Sstevel@tonic-gate {
10187c478bd9Sstevel@tonic-gate 	int opt;
10197c478bd9Sstevel@tonic-gate 	zoneid_t zid;
10207c478bd9Sstevel@tonic-gate 	priv_set_t *privset;
10217c478bd9Sstevel@tonic-gate 	zone_state_t zstate;
10227c478bd9Sstevel@tonic-gate 	char parents_locale[MAXPATHLEN];
10237c478bd9Sstevel@tonic-gate 	int err;
10247c478bd9Sstevel@tonic-gate 
10257c478bd9Sstevel@tonic-gate 	pid_t pid;
10267c478bd9Sstevel@tonic-gate 	sigset_t blockset;
10277c478bd9Sstevel@tonic-gate 	sigset_t block_cld;
10287c478bd9Sstevel@tonic-gate 
10297c478bd9Sstevel@tonic-gate 	struct {
10307c478bd9Sstevel@tonic-gate 		sema_t sem;
10317c478bd9Sstevel@tonic-gate 		int status;
10327c478bd9Sstevel@tonic-gate 		zlog_t log;
10337c478bd9Sstevel@tonic-gate 	} *shstate;
10347c478bd9Sstevel@tonic-gate 	size_t shstatelen = getpagesize();
10357c478bd9Sstevel@tonic-gate 
10367c478bd9Sstevel@tonic-gate 	zlog_t errlog;
10377c478bd9Sstevel@tonic-gate 	zlog_t *zlogp;
10387c478bd9Sstevel@tonic-gate 
10397c478bd9Sstevel@tonic-gate 	progname = get_execbasename(argv[0]);
10407c478bd9Sstevel@tonic-gate 
10417c478bd9Sstevel@tonic-gate 	/*
10427c478bd9Sstevel@tonic-gate 	 * Make sure stderr is unbuffered
10437c478bd9Sstevel@tonic-gate 	 */
10447c478bd9Sstevel@tonic-gate 	(void) setbuffer(stderr, NULL, 0);
10457c478bd9Sstevel@tonic-gate 
10467c478bd9Sstevel@tonic-gate 	/*
10477c478bd9Sstevel@tonic-gate 	 * Get out of the way of mounted filesystems, since we will daemonize
10487c478bd9Sstevel@tonic-gate 	 * soon.
10497c478bd9Sstevel@tonic-gate 	 */
10507c478bd9Sstevel@tonic-gate 	(void) chdir("/");
10517c478bd9Sstevel@tonic-gate 
10527c478bd9Sstevel@tonic-gate 	/*
10537c478bd9Sstevel@tonic-gate 	 * Use the default system umask per PSARC 1998/110 rather than
10547c478bd9Sstevel@tonic-gate 	 * anything that may have been set by the caller.
10557c478bd9Sstevel@tonic-gate 	 */
10567c478bd9Sstevel@tonic-gate 	(void) umask(CMASK);
10577c478bd9Sstevel@tonic-gate 
10587c478bd9Sstevel@tonic-gate 	/*
10597c478bd9Sstevel@tonic-gate 	 * Initially we want to use our parent's locale.
10607c478bd9Sstevel@tonic-gate 	 */
10617c478bd9Sstevel@tonic-gate 	(void) setlocale(LC_ALL, "");
10627c478bd9Sstevel@tonic-gate 	(void) textdomain(TEXT_DOMAIN);
10637c478bd9Sstevel@tonic-gate 	(void) strlcpy(parents_locale, setlocale(LC_MESSAGES, NULL),
10647c478bd9Sstevel@tonic-gate 	    sizeof (parents_locale));
10657c478bd9Sstevel@tonic-gate 
10667c478bd9Sstevel@tonic-gate 	/*
10677c478bd9Sstevel@tonic-gate 	 * This zlog_t is used for writing to stderr
10687c478bd9Sstevel@tonic-gate 	 */
10697c478bd9Sstevel@tonic-gate 	errlog.logfile = stderr;
10707c478bd9Sstevel@tonic-gate 	errlog.buflen = errlog.loglen = 0;
10717c478bd9Sstevel@tonic-gate 	errlog.buf = errlog.log = NULL;
10727c478bd9Sstevel@tonic-gate 	errlog.locale = parents_locale;
10737c478bd9Sstevel@tonic-gate 
10747c478bd9Sstevel@tonic-gate 	/*
10757c478bd9Sstevel@tonic-gate 	 * We start off writing to stderr until we're ready to daemonize.
10767c478bd9Sstevel@tonic-gate 	 */
10777c478bd9Sstevel@tonic-gate 	zlogp = &errlog;
10787c478bd9Sstevel@tonic-gate 
10797c478bd9Sstevel@tonic-gate 	/*
10807c478bd9Sstevel@tonic-gate 	 * Process options.
10817c478bd9Sstevel@tonic-gate 	 */
1082108322fbScarlsonj 	while ((opt = getopt(argc, argv, "R:z:")) != EOF) {
10837c478bd9Sstevel@tonic-gate 		switch (opt) {
1084108322fbScarlsonj 		case 'R':
1085108322fbScarlsonj 			zonecfg_set_root(optarg);
1086108322fbScarlsonj 			break;
10877c478bd9Sstevel@tonic-gate 		case 'z':
10887c478bd9Sstevel@tonic-gate 			zone_name = optarg;
10897c478bd9Sstevel@tonic-gate 			break;
10907c478bd9Sstevel@tonic-gate 		default:
10917c478bd9Sstevel@tonic-gate 			usage();
10927c478bd9Sstevel@tonic-gate 		}
10937c478bd9Sstevel@tonic-gate 	}
10947c478bd9Sstevel@tonic-gate 
10957c478bd9Sstevel@tonic-gate 	if (zone_name == NULL)
10967c478bd9Sstevel@tonic-gate 		usage();
10977c478bd9Sstevel@tonic-gate 
10987c478bd9Sstevel@tonic-gate 	/*
10997c478bd9Sstevel@tonic-gate 	 * Because usage() prints directly to stderr, it has gettext()
11007c478bd9Sstevel@tonic-gate 	 * wrapping, which depends on the locale.  But since zerror() calls
11017c478bd9Sstevel@tonic-gate 	 * localize() which tweaks the locale, it is not safe to call zerror()
11027c478bd9Sstevel@tonic-gate 	 * until after the last call to usage().  Fortunately, the last call
11037c478bd9Sstevel@tonic-gate 	 * to usage() is just above and the first call to zerror() is just
11047c478bd9Sstevel@tonic-gate 	 * below.  Don't mess this up.
11057c478bd9Sstevel@tonic-gate 	 */
11067c478bd9Sstevel@tonic-gate 	if (strcmp(zone_name, GLOBAL_ZONENAME) == 0) {
11077c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_FALSE, "cannot manage the %s zone",
11087c478bd9Sstevel@tonic-gate 		    GLOBAL_ZONENAME);
11097c478bd9Sstevel@tonic-gate 		return (1);
11107c478bd9Sstevel@tonic-gate 	}
11117c478bd9Sstevel@tonic-gate 
11127c478bd9Sstevel@tonic-gate 	if (zone_get_id(zone_name, &zid) != 0) {
11137c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_FALSE, "could not manage %s: %s\n", zone_name,
11147c478bd9Sstevel@tonic-gate 		    zonecfg_strerror(Z_NO_ZONE));
11157c478bd9Sstevel@tonic-gate 		return (1);
11167c478bd9Sstevel@tonic-gate 	}
11177c478bd9Sstevel@tonic-gate 
11187c478bd9Sstevel@tonic-gate 	if ((err = zone_get_state(zone_name, &zstate)) != Z_OK) {
11197c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_FALSE, "failed to get zone state: %s\n",
11207c478bd9Sstevel@tonic-gate 		    zonecfg_strerror(err));
11217c478bd9Sstevel@tonic-gate 		return (1);
11227c478bd9Sstevel@tonic-gate 	}
11237c478bd9Sstevel@tonic-gate 	if (zstate < ZONE_STATE_INSTALLED) {
11247c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_FALSE,
11257c478bd9Sstevel@tonic-gate 		    "cannot manage a zone which is in state '%s'",
11267c478bd9Sstevel@tonic-gate 		    zone_state_str(zstate));
11277c478bd9Sstevel@tonic-gate 		return (1);
11287c478bd9Sstevel@tonic-gate 	}
11297c478bd9Sstevel@tonic-gate 
11307c478bd9Sstevel@tonic-gate 	/*
11317c478bd9Sstevel@tonic-gate 	 * Check that we have all privileges.  It would be nice to pare
11327c478bd9Sstevel@tonic-gate 	 * this down, but this is at least a first cut.
11337c478bd9Sstevel@tonic-gate 	 */
11347c478bd9Sstevel@tonic-gate 	if ((privset = priv_allocset()) == NULL) {
11357c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "%s failed", "priv_allocset");
11367c478bd9Sstevel@tonic-gate 		return (1);
11377c478bd9Sstevel@tonic-gate 	}
11387c478bd9Sstevel@tonic-gate 
11397c478bd9Sstevel@tonic-gate 	if (getppriv(PRIV_EFFECTIVE, privset) != 0) {
11407c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "%s failed", "getppriv");
11417c478bd9Sstevel@tonic-gate 		priv_freeset(privset);
11427c478bd9Sstevel@tonic-gate 		return (1);
11437c478bd9Sstevel@tonic-gate 	}
11447c478bd9Sstevel@tonic-gate 
11457c478bd9Sstevel@tonic-gate 	if (priv_isfullset(privset) == B_FALSE) {
11467c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_FALSE, "You lack sufficient privilege to "
11477c478bd9Sstevel@tonic-gate 		    "run this command (all privs required)\n");
11487c478bd9Sstevel@tonic-gate 		priv_freeset(privset);
11497c478bd9Sstevel@tonic-gate 		return (1);
11507c478bd9Sstevel@tonic-gate 	}
11517c478bd9Sstevel@tonic-gate 	priv_freeset(privset);
11527c478bd9Sstevel@tonic-gate 
11537c478bd9Sstevel@tonic-gate 	if (mkzonedir(zlogp) != 0)
11547c478bd9Sstevel@tonic-gate 		return (1);
11557c478bd9Sstevel@tonic-gate 
11567c478bd9Sstevel@tonic-gate 	/*
11577c478bd9Sstevel@tonic-gate 	 * Pre-fork: setup shared state
11587c478bd9Sstevel@tonic-gate 	 */
11597c478bd9Sstevel@tonic-gate 	if ((shstate = (void *)mmap(NULL, shstatelen,
11607c478bd9Sstevel@tonic-gate 	    PROT_READ|PROT_WRITE, MAP_SHARED|MAP_ANON, -1, (off_t)0)) ==
11617c478bd9Sstevel@tonic-gate 	    MAP_FAILED) {
11627c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "%s failed", "mmap");
11637c478bd9Sstevel@tonic-gate 		return (1);
11647c478bd9Sstevel@tonic-gate 	}
11657c478bd9Sstevel@tonic-gate 	if (sema_init(&shstate->sem, 0, USYNC_PROCESS, NULL) != 0) {
11667c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "%s failed", "sema_init()");
11677c478bd9Sstevel@tonic-gate 		(void) munmap((char *)shstate, shstatelen);
11687c478bd9Sstevel@tonic-gate 		return (1);
11697c478bd9Sstevel@tonic-gate 	}
11707c478bd9Sstevel@tonic-gate 	shstate->log.logfile = NULL;
11717c478bd9Sstevel@tonic-gate 	shstate->log.buflen = shstatelen - sizeof (*shstate);
11727c478bd9Sstevel@tonic-gate 	shstate->log.loglen = shstate->log.buflen;
11737c478bd9Sstevel@tonic-gate 	shstate->log.buf = (char *)shstate + sizeof (*shstate);
11747c478bd9Sstevel@tonic-gate 	shstate->log.log = shstate->log.buf;
11757c478bd9Sstevel@tonic-gate 	shstate->log.locale = parents_locale;
11767c478bd9Sstevel@tonic-gate 	shstate->status = -1;
11777c478bd9Sstevel@tonic-gate 
11787c478bd9Sstevel@tonic-gate 	/*
11797c478bd9Sstevel@tonic-gate 	 * We need a SIGCHLD handler so the sema_wait() below will wake
11807c478bd9Sstevel@tonic-gate 	 * up if the child dies without doing a sema_post().
11817c478bd9Sstevel@tonic-gate 	 */
11827c478bd9Sstevel@tonic-gate 	(void) sigset(SIGCHLD, sigchld);
11837c478bd9Sstevel@tonic-gate 	/*
11847c478bd9Sstevel@tonic-gate 	 * We must mask SIGCHLD until after we've coped with the fork
11857c478bd9Sstevel@tonic-gate 	 * sufficiently to deal with it; otherwise we can race and
11867c478bd9Sstevel@tonic-gate 	 * receive the signal before pid has been initialized
11877c478bd9Sstevel@tonic-gate 	 * (yes, this really happens).
11887c478bd9Sstevel@tonic-gate 	 */
11897c478bd9Sstevel@tonic-gate 	(void) sigemptyset(&block_cld);
11907c478bd9Sstevel@tonic-gate 	(void) sigaddset(&block_cld, SIGCHLD);
11917c478bd9Sstevel@tonic-gate 	(void) sigprocmask(SIG_BLOCK, &block_cld, NULL);
11927c478bd9Sstevel@tonic-gate 
11937c478bd9Sstevel@tonic-gate 	/*
11947c478bd9Sstevel@tonic-gate 	 * Do not let another thread localize a message while we are forking.
11957c478bd9Sstevel@tonic-gate 	 */
11967c478bd9Sstevel@tonic-gate 	(void) mutex_lock(&msglock);
11977c478bd9Sstevel@tonic-gate 	pid = fork();
11987c478bd9Sstevel@tonic-gate 	(void) mutex_unlock(&msglock);
11997c478bd9Sstevel@tonic-gate 	if (pid == -1) {
12007c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "could not fork");
12017c478bd9Sstevel@tonic-gate 		return (1);
12027c478bd9Sstevel@tonic-gate 
12037c478bd9Sstevel@tonic-gate 	} else if (pid > 0) { /* parent */
12047c478bd9Sstevel@tonic-gate 		(void) sigprocmask(SIG_UNBLOCK, &block_cld, NULL);
12057c478bd9Sstevel@tonic-gate 		/*
12067c478bd9Sstevel@tonic-gate 		 * This marks a window of vulnerability in which we receive
12077c478bd9Sstevel@tonic-gate 		 * the SIGCLD before falling into sema_wait (normally we would
12087c478bd9Sstevel@tonic-gate 		 * get woken up from sema_wait with EINTR upon receipt of
12097c478bd9Sstevel@tonic-gate 		 * SIGCLD).  So we may need to use some other scheme like
12107c478bd9Sstevel@tonic-gate 		 * sema_posting in the sigcld handler.
12117c478bd9Sstevel@tonic-gate 		 * blech
12127c478bd9Sstevel@tonic-gate 		 */
12137c478bd9Sstevel@tonic-gate 		(void) sema_wait(&shstate->sem);
12147c478bd9Sstevel@tonic-gate 		(void) sema_destroy(&shstate->sem);
12157c478bd9Sstevel@tonic-gate 		if (shstate->status != 0)
12167c478bd9Sstevel@tonic-gate 			(void) waitpid(pid, NULL, WNOHANG);
12177c478bd9Sstevel@tonic-gate 		/*
12187c478bd9Sstevel@tonic-gate 		 * It's ok if we die with SIGPIPE.  It's not like we could have
12197c478bd9Sstevel@tonic-gate 		 * done anything about it.
12207c478bd9Sstevel@tonic-gate 		 */
12217c478bd9Sstevel@tonic-gate 		(void) fprintf(stderr, "%s", shstate->log.buf);
12227c478bd9Sstevel@tonic-gate 		_exit(shstate->status == 0 ? 0 : 1);
12237c478bd9Sstevel@tonic-gate 	}
12247c478bd9Sstevel@tonic-gate 
12257c478bd9Sstevel@tonic-gate 	/*
12267c478bd9Sstevel@tonic-gate 	 * The child charges on.
12277c478bd9Sstevel@tonic-gate 	 */
12287c478bd9Sstevel@tonic-gate 	(void) sigset(SIGCHLD, SIG_DFL);
12297c478bd9Sstevel@tonic-gate 	(void) sigprocmask(SIG_UNBLOCK, &block_cld, NULL);
12307c478bd9Sstevel@tonic-gate 
12317c478bd9Sstevel@tonic-gate 	/*
12327c478bd9Sstevel@tonic-gate 	 * SIGPIPE can be delivered if we write to a socket for which the
12337c478bd9Sstevel@tonic-gate 	 * peer endpoint is gone.  That can lead to too-early termination
12347c478bd9Sstevel@tonic-gate 	 * of zoneadmd, and that's not good eats.
12357c478bd9Sstevel@tonic-gate 	 */
12367c478bd9Sstevel@tonic-gate 	(void) sigset(SIGPIPE, SIG_IGN);
12377c478bd9Sstevel@tonic-gate 	/*
12387c478bd9Sstevel@tonic-gate 	 * Stop using stderr
12397c478bd9Sstevel@tonic-gate 	 */
12407c478bd9Sstevel@tonic-gate 	zlogp = &shstate->log;
12417c478bd9Sstevel@tonic-gate 
12427c478bd9Sstevel@tonic-gate 	/*
12437c478bd9Sstevel@tonic-gate 	 * We don't need stdout/stderr from now on.
12447c478bd9Sstevel@tonic-gate 	 */
12457c478bd9Sstevel@tonic-gate 	closefrom(0);
12467c478bd9Sstevel@tonic-gate 
12477c478bd9Sstevel@tonic-gate 	/*
12487c478bd9Sstevel@tonic-gate 	 * Initialize the syslog zlog_t.  This needs to be done after
12497c478bd9Sstevel@tonic-gate 	 * the call to closefrom().
12507c478bd9Sstevel@tonic-gate 	 */
12517c478bd9Sstevel@tonic-gate 	logsys.buf = logsys.log = NULL;
12527c478bd9Sstevel@tonic-gate 	logsys.buflen = logsys.loglen = 0;
12537c478bd9Sstevel@tonic-gate 	logsys.logfile = NULL;
12547c478bd9Sstevel@tonic-gate 	logsys.locale = DEFAULT_LOCALE;
12557c478bd9Sstevel@tonic-gate 
12567c478bd9Sstevel@tonic-gate 	openlog("zoneadmd", LOG_PID, LOG_DAEMON);
12577c478bd9Sstevel@tonic-gate 
12587c478bd9Sstevel@tonic-gate 	/*
12597c478bd9Sstevel@tonic-gate 	 * The eventstream is used to publish state changes in the zone
12607c478bd9Sstevel@tonic-gate 	 * from the door threads to the console I/O poller.
12617c478bd9Sstevel@tonic-gate 	 */
12627c478bd9Sstevel@tonic-gate 	if (eventstream_init() == -1) {
12637c478bd9Sstevel@tonic-gate 		zerror(zlogp, B_TRUE, "unable to create eventstream");
12647c478bd9Sstevel@tonic-gate 		goto child_out;
12657c478bd9Sstevel@tonic-gate 	}
12667c478bd9Sstevel@tonic-gate 
12677c478bd9Sstevel@tonic-gate 	(void) snprintf(zone_door_path, sizeof (zone_door_path),
1268108322fbScarlsonj 	    "%s" ZONE_DOOR_PATH, zonecfg_get_root(), zone_name);
12697c478bd9Sstevel@tonic-gate 
12707c478bd9Sstevel@tonic-gate 	/*
12717c478bd9Sstevel@tonic-gate 	 * See if another zoneadmd is running for this zone.  If not, then we
12727c478bd9Sstevel@tonic-gate 	 * can now modify system state.
12737c478bd9Sstevel@tonic-gate 	 */
12747c478bd9Sstevel@tonic-gate 	if (make_daemon_exclusive(zlogp) == -1)
12757c478bd9Sstevel@tonic-gate 		goto child_out;
12767c478bd9Sstevel@tonic-gate 
12777c478bd9Sstevel@tonic-gate 
12787c478bd9Sstevel@tonic-gate 	/*
12797c478bd9Sstevel@tonic-gate 	 * Create/join a new session; we need to be careful of what we do with
12807c478bd9Sstevel@tonic-gate 	 * the console from now on so we don't end up being the session leader
12817c478bd9Sstevel@tonic-gate 	 * for the terminal we're going to be handing out.
12827c478bd9Sstevel@tonic-gate 	 */
12837c478bd9Sstevel@tonic-gate 	(void) setsid();
12847c478bd9Sstevel@tonic-gate 
12857c478bd9Sstevel@tonic-gate 	/*
12867c478bd9Sstevel@tonic-gate 	 * This thread shouldn't be receiving any signals; in particular,
12877c478bd9Sstevel@tonic-gate 	 * SIGCHLD should be received by the thread doing the fork().
12887c478bd9Sstevel@tonic-gate 	 */
12897c478bd9Sstevel@tonic-gate 	(void) sigfillset(&blockset);
12907c478bd9Sstevel@tonic-gate 	(void) thr_sigsetmask(SIG_BLOCK, &blockset, NULL);
12917c478bd9Sstevel@tonic-gate 
12927c478bd9Sstevel@tonic-gate 	/*
12937c478bd9Sstevel@tonic-gate 	 * Setup the console device and get ready to serve the console;
12947c478bd9Sstevel@tonic-gate 	 * once this has completed, we're ready to let console clients
12957c478bd9Sstevel@tonic-gate 	 * make an attempt to connect (they will block until
12967c478bd9Sstevel@tonic-gate 	 * serve_console_sock() below gets called, and any pending
12977c478bd9Sstevel@tonic-gate 	 * connection is accept()ed).
12987c478bd9Sstevel@tonic-gate 	 */
1299108322fbScarlsonj 	if (!zonecfg_in_alt_root() && init_console(zlogp) == -1)
13007c478bd9Sstevel@tonic-gate 		goto child_out;
13017c478bd9Sstevel@tonic-gate 
13027c478bd9Sstevel@tonic-gate 	/*
13037c478bd9Sstevel@tonic-gate 	 * Take the lock now, so that when the door server gets going, we
13047c478bd9Sstevel@tonic-gate 	 * are guaranteed that it won't take a request until we are sure
13057c478bd9Sstevel@tonic-gate 	 * that everything is completely set up.  See the child_out: label
13067c478bd9Sstevel@tonic-gate 	 * below to see why this matters.
13077c478bd9Sstevel@tonic-gate 	 */
13087c478bd9Sstevel@tonic-gate 	(void) mutex_lock(&lock);
13097c478bd9Sstevel@tonic-gate 
1310108322fbScarlsonj 	/* Init semaphore for scratch zones. */
1311108322fbScarlsonj 	if (sema_init(&scratch_sem, 0, USYNC_THREAD, NULL) == -1) {
1312108322fbScarlsonj 		zerror(zlogp, B_TRUE,
1313108322fbScarlsonj 		    "failed to initialize semaphore for scratch zone");
1314108322fbScarlsonj 		goto child_out;
1315108322fbScarlsonj 	}
1316108322fbScarlsonj 
13177c478bd9Sstevel@tonic-gate 	/*
13187c478bd9Sstevel@tonic-gate 	 * Note: door setup must occur *after* the console is setup.
13197c478bd9Sstevel@tonic-gate 	 * This is so that as zlogin tests the door to see if zoneadmd
13207c478bd9Sstevel@tonic-gate 	 * is ready yet, we know that the console will get serviced
13217c478bd9Sstevel@tonic-gate 	 * once door_info() indicates that the door is "up".
13227c478bd9Sstevel@tonic-gate 	 */
13237c478bd9Sstevel@tonic-gate 	if (setup_door(zlogp) == -1)
13247c478bd9Sstevel@tonic-gate 		goto child_out;
13257c478bd9Sstevel@tonic-gate 
13267c478bd9Sstevel@tonic-gate 	/*
13277c478bd9Sstevel@tonic-gate 	 * Things seem OK so far; tell the parent process that we're done
13287c478bd9Sstevel@tonic-gate 	 * with setup tasks.  This will cause the parent to exit, signalling
13297c478bd9Sstevel@tonic-gate 	 * to zoneadm, zlogin, or whatever forked it that we are ready to
13307c478bd9Sstevel@tonic-gate 	 * service requests.
13317c478bd9Sstevel@tonic-gate 	 */
13327c478bd9Sstevel@tonic-gate 	shstate->status = 0;
13337c478bd9Sstevel@tonic-gate 	(void) sema_post(&shstate->sem);
13347c478bd9Sstevel@tonic-gate 	(void) munmap((char *)shstate, shstatelen);
13357c478bd9Sstevel@tonic-gate 	shstate = NULL;
13367c478bd9Sstevel@tonic-gate 
13377c478bd9Sstevel@tonic-gate 	(void) mutex_unlock(&lock);
13387c478bd9Sstevel@tonic-gate 
13397c478bd9Sstevel@tonic-gate 	/*
13407c478bd9Sstevel@tonic-gate 	 * zlogp is now invalid, so reset it to the syslog logger.
13417c478bd9Sstevel@tonic-gate 	 */
13427c478bd9Sstevel@tonic-gate 	zlogp = &logsys;
13437c478bd9Sstevel@tonic-gate 
13447c478bd9Sstevel@tonic-gate 	/*
13457c478bd9Sstevel@tonic-gate 	 * Now that we are free of any parents, switch to the default locale.
13467c478bd9Sstevel@tonic-gate 	 */
13477c478bd9Sstevel@tonic-gate 	(void) setlocale(LC_ALL, DEFAULT_LOCALE);
13487c478bd9Sstevel@tonic-gate 
13497c478bd9Sstevel@tonic-gate 	/*
13507c478bd9Sstevel@tonic-gate 	 * At this point the setup portion of main() is basically done, so
13517c478bd9Sstevel@tonic-gate 	 * we reuse this thread to manage the zone console.  When
13527c478bd9Sstevel@tonic-gate 	 * serve_console() has returned, we are past the point of no return
13537c478bd9Sstevel@tonic-gate 	 * in the life of this zoneadmd.
13547c478bd9Sstevel@tonic-gate 	 */
1355108322fbScarlsonj 	if (zonecfg_in_alt_root()) {
1356108322fbScarlsonj 		/*
1357108322fbScarlsonj 		 * This is just awful, but mounted scratch zones don't (and
1358108322fbScarlsonj 		 * can't) have consoles.  We just wait for unmount instead.
1359108322fbScarlsonj 		 */
1360108322fbScarlsonj 		while (sema_wait(&scratch_sem) == EINTR)
1361108322fbScarlsonj 			;
1362108322fbScarlsonj 	} else {
13637c478bd9Sstevel@tonic-gate 		serve_console(zlogp);
13647c478bd9Sstevel@tonic-gate 		assert(in_death_throes);
1365108322fbScarlsonj 	}
13667c478bd9Sstevel@tonic-gate 
13677c478bd9Sstevel@tonic-gate 	/*
13687c478bd9Sstevel@tonic-gate 	 * This is the next-to-last part of the exit interlock.  Upon calling
13697c478bd9Sstevel@tonic-gate 	 * fdetach(), the door will go unreferenced; once any
13707c478bd9Sstevel@tonic-gate 	 * outstanding requests (like the door thread doing Z_HALT) are
13717c478bd9Sstevel@tonic-gate 	 * done, the door will get an UNREF notification; when it handles
13727c478bd9Sstevel@tonic-gate 	 * the UNREF, the door server will cause the exit.
13737c478bd9Sstevel@tonic-gate 	 */
13747c478bd9Sstevel@tonic-gate 	assert(!MUTEX_HELD(&lock));
13757c478bd9Sstevel@tonic-gate 	(void) fdetach(zone_door_path);
13767c478bd9Sstevel@tonic-gate 	for (;;)
13777c478bd9Sstevel@tonic-gate 		(void) pause();
13787c478bd9Sstevel@tonic-gate 
13797c478bd9Sstevel@tonic-gate child_out:
13807c478bd9Sstevel@tonic-gate 	assert(pid == 0);
13817c478bd9Sstevel@tonic-gate 	if (shstate != NULL) {
13827c478bd9Sstevel@tonic-gate 		shstate->status = -1;
13837c478bd9Sstevel@tonic-gate 		(void) sema_post(&shstate->sem);
13847c478bd9Sstevel@tonic-gate 		(void) munmap((char *)shstate, shstatelen);
13857c478bd9Sstevel@tonic-gate 	}
13867c478bd9Sstevel@tonic-gate 
13877c478bd9Sstevel@tonic-gate 	/*
13887c478bd9Sstevel@tonic-gate 	 * This might trigger an unref notification, but if so,
13897c478bd9Sstevel@tonic-gate 	 * we are still holding the lock, so our call to exit will
13907c478bd9Sstevel@tonic-gate 	 * ultimately win the race and will publish the right exit
13917c478bd9Sstevel@tonic-gate 	 * code.
13927c478bd9Sstevel@tonic-gate 	 */
13937c478bd9Sstevel@tonic-gate 	if (zone_door != -1) {
13947c478bd9Sstevel@tonic-gate 		assert(MUTEX_HELD(&lock));
13957c478bd9Sstevel@tonic-gate 		(void) door_revoke(zone_door);
13967c478bd9Sstevel@tonic-gate 		(void) fdetach(zone_door_path);
13977c478bd9Sstevel@tonic-gate 	}
13987c478bd9Sstevel@tonic-gate 	return (1); /* return from main() forcibly exits an MT process */
13997c478bd9Sstevel@tonic-gate }
1400