1*f875b4ebSrica#!/bin/sh 2*f875b4ebSrica# 3*f875b4ebSrica# CDDL HEADER START 4*f875b4ebSrica# 5*f875b4ebSrica# The contents of this file are subject to the terms of the 6*f875b4ebSrica# Common Development and Distribution License (the "License"). 7*f875b4ebSrica# You may not use this file except in compliance with the License. 8*f875b4ebSrica# 9*f875b4ebSrica# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*f875b4ebSrica# or http://www.opensolaris.org/os/licensing. 11*f875b4ebSrica# See the License for the specific language governing permissions 12*f875b4ebSrica# and limitations under the License. 13*f875b4ebSrica# 14*f875b4ebSrica# When distributing Covered Code, include this CDDL HEADER in each 15*f875b4ebSrica# file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*f875b4ebSrica# If applicable, add the following below this CDDL HEADER, with the 17*f875b4ebSrica# fields enclosed by brackets "[]" replaced with your own identifying 18*f875b4ebSrica# information: Portions Copyright [yyyy] [name of copyright owner] 19*f875b4ebSrica# 20*f875b4ebSrica# CDDL HEADER END 21*f875b4ebSrica# 22*f875b4ebSrica# Copyright 2007 Sun Microsystems, Inc. All rights reserved. 23*f875b4ebSrica# Use is subject to license terms. 24*f875b4ebSrica# 25*f875b4ebSrica#ident "%Z%%M% %I% %E% SMI" 26*f875b4ebSrica# 27*f875b4ebSrica# clonebylabel 28*f875b4ebSrica# 29*f875b4ebSrica# This script installs zones by cloning a zfs snapshot. 30*f875b4ebSrica# For each sensitivity label dominated by the clearance 31*f875b4ebSrica# a zone is installed if necessary. If the zone name is 32*f875b4ebSrica# not already defined in tnzonecfg, the user is prompted 33*f875b4ebSrica# to provide a unique zone name. 34*f875b4ebSrica# 35*f875b4ebSrica# $1 is the label upper bound (clearance) 36*f875b4ebSrica# 37*f875b4ebSrica# $2 is the zone snaphot to clone for a new zone 38*f875b4ebSrica 39*f875b4ebSricaZONECFG=/etc/security/tsol/tnzonecfg 40*f875b4ebSricaclearance=$1 41*f875b4ebSricaimage=$2 42*f875b4ebSrica 43*f875b4ebSrica# 44*f875b4ebSrica# Configure a zone 45*f875b4ebSrica# 46*f875b4ebSrica 47*f875b4ebSricaconfigure() 48*f875b4ebSrica{ 49*f875b4ebSrica config=/tmp/zfg.$$ 50*f875b4ebSrica echo "create -F -t SUNWtsoldef" > $config 51*f875b4ebSrica echo "set zonepath=/zone/$zonename" >> $config 52*f875b4ebSrica echo "commit" >> $config 53*f875b4ebSrica /usr/sbin/zonecfg -z $zonename -f $config 54*f875b4ebSrica rm $config 55*f875b4ebSrica} 56*f875b4ebSrica 57*f875b4ebSrica# 58*f875b4ebSrica# Clone a zone 59*f875b4ebSrica# 60*f875b4ebSrica 61*f875b4ebSricaclone() 62*f875b4ebSrica{ 63*f875b4ebSrica echo Cloning $zonename from $image ... 64*f875b4ebSrica found=`zoneadm -z $zonename list -p 2>/dev/null` 65*f875b4ebSrica if [ $found ]; then 66*f875b4ebSrica true 67*f875b4ebSrica else 68*f875b4ebSrica echo "$zonename is being configured." 69*f875b4ebSrica configure 70*f875b4ebSrica fi 71*f875b4ebSrica /usr/sbin/zfs clone $image zone/$zonename 72*f875b4ebSrica /usr/sbin/zoneadm -z $zonename attach -F 73*f875b4ebSrica} 74*f875b4ebSrica 75*f875b4ebSrica# 76*f875b4ebSrica# Create missing zones for each label dominated by clearance 77*f875b4ebSrica# 78*f875b4ebSrica 79*f875b4ebSricafor label in `lslabels -h "$clearance"`; do 80*f875b4ebSrica zonename=`/bin/grep $label: $ZONECFG | cut -d ":" -f1` 81*f875b4ebSrica if [ $zonename ]; then 82*f875b4ebSrica state=`zoneadm -z $zonename list -p 2>/dev/null | cut -d ":" -f3` 83*f875b4ebSrica if [ $state ]; then 84*f875b4ebSrica if [ $state != configured ]; then 85*f875b4ebSrica echo $zonename is already installed. 86*f875b4ebSrica continue 87*f875b4ebSrica fi 88*f875b4ebSrica fi 89*f875b4ebSrica else 90*f875b4ebSrica zonelabel=`hextoalabel $label` 91*f875b4ebSrica echo Enter zone name for $zonelabel 92*f875b4ebSrica echo or RETURN to skip this label: 93*f875b4ebSrica read zonename 94*f875b4ebSrica if [ $zonename ]; then 95*f875b4ebSrica nz=`/bin/grep "^$zonename:" $ZONECFG | cut -d ":" -f1` 96*f875b4ebSrica if [ $nz ]; then 97*f875b4ebSrica echo $zonename is already used for another label. 98*f875b4ebSrica else 99*f875b4ebSrica echo "$zonename:$label:0::" >> $ZONECFG 100*f875b4ebSrica fi 101*f875b4ebSrica else 102*f875b4ebSrica echo Skipping zone for $zonelabel 103*f875b4ebSrica continue 104*f875b4ebSrica fi 105*f875b4ebSrica fi 106*f875b4ebSrica clone 107*f875b4ebSricadone 108