17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5ee519a1fSgjelinek * Common Development and Distribution License (the "License"). 6ee519a1fSgjelinek * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217e362f58Scomay 227c478bd9Sstevel@tonic-gate /* 23865e09a4Sgjelinek * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 247c478bd9Sstevel@tonic-gate * Use is subject to license terms. 257c478bd9Sstevel@tonic-gate */ 267c478bd9Sstevel@tonic-gate 277c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 287c478bd9Sstevel@tonic-gate 297c478bd9Sstevel@tonic-gate /* 307c478bd9Sstevel@tonic-gate * zoneadm is a command interpreter for zone administration. It is all in 317c478bd9Sstevel@tonic-gate * C (i.e., no lex/yacc), and all the argument passing is argc/argv based. 327c478bd9Sstevel@tonic-gate * main() calls parse_and_run() which calls cmd_match(), then invokes the 337c478bd9Sstevel@tonic-gate * appropriate command's handler function. The rest of the program is the 347c478bd9Sstevel@tonic-gate * handler functions and their helper functions. 357c478bd9Sstevel@tonic-gate * 367c478bd9Sstevel@tonic-gate * Some of the helper functions are used largely to simplify I18N: reducing 377c478bd9Sstevel@tonic-gate * the need for translation notes. This is particularly true of many of 387c478bd9Sstevel@tonic-gate * the zerror() calls: doing e.g. zerror(gettext("%s failed"), "foo") rather 397c478bd9Sstevel@tonic-gate * than zerror(gettext("foo failed")) with a translation note indicating 407c478bd9Sstevel@tonic-gate * that "foo" need not be translated. 417c478bd9Sstevel@tonic-gate */ 427c478bd9Sstevel@tonic-gate 437c478bd9Sstevel@tonic-gate #include <stdio.h> 447c478bd9Sstevel@tonic-gate #include <errno.h> 457c478bd9Sstevel@tonic-gate #include <unistd.h> 467c478bd9Sstevel@tonic-gate #include <signal.h> 477c478bd9Sstevel@tonic-gate #include <stdarg.h> 487c478bd9Sstevel@tonic-gate #include <ctype.h> 497c478bd9Sstevel@tonic-gate #include <stdlib.h> 507c478bd9Sstevel@tonic-gate #include <string.h> 517c478bd9Sstevel@tonic-gate #include <wait.h> 527c478bd9Sstevel@tonic-gate #include <zone.h> 537c478bd9Sstevel@tonic-gate #include <priv.h> 547c478bd9Sstevel@tonic-gate #include <locale.h> 557c478bd9Sstevel@tonic-gate #include <libintl.h> 567c478bd9Sstevel@tonic-gate #include <libzonecfg.h> 577c478bd9Sstevel@tonic-gate #include <bsm/adt.h> 587c478bd9Sstevel@tonic-gate #include <sys/param.h> 597c478bd9Sstevel@tonic-gate #include <sys/types.h> 607c478bd9Sstevel@tonic-gate #include <sys/stat.h> 617c478bd9Sstevel@tonic-gate #include <sys/statvfs.h> 627c478bd9Sstevel@tonic-gate #include <assert.h> 637c478bd9Sstevel@tonic-gate #include <sys/sockio.h> 647c478bd9Sstevel@tonic-gate #include <sys/mntent.h> 657c478bd9Sstevel@tonic-gate #include <limits.h> 660b5de56dSgjelinek #include <dirent.h> 677c478bd9Sstevel@tonic-gate 687c478bd9Sstevel@tonic-gate #include <fcntl.h> 697c478bd9Sstevel@tonic-gate #include <door.h> 707c478bd9Sstevel@tonic-gate #include <macros.h> 717c478bd9Sstevel@tonic-gate #include <libgen.h> 72865e09a4Sgjelinek #include <fnmatch.h> 73*e7f3c547Sgjelinek #include <sys/modctl.h> 747c478bd9Sstevel@tonic-gate 757c478bd9Sstevel@tonic-gate #include <pool.h> 767c478bd9Sstevel@tonic-gate #include <sys/pool.h> 777c478bd9Sstevel@tonic-gate 780b5de56dSgjelinek #include "zoneadm.h" 790b5de56dSgjelinek 807c478bd9Sstevel@tonic-gate #define MAXARGS 8 817c478bd9Sstevel@tonic-gate 827c478bd9Sstevel@tonic-gate /* Reflects kernel zone entries */ 837c478bd9Sstevel@tonic-gate typedef struct zone_entry { 847c478bd9Sstevel@tonic-gate zoneid_t zid; 857c478bd9Sstevel@tonic-gate char zname[ZONENAME_MAX]; 867c478bd9Sstevel@tonic-gate char *zstate_str; 877c478bd9Sstevel@tonic-gate zone_state_t zstate_num; 887c478bd9Sstevel@tonic-gate char zroot[MAXPATHLEN]; 897c478bd9Sstevel@tonic-gate } zone_entry_t; 907c478bd9Sstevel@tonic-gate 917c478bd9Sstevel@tonic-gate static zone_entry_t *zents; 927c478bd9Sstevel@tonic-gate static size_t nzents; 937c478bd9Sstevel@tonic-gate 941390a385Sgjelinek #define LOOPBACK_IF "lo0" 951390a385Sgjelinek #define SOCKET_AF(af) (((af) == AF_UNSPEC) ? AF_INET : (af)) 961390a385Sgjelinek 971390a385Sgjelinek struct net_if { 981390a385Sgjelinek char *name; 991390a385Sgjelinek int af; 1001390a385Sgjelinek }; 1011390a385Sgjelinek 1027c478bd9Sstevel@tonic-gate /* 0755 is the default directory mode. */ 1037c478bd9Sstevel@tonic-gate #define DEFAULT_DIR_MODE \ 1047c478bd9Sstevel@tonic-gate (S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH) 1057c478bd9Sstevel@tonic-gate 1067c478bd9Sstevel@tonic-gate struct cmd { 1077c478bd9Sstevel@tonic-gate uint_t cmd_num; /* command number */ 1087c478bd9Sstevel@tonic-gate char *cmd_name; /* command name */ 1097c478bd9Sstevel@tonic-gate char *short_usage; /* short form help */ 1107c478bd9Sstevel@tonic-gate int (*handler)(int argc, char *argv[]); /* function to call */ 1117c478bd9Sstevel@tonic-gate 1127c478bd9Sstevel@tonic-gate }; 1137c478bd9Sstevel@tonic-gate 1147c478bd9Sstevel@tonic-gate #define SHELP_HELP "help" 1157c478bd9Sstevel@tonic-gate #define SHELP_BOOT "boot [-s]" 1167c478bd9Sstevel@tonic-gate #define SHELP_HALT "halt" 1177c478bd9Sstevel@tonic-gate #define SHELP_READY "ready" 1187c478bd9Sstevel@tonic-gate #define SHELP_REBOOT "reboot" 1197c478bd9Sstevel@tonic-gate #define SHELP_LIST "list [-cipv]" 1207c478bd9Sstevel@tonic-gate #define SHELP_VERIFY "verify" 1210b5de56dSgjelinek #define SHELP_INSTALL "install [-x nodataset]" 1227c478bd9Sstevel@tonic-gate #define SHELP_UNINSTALL "uninstall [-F]" 1230b5de56dSgjelinek #define SHELP_CLONE "clone [-m method] [-s <ZFS snapshot>] zonename" 124865e09a4Sgjelinek #define SHELP_MOVE "move zonepath" 125ee519a1fSgjelinek #define SHELP_DETACH "detach" 126ee519a1fSgjelinek #define SHELP_ATTACH "attach [-F]" 1277c478bd9Sstevel@tonic-gate 1287c478bd9Sstevel@tonic-gate static int help_func(int argc, char *argv[]); 1297c478bd9Sstevel@tonic-gate static int ready_func(int argc, char *argv[]); 1307c478bd9Sstevel@tonic-gate static int boot_func(int argc, char *argv[]); 1317c478bd9Sstevel@tonic-gate static int halt_func(int argc, char *argv[]); 1327c478bd9Sstevel@tonic-gate static int reboot_func(int argc, char *argv[]); 1337c478bd9Sstevel@tonic-gate static int list_func(int argc, char *argv[]); 1347c478bd9Sstevel@tonic-gate static int verify_func(int argc, char *argv[]); 1357c478bd9Sstevel@tonic-gate static int install_func(int argc, char *argv[]); 1367c478bd9Sstevel@tonic-gate static int uninstall_func(int argc, char *argv[]); 137108322fbScarlsonj static int mount_func(int argc, char *argv[]); 138108322fbScarlsonj static int unmount_func(int argc, char *argv[]); 139865e09a4Sgjelinek static int clone_func(int argc, char *argv[]); 140865e09a4Sgjelinek static int move_func(int argc, char *argv[]); 141ee519a1fSgjelinek static int detach_func(int argc, char *argv[]); 142ee519a1fSgjelinek static int attach_func(int argc, char *argv[]); 1437c478bd9Sstevel@tonic-gate static int sanity_check(char *zone, int cmd_num, boolean_t running, 1447c478bd9Sstevel@tonic-gate boolean_t unsafe_when_running); 1457c478bd9Sstevel@tonic-gate static int cmd_match(char *cmd); 1467c478bd9Sstevel@tonic-gate static int verify_details(int); 1477c478bd9Sstevel@tonic-gate 1487c478bd9Sstevel@tonic-gate static struct cmd cmdtab[] = { 1497c478bd9Sstevel@tonic-gate { CMD_HELP, "help", SHELP_HELP, help_func }, 1507c478bd9Sstevel@tonic-gate { CMD_BOOT, "boot", SHELP_BOOT, boot_func }, 1517c478bd9Sstevel@tonic-gate { CMD_HALT, "halt", SHELP_HALT, halt_func }, 1527c478bd9Sstevel@tonic-gate { CMD_READY, "ready", SHELP_READY, ready_func }, 1537c478bd9Sstevel@tonic-gate { CMD_REBOOT, "reboot", SHELP_REBOOT, reboot_func }, 1547c478bd9Sstevel@tonic-gate { CMD_LIST, "list", SHELP_LIST, list_func }, 1557c478bd9Sstevel@tonic-gate { CMD_VERIFY, "verify", SHELP_VERIFY, verify_func }, 1567c478bd9Sstevel@tonic-gate { CMD_INSTALL, "install", SHELP_INSTALL, install_func }, 1577c478bd9Sstevel@tonic-gate { CMD_UNINSTALL, "uninstall", SHELP_UNINSTALL, 158108322fbScarlsonj uninstall_func }, 159865e09a4Sgjelinek /* mount and unmount are private commands for admin/install */ 160108322fbScarlsonj { CMD_MOUNT, "mount", NULL, mount_func }, 161865e09a4Sgjelinek { CMD_UNMOUNT, "unmount", NULL, unmount_func }, 162865e09a4Sgjelinek { CMD_CLONE, "clone", SHELP_CLONE, clone_func }, 163ee519a1fSgjelinek { CMD_MOVE, "move", SHELP_MOVE, move_func }, 164ee519a1fSgjelinek { CMD_DETACH, "detach", SHELP_DETACH, detach_func }, 165ee519a1fSgjelinek { CMD_ATTACH, "attach", SHELP_ATTACH, attach_func } 1667c478bd9Sstevel@tonic-gate }; 1677c478bd9Sstevel@tonic-gate 1687c478bd9Sstevel@tonic-gate /* global variables */ 1697c478bd9Sstevel@tonic-gate 1707c478bd9Sstevel@tonic-gate /* set early in main(), never modified thereafter, used all over the place */ 1717c478bd9Sstevel@tonic-gate static char *execname; 1727c478bd9Sstevel@tonic-gate static char *locale; 1730b5de56dSgjelinek char *target_zone; 1747c478bd9Sstevel@tonic-gate 1757c478bd9Sstevel@tonic-gate /* used in do_subproc() and signal handler */ 1767c478bd9Sstevel@tonic-gate static volatile boolean_t child_killed; 1777c478bd9Sstevel@tonic-gate 1780b5de56dSgjelinek char * 1797c478bd9Sstevel@tonic-gate cmd_to_str(int cmd_num) 1807c478bd9Sstevel@tonic-gate { 1817c478bd9Sstevel@tonic-gate assert(cmd_num >= CMD_MIN && cmd_num <= CMD_MAX); 1827c478bd9Sstevel@tonic-gate return (cmdtab[cmd_num].cmd_name); 1837c478bd9Sstevel@tonic-gate } 1847c478bd9Sstevel@tonic-gate 1857c478bd9Sstevel@tonic-gate /* This is a separate function because of gettext() wrapping. */ 1867c478bd9Sstevel@tonic-gate static char * 1877c478bd9Sstevel@tonic-gate long_help(int cmd_num) 1887c478bd9Sstevel@tonic-gate { 1897e362f58Scomay assert(cmd_num >= CMD_MIN && cmd_num <= CMD_MAX); 1907c478bd9Sstevel@tonic-gate switch (cmd_num) { 1917c478bd9Sstevel@tonic-gate case CMD_HELP: 1927c478bd9Sstevel@tonic-gate return (gettext("Print usage message.")); 1937c478bd9Sstevel@tonic-gate case CMD_BOOT: 1947c478bd9Sstevel@tonic-gate return (gettext("Activates (boots) specified zone. " 1957c478bd9Sstevel@tonic-gate "The -s flag can be used\n\tto boot the zone in " 1967c478bd9Sstevel@tonic-gate "the single-user state.")); 1977c478bd9Sstevel@tonic-gate case CMD_HALT: 1989e518655Sgjelinek return (gettext("Halts specified zone, bypassing shutdown " 1999e518655Sgjelinek "scripts and removing runtime\n\tresources of the zone.")); 2007c478bd9Sstevel@tonic-gate case CMD_READY: 2019e518655Sgjelinek return (gettext("Prepares a zone for running applications but " 2029e518655Sgjelinek "does not start any user\n\tprocesses in the zone.")); 2037c478bd9Sstevel@tonic-gate case CMD_REBOOT: 2049e518655Sgjelinek return (gettext("Restarts the zone (equivalent to a halt / " 2059e518655Sgjelinek "boot sequence).\n\tFails if the zone is not active.")); 2067c478bd9Sstevel@tonic-gate case CMD_LIST: 2077c478bd9Sstevel@tonic-gate return (gettext("Lists the current zones, or a " 2087c478bd9Sstevel@tonic-gate "specific zone if indicated. By default,\n\tall " 2097c478bd9Sstevel@tonic-gate "running zones are listed, though this can be " 2107c478bd9Sstevel@tonic-gate "expanded to all\n\tinstalled zones with the -i " 2117c478bd9Sstevel@tonic-gate "option or all configured zones with the\n\t-c " 2127c478bd9Sstevel@tonic-gate "option. When used with the general -z <zone> " 2137c478bd9Sstevel@tonic-gate "option, lists only the\n\tspecified zone, but " 2147c478bd9Sstevel@tonic-gate "lists it regardless of its state, and the -i " 2157c478bd9Sstevel@tonic-gate "and -c\n\toptions are disallowed. The -v option " 2167c478bd9Sstevel@tonic-gate "can be used to display verbose\n\tinformation: " 2177c478bd9Sstevel@tonic-gate "zone name, id, current state, root directory and " 2187c478bd9Sstevel@tonic-gate "options.\n\tThe -p option can be used to request " 2197c478bd9Sstevel@tonic-gate "machine-parsable output. The -v\n\tand -p " 2207c478bd9Sstevel@tonic-gate "options are mutually exclusive. If neither -v " 2219e518655Sgjelinek "nor -p is used,\n\tjust the zone name is listed.")); 2227c478bd9Sstevel@tonic-gate case CMD_VERIFY: 2237c478bd9Sstevel@tonic-gate return (gettext("Check to make sure the configuration " 2247c478bd9Sstevel@tonic-gate "can safely be instantiated\n\ton the machine: " 2257c478bd9Sstevel@tonic-gate "physical network interfaces exist, etc.")); 2267c478bd9Sstevel@tonic-gate case CMD_INSTALL: 2270b5de56dSgjelinek return (gettext("Install the configuration on to the system. " 2280b5de56dSgjelinek "The -x nodataset option\n\tcan be used to prevent the " 2290b5de56dSgjelinek "creation of a new ZFS file system for the\n\tzone " 2300b5de56dSgjelinek "(assuming the zonepath is within a ZFS file system).")); 2317c478bd9Sstevel@tonic-gate case CMD_UNINSTALL: 2329e518655Sgjelinek return (gettext("Uninstall the configuration from the system. " 2339e518655Sgjelinek "The -F flag can be used\n\tto force the action.")); 234865e09a4Sgjelinek case CMD_CLONE: 2350b5de56dSgjelinek return (gettext("Clone the installation of another zone. " 2360b5de56dSgjelinek "The -m option can be used to\n\tspecify 'copy' which " 2370b5de56dSgjelinek "forces a copy of the source zone. The -s option\n\t" 2380b5de56dSgjelinek "can be used to specify the name of a ZFS snapshot " 2390b5de56dSgjelinek "that was taken from\n\ta previous clone command. The " 2400b5de56dSgjelinek "snapshot will be used as the source\n\tinstead of " 2410b5de56dSgjelinek "creating a new ZFS snapshot.")); 242865e09a4Sgjelinek case CMD_MOVE: 243865e09a4Sgjelinek return (gettext("Move the zone to a new zonepath.")); 2449e518655Sgjelinek case CMD_DETACH: 2459e518655Sgjelinek return (gettext("Detach the zone from the system. The zone " 2469e518655Sgjelinek "state is changed to\n\t'configured' (but the files under " 2479e518655Sgjelinek "the zonepath are untouched).\n\tThe zone can subsequently " 2489e518655Sgjelinek "be attached, or can be moved to another\n\tsystem and " 2499e518655Sgjelinek "attached there.")); 2509e518655Sgjelinek case CMD_ATTACH: 2519e518655Sgjelinek return (gettext("Attach the zone to the system. The zone " 2529e518655Sgjelinek "state must be 'configured'\n\tprior to attach; upon " 2539e518655Sgjelinek "successful completion, the zone state will be\n\t" 2549e518655Sgjelinek "'installed'. The system software on the current " 2559e518655Sgjelinek "system must be\n\tcompatible with the software on the " 2569e518655Sgjelinek "zone's original system.\n\tSpecify -F to force the attach " 2579e518655Sgjelinek "and skip software compatibility tests.")); 258108322fbScarlsonj default: 259108322fbScarlsonj return (""); 2607c478bd9Sstevel@tonic-gate } 2617c478bd9Sstevel@tonic-gate /* NOTREACHED */ 2627e362f58Scomay return (NULL); 2637c478bd9Sstevel@tonic-gate } 2647c478bd9Sstevel@tonic-gate 2657c478bd9Sstevel@tonic-gate /* 2667c478bd9Sstevel@tonic-gate * Called with explicit B_TRUE when help is explicitly requested, B_FALSE for 2677c478bd9Sstevel@tonic-gate * unexpected errors. 2687c478bd9Sstevel@tonic-gate */ 2697c478bd9Sstevel@tonic-gate 2707c478bd9Sstevel@tonic-gate static int 2717c478bd9Sstevel@tonic-gate usage(boolean_t explicit) 2727c478bd9Sstevel@tonic-gate { 2737c478bd9Sstevel@tonic-gate int i; 2747c478bd9Sstevel@tonic-gate FILE *fd = explicit ? stdout : stderr; 2757c478bd9Sstevel@tonic-gate 2767c478bd9Sstevel@tonic-gate (void) fprintf(fd, "%s:\t%s help\n", gettext("usage"), execname); 2777c478bd9Sstevel@tonic-gate (void) fprintf(fd, "\t%s [-z <zone>] list\n", execname); 2787c478bd9Sstevel@tonic-gate (void) fprintf(fd, "\t%s -z <zone> <%s>\n", execname, 2797c478bd9Sstevel@tonic-gate gettext("subcommand")); 2807c478bd9Sstevel@tonic-gate (void) fprintf(fd, "\n%s:\n\n", gettext("Subcommands")); 2817c478bd9Sstevel@tonic-gate for (i = CMD_MIN; i <= CMD_MAX; i++) { 282108322fbScarlsonj if (cmdtab[i].short_usage == NULL) 283108322fbScarlsonj continue; 2847c478bd9Sstevel@tonic-gate (void) fprintf(fd, "%s\n", cmdtab[i].short_usage); 2857c478bd9Sstevel@tonic-gate if (explicit) 2867c478bd9Sstevel@tonic-gate (void) fprintf(fd, "\t%s\n\n", long_help(i)); 2877c478bd9Sstevel@tonic-gate } 2887c478bd9Sstevel@tonic-gate if (!explicit) 2897c478bd9Sstevel@tonic-gate (void) fputs("\n", fd); 2907c478bd9Sstevel@tonic-gate return (Z_USAGE); 2917c478bd9Sstevel@tonic-gate } 2927c478bd9Sstevel@tonic-gate 2937c478bd9Sstevel@tonic-gate static void 2947c478bd9Sstevel@tonic-gate sub_usage(char *short_usage, int cmd_num) 2957c478bd9Sstevel@tonic-gate { 2967c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "%s:\t%s\n", gettext("usage"), short_usage); 2977c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "\t%s\n", long_help(cmd_num)); 2987c478bd9Sstevel@tonic-gate } 2997c478bd9Sstevel@tonic-gate 3007c478bd9Sstevel@tonic-gate /* 3017c478bd9Sstevel@tonic-gate * zperror() is like perror(3c) except that this also prints the executable 3027c478bd9Sstevel@tonic-gate * name at the start of the message, and takes a boolean indicating whether 3037c478bd9Sstevel@tonic-gate * to call libc'c strerror() or that from libzonecfg. 3047c478bd9Sstevel@tonic-gate */ 3057c478bd9Sstevel@tonic-gate 3060b5de56dSgjelinek void 3077c478bd9Sstevel@tonic-gate zperror(const char *str, boolean_t zonecfg_error) 3087c478bd9Sstevel@tonic-gate { 3097c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "%s: %s: %s\n", execname, str, 3107c478bd9Sstevel@tonic-gate zonecfg_error ? zonecfg_strerror(errno) : strerror(errno)); 3117c478bd9Sstevel@tonic-gate } 3127c478bd9Sstevel@tonic-gate 3137c478bd9Sstevel@tonic-gate /* 3147c478bd9Sstevel@tonic-gate * zperror2() is very similar to zperror() above, except it also prints a 3157c478bd9Sstevel@tonic-gate * supplied zone name after the executable. 3167c478bd9Sstevel@tonic-gate * 3177c478bd9Sstevel@tonic-gate * All current consumers of this function want libzonecfg's strerror() rather 3187c478bd9Sstevel@tonic-gate * than libc's; if this ever changes, this function can be made more generic 3197c478bd9Sstevel@tonic-gate * like zperror() above. 3207c478bd9Sstevel@tonic-gate */ 3217c478bd9Sstevel@tonic-gate 3220b5de56dSgjelinek void 3237c478bd9Sstevel@tonic-gate zperror2(const char *zone, const char *str) 3247c478bd9Sstevel@tonic-gate { 3257c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "%s: %s: %s: %s\n", execname, zone, str, 3267c478bd9Sstevel@tonic-gate zonecfg_strerror(errno)); 3277c478bd9Sstevel@tonic-gate } 3287c478bd9Sstevel@tonic-gate 3297c478bd9Sstevel@tonic-gate /* PRINTFLIKE1 */ 3300b5de56dSgjelinek void 3317c478bd9Sstevel@tonic-gate zerror(const char *fmt, ...) 3327c478bd9Sstevel@tonic-gate { 3337c478bd9Sstevel@tonic-gate va_list alist; 3347c478bd9Sstevel@tonic-gate 3357c478bd9Sstevel@tonic-gate va_start(alist, fmt); 3367c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "%s: ", execname); 3377c478bd9Sstevel@tonic-gate if (target_zone != NULL) 3387c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "zone '%s': ", target_zone); 3397c478bd9Sstevel@tonic-gate (void) vfprintf(stderr, fmt, alist); 3407c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "\n"); 3417c478bd9Sstevel@tonic-gate va_end(alist); 3427c478bd9Sstevel@tonic-gate } 3437c478bd9Sstevel@tonic-gate 3447c478bd9Sstevel@tonic-gate static void * 3457c478bd9Sstevel@tonic-gate safe_calloc(size_t nelem, size_t elsize) 3467c478bd9Sstevel@tonic-gate { 3477c478bd9Sstevel@tonic-gate void *r = calloc(nelem, elsize); 3487c478bd9Sstevel@tonic-gate 3497c478bd9Sstevel@tonic-gate if (r == NULL) { 3507c478bd9Sstevel@tonic-gate zerror(gettext("failed to allocate %lu bytes: %s"), 3517c478bd9Sstevel@tonic-gate (ulong_t)nelem * elsize, strerror(errno)); 3527c478bd9Sstevel@tonic-gate exit(Z_ERR); 3537c478bd9Sstevel@tonic-gate } 3547c478bd9Sstevel@tonic-gate return (r); 3557c478bd9Sstevel@tonic-gate } 3567c478bd9Sstevel@tonic-gate 3577c478bd9Sstevel@tonic-gate static void 3587c478bd9Sstevel@tonic-gate zone_print(zone_entry_t *zent, boolean_t verbose, boolean_t parsable) 3597c478bd9Sstevel@tonic-gate { 3607c478bd9Sstevel@tonic-gate static boolean_t firsttime = B_TRUE; 3617c478bd9Sstevel@tonic-gate 3627c478bd9Sstevel@tonic-gate assert(!(verbose && parsable)); 3637c478bd9Sstevel@tonic-gate if (firsttime && verbose) { 3647c478bd9Sstevel@tonic-gate firsttime = B_FALSE; 3657c478bd9Sstevel@tonic-gate (void) printf("%*s %-16s %-14s %-30s\n", ZONEID_WIDTH, "ID", 3667c478bd9Sstevel@tonic-gate "NAME", "STATUS", "PATH"); 3677c478bd9Sstevel@tonic-gate } 3687c478bd9Sstevel@tonic-gate if (!verbose) { 3697c478bd9Sstevel@tonic-gate if (!parsable) { 3707c478bd9Sstevel@tonic-gate (void) printf("%s\n", zent->zname); 3717c478bd9Sstevel@tonic-gate return; 3727c478bd9Sstevel@tonic-gate } 3737c478bd9Sstevel@tonic-gate if (zent->zid == ZONE_ID_UNDEFINED) 3747c478bd9Sstevel@tonic-gate (void) printf("-"); 3757c478bd9Sstevel@tonic-gate else 3767c478bd9Sstevel@tonic-gate (void) printf("%lu", zent->zid); 3777c478bd9Sstevel@tonic-gate (void) printf(":%s:%s:%s\n", zent->zname, zent->zstate_str, 3787c478bd9Sstevel@tonic-gate zent->zroot); 3797c478bd9Sstevel@tonic-gate return; 3807c478bd9Sstevel@tonic-gate } 3817c478bd9Sstevel@tonic-gate if (zent->zstate_str != NULL) { 3827c478bd9Sstevel@tonic-gate if (zent->zid == ZONE_ID_UNDEFINED) 3837c478bd9Sstevel@tonic-gate (void) printf("%*s", ZONEID_WIDTH, "-"); 3847c478bd9Sstevel@tonic-gate else 3857c478bd9Sstevel@tonic-gate (void) printf("%*lu", ZONEID_WIDTH, zent->zid); 3867c478bd9Sstevel@tonic-gate (void) printf(" %-16s %-14s %-30s\n", zent->zname, 3877c478bd9Sstevel@tonic-gate zent->zstate_str, zent->zroot); 3887c478bd9Sstevel@tonic-gate } 3897c478bd9Sstevel@tonic-gate } 3907c478bd9Sstevel@tonic-gate 3917c478bd9Sstevel@tonic-gate static int 392108322fbScarlsonj lookup_zone_info(const char *zone_name, zoneid_t zid, zone_entry_t *zent) 3937c478bd9Sstevel@tonic-gate { 39445916cd2Sjpk char root[MAXPATHLEN], *cp; 3957c478bd9Sstevel@tonic-gate int err; 3967c478bd9Sstevel@tonic-gate 3977c478bd9Sstevel@tonic-gate (void) strlcpy(zent->zname, zone_name, sizeof (zent->zname)); 3987c478bd9Sstevel@tonic-gate (void) strlcpy(zent->zroot, "???", sizeof (zent->zroot)); 3997c478bd9Sstevel@tonic-gate zent->zstate_str = "???"; 4007c478bd9Sstevel@tonic-gate 401108322fbScarlsonj zent->zid = zid; 4027c478bd9Sstevel@tonic-gate 40345916cd2Sjpk /* 40445916cd2Sjpk * For labeled zones which query the zone path of lower-level 40545916cd2Sjpk * zones, the path needs to be adjusted to drop the final 40645916cd2Sjpk * "/root" component. This adjusted path is then useful 40745916cd2Sjpk * for reading down any exported directories from the 40845916cd2Sjpk * lower-level zone. 40945916cd2Sjpk */ 41045916cd2Sjpk if (is_system_labeled() && zent->zid != ZONE_ID_UNDEFINED) { 41145916cd2Sjpk if (zone_getattr(zent->zid, ZONE_ATTR_ROOT, zent->zroot, 41245916cd2Sjpk sizeof (zent->zroot)) == -1) { 41345916cd2Sjpk zperror2(zent->zname, 41445916cd2Sjpk gettext("could not get zone path.")); 41545916cd2Sjpk return (Z_ERR); 41645916cd2Sjpk } 41745916cd2Sjpk cp = zent->zroot + strlen(zent->zroot) - 5; 41845916cd2Sjpk if (cp > zent->zroot && strcmp(cp, "/root") == 0) 41945916cd2Sjpk *cp = 0; 42045916cd2Sjpk } else { 42145916cd2Sjpk if ((err = zone_get_zonepath(zent->zname, root, 42245916cd2Sjpk sizeof (root))) != Z_OK) { 4237c478bd9Sstevel@tonic-gate errno = err; 42445916cd2Sjpk zperror2(zent->zname, 42545916cd2Sjpk gettext("could not get zone path.")); 4267c478bd9Sstevel@tonic-gate return (Z_ERR); 4277c478bd9Sstevel@tonic-gate } 4287c478bd9Sstevel@tonic-gate (void) strlcpy(zent->zroot, root, sizeof (zent->zroot)); 42945916cd2Sjpk } 4307c478bd9Sstevel@tonic-gate 4317c478bd9Sstevel@tonic-gate if ((err = zone_get_state(zent->zname, &zent->zstate_num)) != Z_OK) { 4327c478bd9Sstevel@tonic-gate errno = err; 4337c478bd9Sstevel@tonic-gate zperror2(zent->zname, gettext("could not get state")); 4347c478bd9Sstevel@tonic-gate return (Z_ERR); 4357c478bd9Sstevel@tonic-gate } 4367c478bd9Sstevel@tonic-gate zent->zstate_str = zone_state_str(zent->zstate_num); 4377c478bd9Sstevel@tonic-gate 4387c478bd9Sstevel@tonic-gate return (Z_OK); 4397c478bd9Sstevel@tonic-gate } 4407c478bd9Sstevel@tonic-gate 4417c478bd9Sstevel@tonic-gate /* 4427c478bd9Sstevel@tonic-gate * fetch_zents() calls zone_list(2) to find out how many zones are running 4437c478bd9Sstevel@tonic-gate * (which is stored in the global nzents), then calls zone_list(2) again 4447c478bd9Sstevel@tonic-gate * to fetch the list of running zones (stored in the global zents). This 4457c478bd9Sstevel@tonic-gate * function may be called multiple times, so if zents is already set, we 4467c478bd9Sstevel@tonic-gate * return immediately to save work. 4477c478bd9Sstevel@tonic-gate */ 4487c478bd9Sstevel@tonic-gate 4497c478bd9Sstevel@tonic-gate static int 450108322fbScarlsonj fetch_zents(void) 4517c478bd9Sstevel@tonic-gate { 4527c478bd9Sstevel@tonic-gate zoneid_t *zids = NULL; 4537c478bd9Sstevel@tonic-gate uint_t nzents_saved; 454108322fbScarlsonj int i, retv; 455108322fbScarlsonj FILE *fp; 456108322fbScarlsonj boolean_t inaltroot; 457108322fbScarlsonj zone_entry_t *zentp; 4587c478bd9Sstevel@tonic-gate 4597c478bd9Sstevel@tonic-gate if (nzents > 0) 4607c478bd9Sstevel@tonic-gate return (Z_OK); 4617c478bd9Sstevel@tonic-gate 4627c478bd9Sstevel@tonic-gate if (zone_list(NULL, &nzents) != 0) { 4637c478bd9Sstevel@tonic-gate zperror(gettext("failed to get zoneid list"), B_FALSE); 4647c478bd9Sstevel@tonic-gate return (Z_ERR); 4657c478bd9Sstevel@tonic-gate } 4667c478bd9Sstevel@tonic-gate 4677c478bd9Sstevel@tonic-gate again: 4687c478bd9Sstevel@tonic-gate if (nzents == 0) 4697c478bd9Sstevel@tonic-gate return (Z_OK); 4707c478bd9Sstevel@tonic-gate 4717c478bd9Sstevel@tonic-gate zids = safe_calloc(nzents, sizeof (zoneid_t)); 4727c478bd9Sstevel@tonic-gate nzents_saved = nzents; 4737c478bd9Sstevel@tonic-gate 4747c478bd9Sstevel@tonic-gate if (zone_list(zids, &nzents) != 0) { 4757c478bd9Sstevel@tonic-gate zperror(gettext("failed to get zone list"), B_FALSE); 4767c478bd9Sstevel@tonic-gate free(zids); 4777c478bd9Sstevel@tonic-gate return (Z_ERR); 4787c478bd9Sstevel@tonic-gate } 4797c478bd9Sstevel@tonic-gate if (nzents != nzents_saved) { 4807c478bd9Sstevel@tonic-gate /* list changed, try again */ 4817c478bd9Sstevel@tonic-gate free(zids); 4827c478bd9Sstevel@tonic-gate goto again; 4837c478bd9Sstevel@tonic-gate } 4847c478bd9Sstevel@tonic-gate 4857c478bd9Sstevel@tonic-gate zents = safe_calloc(nzents, sizeof (zone_entry_t)); 4867c478bd9Sstevel@tonic-gate 487108322fbScarlsonj inaltroot = zonecfg_in_alt_root(); 488108322fbScarlsonj if (inaltroot) 489108322fbScarlsonj fp = zonecfg_open_scratch("", B_FALSE); 490108322fbScarlsonj else 491108322fbScarlsonj fp = NULL; 492108322fbScarlsonj zentp = zents; 493108322fbScarlsonj retv = Z_OK; 4947c478bd9Sstevel@tonic-gate for (i = 0; i < nzents; i++) { 4957c478bd9Sstevel@tonic-gate char name[ZONENAME_MAX]; 496108322fbScarlsonj char altname[ZONENAME_MAX]; 4977c478bd9Sstevel@tonic-gate 498108322fbScarlsonj if (getzonenamebyid(zids[i], name, sizeof (name)) < 0) { 4997c478bd9Sstevel@tonic-gate zperror(gettext("failed to get zone name"), B_FALSE); 500108322fbScarlsonj retv = Z_ERR; 501108322fbScarlsonj continue; 5027c478bd9Sstevel@tonic-gate } 503108322fbScarlsonj if (zonecfg_is_scratch(name)) { 504108322fbScarlsonj /* Ignore scratch zones by default */ 505108322fbScarlsonj if (!inaltroot) 506108322fbScarlsonj continue; 507108322fbScarlsonj if (fp == NULL || 508108322fbScarlsonj zonecfg_reverse_scratch(fp, name, altname, 509108322fbScarlsonj sizeof (altname), NULL, 0) == -1) { 5105ee84fbdSgjelinek zerror(gettext("could not resolve scratch " 511108322fbScarlsonj "zone %s"), name); 512108322fbScarlsonj retv = Z_ERR; 513108322fbScarlsonj continue; 514108322fbScarlsonj } 515108322fbScarlsonj (void) strcpy(name, altname); 516108322fbScarlsonj } else { 517108322fbScarlsonj /* Ignore non-scratch when in an alternate root */ 518108322fbScarlsonj if (inaltroot && strcmp(name, GLOBAL_ZONENAME) != 0) 519108322fbScarlsonj continue; 520108322fbScarlsonj } 521108322fbScarlsonj if (lookup_zone_info(name, zids[i], zentp) != Z_OK) { 522108322fbScarlsonj zerror(gettext("failed to get zone data")); 523108322fbScarlsonj retv = Z_ERR; 524108322fbScarlsonj continue; 525108322fbScarlsonj } 526108322fbScarlsonj zentp++; 527108322fbScarlsonj } 528108322fbScarlsonj nzents = zentp - zents; 529108322fbScarlsonj if (fp != NULL) 530108322fbScarlsonj zonecfg_close_scratch(fp); 5317c478bd9Sstevel@tonic-gate 5327c478bd9Sstevel@tonic-gate free(zids); 533108322fbScarlsonj return (retv); 5347c478bd9Sstevel@tonic-gate } 5357c478bd9Sstevel@tonic-gate 536108322fbScarlsonj static int 5377c478bd9Sstevel@tonic-gate zone_print_list(zone_state_t min_state, boolean_t verbose, boolean_t parsable) 5387c478bd9Sstevel@tonic-gate { 5397c478bd9Sstevel@tonic-gate int i; 5407c478bd9Sstevel@tonic-gate zone_entry_t zent; 5417c478bd9Sstevel@tonic-gate FILE *cookie; 5427c478bd9Sstevel@tonic-gate char *name; 5437c478bd9Sstevel@tonic-gate 5447c478bd9Sstevel@tonic-gate /* 5457c478bd9Sstevel@tonic-gate * First get the list of running zones from the kernel and print them. 5467c478bd9Sstevel@tonic-gate * If that is all we need, then return. 5477c478bd9Sstevel@tonic-gate */ 548108322fbScarlsonj if ((i = fetch_zents()) != Z_OK) { 5497c478bd9Sstevel@tonic-gate /* 5507c478bd9Sstevel@tonic-gate * No need for error messages; fetch_zents() has already taken 5517c478bd9Sstevel@tonic-gate * care of this. 5527c478bd9Sstevel@tonic-gate */ 553108322fbScarlsonj return (i); 5547c478bd9Sstevel@tonic-gate } 555108322fbScarlsonj for (i = 0; i < nzents; i++) 5567c478bd9Sstevel@tonic-gate zone_print(&zents[i], verbose, parsable); 5577c478bd9Sstevel@tonic-gate if (min_state >= ZONE_STATE_RUNNING) 558108322fbScarlsonj return (Z_OK); 5597c478bd9Sstevel@tonic-gate /* 5607c478bd9Sstevel@tonic-gate * Next, get the full list of zones from the configuration, skipping 5617c478bd9Sstevel@tonic-gate * any we have already printed. 5627c478bd9Sstevel@tonic-gate */ 5637c478bd9Sstevel@tonic-gate cookie = setzoneent(); 5647c478bd9Sstevel@tonic-gate while ((name = getzoneent(cookie)) != NULL) { 5657c478bd9Sstevel@tonic-gate for (i = 0; i < nzents; i++) { 5667c478bd9Sstevel@tonic-gate if (strcmp(zents[i].zname, name) == 0) 5677c478bd9Sstevel@tonic-gate break; 5687c478bd9Sstevel@tonic-gate } 5697c478bd9Sstevel@tonic-gate if (i < nzents) { 5707c478bd9Sstevel@tonic-gate free(name); 5717c478bd9Sstevel@tonic-gate continue; 5727c478bd9Sstevel@tonic-gate } 573108322fbScarlsonj if (lookup_zone_info(name, ZONE_ID_UNDEFINED, &zent) != Z_OK) { 5747c478bd9Sstevel@tonic-gate free(name); 5757c478bd9Sstevel@tonic-gate continue; 5767c478bd9Sstevel@tonic-gate } 5777c478bd9Sstevel@tonic-gate free(name); 5787c478bd9Sstevel@tonic-gate if (zent.zstate_num >= min_state) 5797c478bd9Sstevel@tonic-gate zone_print(&zent, verbose, parsable); 5807c478bd9Sstevel@tonic-gate } 5817c478bd9Sstevel@tonic-gate endzoneent(cookie); 582108322fbScarlsonj return (Z_OK); 5837c478bd9Sstevel@tonic-gate } 5847c478bd9Sstevel@tonic-gate 5857c478bd9Sstevel@tonic-gate static zone_entry_t * 5867c478bd9Sstevel@tonic-gate lookup_running_zone(char *str) 5877c478bd9Sstevel@tonic-gate { 5887c478bd9Sstevel@tonic-gate zoneid_t zoneid; 5897c478bd9Sstevel@tonic-gate char *cp; 5907c478bd9Sstevel@tonic-gate int i; 5917c478bd9Sstevel@tonic-gate 5927c478bd9Sstevel@tonic-gate if (fetch_zents() != Z_OK) 5937c478bd9Sstevel@tonic-gate return (NULL); 5947c478bd9Sstevel@tonic-gate 5957c478bd9Sstevel@tonic-gate for (i = 0; i < nzents; i++) { 5967c478bd9Sstevel@tonic-gate if (strcmp(str, zents[i].zname) == 0) 5977c478bd9Sstevel@tonic-gate return (&zents[i]); 5987c478bd9Sstevel@tonic-gate } 5997c478bd9Sstevel@tonic-gate errno = 0; 6007c478bd9Sstevel@tonic-gate zoneid = strtol(str, &cp, 0); 6017c478bd9Sstevel@tonic-gate if (zoneid < MIN_ZONEID || zoneid > MAX_ZONEID || 6027c478bd9Sstevel@tonic-gate errno != 0 || *cp != '\0') 6037c478bd9Sstevel@tonic-gate return (NULL); 6047c478bd9Sstevel@tonic-gate for (i = 0; i < nzents; i++) { 6057c478bd9Sstevel@tonic-gate if (zoneid == zents[i].zid) 6067c478bd9Sstevel@tonic-gate return (&zents[i]); 6077c478bd9Sstevel@tonic-gate } 6087c478bd9Sstevel@tonic-gate return (NULL); 6097c478bd9Sstevel@tonic-gate } 6107c478bd9Sstevel@tonic-gate 6117c478bd9Sstevel@tonic-gate /* 6127c478bd9Sstevel@tonic-gate * Check a bit in a mode_t: if on is B_TRUE, that bit should be on; if 6137c478bd9Sstevel@tonic-gate * B_FALSE, it should be off. Return B_TRUE if the mode is bad (incorrect). 6147c478bd9Sstevel@tonic-gate */ 6157c478bd9Sstevel@tonic-gate static boolean_t 6167c478bd9Sstevel@tonic-gate bad_mode_bit(mode_t mode, mode_t bit, boolean_t on, char *file) 6177c478bd9Sstevel@tonic-gate { 6187c478bd9Sstevel@tonic-gate char *str; 6197c478bd9Sstevel@tonic-gate 6207c478bd9Sstevel@tonic-gate assert(bit == S_IRUSR || bit == S_IWUSR || bit == S_IXUSR || 6217c478bd9Sstevel@tonic-gate bit == S_IRGRP || bit == S_IWGRP || bit == S_IXGRP || 6227c478bd9Sstevel@tonic-gate bit == S_IROTH || bit == S_IWOTH || bit == S_IXOTH); 6237c478bd9Sstevel@tonic-gate /* 6247c478bd9Sstevel@tonic-gate * TRANSLATION_NOTE 6257c478bd9Sstevel@tonic-gate * The strings below will be used as part of a larger message, 6267c478bd9Sstevel@tonic-gate * either: 6277c478bd9Sstevel@tonic-gate * (file name) must be (owner|group|world) (read|writ|execut)able 6287c478bd9Sstevel@tonic-gate * or 6297c478bd9Sstevel@tonic-gate * (file name) must not be (owner|group|world) (read|writ|execut)able 6307c478bd9Sstevel@tonic-gate */ 6317c478bd9Sstevel@tonic-gate switch (bit) { 6327c478bd9Sstevel@tonic-gate case S_IRUSR: 6337c478bd9Sstevel@tonic-gate str = gettext("owner readable"); 6347c478bd9Sstevel@tonic-gate break; 6357c478bd9Sstevel@tonic-gate case S_IWUSR: 6367c478bd9Sstevel@tonic-gate str = gettext("owner writable"); 6377c478bd9Sstevel@tonic-gate break; 6387c478bd9Sstevel@tonic-gate case S_IXUSR: 6397c478bd9Sstevel@tonic-gate str = gettext("owner executable"); 6407c478bd9Sstevel@tonic-gate break; 6417c478bd9Sstevel@tonic-gate case S_IRGRP: 6427c478bd9Sstevel@tonic-gate str = gettext("group readable"); 6437c478bd9Sstevel@tonic-gate break; 6447c478bd9Sstevel@tonic-gate case S_IWGRP: 6457c478bd9Sstevel@tonic-gate str = gettext("group writable"); 6467c478bd9Sstevel@tonic-gate break; 6477c478bd9Sstevel@tonic-gate case S_IXGRP: 6487c478bd9Sstevel@tonic-gate str = gettext("group executable"); 6497c478bd9Sstevel@tonic-gate break; 6507c478bd9Sstevel@tonic-gate case S_IROTH: 6517c478bd9Sstevel@tonic-gate str = gettext("world readable"); 6527c478bd9Sstevel@tonic-gate break; 6537c478bd9Sstevel@tonic-gate case S_IWOTH: 6547c478bd9Sstevel@tonic-gate str = gettext("world writable"); 6557c478bd9Sstevel@tonic-gate break; 6567c478bd9Sstevel@tonic-gate case S_IXOTH: 6577c478bd9Sstevel@tonic-gate str = gettext("world executable"); 6587c478bd9Sstevel@tonic-gate break; 6597c478bd9Sstevel@tonic-gate } 6607c478bd9Sstevel@tonic-gate if ((mode & bit) == (on ? 0 : bit)) { 6617c478bd9Sstevel@tonic-gate /* 6627c478bd9Sstevel@tonic-gate * TRANSLATION_NOTE 6637c478bd9Sstevel@tonic-gate * The first parameter below is a file name; the second 6647c478bd9Sstevel@tonic-gate * is one of the "(owner|group|world) (read|writ|execut)able" 6657c478bd9Sstevel@tonic-gate * strings from above. 6667c478bd9Sstevel@tonic-gate */ 6677c478bd9Sstevel@tonic-gate /* 6687c478bd9Sstevel@tonic-gate * The code below could be simplified but not in a way 6697c478bd9Sstevel@tonic-gate * that would easily translate to non-English locales. 6707c478bd9Sstevel@tonic-gate */ 6717c478bd9Sstevel@tonic-gate if (on) { 6727c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s must be %s.\n"), 6737c478bd9Sstevel@tonic-gate file, str); 6747c478bd9Sstevel@tonic-gate } else { 6757c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s must not be %s.\n"), 6767c478bd9Sstevel@tonic-gate file, str); 6777c478bd9Sstevel@tonic-gate } 6787c478bd9Sstevel@tonic-gate return (B_TRUE); 6797c478bd9Sstevel@tonic-gate } 6807c478bd9Sstevel@tonic-gate return (B_FALSE); 6817c478bd9Sstevel@tonic-gate } 6827c478bd9Sstevel@tonic-gate 6837c478bd9Sstevel@tonic-gate /* 6847c478bd9Sstevel@tonic-gate * We want to make sure that no zone has its zone path as a child node 6857c478bd9Sstevel@tonic-gate * (in the directory sense) of any other. We do that by comparing this 6867c478bd9Sstevel@tonic-gate * zone's path to the path of all other (non-global) zones. The comparison 6877c478bd9Sstevel@tonic-gate * in each case is simple: add '/' to the end of the path, then do a 6887c478bd9Sstevel@tonic-gate * strncmp() of the two paths, using the length of the shorter one. 6897c478bd9Sstevel@tonic-gate */ 6907c478bd9Sstevel@tonic-gate 6917c478bd9Sstevel@tonic-gate static int 6927c478bd9Sstevel@tonic-gate crosscheck_zonepaths(char *path) 6937c478bd9Sstevel@tonic-gate { 6947c478bd9Sstevel@tonic-gate char rpath[MAXPATHLEN]; /* resolved path */ 6957c478bd9Sstevel@tonic-gate char path_copy[MAXPATHLEN]; /* copy of original path */ 6967c478bd9Sstevel@tonic-gate char rpath_copy[MAXPATHLEN]; /* copy of original rpath */ 6977c478bd9Sstevel@tonic-gate struct zoneent *ze; 6987c478bd9Sstevel@tonic-gate int res, err; 6997c478bd9Sstevel@tonic-gate FILE *cookie; 7007c478bd9Sstevel@tonic-gate 7017c478bd9Sstevel@tonic-gate cookie = setzoneent(); 7027c478bd9Sstevel@tonic-gate while ((ze = getzoneent_private(cookie)) != NULL) { 7037c478bd9Sstevel@tonic-gate /* Skip zones which are not installed. */ 7047c478bd9Sstevel@tonic-gate if (ze->zone_state < ZONE_STATE_INSTALLED) { 7057c478bd9Sstevel@tonic-gate free(ze); 7067c478bd9Sstevel@tonic-gate continue; 7077c478bd9Sstevel@tonic-gate } 7087c478bd9Sstevel@tonic-gate /* Skip the global zone and the current target zone. */ 7097c478bd9Sstevel@tonic-gate if (strcmp(ze->zone_name, GLOBAL_ZONENAME) == 0 || 7107c478bd9Sstevel@tonic-gate strcmp(ze->zone_name, target_zone) == 0) { 7117c478bd9Sstevel@tonic-gate free(ze); 7127c478bd9Sstevel@tonic-gate continue; 7137c478bd9Sstevel@tonic-gate } 7147c478bd9Sstevel@tonic-gate if (strlen(ze->zone_path) == 0) { 7157c478bd9Sstevel@tonic-gate /* old index file without path, fall back */ 7167c478bd9Sstevel@tonic-gate if ((err = zone_get_zonepath(ze->zone_name, 7177c478bd9Sstevel@tonic-gate ze->zone_path, sizeof (ze->zone_path))) != Z_OK) { 7187c478bd9Sstevel@tonic-gate errno = err; 7197c478bd9Sstevel@tonic-gate zperror2(ze->zone_name, 7207c478bd9Sstevel@tonic-gate gettext("could not get zone path")); 7217c478bd9Sstevel@tonic-gate free(ze); 7227c478bd9Sstevel@tonic-gate continue; 7237c478bd9Sstevel@tonic-gate } 7247c478bd9Sstevel@tonic-gate } 725108322fbScarlsonj (void) snprintf(path_copy, sizeof (path_copy), "%s%s", 726108322fbScarlsonj zonecfg_get_root(), ze->zone_path); 727108322fbScarlsonj res = resolvepath(path_copy, rpath, sizeof (rpath)); 7287c478bd9Sstevel@tonic-gate if (res == -1) { 7297c478bd9Sstevel@tonic-gate if (errno != ENOENT) { 730108322fbScarlsonj zperror(path_copy, B_FALSE); 7317c478bd9Sstevel@tonic-gate free(ze); 7327c478bd9Sstevel@tonic-gate return (Z_ERR); 7337c478bd9Sstevel@tonic-gate } 7347c478bd9Sstevel@tonic-gate (void) printf(gettext("WARNING: zone %s is installed, " 7357c478bd9Sstevel@tonic-gate "but its %s %s does not exist.\n"), ze->zone_name, 736108322fbScarlsonj "zonepath", path_copy); 7377c478bd9Sstevel@tonic-gate free(ze); 7387c478bd9Sstevel@tonic-gate continue; 7397c478bd9Sstevel@tonic-gate } 7407c478bd9Sstevel@tonic-gate rpath[res] = '\0'; 7417c478bd9Sstevel@tonic-gate (void) snprintf(path_copy, sizeof (path_copy), "%s/", path); 7427c478bd9Sstevel@tonic-gate (void) snprintf(rpath_copy, sizeof (rpath_copy), "%s/", rpath); 7437c478bd9Sstevel@tonic-gate if (strncmp(path_copy, rpath_copy, 7447c478bd9Sstevel@tonic-gate min(strlen(path_copy), strlen(rpath_copy))) == 0) { 7455ee84fbdSgjelinek /* 7465ee84fbdSgjelinek * TRANSLATION_NOTE 7475ee84fbdSgjelinek * zonepath is a literal that should not be translated. 7485ee84fbdSgjelinek */ 7497c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s zonepath (%s) and " 7507c478bd9Sstevel@tonic-gate "%s zonepath (%s) overlap.\n"), 7517c478bd9Sstevel@tonic-gate target_zone, path, ze->zone_name, rpath); 7527c478bd9Sstevel@tonic-gate free(ze); 7537c478bd9Sstevel@tonic-gate return (Z_ERR); 7547c478bd9Sstevel@tonic-gate } 7557c478bd9Sstevel@tonic-gate free(ze); 7567c478bd9Sstevel@tonic-gate } 7577c478bd9Sstevel@tonic-gate endzoneent(cookie); 7587c478bd9Sstevel@tonic-gate return (Z_OK); 7597c478bd9Sstevel@tonic-gate } 7607c478bd9Sstevel@tonic-gate 7617c478bd9Sstevel@tonic-gate static int 7627c478bd9Sstevel@tonic-gate validate_zonepath(char *path, int cmd_num) 7637c478bd9Sstevel@tonic-gate { 7647c478bd9Sstevel@tonic-gate int res; /* result of last library/system call */ 7657c478bd9Sstevel@tonic-gate boolean_t err = B_FALSE; /* have we run into an error? */ 7667c478bd9Sstevel@tonic-gate struct stat stbuf; 7677c478bd9Sstevel@tonic-gate struct statvfs vfsbuf; 7687c478bd9Sstevel@tonic-gate char rpath[MAXPATHLEN]; /* resolved path */ 7697c478bd9Sstevel@tonic-gate char ppath[MAXPATHLEN]; /* parent path */ 7707c478bd9Sstevel@tonic-gate char rppath[MAXPATHLEN]; /* resolved parent path */ 7717c478bd9Sstevel@tonic-gate char rootpath[MAXPATHLEN]; /* root path */ 7727c478bd9Sstevel@tonic-gate zone_state_t state; 7737c478bd9Sstevel@tonic-gate 7747c478bd9Sstevel@tonic-gate if (path[0] != '/') { 7757c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 7767c478bd9Sstevel@tonic-gate gettext("%s is not an absolute path.\n"), path); 7777c478bd9Sstevel@tonic-gate return (Z_ERR); 7787c478bd9Sstevel@tonic-gate } 7797c478bd9Sstevel@tonic-gate if ((res = resolvepath(path, rpath, sizeof (rpath))) == -1) { 7807c478bd9Sstevel@tonic-gate if ((errno != ENOENT) || 781865e09a4Sgjelinek (cmd_num != CMD_VERIFY && cmd_num != CMD_INSTALL && 782865e09a4Sgjelinek cmd_num != CMD_CLONE && cmd_num != CMD_MOVE)) { 7837c478bd9Sstevel@tonic-gate zperror(path, B_FALSE); 7847c478bd9Sstevel@tonic-gate return (Z_ERR); 7857c478bd9Sstevel@tonic-gate } 7867c478bd9Sstevel@tonic-gate if (cmd_num == CMD_VERIFY) { 7875ee84fbdSgjelinek /* 7885ee84fbdSgjelinek * TRANSLATION_NOTE 7895ee84fbdSgjelinek * zoneadm is a literal that should not be translated. 7905ee84fbdSgjelinek */ 7917c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("WARNING: %s does not " 7925ee84fbdSgjelinek "exist, so it could not be verified.\nWhen " 7935ee84fbdSgjelinek "'zoneadm %s' is run, '%s' will try to create\n%s, " 7945ee84fbdSgjelinek "and '%s' will be tried again,\nbut the '%s' may " 7955ee84fbdSgjelinek "fail if:\nthe parent directory of %s is group- or " 7965ee84fbdSgjelinek "other-writable\nor\n%s overlaps with any other " 7977c478bd9Sstevel@tonic-gate "installed zones.\n"), path, 7987c478bd9Sstevel@tonic-gate cmd_to_str(CMD_INSTALL), cmd_to_str(CMD_INSTALL), 7997c478bd9Sstevel@tonic-gate path, cmd_to_str(CMD_VERIFY), 8007c478bd9Sstevel@tonic-gate cmd_to_str(CMD_VERIFY), path, path); 8017c478bd9Sstevel@tonic-gate return (Z_OK); 8027c478bd9Sstevel@tonic-gate } 8037c478bd9Sstevel@tonic-gate /* 8047c478bd9Sstevel@tonic-gate * The zonepath is supposed to be mode 700 but its 8057c478bd9Sstevel@tonic-gate * parent(s) 755. So use 755 on the mkdirp() then 8067c478bd9Sstevel@tonic-gate * chmod() the zonepath itself to 700. 8077c478bd9Sstevel@tonic-gate */ 8087c478bd9Sstevel@tonic-gate if (mkdirp(path, DEFAULT_DIR_MODE) < 0) { 8097c478bd9Sstevel@tonic-gate zperror(path, B_FALSE); 8107c478bd9Sstevel@tonic-gate return (Z_ERR); 8117c478bd9Sstevel@tonic-gate } 8127c478bd9Sstevel@tonic-gate /* 8137c478bd9Sstevel@tonic-gate * If the chmod() fails, report the error, but might 8147c478bd9Sstevel@tonic-gate * as well continue the verify procedure. 8157c478bd9Sstevel@tonic-gate */ 8167c478bd9Sstevel@tonic-gate if (chmod(path, S_IRWXU) != 0) 8177c478bd9Sstevel@tonic-gate zperror(path, B_FALSE); 8187c478bd9Sstevel@tonic-gate /* 8197c478bd9Sstevel@tonic-gate * Since the mkdir() succeeded, we should not have to 8207c478bd9Sstevel@tonic-gate * worry about a subsequent ENOENT, thus this should 8217c478bd9Sstevel@tonic-gate * only recurse once. 8227c478bd9Sstevel@tonic-gate */ 823865e09a4Sgjelinek return (validate_zonepath(path, cmd_num)); 8247c478bd9Sstevel@tonic-gate } 8257c478bd9Sstevel@tonic-gate rpath[res] = '\0'; 8267c478bd9Sstevel@tonic-gate if (strcmp(path, rpath) != 0) { 8277c478bd9Sstevel@tonic-gate errno = Z_RESOLVED_PATH; 8287c478bd9Sstevel@tonic-gate zperror(path, B_TRUE); 8297c478bd9Sstevel@tonic-gate return (Z_ERR); 8307c478bd9Sstevel@tonic-gate } 8317c478bd9Sstevel@tonic-gate if ((res = stat(rpath, &stbuf)) != 0) { 8327c478bd9Sstevel@tonic-gate zperror(rpath, B_FALSE); 8337c478bd9Sstevel@tonic-gate return (Z_ERR); 8347c478bd9Sstevel@tonic-gate } 8357c478bd9Sstevel@tonic-gate if (!S_ISDIR(stbuf.st_mode)) { 8367c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s is not a directory.\n"), 8377c478bd9Sstevel@tonic-gate rpath); 8387c478bd9Sstevel@tonic-gate return (Z_ERR); 8397c478bd9Sstevel@tonic-gate } 8407c478bd9Sstevel@tonic-gate if ((strcmp(stbuf.st_fstype, MNTTYPE_TMPFS) == 0) || 8417c478bd9Sstevel@tonic-gate (strcmp(stbuf.st_fstype, MNTTYPE_XMEMFS) == 0)) { 8427c478bd9Sstevel@tonic-gate (void) printf(gettext("WARNING: %s is on a temporary " 8430b5de56dSgjelinek "file system.\n"), rpath); 8447c478bd9Sstevel@tonic-gate } 8457c478bd9Sstevel@tonic-gate if (crosscheck_zonepaths(rpath) != Z_OK) 8467c478bd9Sstevel@tonic-gate return (Z_ERR); 8477c478bd9Sstevel@tonic-gate /* 8487c478bd9Sstevel@tonic-gate * Try to collect and report as many minor errors as possible 8497c478bd9Sstevel@tonic-gate * before returning, so the user can learn everything that needs 8507c478bd9Sstevel@tonic-gate * to be fixed up front. 8517c478bd9Sstevel@tonic-gate */ 8527c478bd9Sstevel@tonic-gate if (stbuf.st_uid != 0) { 8537c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s is not owned by root.\n"), 8547c478bd9Sstevel@tonic-gate rpath); 8557c478bd9Sstevel@tonic-gate err = B_TRUE; 8567c478bd9Sstevel@tonic-gate } 8577c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IRUSR, B_TRUE, rpath); 8587c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IWUSR, B_TRUE, rpath); 8597c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IXUSR, B_TRUE, rpath); 8607c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IRGRP, B_FALSE, rpath); 8617c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IWGRP, B_FALSE, rpath); 8627c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IXGRP, B_FALSE, rpath); 8637c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IROTH, B_FALSE, rpath); 8647c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IWOTH, B_FALSE, rpath); 8657c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IXOTH, B_FALSE, rpath); 8667c478bd9Sstevel@tonic-gate 8677c478bd9Sstevel@tonic-gate (void) snprintf(ppath, sizeof (ppath), "%s/..", path); 8687c478bd9Sstevel@tonic-gate if ((res = resolvepath(ppath, rppath, sizeof (rppath))) == -1) { 8697c478bd9Sstevel@tonic-gate zperror(ppath, B_FALSE); 8707c478bd9Sstevel@tonic-gate return (Z_ERR); 8717c478bd9Sstevel@tonic-gate } 8727c478bd9Sstevel@tonic-gate rppath[res] = '\0'; 8737c478bd9Sstevel@tonic-gate if ((res = stat(rppath, &stbuf)) != 0) { 8747c478bd9Sstevel@tonic-gate zperror(rppath, B_FALSE); 8757c478bd9Sstevel@tonic-gate return (Z_ERR); 8767c478bd9Sstevel@tonic-gate } 8777c478bd9Sstevel@tonic-gate /* theoretically impossible */ 8787c478bd9Sstevel@tonic-gate if (!S_ISDIR(stbuf.st_mode)) { 8797c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s is not a directory.\n"), 8807c478bd9Sstevel@tonic-gate rppath); 8817c478bd9Sstevel@tonic-gate return (Z_ERR); 8827c478bd9Sstevel@tonic-gate } 8837c478bd9Sstevel@tonic-gate if (stbuf.st_uid != 0) { 8847c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s is not owned by root.\n"), 8857c478bd9Sstevel@tonic-gate rppath); 8867c478bd9Sstevel@tonic-gate err = B_TRUE; 8877c478bd9Sstevel@tonic-gate } 8887c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IRUSR, B_TRUE, rppath); 8897c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IWUSR, B_TRUE, rppath); 8907c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IXUSR, B_TRUE, rppath); 8917c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IWGRP, B_FALSE, rppath); 8927c478bd9Sstevel@tonic-gate err |= bad_mode_bit(stbuf.st_mode, S_IWOTH, B_FALSE, rppath); 8937c478bd9Sstevel@tonic-gate if (strcmp(rpath, rppath) == 0) { 8947c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s is its own parent.\n"), 8957c478bd9Sstevel@tonic-gate rppath); 8967c478bd9Sstevel@tonic-gate err = B_TRUE; 8977c478bd9Sstevel@tonic-gate } 8987c478bd9Sstevel@tonic-gate 8997c478bd9Sstevel@tonic-gate if (statvfs(rpath, &vfsbuf) != 0) { 9007c478bd9Sstevel@tonic-gate zperror(rpath, B_FALSE); 9017c478bd9Sstevel@tonic-gate return (Z_ERR); 9027c478bd9Sstevel@tonic-gate } 903b5abaf04Sgjelinek if (strcmp(vfsbuf.f_basetype, MNTTYPE_NFS) == 0) { 9045ee84fbdSgjelinek /* 9055ee84fbdSgjelinek * TRANSLATION_NOTE 9065ee84fbdSgjelinek * Zonepath and NFS are literals that should not be translated. 9075ee84fbdSgjelinek */ 9085ee84fbdSgjelinek (void) fprintf(stderr, gettext("Zonepath %s is on an NFS " 9090b5de56dSgjelinek "mounted file system.\n" 9100b5de56dSgjelinek "\tA local file system must be used.\n"), rpath); 911b5abaf04Sgjelinek return (Z_ERR); 912b5abaf04Sgjelinek } 913b5abaf04Sgjelinek if (vfsbuf.f_flag & ST_NOSUID) { 9145ee84fbdSgjelinek /* 9155ee84fbdSgjelinek * TRANSLATION_NOTE 9165ee84fbdSgjelinek * Zonepath and nosuid are literals that should not be 9175ee84fbdSgjelinek * translated. 9185ee84fbdSgjelinek */ 919b5abaf04Sgjelinek (void) fprintf(stderr, gettext("Zonepath %s is on a nosuid " 9200b5de56dSgjelinek "file system.\n"), rpath); 9217c478bd9Sstevel@tonic-gate return (Z_ERR); 9227c478bd9Sstevel@tonic-gate } 9237c478bd9Sstevel@tonic-gate 9247c478bd9Sstevel@tonic-gate if ((res = zone_get_state(target_zone, &state)) != Z_OK) { 9257c478bd9Sstevel@tonic-gate errno = res; 9267c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not get state")); 9277c478bd9Sstevel@tonic-gate return (Z_ERR); 9287c478bd9Sstevel@tonic-gate } 9297c478bd9Sstevel@tonic-gate /* 9307c478bd9Sstevel@tonic-gate * The existence of the root path is only bad in the configured state, 9317c478bd9Sstevel@tonic-gate * as it is *supposed* to be there at the installed and later states. 932ee519a1fSgjelinek * However, the root path is expected to be there if the zone is 933ee519a1fSgjelinek * detached. 9347c478bd9Sstevel@tonic-gate * State/command mismatches are caught earlier in verify_details(). 9357c478bd9Sstevel@tonic-gate */ 936ee519a1fSgjelinek if (state == ZONE_STATE_CONFIGURED && cmd_num != CMD_ATTACH) { 9377c478bd9Sstevel@tonic-gate if (snprintf(rootpath, sizeof (rootpath), "%s/root", rpath) >= 9387c478bd9Sstevel@tonic-gate sizeof (rootpath)) { 9395ee84fbdSgjelinek /* 9405ee84fbdSgjelinek * TRANSLATION_NOTE 9415ee84fbdSgjelinek * Zonepath is a literal that should not be translated. 9425ee84fbdSgjelinek */ 9437c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 9447c478bd9Sstevel@tonic-gate gettext("Zonepath %s is too long.\n"), rpath); 9457c478bd9Sstevel@tonic-gate return (Z_ERR); 9467c478bd9Sstevel@tonic-gate } 9477c478bd9Sstevel@tonic-gate if ((res = stat(rootpath, &stbuf)) == 0) { 948ee519a1fSgjelinek if (zonecfg_detached(rpath)) 949ee519a1fSgjelinek (void) fprintf(stderr, 950ee519a1fSgjelinek gettext("Cannot %s detached " 951ee519a1fSgjelinek "zone.\nUse attach or remove %s " 952ee519a1fSgjelinek "directory.\n"), cmd_to_str(cmd_num), 953ee519a1fSgjelinek rpath); 954ee519a1fSgjelinek else 955ee519a1fSgjelinek (void) fprintf(stderr, 956ee519a1fSgjelinek gettext("Rootpath %s exists; " 957ee519a1fSgjelinek "remove or move aside prior to %s.\n"), 958ee519a1fSgjelinek rootpath, cmd_to_str(cmd_num)); 9597c478bd9Sstevel@tonic-gate return (Z_ERR); 9607c478bd9Sstevel@tonic-gate } 9617c478bd9Sstevel@tonic-gate } 9627c478bd9Sstevel@tonic-gate 9637c478bd9Sstevel@tonic-gate return (err ? Z_ERR : Z_OK); 9647c478bd9Sstevel@tonic-gate } 9657c478bd9Sstevel@tonic-gate 9667c478bd9Sstevel@tonic-gate static void 9677c478bd9Sstevel@tonic-gate release_lock_file(int lockfd) 9687c478bd9Sstevel@tonic-gate { 9697c478bd9Sstevel@tonic-gate (void) close(lockfd); 9707c478bd9Sstevel@tonic-gate } 9717c478bd9Sstevel@tonic-gate 9727c478bd9Sstevel@tonic-gate static int 9737c478bd9Sstevel@tonic-gate grab_lock_file(const char *zone_name, int *lockfd) 9747c478bd9Sstevel@tonic-gate { 9757c478bd9Sstevel@tonic-gate char pathbuf[PATH_MAX]; 9767c478bd9Sstevel@tonic-gate struct flock flock; 9777c478bd9Sstevel@tonic-gate 978108322fbScarlsonj if (snprintf(pathbuf, sizeof (pathbuf), "%s%s", zonecfg_get_root(), 979108322fbScarlsonj ZONES_TMPDIR) >= sizeof (pathbuf)) { 980108322fbScarlsonj zerror(gettext("alternate root path is too long")); 981108322fbScarlsonj return (Z_ERR); 982108322fbScarlsonj } 983108322fbScarlsonj if (mkdir(pathbuf, S_IRWXU) < 0 && errno != EEXIST) { 984108322fbScarlsonj zerror(gettext("could not mkdir %s: %s"), pathbuf, 9857c478bd9Sstevel@tonic-gate strerror(errno)); 9867c478bd9Sstevel@tonic-gate return (Z_ERR); 9877c478bd9Sstevel@tonic-gate } 988108322fbScarlsonj (void) chmod(pathbuf, S_IRWXU); 9897c478bd9Sstevel@tonic-gate 9907c478bd9Sstevel@tonic-gate /* 9917c478bd9Sstevel@tonic-gate * One of these lock files is created for each zone (when needed). 9927c478bd9Sstevel@tonic-gate * The lock files are not cleaned up (except on system reboot), 9937c478bd9Sstevel@tonic-gate * but since there is only one per zone, there is no resource 9947c478bd9Sstevel@tonic-gate * starvation issue. 9957c478bd9Sstevel@tonic-gate */ 996108322fbScarlsonj if (snprintf(pathbuf, sizeof (pathbuf), "%s%s/%s.zoneadm.lock", 997108322fbScarlsonj zonecfg_get_root(), ZONES_TMPDIR, zone_name) >= sizeof (pathbuf)) { 998108322fbScarlsonj zerror(gettext("alternate root path is too long")); 999108322fbScarlsonj return (Z_ERR); 1000108322fbScarlsonj } 10017c478bd9Sstevel@tonic-gate if ((*lockfd = open(pathbuf, O_RDWR|O_CREAT, S_IRUSR|S_IWUSR)) < 0) { 10027c478bd9Sstevel@tonic-gate zerror(gettext("could not open %s: %s"), pathbuf, 10037c478bd9Sstevel@tonic-gate strerror(errno)); 10047c478bd9Sstevel@tonic-gate return (Z_ERR); 10057c478bd9Sstevel@tonic-gate } 10067c478bd9Sstevel@tonic-gate /* 10077c478bd9Sstevel@tonic-gate * Lock the file to synchronize with other zoneadmds 10087c478bd9Sstevel@tonic-gate */ 10097c478bd9Sstevel@tonic-gate flock.l_type = F_WRLCK; 10107c478bd9Sstevel@tonic-gate flock.l_whence = SEEK_SET; 10117c478bd9Sstevel@tonic-gate flock.l_start = (off_t)0; 10127c478bd9Sstevel@tonic-gate flock.l_len = (off_t)0; 10137c478bd9Sstevel@tonic-gate if (fcntl(*lockfd, F_SETLKW, &flock) < 0) { 10147c478bd9Sstevel@tonic-gate zerror(gettext("unable to lock %s: %s"), pathbuf, 10157c478bd9Sstevel@tonic-gate strerror(errno)); 10167c478bd9Sstevel@tonic-gate release_lock_file(*lockfd); 10177c478bd9Sstevel@tonic-gate return (Z_ERR); 10187c478bd9Sstevel@tonic-gate } 10197c478bd9Sstevel@tonic-gate return (Z_OK); 10207c478bd9Sstevel@tonic-gate } 10217c478bd9Sstevel@tonic-gate 1022108322fbScarlsonj static boolean_t 10237c478bd9Sstevel@tonic-gate get_doorname(const char *zone_name, char *buffer) 10247c478bd9Sstevel@tonic-gate { 1025108322fbScarlsonj return (snprintf(buffer, PATH_MAX, "%s" ZONE_DOOR_PATH, 1026108322fbScarlsonj zonecfg_get_root(), zone_name) < PATH_MAX); 10277c478bd9Sstevel@tonic-gate } 10287c478bd9Sstevel@tonic-gate 10297c478bd9Sstevel@tonic-gate /* 10307c478bd9Sstevel@tonic-gate * system daemons are not audited. For the global zone, this occurs 10317c478bd9Sstevel@tonic-gate * "naturally" since init is started with the default audit 10327c478bd9Sstevel@tonic-gate * characteristics. Since zoneadmd is a system daemon and it starts 10337c478bd9Sstevel@tonic-gate * init for a zone, it is necessary to clear out the audit 10347c478bd9Sstevel@tonic-gate * characteristics inherited from whomever started zoneadmd. This is 10357c478bd9Sstevel@tonic-gate * indicated by the audit id, which is set from the ruid parameter of 10367c478bd9Sstevel@tonic-gate * adt_set_user(), below. 10377c478bd9Sstevel@tonic-gate */ 10387c478bd9Sstevel@tonic-gate 10397c478bd9Sstevel@tonic-gate static void 10407c478bd9Sstevel@tonic-gate prepare_audit_context() 10417c478bd9Sstevel@tonic-gate { 10427c478bd9Sstevel@tonic-gate adt_session_data_t *ah; 10437c478bd9Sstevel@tonic-gate char *failure = gettext("audit failure: %s"); 10447c478bd9Sstevel@tonic-gate 10457c478bd9Sstevel@tonic-gate if (adt_start_session(&ah, NULL, 0)) { 10467c478bd9Sstevel@tonic-gate zerror(failure, strerror(errno)); 10477c478bd9Sstevel@tonic-gate return; 10487c478bd9Sstevel@tonic-gate } 10497c478bd9Sstevel@tonic-gate if (adt_set_user(ah, ADT_NO_AUDIT, ADT_NO_AUDIT, 10507c478bd9Sstevel@tonic-gate ADT_NO_AUDIT, ADT_NO_AUDIT, NULL, ADT_NEW)) { 10517c478bd9Sstevel@tonic-gate zerror(failure, strerror(errno)); 10527c478bd9Sstevel@tonic-gate (void) adt_end_session(ah); 10537c478bd9Sstevel@tonic-gate return; 10547c478bd9Sstevel@tonic-gate } 10557c478bd9Sstevel@tonic-gate if (adt_set_proc(ah)) 10567c478bd9Sstevel@tonic-gate zerror(failure, strerror(errno)); 10577c478bd9Sstevel@tonic-gate 10587c478bd9Sstevel@tonic-gate (void) adt_end_session(ah); 10597c478bd9Sstevel@tonic-gate } 10607c478bd9Sstevel@tonic-gate 10617c478bd9Sstevel@tonic-gate static int 10627c478bd9Sstevel@tonic-gate start_zoneadmd(const char *zone_name) 10637c478bd9Sstevel@tonic-gate { 10647c478bd9Sstevel@tonic-gate char doorpath[PATH_MAX]; 10657c478bd9Sstevel@tonic-gate pid_t child_pid; 10667c478bd9Sstevel@tonic-gate int error = Z_ERR; 10677c478bd9Sstevel@tonic-gate int doorfd, lockfd; 10687c478bd9Sstevel@tonic-gate struct door_info info; 10697c478bd9Sstevel@tonic-gate 1070108322fbScarlsonj if (!get_doorname(zone_name, doorpath)) 1071108322fbScarlsonj return (Z_ERR); 10727c478bd9Sstevel@tonic-gate 10737c478bd9Sstevel@tonic-gate if (grab_lock_file(zone_name, &lockfd) != Z_OK) 10747c478bd9Sstevel@tonic-gate return (Z_ERR); 10757c478bd9Sstevel@tonic-gate 10767c478bd9Sstevel@tonic-gate /* 10777c478bd9Sstevel@tonic-gate * Now that we have the lock, re-confirm that the daemon is 10787c478bd9Sstevel@tonic-gate * *not* up and working fine. If it is still down, we have a green 10797c478bd9Sstevel@tonic-gate * light to start it. 10807c478bd9Sstevel@tonic-gate */ 10817c478bd9Sstevel@tonic-gate if ((doorfd = open(doorpath, O_RDONLY)) < 0) { 10827c478bd9Sstevel@tonic-gate if (errno != ENOENT) { 10837c478bd9Sstevel@tonic-gate zperror(doorpath, B_FALSE); 10847c478bd9Sstevel@tonic-gate goto out; 10857c478bd9Sstevel@tonic-gate } 10867c478bd9Sstevel@tonic-gate } else { 10877c478bd9Sstevel@tonic-gate if (door_info(doorfd, &info) == 0 && 10887c478bd9Sstevel@tonic-gate ((info.di_attributes & DOOR_REVOKED) == 0)) { 10897c478bd9Sstevel@tonic-gate error = Z_OK; 10907c478bd9Sstevel@tonic-gate (void) close(doorfd); 10917c478bd9Sstevel@tonic-gate goto out; 10927c478bd9Sstevel@tonic-gate } 10937c478bd9Sstevel@tonic-gate (void) close(doorfd); 10947c478bd9Sstevel@tonic-gate } 10957c478bd9Sstevel@tonic-gate 10967c478bd9Sstevel@tonic-gate if ((child_pid = fork()) == -1) { 10977c478bd9Sstevel@tonic-gate zperror(gettext("could not fork"), B_FALSE); 10987c478bd9Sstevel@tonic-gate goto out; 10997c478bd9Sstevel@tonic-gate } else if (child_pid == 0) { 1100108322fbScarlsonj const char *argv[6], **ap; 11017c478bd9Sstevel@tonic-gate 1102108322fbScarlsonj /* child process */ 11037c478bd9Sstevel@tonic-gate prepare_audit_context(); 11047c478bd9Sstevel@tonic-gate 1105108322fbScarlsonj ap = argv; 1106108322fbScarlsonj *ap++ = "zoneadmd"; 1107108322fbScarlsonj *ap++ = "-z"; 1108108322fbScarlsonj *ap++ = zone_name; 1109108322fbScarlsonj if (zonecfg_in_alt_root()) { 1110108322fbScarlsonj *ap++ = "-R"; 1111108322fbScarlsonj *ap++ = zonecfg_get_root(); 1112108322fbScarlsonj } 1113108322fbScarlsonj *ap = NULL; 1114108322fbScarlsonj 1115108322fbScarlsonj (void) execv("/usr/lib/zones/zoneadmd", (char * const *)argv); 11165ee84fbdSgjelinek /* 11175ee84fbdSgjelinek * TRANSLATION_NOTE 11185ee84fbdSgjelinek * zoneadmd is a literal that should not be translated. 11195ee84fbdSgjelinek */ 11207c478bd9Sstevel@tonic-gate zperror(gettext("could not exec zoneadmd"), B_FALSE); 11217c478bd9Sstevel@tonic-gate _exit(Z_ERR); 11227c478bd9Sstevel@tonic-gate } else { 11237c478bd9Sstevel@tonic-gate /* parent process */ 11247c478bd9Sstevel@tonic-gate pid_t retval; 11257c478bd9Sstevel@tonic-gate int pstatus = 0; 11267c478bd9Sstevel@tonic-gate 11277c478bd9Sstevel@tonic-gate do { 11287c478bd9Sstevel@tonic-gate retval = waitpid(child_pid, &pstatus, 0); 11297c478bd9Sstevel@tonic-gate } while (retval != child_pid); 11307c478bd9Sstevel@tonic-gate if (WIFSIGNALED(pstatus) || (WIFEXITED(pstatus) && 11317c478bd9Sstevel@tonic-gate WEXITSTATUS(pstatus) != 0)) { 11327c478bd9Sstevel@tonic-gate zerror(gettext("could not start %s"), "zoneadmd"); 11337c478bd9Sstevel@tonic-gate goto out; 11347c478bd9Sstevel@tonic-gate } 11357c478bd9Sstevel@tonic-gate } 11367c478bd9Sstevel@tonic-gate error = Z_OK; 11377c478bd9Sstevel@tonic-gate out: 11387c478bd9Sstevel@tonic-gate release_lock_file(lockfd); 11397c478bd9Sstevel@tonic-gate return (error); 11407c478bd9Sstevel@tonic-gate } 11417c478bd9Sstevel@tonic-gate 11427c478bd9Sstevel@tonic-gate static int 11437c478bd9Sstevel@tonic-gate ping_zoneadmd(const char *zone_name) 11447c478bd9Sstevel@tonic-gate { 11457c478bd9Sstevel@tonic-gate char doorpath[PATH_MAX]; 11467c478bd9Sstevel@tonic-gate int doorfd; 11477c478bd9Sstevel@tonic-gate struct door_info info; 11487c478bd9Sstevel@tonic-gate 1149108322fbScarlsonj if (!get_doorname(zone_name, doorpath)) 1150108322fbScarlsonj return (Z_ERR); 11517c478bd9Sstevel@tonic-gate 11527c478bd9Sstevel@tonic-gate if ((doorfd = open(doorpath, O_RDONLY)) < 0) { 11537c478bd9Sstevel@tonic-gate return (Z_ERR); 11547c478bd9Sstevel@tonic-gate } 11557c478bd9Sstevel@tonic-gate if (door_info(doorfd, &info) == 0 && 11567c478bd9Sstevel@tonic-gate ((info.di_attributes & DOOR_REVOKED) == 0)) { 11577c478bd9Sstevel@tonic-gate (void) close(doorfd); 11587c478bd9Sstevel@tonic-gate return (Z_OK); 11597c478bd9Sstevel@tonic-gate } 11607c478bd9Sstevel@tonic-gate (void) close(doorfd); 11617c478bd9Sstevel@tonic-gate return (Z_ERR); 11627c478bd9Sstevel@tonic-gate } 11637c478bd9Sstevel@tonic-gate 11647c478bd9Sstevel@tonic-gate static int 11657c478bd9Sstevel@tonic-gate call_zoneadmd(const char *zone_name, zone_cmd_arg_t *arg) 11667c478bd9Sstevel@tonic-gate { 11677c478bd9Sstevel@tonic-gate char doorpath[PATH_MAX]; 11687c478bd9Sstevel@tonic-gate int doorfd, result; 11697c478bd9Sstevel@tonic-gate door_arg_t darg; 11707c478bd9Sstevel@tonic-gate 11717c478bd9Sstevel@tonic-gate zoneid_t zoneid; 11727c478bd9Sstevel@tonic-gate uint64_t uniqid = 0; 11737c478bd9Sstevel@tonic-gate 11747c478bd9Sstevel@tonic-gate zone_cmd_rval_t *rvalp; 11757c478bd9Sstevel@tonic-gate size_t rlen; 11767c478bd9Sstevel@tonic-gate char *cp, *errbuf; 11777c478bd9Sstevel@tonic-gate 11787c478bd9Sstevel@tonic-gate rlen = getpagesize(); 11797c478bd9Sstevel@tonic-gate if ((rvalp = malloc(rlen)) == NULL) { 11807c478bd9Sstevel@tonic-gate zerror(gettext("failed to allocate %lu bytes: %s"), rlen, 11817c478bd9Sstevel@tonic-gate strerror(errno)); 11827c478bd9Sstevel@tonic-gate return (-1); 11837c478bd9Sstevel@tonic-gate } 11847c478bd9Sstevel@tonic-gate 11857c478bd9Sstevel@tonic-gate if ((zoneid = getzoneidbyname(zone_name)) != ZONE_ID_UNDEFINED) { 11867c478bd9Sstevel@tonic-gate (void) zone_getattr(zoneid, ZONE_ATTR_UNIQID, &uniqid, 11877c478bd9Sstevel@tonic-gate sizeof (uniqid)); 11887c478bd9Sstevel@tonic-gate } 11897c478bd9Sstevel@tonic-gate arg->uniqid = uniqid; 11907c478bd9Sstevel@tonic-gate (void) strlcpy(arg->locale, locale, sizeof (arg->locale)); 1191108322fbScarlsonj if (!get_doorname(zone_name, doorpath)) { 1192108322fbScarlsonj zerror(gettext("alternate root path is too long")); 1193108322fbScarlsonj free(rvalp); 1194108322fbScarlsonj return (-1); 1195108322fbScarlsonj } 11967c478bd9Sstevel@tonic-gate 11977c478bd9Sstevel@tonic-gate /* 11987c478bd9Sstevel@tonic-gate * Loop trying to start zoneadmd; if something goes seriously 11997c478bd9Sstevel@tonic-gate * wrong we break out and fail. 12007c478bd9Sstevel@tonic-gate */ 12017c478bd9Sstevel@tonic-gate for (;;) { 12027c478bd9Sstevel@tonic-gate if (start_zoneadmd(zone_name) != Z_OK) 12037c478bd9Sstevel@tonic-gate break; 12047c478bd9Sstevel@tonic-gate 12057c478bd9Sstevel@tonic-gate if ((doorfd = open(doorpath, O_RDONLY)) < 0) { 12067c478bd9Sstevel@tonic-gate zperror(gettext("failed to open zone door"), B_FALSE); 12077c478bd9Sstevel@tonic-gate break; 12087c478bd9Sstevel@tonic-gate } 12097c478bd9Sstevel@tonic-gate 12107c478bd9Sstevel@tonic-gate darg.data_ptr = (char *)arg; 12117c478bd9Sstevel@tonic-gate darg.data_size = sizeof (*arg); 12127c478bd9Sstevel@tonic-gate darg.desc_ptr = NULL; 12137c478bd9Sstevel@tonic-gate darg.desc_num = 0; 12147c478bd9Sstevel@tonic-gate darg.rbuf = (char *)rvalp; 12157c478bd9Sstevel@tonic-gate darg.rsize = rlen; 12167c478bd9Sstevel@tonic-gate if (door_call(doorfd, &darg) != 0) { 12177c478bd9Sstevel@tonic-gate (void) close(doorfd); 12187c478bd9Sstevel@tonic-gate /* 12197c478bd9Sstevel@tonic-gate * We'll get EBADF if the door has been revoked. 12207c478bd9Sstevel@tonic-gate */ 12217c478bd9Sstevel@tonic-gate if (errno != EBADF) { 12227c478bd9Sstevel@tonic-gate zperror(gettext("door_call failed"), B_FALSE); 12237c478bd9Sstevel@tonic-gate break; 12247c478bd9Sstevel@tonic-gate } 12257c478bd9Sstevel@tonic-gate continue; /* take another lap */ 12267c478bd9Sstevel@tonic-gate } 12277c478bd9Sstevel@tonic-gate (void) close(doorfd); 12287c478bd9Sstevel@tonic-gate 12297c478bd9Sstevel@tonic-gate if (darg.data_size == 0) { 12307c478bd9Sstevel@tonic-gate /* Door server is going away; kick it again. */ 12317c478bd9Sstevel@tonic-gate continue; 12327c478bd9Sstevel@tonic-gate } 12337c478bd9Sstevel@tonic-gate 12347c478bd9Sstevel@tonic-gate errbuf = rvalp->errbuf; 12357c478bd9Sstevel@tonic-gate while (*errbuf != '\0') { 12367c478bd9Sstevel@tonic-gate /* 12377c478bd9Sstevel@tonic-gate * Remove any newlines since zerror() 12387c478bd9Sstevel@tonic-gate * will append one automatically. 12397c478bd9Sstevel@tonic-gate */ 12407c478bd9Sstevel@tonic-gate cp = strchr(errbuf, '\n'); 12417c478bd9Sstevel@tonic-gate if (cp != NULL) 12427c478bd9Sstevel@tonic-gate *cp = '\0'; 12437c478bd9Sstevel@tonic-gate zerror("%s", errbuf); 12447c478bd9Sstevel@tonic-gate if (cp == NULL) 12457c478bd9Sstevel@tonic-gate break; 12467c478bd9Sstevel@tonic-gate errbuf = cp + 1; 12477c478bd9Sstevel@tonic-gate } 12487c478bd9Sstevel@tonic-gate result = rvalp->rval == 0 ? 0 : -1; 12497c478bd9Sstevel@tonic-gate free(rvalp); 12507c478bd9Sstevel@tonic-gate return (result); 12517c478bd9Sstevel@tonic-gate } 12527c478bd9Sstevel@tonic-gate 12537c478bd9Sstevel@tonic-gate free(rvalp); 12547c478bd9Sstevel@tonic-gate return (-1); 12557c478bd9Sstevel@tonic-gate } 12567c478bd9Sstevel@tonic-gate 12577c478bd9Sstevel@tonic-gate static int 12587c478bd9Sstevel@tonic-gate ready_func(int argc, char *argv[]) 12597c478bd9Sstevel@tonic-gate { 12607c478bd9Sstevel@tonic-gate zone_cmd_arg_t zarg; 12617c478bd9Sstevel@tonic-gate int arg; 12627c478bd9Sstevel@tonic-gate 1263108322fbScarlsonj if (zonecfg_in_alt_root()) { 1264108322fbScarlsonj zerror(gettext("cannot ready zone in alternate root")); 1265108322fbScarlsonj return (Z_ERR); 1266108322fbScarlsonj } 1267108322fbScarlsonj 12687c478bd9Sstevel@tonic-gate optind = 0; 12697c478bd9Sstevel@tonic-gate if ((arg = getopt(argc, argv, "?")) != EOF) { 12707c478bd9Sstevel@tonic-gate switch (arg) { 12717c478bd9Sstevel@tonic-gate case '?': 12727c478bd9Sstevel@tonic-gate sub_usage(SHELP_READY, CMD_READY); 12737c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 12747c478bd9Sstevel@tonic-gate default: 12757c478bd9Sstevel@tonic-gate sub_usage(SHELP_READY, CMD_READY); 12767c478bd9Sstevel@tonic-gate return (Z_USAGE); 12777c478bd9Sstevel@tonic-gate } 12787c478bd9Sstevel@tonic-gate } 12797c478bd9Sstevel@tonic-gate if (argc > optind) { 12807c478bd9Sstevel@tonic-gate sub_usage(SHELP_READY, CMD_READY); 12817c478bd9Sstevel@tonic-gate return (Z_USAGE); 12827c478bd9Sstevel@tonic-gate } 12837c478bd9Sstevel@tonic-gate if (sanity_check(target_zone, CMD_READY, B_FALSE, B_FALSE) != Z_OK) 12847c478bd9Sstevel@tonic-gate return (Z_ERR); 12857c478bd9Sstevel@tonic-gate if (verify_details(CMD_READY) != Z_OK) 12867c478bd9Sstevel@tonic-gate return (Z_ERR); 12877c478bd9Sstevel@tonic-gate 12887c478bd9Sstevel@tonic-gate zarg.cmd = Z_READY; 12897c478bd9Sstevel@tonic-gate if (call_zoneadmd(target_zone, &zarg) != 0) { 12907c478bd9Sstevel@tonic-gate zerror(gettext("call to %s failed"), "zoneadmd"); 12917c478bd9Sstevel@tonic-gate return (Z_ERR); 12927c478bd9Sstevel@tonic-gate } 12937c478bd9Sstevel@tonic-gate return (Z_OK); 12947c478bd9Sstevel@tonic-gate } 12957c478bd9Sstevel@tonic-gate 12967c478bd9Sstevel@tonic-gate static int 12977c478bd9Sstevel@tonic-gate boot_func(int argc, char *argv[]) 12987c478bd9Sstevel@tonic-gate { 12997c478bd9Sstevel@tonic-gate zone_cmd_arg_t zarg; 13007c478bd9Sstevel@tonic-gate int arg; 13017c478bd9Sstevel@tonic-gate 1302108322fbScarlsonj if (zonecfg_in_alt_root()) { 1303108322fbScarlsonj zerror(gettext("cannot boot zone in alternate root")); 1304108322fbScarlsonj return (Z_ERR); 1305108322fbScarlsonj } 1306108322fbScarlsonj 13077c478bd9Sstevel@tonic-gate zarg.bootbuf[0] = '\0'; 13087c478bd9Sstevel@tonic-gate 13097c478bd9Sstevel@tonic-gate /* 13107c478bd9Sstevel@tonic-gate * At the current time, the only supported subargument to the 13117c478bd9Sstevel@tonic-gate * "boot" subcommand is "-s" which specifies a single-user boot. 13127c478bd9Sstevel@tonic-gate * In the future, other boot arguments should be supported 13137c478bd9Sstevel@tonic-gate * including "-m" for specifying alternate smf(5) milestones. 13147c478bd9Sstevel@tonic-gate */ 13157c478bd9Sstevel@tonic-gate optind = 0; 13167c478bd9Sstevel@tonic-gate if ((arg = getopt(argc, argv, "?s")) != EOF) { 13177c478bd9Sstevel@tonic-gate switch (arg) { 13187c478bd9Sstevel@tonic-gate case '?': 13197c478bd9Sstevel@tonic-gate sub_usage(SHELP_BOOT, CMD_BOOT); 13207c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 13217c478bd9Sstevel@tonic-gate case 's': 13227c478bd9Sstevel@tonic-gate (void) strlcpy(zarg.bootbuf, "-s", 13237c478bd9Sstevel@tonic-gate sizeof (zarg.bootbuf)); 13247c478bd9Sstevel@tonic-gate break; 13257c478bd9Sstevel@tonic-gate default: 13267c478bd9Sstevel@tonic-gate sub_usage(SHELP_BOOT, CMD_BOOT); 13277c478bd9Sstevel@tonic-gate return (Z_USAGE); 13287c478bd9Sstevel@tonic-gate } 13297c478bd9Sstevel@tonic-gate } 13307c478bd9Sstevel@tonic-gate if (argc > optind) { 13317c478bd9Sstevel@tonic-gate sub_usage(SHELP_BOOT, CMD_BOOT); 13327c478bd9Sstevel@tonic-gate return (Z_USAGE); 13337c478bd9Sstevel@tonic-gate } 13347c478bd9Sstevel@tonic-gate if (sanity_check(target_zone, CMD_BOOT, B_FALSE, B_FALSE) != Z_OK) 13357c478bd9Sstevel@tonic-gate return (Z_ERR); 13367c478bd9Sstevel@tonic-gate if (verify_details(CMD_BOOT) != Z_OK) 13377c478bd9Sstevel@tonic-gate return (Z_ERR); 13387c478bd9Sstevel@tonic-gate zarg.cmd = Z_BOOT; 13397c478bd9Sstevel@tonic-gate if (call_zoneadmd(target_zone, &zarg) != 0) { 13407c478bd9Sstevel@tonic-gate zerror(gettext("call to %s failed"), "zoneadmd"); 13417c478bd9Sstevel@tonic-gate return (Z_ERR); 13427c478bd9Sstevel@tonic-gate } 13437c478bd9Sstevel@tonic-gate return (Z_OK); 13447c478bd9Sstevel@tonic-gate } 13457c478bd9Sstevel@tonic-gate 13467c478bd9Sstevel@tonic-gate static void 13477c478bd9Sstevel@tonic-gate fake_up_local_zone(zoneid_t zid, zone_entry_t *zeptr) 13487c478bd9Sstevel@tonic-gate { 13497c478bd9Sstevel@tonic-gate ssize_t result; 13507c478bd9Sstevel@tonic-gate 13517c478bd9Sstevel@tonic-gate zeptr->zid = zid; 13527c478bd9Sstevel@tonic-gate /* 13537c478bd9Sstevel@tonic-gate * Since we're looking up our own (non-global) zone name, 13547c478bd9Sstevel@tonic-gate * we can be assured that it will succeed. 13557c478bd9Sstevel@tonic-gate */ 13567c478bd9Sstevel@tonic-gate result = getzonenamebyid(zid, zeptr->zname, sizeof (zeptr->zname)); 13577c478bd9Sstevel@tonic-gate assert(result >= 0); 135845916cd2Sjpk if (!is_system_labeled()) { 13597c478bd9Sstevel@tonic-gate (void) strlcpy(zeptr->zroot, "/", sizeof (zeptr->zroot)); 136045916cd2Sjpk } else { 136145916cd2Sjpk (void) zone_getattr(zid, ZONE_ATTR_ROOT, zeptr->zroot, 136245916cd2Sjpk sizeof (zeptr->zroot)); 136345916cd2Sjpk } 13647c478bd9Sstevel@tonic-gate zeptr->zstate_str = "running"; 13657c478bd9Sstevel@tonic-gate } 13667c478bd9Sstevel@tonic-gate 13677c478bd9Sstevel@tonic-gate static int 13687c478bd9Sstevel@tonic-gate list_func(int argc, char *argv[]) 13697c478bd9Sstevel@tonic-gate { 13707c478bd9Sstevel@tonic-gate zone_entry_t *zentp, zent; 1371108322fbScarlsonj int arg, retv; 13727c478bd9Sstevel@tonic-gate boolean_t output = B_FALSE, verbose = B_FALSE, parsable = B_FALSE; 13737c478bd9Sstevel@tonic-gate zone_state_t min_state = ZONE_STATE_RUNNING; 13747c478bd9Sstevel@tonic-gate zoneid_t zone_id = getzoneid(); 13757c478bd9Sstevel@tonic-gate 13767c478bd9Sstevel@tonic-gate if (target_zone == NULL) { 13777c478bd9Sstevel@tonic-gate /* all zones: default view to running but allow override */ 13787c478bd9Sstevel@tonic-gate optind = 0; 13797c478bd9Sstevel@tonic-gate while ((arg = getopt(argc, argv, "?cipv")) != EOF) { 13807c478bd9Sstevel@tonic-gate switch (arg) { 13817c478bd9Sstevel@tonic-gate case '?': 13827c478bd9Sstevel@tonic-gate sub_usage(SHELP_LIST, CMD_LIST); 13837c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 1384475d78a4Sjonb /* 1385475d78a4Sjonb * The 'i' and 'c' options are not mutually 1386475d78a4Sjonb * exclusive so if 'c' is given, then min_state 1387475d78a4Sjonb * is set to 0 (ZONE_STATE_CONFIGURED) which is 1388475d78a4Sjonb * the lowest possible state. If 'i' is given, 1389475d78a4Sjonb * then min_state is set to be the lowest state 1390475d78a4Sjonb * so far. 1391475d78a4Sjonb */ 13927c478bd9Sstevel@tonic-gate case 'c': 13937c478bd9Sstevel@tonic-gate min_state = ZONE_STATE_CONFIGURED; 13947c478bd9Sstevel@tonic-gate break; 13957c478bd9Sstevel@tonic-gate case 'i': 1396475d78a4Sjonb min_state = min(ZONE_STATE_INSTALLED, 1397475d78a4Sjonb min_state); 1398475d78a4Sjonb 13997c478bd9Sstevel@tonic-gate break; 14007c478bd9Sstevel@tonic-gate case 'p': 14017c478bd9Sstevel@tonic-gate parsable = B_TRUE; 14027c478bd9Sstevel@tonic-gate break; 14037c478bd9Sstevel@tonic-gate case 'v': 14047c478bd9Sstevel@tonic-gate verbose = B_TRUE; 14057c478bd9Sstevel@tonic-gate break; 14067c478bd9Sstevel@tonic-gate default: 14077c478bd9Sstevel@tonic-gate sub_usage(SHELP_LIST, CMD_LIST); 14087c478bd9Sstevel@tonic-gate return (Z_USAGE); 14097c478bd9Sstevel@tonic-gate } 14107c478bd9Sstevel@tonic-gate } 14117c478bd9Sstevel@tonic-gate if (parsable && verbose) { 14127c478bd9Sstevel@tonic-gate zerror(gettext("%s -p and -v are mutually exclusive."), 14137c478bd9Sstevel@tonic-gate cmd_to_str(CMD_LIST)); 14147c478bd9Sstevel@tonic-gate return (Z_ERR); 14157c478bd9Sstevel@tonic-gate } 141645916cd2Sjpk if (zone_id == GLOBAL_ZONEID || is_system_labeled()) { 1417108322fbScarlsonj retv = zone_print_list(min_state, verbose, parsable); 14187c478bd9Sstevel@tonic-gate } else { 1419108322fbScarlsonj retv = Z_OK; 14207c478bd9Sstevel@tonic-gate fake_up_local_zone(zone_id, &zent); 14217c478bd9Sstevel@tonic-gate zone_print(&zent, verbose, parsable); 14227c478bd9Sstevel@tonic-gate } 1423108322fbScarlsonj return (retv); 14247c478bd9Sstevel@tonic-gate } 14257c478bd9Sstevel@tonic-gate 14267c478bd9Sstevel@tonic-gate /* 14277c478bd9Sstevel@tonic-gate * Specific target zone: disallow -i/-c suboptions. 14287c478bd9Sstevel@tonic-gate */ 14297c478bd9Sstevel@tonic-gate optind = 0; 14307c478bd9Sstevel@tonic-gate while ((arg = getopt(argc, argv, "?pv")) != EOF) { 14317c478bd9Sstevel@tonic-gate switch (arg) { 14327c478bd9Sstevel@tonic-gate case '?': 14337c478bd9Sstevel@tonic-gate sub_usage(SHELP_LIST, CMD_LIST); 14347c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 14357c478bd9Sstevel@tonic-gate case 'p': 14367c478bd9Sstevel@tonic-gate parsable = B_TRUE; 14377c478bd9Sstevel@tonic-gate break; 14387c478bd9Sstevel@tonic-gate case 'v': 14397c478bd9Sstevel@tonic-gate verbose = B_TRUE; 14407c478bd9Sstevel@tonic-gate break; 14417c478bd9Sstevel@tonic-gate default: 14427c478bd9Sstevel@tonic-gate sub_usage(SHELP_LIST, CMD_LIST); 14437c478bd9Sstevel@tonic-gate return (Z_USAGE); 14447c478bd9Sstevel@tonic-gate } 14457c478bd9Sstevel@tonic-gate } 14467c478bd9Sstevel@tonic-gate if (parsable && verbose) { 14477c478bd9Sstevel@tonic-gate zerror(gettext("%s -p and -v are mutually exclusive."), 14487c478bd9Sstevel@tonic-gate cmd_to_str(CMD_LIST)); 14497c478bd9Sstevel@tonic-gate return (Z_ERR); 14507c478bd9Sstevel@tonic-gate } 14517c478bd9Sstevel@tonic-gate if (argc > optind) { 14527c478bd9Sstevel@tonic-gate sub_usage(SHELP_LIST, CMD_LIST); 14537c478bd9Sstevel@tonic-gate return (Z_USAGE); 14547c478bd9Sstevel@tonic-gate } 14557c478bd9Sstevel@tonic-gate if (zone_id != GLOBAL_ZONEID) { 14567c478bd9Sstevel@tonic-gate fake_up_local_zone(zone_id, &zent); 14577c478bd9Sstevel@tonic-gate /* 14587c478bd9Sstevel@tonic-gate * main() will issue a Z_NO_ZONE error if it cannot get an 14597c478bd9Sstevel@tonic-gate * id for target_zone, which in a non-global zone should 14607c478bd9Sstevel@tonic-gate * happen for any zone name except `zonename`. Thus we 14617c478bd9Sstevel@tonic-gate * assert() that here but don't otherwise check. 14627c478bd9Sstevel@tonic-gate */ 14637c478bd9Sstevel@tonic-gate assert(strcmp(zent.zname, target_zone) == 0); 14647c478bd9Sstevel@tonic-gate zone_print(&zent, verbose, parsable); 14657c478bd9Sstevel@tonic-gate output = B_TRUE; 14667c478bd9Sstevel@tonic-gate } else if ((zentp = lookup_running_zone(target_zone)) != NULL) { 14677c478bd9Sstevel@tonic-gate zone_print(zentp, verbose, parsable); 14687c478bd9Sstevel@tonic-gate output = B_TRUE; 1469108322fbScarlsonj } else if (lookup_zone_info(target_zone, ZONE_ID_UNDEFINED, 1470108322fbScarlsonj &zent) == Z_OK) { 14717c478bd9Sstevel@tonic-gate zone_print(&zent, verbose, parsable); 14727c478bd9Sstevel@tonic-gate output = B_TRUE; 14737c478bd9Sstevel@tonic-gate } 14747c478bd9Sstevel@tonic-gate return (output ? Z_OK : Z_ERR); 14757c478bd9Sstevel@tonic-gate } 14767c478bd9Sstevel@tonic-gate 14777c478bd9Sstevel@tonic-gate static void 14787c478bd9Sstevel@tonic-gate sigterm(int sig) 14797c478bd9Sstevel@tonic-gate { 14807c478bd9Sstevel@tonic-gate /* 14817c478bd9Sstevel@tonic-gate * Ignore SIG{INT,TERM}, so we don't end up in an infinite loop, 14827c478bd9Sstevel@tonic-gate * then propagate the signal to our process group. 14837c478bd9Sstevel@tonic-gate */ 14847c478bd9Sstevel@tonic-gate (void) sigset(SIGINT, SIG_IGN); 14857c478bd9Sstevel@tonic-gate (void) sigset(SIGTERM, SIG_IGN); 14867c478bd9Sstevel@tonic-gate (void) kill(0, sig); 14877c478bd9Sstevel@tonic-gate child_killed = B_TRUE; 14887c478bd9Sstevel@tonic-gate } 14897c478bd9Sstevel@tonic-gate 14907c478bd9Sstevel@tonic-gate static int 14917c478bd9Sstevel@tonic-gate do_subproc(char *cmdbuf) 14927c478bd9Sstevel@tonic-gate { 14937c478bd9Sstevel@tonic-gate char inbuf[1024]; /* arbitrary large amount */ 14947c478bd9Sstevel@tonic-gate FILE *file; 14957c478bd9Sstevel@tonic-gate 14967c478bd9Sstevel@tonic-gate child_killed = B_FALSE; 14977c478bd9Sstevel@tonic-gate /* 14987c478bd9Sstevel@tonic-gate * We use popen(3c) to launch child processes for [un]install; 14997c478bd9Sstevel@tonic-gate * this library call does not return a PID, so we have to kill 15007c478bd9Sstevel@tonic-gate * the whole process group. To avoid killing our parent, we 15017c478bd9Sstevel@tonic-gate * become a process group leader here. But doing so can wreak 15027c478bd9Sstevel@tonic-gate * havoc with reading from stdin when launched by a non-job-control 15037c478bd9Sstevel@tonic-gate * shell, so we close stdin and reopen it as /dev/null first. 15047c478bd9Sstevel@tonic-gate */ 15057c478bd9Sstevel@tonic-gate (void) close(STDIN_FILENO); 15067c478bd9Sstevel@tonic-gate (void) open("/dev/null", O_RDONLY); 15077c478bd9Sstevel@tonic-gate (void) setpgid(0, 0); 15087c478bd9Sstevel@tonic-gate (void) sigset(SIGINT, sigterm); 15097c478bd9Sstevel@tonic-gate (void) sigset(SIGTERM, sigterm); 15107c478bd9Sstevel@tonic-gate file = popen(cmdbuf, "r"); 15117c478bd9Sstevel@tonic-gate for (;;) { 15127c478bd9Sstevel@tonic-gate if (child_killed || fgets(inbuf, sizeof (inbuf), file) == NULL) 15137c478bd9Sstevel@tonic-gate break; 15147c478bd9Sstevel@tonic-gate (void) fputs(inbuf, stdout); 15157c478bd9Sstevel@tonic-gate } 15167c478bd9Sstevel@tonic-gate (void) sigset(SIGINT, SIG_DFL); 15177c478bd9Sstevel@tonic-gate (void) sigset(SIGTERM, SIG_DFL); 15187c478bd9Sstevel@tonic-gate return (pclose(file)); 15197c478bd9Sstevel@tonic-gate } 15207c478bd9Sstevel@tonic-gate 15217c478bd9Sstevel@tonic-gate static int 15227c478bd9Sstevel@tonic-gate subproc_status(const char *cmd, int status) 15237c478bd9Sstevel@tonic-gate { 15247c478bd9Sstevel@tonic-gate if (WIFEXITED(status)) { 15257c478bd9Sstevel@tonic-gate int exit_code = WEXITSTATUS(status); 15267c478bd9Sstevel@tonic-gate 15277c478bd9Sstevel@tonic-gate if (exit_code == 0) 15287c478bd9Sstevel@tonic-gate return (Z_OK); 15297c478bd9Sstevel@tonic-gate zerror(gettext("'%s' failed with exit code %d."), cmd, 15307c478bd9Sstevel@tonic-gate exit_code); 15317c478bd9Sstevel@tonic-gate } else if (WIFSIGNALED(status)) { 15327c478bd9Sstevel@tonic-gate int signal = WTERMSIG(status); 15337c478bd9Sstevel@tonic-gate char sigstr[SIG2STR_MAX]; 15347c478bd9Sstevel@tonic-gate 15357c478bd9Sstevel@tonic-gate if (sig2str(signal, sigstr) == 0) { 15367c478bd9Sstevel@tonic-gate zerror(gettext("'%s' terminated by signal SIG%s."), cmd, 15377c478bd9Sstevel@tonic-gate sigstr); 15387c478bd9Sstevel@tonic-gate } else { 15397c478bd9Sstevel@tonic-gate zerror(gettext("'%s' terminated by an unknown signal."), 15407c478bd9Sstevel@tonic-gate cmd); 15417c478bd9Sstevel@tonic-gate } 15427c478bd9Sstevel@tonic-gate } else { 15437c478bd9Sstevel@tonic-gate zerror(gettext("'%s' failed for unknown reasons."), cmd); 15447c478bd9Sstevel@tonic-gate } 15457c478bd9Sstevel@tonic-gate return (Z_ERR); 15467c478bd9Sstevel@tonic-gate } 15477c478bd9Sstevel@tonic-gate 15487c478bd9Sstevel@tonic-gate /* 15497c478bd9Sstevel@tonic-gate * Various sanity checks; make sure: 15507c478bd9Sstevel@tonic-gate * 1. We're in the global zone. 15517c478bd9Sstevel@tonic-gate * 2. The calling user has sufficient privilege. 15527c478bd9Sstevel@tonic-gate * 3. The target zone is neither the global zone nor anything starting with 15537c478bd9Sstevel@tonic-gate * "SUNW". 15547c478bd9Sstevel@tonic-gate * 4a. If we're looking for a 'not running' (i.e., configured or installed) 15557c478bd9Sstevel@tonic-gate * zone, the name service knows about it. 15567c478bd9Sstevel@tonic-gate * 4b. For some operations which expect a zone not to be running, that it is 15577c478bd9Sstevel@tonic-gate * not already running (or ready). 15587c478bd9Sstevel@tonic-gate */ 15597c478bd9Sstevel@tonic-gate static int 15607c478bd9Sstevel@tonic-gate sanity_check(char *zone, int cmd_num, boolean_t running, 15617c478bd9Sstevel@tonic-gate boolean_t unsafe_when_running) 15627c478bd9Sstevel@tonic-gate { 15637c478bd9Sstevel@tonic-gate zone_entry_t *zent; 15647c478bd9Sstevel@tonic-gate priv_set_t *privset; 15657c478bd9Sstevel@tonic-gate zone_state_t state; 1566108322fbScarlsonj char kernzone[ZONENAME_MAX]; 1567108322fbScarlsonj FILE *fp; 15687c478bd9Sstevel@tonic-gate 15697c478bd9Sstevel@tonic-gate if (getzoneid() != GLOBAL_ZONEID) { 1570ffbafc53Scomay switch (cmd_num) { 1571ffbafc53Scomay case CMD_HALT: 1572ffbafc53Scomay zerror(gettext("use %s to %s this zone."), "halt(1M)", 15737c478bd9Sstevel@tonic-gate cmd_to_str(cmd_num)); 1574ffbafc53Scomay break; 1575ffbafc53Scomay case CMD_REBOOT: 1576ffbafc53Scomay zerror(gettext("use %s to %s this zone."), 1577ffbafc53Scomay "reboot(1M)", cmd_to_str(cmd_num)); 1578ffbafc53Scomay break; 1579ffbafc53Scomay default: 1580ffbafc53Scomay zerror(gettext("must be in the global zone to %s a " 1581ffbafc53Scomay "zone."), cmd_to_str(cmd_num)); 1582ffbafc53Scomay break; 1583ffbafc53Scomay } 15847c478bd9Sstevel@tonic-gate return (Z_ERR); 15857c478bd9Sstevel@tonic-gate } 15867c478bd9Sstevel@tonic-gate 15877c478bd9Sstevel@tonic-gate if ((privset = priv_allocset()) == NULL) { 15887c478bd9Sstevel@tonic-gate zerror(gettext("%s failed"), "priv_allocset"); 15897c478bd9Sstevel@tonic-gate return (Z_ERR); 15907c478bd9Sstevel@tonic-gate } 15917c478bd9Sstevel@tonic-gate 15927c478bd9Sstevel@tonic-gate if (getppriv(PRIV_EFFECTIVE, privset) != 0) { 15937c478bd9Sstevel@tonic-gate zerror(gettext("%s failed"), "getppriv"); 15947c478bd9Sstevel@tonic-gate priv_freeset(privset); 15957c478bd9Sstevel@tonic-gate return (Z_ERR); 15967c478bd9Sstevel@tonic-gate } 15977c478bd9Sstevel@tonic-gate 15987c478bd9Sstevel@tonic-gate if (priv_isfullset(privset) == B_FALSE) { 15997c478bd9Sstevel@tonic-gate zerror(gettext("only a privileged user may %s a zone."), 16007c478bd9Sstevel@tonic-gate cmd_to_str(cmd_num)); 16017c478bd9Sstevel@tonic-gate priv_freeset(privset); 16027c478bd9Sstevel@tonic-gate return (Z_ERR); 16037c478bd9Sstevel@tonic-gate } 16047c478bd9Sstevel@tonic-gate priv_freeset(privset); 16057c478bd9Sstevel@tonic-gate 16067c478bd9Sstevel@tonic-gate if (zone == NULL) { 16077c478bd9Sstevel@tonic-gate zerror(gettext("no zone specified")); 16087c478bd9Sstevel@tonic-gate return (Z_ERR); 16097c478bd9Sstevel@tonic-gate } 16107c478bd9Sstevel@tonic-gate 16117c478bd9Sstevel@tonic-gate if (strcmp(zone, GLOBAL_ZONENAME) == 0) { 16127c478bd9Sstevel@tonic-gate zerror(gettext("%s operation is invalid for the global zone."), 16137c478bd9Sstevel@tonic-gate cmd_to_str(cmd_num)); 16147c478bd9Sstevel@tonic-gate return (Z_ERR); 16157c478bd9Sstevel@tonic-gate } 16167c478bd9Sstevel@tonic-gate 16177c478bd9Sstevel@tonic-gate if (strncmp(zone, "SUNW", 4) == 0) { 16187c478bd9Sstevel@tonic-gate zerror(gettext("%s operation is invalid for zones starting " 16197c478bd9Sstevel@tonic-gate "with SUNW."), cmd_to_str(cmd_num)); 16207c478bd9Sstevel@tonic-gate return (Z_ERR); 16217c478bd9Sstevel@tonic-gate } 16227c478bd9Sstevel@tonic-gate 1623108322fbScarlsonj if (!zonecfg_in_alt_root()) { 1624108322fbScarlsonj zent = lookup_running_zone(zone); 1625108322fbScarlsonj } else if ((fp = zonecfg_open_scratch("", B_FALSE)) == NULL) { 1626108322fbScarlsonj zent = NULL; 1627108322fbScarlsonj } else { 1628108322fbScarlsonj if (zonecfg_find_scratch(fp, zone, zonecfg_get_root(), 1629108322fbScarlsonj kernzone, sizeof (kernzone)) == 0) 1630108322fbScarlsonj zent = lookup_running_zone(kernzone); 1631108322fbScarlsonj else 1632108322fbScarlsonj zent = NULL; 1633108322fbScarlsonj zonecfg_close_scratch(fp); 1634108322fbScarlsonj } 1635108322fbScarlsonj 16367c478bd9Sstevel@tonic-gate /* 16377c478bd9Sstevel@tonic-gate * Look up from the kernel for 'running' zones. 16387c478bd9Sstevel@tonic-gate */ 16397c478bd9Sstevel@tonic-gate if (running) { 16407c478bd9Sstevel@tonic-gate if (zent == NULL) { 16417c478bd9Sstevel@tonic-gate zerror(gettext("not running")); 16427c478bd9Sstevel@tonic-gate return (Z_ERR); 16437c478bd9Sstevel@tonic-gate } 16447c478bd9Sstevel@tonic-gate } else { 16457c478bd9Sstevel@tonic-gate int err; 16467c478bd9Sstevel@tonic-gate 16477c478bd9Sstevel@tonic-gate if (unsafe_when_running && zent != NULL) { 16487c478bd9Sstevel@tonic-gate /* check whether the zone is ready or running */ 16497c478bd9Sstevel@tonic-gate if ((err = zone_get_state(zent->zname, 16507c478bd9Sstevel@tonic-gate &zent->zstate_num)) != Z_OK) { 16517c478bd9Sstevel@tonic-gate errno = err; 16527c478bd9Sstevel@tonic-gate zperror2(zent->zname, 16537c478bd9Sstevel@tonic-gate gettext("could not get state")); 16547c478bd9Sstevel@tonic-gate /* can't tell, so hedge */ 16557c478bd9Sstevel@tonic-gate zent->zstate_str = "ready/running"; 16567c478bd9Sstevel@tonic-gate } else { 16577c478bd9Sstevel@tonic-gate zent->zstate_str = 16587c478bd9Sstevel@tonic-gate zone_state_str(zent->zstate_num); 16597c478bd9Sstevel@tonic-gate } 16607c478bd9Sstevel@tonic-gate zerror(gettext("%s operation is invalid for %s zones."), 16617c478bd9Sstevel@tonic-gate cmd_to_str(cmd_num), zent->zstate_str); 16627c478bd9Sstevel@tonic-gate return (Z_ERR); 16637c478bd9Sstevel@tonic-gate } 16647c478bd9Sstevel@tonic-gate if ((err = zone_get_state(zone, &state)) != Z_OK) { 16657c478bd9Sstevel@tonic-gate errno = err; 16667c478bd9Sstevel@tonic-gate zperror2(zone, gettext("could not get state")); 16677c478bd9Sstevel@tonic-gate return (Z_ERR); 16687c478bd9Sstevel@tonic-gate } 16697c478bd9Sstevel@tonic-gate switch (cmd_num) { 16707c478bd9Sstevel@tonic-gate case CMD_UNINSTALL: 16717c478bd9Sstevel@tonic-gate if (state == ZONE_STATE_CONFIGURED) { 16727c478bd9Sstevel@tonic-gate zerror(gettext("is already in state '%s'."), 16737c478bd9Sstevel@tonic-gate zone_state_str(ZONE_STATE_CONFIGURED)); 16747c478bd9Sstevel@tonic-gate return (Z_ERR); 16757c478bd9Sstevel@tonic-gate } 16767c478bd9Sstevel@tonic-gate break; 1677ee519a1fSgjelinek case CMD_ATTACH: 1678865e09a4Sgjelinek case CMD_CLONE: 16797c478bd9Sstevel@tonic-gate case CMD_INSTALL: 16807c478bd9Sstevel@tonic-gate if (state == ZONE_STATE_INSTALLED) { 16817c478bd9Sstevel@tonic-gate zerror(gettext("is already %s."), 16827c478bd9Sstevel@tonic-gate zone_state_str(ZONE_STATE_INSTALLED)); 16837c478bd9Sstevel@tonic-gate return (Z_ERR); 16847c478bd9Sstevel@tonic-gate } else if (state == ZONE_STATE_INCOMPLETE) { 16857c478bd9Sstevel@tonic-gate zerror(gettext("zone is %s; %s required."), 16867c478bd9Sstevel@tonic-gate zone_state_str(ZONE_STATE_INCOMPLETE), 16877c478bd9Sstevel@tonic-gate cmd_to_str(CMD_UNINSTALL)); 16887c478bd9Sstevel@tonic-gate return (Z_ERR); 16897c478bd9Sstevel@tonic-gate } 16907c478bd9Sstevel@tonic-gate break; 1691ee519a1fSgjelinek case CMD_DETACH: 1692865e09a4Sgjelinek case CMD_MOVE: 16937c478bd9Sstevel@tonic-gate case CMD_READY: 16947c478bd9Sstevel@tonic-gate case CMD_BOOT: 1695108322fbScarlsonj case CMD_MOUNT: 16967c478bd9Sstevel@tonic-gate if (state < ZONE_STATE_INSTALLED) { 16977c478bd9Sstevel@tonic-gate zerror(gettext("must be %s before %s."), 16987c478bd9Sstevel@tonic-gate zone_state_str(ZONE_STATE_INSTALLED), 16997c478bd9Sstevel@tonic-gate cmd_to_str(cmd_num)); 17007c478bd9Sstevel@tonic-gate return (Z_ERR); 17017c478bd9Sstevel@tonic-gate } 17027c478bd9Sstevel@tonic-gate break; 17037c478bd9Sstevel@tonic-gate case CMD_VERIFY: 17047c478bd9Sstevel@tonic-gate if (state == ZONE_STATE_INCOMPLETE) { 17057c478bd9Sstevel@tonic-gate zerror(gettext("zone is %s; %s required."), 17067c478bd9Sstevel@tonic-gate zone_state_str(ZONE_STATE_INCOMPLETE), 17077c478bd9Sstevel@tonic-gate cmd_to_str(CMD_UNINSTALL)); 17087c478bd9Sstevel@tonic-gate return (Z_ERR); 17097c478bd9Sstevel@tonic-gate } 17107c478bd9Sstevel@tonic-gate break; 1711108322fbScarlsonj case CMD_UNMOUNT: 1712108322fbScarlsonj if (state != ZONE_STATE_MOUNTED) { 1713108322fbScarlsonj zerror(gettext("must be %s before %s."), 1714108322fbScarlsonj zone_state_str(ZONE_STATE_MOUNTED), 1715108322fbScarlsonj cmd_to_str(cmd_num)); 1716108322fbScarlsonj return (Z_ERR); 1717108322fbScarlsonj } 1718108322fbScarlsonj break; 17197c478bd9Sstevel@tonic-gate } 17207c478bd9Sstevel@tonic-gate } 17217c478bd9Sstevel@tonic-gate return (Z_OK); 17227c478bd9Sstevel@tonic-gate } 17237c478bd9Sstevel@tonic-gate 17247c478bd9Sstevel@tonic-gate static int 17257c478bd9Sstevel@tonic-gate halt_func(int argc, char *argv[]) 17267c478bd9Sstevel@tonic-gate { 17277c478bd9Sstevel@tonic-gate zone_cmd_arg_t zarg; 17287c478bd9Sstevel@tonic-gate int arg; 17297c478bd9Sstevel@tonic-gate 1730108322fbScarlsonj if (zonecfg_in_alt_root()) { 1731108322fbScarlsonj zerror(gettext("cannot halt zone in alternate root")); 1732108322fbScarlsonj return (Z_ERR); 1733108322fbScarlsonj } 1734108322fbScarlsonj 17357c478bd9Sstevel@tonic-gate optind = 0; 17367c478bd9Sstevel@tonic-gate if ((arg = getopt(argc, argv, "?")) != EOF) { 17377c478bd9Sstevel@tonic-gate switch (arg) { 17387c478bd9Sstevel@tonic-gate case '?': 17397c478bd9Sstevel@tonic-gate sub_usage(SHELP_HALT, CMD_HALT); 17407c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 17417c478bd9Sstevel@tonic-gate default: 17427c478bd9Sstevel@tonic-gate sub_usage(SHELP_HALT, CMD_HALT); 17437c478bd9Sstevel@tonic-gate return (Z_USAGE); 17447c478bd9Sstevel@tonic-gate } 17457c478bd9Sstevel@tonic-gate } 17467c478bd9Sstevel@tonic-gate if (argc > optind) { 17477c478bd9Sstevel@tonic-gate sub_usage(SHELP_HALT, CMD_HALT); 17487c478bd9Sstevel@tonic-gate return (Z_USAGE); 17497c478bd9Sstevel@tonic-gate } 17507c478bd9Sstevel@tonic-gate /* 17517c478bd9Sstevel@tonic-gate * zoneadmd should be the one to decide whether or not to proceed, 17527c478bd9Sstevel@tonic-gate * so even though it seems that the fourth parameter below should 17537c478bd9Sstevel@tonic-gate * perhaps be B_TRUE, it really shouldn't be. 17547c478bd9Sstevel@tonic-gate */ 17557c478bd9Sstevel@tonic-gate if (sanity_check(target_zone, CMD_HALT, B_FALSE, B_FALSE) != Z_OK) 17567c478bd9Sstevel@tonic-gate return (Z_ERR); 17577c478bd9Sstevel@tonic-gate 17587c478bd9Sstevel@tonic-gate zarg.cmd = Z_HALT; 17597c478bd9Sstevel@tonic-gate return ((call_zoneadmd(target_zone, &zarg) == 0) ? Z_OK : Z_ERR); 17607c478bd9Sstevel@tonic-gate } 17617c478bd9Sstevel@tonic-gate 17627c478bd9Sstevel@tonic-gate static int 17637c478bd9Sstevel@tonic-gate reboot_func(int argc, char *argv[]) 17647c478bd9Sstevel@tonic-gate { 17657c478bd9Sstevel@tonic-gate zone_cmd_arg_t zarg; 17667c478bd9Sstevel@tonic-gate int arg; 17677c478bd9Sstevel@tonic-gate 1768108322fbScarlsonj if (zonecfg_in_alt_root()) { 1769108322fbScarlsonj zerror(gettext("cannot reboot zone in alternate root")); 1770108322fbScarlsonj return (Z_ERR); 1771108322fbScarlsonj } 1772108322fbScarlsonj 17737c478bd9Sstevel@tonic-gate optind = 0; 17747c478bd9Sstevel@tonic-gate if ((arg = getopt(argc, argv, "?")) != EOF) { 17757c478bd9Sstevel@tonic-gate switch (arg) { 17767c478bd9Sstevel@tonic-gate case '?': 17777c478bd9Sstevel@tonic-gate sub_usage(SHELP_REBOOT, CMD_REBOOT); 17787c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 17797c478bd9Sstevel@tonic-gate default: 17807c478bd9Sstevel@tonic-gate sub_usage(SHELP_REBOOT, CMD_REBOOT); 17817c478bd9Sstevel@tonic-gate return (Z_USAGE); 17827c478bd9Sstevel@tonic-gate } 17837c478bd9Sstevel@tonic-gate } 17847c478bd9Sstevel@tonic-gate if (argc > 0) { 17857c478bd9Sstevel@tonic-gate sub_usage(SHELP_REBOOT, CMD_REBOOT); 17867c478bd9Sstevel@tonic-gate return (Z_USAGE); 17877c478bd9Sstevel@tonic-gate } 17887c478bd9Sstevel@tonic-gate /* 17897c478bd9Sstevel@tonic-gate * zoneadmd should be the one to decide whether or not to proceed, 17907c478bd9Sstevel@tonic-gate * so even though it seems that the fourth parameter below should 17917c478bd9Sstevel@tonic-gate * perhaps be B_TRUE, it really shouldn't be. 17927c478bd9Sstevel@tonic-gate */ 17937c478bd9Sstevel@tonic-gate if (sanity_check(target_zone, CMD_REBOOT, B_TRUE, B_FALSE) != Z_OK) 17947c478bd9Sstevel@tonic-gate return (Z_ERR); 1795b5abaf04Sgjelinek if (verify_details(CMD_REBOOT) != Z_OK) 1796b5abaf04Sgjelinek return (Z_ERR); 17977c478bd9Sstevel@tonic-gate 17987c478bd9Sstevel@tonic-gate zarg.cmd = Z_REBOOT; 17997c478bd9Sstevel@tonic-gate return ((call_zoneadmd(target_zone, &zarg) == 0) ? Z_OK : Z_ERR); 18007c478bd9Sstevel@tonic-gate } 18017c478bd9Sstevel@tonic-gate 18027c478bd9Sstevel@tonic-gate static int 18037c478bd9Sstevel@tonic-gate verify_rctls(zone_dochandle_t handle) 18047c478bd9Sstevel@tonic-gate { 18057c478bd9Sstevel@tonic-gate struct zone_rctltab rctltab; 18067c478bd9Sstevel@tonic-gate size_t rbs = rctlblk_size(); 18077c478bd9Sstevel@tonic-gate rctlblk_t *rctlblk; 18087c478bd9Sstevel@tonic-gate int error = Z_INVAL; 18097c478bd9Sstevel@tonic-gate 18107c478bd9Sstevel@tonic-gate if ((rctlblk = malloc(rbs)) == NULL) { 18117c478bd9Sstevel@tonic-gate zerror(gettext("failed to allocate %lu bytes: %s"), rbs, 18127c478bd9Sstevel@tonic-gate strerror(errno)); 18137c478bd9Sstevel@tonic-gate return (Z_NOMEM); 18147c478bd9Sstevel@tonic-gate } 18157c478bd9Sstevel@tonic-gate 18167c478bd9Sstevel@tonic-gate if (zonecfg_setrctlent(handle) != Z_OK) { 18177c478bd9Sstevel@tonic-gate zerror(gettext("zonecfg_setrctlent failed")); 18187c478bd9Sstevel@tonic-gate free(rctlblk); 18197c478bd9Sstevel@tonic-gate return (error); 18207c478bd9Sstevel@tonic-gate } 18217c478bd9Sstevel@tonic-gate 18227c478bd9Sstevel@tonic-gate rctltab.zone_rctl_valptr = NULL; 18237c478bd9Sstevel@tonic-gate while (zonecfg_getrctlent(handle, &rctltab) == Z_OK) { 18247c478bd9Sstevel@tonic-gate struct zone_rctlvaltab *rctlval; 18257c478bd9Sstevel@tonic-gate const char *name = rctltab.zone_rctl_name; 18267c478bd9Sstevel@tonic-gate 18277c478bd9Sstevel@tonic-gate if (!zonecfg_is_rctl(name)) { 18287c478bd9Sstevel@tonic-gate zerror(gettext("WARNING: Ignoring unrecognized rctl " 18297c478bd9Sstevel@tonic-gate "'%s'."), name); 18307c478bd9Sstevel@tonic-gate zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr); 18317c478bd9Sstevel@tonic-gate rctltab.zone_rctl_valptr = NULL; 18327c478bd9Sstevel@tonic-gate continue; 18337c478bd9Sstevel@tonic-gate } 18347c478bd9Sstevel@tonic-gate 18357c478bd9Sstevel@tonic-gate for (rctlval = rctltab.zone_rctl_valptr; rctlval != NULL; 18367c478bd9Sstevel@tonic-gate rctlval = rctlval->zone_rctlval_next) { 18377c478bd9Sstevel@tonic-gate if (zonecfg_construct_rctlblk(rctlval, rctlblk) 18387c478bd9Sstevel@tonic-gate != Z_OK) { 18397c478bd9Sstevel@tonic-gate zerror(gettext("invalid rctl value: " 18407c478bd9Sstevel@tonic-gate "(priv=%s,limit=%s,action%s)"), 18417c478bd9Sstevel@tonic-gate rctlval->zone_rctlval_priv, 18427c478bd9Sstevel@tonic-gate rctlval->zone_rctlval_limit, 18437c478bd9Sstevel@tonic-gate rctlval->zone_rctlval_action); 18447c478bd9Sstevel@tonic-gate goto out; 18457c478bd9Sstevel@tonic-gate } 18467c478bd9Sstevel@tonic-gate if (!zonecfg_valid_rctl(name, rctlblk)) { 18477c478bd9Sstevel@tonic-gate zerror(gettext("(priv=%s,limit=%s,action=%s) " 18487c478bd9Sstevel@tonic-gate "is not a valid value for rctl '%s'"), 18497c478bd9Sstevel@tonic-gate rctlval->zone_rctlval_priv, 18507c478bd9Sstevel@tonic-gate rctlval->zone_rctlval_limit, 18517c478bd9Sstevel@tonic-gate rctlval->zone_rctlval_action, 18527c478bd9Sstevel@tonic-gate name); 18537c478bd9Sstevel@tonic-gate goto out; 18547c478bd9Sstevel@tonic-gate } 18557c478bd9Sstevel@tonic-gate } 18567c478bd9Sstevel@tonic-gate zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr); 18577c478bd9Sstevel@tonic-gate } 18587c478bd9Sstevel@tonic-gate rctltab.zone_rctl_valptr = NULL; 18597c478bd9Sstevel@tonic-gate error = Z_OK; 18607c478bd9Sstevel@tonic-gate out: 18617c478bd9Sstevel@tonic-gate zonecfg_free_rctl_value_list(rctltab.zone_rctl_valptr); 18627c478bd9Sstevel@tonic-gate (void) zonecfg_endrctlent(handle); 18637c478bd9Sstevel@tonic-gate free(rctlblk); 18647c478bd9Sstevel@tonic-gate return (error); 18657c478bd9Sstevel@tonic-gate } 18667c478bd9Sstevel@tonic-gate 18677c478bd9Sstevel@tonic-gate static int 18687c478bd9Sstevel@tonic-gate verify_pool(zone_dochandle_t handle) 18697c478bd9Sstevel@tonic-gate { 18707c478bd9Sstevel@tonic-gate char poolname[MAXPATHLEN]; 18717c478bd9Sstevel@tonic-gate pool_conf_t *poolconf; 18727c478bd9Sstevel@tonic-gate pool_t *pool; 18737c478bd9Sstevel@tonic-gate int status; 18747c478bd9Sstevel@tonic-gate int error; 18757c478bd9Sstevel@tonic-gate 18767c478bd9Sstevel@tonic-gate /* 18777c478bd9Sstevel@tonic-gate * This ends up being very similar to the check done in zoneadmd. 18787c478bd9Sstevel@tonic-gate */ 18797c478bd9Sstevel@tonic-gate error = zonecfg_get_pool(handle, poolname, sizeof (poolname)); 18807c478bd9Sstevel@tonic-gate if (error == Z_NO_ENTRY || (error == Z_OK && strlen(poolname) == 0)) { 18817c478bd9Sstevel@tonic-gate /* 18827c478bd9Sstevel@tonic-gate * No pool specified. 18837c478bd9Sstevel@tonic-gate */ 18847c478bd9Sstevel@tonic-gate return (0); 18857c478bd9Sstevel@tonic-gate } 18867c478bd9Sstevel@tonic-gate if (error != Z_OK) { 18877c478bd9Sstevel@tonic-gate zperror(gettext("Unable to retrieve pool name from " 18887c478bd9Sstevel@tonic-gate "configuration"), B_TRUE); 18897c478bd9Sstevel@tonic-gate return (error); 18907c478bd9Sstevel@tonic-gate } 18917c478bd9Sstevel@tonic-gate /* 18927c478bd9Sstevel@tonic-gate * Don't do anything if pools aren't enabled. 18937c478bd9Sstevel@tonic-gate */ 18947c478bd9Sstevel@tonic-gate if (pool_get_status(&status) != PO_SUCCESS || status != POOL_ENABLED) { 18957c478bd9Sstevel@tonic-gate zerror(gettext("WARNING: pools facility not active; " 18967c478bd9Sstevel@tonic-gate "zone will not be bound to pool '%s'."), poolname); 18977c478bd9Sstevel@tonic-gate return (Z_OK); 18987c478bd9Sstevel@tonic-gate } 18997c478bd9Sstevel@tonic-gate /* 19007c478bd9Sstevel@tonic-gate * Try to provide a sane error message if the requested pool doesn't 19017c478bd9Sstevel@tonic-gate * exist. It isn't clear that pools-related failures should 19027c478bd9Sstevel@tonic-gate * necessarily translate to a failure to verify the zone configuration, 19037c478bd9Sstevel@tonic-gate * hence they are not considered errors. 19047c478bd9Sstevel@tonic-gate */ 19057c478bd9Sstevel@tonic-gate if ((poolconf = pool_conf_alloc()) == NULL) { 19067c478bd9Sstevel@tonic-gate zerror(gettext("WARNING: pool_conf_alloc failed; " 19077c478bd9Sstevel@tonic-gate "using default pool")); 19087c478bd9Sstevel@tonic-gate return (Z_OK); 19097c478bd9Sstevel@tonic-gate } 19107c478bd9Sstevel@tonic-gate if (pool_conf_open(poolconf, pool_dynamic_location(), PO_RDONLY) != 19117c478bd9Sstevel@tonic-gate PO_SUCCESS) { 19127c478bd9Sstevel@tonic-gate zerror(gettext("WARNING: pool_conf_open failed; " 19137c478bd9Sstevel@tonic-gate "using default pool")); 19147c478bd9Sstevel@tonic-gate pool_conf_free(poolconf); 19157c478bd9Sstevel@tonic-gate return (Z_OK); 19167c478bd9Sstevel@tonic-gate } 19177c478bd9Sstevel@tonic-gate pool = pool_get_pool(poolconf, poolname); 19187c478bd9Sstevel@tonic-gate (void) pool_conf_close(poolconf); 19197c478bd9Sstevel@tonic-gate pool_conf_free(poolconf); 19207c478bd9Sstevel@tonic-gate if (pool == NULL) { 19217c478bd9Sstevel@tonic-gate zerror(gettext("WARNING: pool '%s' not found. " 19227c478bd9Sstevel@tonic-gate "using default pool"), poolname); 19237c478bd9Sstevel@tonic-gate } 19247c478bd9Sstevel@tonic-gate 19257c478bd9Sstevel@tonic-gate return (Z_OK); 19267c478bd9Sstevel@tonic-gate } 19277c478bd9Sstevel@tonic-gate 19287c478bd9Sstevel@tonic-gate static int 1929b5abaf04Sgjelinek verify_ipd(zone_dochandle_t handle) 1930b5abaf04Sgjelinek { 1931b5abaf04Sgjelinek int return_code = Z_OK; 1932b5abaf04Sgjelinek struct zone_fstab fstab; 1933b5abaf04Sgjelinek struct stat st; 1934b5abaf04Sgjelinek char specdir[MAXPATHLEN]; 1935b5abaf04Sgjelinek 1936b5abaf04Sgjelinek if (zonecfg_setipdent(handle) != Z_OK) { 19375ee84fbdSgjelinek /* 19385ee84fbdSgjelinek * TRANSLATION_NOTE 19395ee84fbdSgjelinek * inherit-pkg-dirs is a literal that should not be translated. 19405ee84fbdSgjelinek */ 19415ee84fbdSgjelinek (void) fprintf(stderr, gettext("could not verify " 1942b5abaf04Sgjelinek "inherit-pkg-dirs: unable to enumerate mounts\n")); 1943b5abaf04Sgjelinek return (Z_ERR); 1944b5abaf04Sgjelinek } 1945b5abaf04Sgjelinek while (zonecfg_getipdent(handle, &fstab) == Z_OK) { 1946b5abaf04Sgjelinek /* 1947b5abaf04Sgjelinek * Verify fs_dir exists. 1948b5abaf04Sgjelinek */ 1949b5abaf04Sgjelinek (void) snprintf(specdir, sizeof (specdir), "%s%s", 1950b5abaf04Sgjelinek zonecfg_get_root(), fstab.zone_fs_dir); 1951b5abaf04Sgjelinek if (stat(specdir, &st) != 0) { 19525ee84fbdSgjelinek /* 19535ee84fbdSgjelinek * TRANSLATION_NOTE 19545ee84fbdSgjelinek * inherit-pkg-dir is a literal that should not be 19555ee84fbdSgjelinek * translated. 19565ee84fbdSgjelinek */ 19575ee84fbdSgjelinek (void) fprintf(stderr, gettext("could not verify " 1958b5abaf04Sgjelinek "inherit-pkg-dir %s: %s\n"), 1959b5abaf04Sgjelinek fstab.zone_fs_dir, strerror(errno)); 1960b5abaf04Sgjelinek return_code = Z_ERR; 1961b5abaf04Sgjelinek } 1962b5abaf04Sgjelinek if (strcmp(st.st_fstype, MNTTYPE_NFS) == 0) { 19635ee84fbdSgjelinek /* 19645ee84fbdSgjelinek * TRANSLATION_NOTE 19655ee84fbdSgjelinek * inherit-pkg-dir and NFS are literals that should 19665ee84fbdSgjelinek * not be translated. 19675ee84fbdSgjelinek */ 1968b5abaf04Sgjelinek (void) fprintf(stderr, gettext("cannot verify " 19690b5de56dSgjelinek "inherit-pkg-dir %s: NFS mounted file system.\n" 19700b5de56dSgjelinek "\tA local file system must be used.\n"), 1971b5abaf04Sgjelinek fstab.zone_fs_dir); 1972b5abaf04Sgjelinek return_code = Z_ERR; 1973b5abaf04Sgjelinek } 1974b5abaf04Sgjelinek } 1975b5abaf04Sgjelinek (void) zonecfg_endipdent(handle); 1976b5abaf04Sgjelinek 1977b5abaf04Sgjelinek return (return_code); 1978b5abaf04Sgjelinek } 1979b5abaf04Sgjelinek 198020c8013fSlling /* 198120c8013fSlling * Verify that the special device/file system exists and is valid. 198220c8013fSlling */ 198320c8013fSlling static int 198420c8013fSlling verify_fs_special(struct zone_fstab *fstab) 198520c8013fSlling { 198620c8013fSlling struct stat st; 198720c8013fSlling 198820c8013fSlling if (strcmp(fstab->zone_fs_type, MNTTYPE_ZFS) == 0) 198920c8013fSlling return (verify_fs_zfs(fstab)); 199020c8013fSlling 199120c8013fSlling if (stat(fstab->zone_fs_special, &st) != 0) { 19925c358068Slling (void) fprintf(stderr, gettext("could not verify fs " 199320c8013fSlling "%s: could not access %s: %s\n"), fstab->zone_fs_dir, 199420c8013fSlling fstab->zone_fs_special, strerror(errno)); 199520c8013fSlling return (Z_ERR); 199620c8013fSlling } 199720c8013fSlling 199820c8013fSlling if (strcmp(st.st_fstype, MNTTYPE_NFS) == 0) { 199920c8013fSlling /* 200020c8013fSlling * TRANSLATION_NOTE 200120c8013fSlling * fs and NFS are literals that should 200220c8013fSlling * not be translated. 200320c8013fSlling */ 200420c8013fSlling (void) fprintf(stderr, gettext("cannot verify " 20050b5de56dSgjelinek "fs %s: NFS mounted file system.\n" 20060b5de56dSgjelinek "\tA local file system must be used.\n"), 200720c8013fSlling fstab->zone_fs_special); 200820c8013fSlling return (Z_ERR); 200920c8013fSlling } 201020c8013fSlling 201120c8013fSlling return (Z_OK); 201220c8013fSlling } 201320c8013fSlling 2014b5abaf04Sgjelinek static int 20157c478bd9Sstevel@tonic-gate verify_filesystems(zone_dochandle_t handle) 20167c478bd9Sstevel@tonic-gate { 20177c478bd9Sstevel@tonic-gate int return_code = Z_OK; 20187c478bd9Sstevel@tonic-gate struct zone_fstab fstab; 20197c478bd9Sstevel@tonic-gate char cmdbuf[MAXPATHLEN]; 20207c478bd9Sstevel@tonic-gate struct stat st; 20217c478bd9Sstevel@tonic-gate 20227c478bd9Sstevel@tonic-gate /* 20237c478bd9Sstevel@tonic-gate * No need to verify inherit-pkg-dir fs types, as their type is 20247c478bd9Sstevel@tonic-gate * implicitly lofs, which is known. Therefore, the types are only 20257c478bd9Sstevel@tonic-gate * verified for regular file systems below. 20267c478bd9Sstevel@tonic-gate * 20277c478bd9Sstevel@tonic-gate * Since the actual mount point is not known until the dependent mounts 20287c478bd9Sstevel@tonic-gate * are performed, we don't attempt any path validation here: that will 20297c478bd9Sstevel@tonic-gate * happen later when zoneadmd actually does the mounts. 20307c478bd9Sstevel@tonic-gate */ 20317c478bd9Sstevel@tonic-gate if (zonecfg_setfsent(handle) != Z_OK) { 20320b5de56dSgjelinek (void) fprintf(stderr, gettext("could not verify file systems: " 20337c478bd9Sstevel@tonic-gate "unable to enumerate mounts\n")); 20347c478bd9Sstevel@tonic-gate return (Z_ERR); 20357c478bd9Sstevel@tonic-gate } 20367c478bd9Sstevel@tonic-gate while (zonecfg_getfsent(handle, &fstab) == Z_OK) { 20377c478bd9Sstevel@tonic-gate if (!zonecfg_valid_fs_type(fstab.zone_fs_type)) { 20387c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("cannot verify fs %s: " 20397c478bd9Sstevel@tonic-gate "type %s is not allowed.\n"), fstab.zone_fs_dir, 20407c478bd9Sstevel@tonic-gate fstab.zone_fs_type); 20417c478bd9Sstevel@tonic-gate return_code = Z_ERR; 20427c478bd9Sstevel@tonic-gate goto next_fs; 20437c478bd9Sstevel@tonic-gate } 20447c478bd9Sstevel@tonic-gate /* 20457c478bd9Sstevel@tonic-gate * Verify /usr/lib/fs/<fstype>/mount exists. 20467c478bd9Sstevel@tonic-gate */ 20477c478bd9Sstevel@tonic-gate if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/mount", 20487c478bd9Sstevel@tonic-gate fstab.zone_fs_type) > sizeof (cmdbuf)) { 20497c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("cannot verify fs %s: " 20507c478bd9Sstevel@tonic-gate "type %s is too long.\n"), fstab.zone_fs_dir, 20517c478bd9Sstevel@tonic-gate fstab.zone_fs_type); 20527c478bd9Sstevel@tonic-gate return_code = Z_ERR; 20537c478bd9Sstevel@tonic-gate goto next_fs; 20547c478bd9Sstevel@tonic-gate } 20557c478bd9Sstevel@tonic-gate if (stat(cmdbuf, &st) != 0) { 20565ee84fbdSgjelinek (void) fprintf(stderr, gettext("could not verify fs " 20575ee84fbdSgjelinek "%s: could not access %s: %s\n"), fstab.zone_fs_dir, 20587c478bd9Sstevel@tonic-gate cmdbuf, strerror(errno)); 20597c478bd9Sstevel@tonic-gate return_code = Z_ERR; 20607c478bd9Sstevel@tonic-gate goto next_fs; 20617c478bd9Sstevel@tonic-gate } 20627c478bd9Sstevel@tonic-gate if (!S_ISREG(st.st_mode)) { 20635ee84fbdSgjelinek (void) fprintf(stderr, gettext("could not verify fs " 20645ee84fbdSgjelinek "%s: %s is not a regular file\n"), 20655ee84fbdSgjelinek fstab.zone_fs_dir, cmdbuf); 20667c478bd9Sstevel@tonic-gate return_code = Z_ERR; 20677c478bd9Sstevel@tonic-gate goto next_fs; 20687c478bd9Sstevel@tonic-gate } 20697c478bd9Sstevel@tonic-gate /* 20707c478bd9Sstevel@tonic-gate * Verify /usr/lib/fs/<fstype>/fsck exists iff zone_fs_raw is 20717c478bd9Sstevel@tonic-gate * set. 20727c478bd9Sstevel@tonic-gate */ 20737c478bd9Sstevel@tonic-gate if (snprintf(cmdbuf, sizeof (cmdbuf), "/usr/lib/fs/%s/fsck", 20747c478bd9Sstevel@tonic-gate fstab.zone_fs_type) > sizeof (cmdbuf)) { 20757c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("cannot verify fs %s: " 20767c478bd9Sstevel@tonic-gate "type %s is too long.\n"), fstab.zone_fs_dir, 20777c478bd9Sstevel@tonic-gate fstab.zone_fs_type); 20787c478bd9Sstevel@tonic-gate return_code = Z_ERR; 20797c478bd9Sstevel@tonic-gate goto next_fs; 20807c478bd9Sstevel@tonic-gate } 20817c478bd9Sstevel@tonic-gate if (fstab.zone_fs_raw[0] == '\0' && stat(cmdbuf, &st) == 0) { 20825ee84fbdSgjelinek (void) fprintf(stderr, gettext("could not verify fs " 20835ee84fbdSgjelinek "%s: must specify 'raw' device for %s " 20840b5de56dSgjelinek "file systems\n"), 20857c478bd9Sstevel@tonic-gate fstab.zone_fs_dir, fstab.zone_fs_type); 20867c478bd9Sstevel@tonic-gate return_code = Z_ERR; 20877c478bd9Sstevel@tonic-gate goto next_fs; 20887c478bd9Sstevel@tonic-gate } 20897c478bd9Sstevel@tonic-gate if (fstab.zone_fs_raw[0] != '\0' && 20907c478bd9Sstevel@tonic-gate (stat(cmdbuf, &st) != 0 || !S_ISREG(st.st_mode))) { 20917c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("cannot verify fs %s: " 20927c478bd9Sstevel@tonic-gate "'raw' device specified but " 20937c478bd9Sstevel@tonic-gate "no fsck executable exists for %s\n"), 20947c478bd9Sstevel@tonic-gate fstab.zone_fs_dir, fstab.zone_fs_type); 20957c478bd9Sstevel@tonic-gate return_code = Z_ERR; 20967c478bd9Sstevel@tonic-gate goto next_fs; 20977c478bd9Sstevel@tonic-gate } 209820c8013fSlling 209920c8013fSlling /* Verify fs_special. */ 210020c8013fSlling if ((return_code = verify_fs_special(&fstab)) != Z_OK) 2101b5abaf04Sgjelinek goto next_fs; 210220c8013fSlling 210320c8013fSlling /* Verify fs_raw. */ 2104b5abaf04Sgjelinek if (fstab.zone_fs_raw[0] != '\0' && 2105b5abaf04Sgjelinek stat(fstab.zone_fs_raw, &st) != 0) { 21065ee84fbdSgjelinek /* 21075ee84fbdSgjelinek * TRANSLATION_NOTE 21085ee84fbdSgjelinek * fs is a literal that should not be translated. 21095ee84fbdSgjelinek */ 21105ee84fbdSgjelinek (void) fprintf(stderr, gettext("could not verify fs " 21115ee84fbdSgjelinek "%s: could not access %s: %s\n"), fstab.zone_fs_dir, 2112b5abaf04Sgjelinek fstab.zone_fs_raw, strerror(errno)); 2113b5abaf04Sgjelinek return_code = Z_ERR; 2114b5abaf04Sgjelinek goto next_fs; 2115b5abaf04Sgjelinek } 21167c478bd9Sstevel@tonic-gate next_fs: 21177c478bd9Sstevel@tonic-gate zonecfg_free_fs_option_list(fstab.zone_fs_options); 21187c478bd9Sstevel@tonic-gate } 21197c478bd9Sstevel@tonic-gate (void) zonecfg_endfsent(handle); 21207c478bd9Sstevel@tonic-gate 21217c478bd9Sstevel@tonic-gate return (return_code); 21227c478bd9Sstevel@tonic-gate } 21237c478bd9Sstevel@tonic-gate 21247c478bd9Sstevel@tonic-gate static int 2125ffbafc53Scomay verify_limitpriv(zone_dochandle_t handle) 2126ffbafc53Scomay { 2127ffbafc53Scomay char *privname = NULL; 2128ffbafc53Scomay int err; 2129ffbafc53Scomay priv_set_t *privs; 2130ffbafc53Scomay 2131ffbafc53Scomay if ((privs = priv_allocset()) == NULL) { 2132ffbafc53Scomay zperror(gettext("failed to allocate privilege set"), B_FALSE); 2133ffbafc53Scomay return (Z_NOMEM); 2134ffbafc53Scomay } 2135ffbafc53Scomay err = zonecfg_get_privset(handle, privs, &privname); 2136ffbafc53Scomay switch (err) { 2137ffbafc53Scomay case Z_OK: 2138ffbafc53Scomay break; 2139ffbafc53Scomay case Z_PRIV_PROHIBITED: 2140ffbafc53Scomay (void) fprintf(stderr, gettext("privilege \"%s\" is not " 2141ffbafc53Scomay "permitted within the zone's privilege set\n"), privname); 2142ffbafc53Scomay break; 2143ffbafc53Scomay case Z_PRIV_REQUIRED: 2144ffbafc53Scomay (void) fprintf(stderr, gettext("required privilege \"%s\" is " 2145ffbafc53Scomay "missing from the zone's privilege set\n"), privname); 2146ffbafc53Scomay break; 2147ffbafc53Scomay case Z_PRIV_UNKNOWN: 2148ffbafc53Scomay (void) fprintf(stderr, gettext("unknown privilege \"%s\" " 2149ffbafc53Scomay "specified in the zone's privilege set\n"), privname); 2150ffbafc53Scomay break; 2151ffbafc53Scomay default: 2152ffbafc53Scomay zperror( 2153ffbafc53Scomay gettext("failed to determine the zone's privilege set"), 2154ffbafc53Scomay B_TRUE); 2155ffbafc53Scomay break; 2156ffbafc53Scomay } 2157ffbafc53Scomay free(privname); 2158ffbafc53Scomay priv_freeset(privs); 2159ffbafc53Scomay return (err); 2160ffbafc53Scomay } 2161ffbafc53Scomay 21621390a385Sgjelinek static void 21631390a385Sgjelinek free_local_netifs(int if_cnt, struct net_if **if_list) 21641390a385Sgjelinek { 21651390a385Sgjelinek int i; 21661390a385Sgjelinek 21671390a385Sgjelinek for (i = 0; i < if_cnt; i++) { 21681390a385Sgjelinek free(if_list[i]->name); 21691390a385Sgjelinek free(if_list[i]); 21701390a385Sgjelinek } 21711390a385Sgjelinek free(if_list); 21721390a385Sgjelinek } 21731390a385Sgjelinek 21741390a385Sgjelinek /* 21751390a385Sgjelinek * Get a list of the network interfaces, along with their address families, 21761390a385Sgjelinek * that are plumbed in the global zone. See if_tcp(7p) for a description 21771390a385Sgjelinek * of the ioctls used here. 21781390a385Sgjelinek */ 21791390a385Sgjelinek static int 21801390a385Sgjelinek get_local_netifs(int *if_cnt, struct net_if ***if_list) 21811390a385Sgjelinek { 21821390a385Sgjelinek int s; 21831390a385Sgjelinek int i; 21841390a385Sgjelinek int res = Z_OK; 21851390a385Sgjelinek int space_needed; 21861390a385Sgjelinek int cnt = 0; 21871390a385Sgjelinek struct lifnum if_num; 21881390a385Sgjelinek struct lifconf if_conf; 21891390a385Sgjelinek struct lifreq *if_reqp; 21901390a385Sgjelinek char *if_buf; 21911390a385Sgjelinek struct net_if **local_ifs = NULL; 21921390a385Sgjelinek 21931390a385Sgjelinek *if_cnt = 0; 21941390a385Sgjelinek *if_list = NULL; 21951390a385Sgjelinek 21961390a385Sgjelinek if ((s = socket(SOCKET_AF(AF_INET), SOCK_DGRAM, 0)) < 0) 21971390a385Sgjelinek return (Z_ERR); 21981390a385Sgjelinek 21991390a385Sgjelinek /* 22001390a385Sgjelinek * Come back here in the unlikely event that the number of interfaces 22011390a385Sgjelinek * increases between the time we get the count and the time we do the 22021390a385Sgjelinek * SIOCGLIFCONF ioctl. 22031390a385Sgjelinek */ 22041390a385Sgjelinek retry: 22051390a385Sgjelinek /* Get the number of interfaces. */ 22061390a385Sgjelinek if_num.lifn_family = AF_UNSPEC; 22071390a385Sgjelinek if_num.lifn_flags = LIFC_NOXMIT; 22081390a385Sgjelinek if (ioctl(s, SIOCGLIFNUM, &if_num) < 0) { 22091390a385Sgjelinek (void) close(s); 22101390a385Sgjelinek return (Z_ERR); 22111390a385Sgjelinek } 22121390a385Sgjelinek 22131390a385Sgjelinek /* Get the interface configuration list. */ 22141390a385Sgjelinek space_needed = if_num.lifn_count * sizeof (struct lifreq); 22151390a385Sgjelinek if ((if_buf = malloc(space_needed)) == NULL) { 22161390a385Sgjelinek (void) close(s); 22171390a385Sgjelinek return (Z_ERR); 22181390a385Sgjelinek } 22191390a385Sgjelinek if_conf.lifc_family = AF_UNSPEC; 22201390a385Sgjelinek if_conf.lifc_flags = LIFC_NOXMIT; 22211390a385Sgjelinek if_conf.lifc_len = space_needed; 22221390a385Sgjelinek if_conf.lifc_buf = if_buf; 22231390a385Sgjelinek if (ioctl(s, SIOCGLIFCONF, &if_conf) < 0) { 22241390a385Sgjelinek free(if_buf); 22251390a385Sgjelinek /* 22261390a385Sgjelinek * SIOCGLIFCONF returns EINVAL if the buffer we passed in is 22271390a385Sgjelinek * too small. In this case go back and get the new if cnt. 22281390a385Sgjelinek */ 22291390a385Sgjelinek if (errno == EINVAL) 22301390a385Sgjelinek goto retry; 22311390a385Sgjelinek 22321390a385Sgjelinek (void) close(s); 22331390a385Sgjelinek return (Z_ERR); 22341390a385Sgjelinek } 22351390a385Sgjelinek (void) close(s); 22361390a385Sgjelinek 22371390a385Sgjelinek /* Get the name and address family for each interface. */ 22381390a385Sgjelinek if_reqp = if_conf.lifc_req; 22391390a385Sgjelinek for (i = 0; i < (if_conf.lifc_len / sizeof (struct lifreq)); i++) { 22401390a385Sgjelinek struct net_if **p; 22411390a385Sgjelinek struct lifreq req; 22421390a385Sgjelinek 22431390a385Sgjelinek if (strcmp(LOOPBACK_IF, if_reqp->lifr_name) == 0) { 22441390a385Sgjelinek if_reqp++; 22451390a385Sgjelinek continue; 22461390a385Sgjelinek } 22471390a385Sgjelinek 22481390a385Sgjelinek if ((s = socket(SOCKET_AF(if_reqp->lifr_addr.ss_family), 22491390a385Sgjelinek SOCK_DGRAM, 0)) == -1) { 22501390a385Sgjelinek res = Z_ERR; 22511390a385Sgjelinek break; 22521390a385Sgjelinek } 22531390a385Sgjelinek 22541390a385Sgjelinek (void) strncpy(req.lifr_name, if_reqp->lifr_name, 22551390a385Sgjelinek sizeof (req.lifr_name)); 22561390a385Sgjelinek if (ioctl(s, SIOCGLIFADDR, &req) < 0) { 22571390a385Sgjelinek (void) close(s); 22581390a385Sgjelinek if_reqp++; 22591390a385Sgjelinek continue; 22601390a385Sgjelinek } 22611390a385Sgjelinek 22621390a385Sgjelinek if ((p = (struct net_if **)realloc(local_ifs, 22631390a385Sgjelinek sizeof (struct net_if *) * (cnt + 1))) == NULL) { 22641390a385Sgjelinek res = Z_ERR; 22651390a385Sgjelinek break; 22661390a385Sgjelinek } 22671390a385Sgjelinek local_ifs = p; 22681390a385Sgjelinek 22691390a385Sgjelinek if ((local_ifs[cnt] = malloc(sizeof (struct net_if))) == NULL) { 22701390a385Sgjelinek res = Z_ERR; 22711390a385Sgjelinek break; 22721390a385Sgjelinek } 22731390a385Sgjelinek 22741390a385Sgjelinek if ((local_ifs[cnt]->name = strdup(if_reqp->lifr_name)) 22751390a385Sgjelinek == NULL) { 22761390a385Sgjelinek free(local_ifs[cnt]); 22771390a385Sgjelinek res = Z_ERR; 22781390a385Sgjelinek break; 22791390a385Sgjelinek } 22801390a385Sgjelinek local_ifs[cnt]->af = req.lifr_addr.ss_family; 22811390a385Sgjelinek cnt++; 22821390a385Sgjelinek 22831390a385Sgjelinek (void) close(s); 22841390a385Sgjelinek if_reqp++; 22851390a385Sgjelinek } 22861390a385Sgjelinek 22871390a385Sgjelinek free(if_buf); 22881390a385Sgjelinek 22891390a385Sgjelinek if (res != Z_OK) { 22901390a385Sgjelinek free_local_netifs(cnt, local_ifs); 22911390a385Sgjelinek } else { 22921390a385Sgjelinek *if_cnt = cnt; 22931390a385Sgjelinek *if_list = local_ifs; 22941390a385Sgjelinek } 22951390a385Sgjelinek 22961390a385Sgjelinek return (res); 22971390a385Sgjelinek } 22981390a385Sgjelinek 22991390a385Sgjelinek static char * 23001390a385Sgjelinek af2str(int af) 23011390a385Sgjelinek { 23021390a385Sgjelinek switch (af) { 23031390a385Sgjelinek case AF_INET: 23041390a385Sgjelinek return ("IPv4"); 23051390a385Sgjelinek case AF_INET6: 23061390a385Sgjelinek return ("IPv6"); 23071390a385Sgjelinek default: 23081390a385Sgjelinek return ("Unknown"); 23091390a385Sgjelinek } 23101390a385Sgjelinek } 23111390a385Sgjelinek 23121390a385Sgjelinek /* 23131390a385Sgjelinek * Cross check the network interface name and address family with the 23141390a385Sgjelinek * interfaces that are set up in the global zone so that we can print the 23151390a385Sgjelinek * appropriate error message. 23161390a385Sgjelinek */ 23171390a385Sgjelinek static void 23181390a385Sgjelinek print_net_err(char *phys, char *addr, int af, char *msg) 23191390a385Sgjelinek { 23201390a385Sgjelinek int i; 23211390a385Sgjelinek int local_if_cnt = 0; 23221390a385Sgjelinek struct net_if **local_ifs = NULL; 23231390a385Sgjelinek boolean_t found_if = B_FALSE; 23241390a385Sgjelinek boolean_t found_af = B_FALSE; 23251390a385Sgjelinek 23261390a385Sgjelinek if (get_local_netifs(&local_if_cnt, &local_ifs) != Z_OK) { 23271390a385Sgjelinek (void) fprintf(stderr, 23281390a385Sgjelinek gettext("could not verify %s %s=%s %s=%s\n\t%s\n"), 23291390a385Sgjelinek "net", "address", addr, "physical", phys, msg); 23301390a385Sgjelinek return; 23311390a385Sgjelinek } 23321390a385Sgjelinek 23331390a385Sgjelinek for (i = 0; i < local_if_cnt; i++) { 23341390a385Sgjelinek if (strcmp(phys, local_ifs[i]->name) == 0) { 23351390a385Sgjelinek found_if = B_TRUE; 23361390a385Sgjelinek if (af == local_ifs[i]->af) { 23371390a385Sgjelinek found_af = B_TRUE; 23381390a385Sgjelinek break; 23391390a385Sgjelinek } 23401390a385Sgjelinek } 23411390a385Sgjelinek } 23421390a385Sgjelinek 23431390a385Sgjelinek free_local_netifs(local_if_cnt, local_ifs); 23441390a385Sgjelinek 23451390a385Sgjelinek if (!found_if) { 23461390a385Sgjelinek (void) fprintf(stderr, 23471390a385Sgjelinek gettext("could not verify %s %s=%s\n\t" 23481390a385Sgjelinek "network interface %s is not plumbed in the global zone\n"), 23491390a385Sgjelinek "net", "physical", phys, phys); 23501390a385Sgjelinek return; 23511390a385Sgjelinek } 23521390a385Sgjelinek 23531390a385Sgjelinek /* 23541390a385Sgjelinek * Print this error if we were unable to find the address family 23551390a385Sgjelinek * for this interface. If the af variable is not initialized to 23561390a385Sgjelinek * to something meaningful by the caller (not AF_UNSPEC) then we 23571390a385Sgjelinek * also skip this message since it wouldn't be informative. 23581390a385Sgjelinek */ 23591390a385Sgjelinek if (!found_af && af != AF_UNSPEC) { 23601390a385Sgjelinek (void) fprintf(stderr, 23611390a385Sgjelinek gettext("could not verify %s %s=%s %s=%s\n\tthe %s address " 23621390a385Sgjelinek "family is not configured on this interface in the\n\t" 23631390a385Sgjelinek "global zone\n"), 23641390a385Sgjelinek "net", "address", addr, "physical", phys, af2str(af)); 23651390a385Sgjelinek return; 23661390a385Sgjelinek } 23671390a385Sgjelinek 23681390a385Sgjelinek (void) fprintf(stderr, 23691390a385Sgjelinek gettext("could not verify %s %s=%s %s=%s\n\t%s\n"), 23701390a385Sgjelinek "net", "address", addr, "physical", phys, msg); 23711390a385Sgjelinek } 23721390a385Sgjelinek 2373ffbafc53Scomay static int 23747c478bd9Sstevel@tonic-gate verify_details(int cmd_num) 23757c478bd9Sstevel@tonic-gate { 23767c478bd9Sstevel@tonic-gate zone_dochandle_t handle; 23777c478bd9Sstevel@tonic-gate struct zone_nwiftab nwiftab; 23787c478bd9Sstevel@tonic-gate char zonepath[MAXPATHLEN], checkpath[MAXPATHLEN]; 23797c478bd9Sstevel@tonic-gate int return_code = Z_OK; 23807c478bd9Sstevel@tonic-gate int err; 2381108322fbScarlsonj boolean_t in_alt_root; 23827c478bd9Sstevel@tonic-gate 23837c478bd9Sstevel@tonic-gate if ((handle = zonecfg_init_handle()) == NULL) { 23847c478bd9Sstevel@tonic-gate zperror(cmd_to_str(cmd_num), B_TRUE); 23857c478bd9Sstevel@tonic-gate return (Z_ERR); 23867c478bd9Sstevel@tonic-gate } 23877c478bd9Sstevel@tonic-gate if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) { 23887c478bd9Sstevel@tonic-gate errno = err; 23897c478bd9Sstevel@tonic-gate zperror(cmd_to_str(cmd_num), B_TRUE); 23907c478bd9Sstevel@tonic-gate zonecfg_fini_handle(handle); 23917c478bd9Sstevel@tonic-gate return (Z_ERR); 23927c478bd9Sstevel@tonic-gate } 23937c478bd9Sstevel@tonic-gate if ((err = zonecfg_get_zonepath(handle, zonepath, sizeof (zonepath))) != 23947c478bd9Sstevel@tonic-gate Z_OK) { 23957c478bd9Sstevel@tonic-gate errno = err; 23967c478bd9Sstevel@tonic-gate zperror(cmd_to_str(cmd_num), B_TRUE); 23977c478bd9Sstevel@tonic-gate zonecfg_fini_handle(handle); 23987c478bd9Sstevel@tonic-gate return (Z_ERR); 23997c478bd9Sstevel@tonic-gate } 24007c478bd9Sstevel@tonic-gate /* 24017c478bd9Sstevel@tonic-gate * zonecfg_get_zonepath() gets its data from the XML repository. 24027c478bd9Sstevel@tonic-gate * Verify this against the index file, which is checked first by 24037c478bd9Sstevel@tonic-gate * zone_get_zonepath(). If they don't match, bail out. 24047c478bd9Sstevel@tonic-gate */ 24057c478bd9Sstevel@tonic-gate if ((err = zone_get_zonepath(target_zone, checkpath, 24067c478bd9Sstevel@tonic-gate sizeof (checkpath))) != Z_OK) { 24077c478bd9Sstevel@tonic-gate errno = err; 24087c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not get zone path")); 24097c478bd9Sstevel@tonic-gate return (Z_ERR); 24107c478bd9Sstevel@tonic-gate } 24117c478bd9Sstevel@tonic-gate if (strcmp(zonepath, checkpath) != 0) { 24125ee84fbdSgjelinek /* 24135ee84fbdSgjelinek * TRANSLATION_NOTE 24145ee84fbdSgjelinek * XML and zonepath are literals that should not be translated. 24155ee84fbdSgjelinek */ 24167c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("The XML repository has " 24177c478bd9Sstevel@tonic-gate "zonepath '%s',\nbut the index file has zonepath '%s'.\n" 24187c478bd9Sstevel@tonic-gate "These must match, so fix the incorrect entry.\n"), 24197c478bd9Sstevel@tonic-gate zonepath, checkpath); 24207c478bd9Sstevel@tonic-gate return (Z_ERR); 24217c478bd9Sstevel@tonic-gate } 24227c478bd9Sstevel@tonic-gate if (validate_zonepath(zonepath, cmd_num) != Z_OK) { 24237c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("could not verify zonepath %s " 24247c478bd9Sstevel@tonic-gate "because of the above errors.\n"), zonepath); 24257c478bd9Sstevel@tonic-gate return_code = Z_ERR; 24267c478bd9Sstevel@tonic-gate } 24277c478bd9Sstevel@tonic-gate 2428108322fbScarlsonj in_alt_root = zonecfg_in_alt_root(); 2429108322fbScarlsonj if (in_alt_root) 2430108322fbScarlsonj goto no_net; 2431108322fbScarlsonj 24327c478bd9Sstevel@tonic-gate if ((err = zonecfg_setnwifent(handle)) != Z_OK) { 24337c478bd9Sstevel@tonic-gate errno = err; 24347c478bd9Sstevel@tonic-gate zperror(cmd_to_str(cmd_num), B_TRUE); 24357c478bd9Sstevel@tonic-gate zonecfg_fini_handle(handle); 24367c478bd9Sstevel@tonic-gate return (Z_ERR); 24377c478bd9Sstevel@tonic-gate } 24387c478bd9Sstevel@tonic-gate while (zonecfg_getnwifent(handle, &nwiftab) == Z_OK) { 24397c478bd9Sstevel@tonic-gate struct lifreq lifr; 24401390a385Sgjelinek sa_family_t af = AF_UNSPEC; 24417c478bd9Sstevel@tonic-gate int so, res; 24427c478bd9Sstevel@tonic-gate 24437c478bd9Sstevel@tonic-gate /* skip any loopback interfaces */ 24447c478bd9Sstevel@tonic-gate if (strcmp(nwiftab.zone_nwif_physical, "lo0") == 0) 24457c478bd9Sstevel@tonic-gate continue; 24467c478bd9Sstevel@tonic-gate if ((res = zonecfg_valid_net_address(nwiftab.zone_nwif_address, 24477c478bd9Sstevel@tonic-gate &lifr)) != Z_OK) { 24481390a385Sgjelinek print_net_err(nwiftab.zone_nwif_physical, 24491390a385Sgjelinek nwiftab.zone_nwif_address, af, 24501390a385Sgjelinek zonecfg_strerror(res)); 24517c478bd9Sstevel@tonic-gate return_code = Z_ERR; 24527c478bd9Sstevel@tonic-gate continue; 24537c478bd9Sstevel@tonic-gate } 24547c478bd9Sstevel@tonic-gate af = lifr.lifr_addr.ss_family; 24557c478bd9Sstevel@tonic-gate (void) memset(&lifr, 0, sizeof (lifr)); 24567c478bd9Sstevel@tonic-gate (void) strlcpy(lifr.lifr_name, nwiftab.zone_nwif_physical, 24577c478bd9Sstevel@tonic-gate sizeof (lifr.lifr_name)); 24587c478bd9Sstevel@tonic-gate lifr.lifr_addr.ss_family = af; 24597c478bd9Sstevel@tonic-gate if ((so = socket(af, SOCK_DGRAM, 0)) < 0) { 24607c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("could not verify %s " 24617c478bd9Sstevel@tonic-gate "%s=%s %s=%s: could not get socket: %s\n"), "net", 24627c478bd9Sstevel@tonic-gate "address", nwiftab.zone_nwif_address, "physical", 24637c478bd9Sstevel@tonic-gate nwiftab.zone_nwif_physical, strerror(errno)); 24647c478bd9Sstevel@tonic-gate return_code = Z_ERR; 24657c478bd9Sstevel@tonic-gate continue; 24667c478bd9Sstevel@tonic-gate } 24671390a385Sgjelinek if (ioctl(so, SIOCGLIFFLAGS, &lifr) < 0) { 24681390a385Sgjelinek print_net_err(nwiftab.zone_nwif_physical, 24691390a385Sgjelinek nwiftab.zone_nwif_address, af, 24707c478bd9Sstevel@tonic-gate strerror(errno)); 24717c478bd9Sstevel@tonic-gate return_code = Z_ERR; 24727c478bd9Sstevel@tonic-gate } 24737c478bd9Sstevel@tonic-gate (void) close(so); 24747c478bd9Sstevel@tonic-gate } 24757c478bd9Sstevel@tonic-gate (void) zonecfg_endnwifent(handle); 2476108322fbScarlsonj no_net: 24777c478bd9Sstevel@tonic-gate 2478*e7f3c547Sgjelinek /* verify that lofs has not been excluded from the kernel */ 2479*e7f3c547Sgjelinek if (modctl(MODLOAD, 1, "fs/lofs", NULL) != 0) { 2480*e7f3c547Sgjelinek if (errno == ENXIO) 2481*e7f3c547Sgjelinek (void) fprintf(stderr, gettext("could not verify " 2482*e7f3c547Sgjelinek "lofs(7FS): possibly excluded in /etc/system\n")); 2483*e7f3c547Sgjelinek else 2484*e7f3c547Sgjelinek (void) fprintf(stderr, gettext("could not verify " 2485*e7f3c547Sgjelinek "lofs(7FS): %s\n"), strerror(errno)); 2486*e7f3c547Sgjelinek return_code = Z_ERR; 2487*e7f3c547Sgjelinek } 2488*e7f3c547Sgjelinek 24897c478bd9Sstevel@tonic-gate if (verify_filesystems(handle) != Z_OK) 24907c478bd9Sstevel@tonic-gate return_code = Z_ERR; 2491b5abaf04Sgjelinek if (verify_ipd(handle) != Z_OK) 2492b5abaf04Sgjelinek return_code = Z_ERR; 2493108322fbScarlsonj if (!in_alt_root && verify_rctls(handle) != Z_OK) 24947c478bd9Sstevel@tonic-gate return_code = Z_ERR; 2495108322fbScarlsonj if (!in_alt_root && verify_pool(handle) != Z_OK) 24967c478bd9Sstevel@tonic-gate return_code = Z_ERR; 2497fa9e4066Sahrens if (!in_alt_root && verify_datasets(handle) != Z_OK) 2498fa9e4066Sahrens return_code = Z_ERR; 2499ffbafc53Scomay 2500ffbafc53Scomay /* 2501ffbafc53Scomay * As the "mount" command is used for patching/upgrading of zones 2502ffbafc53Scomay * or other maintenance processes, the zone's privilege set is not 2503ffbafc53Scomay * checked in this case. Instead, the default, safe set of 2504ffbafc53Scomay * privileges will be used when this zone is created in the 2505ffbafc53Scomay * kernel. 2506ffbafc53Scomay */ 2507ffbafc53Scomay if (!in_alt_root && cmd_num != CMD_MOUNT && 2508ffbafc53Scomay verify_limitpriv(handle) != Z_OK) 2509ffbafc53Scomay return_code = Z_ERR; 25107c478bd9Sstevel@tonic-gate zonecfg_fini_handle(handle); 25117c478bd9Sstevel@tonic-gate if (return_code == Z_ERR) 25127c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 25137c478bd9Sstevel@tonic-gate gettext("%s: zone %s failed to verify\n"), 25147c478bd9Sstevel@tonic-gate execname, target_zone); 25157c478bd9Sstevel@tonic-gate return (return_code); 25167c478bd9Sstevel@tonic-gate } 25177c478bd9Sstevel@tonic-gate 25187c478bd9Sstevel@tonic-gate static int 25197c478bd9Sstevel@tonic-gate verify_func(int argc, char *argv[]) 25207c478bd9Sstevel@tonic-gate { 25217c478bd9Sstevel@tonic-gate int arg; 25227c478bd9Sstevel@tonic-gate 25237c478bd9Sstevel@tonic-gate optind = 0; 25247c478bd9Sstevel@tonic-gate if ((arg = getopt(argc, argv, "?")) != EOF) { 25257c478bd9Sstevel@tonic-gate switch (arg) { 25267c478bd9Sstevel@tonic-gate case '?': 25277c478bd9Sstevel@tonic-gate sub_usage(SHELP_VERIFY, CMD_VERIFY); 25287c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 25297c478bd9Sstevel@tonic-gate default: 25307c478bd9Sstevel@tonic-gate sub_usage(SHELP_VERIFY, CMD_VERIFY); 25317c478bd9Sstevel@tonic-gate return (Z_USAGE); 25327c478bd9Sstevel@tonic-gate } 25337c478bd9Sstevel@tonic-gate } 25347c478bd9Sstevel@tonic-gate if (argc > optind) { 25357c478bd9Sstevel@tonic-gate sub_usage(SHELP_VERIFY, CMD_VERIFY); 25367c478bd9Sstevel@tonic-gate return (Z_USAGE); 25377c478bd9Sstevel@tonic-gate } 25387c478bd9Sstevel@tonic-gate if (sanity_check(target_zone, CMD_VERIFY, B_FALSE, B_FALSE) != Z_OK) 25397c478bd9Sstevel@tonic-gate return (Z_ERR); 25407c478bd9Sstevel@tonic-gate return (verify_details(CMD_VERIFY)); 25417c478bd9Sstevel@tonic-gate } 25427c478bd9Sstevel@tonic-gate 25437c478bd9Sstevel@tonic-gate #define LUCREATEZONE "/usr/lib/lu/lucreatezone" 25447c478bd9Sstevel@tonic-gate 25457c478bd9Sstevel@tonic-gate static int 25467c478bd9Sstevel@tonic-gate install_func(int argc, char *argv[]) 25477c478bd9Sstevel@tonic-gate { 25487c478bd9Sstevel@tonic-gate /* 9: "exec " and " -z " */ 25497c478bd9Sstevel@tonic-gate char cmdbuf[sizeof (LUCREATEZONE) + ZONENAME_MAX + 9]; 25507c478bd9Sstevel@tonic-gate int lockfd; 25517c478bd9Sstevel@tonic-gate int err, arg; 25527c478bd9Sstevel@tonic-gate char zonepath[MAXPATHLEN]; 25537c478bd9Sstevel@tonic-gate int status; 25540b5de56dSgjelinek boolean_t nodataset = B_FALSE; 25557c478bd9Sstevel@tonic-gate 2556108322fbScarlsonj if (zonecfg_in_alt_root()) { 2557108322fbScarlsonj zerror(gettext("cannot install zone in alternate root")); 2558108322fbScarlsonj return (Z_ERR); 2559108322fbScarlsonj } 2560108322fbScarlsonj 25617c478bd9Sstevel@tonic-gate optind = 0; 25620b5de56dSgjelinek if ((arg = getopt(argc, argv, "?x:")) != EOF) { 25637c478bd9Sstevel@tonic-gate switch (arg) { 25647c478bd9Sstevel@tonic-gate case '?': 25657c478bd9Sstevel@tonic-gate sub_usage(SHELP_INSTALL, CMD_INSTALL); 25667c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 25670b5de56dSgjelinek case 'x': 25680b5de56dSgjelinek if (strcmp(optarg, "nodataset") != 0) { 25690b5de56dSgjelinek sub_usage(SHELP_INSTALL, CMD_INSTALL); 25700b5de56dSgjelinek return (Z_USAGE); 25710b5de56dSgjelinek } 25720b5de56dSgjelinek nodataset = B_TRUE; 25730b5de56dSgjelinek break; 25747c478bd9Sstevel@tonic-gate default: 25757c478bd9Sstevel@tonic-gate sub_usage(SHELP_INSTALL, CMD_INSTALL); 25767c478bd9Sstevel@tonic-gate return (Z_USAGE); 25777c478bd9Sstevel@tonic-gate } 25787c478bd9Sstevel@tonic-gate } 25797c478bd9Sstevel@tonic-gate if (argc > optind) { 25807c478bd9Sstevel@tonic-gate sub_usage(SHELP_INSTALL, CMD_INSTALL); 25817c478bd9Sstevel@tonic-gate return (Z_USAGE); 25827c478bd9Sstevel@tonic-gate } 25837c478bd9Sstevel@tonic-gate if (sanity_check(target_zone, CMD_INSTALL, B_FALSE, B_TRUE) != Z_OK) 25847c478bd9Sstevel@tonic-gate return (Z_ERR); 25857c478bd9Sstevel@tonic-gate if (verify_details(CMD_INSTALL) != Z_OK) 25867c478bd9Sstevel@tonic-gate return (Z_ERR); 25877c478bd9Sstevel@tonic-gate 25887c478bd9Sstevel@tonic-gate if (grab_lock_file(target_zone, &lockfd) != Z_OK) { 25897c478bd9Sstevel@tonic-gate zerror(gettext("another %s may have an operation in progress."), 2590865e09a4Sgjelinek "zoneadm"); 25917c478bd9Sstevel@tonic-gate return (Z_ERR); 25927c478bd9Sstevel@tonic-gate } 25937c478bd9Sstevel@tonic-gate err = zone_set_state(target_zone, ZONE_STATE_INCOMPLETE); 25947c478bd9Sstevel@tonic-gate if (err != Z_OK) { 25957c478bd9Sstevel@tonic-gate errno = err; 25967c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not set state")); 25977c478bd9Sstevel@tonic-gate goto done; 25987c478bd9Sstevel@tonic-gate } 25997c478bd9Sstevel@tonic-gate 26007c478bd9Sstevel@tonic-gate /* 26017c478bd9Sstevel@tonic-gate * According to the Application Packaging Developer's Guide, a 26027c478bd9Sstevel@tonic-gate * "checkinstall" script when included in a package is executed as 26037c478bd9Sstevel@tonic-gate * the user "install", if such a user exists, or by the user 26047c478bd9Sstevel@tonic-gate * "nobody". In order to support this dubious behavior, the path 26057c478bd9Sstevel@tonic-gate * to the zone being constructed is opened up during the life of 26067c478bd9Sstevel@tonic-gate * the command laying down the zone's root file system. Once this 26077c478bd9Sstevel@tonic-gate * has completed, regardless of whether it was successful, the 26087c478bd9Sstevel@tonic-gate * path to the zone is again restricted. 26097c478bd9Sstevel@tonic-gate */ 26107c478bd9Sstevel@tonic-gate if ((err = zone_get_zonepath(target_zone, zonepath, 26117c478bd9Sstevel@tonic-gate sizeof (zonepath))) != Z_OK) { 26127c478bd9Sstevel@tonic-gate errno = err; 26137c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not get zone path")); 26147c478bd9Sstevel@tonic-gate goto done; 26157c478bd9Sstevel@tonic-gate } 26160b5de56dSgjelinek 26170b5de56dSgjelinek if (!nodataset) 26180b5de56dSgjelinek create_zfs_zonepath(zonepath); 26190b5de56dSgjelinek 26207c478bd9Sstevel@tonic-gate if (chmod(zonepath, DEFAULT_DIR_MODE) != 0) { 26217c478bd9Sstevel@tonic-gate zperror(zonepath, B_FALSE); 26227c478bd9Sstevel@tonic-gate err = Z_ERR; 26237c478bd9Sstevel@tonic-gate goto done; 26247c478bd9Sstevel@tonic-gate } 26257c478bd9Sstevel@tonic-gate 26267c478bd9Sstevel@tonic-gate /* 26277c478bd9Sstevel@tonic-gate * "exec" the command so that the returned status is that of 26287c478bd9Sstevel@tonic-gate * LUCREATEZONE and not the shell. 26297c478bd9Sstevel@tonic-gate */ 26307c478bd9Sstevel@tonic-gate (void) snprintf(cmdbuf, sizeof (cmdbuf), "exec " LUCREATEZONE " -z %s", 26317c478bd9Sstevel@tonic-gate target_zone); 26327c478bd9Sstevel@tonic-gate status = do_subproc(cmdbuf); 26337c478bd9Sstevel@tonic-gate if (chmod(zonepath, S_IRWXU) != 0) { 26347c478bd9Sstevel@tonic-gate zperror(zonepath, B_FALSE); 26357c478bd9Sstevel@tonic-gate err = Z_ERR; 26367c478bd9Sstevel@tonic-gate goto done; 26377c478bd9Sstevel@tonic-gate } 26387c478bd9Sstevel@tonic-gate if ((err = subproc_status(LUCREATEZONE, status)) != Z_OK) 26397c478bd9Sstevel@tonic-gate goto done; 26407c478bd9Sstevel@tonic-gate 26417c478bd9Sstevel@tonic-gate if ((err = zone_set_state(target_zone, ZONE_STATE_INSTALLED)) != Z_OK) { 26427c478bd9Sstevel@tonic-gate errno = err; 26437c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not set state")); 26447c478bd9Sstevel@tonic-gate goto done; 26457c478bd9Sstevel@tonic-gate } 26467c478bd9Sstevel@tonic-gate 26477c478bd9Sstevel@tonic-gate done: 26487c478bd9Sstevel@tonic-gate release_lock_file(lockfd); 26497c478bd9Sstevel@tonic-gate return ((err == Z_OK) ? Z_OK : Z_ERR); 26507c478bd9Sstevel@tonic-gate } 26517c478bd9Sstevel@tonic-gate 26527c478bd9Sstevel@tonic-gate /* 2653865e09a4Sgjelinek * Check that the inherited pkg dirs are the same for the clone and its source. 2654865e09a4Sgjelinek * The easiest way to do that is check that the list of ipds is the same 2655865e09a4Sgjelinek * by matching each one against the other. This algorithm should be fine since 2656865e09a4Sgjelinek * the list of ipds should not be that long. 2657865e09a4Sgjelinek */ 2658865e09a4Sgjelinek static int 2659865e09a4Sgjelinek valid_ipd_clone(zone_dochandle_t s_handle, char *source_zone, 2660865e09a4Sgjelinek zone_dochandle_t t_handle, char *target_zone) 2661865e09a4Sgjelinek { 2662865e09a4Sgjelinek int err; 2663865e09a4Sgjelinek int res = Z_OK; 2664865e09a4Sgjelinek int s_cnt = 0; 2665865e09a4Sgjelinek int t_cnt = 0; 2666865e09a4Sgjelinek struct zone_fstab s_fstab; 2667865e09a4Sgjelinek struct zone_fstab t_fstab; 2668865e09a4Sgjelinek 2669865e09a4Sgjelinek /* 2670865e09a4Sgjelinek * First check the source of the clone against the target. 2671865e09a4Sgjelinek */ 2672865e09a4Sgjelinek if ((err = zonecfg_setipdent(s_handle)) != Z_OK) { 2673865e09a4Sgjelinek errno = err; 2674865e09a4Sgjelinek zperror2(source_zone, gettext("could not enumerate " 2675865e09a4Sgjelinek "inherit-pkg-dirs")); 2676865e09a4Sgjelinek return (Z_ERR); 2677865e09a4Sgjelinek } 2678865e09a4Sgjelinek 2679865e09a4Sgjelinek while (zonecfg_getipdent(s_handle, &s_fstab) == Z_OK) { 2680865e09a4Sgjelinek boolean_t match = B_FALSE; 2681865e09a4Sgjelinek 2682865e09a4Sgjelinek s_cnt++; 2683865e09a4Sgjelinek 2684865e09a4Sgjelinek if ((err = zonecfg_setipdent(t_handle)) != Z_OK) { 2685865e09a4Sgjelinek errno = err; 2686865e09a4Sgjelinek zperror2(target_zone, gettext("could not enumerate " 2687865e09a4Sgjelinek "inherit-pkg-dirs")); 2688865e09a4Sgjelinek (void) zonecfg_endipdent(s_handle); 2689865e09a4Sgjelinek return (Z_ERR); 2690865e09a4Sgjelinek } 2691865e09a4Sgjelinek 2692865e09a4Sgjelinek while (zonecfg_getipdent(t_handle, &t_fstab) == Z_OK) { 2693865e09a4Sgjelinek if (strcmp(s_fstab.zone_fs_dir, t_fstab.zone_fs_dir) 2694865e09a4Sgjelinek == 0) { 2695865e09a4Sgjelinek match = B_TRUE; 2696865e09a4Sgjelinek break; 2697865e09a4Sgjelinek } 2698865e09a4Sgjelinek } 2699865e09a4Sgjelinek (void) zonecfg_endipdent(t_handle); 2700865e09a4Sgjelinek 2701865e09a4Sgjelinek if (!match) { 2702865e09a4Sgjelinek (void) fprintf(stderr, gettext("inherit-pkg-dir " 2703865e09a4Sgjelinek "'%s' is not configured in zone %s.\n"), 2704865e09a4Sgjelinek s_fstab.zone_fs_dir, target_zone); 2705865e09a4Sgjelinek res = Z_ERR; 2706865e09a4Sgjelinek } 2707865e09a4Sgjelinek } 2708865e09a4Sgjelinek 2709865e09a4Sgjelinek (void) zonecfg_endipdent(s_handle); 2710865e09a4Sgjelinek 2711865e09a4Sgjelinek /* skip the next check if we already have errors */ 2712865e09a4Sgjelinek if (res == Z_ERR) 2713865e09a4Sgjelinek return (res); 2714865e09a4Sgjelinek 2715865e09a4Sgjelinek /* 2716865e09a4Sgjelinek * Now check the number of ipds in the target so we can verify 2717865e09a4Sgjelinek * that the source is not a subset of the target. 2718865e09a4Sgjelinek */ 2719865e09a4Sgjelinek if ((err = zonecfg_setipdent(t_handle)) != Z_OK) { 2720865e09a4Sgjelinek errno = err; 2721865e09a4Sgjelinek zperror2(target_zone, gettext("could not enumerate " 2722865e09a4Sgjelinek "inherit-pkg-dirs")); 2723865e09a4Sgjelinek return (Z_ERR); 2724865e09a4Sgjelinek } 2725865e09a4Sgjelinek 2726865e09a4Sgjelinek while (zonecfg_getipdent(t_handle, &t_fstab) == Z_OK) 2727865e09a4Sgjelinek t_cnt++; 2728865e09a4Sgjelinek 2729865e09a4Sgjelinek (void) zonecfg_endipdent(t_handle); 2730865e09a4Sgjelinek 2731865e09a4Sgjelinek if (t_cnt != s_cnt) { 2732865e09a4Sgjelinek (void) fprintf(stderr, gettext("Zone %s is configured " 2733865e09a4Sgjelinek "with inherit-pkg-dirs that are not configured in zone " 2734865e09a4Sgjelinek "%s.\n"), target_zone, source_zone); 2735865e09a4Sgjelinek res = Z_ERR; 2736865e09a4Sgjelinek } 2737865e09a4Sgjelinek 2738865e09a4Sgjelinek return (res); 2739865e09a4Sgjelinek } 2740865e09a4Sgjelinek 2741865e09a4Sgjelinek static void 2742865e09a4Sgjelinek warn_dev_match(zone_dochandle_t s_handle, char *source_zone, 2743865e09a4Sgjelinek zone_dochandle_t t_handle, char *target_zone) 2744865e09a4Sgjelinek { 2745865e09a4Sgjelinek int err; 2746865e09a4Sgjelinek struct zone_devtab s_devtab; 2747865e09a4Sgjelinek struct zone_devtab t_devtab; 2748865e09a4Sgjelinek 2749865e09a4Sgjelinek if ((err = zonecfg_setdevent(t_handle)) != Z_OK) { 2750865e09a4Sgjelinek errno = err; 2751865e09a4Sgjelinek zperror2(target_zone, gettext("could not enumerate devices")); 2752865e09a4Sgjelinek return; 2753865e09a4Sgjelinek } 2754865e09a4Sgjelinek 2755865e09a4Sgjelinek while (zonecfg_getdevent(t_handle, &t_devtab) == Z_OK) { 2756865e09a4Sgjelinek if ((err = zonecfg_setdevent(s_handle)) != Z_OK) { 2757865e09a4Sgjelinek errno = err; 2758865e09a4Sgjelinek zperror2(source_zone, 2759865e09a4Sgjelinek gettext("could not enumerate devices")); 2760865e09a4Sgjelinek (void) zonecfg_enddevent(t_handle); 2761865e09a4Sgjelinek return; 2762865e09a4Sgjelinek } 2763865e09a4Sgjelinek 2764865e09a4Sgjelinek while (zonecfg_getdevent(s_handle, &s_devtab) == Z_OK) { 2765865e09a4Sgjelinek /* 2766865e09a4Sgjelinek * Use fnmatch to catch the case where wildcards 2767865e09a4Sgjelinek * were used in one zone and the other has an 2768865e09a4Sgjelinek * explicit entry (e.g. /dev/dsk/c0t0d0s6 vs. 2769865e09a4Sgjelinek * /dev/\*dsk/c0t0d0s6). 2770865e09a4Sgjelinek */ 2771865e09a4Sgjelinek if (fnmatch(t_devtab.zone_dev_match, 2772865e09a4Sgjelinek s_devtab.zone_dev_match, FNM_PATHNAME) == 0 || 2773865e09a4Sgjelinek fnmatch(s_devtab.zone_dev_match, 2774865e09a4Sgjelinek t_devtab.zone_dev_match, FNM_PATHNAME) == 0) { 2775865e09a4Sgjelinek (void) fprintf(stderr, 2776865e09a4Sgjelinek gettext("WARNING: device '%s' " 2777865e09a4Sgjelinek "is configured in both zones.\n"), 2778865e09a4Sgjelinek t_devtab.zone_dev_match); 2779865e09a4Sgjelinek break; 2780865e09a4Sgjelinek } 2781865e09a4Sgjelinek } 2782865e09a4Sgjelinek (void) zonecfg_enddevent(s_handle); 2783865e09a4Sgjelinek } 2784865e09a4Sgjelinek 2785865e09a4Sgjelinek (void) zonecfg_enddevent(t_handle); 2786865e09a4Sgjelinek } 2787865e09a4Sgjelinek 2788865e09a4Sgjelinek /* 2789865e09a4Sgjelinek * Check if the specified mount option (opt) is contained within the 2790865e09a4Sgjelinek * options string. 2791865e09a4Sgjelinek */ 2792865e09a4Sgjelinek static boolean_t 2793865e09a4Sgjelinek opt_match(char *opt, char *options) 2794865e09a4Sgjelinek { 2795865e09a4Sgjelinek char *p; 2796865e09a4Sgjelinek char *lastp; 2797865e09a4Sgjelinek 2798865e09a4Sgjelinek if ((p = strtok_r(options, ",", &lastp)) != NULL) { 2799865e09a4Sgjelinek if (strcmp(p, opt) == 0) 2800865e09a4Sgjelinek return (B_TRUE); 2801865e09a4Sgjelinek while ((p = strtok_r(NULL, ",", &lastp)) != NULL) { 2802865e09a4Sgjelinek if (strcmp(p, opt) == 0) 2803865e09a4Sgjelinek return (B_TRUE); 2804865e09a4Sgjelinek } 2805865e09a4Sgjelinek } 2806865e09a4Sgjelinek 2807865e09a4Sgjelinek return (B_FALSE); 2808865e09a4Sgjelinek } 2809865e09a4Sgjelinek 28100b5de56dSgjelinek #define RW_LOFS "WARNING: read-write lofs file system on '%s' is configured " \ 2811865e09a4Sgjelinek "in both zones.\n" 2812865e09a4Sgjelinek 2813865e09a4Sgjelinek static void 2814865e09a4Sgjelinek print_fs_warnings(struct zone_fstab *s_fstab, struct zone_fstab *t_fstab) 2815865e09a4Sgjelinek { 2816865e09a4Sgjelinek /* 2817865e09a4Sgjelinek * It is ok to have shared lofs mounted fs but we want to warn if 2818865e09a4Sgjelinek * either is rw since this will effect the other zone. 2819865e09a4Sgjelinek */ 2820865e09a4Sgjelinek if (strcmp(t_fstab->zone_fs_type, "lofs") == 0) { 2821865e09a4Sgjelinek zone_fsopt_t *optp; 2822865e09a4Sgjelinek 2823865e09a4Sgjelinek /* The default is rw so no options means rw */ 2824865e09a4Sgjelinek if (t_fstab->zone_fs_options == NULL || 2825865e09a4Sgjelinek s_fstab->zone_fs_options == NULL) { 2826865e09a4Sgjelinek (void) fprintf(stderr, gettext(RW_LOFS), 2827865e09a4Sgjelinek t_fstab->zone_fs_special); 2828865e09a4Sgjelinek return; 2829865e09a4Sgjelinek } 2830865e09a4Sgjelinek 2831865e09a4Sgjelinek for (optp = s_fstab->zone_fs_options; optp != NULL; 2832865e09a4Sgjelinek optp = optp->zone_fsopt_next) { 2833865e09a4Sgjelinek if (opt_match("rw", optp->zone_fsopt_opt)) { 2834865e09a4Sgjelinek (void) fprintf(stderr, gettext(RW_LOFS), 2835865e09a4Sgjelinek s_fstab->zone_fs_special); 2836865e09a4Sgjelinek return; 2837865e09a4Sgjelinek } 2838865e09a4Sgjelinek } 2839865e09a4Sgjelinek 2840865e09a4Sgjelinek for (optp = t_fstab->zone_fs_options; optp != NULL; 2841865e09a4Sgjelinek optp = optp->zone_fsopt_next) { 2842865e09a4Sgjelinek if (opt_match("rw", optp->zone_fsopt_opt)) { 2843865e09a4Sgjelinek (void) fprintf(stderr, gettext(RW_LOFS), 2844865e09a4Sgjelinek t_fstab->zone_fs_special); 2845865e09a4Sgjelinek return; 2846865e09a4Sgjelinek } 2847865e09a4Sgjelinek } 2848865e09a4Sgjelinek 2849865e09a4Sgjelinek return; 2850865e09a4Sgjelinek } 2851865e09a4Sgjelinek 2852865e09a4Sgjelinek /* 2853865e09a4Sgjelinek * TRANSLATION_NOTE 28540b5de56dSgjelinek * The first variable is the file system type and the second is 28550b5de56dSgjelinek * the file system special device. For example, 28560b5de56dSgjelinek * WARNING: ufs file system on '/dev/dsk/c0t0d0s0' ... 2857865e09a4Sgjelinek */ 28580b5de56dSgjelinek (void) fprintf(stderr, gettext("WARNING: %s file system on '%s' " 2859865e09a4Sgjelinek "is configured in both zones.\n"), t_fstab->zone_fs_type, 2860865e09a4Sgjelinek t_fstab->zone_fs_special); 2861865e09a4Sgjelinek } 2862865e09a4Sgjelinek 2863865e09a4Sgjelinek static void 2864865e09a4Sgjelinek warn_fs_match(zone_dochandle_t s_handle, char *source_zone, 2865865e09a4Sgjelinek zone_dochandle_t t_handle, char *target_zone) 2866865e09a4Sgjelinek { 2867865e09a4Sgjelinek int err; 2868865e09a4Sgjelinek struct zone_fstab s_fstab; 2869865e09a4Sgjelinek struct zone_fstab t_fstab; 2870865e09a4Sgjelinek 2871865e09a4Sgjelinek if ((err = zonecfg_setfsent(t_handle)) != Z_OK) { 2872865e09a4Sgjelinek errno = err; 2873865e09a4Sgjelinek zperror2(target_zone, 28740b5de56dSgjelinek gettext("could not enumerate file systems")); 2875865e09a4Sgjelinek return; 2876865e09a4Sgjelinek } 2877865e09a4Sgjelinek 2878865e09a4Sgjelinek while (zonecfg_getfsent(t_handle, &t_fstab) == Z_OK) { 2879865e09a4Sgjelinek if ((err = zonecfg_setfsent(s_handle)) != Z_OK) { 2880865e09a4Sgjelinek errno = err; 2881865e09a4Sgjelinek zperror2(source_zone, 28820b5de56dSgjelinek gettext("could not enumerate file systems")); 2883865e09a4Sgjelinek (void) zonecfg_endfsent(t_handle); 2884865e09a4Sgjelinek return; 2885865e09a4Sgjelinek } 2886865e09a4Sgjelinek 2887865e09a4Sgjelinek while (zonecfg_getfsent(s_handle, &s_fstab) == Z_OK) { 2888865e09a4Sgjelinek if (strcmp(t_fstab.zone_fs_special, 2889865e09a4Sgjelinek s_fstab.zone_fs_special) == 0) { 2890865e09a4Sgjelinek print_fs_warnings(&s_fstab, &t_fstab); 2891865e09a4Sgjelinek break; 2892865e09a4Sgjelinek } 2893865e09a4Sgjelinek } 2894865e09a4Sgjelinek (void) zonecfg_endfsent(s_handle); 2895865e09a4Sgjelinek } 2896865e09a4Sgjelinek 2897865e09a4Sgjelinek (void) zonecfg_endfsent(t_handle); 2898865e09a4Sgjelinek } 2899865e09a4Sgjelinek 2900865e09a4Sgjelinek /* 2901865e09a4Sgjelinek * We don't catch the case where you used the same IP address but 2902865e09a4Sgjelinek * it is not an exact string match. For example, 192.9.0.128 vs. 192.09.0.128. 2903865e09a4Sgjelinek * However, we're not going to worry about that but we will check for 2904865e09a4Sgjelinek * a possible netmask on one of the addresses (e.g. 10.0.0.1 and 10.0.0.1/24) 2905865e09a4Sgjelinek * and handle that case as a match. 2906865e09a4Sgjelinek */ 2907865e09a4Sgjelinek static void 2908865e09a4Sgjelinek warn_ip_match(zone_dochandle_t s_handle, char *source_zone, 2909865e09a4Sgjelinek zone_dochandle_t t_handle, char *target_zone) 2910865e09a4Sgjelinek { 2911865e09a4Sgjelinek int err; 2912865e09a4Sgjelinek struct zone_nwiftab s_nwiftab; 2913865e09a4Sgjelinek struct zone_nwiftab t_nwiftab; 2914865e09a4Sgjelinek 2915865e09a4Sgjelinek if ((err = zonecfg_setnwifent(t_handle)) != Z_OK) { 2916865e09a4Sgjelinek errno = err; 2917865e09a4Sgjelinek zperror2(target_zone, 2918865e09a4Sgjelinek gettext("could not enumerate network interfaces")); 2919865e09a4Sgjelinek return; 2920865e09a4Sgjelinek } 2921865e09a4Sgjelinek 2922865e09a4Sgjelinek while (zonecfg_getnwifent(t_handle, &t_nwiftab) == Z_OK) { 2923865e09a4Sgjelinek char *p; 2924865e09a4Sgjelinek 2925865e09a4Sgjelinek /* remove an (optional) netmask from the address */ 2926865e09a4Sgjelinek if ((p = strchr(t_nwiftab.zone_nwif_address, '/')) != NULL) 2927865e09a4Sgjelinek *p = '\0'; 2928865e09a4Sgjelinek 2929865e09a4Sgjelinek if ((err = zonecfg_setnwifent(s_handle)) != Z_OK) { 2930865e09a4Sgjelinek errno = err; 2931865e09a4Sgjelinek zperror2(source_zone, 2932865e09a4Sgjelinek gettext("could not enumerate network interfaces")); 2933865e09a4Sgjelinek (void) zonecfg_endnwifent(t_handle); 2934865e09a4Sgjelinek return; 2935865e09a4Sgjelinek } 2936865e09a4Sgjelinek 2937865e09a4Sgjelinek while (zonecfg_getnwifent(s_handle, &s_nwiftab) == Z_OK) { 2938865e09a4Sgjelinek /* remove an (optional) netmask from the address */ 2939865e09a4Sgjelinek if ((p = strchr(s_nwiftab.zone_nwif_address, '/')) 2940865e09a4Sgjelinek != NULL) 2941865e09a4Sgjelinek *p = '\0'; 2942865e09a4Sgjelinek 2943865e09a4Sgjelinek if (strcmp(t_nwiftab.zone_nwif_address, 2944865e09a4Sgjelinek s_nwiftab.zone_nwif_address) == 0) { 2945865e09a4Sgjelinek (void) fprintf(stderr, 2946865e09a4Sgjelinek gettext("WARNING: network address '%s' " 2947865e09a4Sgjelinek "is configured in both zones.\n"), 2948865e09a4Sgjelinek t_nwiftab.zone_nwif_address); 2949865e09a4Sgjelinek break; 2950865e09a4Sgjelinek } 2951865e09a4Sgjelinek } 2952865e09a4Sgjelinek (void) zonecfg_endnwifent(s_handle); 2953865e09a4Sgjelinek } 2954865e09a4Sgjelinek 2955865e09a4Sgjelinek (void) zonecfg_endnwifent(t_handle); 2956865e09a4Sgjelinek } 2957865e09a4Sgjelinek 2958865e09a4Sgjelinek static void 2959865e09a4Sgjelinek warn_dataset_match(zone_dochandle_t s_handle, char *source_zone, 2960865e09a4Sgjelinek zone_dochandle_t t_handle, char *target_zone) 2961865e09a4Sgjelinek { 2962865e09a4Sgjelinek int err; 2963865e09a4Sgjelinek struct zone_dstab s_dstab; 2964865e09a4Sgjelinek struct zone_dstab t_dstab; 2965865e09a4Sgjelinek 2966865e09a4Sgjelinek if ((err = zonecfg_setdsent(t_handle)) != Z_OK) { 2967865e09a4Sgjelinek errno = err; 2968865e09a4Sgjelinek zperror2(target_zone, gettext("could not enumerate datasets")); 2969865e09a4Sgjelinek return; 2970865e09a4Sgjelinek } 2971865e09a4Sgjelinek 2972865e09a4Sgjelinek while (zonecfg_getdsent(t_handle, &t_dstab) == Z_OK) { 2973865e09a4Sgjelinek if ((err = zonecfg_setdsent(s_handle)) != Z_OK) { 2974865e09a4Sgjelinek errno = err; 2975865e09a4Sgjelinek zperror2(source_zone, 2976865e09a4Sgjelinek gettext("could not enumerate datasets")); 2977865e09a4Sgjelinek (void) zonecfg_enddsent(t_handle); 2978865e09a4Sgjelinek return; 2979865e09a4Sgjelinek } 2980865e09a4Sgjelinek 2981865e09a4Sgjelinek while (zonecfg_getdsent(s_handle, &s_dstab) == Z_OK) { 2982865e09a4Sgjelinek if (strcmp(t_dstab.zone_dataset_name, 2983865e09a4Sgjelinek s_dstab.zone_dataset_name) == 0) { 2984865e09a4Sgjelinek (void) fprintf(stderr, 2985865e09a4Sgjelinek gettext("WARNING: dataset '%s' " 2986865e09a4Sgjelinek "is configured in both zones.\n"), 2987865e09a4Sgjelinek t_dstab.zone_dataset_name); 2988865e09a4Sgjelinek break; 2989865e09a4Sgjelinek } 2990865e09a4Sgjelinek } 2991865e09a4Sgjelinek (void) zonecfg_enddsent(s_handle); 2992865e09a4Sgjelinek } 2993865e09a4Sgjelinek 2994865e09a4Sgjelinek (void) zonecfg_enddsent(t_handle); 2995865e09a4Sgjelinek } 2996865e09a4Sgjelinek 2997865e09a4Sgjelinek static int 2998865e09a4Sgjelinek validate_clone(char *source_zone, char *target_zone) 2999865e09a4Sgjelinek { 3000865e09a4Sgjelinek int err = Z_OK; 3001865e09a4Sgjelinek zone_dochandle_t s_handle; 3002865e09a4Sgjelinek zone_dochandle_t t_handle; 3003865e09a4Sgjelinek 3004865e09a4Sgjelinek if ((t_handle = zonecfg_init_handle()) == NULL) { 3005865e09a4Sgjelinek zperror(cmd_to_str(CMD_CLONE), B_TRUE); 3006865e09a4Sgjelinek return (Z_ERR); 3007865e09a4Sgjelinek } 3008865e09a4Sgjelinek if ((err = zonecfg_get_handle(target_zone, t_handle)) != Z_OK) { 3009865e09a4Sgjelinek errno = err; 3010865e09a4Sgjelinek zperror(cmd_to_str(CMD_CLONE), B_TRUE); 3011865e09a4Sgjelinek zonecfg_fini_handle(t_handle); 3012865e09a4Sgjelinek return (Z_ERR); 3013865e09a4Sgjelinek } 3014865e09a4Sgjelinek 3015865e09a4Sgjelinek if ((s_handle = zonecfg_init_handle()) == NULL) { 3016865e09a4Sgjelinek zperror(cmd_to_str(CMD_CLONE), B_TRUE); 3017865e09a4Sgjelinek zonecfg_fini_handle(t_handle); 3018865e09a4Sgjelinek return (Z_ERR); 3019865e09a4Sgjelinek } 3020865e09a4Sgjelinek if ((err = zonecfg_get_handle(source_zone, s_handle)) != Z_OK) { 3021865e09a4Sgjelinek errno = err; 3022865e09a4Sgjelinek zperror(cmd_to_str(CMD_CLONE), B_TRUE); 3023865e09a4Sgjelinek goto done; 3024865e09a4Sgjelinek } 3025865e09a4Sgjelinek 3026865e09a4Sgjelinek /* verify new zone has same inherit-pkg-dirs */ 3027865e09a4Sgjelinek err = valid_ipd_clone(s_handle, source_zone, t_handle, target_zone); 3028865e09a4Sgjelinek 3029865e09a4Sgjelinek /* warn about imported fs's which are the same */ 3030865e09a4Sgjelinek warn_fs_match(s_handle, source_zone, t_handle, target_zone); 3031865e09a4Sgjelinek 3032865e09a4Sgjelinek /* warn about imported IP addresses which are the same */ 3033865e09a4Sgjelinek warn_ip_match(s_handle, source_zone, t_handle, target_zone); 3034865e09a4Sgjelinek 3035865e09a4Sgjelinek /* warn about imported devices which are the same */ 3036865e09a4Sgjelinek warn_dev_match(s_handle, source_zone, t_handle, target_zone); 3037865e09a4Sgjelinek 3038865e09a4Sgjelinek /* warn about imported datasets which are the same */ 3039865e09a4Sgjelinek warn_dataset_match(s_handle, source_zone, t_handle, target_zone); 3040865e09a4Sgjelinek 3041865e09a4Sgjelinek done: 3042865e09a4Sgjelinek zonecfg_fini_handle(t_handle); 3043865e09a4Sgjelinek zonecfg_fini_handle(s_handle); 3044865e09a4Sgjelinek 3045865e09a4Sgjelinek return ((err == Z_OK) ? Z_OK : Z_ERR); 3046865e09a4Sgjelinek } 3047865e09a4Sgjelinek 3048865e09a4Sgjelinek static int 3049865e09a4Sgjelinek copy_zone(char *src, char *dst) 3050865e09a4Sgjelinek { 3051865e09a4Sgjelinek boolean_t out_null = B_FALSE; 3052865e09a4Sgjelinek int status; 3053865e09a4Sgjelinek int err; 3054865e09a4Sgjelinek char *outfile; 3055865e09a4Sgjelinek char cmdbuf[MAXPATHLEN * 2 + 128]; 3056865e09a4Sgjelinek 3057865e09a4Sgjelinek if ((outfile = tempnam("/var/log", "zone")) == NULL) { 3058865e09a4Sgjelinek outfile = "/dev/null"; 3059865e09a4Sgjelinek out_null = B_TRUE; 3060865e09a4Sgjelinek } 3061865e09a4Sgjelinek 30620b5de56dSgjelinek /* 30630b5de56dSgjelinek * Use find to get the list of files to copy. We need to skip 30640b5de56dSgjelinek * files of type "socket" since cpio can't handle those but that 30650b5de56dSgjelinek * should be ok since the app will recreate the socket when it runs. 30660b5de56dSgjelinek * We also need to filter out anything under the .zfs subdir. Since 30670b5de56dSgjelinek * find is running depth-first, we need the extra egrep to filter .zfs. 30680b5de56dSgjelinek */ 3069865e09a4Sgjelinek (void) snprintf(cmdbuf, sizeof (cmdbuf), 30700b5de56dSgjelinek "cd %s && /usr/bin/find . -type s -prune -o -depth -print | " 307107b574eeSgjelinek "/usr/bin/egrep -v '^\\./\\.zfs$|^\\./\\.zfs/' | " 3072865e09a4Sgjelinek "/usr/bin/cpio -pdmuP@ %s > %s 2>&1", 3073865e09a4Sgjelinek src, dst, outfile); 3074865e09a4Sgjelinek 3075865e09a4Sgjelinek status = do_subproc(cmdbuf); 3076865e09a4Sgjelinek 3077865e09a4Sgjelinek if ((err = subproc_status("copy", status)) != Z_OK) { 3078865e09a4Sgjelinek if (!out_null) 3079865e09a4Sgjelinek (void) fprintf(stderr, gettext("\nThe copy failed.\n" 3080865e09a4Sgjelinek "More information can be found in %s\n"), outfile); 3081865e09a4Sgjelinek return (err); 3082865e09a4Sgjelinek } 3083865e09a4Sgjelinek 3084865e09a4Sgjelinek if (!out_null) 3085865e09a4Sgjelinek (void) unlink(outfile); 3086865e09a4Sgjelinek 3087865e09a4Sgjelinek return (Z_OK); 3088865e09a4Sgjelinek } 3089865e09a4Sgjelinek 3090865e09a4Sgjelinek /* 30915cd08338Sgjelinek * Run sys-unconfig on a zone. This will leave the zone in the installed 30925cd08338Sgjelinek * state as long as there were no errors during the sys-unconfig. 3093865e09a4Sgjelinek */ 3094865e09a4Sgjelinek static int 30955cd08338Sgjelinek unconfigure_zone(char *zonepath) 3096865e09a4Sgjelinek { 30975cd08338Sgjelinek int err; 3098865e09a4Sgjelinek int status; 30995cd08338Sgjelinek struct stat unconfig_buf; 31005cd08338Sgjelinek zone_cmd_arg_t zarg; 31015cd08338Sgjelinek char cmdbuf[MAXPATHLEN + 51]; 3102865e09a4Sgjelinek 31035cd08338Sgjelinek /* The zone has to be installed in order to mount the scratch zone. */ 31045cd08338Sgjelinek if ((err = zone_set_state(target_zone, ZONE_STATE_INSTALLED)) != Z_OK) { 31055cd08338Sgjelinek errno = err; 31065cd08338Sgjelinek zperror2(target_zone, gettext("could not set state")); 31075cd08338Sgjelinek return (Z_ERR); 31085cd08338Sgjelinek } 31095cd08338Sgjelinek 31105cd08338Sgjelinek /* 311145916cd2Sjpk * Trusted Extensions requires that cloned zones use the 311245916cd2Sjpk * same sysid configuration, so it is not appropriate to 311345916cd2Sjpk * unconfigure the zone. 311445916cd2Sjpk */ 311545916cd2Sjpk if (is_system_labeled()) 311645916cd2Sjpk return (Z_OK); 311745916cd2Sjpk 311845916cd2Sjpk /* 31195cd08338Sgjelinek * Check if the zone is already sys-unconfiged. This saves us 31205cd08338Sgjelinek * the work of bringing up the scratch zone so we can unconfigure it. 31215cd08338Sgjelinek */ 31225cd08338Sgjelinek (void) snprintf(cmdbuf, sizeof (cmdbuf), "%s/root/etc/.UNCONFIGURED", 31235cd08338Sgjelinek zonepath); 31245cd08338Sgjelinek if (stat(cmdbuf, &unconfig_buf) == 0) 3125865e09a4Sgjelinek return (Z_OK); 3126865e09a4Sgjelinek 31275cd08338Sgjelinek zarg.cmd = Z_MOUNT; 31285cd08338Sgjelinek if (call_zoneadmd(target_zone, &zarg) != 0) { 31295cd08338Sgjelinek zerror(gettext("call to %s failed"), "zoneadmd"); 31305cd08338Sgjelinek (void) zone_set_state(target_zone, ZONE_STATE_INCOMPLETE); 31315cd08338Sgjelinek return (Z_ERR); 3132865e09a4Sgjelinek } 3133865e09a4Sgjelinek 31345cd08338Sgjelinek (void) snprintf(cmdbuf, sizeof (cmdbuf), 31355cd08338Sgjelinek "/usr/sbin/zlogin -S %s /usr/sbin/sys-unconfig -R /a", target_zone); 31365cd08338Sgjelinek 31375cd08338Sgjelinek status = do_subproc(cmdbuf); 31385cd08338Sgjelinek if ((err = subproc_status("sys-unconfig", status)) != Z_OK) { 31395cd08338Sgjelinek errno = err; 31405cd08338Sgjelinek zperror2(target_zone, gettext("sys-unconfig failed\n")); 31415cd08338Sgjelinek (void) zone_set_state(target_zone, ZONE_STATE_INCOMPLETE); 3142865e09a4Sgjelinek } 3143865e09a4Sgjelinek 31445cd08338Sgjelinek zarg.cmd = Z_UNMOUNT; 31455cd08338Sgjelinek if (call_zoneadmd(target_zone, &zarg) != 0) { 31465cd08338Sgjelinek zerror(gettext("call to %s failed"), "zoneadmd"); 31475cd08338Sgjelinek (void) fprintf(stderr, gettext("could not unmount zone\n")); 31485cd08338Sgjelinek return (Z_ERR); 31495cd08338Sgjelinek } 31505cd08338Sgjelinek 31515cd08338Sgjelinek return ((err == Z_OK) ? Z_OK : Z_ERR); 31525cd08338Sgjelinek } 3153865e09a4Sgjelinek 3154865e09a4Sgjelinek /* ARGSUSED */ 31550b5de56dSgjelinek static int 3156865e09a4Sgjelinek zfm_print(const char *p, void *r) { 3157865e09a4Sgjelinek zerror(" %s\n", p); 3158865e09a4Sgjelinek return (0); 3159865e09a4Sgjelinek } 3160865e09a4Sgjelinek 31610b5de56dSgjelinek int 31620b5de56dSgjelinek clone_copy(char *source_zonepath, char *zonepath) 31630b5de56dSgjelinek { 31640b5de56dSgjelinek int err; 31650b5de56dSgjelinek 31660b5de56dSgjelinek /* Don't clone the zone if anything is still mounted there */ 31670b5de56dSgjelinek if (zonecfg_find_mounts(source_zonepath, NULL, NULL)) { 31680b5de56dSgjelinek zerror(gettext("These file systems are mounted on " 31690b5de56dSgjelinek "subdirectories of %s.\n"), source_zonepath); 31700b5de56dSgjelinek (void) zonecfg_find_mounts(source_zonepath, zfm_print, NULL); 31710b5de56dSgjelinek return (Z_ERR); 31720b5de56dSgjelinek } 31730b5de56dSgjelinek 31740b5de56dSgjelinek /* 31750b5de56dSgjelinek * Attempt to create a ZFS fs for the zonepath. As usual, we don't 31760b5de56dSgjelinek * care if this works or not since we always have the default behavior 31770b5de56dSgjelinek * of a simple directory for the zonepath. 31780b5de56dSgjelinek */ 31790b5de56dSgjelinek create_zfs_zonepath(zonepath); 31800b5de56dSgjelinek 31810b5de56dSgjelinek (void) printf(gettext("Copying %s..."), source_zonepath); 31820b5de56dSgjelinek (void) fflush(stdout); 31830b5de56dSgjelinek 31840b5de56dSgjelinek err = copy_zone(source_zonepath, zonepath); 31850b5de56dSgjelinek 31860b5de56dSgjelinek (void) printf("\n"); 31870b5de56dSgjelinek 31880b5de56dSgjelinek return (err); 31890b5de56dSgjelinek } 31900b5de56dSgjelinek 3191865e09a4Sgjelinek static int 3192865e09a4Sgjelinek clone_func(int argc, char *argv[]) 3193865e09a4Sgjelinek { 3194865e09a4Sgjelinek char *source_zone = NULL; 3195865e09a4Sgjelinek int lockfd; 3196865e09a4Sgjelinek int err, arg; 3197865e09a4Sgjelinek char zonepath[MAXPATHLEN]; 3198865e09a4Sgjelinek char source_zonepath[MAXPATHLEN]; 3199865e09a4Sgjelinek zone_state_t state; 3200865e09a4Sgjelinek zone_entry_t *zent; 32010b5de56dSgjelinek char *method = NULL; 32020b5de56dSgjelinek char *snapshot = NULL; 3203865e09a4Sgjelinek 3204865e09a4Sgjelinek if (zonecfg_in_alt_root()) { 3205865e09a4Sgjelinek zerror(gettext("cannot clone zone in alternate root")); 3206865e09a4Sgjelinek return (Z_ERR); 3207865e09a4Sgjelinek } 3208865e09a4Sgjelinek 3209865e09a4Sgjelinek optind = 0; 32100b5de56dSgjelinek if ((arg = getopt(argc, argv, "?m:s:")) != EOF) { 3211865e09a4Sgjelinek switch (arg) { 3212865e09a4Sgjelinek case '?': 3213865e09a4Sgjelinek sub_usage(SHELP_CLONE, CMD_CLONE); 3214865e09a4Sgjelinek return (optopt == '?' ? Z_OK : Z_USAGE); 3215865e09a4Sgjelinek case 'm': 3216865e09a4Sgjelinek method = optarg; 3217865e09a4Sgjelinek break; 32180b5de56dSgjelinek case 's': 32190b5de56dSgjelinek snapshot = optarg; 32200b5de56dSgjelinek break; 3221865e09a4Sgjelinek default: 3222865e09a4Sgjelinek sub_usage(SHELP_CLONE, CMD_CLONE); 3223865e09a4Sgjelinek return (Z_USAGE); 3224865e09a4Sgjelinek } 3225865e09a4Sgjelinek } 32260b5de56dSgjelinek if (argc != (optind + 1) || 32270b5de56dSgjelinek (method != NULL && strcmp(method, "copy") != 0)) { 3228865e09a4Sgjelinek sub_usage(SHELP_CLONE, CMD_CLONE); 3229865e09a4Sgjelinek return (Z_USAGE); 3230865e09a4Sgjelinek } 3231865e09a4Sgjelinek source_zone = argv[optind]; 3232865e09a4Sgjelinek if (sanity_check(target_zone, CMD_CLONE, B_FALSE, B_TRUE) != Z_OK) 3233865e09a4Sgjelinek return (Z_ERR); 3234865e09a4Sgjelinek if (verify_details(CMD_CLONE) != Z_OK) 3235865e09a4Sgjelinek return (Z_ERR); 3236865e09a4Sgjelinek 3237865e09a4Sgjelinek /* 3238865e09a4Sgjelinek * We also need to do some extra validation on the source zone. 3239865e09a4Sgjelinek */ 3240865e09a4Sgjelinek if (strcmp(source_zone, GLOBAL_ZONENAME) == 0) { 3241865e09a4Sgjelinek zerror(gettext("%s operation is invalid for the global zone."), 3242865e09a4Sgjelinek cmd_to_str(CMD_CLONE)); 3243865e09a4Sgjelinek return (Z_ERR); 3244865e09a4Sgjelinek } 3245865e09a4Sgjelinek 3246865e09a4Sgjelinek if (strncmp(source_zone, "SUNW", 4) == 0) { 3247865e09a4Sgjelinek zerror(gettext("%s operation is invalid for zones starting " 3248865e09a4Sgjelinek "with SUNW."), cmd_to_str(CMD_CLONE)); 3249865e09a4Sgjelinek return (Z_ERR); 3250865e09a4Sgjelinek } 3251865e09a4Sgjelinek 3252865e09a4Sgjelinek zent = lookup_running_zone(source_zone); 3253865e09a4Sgjelinek if (zent != NULL) { 3254865e09a4Sgjelinek /* check whether the zone is ready or running */ 3255865e09a4Sgjelinek if ((err = zone_get_state(zent->zname, &zent->zstate_num)) 3256865e09a4Sgjelinek != Z_OK) { 3257865e09a4Sgjelinek errno = err; 3258865e09a4Sgjelinek zperror2(zent->zname, gettext("could not get state")); 3259865e09a4Sgjelinek /* can't tell, so hedge */ 3260865e09a4Sgjelinek zent->zstate_str = "ready/running"; 3261865e09a4Sgjelinek } else { 3262865e09a4Sgjelinek zent->zstate_str = zone_state_str(zent->zstate_num); 3263865e09a4Sgjelinek } 3264865e09a4Sgjelinek zerror(gettext("%s operation is invalid for %s zones."), 3265865e09a4Sgjelinek cmd_to_str(CMD_CLONE), zent->zstate_str); 3266865e09a4Sgjelinek return (Z_ERR); 3267865e09a4Sgjelinek } 3268865e09a4Sgjelinek 3269865e09a4Sgjelinek if ((err = zone_get_state(source_zone, &state)) != Z_OK) { 3270865e09a4Sgjelinek errno = err; 3271865e09a4Sgjelinek zperror2(source_zone, gettext("could not get state")); 3272865e09a4Sgjelinek return (Z_ERR); 3273865e09a4Sgjelinek } 3274865e09a4Sgjelinek if (state != ZONE_STATE_INSTALLED) { 3275865e09a4Sgjelinek (void) fprintf(stderr, 3276865e09a4Sgjelinek gettext("%s: zone %s is %s; %s is required.\n"), 3277865e09a4Sgjelinek execname, source_zone, zone_state_str(state), 3278865e09a4Sgjelinek zone_state_str(ZONE_STATE_INSTALLED)); 3279865e09a4Sgjelinek return (Z_ERR); 3280865e09a4Sgjelinek } 3281865e09a4Sgjelinek 3282865e09a4Sgjelinek /* 3283865e09a4Sgjelinek * The source zone checks out ok, continue with the clone. 3284865e09a4Sgjelinek */ 3285865e09a4Sgjelinek 3286865e09a4Sgjelinek if (validate_clone(source_zone, target_zone) != Z_OK) 3287865e09a4Sgjelinek return (Z_ERR); 3288865e09a4Sgjelinek 3289865e09a4Sgjelinek if (grab_lock_file(target_zone, &lockfd) != Z_OK) { 3290865e09a4Sgjelinek zerror(gettext("another %s may have an operation in progress."), 3291865e09a4Sgjelinek "zoneadm"); 3292865e09a4Sgjelinek return (Z_ERR); 3293865e09a4Sgjelinek } 3294865e09a4Sgjelinek 3295865e09a4Sgjelinek if ((err = zone_get_zonepath(source_zone, source_zonepath, 3296865e09a4Sgjelinek sizeof (source_zonepath))) != Z_OK) { 3297865e09a4Sgjelinek errno = err; 3298865e09a4Sgjelinek zperror2(source_zone, gettext("could not get zone path")); 3299865e09a4Sgjelinek goto done; 3300865e09a4Sgjelinek } 3301865e09a4Sgjelinek 3302865e09a4Sgjelinek if ((err = zone_get_zonepath(target_zone, zonepath, sizeof (zonepath))) 3303865e09a4Sgjelinek != Z_OK) { 3304865e09a4Sgjelinek errno = err; 3305865e09a4Sgjelinek zperror2(target_zone, gettext("could not get zone path")); 3306865e09a4Sgjelinek goto done; 3307865e09a4Sgjelinek } 3308865e09a4Sgjelinek 3309865e09a4Sgjelinek if ((err = zone_set_state(target_zone, ZONE_STATE_INCOMPLETE)) 3310865e09a4Sgjelinek != Z_OK) { 3311865e09a4Sgjelinek errno = err; 3312865e09a4Sgjelinek zperror2(target_zone, gettext("could not set state")); 3313865e09a4Sgjelinek goto done; 3314865e09a4Sgjelinek } 3315865e09a4Sgjelinek 33160b5de56dSgjelinek if (snapshot != NULL) { 33170b5de56dSgjelinek err = clone_snapshot_zfs(snapshot, zonepath); 33180b5de56dSgjelinek } else { 33190b5de56dSgjelinek /* 33200b5de56dSgjelinek * We always copy the clone unless the source is ZFS and a 33210b5de56dSgjelinek * ZFS clone worked. We fallback to copying if the ZFS clone 33220b5de56dSgjelinek * fails for some reason. 33230b5de56dSgjelinek */ 33240b5de56dSgjelinek err = Z_ERR; 33250b5de56dSgjelinek if (method == NULL && is_zonepath_zfs(source_zonepath)) 33260b5de56dSgjelinek err = clone_zfs(source_zone, source_zonepath, zonepath); 3327865e09a4Sgjelinek 33285cd08338Sgjelinek if (err != Z_OK) 33290b5de56dSgjelinek err = clone_copy(source_zonepath, zonepath); 33300b5de56dSgjelinek } 3331865e09a4Sgjelinek 33320b5de56dSgjelinek if (err == Z_OK) 33335cd08338Sgjelinek err = unconfigure_zone(zonepath); 3334865e09a4Sgjelinek 3335865e09a4Sgjelinek done: 3336865e09a4Sgjelinek release_lock_file(lockfd); 3337865e09a4Sgjelinek return ((err == Z_OK) ? Z_OK : Z_ERR); 3338865e09a4Sgjelinek } 3339865e09a4Sgjelinek 3340865e09a4Sgjelinek #define RMCOMMAND "/usr/bin/rm -rf" 3341865e09a4Sgjelinek 334207b574eeSgjelinek /* 33430b5de56dSgjelinek * Used when removing a zonepath after uninstalling or cleaning up after 33440b5de56dSgjelinek * the move subcommand. This handles a zonepath that has non-standard 33450b5de56dSgjelinek * contents so that we will only cleanup the stuff we know about and leave 33460b5de56dSgjelinek * any user data alone. 334707b574eeSgjelinek * 33480b5de56dSgjelinek * If the "all" parameter is true then we should remove the whole zonepath 33490b5de56dSgjelinek * even if it has non-standard files/directories in it. This can be used when 33500b5de56dSgjelinek * we need to cleanup after moving the zonepath across file systems. 33510b5de56dSgjelinek * 33520b5de56dSgjelinek * We "exec" the RMCOMMAND so that the returned status is that of RMCOMMAND 33530b5de56dSgjelinek * and not the shell. 335407b574eeSgjelinek */ 335507b574eeSgjelinek static int 33560b5de56dSgjelinek cleanup_zonepath(char *zonepath, boolean_t all) 335707b574eeSgjelinek { 335807b574eeSgjelinek int status; 33590b5de56dSgjelinek int i; 33600b5de56dSgjelinek boolean_t non_std = B_FALSE; 33610b5de56dSgjelinek struct dirent *dp; 33620b5de56dSgjelinek DIR *dirp; 33630b5de56dSgjelinek char *std_entries[] = {"dev", "lu", "root", NULL}; 33640b5de56dSgjelinek /* (MAXPATHLEN * 3) is for the 3 std_entries dirs */ 33650b5de56dSgjelinek char cmdbuf[sizeof (RMCOMMAND) + (MAXPATHLEN * 3) + 64]; 336607b574eeSgjelinek 336707b574eeSgjelinek /* 33680b5de56dSgjelinek * We shouldn't need these checks but lets be paranoid since we 33690b5de56dSgjelinek * could blow away the whole system here if we got the wrong zonepath. 337007b574eeSgjelinek */ 33710b5de56dSgjelinek if (*zonepath == NULL || strcmp(zonepath, "/") == 0) { 33720b5de56dSgjelinek (void) fprintf(stderr, "invalid zonepath '%s'\n", zonepath); 33730b5de56dSgjelinek return (Z_INVAL); 33740b5de56dSgjelinek } 33750b5de56dSgjelinek 337607b574eeSgjelinek /* 33770b5de56dSgjelinek * If the dirpath is already gone (maybe it was manually removed) then 33780b5de56dSgjelinek * we just return Z_OK so that the cleanup is successful. 337907b574eeSgjelinek */ 33800b5de56dSgjelinek if ((dirp = opendir(zonepath)) == NULL) 33810b5de56dSgjelinek return (Z_OK); 33820b5de56dSgjelinek 33830b5de56dSgjelinek /* 33840b5de56dSgjelinek * Look through the zonepath directory to see if there are any 33850b5de56dSgjelinek * non-standard files/dirs. Also skip .zfs since that might be 33860b5de56dSgjelinek * there but we'll handle ZFS file systems as a special case. 33870b5de56dSgjelinek */ 33880b5de56dSgjelinek while ((dp = readdir(dirp)) != NULL) { 33890b5de56dSgjelinek if (strcmp(dp->d_name, ".") == 0 || 33900b5de56dSgjelinek strcmp(dp->d_name, "..") == 0 || 33910b5de56dSgjelinek strcmp(dp->d_name, ".zfs") == 0) 33920b5de56dSgjelinek continue; 33930b5de56dSgjelinek 33940b5de56dSgjelinek for (i = 0; std_entries[i] != NULL; i++) 33950b5de56dSgjelinek if (strcmp(dp->d_name, std_entries[i]) == 0) 33960b5de56dSgjelinek break; 33970b5de56dSgjelinek 33980b5de56dSgjelinek if (std_entries[i] == NULL) 33990b5de56dSgjelinek non_std = B_TRUE; 34000b5de56dSgjelinek } 34010b5de56dSgjelinek (void) closedir(dirp); 34020b5de56dSgjelinek 34030b5de56dSgjelinek if (!all && non_std) { 34040b5de56dSgjelinek /* 34050b5de56dSgjelinek * There are extra, non-standard directories/files in the 34060b5de56dSgjelinek * zonepath so we don't want to remove the zonepath. We 34070b5de56dSgjelinek * just want to remove the standard directories and leave 34080b5de56dSgjelinek * the user data alone. 34090b5de56dSgjelinek */ 34100b5de56dSgjelinek (void) snprintf(cmdbuf, sizeof (cmdbuf), "exec " RMCOMMAND); 34110b5de56dSgjelinek 34120b5de56dSgjelinek for (i = 0; std_entries[i] != NULL; i++) { 34130b5de56dSgjelinek char tmpbuf[MAXPATHLEN]; 34140b5de56dSgjelinek 34150b5de56dSgjelinek if (snprintf(tmpbuf, sizeof (tmpbuf), " %s/%s", 34160b5de56dSgjelinek zonepath, std_entries[i]) >= sizeof (tmpbuf) || 34170b5de56dSgjelinek strlcat(cmdbuf, tmpbuf, sizeof (cmdbuf)) >= 34180b5de56dSgjelinek sizeof (cmdbuf)) { 34190b5de56dSgjelinek (void) fprintf(stderr, 34200b5de56dSgjelinek gettext("path is too long\n")); 34210b5de56dSgjelinek return (Z_INVAL); 34220b5de56dSgjelinek } 342307b574eeSgjelinek } 342407b574eeSgjelinek 342507b574eeSgjelinek status = do_subproc(cmdbuf); 342607b574eeSgjelinek 34270b5de56dSgjelinek (void) fprintf(stderr, gettext("WARNING: Unable to completely " 34280b5de56dSgjelinek "remove %s\nbecause it contains additional user data. " 34290b5de56dSgjelinek "Only the standard directory\nentries have been " 34300b5de56dSgjelinek "removed.\n"), 34310b5de56dSgjelinek zonepath); 343207b574eeSgjelinek 34330b5de56dSgjelinek return (subproc_status(RMCOMMAND, status)); 34340b5de56dSgjelinek } 34350b5de56dSgjelinek 34360b5de56dSgjelinek /* 34370b5de56dSgjelinek * There is nothing unexpected in the zonepath, try to get rid of the 34380b5de56dSgjelinek * whole zonepath directory. 34390b5de56dSgjelinek * 34400b5de56dSgjelinek * If the zonepath is its own zfs file system, try to destroy the 34410b5de56dSgjelinek * file system. If that fails for some reason (e.g. it has clones) 34420b5de56dSgjelinek * then we'll just remove the contents of the zonepath. 34430b5de56dSgjelinek */ 34440b5de56dSgjelinek if (is_zonepath_zfs(zonepath)) { 34450b5de56dSgjelinek if (destroy_zfs(zonepath) == Z_OK) 34460b5de56dSgjelinek return (Z_OK); 34470b5de56dSgjelinek (void) snprintf(cmdbuf, sizeof (cmdbuf), "exec " RMCOMMAND 34480b5de56dSgjelinek " %s/*", zonepath); 34490b5de56dSgjelinek status = do_subproc(cmdbuf); 34500b5de56dSgjelinek return (subproc_status(RMCOMMAND, status)); 34510b5de56dSgjelinek } 34520b5de56dSgjelinek 34530b5de56dSgjelinek (void) snprintf(cmdbuf, sizeof (cmdbuf), "exec " RMCOMMAND " %s", 34540b5de56dSgjelinek zonepath); 34550b5de56dSgjelinek status = do_subproc(cmdbuf); 34560b5de56dSgjelinek return (subproc_status(RMCOMMAND, status)); 345707b574eeSgjelinek } 345807b574eeSgjelinek 3459865e09a4Sgjelinek static int 3460865e09a4Sgjelinek move_func(int argc, char *argv[]) 3461865e09a4Sgjelinek { 3462865e09a4Sgjelinek char *new_zonepath = NULL; 3463865e09a4Sgjelinek int lockfd; 3464865e09a4Sgjelinek int err, arg; 3465865e09a4Sgjelinek char zonepath[MAXPATHLEN]; 3466865e09a4Sgjelinek zone_dochandle_t handle; 3467865e09a4Sgjelinek boolean_t fast; 34680b5de56dSgjelinek boolean_t is_zfs = B_FALSE; 34690b5de56dSgjelinek struct dirent *dp; 34700b5de56dSgjelinek DIR *dirp; 34710b5de56dSgjelinek boolean_t empty = B_TRUE; 3472865e09a4Sgjelinek boolean_t revert; 3473865e09a4Sgjelinek struct stat zonepath_buf; 3474865e09a4Sgjelinek struct stat new_zonepath_buf; 3475865e09a4Sgjelinek 3476865e09a4Sgjelinek if (zonecfg_in_alt_root()) { 3477865e09a4Sgjelinek zerror(gettext("cannot move zone in alternate root")); 3478865e09a4Sgjelinek return (Z_ERR); 3479865e09a4Sgjelinek } 3480865e09a4Sgjelinek 3481865e09a4Sgjelinek optind = 0; 3482865e09a4Sgjelinek if ((arg = getopt(argc, argv, "?")) != EOF) { 3483865e09a4Sgjelinek switch (arg) { 3484865e09a4Sgjelinek case '?': 3485865e09a4Sgjelinek sub_usage(SHELP_MOVE, CMD_MOVE); 3486865e09a4Sgjelinek return (optopt == '?' ? Z_OK : Z_USAGE); 3487865e09a4Sgjelinek default: 3488865e09a4Sgjelinek sub_usage(SHELP_MOVE, CMD_MOVE); 3489865e09a4Sgjelinek return (Z_USAGE); 3490865e09a4Sgjelinek } 3491865e09a4Sgjelinek } 3492865e09a4Sgjelinek if (argc != (optind + 1)) { 3493865e09a4Sgjelinek sub_usage(SHELP_MOVE, CMD_MOVE); 3494865e09a4Sgjelinek return (Z_USAGE); 3495865e09a4Sgjelinek } 3496865e09a4Sgjelinek new_zonepath = argv[optind]; 3497865e09a4Sgjelinek if (sanity_check(target_zone, CMD_MOVE, B_FALSE, B_TRUE) != Z_OK) 3498865e09a4Sgjelinek return (Z_ERR); 3499865e09a4Sgjelinek if (verify_details(CMD_MOVE) != Z_OK) 3500865e09a4Sgjelinek return (Z_ERR); 3501865e09a4Sgjelinek 3502865e09a4Sgjelinek /* 3503865e09a4Sgjelinek * Check out the new zonepath. This has the side effect of creating 3504865e09a4Sgjelinek * a directory for the new zonepath. We depend on this later when we 35050b5de56dSgjelinek * stat to see if we are doing a cross file system move or not. 3506865e09a4Sgjelinek */ 3507865e09a4Sgjelinek if (validate_zonepath(new_zonepath, CMD_MOVE) != Z_OK) 3508865e09a4Sgjelinek return (Z_ERR); 3509865e09a4Sgjelinek 3510865e09a4Sgjelinek if ((err = zone_get_zonepath(target_zone, zonepath, sizeof (zonepath))) 3511865e09a4Sgjelinek != Z_OK) { 3512865e09a4Sgjelinek errno = err; 3513865e09a4Sgjelinek zperror2(target_zone, gettext("could not get zone path")); 3514865e09a4Sgjelinek return (Z_ERR); 3515865e09a4Sgjelinek } 3516865e09a4Sgjelinek 3517865e09a4Sgjelinek if (stat(zonepath, &zonepath_buf) == -1) { 3518865e09a4Sgjelinek zperror(gettext("could not stat zone path"), B_FALSE); 3519865e09a4Sgjelinek return (Z_ERR); 3520865e09a4Sgjelinek } 3521865e09a4Sgjelinek 3522865e09a4Sgjelinek if (stat(new_zonepath, &new_zonepath_buf) == -1) { 3523865e09a4Sgjelinek zperror(gettext("could not stat new zone path"), B_FALSE); 3524865e09a4Sgjelinek return (Z_ERR); 3525865e09a4Sgjelinek } 3526865e09a4Sgjelinek 35270b5de56dSgjelinek /* 35280b5de56dSgjelinek * Check if the destination directory is empty. 35290b5de56dSgjelinek */ 35300b5de56dSgjelinek if ((dirp = opendir(new_zonepath)) == NULL) { 35310b5de56dSgjelinek zperror(gettext("could not open new zone path"), B_FALSE); 35320b5de56dSgjelinek return (Z_ERR); 35330b5de56dSgjelinek } 35340b5de56dSgjelinek while ((dp = readdir(dirp)) != (struct dirent *)0) { 35350b5de56dSgjelinek if (strcmp(dp->d_name, ".") == 0 || 35360b5de56dSgjelinek strcmp(dp->d_name, "..") == 0) 35370b5de56dSgjelinek continue; 35380b5de56dSgjelinek empty = B_FALSE; 35390b5de56dSgjelinek break; 35400b5de56dSgjelinek } 35410b5de56dSgjelinek (void) closedir(dirp); 35420b5de56dSgjelinek 35430b5de56dSgjelinek /* Error if there is anything in the destination directory. */ 35440b5de56dSgjelinek if (!empty) { 35450b5de56dSgjelinek (void) fprintf(stderr, gettext("could not move zone to %s: " 35460b5de56dSgjelinek "directory not empty\n"), new_zonepath); 35470b5de56dSgjelinek return (Z_ERR); 35480b5de56dSgjelinek } 35490b5de56dSgjelinek 3550865e09a4Sgjelinek /* Don't move the zone if anything is still mounted there */ 3551865e09a4Sgjelinek if (zonecfg_find_mounts(zonepath, NULL, NULL)) { 35520b5de56dSgjelinek zerror(gettext("These file systems are mounted on " 3553865e09a4Sgjelinek "subdirectories of %s.\n"), zonepath); 3554865e09a4Sgjelinek (void) zonecfg_find_mounts(zonepath, zfm_print, NULL); 3555865e09a4Sgjelinek return (Z_ERR); 3556865e09a4Sgjelinek } 3557865e09a4Sgjelinek 3558865e09a4Sgjelinek /* 3559865e09a4Sgjelinek * Check if we are moving in the same file system and can do a fast 3560865e09a4Sgjelinek * move or if we are crossing file systems and have to copy the data. 3561865e09a4Sgjelinek */ 3562865e09a4Sgjelinek fast = (zonepath_buf.st_dev == new_zonepath_buf.st_dev); 3563865e09a4Sgjelinek 3564865e09a4Sgjelinek if ((handle = zonecfg_init_handle()) == NULL) { 3565865e09a4Sgjelinek zperror(cmd_to_str(CMD_MOVE), B_TRUE); 3566865e09a4Sgjelinek return (Z_ERR); 3567865e09a4Sgjelinek } 3568865e09a4Sgjelinek 3569865e09a4Sgjelinek if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) { 3570865e09a4Sgjelinek errno = err; 3571865e09a4Sgjelinek zperror(cmd_to_str(CMD_MOVE), B_TRUE); 3572865e09a4Sgjelinek zonecfg_fini_handle(handle); 3573865e09a4Sgjelinek return (Z_ERR); 3574865e09a4Sgjelinek } 3575865e09a4Sgjelinek 3576865e09a4Sgjelinek if (grab_lock_file(target_zone, &lockfd) != Z_OK) { 3577865e09a4Sgjelinek zerror(gettext("another %s may have an operation in progress."), 3578865e09a4Sgjelinek "zoneadm"); 3579865e09a4Sgjelinek zonecfg_fini_handle(handle); 3580865e09a4Sgjelinek return (Z_ERR); 3581865e09a4Sgjelinek } 3582865e09a4Sgjelinek 3583865e09a4Sgjelinek /* 35840b5de56dSgjelinek * We're making some file system changes now so we have to clean up 35850b5de56dSgjelinek * the file system before we are done. This will either clean up the 3586865e09a4Sgjelinek * new zonepath if the zonecfg update failed or it will clean up the 3587865e09a4Sgjelinek * old zonepath if everything is ok. 3588865e09a4Sgjelinek */ 3589865e09a4Sgjelinek revert = B_TRUE; 3590865e09a4Sgjelinek 35910b5de56dSgjelinek if (is_zonepath_zfs(zonepath) && 35920b5de56dSgjelinek move_zfs(zonepath, new_zonepath) != Z_ERR) { 35930b5de56dSgjelinek is_zfs = B_TRUE; 35940b5de56dSgjelinek 35950b5de56dSgjelinek } else if (fast) { 3596865e09a4Sgjelinek /* same file system, use rename for a quick move */ 3597865e09a4Sgjelinek 3598865e09a4Sgjelinek /* 3599865e09a4Sgjelinek * Remove the new_zonepath directory that got created above 3600865e09a4Sgjelinek * during the validation. It gets in the way of the rename. 3601865e09a4Sgjelinek */ 3602865e09a4Sgjelinek if (rmdir(new_zonepath) != 0) { 3603865e09a4Sgjelinek zperror(gettext("could not rmdir new zone path"), 3604865e09a4Sgjelinek B_FALSE); 3605865e09a4Sgjelinek zonecfg_fini_handle(handle); 3606865e09a4Sgjelinek release_lock_file(lockfd); 3607865e09a4Sgjelinek return (Z_ERR); 3608865e09a4Sgjelinek } 3609865e09a4Sgjelinek 3610865e09a4Sgjelinek if (rename(zonepath, new_zonepath) != 0) { 3611865e09a4Sgjelinek /* 3612865e09a4Sgjelinek * If this fails we don't need to do all of the 3613865e09a4Sgjelinek * cleanup that happens for the rest of the code 3614865e09a4Sgjelinek * so just return from this error. 3615865e09a4Sgjelinek */ 3616865e09a4Sgjelinek zperror(gettext("could not move zone"), B_FALSE); 3617865e09a4Sgjelinek zonecfg_fini_handle(handle); 3618865e09a4Sgjelinek release_lock_file(lockfd); 3619865e09a4Sgjelinek return (Z_ERR); 3620865e09a4Sgjelinek } 3621865e09a4Sgjelinek 3622865e09a4Sgjelinek } else { 36230b5de56dSgjelinek /* 36240b5de56dSgjelinek * Attempt to create a ZFS fs for the new zonepath. As usual, 36250b5de56dSgjelinek * we don't care if this works or not since we always have the 36260b5de56dSgjelinek * default behavior of a simple directory for the zonepath. 36270b5de56dSgjelinek */ 36280b5de56dSgjelinek create_zfs_zonepath(new_zonepath); 36290b5de56dSgjelinek 3630865e09a4Sgjelinek (void) printf(gettext( 36310b5de56dSgjelinek "Moving across file systems; copying zonepath %s..."), 3632865e09a4Sgjelinek zonepath); 3633865e09a4Sgjelinek (void) fflush(stdout); 3634865e09a4Sgjelinek 3635865e09a4Sgjelinek err = copy_zone(zonepath, new_zonepath); 3636865e09a4Sgjelinek 3637865e09a4Sgjelinek (void) printf("\n"); 3638865e09a4Sgjelinek if (err != Z_OK) 3639865e09a4Sgjelinek goto done; 3640865e09a4Sgjelinek } 3641865e09a4Sgjelinek 3642865e09a4Sgjelinek if ((err = zonecfg_set_zonepath(handle, new_zonepath)) != Z_OK) { 3643865e09a4Sgjelinek errno = err; 3644865e09a4Sgjelinek zperror(gettext("could not set new zonepath"), B_TRUE); 3645865e09a4Sgjelinek goto done; 3646865e09a4Sgjelinek } 3647865e09a4Sgjelinek 3648865e09a4Sgjelinek if ((err = zonecfg_save(handle)) != Z_OK) { 3649865e09a4Sgjelinek errno = err; 3650865e09a4Sgjelinek zperror(gettext("zonecfg save failed"), B_TRUE); 3651865e09a4Sgjelinek goto done; 3652865e09a4Sgjelinek } 3653865e09a4Sgjelinek 3654865e09a4Sgjelinek revert = B_FALSE; 3655865e09a4Sgjelinek 3656865e09a4Sgjelinek done: 3657865e09a4Sgjelinek zonecfg_fini_handle(handle); 3658865e09a4Sgjelinek release_lock_file(lockfd); 3659865e09a4Sgjelinek 3660865e09a4Sgjelinek /* 36610b5de56dSgjelinek * Clean up the file system based on how things went. We either 3662865e09a4Sgjelinek * clean up the new zonepath if the operation failed for some reason 3663865e09a4Sgjelinek * or we clean up the old zonepath if everything is ok. 3664865e09a4Sgjelinek */ 3665865e09a4Sgjelinek if (revert) { 3666865e09a4Sgjelinek /* The zonecfg update failed, cleanup the new zonepath. */ 36670b5de56dSgjelinek if (is_zfs) { 36680b5de56dSgjelinek if (move_zfs(new_zonepath, zonepath) == Z_ERR) { 36690b5de56dSgjelinek (void) fprintf(stderr, gettext("could not " 36700b5de56dSgjelinek "restore zonepath, the zfs mountpoint is " 36710b5de56dSgjelinek "set as:\n%s\n"), new_zonepath); 36720b5de56dSgjelinek /* 36730b5de56dSgjelinek * err is already != Z_OK since we're reverting 36740b5de56dSgjelinek */ 36750b5de56dSgjelinek } 36760b5de56dSgjelinek 36770b5de56dSgjelinek } else if (fast) { 3678865e09a4Sgjelinek if (rename(new_zonepath, zonepath) != 0) { 3679865e09a4Sgjelinek zperror(gettext("could not restore zonepath"), 3680865e09a4Sgjelinek B_FALSE); 3681865e09a4Sgjelinek /* 3682865e09a4Sgjelinek * err is already != Z_OK since we're reverting 3683865e09a4Sgjelinek */ 3684865e09a4Sgjelinek } 3685865e09a4Sgjelinek } else { 3686865e09a4Sgjelinek (void) printf(gettext("Cleaning up zonepath %s..."), 3687865e09a4Sgjelinek new_zonepath); 3688865e09a4Sgjelinek (void) fflush(stdout); 36890b5de56dSgjelinek err = cleanup_zonepath(new_zonepath, B_TRUE); 3690865e09a4Sgjelinek (void) printf("\n"); 3691865e09a4Sgjelinek 369207b574eeSgjelinek if (err != Z_OK) { 3693865e09a4Sgjelinek errno = err; 3694865e09a4Sgjelinek zperror(gettext("could not remove new " 3695865e09a4Sgjelinek "zonepath"), B_TRUE); 3696865e09a4Sgjelinek } else { 3697865e09a4Sgjelinek /* 3698865e09a4Sgjelinek * Because we're reverting we know the mainline 3699865e09a4Sgjelinek * code failed but we just reused the err 3700865e09a4Sgjelinek * variable so we reset it back to Z_ERR. 3701865e09a4Sgjelinek */ 3702865e09a4Sgjelinek err = Z_ERR; 3703865e09a4Sgjelinek } 3704865e09a4Sgjelinek } 3705865e09a4Sgjelinek 3706865e09a4Sgjelinek } else { 3707865e09a4Sgjelinek /* The move was successful, cleanup the old zonepath. */ 37080b5de56dSgjelinek if (!is_zfs && !fast) { 3709865e09a4Sgjelinek (void) printf( 3710865e09a4Sgjelinek gettext("Cleaning up zonepath %s..."), zonepath); 3711865e09a4Sgjelinek (void) fflush(stdout); 37120b5de56dSgjelinek err = cleanup_zonepath(zonepath, B_TRUE); 3713865e09a4Sgjelinek (void) printf("\n"); 3714865e09a4Sgjelinek 371507b574eeSgjelinek if (err != Z_OK) { 3716865e09a4Sgjelinek errno = err; 3717865e09a4Sgjelinek zperror(gettext("could not remove zonepath"), 3718865e09a4Sgjelinek B_TRUE); 3719865e09a4Sgjelinek } 3720865e09a4Sgjelinek } 3721865e09a4Sgjelinek } 3722865e09a4Sgjelinek 3723865e09a4Sgjelinek return ((err == Z_OK) ? Z_OK : Z_ERR); 3724865e09a4Sgjelinek } 3725865e09a4Sgjelinek 3726ee519a1fSgjelinek static int 3727ee519a1fSgjelinek detach_func(int argc, char *argv[]) 3728ee519a1fSgjelinek { 3729ee519a1fSgjelinek int lockfd; 3730ee519a1fSgjelinek int err, arg; 3731ee519a1fSgjelinek char zonepath[MAXPATHLEN]; 3732ee519a1fSgjelinek zone_dochandle_t handle; 3733ee519a1fSgjelinek 3734ee519a1fSgjelinek if (zonecfg_in_alt_root()) { 3735ee519a1fSgjelinek zerror(gettext("cannot detach zone in alternate root")); 3736ee519a1fSgjelinek return (Z_ERR); 3737ee519a1fSgjelinek } 3738ee519a1fSgjelinek 3739ee519a1fSgjelinek optind = 0; 3740ee519a1fSgjelinek if ((arg = getopt(argc, argv, "?")) != EOF) { 3741ee519a1fSgjelinek switch (arg) { 3742ee519a1fSgjelinek case '?': 3743ee519a1fSgjelinek sub_usage(SHELP_DETACH, CMD_DETACH); 3744ee519a1fSgjelinek return (optopt == '?' ? Z_OK : Z_USAGE); 3745ee519a1fSgjelinek default: 3746ee519a1fSgjelinek sub_usage(SHELP_DETACH, CMD_DETACH); 3747ee519a1fSgjelinek return (Z_USAGE); 3748ee519a1fSgjelinek } 3749ee519a1fSgjelinek } 3750ee519a1fSgjelinek if (sanity_check(target_zone, CMD_DETACH, B_FALSE, B_TRUE) != Z_OK) 3751ee519a1fSgjelinek return (Z_ERR); 3752ee519a1fSgjelinek if (verify_details(CMD_DETACH) != Z_OK) 3753ee519a1fSgjelinek return (Z_ERR); 3754ee519a1fSgjelinek 3755ee519a1fSgjelinek if ((err = zone_get_zonepath(target_zone, zonepath, sizeof (zonepath))) 3756ee519a1fSgjelinek != Z_OK) { 3757ee519a1fSgjelinek errno = err; 3758ee519a1fSgjelinek zperror2(target_zone, gettext("could not get zone path")); 3759ee519a1fSgjelinek return (Z_ERR); 3760ee519a1fSgjelinek } 3761ee519a1fSgjelinek 3762ee519a1fSgjelinek /* Don't detach the zone if anything is still mounted there */ 3763ee519a1fSgjelinek if (zonecfg_find_mounts(zonepath, NULL, NULL)) { 37640b5de56dSgjelinek zerror(gettext("These file systems are mounted on " 3765ee519a1fSgjelinek "subdirectories of %s.\n"), zonepath); 3766ee519a1fSgjelinek (void) zonecfg_find_mounts(zonepath, zfm_print, NULL); 3767ee519a1fSgjelinek return (Z_ERR); 3768ee519a1fSgjelinek } 3769ee519a1fSgjelinek 3770ee519a1fSgjelinek if ((handle = zonecfg_init_handle()) == NULL) { 3771ee519a1fSgjelinek zperror(cmd_to_str(CMD_DETACH), B_TRUE); 3772ee519a1fSgjelinek return (Z_ERR); 3773ee519a1fSgjelinek } 3774ee519a1fSgjelinek 3775ee519a1fSgjelinek if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) { 3776ee519a1fSgjelinek errno = err; 3777ee519a1fSgjelinek zperror(cmd_to_str(CMD_DETACH), B_TRUE); 3778ee519a1fSgjelinek zonecfg_fini_handle(handle); 3779ee519a1fSgjelinek return (Z_ERR); 3780ee519a1fSgjelinek } 3781ee519a1fSgjelinek 3782ee519a1fSgjelinek if (grab_lock_file(target_zone, &lockfd) != Z_OK) { 3783ee519a1fSgjelinek zerror(gettext("another %s may have an operation in progress."), 3784ee519a1fSgjelinek "zoneadm"); 3785ee519a1fSgjelinek zonecfg_fini_handle(handle); 3786ee519a1fSgjelinek return (Z_ERR); 3787ee519a1fSgjelinek } 3788ee519a1fSgjelinek 3789ee519a1fSgjelinek if ((err = zonecfg_get_detach_info(handle, B_TRUE)) != Z_OK) { 3790ee519a1fSgjelinek errno = err; 3791ee519a1fSgjelinek zperror(gettext("getting the detach information failed"), 3792ee519a1fSgjelinek B_TRUE); 3793ee519a1fSgjelinek goto done; 3794ee519a1fSgjelinek } 3795ee519a1fSgjelinek 3796ee519a1fSgjelinek if ((err = zonecfg_detach_save(handle)) != Z_OK) { 3797ee519a1fSgjelinek errno = err; 3798ee519a1fSgjelinek zperror(gettext("saving the detach manifest failed"), B_TRUE); 3799ee519a1fSgjelinek goto done; 3800ee519a1fSgjelinek } 3801ee519a1fSgjelinek 3802ee519a1fSgjelinek if ((err = zone_set_state(target_zone, ZONE_STATE_CONFIGURED)) 3803ee519a1fSgjelinek != Z_OK) { 3804ee519a1fSgjelinek errno = err; 3805ee519a1fSgjelinek zperror(gettext("could not reset state"), B_TRUE); 3806ee519a1fSgjelinek } 3807ee519a1fSgjelinek 3808ee519a1fSgjelinek done: 3809ee519a1fSgjelinek zonecfg_fini_handle(handle); 3810ee519a1fSgjelinek release_lock_file(lockfd); 3811ee519a1fSgjelinek 3812ee519a1fSgjelinek return ((err == Z_OK) ? Z_OK : Z_ERR); 3813ee519a1fSgjelinek } 3814ee519a1fSgjelinek 3815ee519a1fSgjelinek /* 3816ee519a1fSgjelinek * During attach we go through and fix up the /dev entries for the zone 3817ee519a1fSgjelinek * we are attaching. In order to regenerate /dev with the correct devices, 3818ee519a1fSgjelinek * the old /dev will be removed, the zone readied (which generates a new 3819ee519a1fSgjelinek * /dev) then halted, then we use the info from the manifest to update 3820ee519a1fSgjelinek * the modes, owners, etc. on the new /dev. 3821ee519a1fSgjelinek */ 3822ee519a1fSgjelinek static int 3823ee519a1fSgjelinek dev_fix(zone_dochandle_t handle) 3824ee519a1fSgjelinek { 3825ee519a1fSgjelinek int res; 3826ee519a1fSgjelinek int err; 3827ee519a1fSgjelinek int status; 3828ee519a1fSgjelinek struct zone_devpermtab devtab; 3829ee519a1fSgjelinek zone_cmd_arg_t zarg; 3830ee519a1fSgjelinek char devpath[MAXPATHLEN]; 3831ee519a1fSgjelinek /* 6: "exec " and " " */ 3832ee519a1fSgjelinek char cmdbuf[sizeof (RMCOMMAND) + MAXPATHLEN + 6]; 3833ee519a1fSgjelinek 3834ee519a1fSgjelinek if ((res = zonecfg_get_zonepath(handle, devpath, sizeof (devpath))) 3835ee519a1fSgjelinek != Z_OK) 3836ee519a1fSgjelinek return (res); 3837ee519a1fSgjelinek 3838ee519a1fSgjelinek if (strlcat(devpath, "/dev", sizeof (devpath)) >= sizeof (devpath)) 3839ee519a1fSgjelinek return (Z_TOO_BIG); 3840ee519a1fSgjelinek 3841ee519a1fSgjelinek /* 3842ee519a1fSgjelinek * "exec" the command so that the returned status is that of 3843ee519a1fSgjelinek * RMCOMMAND and not the shell. 3844ee519a1fSgjelinek */ 3845ee519a1fSgjelinek (void) snprintf(cmdbuf, sizeof (cmdbuf), "exec " RMCOMMAND " %s", 3846ee519a1fSgjelinek devpath); 3847ee519a1fSgjelinek status = do_subproc(cmdbuf); 3848ee519a1fSgjelinek if ((err = subproc_status(RMCOMMAND, status)) != Z_OK) { 3849ee519a1fSgjelinek (void) fprintf(stderr, 3850ee519a1fSgjelinek gettext("could not remove existing /dev\n")); 3851ee519a1fSgjelinek return (Z_ERR); 3852ee519a1fSgjelinek } 3853ee519a1fSgjelinek 3854ee519a1fSgjelinek /* In order to ready the zone, it must be in the installed state */ 3855ee519a1fSgjelinek if ((err = zone_set_state(target_zone, ZONE_STATE_INSTALLED)) != Z_OK) { 3856ee519a1fSgjelinek errno = err; 3857ee519a1fSgjelinek zperror(gettext("could not reset state"), B_TRUE); 3858ee519a1fSgjelinek return (Z_ERR); 3859ee519a1fSgjelinek } 3860ee519a1fSgjelinek 3861ee519a1fSgjelinek /* We have to ready the zone to regen the dev tree */ 3862ee519a1fSgjelinek zarg.cmd = Z_READY; 3863ee519a1fSgjelinek if (call_zoneadmd(target_zone, &zarg) != 0) { 3864ee519a1fSgjelinek zerror(gettext("call to %s failed"), "zoneadmd"); 3865ee519a1fSgjelinek return (Z_ERR); 3866ee519a1fSgjelinek } 3867ee519a1fSgjelinek 3868ee519a1fSgjelinek zarg.cmd = Z_HALT; 3869ee519a1fSgjelinek if (call_zoneadmd(target_zone, &zarg) != 0) { 3870ee519a1fSgjelinek zerror(gettext("call to %s failed"), "zoneadmd"); 3871ee519a1fSgjelinek return (Z_ERR); 3872ee519a1fSgjelinek } 3873ee519a1fSgjelinek 3874ee519a1fSgjelinek if (zonecfg_setdevperment(handle) != Z_OK) { 3875ee519a1fSgjelinek (void) fprintf(stderr, 3876ee519a1fSgjelinek gettext("unable to enumerate device entries\n")); 3877ee519a1fSgjelinek return (Z_ERR); 3878ee519a1fSgjelinek } 3879ee519a1fSgjelinek 3880ee519a1fSgjelinek while (zonecfg_getdevperment(handle, &devtab) == Z_OK) { 3881ee519a1fSgjelinek int err; 3882ee519a1fSgjelinek 3883ee519a1fSgjelinek if ((err = zonecfg_devperms_apply(handle, 3884ee519a1fSgjelinek devtab.zone_devperm_name, devtab.zone_devperm_uid, 3885ee519a1fSgjelinek devtab.zone_devperm_gid, devtab.zone_devperm_mode, 3886ee519a1fSgjelinek devtab.zone_devperm_acl)) != Z_OK && err != Z_INVAL) 3887ee519a1fSgjelinek (void) fprintf(stderr, gettext("error updating device " 3888ee519a1fSgjelinek "%s: %s\n"), devtab.zone_devperm_name, 3889ee519a1fSgjelinek zonecfg_strerror(err)); 3890ee519a1fSgjelinek 3891ee519a1fSgjelinek free(devtab.zone_devperm_acl); 3892ee519a1fSgjelinek } 3893ee519a1fSgjelinek 3894ee519a1fSgjelinek (void) zonecfg_enddevperment(handle); 3895ee519a1fSgjelinek 3896ee519a1fSgjelinek return (Z_OK); 3897ee519a1fSgjelinek } 3898ee519a1fSgjelinek 3899ee519a1fSgjelinek static int 3900ee519a1fSgjelinek attach_func(int argc, char *argv[]) 3901ee519a1fSgjelinek { 3902ee519a1fSgjelinek int lockfd; 3903ee519a1fSgjelinek int err, arg; 3904ee519a1fSgjelinek boolean_t force = B_FALSE; 3905ee519a1fSgjelinek zone_dochandle_t handle; 3906ee519a1fSgjelinek zone_dochandle_t athandle = NULL; 3907ee519a1fSgjelinek char zonepath[MAXPATHLEN]; 3908ee519a1fSgjelinek 3909ee519a1fSgjelinek if (zonecfg_in_alt_root()) { 3910ee519a1fSgjelinek zerror(gettext("cannot attach zone in alternate root")); 3911ee519a1fSgjelinek return (Z_ERR); 3912ee519a1fSgjelinek } 3913ee519a1fSgjelinek 3914ee519a1fSgjelinek optind = 0; 3915ee519a1fSgjelinek if ((arg = getopt(argc, argv, "?F")) != EOF) { 3916ee519a1fSgjelinek switch (arg) { 3917ee519a1fSgjelinek case '?': 3918ee519a1fSgjelinek sub_usage(SHELP_ATTACH, CMD_ATTACH); 3919ee519a1fSgjelinek return (optopt == '?' ? Z_OK : Z_USAGE); 3920ee519a1fSgjelinek case 'F': 3921ee519a1fSgjelinek force = B_TRUE; 3922ee519a1fSgjelinek break; 3923ee519a1fSgjelinek default: 3924ee519a1fSgjelinek sub_usage(SHELP_ATTACH, CMD_ATTACH); 3925ee519a1fSgjelinek return (Z_USAGE); 3926ee519a1fSgjelinek } 3927ee519a1fSgjelinek } 3928ee519a1fSgjelinek if (sanity_check(target_zone, CMD_ATTACH, B_FALSE, B_TRUE) != Z_OK) 3929ee519a1fSgjelinek return (Z_ERR); 3930ee519a1fSgjelinek if (verify_details(CMD_ATTACH) != Z_OK) 3931ee519a1fSgjelinek return (Z_ERR); 3932ee519a1fSgjelinek 3933ee519a1fSgjelinek if ((err = zone_get_zonepath(target_zone, zonepath, sizeof (zonepath))) 3934ee519a1fSgjelinek != Z_OK) { 3935ee519a1fSgjelinek errno = err; 3936ee519a1fSgjelinek zperror2(target_zone, gettext("could not get zone path")); 3937ee519a1fSgjelinek return (Z_ERR); 3938ee519a1fSgjelinek } 3939ee519a1fSgjelinek 3940ee519a1fSgjelinek if ((handle = zonecfg_init_handle()) == NULL) { 3941ee519a1fSgjelinek zperror(cmd_to_str(CMD_ATTACH), B_TRUE); 3942ee519a1fSgjelinek return (Z_ERR); 3943ee519a1fSgjelinek } 3944ee519a1fSgjelinek 3945ee519a1fSgjelinek if ((err = zonecfg_get_handle(target_zone, handle)) != Z_OK) { 3946ee519a1fSgjelinek errno = err; 3947ee519a1fSgjelinek zperror(cmd_to_str(CMD_ATTACH), B_TRUE); 3948ee519a1fSgjelinek zonecfg_fini_handle(handle); 3949ee519a1fSgjelinek return (Z_ERR); 3950ee519a1fSgjelinek } 3951ee519a1fSgjelinek 3952ee519a1fSgjelinek if (grab_lock_file(target_zone, &lockfd) != Z_OK) { 3953ee519a1fSgjelinek zerror(gettext("another %s may have an operation in progress."), 3954ee519a1fSgjelinek "zoneadm"); 3955ee519a1fSgjelinek zonecfg_fini_handle(handle); 3956ee519a1fSgjelinek return (Z_ERR); 3957ee519a1fSgjelinek } 3958ee519a1fSgjelinek 3959ee519a1fSgjelinek if (force) 3960ee519a1fSgjelinek goto forced; 3961ee519a1fSgjelinek 3962ee519a1fSgjelinek if ((athandle = zonecfg_init_handle()) == NULL) { 3963ee519a1fSgjelinek zperror(cmd_to_str(CMD_ATTACH), B_TRUE); 3964ee519a1fSgjelinek goto done; 3965ee519a1fSgjelinek } 3966ee519a1fSgjelinek 3967ee519a1fSgjelinek if ((err = zonecfg_get_attach_handle(zonepath, target_zone, B_TRUE, 3968ee519a1fSgjelinek athandle)) != Z_OK) { 3969ee519a1fSgjelinek if (err == Z_NO_ZONE) 3970ee519a1fSgjelinek zerror(gettext("Not a detached zone")); 3971ee519a1fSgjelinek else if (err == Z_INVALID_DOCUMENT) 3972ee519a1fSgjelinek zerror(gettext("Cannot attach to an earlier release " 3973ee519a1fSgjelinek "of the operating system")); 3974ee519a1fSgjelinek else 3975ee519a1fSgjelinek zperror(cmd_to_str(CMD_ATTACH), B_TRUE); 3976ee519a1fSgjelinek goto done; 3977ee519a1fSgjelinek } 3978ee519a1fSgjelinek 3979ee519a1fSgjelinek /* Get the detach information for the locally defined zone. */ 3980ee519a1fSgjelinek if ((err = zonecfg_get_detach_info(handle, B_FALSE)) != Z_OK) { 3981ee519a1fSgjelinek errno = err; 3982ee519a1fSgjelinek zperror(gettext("getting the attach information failed"), 3983ee519a1fSgjelinek B_TRUE); 3984ee519a1fSgjelinek goto done; 3985ee519a1fSgjelinek } 3986ee519a1fSgjelinek 3987ee519a1fSgjelinek /* sw_cmp prints error msgs as necessary */ 39880b5de56dSgjelinek if ((err = sw_cmp(handle, athandle, SW_CMP_NONE)) != Z_OK) 3989ee519a1fSgjelinek goto done; 3990ee519a1fSgjelinek 3991ee519a1fSgjelinek if ((err = dev_fix(athandle)) != Z_OK) 3992ee519a1fSgjelinek goto done; 3993ee519a1fSgjelinek 3994ee519a1fSgjelinek forced: 3995ee519a1fSgjelinek 3996ee519a1fSgjelinek zonecfg_rm_detached(handle, force); 3997ee519a1fSgjelinek 3998ee519a1fSgjelinek if ((err = zone_set_state(target_zone, ZONE_STATE_INSTALLED)) != Z_OK) { 3999ee519a1fSgjelinek errno = err; 4000ee519a1fSgjelinek zperror(gettext("could not reset state"), B_TRUE); 4001ee519a1fSgjelinek } 4002ee519a1fSgjelinek 4003ee519a1fSgjelinek done: 4004ee519a1fSgjelinek zonecfg_fini_handle(handle); 4005ee519a1fSgjelinek release_lock_file(lockfd); 4006ee519a1fSgjelinek if (athandle != NULL) 4007ee519a1fSgjelinek zonecfg_fini_handle(athandle); 4008ee519a1fSgjelinek 4009ee519a1fSgjelinek return ((err == Z_OK) ? Z_OK : Z_ERR); 4010ee519a1fSgjelinek } 4011ee519a1fSgjelinek 4012865e09a4Sgjelinek /* 40137c478bd9Sstevel@tonic-gate * On input, TRUE => yes, FALSE => no. 40147c478bd9Sstevel@tonic-gate * On return, TRUE => 1, FALSE => 0, could not ask => -1. 40157c478bd9Sstevel@tonic-gate */ 40167c478bd9Sstevel@tonic-gate 40177c478bd9Sstevel@tonic-gate static int 40187c478bd9Sstevel@tonic-gate ask_yesno(boolean_t default_answer, const char *question) 40197c478bd9Sstevel@tonic-gate { 40207c478bd9Sstevel@tonic-gate char line[64]; /* should be large enough to answer yes or no */ 40217c478bd9Sstevel@tonic-gate 40227c478bd9Sstevel@tonic-gate if (!isatty(STDIN_FILENO)) 40237c478bd9Sstevel@tonic-gate return (-1); 40247c478bd9Sstevel@tonic-gate for (;;) { 40257c478bd9Sstevel@tonic-gate (void) printf("%s (%s)? ", question, 40267c478bd9Sstevel@tonic-gate default_answer ? "[y]/n" : "y/[n]"); 40277c478bd9Sstevel@tonic-gate if (fgets(line, sizeof (line), stdin) == NULL || 40287c478bd9Sstevel@tonic-gate line[0] == '\n') 40297c478bd9Sstevel@tonic-gate return (default_answer ? 1 : 0); 40307c478bd9Sstevel@tonic-gate if (tolower(line[0]) == 'y') 40317c478bd9Sstevel@tonic-gate return (1); 40327c478bd9Sstevel@tonic-gate if (tolower(line[0]) == 'n') 40337c478bd9Sstevel@tonic-gate return (0); 40347c478bd9Sstevel@tonic-gate } 40357c478bd9Sstevel@tonic-gate } 40367c478bd9Sstevel@tonic-gate 40377c478bd9Sstevel@tonic-gate static int 40387c478bd9Sstevel@tonic-gate uninstall_func(int argc, char *argv[]) 40397c478bd9Sstevel@tonic-gate { 40407c478bd9Sstevel@tonic-gate char line[ZONENAME_MAX + 128]; /* Enough for "Are you sure ..." */ 40410b5de56dSgjelinek char rootpath[MAXPATHLEN], zonepath[MAXPATHLEN]; 40427c478bd9Sstevel@tonic-gate boolean_t force = B_FALSE; 40437c478bd9Sstevel@tonic-gate int lockfd, answer; 40447c478bd9Sstevel@tonic-gate int err, arg; 40457c478bd9Sstevel@tonic-gate 4046108322fbScarlsonj if (zonecfg_in_alt_root()) { 4047108322fbScarlsonj zerror(gettext("cannot uninstall zone in alternate root")); 4048108322fbScarlsonj return (Z_ERR); 4049108322fbScarlsonj } 4050108322fbScarlsonj 40517c478bd9Sstevel@tonic-gate optind = 0; 40527c478bd9Sstevel@tonic-gate while ((arg = getopt(argc, argv, "?F")) != EOF) { 40537c478bd9Sstevel@tonic-gate switch (arg) { 40547c478bd9Sstevel@tonic-gate case '?': 40557c478bd9Sstevel@tonic-gate sub_usage(SHELP_UNINSTALL, CMD_UNINSTALL); 40567c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 40577c478bd9Sstevel@tonic-gate case 'F': 40587c478bd9Sstevel@tonic-gate force = B_TRUE; 40597c478bd9Sstevel@tonic-gate break; 40607c478bd9Sstevel@tonic-gate default: 40617c478bd9Sstevel@tonic-gate sub_usage(SHELP_UNINSTALL, CMD_UNINSTALL); 40627c478bd9Sstevel@tonic-gate return (Z_USAGE); 40637c478bd9Sstevel@tonic-gate } 40647c478bd9Sstevel@tonic-gate } 40657c478bd9Sstevel@tonic-gate if (argc > optind) { 40667c478bd9Sstevel@tonic-gate sub_usage(SHELP_UNINSTALL, CMD_UNINSTALL); 40677c478bd9Sstevel@tonic-gate return (Z_USAGE); 40687c478bd9Sstevel@tonic-gate } 40697c478bd9Sstevel@tonic-gate 40707c478bd9Sstevel@tonic-gate if (sanity_check(target_zone, CMD_UNINSTALL, B_FALSE, B_TRUE) != Z_OK) 40717c478bd9Sstevel@tonic-gate return (Z_ERR); 40727c478bd9Sstevel@tonic-gate 40737c478bd9Sstevel@tonic-gate if (!force) { 40747c478bd9Sstevel@tonic-gate (void) snprintf(line, sizeof (line), 40757c478bd9Sstevel@tonic-gate gettext("Are you sure you want to %s zone %s"), 40767c478bd9Sstevel@tonic-gate cmd_to_str(CMD_UNINSTALL), target_zone); 40777c478bd9Sstevel@tonic-gate if ((answer = ask_yesno(B_FALSE, line)) == 0) { 40787c478bd9Sstevel@tonic-gate return (Z_OK); 40797c478bd9Sstevel@tonic-gate } else if (answer == -1) { 40807c478bd9Sstevel@tonic-gate zerror(gettext("Input not from terminal and -F " 40817c478bd9Sstevel@tonic-gate "not specified: %s not done."), 40827c478bd9Sstevel@tonic-gate cmd_to_str(CMD_UNINSTALL)); 40837c478bd9Sstevel@tonic-gate return (Z_ERR); 40847c478bd9Sstevel@tonic-gate } 40857c478bd9Sstevel@tonic-gate } 40867c478bd9Sstevel@tonic-gate 40870b5de56dSgjelinek if ((err = zone_get_zonepath(target_zone, zonepath, 40880b5de56dSgjelinek sizeof (zonepath))) != Z_OK) { 40897c478bd9Sstevel@tonic-gate errno = err; 40907c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not get zone path")); 40917c478bd9Sstevel@tonic-gate return (Z_ERR); 40927c478bd9Sstevel@tonic-gate } 40937c478bd9Sstevel@tonic-gate if ((err = zone_get_rootpath(target_zone, rootpath, 40947c478bd9Sstevel@tonic-gate sizeof (rootpath))) != Z_OK) { 40957c478bd9Sstevel@tonic-gate errno = err; 40967c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not get root path")); 40977c478bd9Sstevel@tonic-gate return (Z_ERR); 40987c478bd9Sstevel@tonic-gate } 40997c478bd9Sstevel@tonic-gate 41007c478bd9Sstevel@tonic-gate /* 41017c478bd9Sstevel@tonic-gate * If there seems to be a zoneadmd running for this zone, call it 41027c478bd9Sstevel@tonic-gate * to tell it that an uninstall is happening; if all goes well it 41037c478bd9Sstevel@tonic-gate * will then shut itself down. 41047c478bd9Sstevel@tonic-gate */ 41057c478bd9Sstevel@tonic-gate if (ping_zoneadmd(target_zone) == Z_OK) { 41067c478bd9Sstevel@tonic-gate zone_cmd_arg_t zarg; 41077c478bd9Sstevel@tonic-gate zarg.cmd = Z_NOTE_UNINSTALLING; 41087c478bd9Sstevel@tonic-gate /* we don't care too much if this fails... just plow on */ 41097c478bd9Sstevel@tonic-gate (void) call_zoneadmd(target_zone, &zarg); 41107c478bd9Sstevel@tonic-gate } 41117c478bd9Sstevel@tonic-gate 41127c478bd9Sstevel@tonic-gate if (grab_lock_file(target_zone, &lockfd) != Z_OK) { 41137c478bd9Sstevel@tonic-gate zerror(gettext("another %s may have an operation in progress."), 4114865e09a4Sgjelinek "zoneadm"); 41157c478bd9Sstevel@tonic-gate return (Z_ERR); 41167c478bd9Sstevel@tonic-gate } 41177c478bd9Sstevel@tonic-gate 41187c478bd9Sstevel@tonic-gate /* Don't uninstall the zone if anything is mounted there */ 41197c478bd9Sstevel@tonic-gate err = zonecfg_find_mounts(rootpath, NULL, NULL); 41207c478bd9Sstevel@tonic-gate if (err) { 41210b5de56dSgjelinek zerror(gettext("These file systems are mounted on " 41227c478bd9Sstevel@tonic-gate "subdirectories of %s.\n"), rootpath); 41237c478bd9Sstevel@tonic-gate (void) zonecfg_find_mounts(rootpath, zfm_print, NULL); 41247c478bd9Sstevel@tonic-gate return (Z_ERR); 41257c478bd9Sstevel@tonic-gate } 41267c478bd9Sstevel@tonic-gate 41277c478bd9Sstevel@tonic-gate err = zone_set_state(target_zone, ZONE_STATE_INCOMPLETE); 41287c478bd9Sstevel@tonic-gate if (err != Z_OK) { 41297c478bd9Sstevel@tonic-gate errno = err; 41307c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not set state")); 41317c478bd9Sstevel@tonic-gate goto bad; 41327c478bd9Sstevel@tonic-gate } 41337c478bd9Sstevel@tonic-gate 41340b5de56dSgjelinek if ((err = cleanup_zonepath(zonepath, B_FALSE)) != Z_OK) { 41350b5de56dSgjelinek errno = err; 41360b5de56dSgjelinek zperror2(target_zone, gettext("cleaning up zonepath failed")); 41377c478bd9Sstevel@tonic-gate goto bad; 41380b5de56dSgjelinek } 41390b5de56dSgjelinek 41407c478bd9Sstevel@tonic-gate err = zone_set_state(target_zone, ZONE_STATE_CONFIGURED); 41417c478bd9Sstevel@tonic-gate if (err != Z_OK) { 41427c478bd9Sstevel@tonic-gate errno = err; 41437c478bd9Sstevel@tonic-gate zperror2(target_zone, gettext("could not reset state")); 41447c478bd9Sstevel@tonic-gate } 41457c478bd9Sstevel@tonic-gate bad: 41467c478bd9Sstevel@tonic-gate release_lock_file(lockfd); 41477c478bd9Sstevel@tonic-gate return (err); 41487c478bd9Sstevel@tonic-gate } 41497c478bd9Sstevel@tonic-gate 4150108322fbScarlsonj /* ARGSUSED */ 4151108322fbScarlsonj static int 4152108322fbScarlsonj mount_func(int argc, char *argv[]) 4153108322fbScarlsonj { 4154108322fbScarlsonj zone_cmd_arg_t zarg; 4155108322fbScarlsonj 4156108322fbScarlsonj if (argc > 0) 4157108322fbScarlsonj return (Z_USAGE); 4158108322fbScarlsonj if (sanity_check(target_zone, CMD_MOUNT, B_FALSE, B_FALSE) != Z_OK) 4159108322fbScarlsonj return (Z_ERR); 4160108322fbScarlsonj if (verify_details(CMD_MOUNT) != Z_OK) 4161108322fbScarlsonj return (Z_ERR); 4162108322fbScarlsonj 4163108322fbScarlsonj zarg.cmd = Z_MOUNT; 4164108322fbScarlsonj if (call_zoneadmd(target_zone, &zarg) != 0) { 4165108322fbScarlsonj zerror(gettext("call to %s failed"), "zoneadmd"); 4166108322fbScarlsonj return (Z_ERR); 4167108322fbScarlsonj } 4168108322fbScarlsonj return (Z_OK); 4169108322fbScarlsonj } 4170108322fbScarlsonj 4171108322fbScarlsonj /* ARGSUSED */ 4172108322fbScarlsonj static int 4173108322fbScarlsonj unmount_func(int argc, char *argv[]) 4174108322fbScarlsonj { 4175108322fbScarlsonj zone_cmd_arg_t zarg; 4176108322fbScarlsonj 4177108322fbScarlsonj if (argc > 0) 4178108322fbScarlsonj return (Z_USAGE); 4179108322fbScarlsonj if (sanity_check(target_zone, CMD_UNMOUNT, B_FALSE, B_FALSE) != Z_OK) 4180108322fbScarlsonj return (Z_ERR); 4181108322fbScarlsonj 4182108322fbScarlsonj zarg.cmd = Z_UNMOUNT; 4183108322fbScarlsonj if (call_zoneadmd(target_zone, &zarg) != 0) { 4184108322fbScarlsonj zerror(gettext("call to %s failed"), "zoneadmd"); 4185108322fbScarlsonj return (Z_ERR); 4186108322fbScarlsonj } 4187108322fbScarlsonj return (Z_OK); 4188108322fbScarlsonj } 4189108322fbScarlsonj 41907c478bd9Sstevel@tonic-gate static int 41917c478bd9Sstevel@tonic-gate help_func(int argc, char *argv[]) 41927c478bd9Sstevel@tonic-gate { 41937c478bd9Sstevel@tonic-gate int arg, cmd_num; 41947c478bd9Sstevel@tonic-gate 41957c478bd9Sstevel@tonic-gate if (argc == 0) { 41967c478bd9Sstevel@tonic-gate (void) usage(B_TRUE); 41977c478bd9Sstevel@tonic-gate return (Z_OK); 41987c478bd9Sstevel@tonic-gate } 41997c478bd9Sstevel@tonic-gate optind = 0; 42007c478bd9Sstevel@tonic-gate if ((arg = getopt(argc, argv, "?")) != EOF) { 42017c478bd9Sstevel@tonic-gate switch (arg) { 42027c478bd9Sstevel@tonic-gate case '?': 42037c478bd9Sstevel@tonic-gate sub_usage(SHELP_HELP, CMD_HELP); 42047c478bd9Sstevel@tonic-gate return (optopt == '?' ? Z_OK : Z_USAGE); 42057c478bd9Sstevel@tonic-gate default: 42067c478bd9Sstevel@tonic-gate sub_usage(SHELP_HELP, CMD_HELP); 42077c478bd9Sstevel@tonic-gate return (Z_USAGE); 42087c478bd9Sstevel@tonic-gate } 42097c478bd9Sstevel@tonic-gate } 42107c478bd9Sstevel@tonic-gate while (optind < argc) { 4211394a25e2Scarlsonj /* Private commands have NULL short_usage; omit them */ 4212394a25e2Scarlsonj if ((cmd_num = cmd_match(argv[optind])) < 0 || 4213394a25e2Scarlsonj cmdtab[cmd_num].short_usage == NULL) { 42147c478bd9Sstevel@tonic-gate sub_usage(SHELP_HELP, CMD_HELP); 42157c478bd9Sstevel@tonic-gate return (Z_USAGE); 42167c478bd9Sstevel@tonic-gate } 42177c478bd9Sstevel@tonic-gate sub_usage(cmdtab[cmd_num].short_usage, cmd_num); 42187c478bd9Sstevel@tonic-gate optind++; 42197c478bd9Sstevel@tonic-gate } 42207c478bd9Sstevel@tonic-gate return (Z_OK); 42217c478bd9Sstevel@tonic-gate } 42227c478bd9Sstevel@tonic-gate 42237c478bd9Sstevel@tonic-gate /* 42247c478bd9Sstevel@tonic-gate * Returns: CMD_MIN thru CMD_MAX on success, -1 on error 42257c478bd9Sstevel@tonic-gate */ 42267c478bd9Sstevel@tonic-gate 42277c478bd9Sstevel@tonic-gate static int 42287c478bd9Sstevel@tonic-gate cmd_match(char *cmd) 42297c478bd9Sstevel@tonic-gate { 42307c478bd9Sstevel@tonic-gate int i; 42317c478bd9Sstevel@tonic-gate 42327c478bd9Sstevel@tonic-gate for (i = CMD_MIN; i <= CMD_MAX; i++) { 42337c478bd9Sstevel@tonic-gate /* return only if there is an exact match */ 42347c478bd9Sstevel@tonic-gate if (strcmp(cmd, cmdtab[i].cmd_name) == 0) 42357c478bd9Sstevel@tonic-gate return (cmdtab[i].cmd_num); 42367c478bd9Sstevel@tonic-gate } 42377c478bd9Sstevel@tonic-gate return (-1); 42387c478bd9Sstevel@tonic-gate } 42397c478bd9Sstevel@tonic-gate 42407c478bd9Sstevel@tonic-gate static int 42417c478bd9Sstevel@tonic-gate parse_and_run(int argc, char *argv[]) 42427c478bd9Sstevel@tonic-gate { 42437c478bd9Sstevel@tonic-gate int i = cmd_match(argv[0]); 42447c478bd9Sstevel@tonic-gate 42457c478bd9Sstevel@tonic-gate if (i < 0) 42467c478bd9Sstevel@tonic-gate return (usage(B_FALSE)); 42477c478bd9Sstevel@tonic-gate return (cmdtab[i].handler(argc - 1, &(argv[1]))); 42487c478bd9Sstevel@tonic-gate } 42497c478bd9Sstevel@tonic-gate 42507c478bd9Sstevel@tonic-gate static char * 42517c478bd9Sstevel@tonic-gate get_execbasename(char *execfullname) 42527c478bd9Sstevel@tonic-gate { 42537c478bd9Sstevel@tonic-gate char *last_slash, *execbasename; 42547c478bd9Sstevel@tonic-gate 42557c478bd9Sstevel@tonic-gate /* guard against '/' at end of command invocation */ 42567c478bd9Sstevel@tonic-gate for (;;) { 42577c478bd9Sstevel@tonic-gate last_slash = strrchr(execfullname, '/'); 42587c478bd9Sstevel@tonic-gate if (last_slash == NULL) { 42597c478bd9Sstevel@tonic-gate execbasename = execfullname; 42607c478bd9Sstevel@tonic-gate break; 42617c478bd9Sstevel@tonic-gate } else { 42627c478bd9Sstevel@tonic-gate execbasename = last_slash + 1; 42637c478bd9Sstevel@tonic-gate if (*execbasename == '\0') { 42647c478bd9Sstevel@tonic-gate *last_slash = '\0'; 42657c478bd9Sstevel@tonic-gate continue; 42667c478bd9Sstevel@tonic-gate } 42677c478bd9Sstevel@tonic-gate break; 42687c478bd9Sstevel@tonic-gate } 42697c478bd9Sstevel@tonic-gate } 42707c478bd9Sstevel@tonic-gate return (execbasename); 42717c478bd9Sstevel@tonic-gate } 42727c478bd9Sstevel@tonic-gate 42737c478bd9Sstevel@tonic-gate int 42747c478bd9Sstevel@tonic-gate main(int argc, char **argv) 42757c478bd9Sstevel@tonic-gate { 42767c478bd9Sstevel@tonic-gate int arg; 42777c478bd9Sstevel@tonic-gate zoneid_t zid; 4278108322fbScarlsonj struct stat st; 42797c478bd9Sstevel@tonic-gate 42807c478bd9Sstevel@tonic-gate if ((locale = setlocale(LC_ALL, "")) == NULL) 42817c478bd9Sstevel@tonic-gate locale = "C"; 42827c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 42837c478bd9Sstevel@tonic-gate setbuf(stdout, NULL); 42847c478bd9Sstevel@tonic-gate (void) sigset(SIGHUP, SIG_IGN); 42857c478bd9Sstevel@tonic-gate execname = get_execbasename(argv[0]); 42867c478bd9Sstevel@tonic-gate target_zone = NULL; 42877c478bd9Sstevel@tonic-gate if (chdir("/") != 0) { 42887c478bd9Sstevel@tonic-gate zerror(gettext("could not change directory to /.")); 42897c478bd9Sstevel@tonic-gate exit(Z_ERR); 42907c478bd9Sstevel@tonic-gate } 42917c478bd9Sstevel@tonic-gate 4292108322fbScarlsonj while ((arg = getopt(argc, argv, "?z:R:")) != EOF) { 42937c478bd9Sstevel@tonic-gate switch (arg) { 42947c478bd9Sstevel@tonic-gate case '?': 42957c478bd9Sstevel@tonic-gate return (usage(B_TRUE)); 42967c478bd9Sstevel@tonic-gate case 'z': 42977c478bd9Sstevel@tonic-gate target_zone = optarg; 42987c478bd9Sstevel@tonic-gate break; 4299108322fbScarlsonj case 'R': /* private option for admin/install use */ 4300108322fbScarlsonj if (*optarg != '/') { 4301108322fbScarlsonj zerror(gettext("root path must be absolute.")); 4302108322fbScarlsonj exit(Z_ERR); 4303108322fbScarlsonj } 4304108322fbScarlsonj if (stat(optarg, &st) == -1 || !S_ISDIR(st.st_mode)) { 4305108322fbScarlsonj zerror( 4306108322fbScarlsonj gettext("root path must be a directory.")); 4307108322fbScarlsonj exit(Z_ERR); 4308108322fbScarlsonj } 4309108322fbScarlsonj zonecfg_set_root(optarg); 4310108322fbScarlsonj break; 43117c478bd9Sstevel@tonic-gate default: 43127c478bd9Sstevel@tonic-gate return (usage(B_FALSE)); 43137c478bd9Sstevel@tonic-gate } 43147c478bd9Sstevel@tonic-gate } 43157c478bd9Sstevel@tonic-gate 43167c478bd9Sstevel@tonic-gate if (optind >= argc) 43177c478bd9Sstevel@tonic-gate return (usage(B_FALSE)); 43187c478bd9Sstevel@tonic-gate if (target_zone != NULL && zone_get_id(target_zone, &zid) != 0) { 43197c478bd9Sstevel@tonic-gate errno = Z_NO_ZONE; 43207c478bd9Sstevel@tonic-gate zperror(target_zone, B_TRUE); 43217c478bd9Sstevel@tonic-gate exit(Z_ERR); 43227c478bd9Sstevel@tonic-gate } 43237c478bd9Sstevel@tonic-gate return (parse_and_run(argc - optind, &argv[optind])); 43247c478bd9Sstevel@tonic-gate } 4325