usr/src/cmd/tsol/misc/txzonemgr.sh

   1 #!/bin/ksh
   2 #
   3 # CDDL HEADER START
   4 #
   5 # The contents of this file are subject to the terms of the
   6 # Common Development and Distribution License (the "License").
   7 # You may not use this file except in compliance with the License.
   8 #
   9 # You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
  10 # or http://www.opensolaris.org/os/licensing.
  11 # See the License for the specific language governing permissions
  12 # and limitations under the License.
  13 #
  14 # When distributing Covered Code, include this CDDL HEADER in each
  15 # file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  16 # If applicable, add the following below this CDDL HEADER, with the
  17 # fields enclosed by brackets "[]" replaced with your own identifying
  18 # information: Portions Copyright [yyyy] [name of copyright owner]
  19 #
  20 # CDDL HEADER END
  21 #
  22 # Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
  23 # Copyright 2014 Garrett D'Amore
  24 #
  25 #
  26
  27 # This script provides a simple GUI for managing labeled zones.
  28 # It provides contextual menus which provide appropriate choices.
  29 # It must be run in the global zone as root.
  30
  31 # These arguments are accepted, and will result in non-interactive
  32 # (text-only) mode:
  33 #
  34 #       txzonemgr [-c | -d[f]]
  35 #
  36 #       -c      create default zones
  37 #       -d      destroy all zones; prompts for confirmation unless
  38 #               the -f flag is also specified
  39 #       -f      force
  40 #
  41
  42 # DISP - use GUI (otherwise use non-interactive mode)
  43 DISP=1
  44 # CREATEDEF - make default zones (non-interactive)
  45 CREATEDEF=0
  46 # DESTROYZONES - tear down all zones (non-interactive)
  47 DESTROYZONES=0
  48 # FORCE - force
  49 FORCE=0
  50
  51 NSCD_PER_LABEL=0
  52 NSCD_INDICATOR=/var/tsol/doors/nscd_per_label
  53 if [ -f $NSCD_INDICATOR ] ; then
  54         NSCD_PER_LABEL=1
  55 fi
  56
  57 myname=$(basename $0)
  58
  59 TXTMP=/tmp/txzonemgr
  60 TNRHTP=/etc/security/tsol/tnrhtp
  61 TNRHDB=/etc/security/tsol/tnrhdb
  62 TNZONECFG=/etc/security/tsol/tnzonecfg
  63 PUBZONE=public
  64 INTZONE=internal
  65
  66 PATH=/usr/bin:/usr/sbin:/usr/lib export PATH
  67 title="Labeled Zone Manager 2.1"
  68
  69 msg_defzones=$(gettext "Create default zones using default settings?")
  70 msg_confirmkill=$(gettext "OK to destroy all zones?")
  71 msg_continue=$(gettext "(exit to resume $(basename $0) when ready)")
  72 msg_getlabel=$(gettext "Select a label for the")
  73 msg_getremote=$(gettext "Select a remote host or network from the list below:")
  74 msg_getnet=$(gettext "Select a network configuration for the")
  75 msg_getzone=$(gettext "Select a zone from the list below:
  76 (select global for zone creation and shared settings)")
  77 msg_getcmd=$(gettext "Select a command from the list below:")
  78 msg_inuse=$(gettext "That label is already assigned\nto the")
  79 msg_getmin=$(gettext "Select the minimum network label for the")
  80 msg_getmax=$(gettext "Select the maximum network label for the")
  81 msg_badip=$(gettext " is not a valid IP address")
  82
  83
  84 process_options()
  85 {
  86         typeset opt optlist
  87
  88         optlist='cdf'
  89
  90         while getopts ":$optlist" opt
  91         do
  92                 case $opt in
  93                 c)      CREATEDEF=1
  94                         DISP=0
  95                         ;;
  96                 d)      DESTROYZONES=1
  97                         DISP=0
  98                         ;;
  99                 f)      FORCE=1
 100                         ;;
 101                 *)      gettext "invalid option -$OPTARG\n"
 102                         usage
 103                         return 2
 104                         ;;
 105                 esac
 106         done
 107
 108         if [ $CREATEDEF -eq 1 -a $DESTROYZONES -eq 1 ] ; then
 109                 gettext "cannot combine options -c and -d\n"
 110                 usage
 111                 return 2
 112         fi
 113         if [ $CREATEDEF -eq 1 -a $FORCE -eq 1 ] ; then
 114                 gettext "option -f not allowed with -c\n"
 115                 usage
 116                 return 2
 117         fi
 118         if [ $FORCE -eq 1 -a $CREATEDEF -eq 0 -a $DESTROYZONES -eq 0 ] ; then
 119                 gettext "option -f specified without any other options\n"
 120                 usage
 121                 return 2
 122         fi
 123
 124         shift $((OPTIND - 1))
 125         if [ "x$1" != "x" ] ; then
 126                 usage
 127                 return 2
 128         fi
 129
 130         return 0
 131 }
 132
 133 usage() {
 134         gettext "usage: $myname [-c | -d[f]]\n"
 135 }
 136
 137 consoleCheck() {
 138         if [ $zonename != global ] ; then
 139                 zconsole=$(pgrep -f "zlogin -C $zonename")
 140                 if [ $? != 0 ] ; then
 141                         console="Zone Console...\n"
 142                 fi
 143         fi
 144 }
 145
 146 labelCheck() {
 147         hexlabel=$(grep "^$zonename:" $TNZONECFG|cut -d : -f2);
 148         if [[ $hexlabel ]] ; then
 149                 label=
 150                 if [ $zonename = global ] ; then
 151                         template="admin_low"
 152                         addcipsohost="Add Multilevel Access to Remote Host...\n"
 153                         removecipsohost="Remove Multilevel Access to Remote Host...\n"
 154                         setmlps="Configure Multilevel Ports...\n"
 155                 else
 156                         template=${zonename}_unlab
 157                         addcipsohost=
 158                         removecipsohost=
 159                         setmlps=
 160
 161                         net=$(zonecfg -z $zonename info net)
 162                         if [[ -n $net ]] ; then
 163                                 setmlps="Configure Multilevel Ports...\n"
 164                         elif [ $zonestate = configured ] ; then
 165                                 addnet="Configure Network Interfaces...\n"
 166                         fi
 167                 fi
 168                 addremotehost="Add Single-level Access to Remote Host...\n"
 169                 remotes=$(grep -v "^#" $TNRHDB|grep $template)
 170                 if [ $? = 0 ] ; then
 171                         removeremotehost="Remove Single-level Access to Remote Host...\n"
 172                 else
 173                         removeremotehost=
 174                 fi
 175         else
 176                 label="Select Label...\n"
 177                 addremotehost=
 178                 removeremotehost=
 179                 addcipsohost=
 180                 removecipsohost=
 181                 setmlps=
 182         fi
 183 }
 184
 185 cloneCheck() {
 186         set -A zonelist
 187         integer clone_cnt=0
 188         for p in $(zoneadm list -ip) ; do
 189                 z=$(echo "$p"|cut -d : -f2)
 190                 s=$(echo "$p"|cut -d : -f3)
 191                 if [ $z = $zonename ] ; then
 192                         continue
 193                 elif [ $s = "installed" ] ; then
 194                         zonelist[clone_cnt]=$z
 195                         clone_cnt+=1
 196                 fi
 197         done
 198         if [ $clone_cnt -gt 0 ] ; then
 199                 clone="Clone...\n"; \
 200         fi
 201 }
 202
 203 relabelCheck() {
 204         macstate=$(zonecfg -z $zonename info|grep win_mac_write)
 205         if [[ -n $macstate ]] ; then
 206                 permitrelabel="Deny Relabeling\n"
 207         else
 208                 permitrelabel="Permit Relabeling\n"
 209         fi
 210 }
 211
 212 autobootCheck() {
 213         bootmode=$(zonecfg -z $zonename info autoboot)
 214         if [[ $bootmode == 'autoboot: true' ]] ; then
 215                 autoboot="Set Manual Booting\n"
 216         else
 217                 autoboot="Set Automatic Booting\n"
 218         fi
 219 }
 220
 221 newZone() {
 222                 if [[ ! -n $zonename ]] ; then
 223                         zonename=$(zenity --entry \
 224                             --title="$title" \
 225                             --width=330 \
 226                             --entry-text="" \
 227                             --text="Enter Zone Name: ")
 228
 229                         if [[ ! -n $zonename ]] ; then
 230                                 zonename=global
 231                                 return
 232                         fi
 233                 fi
 234                 zonecfg -z $zonename "create -t SUNWtsoldef;\
 235                      set zonepath=/zone/$zonename"
 236 }
 237
 238 removeZoneBEs() {
 239         delopt=$*
 240
 241         zfs list -H $ZDSET/$zonename 1>/dev/null 2>&1
 242         if [ $? = 0 ] ; then
 243                 for zbe in $(zfs list -rHo name $ZDSET/$zonename|grep ROOT/zbe) ; do
 244                         zfs destroy $delopt $zbe
 245                 done
 246         fi
 247 }
 248
 249 updateTemplate () {
 250         if [ $hostType = cipso ] ; then
 251                 template=${zonename}_cipso
 252                 deflabel=
 253         else
 254                 template=${zonename}_unlab
 255                 deflabel="def_label=${hexlabel};"
 256         fi
 257
 258         tnzone=$(grep "^${template}:" $TNRHTP 2>/dev/null)
 259         if [ $? -eq 0 ] ; then
 260                 sed -e "/^${template}/d" $TNRHTP > $TXTMP/tnrhtp.$$ 2>/dev/null
 261                 mv $TXTMP/tnrhtp.$$ $TNRHTP
 262         fi
 263         print "${template}:host_type=${hostType};doi=1;min_sl=${minlabel};max_sl=${maxlabel};$deflabel" >> $TNRHTP
 264         tnctl -t $template
 265 }
 266
 267 setTNdata () {
 268         tnzline="$zonename:${hexlabel}:0::"
 269         grep "^$tnzline" $TNZONECFG 1>/dev/null 2>&1
 270         if [ $? -eq 1 ] ; then
 271                 print "$tnzline" >> $TNZONECFG
 272         fi
 273
 274         #
 275         # Add matching entries in tnrhtp if necessary
 276         #
 277         minlabel=admin_low
 278         maxlabel=admin_high
 279         hostType=cipso
 280         updateTemplate
 281
 282         hostType=unlabeled
 283         updateTemplate
 284 }
 285
 286 selectLabel() {
 287         hexlabel=$(tgnome-selectlabel \
 288                 --title="$title" \
 289                 --text="$msg_getlabel $zonename zone:" \
 290                 --min="${DEFAULTLABEL}"  \
 291                 --default="${DEFAULTLABEL}"  \
 292                 --max=$(chk_encodings -X) \
 293                 --accredcheck=yes \
 294                 --mode=sensitivity \
 295                 --format=internal)
 296         if [ $? = 0 ] ; then
 297                 x=$(grep -i :{$hexlabel}: $TNZONECFG)
 298                 if [ $? = 0 ] ; then
 299                         z=$(print $x|cut -d : -f1)
 300                         x=$(zenity --error \
 301                             --title="$title" \
 302                             --text="$msg_inuse $z zone.")
 303                 else
 304                         setTNdata
 305                 fi
 306         fi
 307 }
 308
 309 getLabelRange() {
 310         deflabel=$(hextoalabel $hexlabel)
 311         minlabel=$(tgnome-selectlabel \
 312                 --title="$title" \
 313                 --text="$msg_getmin $zonename zone:" \
 314                 --min="${DEFAULTLABEL}"  \
 315                 --max="$deflabel" \
 316                 --default="$hexlabel" \
 317                 --accredcheck=no \
 318                 --mode=sensitivity \
 319                 --format=internal)
 320         [ $? != 0 ] && return
 321
 322         maxlabel=$(tgnome-selectlabel \
 323                 --title="$title" \
 324                 --text="$msg_getmax $zonename zone:" \
 325                 --min="$deflabel"  \
 326                 --max=$(chk_encodings -X) \
 327                 --default="$hexlabel" \
 328                 --accredcheck=no \
 329                 --mode=sensitivity \
 330                 --format=internal)
 331         [ $? != 0 ] && return
 332
 333         hostType=cipso
 334         updateTemplate
 335 }
 336
 337
 338 encryptionValues() {
 339         echo $(zfs get 2>&1 | grep encryption | sed -e s/^.*YES// -e s/\|//g)
 340 }
 341
 342 getPassphrase() {
 343         pass1=$(zenity --entry --title="$title" --text="Enter passphrase:" \
 344             --width=330 --hide-text)
 345         pass2=$(zenity --entry --title="$title" --text="Re-enter passphrase:" \
 346             --width=330 --hide-text)
 347         if [[ "$pass1" != "$pass2" ]]; then
 348                 zenity --error --title="$title" \
 349                         --text="Passphrases do not match"
 350                 return ""
 351         fi
 352         file=$(mktemp)
 353         echo "$pass1" > $file
 354         echo "$file"
 355 }
 356
 357 createZDSET() {
 358         options=$1
 359         pool=${2%%/*}
 360
 361         # First check if ZFS encrytption support is available
 362         pversion=$(zpool list -H -o version $pool)
 363         cversion=$(zpool upgrade -v | grep Crypto | awk '{ print $1 }')
 364         if (( cversion == 0 || pversion < cversion )); then
 365                 zfs create $options $ZDSET
 366                 return
 367         fi
 368
 369         encryption=$(zenity --list --title="$title" --height=320 \
 370                 --text="Select cipher for encryption of all labels:" \
 371                 --column="encryption" $(encryptionValues))
 372
 373         if [[ $? != 0 || $encryption == "off" ]]; then
 374                 zfs create $options $ZDSET
 375                 return
 376         fi
 377
 378         format=$(zenity --list --title="$title" \
 379                 --text "Select encryption key source:" \
 380                 --column="Key format and location" \
 381                 "Passphrase" "Generate Key in file")
 382         [ $? != 0 ] && exit
 383
 384         if [[ $format == "Passphrase" ]]; then
 385                 file=$(getPassphrase)
 386                 if [[ $file == "" ]]; then
 387                         exit
 388                 fi
 389                 keysource="passphrase,file://$file"
 390                 removefile=1;
 391         elif [[ $format == "Generate Key in file" ]]; then
 392                 file=$(zenity --file-selection \
 393                         --title="$title: Location of key file" \
 394                         --save --confirm-overwrite)
 395                 [ $? != 0 ] && exit
 396                 if [[ $encryption == "on" ]]; then
 397                         keylen=128
 398                 else
 399                         t=${encryption#aes-} && keylen=${t%%-*}
 400                 fi
 401                 pktool genkey keystore=file keytype=aes \
 402                     keylen=$keylen outkey=$file
 403                 keysource="raw,file:///$file"
 404         fi
 405
 406         options="$options -o encryption=$encryption -o keysource=$keysource"
 407         zfs create $options $ZDSET
 408         if (( removefile == 1 )); then
 409                 zfs set keysource=passphrase,prompt $ZDSET
 410                 rm $file
 411         fi
 412 }
 413
 414
 415 initialize() {
 416         zonepath=$(zoneadm -z $zonename list -p|cut -d : -f4)
 417         ZONE_ETC_DIR=$zonepath/root/etc
 418         SYSIDCFG=${ZONE_ETC_DIR}/sysidcfg
 419
 420         if [ -f /var/ldap/ldap_client_file ] ; then
 421                 ldapaddress=$(ldapclient list | \
 422                     grep "^NS_LDAP_SERVERS" | cut -d " " -f2)
 423                 print "name_service=LDAP {" > ${SYSIDCFG}
 424                 domain=$(domainname)
 425                 print "domain_name=$domain" >> ${SYSIDCFG}
 426                 profName=$(ldapclient list | \
 427                     grep "^NS_LDAP_PROFILE" | cut -d " " -f2)
 428                 proxyPwd=$(ldapclient list | \
 429                     grep "^NS_LDAP_BINDPASSWD" | cut -d " " -f2)
 430                 proxyDN=$(ldapclient list | \
 431                     grep "^NS_LDAP_BINDDN" | cut -d " " -f 2)
 432                 if [ "$proxyDN" ] ; then
 433                         print "proxy_dn=\"$proxyDN\"" >> ${SYSIDCFG}
 434                         print "proxy_password=\"$proxyPwd\"" >> ${SYSIDCFG}
 435                 fi
 436                 print "profile=$profName" >> ${SYSIDCFG}
 437                 print "profile_server=$ldapaddress }" >> ${SYSIDCFG}
 438                 cp /etc/nsswitch.conf $ZONE_ETC_DIR/nsswitch.ldap
 439         else
 440                 print "name_service=NONE" > ${SYSIDCFG}
 441                 fi
 442         print "security_policy=NONE" >> ${SYSIDCFG}
 443         locale=$(locale|grep LANG | cut -d "=" -f2)
 444         if [[ -z $locale ]] ; then
 445                 locale="C"
 446         fi
 447         print "system_locale=$locale" >> ${SYSIDCFG}
 448         timezone=$(grep "^TZ" /etc/default/init|cut -d "=" -f2)
 449         print "timezone=$timezone" >> ${SYSIDCFG}
 450         print "terminal=vt100" >> ${SYSIDCFG}
 451         rootpwd=$(grep "^root:" /etc/shadow|cut -d : -f2)
 452
 453 #       There are two problems with setting the root password:
 454 #               The zone's shadow file may be read-only
 455 #               The password contains unparsable characters
 456 #       so the following line is commented out until this is resolved.
 457
 458         #print "root_password=$rootpwd" >> ${SYSIDCFG}
 459         print "nfs4_domain=dynamic" >> ${SYSIDCFG}
 460         print "network_interface=PRIMARY {" >> ${SYSIDCFG}
 461
 462         net=$(zonecfg -z $zonename info net)
 463         ipType=$(zonecfg -z $zonename info ip-type|cut -d" " -f2)
 464         if [ $ipType = exclusive ] ; then
 465                 hostname=$(zenity --entry \
 466                     --title="$title" \
 467                     --width=330 \
 468                     --text="${zonename}0: Enter Hostname or dhcp: ")
 469                 [ $? != 0 ] && return
 470
 471                 if [ $hostname = dhcp ] ; then
 472                         print "dhcp" >> ${SYSIDCFG}
 473                 else
 474                         print "hostname=$hostname" >> ${SYSIDCFG}
 475                         ipaddr=$(getent hosts $hostname|cut -f1)
 476                         if [ $? != 0 ] ; then
 477                                 ipaddr=$(zenity --entry \
 478                                     --title="$title" \
 479                                     --text="$nic: Enter IP address: " \
 480                                     --entry-text a.b.c.d)
 481                                 [ $? != 0 ] && return
 482
 483                                 validateIPaddr
 484                                 if [[ -z $ipaddr ]] ; then
 485                                         return
 486                                 fi
 487                         fi
 488                         print "ip_address=$ipaddr" >> ${SYSIDCFG}
 489                         getNetmask
 490                         print "netmask=$nm" >> ${SYSIDCFG}
 491                         print "default_route=none" >> ${SYSIDCFG}
 492                         template=${zonename}_cipso
 493                         cidr=32
 494                         updateTnrhdb
 495                 fi
 496         elif [[ -n $net ]] ; then
 497                 hostname=$(hostname)
 498                 hostname=$(zenity --entry \
 499                     --title="$title" \
 500                     --width=330 \
 501                     --text="Enter Hostname: " \
 502                     --entry-text $hostname)
 503                 [ $? != 0 ] && return
 504
 505                 print "hostname=$hostname" >> ${SYSIDCFG}
 506                 ipaddr=$(getent hosts $hostname|cut -f1)
 507                 if [ $? = 0 ] ; then
 508                         print "ip_address=$ipaddr" >> ${SYSIDCFG}
 509                 fi
 510         else
 511                 getAllZoneNICs
 512                 for i in ${aznics[*]} ; do
 513                         ipaddr=$(ifconfig $i|grep inet|cut -d " " -f2)
 514                 done
 515                 print "hostname=$(hostname)" >> ${SYSIDCFG}
 516                 print "ip_address=$ipaddr" >> ${SYSIDCFG}
 517         fi
 518
 519         print "protocol_ipv6=no }" >> ${SYSIDCFG}
 520         cp /etc/default/nfs ${ZONE_ETC_DIR}/default/nfs
 521         touch ${ZONE_ETC_DIR}/.NFS4inst_state.domain
 522 }
 523
 524 clone() {
 525         image=$1
 526         if [[ -z $image ]] ; then
 527                 msg_clone=$(gettext "Clone the $zonename zone using a
 528 snapshot of one of the following halted zones:")
 529                 image=$(zenity --list \
 530                     --title="$title" \
 531                     --text="$msg_clone" \
 532                     --height=300 \
 533                     --width=330 \
 534                     --column="Installed Zones" ${zonelist[*]})
 535         fi
 536
 537         if [[ -n $image ]] ; then
 538                 removeZoneBEs
 539                 zoneadm -z $zonename clone $image
 540
 541                 if [ $NSCD_PER_LABEL = 0 ] ; then
 542                         sharePasswd $zonename
 543                 else
 544                         unsharePasswd $zonename
 545                 fi
 546
 547                 ipType=$(zonecfg -z $zonename info ip-type|cut -d" " -f2)
 548                 if [ $ipType = exclusive ] ; then
 549                         zoneadm -z $zonename ready
 550                         zonepath=$(zoneadm -z $zonename list -p|cut -d : -f4)
 551                         sys-unconfig -R $zonepath/root 2>/dev/null
 552                         initialize
 553                         zoneadm -z $zonename halt
 554                 fi
 555         fi
 556 }
 557
 558 install() {
 559         removeZoneBEs
 560         if [ $DISP -eq 0 ] ; then
 561                 gettext "installing zone $zonename ...\n"
 562                 zoneadm -z $zonename install
 563         else
 564                 # sleep is needed here to avoid occasional timing
 565                 # problem with gnome-terminal display...
 566                 sleep 2
 567                 gnome-terminal \
 568                     --title="$title: Installing $zonename zone" \
 569                     --command "zoneadm -z $zonename install" \
 570                     --disable-factory \
 571                     --hide-menubar
 572         fi
 573
 574         zonestate=$(zoneadm -z $zonename list -p | cut -d : -f 3)
 575         if [ $zonestate != installed ] ; then
 576                 gettext "error installing zone $zonename.\n"
 577                 return 1
 578         fi
 579
 580         if [ $NSCD_PER_LABEL = 0 ] ; then
 581                 sharePasswd $zonename
 582         else
 583                 unsharePasswd $zonename
 584         fi
 585
 586         zoneadm -z $zonename ready
 587         zonestate=$(zoneadm -z $zonename list -p | cut -d : -f 3)
 588         if [ $zonestate != ready ] ; then
 589                 gettext "error making zone $zonename ready.\n"
 590                 return 1
 591         fi
 592
 593         initialize
 594         zoneadm -z $zonename halt
 595 }
 596
 597 delete() {
 598         delopt=$*
 599
 600         # if there is an entry for this zone in tnzonecfg, remove it
 601         # before deleting the zone.
 602
 603         tnzone=$(grep "^$zonename:" $TNZONECFG 2>/dev/null)
 604         if [ -n "${tnzone}" ] ; then
 605                 sed -e "/^$zonename:/d" $TNZONECFG > \
 606                     $TXTMP/tnzonefg.$$ 2>/dev/null
 607                 mv $TXTMP/tnzonefg.$$ $TNZONECFG
 608         fi
 609
 610         for tnzone in $(grep ":${zonename}_unlab" $TNRHDB 2>/dev/null) ; do
 611                 tnctl -dh "$tnzone"
 612                 sed -e "/:${zonename}_unlab/d" $TNRHDB > \
 613                     $TXTMP/tnrhdb.$$ 2>/dev/null
 614                 mv $TXTMP/tnrhdb.$$ $TNRHDB
 615         done
 616
 617         for tnzone in $(grep "^${zonename}_unlab:" $TNRHTP 2>/dev/null) ; do
 618                 tnctl -dt ${zonename}_unlab
 619                 sed -e "/^${zonename}_unlab:/d" $TNRHTP > \
 620                     $TXTMP/tnrhtp.$$ 2>/dev/null
 621                 mv $TXTMP/tnrhtp.$$ $TNRHTP
 622         done
 623
 624         for tnzone in $(grep ":${zonename}_cipso" $TNRHDB 2>/dev/null) ; do
 625                 tnctl -dh "$tnzone"
 626                 sed -e "/:${zonename}_cipso/d" $TNRHDB > \
 627                     $TXTMP/tnrhdb.$$ 2>/dev/null
 628                 mv $TXTMP/tnrhdb.$$ $TNRHDB
 629         done
 630
 631         for tnzone in $(grep "^${zonename}_cipso:" $TNRHTP 2>/dev/null) ; do
 632                 tnctl -dt ${zonename}_cipso
 633                 sed -e "/^${zonename}_cipso:/d" $TNRHTP > \
 634                     $TXTMP/tnrhtp.$$ 2>/dev/null
 635                 mv $TXTMP/tnrhtp.$$ $TNRHTP
 636         done
 637
 638         zonecfg -z $zonename delete -F
 639
 640         removeZoneBEs $delopt
 641         for snap in $(zfs list -Ho name -t snapshot|grep "\@${zonename}_snap") ; do
 642                 zfs destroy -R $snap
 643         done
 644 }
 645
 646 validateIPaddr () {
 647         OLDIFS=$IFS
 648         IFS=.
 649         integer octet_cnt=0
 650         integer dummy
 651         set -A octets $ipaddr
 652         IFS=$OLDIFS
 653         if [ ${#octets[*]} == 4 ] ; then
 654                 while (( octet_cnt < ${#octets[*]} )); do
 655                         dummy=${octets[octet_cnt]}
 656                         if [ $dummy = ${octets[octet_cnt]} ] ; then
 657                                 if (( dummy >= 0 && \
 658                                     dummy < 256 )) ; then
 659                                         octet_cnt+=1
 660                                         continue
 661                                 fi
 662                         else
 663                         x=$(zenity --error \
 664                             --title="$title" \
 665                             --text="$ipaddr $msg_badip")
 666                         ipaddr=
 667                         return
 668                         fi
 669                 done
 670         else
 671                 x=$(zenity --error \
 672                     --title="$title" \
 673                     --text="$ipaddr $msg_badip")
 674                 ipaddr=
 675         fi
 676 }
 677
 678 getAllZoneNICs(){
 679         integer count=0
 680         for i in $(ifconfig -a4|grep  "^[a-z].*:")
 681         do
 682                 print "$i" |grep "^[a-z].*:" >/dev/null 2>&1
 683                 [ $? -eq 1 ] && continue
 684
 685                 i=${i%:} # Remove colon after interface name
 686                 for j in $(ifconfig $i)
 687                 do
 688                         case $j in
 689                                 all-zones)
 690                                         aznics[count]=$i
 691                                         count+=1
 692                                         ;;
 693                         esac
 694                 done
 695         done
 696 }
 697
 698 getNetmask() {
 699         cidr=
 700         nm=$(zenity --entry \
 701             --title="$title" \
 702             --width=330 \
 703             --text="$ipaddr: Enter netmask: " \
 704             --entry-text 255.255.255.0)
 705         [ $? != 0 ] && return;
 706
 707         cidr=$(perl -e 'use Socket; print unpack("%32b*",inet_aton($ARGV[0])), "\n";' $nm)
 708 }
 709
 710 addNet() {
 711         getIPaddr
 712         if [[ -z $ipaddr ]] ; then
 713                 return;
 714         fi
 715         getNetmask
 716         if [[ -z $cidr ]] ; then
 717                 return;
 718         fi
 719         zonecfg -z $zonename "add net; \
 720             set address=${ipaddr}/${cidr}; \
 721             set physical=$nic; \
 722             end"
 723         template=${zonename}_cipso
 724         cidr=32
 725         updateTnrhdb
 726 }
 727
 728 getAttrs() {
 729         zone=global
 730         type=ignore
 731         for j in $(ifconfig $nic)
 732         do
 733                 case $j in
 734                         inet) type=$j;;
 735                         zone) type=$j;;
 736                         all-zones) zone=all-zones;;
 737                         flags*) flags=$j;;
 738                         *) case $type in
 739                                 inet) ipaddr=$j ;;
 740                                 zone) zone=$j ;;
 741                                 *) continue ;;
 742                            esac;
 743                            type=ignore;;
 744                 esac
 745         done
 746         if [[ $flags == ~(E).UP, ]] ; then
 747                 updown=Up
 748         else
 749                 updown=Down
 750         fi
 751         if [[ $nic == ~(E).: ]] ; then
 752                 linktype=logical
 753         else
 754                 vnic=$(dladm show-vnic -po link $nic 2>/dev/null)
 755                 if [[ -n $vnic ]] ; then
 756                         linktype=virtual
 757                 else
 758                         linktype=physical
 759                 fi
 760         fi
 761         if [ $ipaddr != 0.0.0.0 ] ; then
 762                 x=$(grep "^${ipaddr}[^0-9]" $TNRHDB)
 763                 if [ $? = 1 ] ; then
 764                         template=cipso
 765                         cidr=32
 766                         updateTnrhdb
 767                 else
 768                         template=$(print "$x"|cut -d : -f2)
 769                 fi
 770         else
 771                 template="..."
 772                 ipaddr="..."
 773         fi
 774 }
 775 deleteTnrhdbEntry() {
 776         remote=$(grep "^${ipaddr}[^0-9]" $TNRHDB)
 777         if [ $? = 0 ] ; then
 778                 ip=$(print $remote|cut -d "/" -f1)
 779                         if [[ $remote == ~(E)./ ]] ; then
 780                                 pr=$(print $remote|cut -d "/" -f2)
 781                                 remote="$ip\\/$pr"
 782                         fi
 783                 sed -e "/^${remote}/d" $TNRHDB > /tmp/tnrhdb.$$ 2>/dev/null
 784                 mv /tmp/tnrhdb.$$ $TNRHDB
 785         fi
 786 }
 787
 788 updateTnrhdb() {
 789         deleteTnrhdbEntry
 790         if [[ -n $cidr ]] ; then
 791                 print "${ipaddr}/$cidr:$template" >> $TNRHDB
 792                 tnctl -h ${ipaddr}/$cidr:$template
 793         else
 794                 print "${ipaddr}:$template" >> $TNRHDB
 795                 tnctl -h ${ipaddr}:$template
 796         fi
 797 }
 798
 799 getIPaddr() {
 800         hostname=$(zenity --entry \
 801             --title="$title" \
 802             --width=330 \
 803             --text="$nic: Enter Hostname: ")
 804
 805         [ $? != 0 ] && return
 806
 807         ipaddr=$(getent hosts $hostname|cut -f1)
 808         if [[ -z $ipaddr ]] ; then
 809                 ipaddr=$(zenity --entry \
 810                     --title="$title" \
 811                     --text="$nic: Enter IP address: " \
 812                     --entry-text a.b.c.d)
 813                 [ $? != 0 ] && return
 814                 validateIPaddr
 815         fi
 816
 817 }
 818
 819 addHost() {
 820         # Update hosts
 821         if [[ -z $ipaddr ]] ; then
 822                return;
 823         fi
 824         grep "^${ipaddr}[^0-9]" /etc/inet/hosts >/dev/null
 825         if [ $? -eq 1 ] ; then
 826                 print "$ipaddr\t$hostname" >> /etc/inet/hosts
 827         fi
 828
 829         template=cipso
 830         cidr=32
 831         updateTnrhdb
 832
 833         ifconfig $nic $ipaddr netmask + broadcast +
 834         #
 835         # TODO: better integration with nwam
 836         # TODO: get/set netmask for IP address
 837         #
 838         print $hostname > /etc/hostname.$nic
 839 }
 840
 841 createInterface() {
 842         msg=$(ifconfig $nic addif 0.0.0.0)
 843         $(zenity --info \
 844             --title="$title" \
 845             --text="$msg" )
 846         nic=$(print "$msg"|cut -d" " -f5)
 847
 848 }
 849
 850 createVNIC() {
 851         if [ $zonename != global ] ; then
 852                 vnicname=${zonename}0
 853         else
 854                 vnicname=$(zenity --entry \
 855                     --title="$title" \
 856                     --width=330 \
 857                     --entry-text="" \
 858                     --text="Enter VNIC Name: ")
 859
 860                 if [[ ! -n $vnicname ]] ; then
 861                         return
 862                 fi
 863         fi
 864         x=$(dladm show-vnic|grep "^$vnicname " )
 865         if [[ ! -n $x ]] ; then
 866                 dladm create-vnic -l $nic $vnicname
 867         fi
 868         if [ $zonename = global ] ; then
 869                 ifconfig $vnicname plumb
 870         else
 871                 zonecfg -z $zonename "add net; \
 872                     set physical=$vnicname; \
 873                     end"
 874         fi
 875         nic=$vnicname
 876 }
 877
 878 shareInterface() {
 879         #
 880         # TODO: better integration with nwam
 881         #
 882         ifconfig $nic all-zones;\
 883         if_file=/etc/hostname.$nic
 884         sed q | sed -e "s/$/ all-zones/" < $if_file >$TXTMP/txnetmgr.$$
 885         mv $TXTMP/txnetmgr.$$ $if_file
 886 }
 887
 888 unshareInterface() {
 889         #
 890         # TODO: better integration with nwam
 891         #
 892         ifconfig $nic -zone;\
 893         if_file=/etc/hostname.$nic
 894         sed q | sed -e "s/all-zones/ /" < $if_file >$TXTMP/txnetmgr.$$
 895         mv $TXTMP/txnetmgr.$$ $if_file
 896 }
 897
 898 addTnrhdb() {
 899         ipaddr=$(zenity --entry \
 900             --title="$title" \
 901             --width=330 \
 902             --text="Zone:$zonename. Enter IP address of remote host or network: " \
 903             --entry-text a.b.c.d)
 904         [ $? != 0 ] && return
 905         validateIPaddr
 906         if [[ -z $ipaddr ]] ; then
 907                 return;
 908         fi
 909         if [ ${octets[3]} = 0 ] ; then
 910                 nic="$ipaddr"
 911                 getNetmask
 912                 if [[ -z $cidr ]] ; then
 913                         return;
 914                 fi
 915         else
 916                 cidr=32
 917         fi
 918         print "${ipaddr}/$cidr:$template" > $TXTMP/tnrhdb_new.$$
 919         x=$(tnchkdb -h $TXTMP/tnrhdb_new.$$ 2>$TXTMP/syntax_error.$$)
 920         if [ $? = 0 ] ; then
 921                 updateTnrhdb
 922         else
 923                 syntax=$(cat $TXTMP/syntax_error.$$)
 924                 x=$(zenity --error \
 925                     --title="$title" \
 926                     --text="$syntax")
 927         fi
 928         rm $TXTMP/tnrhdb_new.$$
 929         rm $TXTMP/syntax_error.$$
 930 }
 931
 932 removeTnrhdb() {
 933         while (( 1 )) do
 934                 remotes=$(grep "^[^#][0-9.]" $TNRHDB|grep ":$template"|cut -d : -f1-2|tr : " ")
 935                 if [ $template = cipso ] ; then
 936                         templateHeading="from All Zones":
 937                 else
 938                         templateHeading="from this Zone":
 939                 fi
 940                 if [[ -n $remotes ]] ; then
 941                         ipaddr=$(zenity --list \
 942                             --title="$title" \
 943                             --text="$msg_getremote" \
 944                             --height=250 \
 945                             --width=300 \
 946                             --column="Remove Access to:" \
 947                             --column="$templateHeading" \
 948                             $remotes)
 949
 950                         if [[ -n $ipaddr ]] ; then
 951                                 deleteTnrhdbEntry
 952                                 tnctl -dh ${ip}:$template
 953                         else
 954                                 return
 955                         fi
 956                 else
 957                         return
 958                 fi
 959         done
 960 }
 961
 962 setMLPs() {
 963         tnzone=$(grep "^$zonename:" $TNZONECFG 2>/dev/null)
 964         zoneMLPs=:$(print "$tnzone"|cut -d : -f4)
 965         sharedMLPs=:$(print "$tnzone"|cut -d : -f5)
 966         attrs="Private Interfaces$zoneMLPs\nShared Interfaces$sharedMLPs"
 967         ports=$(print "$attrs"|zenity --list \
 968             --title="$title" \
 969             --height=200 \
 970             --width=450 \
 971             --text="Zone: $zonename\nClick once to select, twice to edit.\nShift-click to select both rows." \
 972             --column="Multilevel Ports (example: 80-81/tcp;111/udp;)" \
 973             --editable \
 974             --multiple
 975             )
 976
 977         if [[ -z $ports ]] ; then
 978                 return
 979         fi
 980
 981         # getopts needs another a blank and another dash
 982         ports=--$(print "$ports"|sed 's/ //g'|sed 's/|/ --/g'|sed 's/Interfaces:/ :/g')
 983
 984         OPTIND=1
 985         while getopts "z:(Private)s:(Shared)" opt $ports ; do
 986                 case $opt in
 987                         z) zoneMLPs=$OPTARG ;;
 988                         s) sharedMLPs=$OPTARG ;;
 989                 esac
 990         done
 991
 992         sed -e "/^$zonename:*/d" $TNZONECFG > $TXTMP/tnzonecfg.$$ 2>/dev/null
 993         tnzone=$(print "$tnzone"|cut -d : -f1-3)
 994         echo "${tnzone}${zoneMLPs}${sharedMLPs}" >> $TXTMP/tnzonecfg.$$
 995
 996         x=$(tnchkdb -z $TXTMP/tnzonecfg.$$ 2>$TXTMP/syntax_error.$$)
 997
 998         if [ $? = 0 ] ; then
 999                 mv $TXTMP/tnzonecfg.$$ $TNZONECFG
1000                 zenity --info \
1001                     --title="$title" \
1002                     --text="Multilevel ports for the $zonename zone\nwill be interpreted on next reboot."
1003                 if [ $zonename != global ] ; then
1004                         getLabelRange
1005                 fi
1006         else
1007                 syntax=$(cat $TXTMP/syntax_error.$$)
1008                 x=$(zenity --error \
1009                     --title="$title" \
1010                     --text="$syntax")
1011                 rm $TXTMP/tnzonecfg.$$
1012         fi
1013         rm $TXTMP/syntax_error.$$
1014 }
1015
1016 enableAuthentication() {
1017         integer file_cnt=0
1018
1019         zonepath=$(zoneadm -z $1 list -p|cut -d : -f4)
1020         ZONE_ETC_DIR=$zonepath/root/etc
1021
1022         # If the zone's shadow file was previously read-only
1023         # there may be no root password entry for this zone.
1024         # If so, replace the root password entry with the global zone's.
1025
1026         entry=$(grep ^root:: $ZONE_ETC_DIR/shadow)
1027         if [ $? -eq 0 ] ; then
1028                 grep ^root: /etc/shadow > $TXTMP/shadow.$$
1029                 sed -e "/^root::/d" $ZONE_ETC_DIR/shadow >> \
1030                     $TXTMP/shadow.$$ 2>/dev/null
1031                 mv $TXTMP/shadow.$$ $ZONE_ETC_DIR/shadow
1032                 chmod 400 $ZONE_ETC_DIR/shadow
1033         fi
1034
1035         if [ $LOGNAME = "root" ]; then
1036                 return
1037         fi
1038
1039         file[0]="passwd"
1040         file[1]="shadow"
1041         file[2]="user_attr"
1042         #
1043         # Add the user who assumed the root role to each installed zone
1044         #
1045         while (( file_cnt < ${#file[*]} )); do
1046                 exists=$(grep "^${LOGNAME}:" \
1047                     $ZONE_ETC_DIR/${file[file_cnt]} >/dev/null)
1048                 if [ $? -ne 0 ] ; then
1049                         entry=$(grep "^${LOGNAME}:" \
1050                             /etc/${file[file_cnt]})
1051                         if [ $? -eq 0 ] ; then
1052                                 print "$entry" >> \
1053                                     $ZONE_ETC_DIR/${file[file_cnt]}
1054                         fi
1055                 fi
1056                 file_cnt+=1
1057         done
1058         chmod 400 $ZONE_ETC_DIR/shadow
1059 }
1060
1061 unsharePasswd() {
1062         zonecfg -z $1 remove fs dir=/etc/passwd >/dev/null 2>&1 | grep -v such
1063         zonecfg -z $1 remove fs dir=/etc/shadow >/dev/null 2>&1 | grep -v such
1064         zoneadm -z $1 ready >/dev/null 2>&1
1065         if [ $? -eq 0 ] ; then
1066                 enableAuthentication $1
1067                 zoneadm -z $1 halt >/dev/null 2>&1
1068         else
1069                 echo Skipping $1
1070         fi
1071 }
1072
1073 sharePasswd() {
1074         passwd=$(zonecfg -z $1 info|grep /etc/passwd)
1075         if [ $? -eq 1 ] ; then
1076                 zonecfg -z $1 "add fs; \
1077                     set special=/etc/passwd; \
1078                     set dir=/etc/passwd; \
1079                     set type=lofs; \
1080                     add options ro; \
1081                     end; \
1082                     add fs; \
1083                     set special=/etc/shadow; \
1084                     set dir=/etc/shadow; \
1085                     set type=lofs; \
1086                     add options ro; \
1087                     end"
1088         fi
1089         zoneadm -z $1 halt >/dev/null 2>&1
1090 }
1091
1092 # This routine is a toggle -- if we find it configured for global nscd,
1093 # change to nscd-per-label and vice-versa.
1094 #
1095 # The user was presented with only the choice to CHANGE the existing
1096 # configuration.
1097
1098 manageNscd() {
1099         if [ $NSCD_PER_LABEL -eq 0 ] ; then
1100                 # this MUST be a regular file for svc-nscd to detect
1101                 touch $NSCD_INDICATOR
1102                 NSCD_OPT="Unconfigure per-zone name service"
1103                 NSCD_PER_LABEL=1
1104                 for i in $(zoneadm list -i | grep -v global) ; do
1105                         zoneadm -z $i halt >/dev/null 2>&1
1106                         unsharePasswd $i
1107                 done
1108         else
1109                 rm -f $NSCD_INDICATOR
1110                 NSCD_OPT="Configure per-zone name service"
1111                 NSCD_PER_LABEL=0
1112                 for i in $(zoneadm list -i | grep -v global) ; do
1113                         zoneadm -z $i halt >/dev/null 2>&1
1114                         sharePasswd $i
1115                 done
1116         fi
1117 }
1118
1119 manageZoneNets () {
1120         ncmds[0]="Only use all-zones interfaces"
1121         ncmds[1]="Add a logical interface"
1122         ncmds[2]="Add a virtual interface (VNIC)"
1123
1124         stacks[0]="Shared Stack"
1125         stacks[1]="Exclusive Stack"
1126
1127         getAllZoneNICs
1128         netOps[0]="1\n${ncmds[0]}\nShared Stack\n${aznics[*]}"
1129
1130         integer nic_cnt=0
1131         integer netOp_cnt=2
1132
1133         set -A nics $(dladm show-phys|grep -v LINK|cut -f1 -d " ")
1134
1135         while (( nic_cnt < ${#nics[*]} )); do
1136                 netOps[netOp_cnt - 1]="\n$netOp_cnt\n${ncmds[1]}\n${stacks[0]}\n${nics[nic_cnt]}"
1137                 netOp_cnt+=1
1138                 netOps[netOp_cnt - 1]="\n$netOp_cnt\n${ncmds[2]}\n${stacks[1]}\n${nics[nic_cnt]}"
1139                 netOp_cnt+=1
1140                 nic_cnt+=1
1141         done
1142
1143         netOp=$(print "${netOps[*]}"|zenity --list \
1144             --title="$title" \
1145             --text="$msg_getnet $zonename zone:" \
1146             --height=300 \
1147             --width=500 \
1148             --column="#" \
1149             --column="Network Configuration " \
1150             --column="IP Type" \
1151             --column="Available Interfaces" \
1152             --hide-column=1
1153         )
1154
1155         # User picked cancel or no selection
1156         if [[ -z $netOp ]] ; then
1157                 return
1158         fi
1159
1160         # All-zones is the default, so just return
1161         if [ $netOp = 1 ] ; then
1162                 return
1163         fi
1164
1165         cmd=$(print "${netOps[$netOp - 1]}"|tr '\n' ';' |cut -d';' -f 3)
1166         nic=$(print "${netOps[$netOp - 1]}"|tr '\n' ';' |cut -d';' -f 5)
1167         case $cmd in
1168             ${ncmds[1]} )
1169                 addNet;
1170                 ;;
1171             ${ncmds[2]} )
1172                 zonecfg -z $zonename set ip-type=exclusive
1173                 createVNIC
1174                 ;;
1175         esac
1176 }
1177
1178 manageInterface () {
1179         while (( 1 )) do
1180                 getAttrs
1181
1182                 # Clear list of commands
1183
1184                 share=
1185                 setipaddr=
1186                 newlogical=
1187                 newvnic=
1188                 unplumb=
1189                 bringup=
1190                 bringdown=
1191
1192                 if [ $updown = Down ] ; then
1193                         bringup="Bring Up\n"
1194                 else
1195                         bringdown="Bring Down\n"
1196                 fi
1197
1198                 case $linktype in
1199                 physical )
1200                         newlogical="Create Logical Interface...\n";
1201                         newvnic="Create Virtual Interface (VNIC)...\n";
1202                         ;;
1203                 logical )
1204                         unplumb="Remove Logical Interface\n"
1205                         ;;
1206                 virtual )
1207                         newlogical="Create Logical Interface...\n";
1208                         unplumb="Remove Virtual Interface\n" ;
1209                         ;;
1210                 esac
1211
1212                 if [ $ipaddr = "..." ] ; then
1213                         setipaddr="Set IP address...\n"
1214                 elif [ $zone != all-zones ] ; then
1215                         share="Share with Shared-IP Zones\n"
1216                 else
1217                         share="Remove from Shared-IP Zones\n"
1218                 fi
1219
1220                 command=$(print ""\
1221                     $share \
1222                     $setipaddr \
1223                     $newlogical \
1224                     $newvnic \
1225                     $unplumb \
1226                     $bringup \
1227                     $bringdown \
1228                     | zenity --list \
1229                     --title="$title" \
1230                     --text="Select a command from the list below:" \
1231                     --height=300 \
1232                     --column "Interface: $nic" )
1233
1234                 case $command in
1235                     " Create Logical Interface...")
1236                         createInterface;;
1237                     " Create Virtual Interface (VNIC)...")
1238                         createVNIC ;;
1239                     " Set IP address...")
1240                         getIPaddr
1241                         addHost;;
1242                     " Share with Shared-IP Zones")
1243                         shareInterface;;
1244                     " Remove from Shared-IP Zones")
1245                         unshareInterface;;
1246                     " Remove Logical Interface")
1247                         ifconfig $nic unplumb
1248                         rm -f /etc/hostname.$nic
1249                         return;;
1250                     " Remove Virtual Interface")
1251                         ifconfig $nic unplumb
1252                         dladm delete-vnic $nic
1253                         rm -f /etc/hostname.$nic
1254                         return;;
1255                     " Bring Up")
1256                         ifconfig $nic up;;
1257                     " Bring Down")
1258                         ifconfig $nic down;;
1259                     *) return;;
1260                 esac
1261         done
1262 }
1263
1264 sharePrimaryNic() {
1265         set -A ip $(getent hosts $(cat /etc/nodename))
1266         for i in $(ifconfig -au4|grep  "^[a-z].*:" |grep -v LOOPBACK)
1267         do
1268                 print "$i" |grep "^[a-z].*:" >/dev/null 2>&1
1269                 [ $? -eq 1 ] && continue
1270
1271                 nic=${i%:} # Remove colon after interface name
1272                 getAttrs
1273                 if [ ${ip[0]} = $ipaddr ]; then
1274                         shareInterface
1275                         break
1276                 fi
1277         done
1278 }
1279
1280 manageNets() {
1281         while (( 1 )) do
1282                 attrs=
1283                 for i in $(ifconfig -a4|grep  "^[a-z].*:" |grep -v LOOPBACK)
1284                 do
1285                         print "$i" |grep "^[a-z].*:" >/dev/null 2>&1
1286                         [ $? -eq 1 ] && continue
1287
1288                         nic=${i%:} # Remove colon after interface name
1289                         getAttrs
1290                         attrs="$nic $linktype $zone $ipaddr $template $updown $attrs"
1291                 done
1292
1293                 nic=$(zenity --list \
1294                     --title="$title" \
1295                     --text="Select an interface from the list below:" \
1296                     --height=300 \
1297                     --width=500 \
1298                     --column="Interface" \
1299                     --column="Type" \
1300                     --column="Zone Name" \
1301                     --column="IP Address" \
1302                     --column="Template" \
1303                     --column="State" \
1304                     $attrs)
1305
1306                 if [[ -z $nic ]] ; then
1307                         return
1308                 fi
1309                 manageInterface
1310         done
1311 }
1312
1313 createLDAPclient() {
1314         ldaptitle="$title: Create LDAP Client"
1315         ldapdomain=$(zenity --entry \
1316             --width=400 \
1317             --title="$ldaptitle" \
1318             --text="Enter Domain Name: ")
1319         if [[ -n $ldapdomain ]] ; then
1320         ldapserver=$(zenity --entry \
1321             --width=400 \
1322             --title="$ldaptitle" \
1323             --text="Enter Hostname of LDAP Server: ")
1324         else
1325                 return
1326         fi
1327         if [[ -n $ldapserver ]] ; then
1328         ldapserveraddr=$(zenity --entry \
1329             --width=400 \
1330             --title="$ldaptitle" \
1331             --text="Enter IP adddress of LDAP Server $ldapserver: ")
1332         else
1333                 return
1334         fi
1335         ldappassword=""
1336         while [[ -z ${ldappassword} || "x$ldappassword" != "x$ldappasswordconfirm" ]] ; do
1337             ldappassword=$(zenity --entry \
1338                 --width=400 \
1339                 --title="$ldaptitle" \
1340                 --hide-text \
1341                 --text="Enter LDAP Proxy Password:")
1342             ldappasswordconfirm=$(zenity --entry \
1343                 --width=400 \
1344                 --title="$ldaptitle" \
1345                 --hide-text \
1346                 --text="Confirm LDAP Proxy Password:")
1347         done
1348         ldapprofile=$(zenity --entry \
1349             --width=400 \
1350             --title="$ldaptitle" \
1351             --text="Enter LDAP Profile Name: ")
1352         whatnext=$(zenity --list \
1353             --width=400 \
1354             --height=250 \
1355             --title="$ldaptitle" \
1356             --text="Proceed to create LDAP Client?" \
1357             --column=Parameter --column=Value \
1358             "Domain Name" "$ldapdomain" \
1359             "Hostname" "$ldapserver" \
1360             "IP Address" "$ldapserveraddr" \
1361             "Password" "$(print "$ldappassword" | sed 's/./*/g')" \
1362             "Profile" "$ldapprofile")
1363         [ $? != 0 ] && return
1364
1365         grep "^${ldapserveraddr}[^0-9]" /etc/hosts > /dev/null
1366         if [ $? -eq 1 ] ; then
1367                 print "$ldapserveraddr $ldapserver" >> /etc/hosts
1368         fi
1369
1370         grep "${ldapserver}:" $TNRHDB > /dev/null
1371         if [ $? -eq 1 ] ; then
1372                 print "# ${ldapserver} - ldap server" \
1373                     >> $TNRHDB
1374                 print "${ldapserveraddr}:cipso" \
1375                     >> $TNRHDB
1376                 tnctl -h "${ldapserveraddr}:cipso"
1377         fi
1378
1379         proxyDN=$(print $ldapdomain|awk -F"." \
1380             "{ ORS = \"\" } { for (i = 1; i < NF; i++) print \"dc=\"\\\$i\",\" }{ print \"dc=\"\\\$NF }")
1381
1382         zenity --info \
1383             --title="$ldaptitle" \
1384             --width=500 \
1385             --text="global zone will be LDAP client of $ldapserver"
1386
1387         ldapout=$TXTMP/ldapclient.$$
1388
1389         ldapclient init -a profileName="$ldapprofile" \
1390             -a domainName="$ldapdomain" \
1391             -a proxyDN"=cn=proxyagent,ou=profile,$proxyDN" \
1392             -a proxyPassword="$ldappassword" \
1393             "$ldapserveraddr" >$ldapout 2>&1
1394
1395         if [ $? -eq 0 ] ; then
1396             ldapstatus=Success
1397         else
1398             ldapstatus=Error
1399         fi
1400
1401         zenity --text-info \
1402             --width=700 \
1403             --height=300 \
1404             --title="$ldaptitle: $ldapstatus" \
1405             --filename=$ldapout
1406
1407         rm -f $ldapout
1408
1409
1410 }
1411
1412 tearDownZones() {
1413         if [ $DISP -eq 0 ] ; then
1414                 if [ $FORCE -eq 0 ] ; then
1415                         gettext "OK to destroy all zones [y|N]? "
1416                         read ans
1417                         printf "%s\n" "$ans" \
1418                             | /usr/xpg4/bin/grep -Eq "$(locale yesexpr)"
1419                         if [ $? -ne 0 ] ; then
1420                                 gettext "canceled.\n"
1421                                 return 1
1422                         fi
1423                 fi
1424                 gettext "destroying all zones ...\n"
1425         else
1426                 killall=$(zenity --question \
1427                     --title="$title" \
1428                     --width=330 \
1429                     --text="$msg_confirmkill")
1430                 if [[ $? != 0 ]]; then
1431                         return
1432                 fi
1433         fi
1434
1435         for p in $(zoneadm list -cp|grep -v global:) ; do
1436                 zonename=$(echo "$p"|cut -d : -f2)
1437                 if [ $DISP -eq 0 ] ; then
1438                         gettext "destroying zone $zonename ...\n"
1439                 fi
1440                 zoneadm -z $zonename halt 1>/dev/null 2>&1
1441                 zoneadm -z $zonename uninstall -F 1>/dev/null 2>&1
1442                 delete -rRf
1443         done
1444         zonename=global
1445 }
1446
1447 createDefaultZones() {
1448         # If GUI display is not used, skip the dialog
1449         if [ $DISP -eq 0 ] ; then
1450                 createDefaultPublic
1451                 if [ $? -ne 0 ] ; then
1452                         return 1
1453                 fi
1454                 createDefaultInternal
1455                 return
1456         fi
1457
1458         msg_choose1=$(gettext "Choose one:")
1459         defpub=$(gettext "$PUBZONE zone only")
1460         defboth=$(gettext "$PUBZONE and $INTZONE zones")
1461         defskip=$(gettext "Main Menu...")
1462         command=$(echo ""\
1463             "$defpub\n" \
1464             "$defboth\n" \
1465             "$defskip\n" \
1466             | zenity --list \
1467             --title="$title" \
1468             --text="$msg_defzones" \
1469             --column="$msg_choose1" \
1470             --height=400 \
1471             --width=330 )
1472
1473         case $command in
1474             " $defpub")
1475                 createDefaultPublic ;;
1476
1477             " $defboth")
1478                 createDefaultPublic
1479                 if [ $? -ne 0 ] ; then
1480                         return 1
1481                 fi
1482                 createDefaultInternal ;;
1483
1484             *)
1485                 return;;
1486         esac
1487 }
1488
1489 createDefaultPublic() {
1490         zonename=$PUBZONE
1491         if [ $DISP -eq 0 ] ; then
1492                 gettext "creating default $zonename zone ...\n"
1493         fi
1494         newZone
1495         zone_cnt+=1
1496         hexlabel=$DEFAULTLABEL
1497         setTNdata
1498         sharePrimaryNic
1499
1500         install
1501         if [ $? -ne 0 ] ; then
1502                 return 1
1503         fi
1504
1505         if [ $DISP -eq 0 ] ; then
1506                 gettext "booting zone $zonename ...\n"
1507                 zoneadm -z $zonename boot
1508         else
1509                 zoneadm -z $zonename boot &
1510                 gnome-terminal \
1511                     --disable-factory \
1512                     --title="Zone Console: $zonename $msg_continue" \
1513                     --command "zlogin -C $zonename"
1514         fi
1515 }
1516
1517 createDefaultInternal() {
1518         zoneadm -z $PUBZONE halt
1519
1520         zonename=snapshot
1521         newZone
1522         zone_cnt+=1
1523         zonecfg -z $zonename set autoboot=false
1524
1525         clone $PUBZONE
1526         zoneadm -z $PUBZONE boot &
1527
1528         zonename=$INTZONE
1529         if [ $DISP -eq 0 ] ; then
1530                 gettext "creating default $zonename zone ...\n"
1531         fi
1532         newZone
1533         zone_cnt+=1
1534
1535         hexlabel=$INTLABEL
1536         x=$(grep -i :{$hexlabel}: $TNZONECFG)
1537         if [ $? = 0 ] ; then
1538                 z=$(print $x|cut -d : -f1)
1539                 echo "$msg_inuse $z zone."
1540         else
1541                 setTNdata
1542         fi
1543
1544         clone snapshot
1545         if [ $DISP -eq 0 ] ; then
1546                 gettext "booting zone $zonename ...\n"
1547         else
1548                 gnome-terminal \
1549                     --title="Zone Console: $zonename" \
1550                     --command "zlogin -C $zonename" &
1551         fi
1552         zoneadm -z $zonename boot &
1553 }
1554
1555 selectZone() {
1556         set -A zonelist "global\nrunning\nADMIN_HIGH"
1557         integer zone_cnt=1
1558
1559         for p in $(zoneadm list -cp|grep -v global:) ; do
1560                 zone_cnt+=1
1561         done
1562         if [ $zone_cnt == 1 ] ; then
1563                 createDefaultZones
1564         fi
1565         if [ $zone_cnt == 1 ] ; then
1566                 zonename=global
1567                 singleZone
1568                 return
1569         fi
1570
1571         zone_cnt=1
1572         for p in $(zoneadm list -cp|grep -v global:) ; do
1573                 zonename=$(echo "$p"|cut -d : -f2)
1574                 state=$(echo "$p"|cut -d : -f3)
1575                 hexlabel=$(grep "^$zonename:" $TNZONECFG|cut -d : -f2)
1576                 if [[ $hexlabel ]] ; then
1577                         curlabel=$(hextoalabel $hexlabel)
1578                 else
1579                         curlabel=...
1580                 fi
1581                 zonelist[zone_cnt]="\n$zonename\n$state\n$curlabel"
1582                 zone_cnt+=1
1583         done
1584         zonename=$(print "${zonelist[*]}"|zenity --list \
1585             --title="$title" \
1586             --text="$msg_getzone" \
1587             --height=300 \
1588             --width=500 \
1589             --column="Zone Name" \
1590             --column="Status" \
1591             --column="Sensitivity Label" \
1592         )
1593
1594         # if the menu choice was a zonename, pop up zone menu
1595         if [[ -n $zonename ]] ; then
1596                 singleZone
1597         else
1598                 exit
1599         fi
1600 }
1601
1602 # Loop for single-zone menu
1603 singleZone() {
1604
1605         while (( 1 )) do
1606                 # Clear list of commands
1607
1608                 console=
1609                 label=
1610                 start=
1611                 reboot=
1612                 stop=
1613                 clone=
1614                 install=
1615                 ready=
1616                 uninstall=
1617                 autoboot=
1618                 delete=
1619                 deletenet=
1620                 permitrelabel=
1621
1622                 if [ $zone_cnt -gt 1 ] ; then
1623                         killZones="Destroy all zones...\n"
1624                         xit="Select another zone..."
1625                 else
1626                         killZones=
1627                         xit="Exit"
1628                 fi
1629                 if [ $zonename = global ] ; then
1630                         ldapClient="Create LDAP Client...\n"
1631                         nscdOpt="$NSCD_OPT\n"
1632                         createZone="Create a new zone...\n"
1633                         addnet="Configure Network Interfaces...\n"
1634                 else
1635                         ldapClient=
1636                         nscdOpt=
1637                         createZone=
1638                         addnet=
1639                         killZones=
1640                 fi
1641
1642                 zonestate=$(zoneadm -z $zonename list -p | cut -d : -f 3)
1643
1644                 consoleCheck;
1645                 labelCheck;
1646                 delay=0
1647
1648                 if [ $zonename != global ] ; then
1649                         case $zonestate in
1650                                 running)
1651                                         ready="Ready\n"
1652                                         reboot="Reboot\n"
1653                                         stop="Halt\n"
1654                                         ;;
1655                                 ready)
1656                                         start="Boot\n"
1657                                         stop="Halt\n"
1658                                         ;;
1659                                 installed)
1660                                         if [[ -z $label ]] ; then
1661                                                 ready="Ready\n"
1662                                                 start="Boot\n"
1663                                         fi
1664                                         uninstall="Uninstall\n"
1665                                         relabelCheck
1666                                         autobootCheck
1667                                         ;;
1668                                 configured)
1669                                         install="Install...\n"
1670                                         cloneCheck
1671                                         delete="Delete\n"
1672                                         console=
1673                                         ;;
1674                                 incomplete)
1675                                         uninstall="Uninstall\n"
1676                                         ;;
1677                                 *)
1678                                 ;;
1679                         esac
1680                 fi
1681
1682                 command=$(echo ""\
1683                     $createZone \
1684                     $console \
1685                     $label \
1686                     $start \
1687                     $reboot \
1688                     $stop \
1689                     $clone \
1690                     $install \
1691                     $ready \
1692                     $uninstall \
1693                     $delete \
1694                     $addnet \
1695                     $deletenet \
1696                     $addremotehost \
1697                     $addcipsohost \
1698                     $removeremotehost \
1699                     $removecipsohost \
1700                     $setmlps \
1701                     $permitrelabel \
1702                     $autoboot \
1703                     $ldapClient \
1704                     $nscdOpt \
1705                     $killZones \
1706                     $xit \
1707                     | zenity --list \
1708                     --title="$title" \
1709                     --text="$msg_getcmd" \
1710                     --height=400 \
1711                     --width=330 \
1712                     --column "Zone: $zonename   Status: $zonestate" )
1713
1714                 case $command in
1715                     " Create a new zone...")
1716                         zonename=
1717                         newZone ;;
1718
1719                     " Zone Console...")
1720                         delay=2
1721                         gnome-terminal \
1722                             --title="Zone Console: $zonename" \
1723                             --command "zlogin -C $zonename" & ;;
1724
1725                     " Select Label...")
1726                         selectLabel;;
1727
1728                     " Ready")
1729                         zoneadm -z $zonename ready ;;
1730
1731                     " Boot")
1732                         zoneadm -z $zonename boot ;;
1733
1734                     " Halt")
1735                         zoneadm -z $zonename halt ;;
1736
1737                     " Reboot")
1738                         zoneadm -z $zonename reboot ;;
1739
1740                     " Install...")
1741                         install;;
1742
1743                     " Clone...")
1744                         clone ;;
1745
1746                     " Uninstall")
1747                         zoneadm -z $zonename uninstall -F;;
1748
1749                     " Delete")
1750                         delete
1751                         return ;;
1752
1753                     " Configure Network Interfaces...")
1754                         if [ $zonename = global ] ; then
1755                                 manageNets
1756                         else
1757                                 manageZoneNets
1758                         fi;;
1759
1760                     " Add Single-level Access to Remote Host...")
1761                         addTnrhdb ;;
1762
1763                     " Add Multilevel Access to Remote Host...")
1764                         template=cipso
1765                         addTnrhdb ;;
1766
1767                     " Remove Single-level Access to Remote Host...")
1768                         removeTnrhdb ;;
1769
1770                     " Remove Multilevel Access to Remote Host...")
1771                         template=cipso
1772                         removeTnrhdb ;;
1773
1774                     " Configure Multilevel Ports...")
1775                         setMLPs;;
1776
1777                     " Permit Relabeling")
1778                         zonecfg -z $zonename set limitpriv=default,\
1779 win_mac_read,win_mac_write,win_selection,win_dac_read,win_dac_write,\
1780 file_downgrade_sl,file_upgrade_sl,sys_trans_label ;;
1781
1782                     " Deny Relabeling")
1783                         zonecfg -z $zonename set limitpriv=default ;;
1784
1785                     " Set Automatic Booting")
1786                         zonecfg -z $zonename set autoboot=true ;;
1787
1788                     " Set Manual Booting")
1789                         zonecfg -z $zonename set autoboot=false ;;
1790
1791                     " Create LDAP Client...")
1792                         createLDAPclient ;;
1793
1794                     " Configure per-zone name service")
1795                         manageNscd ;;
1796
1797                     " Unconfigure per-zone name service")
1798                         manageNscd ;;
1799
1800                     " Destroy all zones...")
1801                         tearDownZones
1802                         return ;;
1803
1804                     *)
1805                         if [ $zone_cnt == 1 ] ; then
1806                                 exit
1807                         else
1808                                 return
1809                         fi;;
1810                 esac
1811                 sleep $delay;
1812         done
1813 }
1814
1815 # Main loop for top-level window
1816 #
1817
1818 /usr/bin/plabel $$ 1>/dev/null 2>&1
1819 if [ $? != 0 ] ; then
1820         gettext "$0 : Trusted Extensions must be enabled.\n"
1821         exit 1
1822 fi
1823
1824 myzone=$(/sbin/zonename)
1825 if [ $myzone != "global" ] ; then
1826         gettext "$0 : must be in global zone to run.\n"
1827         exit 1
1828 fi
1829
1830
1831 process_options "$@" || exit
1832
1833 mkdir $TXTMP 2>/dev/null
1834 deflabel=$(chk_encodings -a|grep "Default User Sensitivity"|\
1835    sed 's/= /=/'|sed 's/"/'''/g|cut -d"=" -f2)
1836 DEFAULTLABEL=$(atohexlabel ${deflabel})
1837 intlabel=$(chk_encodings -a|grep "Default User Clearance"|\
1838    sed 's/= /=/'|sed 's/"/'''/g|cut -d"=" -f2)
1839 INTLABEL=$(atohexlabel -c "${intlabel}")
1840
1841 # are there any zfs pools?
1842 ZDSET=none
1843 zpool iostat 1>/dev/null 2>&1
1844 if [ $? = 0 ] ; then
1845         # is there a zfs pool named "zone"?
1846         zpool list -H zone 1>/dev/null 2>&1
1847         if [ $? = 0 ] ; then
1848                 # yes
1849                 ZDSET=zone
1850         else
1851                 # no, but is there a root pool?
1852                 rootfs=$(df -n / | awk '{print $3}')
1853                 if [ $rootfs = "zfs" ] ; then
1854                         # yes, use it
1855                         ZDSET=$(zfs list -Ho name / | cut -d/ -f 1)/zones
1856                         zfs list -H $ZDSET 1>/dev/null 2>&1
1857                         if [ $? = 1 ] ; then
1858                                 createZDSET "-o mountpoint=/zone" $ZDSET
1859                         fi
1860                 fi
1861         fi
1862 fi
1863
1864 if [ $DISP -eq 0 ] ; then
1865         gettext "non-interactive mode ...\n"
1866
1867         if [ $DESTROYZONES -eq 1 ] ; then
1868                 tearDownZones
1869         fi
1870
1871         if [ $CREATEDEF -eq 1 ] ; then
1872                 if [[ $(zoneadm list -c) == global ]] ; then
1873                         createDefaultZones
1874                 else
1875                         gettext "cannot create default zones because there are existing zones.\n"
1876                 fi
1877         fi
1878
1879         exit
1880 fi
1881
1882 if [ $NSCD_PER_LABEL -eq 0 ] ; then
1883         NSCD_OPT="Configure per-zone name service"
1884 else
1885         NSCD_OPT="Unconfigure per-zone name service"
1886 fi
1887
1888
1889 while (( 1 )) do
1890         selectZone
1891 done