Zone customisation using SMF

From: Lion-O (nosp_at_m.catslair.org)
Date: 10/23/05


Date: Sat, 22 Oct 2005 23:30:26 -0000

Hi there!

Finally a message which doesn't contain a question of any kind, just
meant to share some experiences with you guys while hoping it may
benefit someone.

I recently started moving certain services into my non-global zone and
with that also decided that some of these really needed a SMF manifest
so that I could manage them using SMF. Fortunatly the xml files are easy
to write once you grasped the common structure and thus I started
thinking about how I'd setup the zone itself. With zones you can toggle
the flag to start them automaticly but that still leaves you without
options to setup an environment. For example; my non-global zone is
setup on a whole different network than my global zone (partly for
security considerations) but this automaticly implies the need for a few
route entries before I can actually reach this non-global zone.

Then I started thinking... I figured a script file which was started by
a manifest on its own would be the best solution. And after reading the
decriptions I figured a milestone manifest would be best suited for this
setup. This does present you with a minor issue; there already is a
manifest for zones (svc:/system/zones) but its not usuable for
customisation, even making a new service which depends on this would
still leave you with the problem of picking the right zone(s). So
following this lead will give you 2 'zones' services. The one mentioned
above and svc:/milestone/zones.

To this end I decided not to configure the zones to boot automaticly
(thus also hoping to reduce a little load on the system during reboots)
and instead creating a new manifest which' script basicly starts the
zone(s) and sets up the environment. To this end I'm using a batchfile
which responds to start/stop to setup or disable the specific
configuration entries.

Well, I figured I might as well dump the files in here, perhaps someone
can also find some good use for them.

-=[ /var/svc/manifest/milestone/zonestart.xml ]=-

<?xml version="1.0"?>
<!DOCTYPE service_bundle SYSTEM "/usr/share/lib/xml/dtd/service_bundle.dtd.1">
<!--
        Zonestart is the milestone where all zones are started and their
        specific environment (routing, arp entry, etc.) has been fully
        configured.
-->

<service_bundle type='manifest' name='Zone_environment'>
<service name='milestone/zones' type='service' version='1'>

        <create_default_instance enabled='false' />
        <single_instance />

        <dependency
                name='filesystems'
                grouping='require_all'
                restart_on='none'
                type='service'>
                <service_fmri value='svc:/system/filesystem/local' />
        </dependency>

        <dependency
                name='network'
                grouping='require_all'
                restart_on='error'
                type='service'>
                <service_fmri value='svc:/milestone/network' />
        </dependency>

        <dependency
                name='system_zones'
                grouping='require_all'
                restart_on='refresh'
                type='service'>
                <service_fmri value='svc:/system/zones:default' />
        </dependency>

        <exec_method
                type='method'
                name='start'
                exec='/usr/local/sbin/zone-setup start'
                timeout_seconds='30' />

        <exec_method
                type='method'
                name='stop'
                exec='/usr/local/sbin/zone-setup stop'
                timeout_seconds='60' />

        <property_group name='general' type='framework'>
                <propval name='duration' type='astring' value='transient' />
        </property_group>

        <stability value='Evolving' />
        <template>
                <common_name>
                        <loctext xml:lang='C'>
                                Local configuration milestone
                        </loctext>
                </common_name>
        </template>
</service>

</service_bundle>

---[ EOF ]---

And then the batch file which matches the above manifest. However, as you may
notice I was a little too enthousiast with the comments above; I haven't
finished the part which turns the relevant arp entry from dynamic to static
yet.

-=[ /usr/local/sbin/zone-setup ]=-

#!/bin/sh
#
# Zone Setup -> Start the zone(s) and setup their environment

set -e

PATH=/usr/sbin:/usr/bin:/usr/local/sbin

# Function that starts the daemon/service.
#
d_start() {
        zoneadm -z pandora boot
        route add <net-range> <zone-ip> -iface
        route add <default-route> <zone-ip> -iface
}

# Function that stops the daemon/service.
#
d_stop() {
        route delete <net-range> <zone-ip> -iface
        route delete <default-route> <zone-ip> -iface
        zoneadm -z pandora halt
}

case "$1" in
  start)
        echo "Starting local zones"
        d_start
        echo "."
        ;;
  stop)
        echo "Stopping local zones"
        d_stop
        echo "."
        ;;
  *)
        echo "Usage: $0 {start|stop}" >&2
        exit 1
        ;;
esac

exit 0

---[ EOF ]---

Needless to say you will need to edit the shellscript and define the right
values.

-- 
Groetjes, Peter
.\\ PGP/GPG key: http://www.catslair.org/pubkey.asc


Relevant Pages

  • For anyone interested in blocking nameserver lookups to sites
    ... I am using a BIND ... 8.2.x series name server and a semi-current version of RedHat Linux. ... Setup your forwarders as your primary and secondary name servers (these are ... zone "doubleclick.net" in { ...
    (comp.os.linux.security)
  • Re: Is my two domain setup correct?
    ... I am trying to get my head round the setup. ... Surely if the root domain zone is AD intergrated and the child domain is ...
    (microsoft.public.windows.server.dns)
  • Re: For anyone interested in blocking nameserver lookups to sites
    ... > 8.2.x series name server and a semi-current version of RedHat Linux. ... > The first thing that you need to do is setup the start of the named.conf ... > zone "doubleclick.net" in { ... > however you can go into Internet Options -> Advanced tab and turn off ...
    (comp.os.linux.security)
  • RE: Problem migrating computer accounts
    ... could it be because of DNS configuration. ... Just want to confirm my dns setup ... vice-versa setup nt4.o domain as a secondary zone in the AD domain. ...
    (microsoft.public.windows.server.migration)
  • Re: Nameserver scenario with advertisers and resolvers - Solution Sum
    ... These are the two "hidden" DNS servers. ... I setup two more DNS servers in a Primary/Secondary configuration ... I created the zone for the internal domain. ...
    (microsoft.public.windows.server.dns)

Loading