By default, filesystems are assigned a single label in a zone at that same label. You can create a multilevel ZFS dataset, mount it on a Trusted Extensions system, and with appropriate permissions, upgrade and downgrade the files in that dataset. For more information, see Multilevel Datasets for Relabeling Files in Trusted Extensions Configuration and Administration .