Write-Down Policy in the Global Zone

The ability of a subject, such as a process, to write an object whose label it dominates is referred to as writing down. The write-down policy in the global zone is specified administratively. Because global zone processes run at the ADMIN_HIGH label, certain file systems that are associated with other labels can be mounted read-write in the global zone. However, these special file system mounts must be administratively specified in automount maps, and they must be mounted by the global zone automounter. These mounts must have mount points within the zone path of the zone that has the same label as the exported file system. However, these mount points must not be visible from within the labeled zone.

For example, if the PUBLIC zone has a zone path of /zone/public, a writable mount point of /zone/public/home/mydir is permitted. However, a writable mount point of /zone/public/root/home/mydir is not permitted because it can be accessed by the labeled zone and not by the global zone. No cross-zone NFS mounts are permitted, which means that the NFS-mounted files can only be accessed by processes that run in the zone that mounted the file system. Global zone processes can write down to such files, subject to the standard discretionary access control (DAC) policy.

Local file systems associated with zones are protected from access by global zone processes by DAC, which uses file permissions and access control lists (ACLs). The parent directory of each zone's root (/) directory is only accessible by root processes or by processes that assert the file_dac_search privilege.

In general, the ability to write down from the global zone is restricted. Typically, writing down is used only when a file is reclassified by using the setflabel() interface or when privileged users drag and drop files between File Manager applications in different zones.