The file-mac-profile property enables you to run zones with a read-only root file system. This feature enables you to choose between four predefined profiles that determine how much of a zone file system is read-only only, even for processes that have allzone privileges. See zonecfg file-mac-profile Property in Creating and Using Oracle Solaris Zones .