The following decisions affect the actions that users can perform in Trusted Extensions and how much effort is required. Some decisions are the same as the decisions that you would make when installing the Oracle Solaris OS. However, decisions that are specific to Trusted Extensions can affect site security and ease of use.
Decide whether to change default user security attributes in the policy.conf file. User defaults in the label_encodings file were originally configured by the initial setup team. For a description of the defaults, see Default User Security Attributes in Trusted Extensions.
Decide which startup files, if any, to copy or link from each user's minimum-label home directory to the user's higher-level home directories. For the procedure, see How to Configure Startup Files for Users in Trusted Extensions.
Decide if user accounts must be created separately in labeled zones.
By default, labeled zones share the global zone's name service configuration. Therefore, user accounts are created in the global zone for all zones. The /etc/passwd and /etc/shadow files in the labeled zones are read-only views of the global zone files. Similarly, LDAP databases are read-only in labeled zones.
Applications that you install to a zone from within a zone can require the creation of user accounts, such as pkg:/service/network/ftp. To enable a zone-specific application to create a user account, you must configure the per-zone name service daemon, as described in How to Configure a Separate Name Service for Each Labeled Zone. The user accounts that such applications add to a labeled zone must be manually managed by the zone administrator.