Mutable and immutable zones are differentiated by their MWAC security policy, which you specify with the file-mac-profile property of the zonecfg command.
By default, the file-mac-profile property is not set and the zone has a writable root dataset.
Several values for file-mac-profile restrict access to all or part of the runtime environment from inside the zone. All of the profiles except none will cause the /var/pkg directory and its contents to be read-only from inside the zone. The none MWAC security policy is equivalent to an unset MWAC security policy.
The following MWAC values restrict access to all or part of the runtime environment from inside the zone:
Read-only file system, no exceptions.
IPS packages cannot be installed.
Persistently enabled SMF services are fixed.
SMF manifests cannot be added from the default locations.
Logging and auditing configuration files are fixed. Data can only be logged remotely.
Running an NFS server inside an immutable zone with this profile is not supported. You must use the fixed-configuration profile to run an NFS server.
Permits updates to /var/* directories, with the exception of directories that contain system configuration components.
IPS packages, including new packages, cannot be installed.
Persistently enabled SMF services are fixed.
SMF manifests cannot be added from the default locations.
Logging and auditing configuration files can be local. syslog and audit configuration are fixed.
Permits modification of files in /etc/* directories, changes to root's home directory, and updates to /var/* directories. This configuration provides the closest functionality to the Oracle Solaris 10 native sparse root zone documented in the Oracle Solaris 10 guide, System Administration Guide: Oracle Solaris Containers-Resource Management and Oracle Solaris Zones.
IPS packages, including new packages, cannot be installed.
Persistently enabled SMF services are fixed.
SMF manifests cannot be added from the default locations.
Logging and auditing configuration files can be local. syslog and audit configuration can be changed.
Is valid for global zones, including the global zone of a kernel zone. Permits the creation and the destroying of kernel zones and non-global zones.
Is equivalent to fixed-configuration, but adds the ability to create and destroy kernel zones and non-global zones.
Is similar to flexible-configuration, but dynamic-zones cannot write to files in the /etc directory.
In this example, you are assigned the Zone Security rights profile and create an immutable zone. In this zone, the zone administrator can create and destroy kernel and non-global zones. Otherwise, the zone is immutable.
$ zonecfg -z global set file-mac-profile=dynamic-zones
After the MWAC security policy is set and you reboot the immutable zone, the zone boots transient read-write until it reaches the self-assembly-complete milestone and then reboots in read-only mode.
Datasets that you add to a zone through the zonecfg add dataset command are not subject to MWAC policy. Zones have full control over added datasets. The platform datasets are visible, but their data and their properties are read-only unless the zone is booted read/write.
File systems that you add to a zone through the zonecfg add fs command are not subject to MWAC policy. To maintain the policy, mount the file systems read-only.
Changes that you make to an immutable zone through the SMF commands described in the svcadm(1M) and svccfg(1M) man pages are only applicable to the temporary, live SMF database, not to the on-disk SMF database. If you modify the zone's MWAC security policy, the changes take effect when the zone is rebooted.