You might want to extend a user's label range to give the user read access to an administrative application. For example, a user who can log in to the global zone could then run the Solaris Management Console. The user could view, but not not change the contents.
Alternatively, you might want to restrict the user's label range. For example, a guest user might be limited to one label.
You must be in the Security Administrator role in the global zone.
Open a Trusted Extensions toolbox in the Solaris Management Console.
Use a toolbox of the appropriate scope. For details, see Initialize the Solaris Management Console Server in Trusted Extensions in Oracle Solaris Trusted Extensions Configuration Guide.
Under System Configuration, navigate to User Accounts.
A password prompt might be displayed.
Type the role password.
Select the individual user from User Accounts.
Click the Trusted Extensions Attributes tab.
To save the changes, click OK.