Primary and Secondary Labeled Zones

The first zone that you create at a specific label is a primary labeled zone. Its label is unique. You can create no other primary zone at that label.

A secondary zone is a zone at the label of a primary zone. With a secondary zone, you can isolate services in separate zones at the same label. Those services can share network resources such as name servers, printers, and databases without the use of privilege. You can have multiple secondary zones at the same label.

Specifically, secondary zones differ from primary zones in the following ways:

• The label assignments of secondary zones do not need to be unique.

• Secondary zones must use exclusive IP networking.

  This restriction ensures that a labeled packet reaches the correct zone.

• Secondary zones do not have GNOME packages installed.

  Secondary zones are not visible on the GNOME Trusted Desktop.

• Secondary zones cannot be the destination zone for the setlabel command.

  If several zones are at the same label, the destination zone cannot be resolved by the command.

For any label, there can be at most one primary labeled zone and an arbitrary number of secondary labeled zones. The global zone remains an exception. It is the only zone that can be assigned the ADMIN_LOW label and therefore cannot have a secondary zone. To create a secondary zone, see How to Create a Secondary Labeled Zone and the zenity(1) man page.