Trusted Extensions Configuration and Administration

Exit Print View

Updated: July 2014
 
 

Multilevel Datasets for Relabeling Files

A multilevel ZFS dataset contains files and directories at different labels. Each file and directory is individually labeled, and the labels can be changed without moving or copying the files. Files can be relabeled within the dataset's label range. To create and share multilevel datasets, see How to Create and Share a Multilevel Dataset.

Normally, all the files and directories in a dataset have the same label as the zone in which the dataset is mounted. This label is recorded automatically in a ZFS property called mlslabel when the dataset is first mounted in the zone. These datasets are single-level labeled datasets. The mlslabel property cannot be changed while the dataset is mounted, that is, the mounting zone cannot change the mlslabel property.

After the mlslabel property is set, the dataset cannot be mounted read-write in a zone unless the zone's label matches the mlslabel property of the dataset. Furthermore, a dataset cannot be ZFS-mounted in any zone if it is currently ZFS-mounted in any other zone, including the global zone. Because the labels of files in a single-level labeled dataset are fixed, when you relabel a file with the setlabel command, the file is actually moved to the equivalent pathname in the primary zone that corresponds to the target label. This movement across zones can be inefficient and confusing. Multilevel datasets provide an efficient container for relabeling data.

For multilevel datasets that are mounted in the global zone, the default value of the mlslabel property is ADMIN_HIGH. This value specifies the upper bound of the label range of the dataset. If you specify a lower label, you can only write to the dataset from zones whose labels are dominated by the mlslabel property.

Users or roles with the Object Label Management rights profile have the appropriate privileges to upgrade or downgrade files or directories to which they have DAC access. For the procedure, see How to Enable a User to Change the Security Level of Data.

    For the user process, additional policy constraints apply.

  • By default, no process in a labeled zone can relabel files or directories. To enable relabeling, see How to Enable Files to Be Relabeled From a Labeled Zone. To specify more granular controls, for example, permitting downgrading files but not upgrading files, see Example 13–5.

  • Directories cannot be relabeled unless they are empty.

  • Files and directories cannot be downgraded below the label of their containing directory.

    To relabel, you first move the file to the lower-level directory, then relabel it.

  • Zones that mount the dataset cannot upgrade a file or directory above the zone label.

  • Files cannot be relabeled if they are currently open by a process in any zone.

  • File and directories cannot be upgraded above the mlslabel value of the dataset.