How to Configure a Kernel Zone as an Immutable (Read-Only) Zone

1. Become an administrator.

   For more information, see Using Your Assigned Administrative Rights in Securing Users and Processes in Oracle Solaris 11.2 .

2. Boot the kernel zone.

   # zoneadm kernel-zone-name boot

3. Log into the kernel zone.

   # zlogin kernel-zone-name

4. Set the immutable zone from within the kernel zone.

   kernel-zone-name# zonecfg -z global set file-mac-profile=value

   For example:

   kzone1# zonecfg -z global set file-mac-profile=flexible-configuration
   	updating /platform/i86pc/amd64/boot_archive

5. Reboot the kernel zone.

   kernel-zone-name# reboot