How to Create and Share a Multilevel Dataset

Language:

Multilevel datasets are useful containers when you downgrade or upgrade information. For more information, see Multilevel Datasets for Relabeling Files. Multilevel datasets are also useful for multilevel NFS file servers to provide files at many labels to a number of NFS clients.

Before You Begin

To create a multilevel dataset, you must be in the root role in the global zone.

Create a multilevel dataset.
```
# zfs create -o mountpoint=/multi -o multilevel=on rpool/multi
```
rpool/multi is a multilevel dataset that is mounted in the global zone at /multi.
To limit the upper label range of the dataset, see Example 10, Creating a Multilevel Dataset With a Highest Label Below ADMIN_HIGH.
Verify that the multilevel dataset is mounted and that the mountpoint has the ADMIN_LOW label.
```
# getlabel /multi
/multi: ADMIN_LOW
```

Protect the parent file system.

Set the following ZFS properties to off for all file systems in the pool:

# zfs set devices=off rpool/multi
# zfs set exec=off rpool/multi
# zfs set setuid=off rpool/multi

(Optional)Set the compression property of the pool.
Typically, compression is set in ZFS at the file system level. However, because all the file systems in this pool are data files, compression is set at the top-level dataset for the pool.
```
# zfs set compression=on rpool/multi
```
See also Interactions Between ZFS Compression, Deduplication, and Encryption Properties in Managing ZFS File Systems in Oracle Solaris 11.4.

Create top-level directories for each label that you want in the multilevel dataset.

# cd /multi
# mkdir public internal
# chmod 777 public internal
# setlabel PUBLIC public
# setlabel "CNF : INTERNAL" internal

Use LOFS to mount the multilevel dataset in every labeled zone that is approved to have access.
For example, the following series of zonecfg commands mounts the dataset in the public zone.
```
# zonecfg -z public
zonecfg:public> add fs
zonecfg:public:fs> set dir=/multi
zonecfg:public:fs> set special=/multi
zonecfg:public:fs> set type=lofs
zonecfg:public:fs> end
zonecfg:public> exit
```
Multilevel datasets permit writing files at the same label as the mounting zone and reading lower-level files. The label of the mounted files can be viewed and set.
To use NFS to share the multilevel dataset with other systems, do the following:
1. Make the NFS service in the global zone into a multilevel service.
```
# tncfg -z global add mlp_private=2049/tcp
# tncfg -z global add mlp_private=111/udp
# tncfg -z global add mlp_private=111/tcp
```
2. Restart the NFS service.
```
# svcadm restart nfs/server
```
3. Share the multilevel dataset.
```
# share /multi
```
NFS-mounted multilevel datasets permit writing files at the same label as the mounting zone and reading lower-level files. The label of the mounted files cannot be viewed reliably or set. For more information, see Mounting Multilevel Datasets From Another System.

Example 10 Creating a Multilevel Dataset With a Highest Label Below ADMIN_HIGH

In this example, the administrator creates a multilevel dataset with a upper bound, or highest label, that is lower than the default, ADMIN_HIGH. At dataset creation, the administrator specifies the upper label bound in the mslabel property. This upper bound prevents global zone processes from creating any files or directories in the multilevel dataset. Only labeled zone processes can create directories and files in the dataset. Because the multilevel property is on, the mlslabel property sets the upper bound, not the label for a single-label dataset.

# zfs create -o mountpoint=/multiIUO -o multilevel=on \
   -o mlslabel="CNF : INTERNAL" rpool/multiIUO

Then, the administrator logs in to each labeled zone to create a directory at that label in the mounted dataset.

# zlogin public
# mkdir /multiIUO
# chmod 777 /multiIUO
# zlogin internal
# mkdir /multiIUO
# chmod 777 /multiIUO

The multilevel datasets are visible at the label of the mounting zone to authorized users after the zone is rebooted.

Next Steps

To enable users to relabel files, see How to Enable Files to Be Relabeled From a Labeled Zone.