Security Restrictions and File System Behavior
Mounting certain file systems from within a zone presents a security risk. Non-default file systems exhibit special behavior when mounted in a zone. The list of modified file systems follows.
- AutoFS
-
AutoFS is a client-side service that automatically mounts the appropriate file system. AutoFS mounts established within a zone are local to that zone and cannot be accessed from other zones, including the global zone. The mounts are removed when the zone is halted or rebooted. For more information about AutoFS, see How Autofs Works in Managing Network File Systems in Oracle Solaris 11.4.
Each zone runs its own copy of
automountd
. The auto maps and timeouts are controlled by the zone administrator.An AutoFS mount that is created in the kernel when another mount is triggered cannot be removed by using the regular
umount
interface. These mounts are unmounted as a group during zone shutdown. - MNTFS
-
MNTFS is a virtual file system that provides read-only access to the table of mounted file systems for the local system. The set of file systems visible by using
mnttab
from within a non-global zone is the set of file systems mounted in the zone, plus an entry for root (/
). All mounts in the system are visible from the global zone's/etc/mnttab
table. For more information about MNTFS, see Mounting File Systems in Managing Network File Systems in Oracle Solaris 11.4. - NFS
-
NFS mounts that are established within a zone are local to that zone and cannot be accessed from other zones, including the global zone. The mounts are removed when the zone is halted or rebooted.
From within a zone, NFS mounts behave as though mounted with the
nodevices
option.The
nfsstat
command output only pertains to the zone in which the command is run. For more information, seenfsstat
(8). - PROCFS
-
The
/proc
file system, or PROCFS, provides process visibility and access restrictions as well as information about the zone association of processes. Only processes in the same zone are visible through/proc
.Processes in the global zone can observe processes and other objects in non-global zones.
From within a zone,
procfs
mounts behave as though mounted with thenodevices
option. For more information aboutprocfs
, see theproc
(5) man page. - LOFS
-
The scope of what can be mounted through LOFS is limited to the portion of the file system that is visible to the zone. Hence, there are no restrictions on LOFS mounts in a zone.
- UFS, UDFS, PCFS, and other storage-based file systems
-
When using the
zonecfg
command to configure storage-based file systems that have anfsck
binary, such as UFS, the zone administrator must specify araw
parameter. The parameter indicates the raw (character) device, such as/dev/rdsk/c0t0d0s7
. Thezoneadmd
daemon automatically runs thefsck
command in preen mode (fsck -p
), which checks and fixes the file system non-interactively, before it mounts the file system. If thefsck
fails,zoneadmd
cannot bring the zone to theready
state. The path specified byraw
cannot be a relative path.It is an error to specify a device to
fsck
for a file system that does not provide anfsck
binary in/usr/lib/fs/
fstype/fsck
. It is also an error if you do not specify a device tofsck
if anfsck
binary exists for that file system.For more information, see zoneadmd Zones Administration Daemon and the
fsck
(8) man page. - ZFS
-
In addition to the default dataset described in File Systems Mounted in Zones in Oracle Solaris Zones Configuration Resources, you can add a ZFS dataset to a non-global zone by using the
zonecfg
command with theadd dataset
resource. The dataset is visible and mounted in the non-global zone, and also visible in the global zone. The zone administrator can create and destroy file systems within that dataset, and modify the properties of the dataset.The
zoned
attribute ofzfs
indicates whether a dataset has been added to a non-global zone.$ pfexec zfs get zoned dataset NAME PROPERTY VALUE SOURCE dataset zoned on local
Each dataset that is delegated to a non-global zone through a dataset resource is aliased. The dataset layout is not visible within the zone. Each aliased dataset appears in the zone as if it were a pool. The default alias for a dataset is the last component in the dataset name. For example, if the default alias is used for the delegated dataset
tank/sales
, the zone will see a virtual ZFS pool namedsales
. The alias can be customized to be a different value by setting the alias property within the dataset resource.A dataset named
rpool
exists within each non-global zone'szonepath
dataset. For all non-global zones, this zonerpool
dataset is aliased asrpool
.zonename$ zfs list -o name,zoned,mounted,mountpoint NAME ZONED MOUNTED MOUNTPOINT rpool on no /rpool rpool/ROOT on no legacy rpool/ROOT/solaris on yes / rpool/export on no /export rpool/export/home on no /export/home
Dataset aliases are subject to the same name restrictions as ZFS pools. These restrictions are documented in the
zpool
(8) man page.If you want to share a global zone dataset, you can add an LOFS-mounted ZFS file system by using the
zonecfg
command with theadd fs
subcommand. An administrator with the appropriate rights is responsible for setting and controlling the properties of the dataset.For more information about ZFS, see Chapter 10, Oracle Solaris ZFS Advanced Topics in Managing ZFS File Systems in Oracle Solaris 11.4.