Zone Resource Exceptions to MWAC Security Policy

Datasets that you add to a zone through the zonecfg add dataset command are not subject to MWAC policy. Zones have full control over added datasets. The platform datasets are visible, but their data and their properties are read-only unless the zone is booted read/write.

File systems that you add to a zone through the zonecfg add fs command are not subject to MWAC policy. To maintain the policy, mount the file systems read-only.