After installing and customizing an Oracle Solaris 11 non-global (solaris brand) zone, you execute commands: # zonecfg –z myzone ‘set file-mac-profile=fixed-configuration' # zoneadm –z myzone reboot What is the impact of making this specific change?

The file-mac-profile property within zonecfg is used to apply a Mandatory Access Control (MAC) security profile to the zone's file systems. The value fixed-configuration specifically implements an immutable zone configuration. When this profile is applied and the zone is rebooted, the zone's root file system is mounted as read-only. The only exceptions are the /var directory and its subdirectories, which remain writable to allow for essential operations like logging, temporary file creation, and service state management. This creates a secure, stable, and predictable operating environment.

A. The "MAC" in file-mac-profile refers to Mandatory Access Control for file systems, not Media Access Control (MAC) addresses for networking.
B. This profile is a native Oracle Solaris security feature and has no connection to Mac OS X extended file attributes.
C. While this is a Mandatory Access Control feature, its function is to enforce file system writability rules, not to manage user access via Trusted Extension labels.
D. The fixed-configuration profile's purpose is to control the writability of the local root file system, not to restrict the mounting of remote file systems.

1. Oracle Solaris 11.4 Man Pages, zonecfg(8): In the description of the file-mac-profile property, it states: "fixed-configuration - The fixed-configuration profile is enforced. This profile makes the zone's root file system read-only, with the exception of /var and its subdirectories."

2. Oracle Solaris 11.4 Documentation, Creating and Using Oracle Solaris Zones, Chapter 1, "Introduction to Oracle Solaris Zones," Section: "Immutable Zones": This section explains that immutable zones can be configured with a read-only root file system. It explicitly mentions that the file-mac-profile property is used to configure this feature, with fixed-configuration being one of the key profiles.