Device Use in Non-Global Zones
The set of devices available within a zone is restricted to prevent a
process in one zone from interfering with processes running in other zones. For
example, a process in a zone cannot modify kernel memory or modify
the contents of the root disk. Thus, by default, only certain pseudo-devices that
are considered safe for use in a zone are available. Additional devices can
be made available within specific zones by using the zonecfg utility.
/dev and the /devices Namespace
The devfs file system described in the devfs(7FS) man page is used by
the Solaris system to manage /devices. Each element in this namespace represents the
physical path to a hardware device, pseudo-device, or nexus device. The namespace is
a reflection of the device tree. As such, the file system is populated
by a hierarchy of directories and device special files.
Devices are grouped according to the relative /dev hierarchy. For example, all of
the devices under /dev in the global zone are grouped as global zone
devices. For a non-global zone, the devices are grouped in a /dev directory
under the zone's root path. Each group is a mounted /dev file system
instance that is mounted under the /dev directory. Thus, the global zone devices are
mounted under /dev, while the devices for a non-global zone named my-zone are
mounted under /my-zone_rootpath/dev.
The /dev file hierarchy is managed by the dev file system described
in the dev(7FS) man page.
Caution - Subsystems that rely on /devices path names are not able to run in
non-global zones. The subsystems must be updated to use /dev path names.
Exclusive-Use Devices
You might have devices that you want to assign to specific zones.
Allowing unprivileged users to access block devices could permit those devices to be used
to cause system panic, bus resets, or other adverse effects. Before making such
assignments, consider the following issues:
Before assigning a SCSI tape device to a specific zone, consult the sgen(7D) man page.
Placing a physical device into more than one zone can create a covert channel between zones. Global zone applications that use such a device risk the possibility of compromised data or data corruption by a non-global zone.
Device Driver Administration
In a non-global zone, you can use the modinfo command described in the
modinfo(1M) man page to examine the list of loaded kernel modules.
Most operations concerning kernel, device, and platform management will not work inside a
non-global zone because modifying platform hardware configurations violates the zone security model. These
operations include the following:
Adding and removing drivers
Explicitly loading and unloading kernel modules
Initiating dynamic reconfiguration (DR) operations
Using facilities that affect the state of the physical platform
Utilities That Do Not Work or Are Modified in Non-Global Zones
Utilities That Do Not Work in Non-Global Zones
The following utilities do not work in a zone because they rely
on devices that are not normally available:
SPARC: Utility Modified for Use in a Non-Global Zone
The eeprom utility can be used in a zone to view settings. The
utility cannot be used to change settings. For more information, see the eeprom(1M)
and openprom(7D) man pages.
