Abstract: A global zone executing on a host OS that includes a multilevel filesystem (MLFS) associated with a label range, where the MLFS includes files and directories, where each of the files is associated with its own label and where each of the directories is associated with its own label. The global zone further includes a first non-global zone, where the MLFS is mounted in the first non-global zone as a first loopback file system. The host OS is configured to receive, from a process executing on the host OS, a request to access a first file in the MLFS, make a first determination that a process label dominates a first file label, based on the first determination, make a second determination that the first file label is equal to the process label, and in response to the second determination, provide read and write access to the first file.

Abstract: A global zone executing on a host OS that includes a multilevel filesystem (MLFS) associated with a label range, where the MLFS includes files and directories, where each of the files is associated with its own label and where each of the directories is associated with its own label. The global zone further includes a first non-global zone, where the MLFS is mounted in the first non-global zone as a first loopback file system. The host OS is configured to receive, from a process executing on the host OS, a request to access a first file in the MLFS, make a first determination that a process label dominates a first file label, based on the first determination, make a second determination that the first file label is equal to the process label, and in response to the second determination, provide read and write access to the first file.