[gentoo-commits] proj/hardened-docs:master commit in: xml/selinux/

[Sven Vermeulen]

commit:     52787589c4ca2f84f57c933566cf27936f0961e2
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Tue May 31 20:16:07 2011 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue May 31 20:16:07 2011 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-docs.git;a=commit;h=52787589

Put more focus on the staff_u user, inform users that this is necessary to work with portage

---
 xml/selinux/hb-using-commands.xml |   24 +++++++++++++++++++-----
 1 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/xml/selinux/hb-using-commands.xml b/xml/selinux/hb-using-commands.xml
index b9342f0..a0e8ea4 100644
--- a/xml/selinux/hb-using-commands.xml
+++ b/xml/selinux/hb-using-commands.xml
@@ -7,8 +7,8 @@
 <!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-commands.xml,v 1.2 2011/04/25 20:12:59 zorry Exp $ -->
 
 <sections>
-<version>2</version>
-<date>2011-04-22</date>
+<version>3</version>
+<date>2011-05-31</date>
 
 <section>
 <title>SELinux Information Commands</title>
@@ -295,16 +295,30 @@ system_u            system_u
 
 <p>
 The default behavior is that users are logged on as the <e>user_u</e> SELinux
-user. If you want to allow another user (say <c>anna</c>) to log on as
-<c>staff_u</c>:
+user. This SELinux user is a non-administrator user: it has no specific
+privileges and should be used for every account that never requires elevated
+privileges (so no <c>su</c> or <c>sudo</c> rights for anything).
+</p>
+
+<p>
+The account you use to administer your system should be mapped to the
+<c>staff_u</c> SELinux user (or its own user with the appropriate roles). This
+can be accomplished as follows (example with the Unix account <e>anna</e>):
 </p>
 
 <pre caption="Letting 'anna' log on as 'staff_u'">
 ~# <i>semanage login -a -s staff_u anna</i>
 </pre>
 
+<impo>
+Make sure that whatever account you use to administer your system is mapped to
+the <c>staff_u</c> user, or has the ability to switch to the <c>sysadm_r</c>
+role. Portage only works from within the <c>sysadm_r</c> role.
+</impo>
+
 <p>
-SELinux users then can be configured to belong to one or more roles.
+As mentioned, SELinux users are configured to be able to join in on one or more
+roles. To list the available roles, you can use <c>semanage user -l</c>:
 </p>
 
 <pre caption="Listing login / role mappings">