[gentoo-hardened] Confusing Documentation

[John Huttley]

Withs chris's help, I've now got  a selinux system, so I'm working on 
how to use it.

In the handbook 
http://www.gentoo.org/proj/en/hardened/selinux/selinux-handbook.xml?part=3&chap=1

under roles, there is this

Permissions are not given to roles.
A role describes the set of types a user can use.
For example, a system administrator that is using the system for regular 
user tasks should be in the staff_r role.
If they need to administrate the system, then a role change to sysadm_r 
is required.

This doesn't add up.
==========
Permissions are not given to roles.   <-- Right, permissions are based 
on types, as explained in the prev paragraph

For example, a system administrator that is using the system for regular 
user tasks should be in the staff_r role.  <--What?  don't you mean the 
staff_t domain? its the domain (type) that has the perms


==========
I would figure that if I logged in as root, I could stay in the sysadm_r 
and change between sysadm_t and staff_t



If a role is a set of permitted types, why should I have to change my 
role????



Yours in confusion,

--John



-- 
gentoo-hardened@g.o mailing list