Re: [gentoo-hardened] Confusing Documentation

[John Huttley]

Ah of course!
Does this mean that I must always 

newrole -r sysadm_r -t sysadm_t

before emerging any  selinux-*  ebuild, since that touches policies??


I log in as root and the  id  command says i'm in context  
root:system_r:unconfined_t

So I think more than just my daemon policies are buggered. Yup, a 
remerge world is just what it needs..

--John


Mike Edenfield wrote:
> John Huttley wrote:
>
>> I would figure that if I logged in as root, I could stay in the
>> sysadm_r and change between sysadm_t and staff_t
>
>> If a role is a set of permitted types, why should I have to change my
>> role????
>
> By default, when you log in as root, you don't get assigned the
> sysadm_r role.  You're put into staff_r instead.  This role is
> permitted to transition to the types you need for routine system
> management -- log files and such.  But there's a lot that staff_r
> doesn't have access to.  For example, changing the SELinux policy
> itself :)
>
> Similar to how standard best practices would have you log in as a
> non-root user, and sudo when you need root access, SELinux best
> practices says that you log into staff_r, and only change to the
> sysadm_r role when needed, and only for as long as necessary.
>
-- 
gentoo-hardened@g.o mailing list