Re: [gentoo-hardened] Confusing Documentation

[Chris PeBenito]

On Tue, 2007-07-31 at 15:30 +1200, John Huttley wrote:
> Ah of course!
> Does this mean that I must always
>
> newrole -r sysadm_r -t sysadm_t
>
> before emerging any  selinux-*  ebuild, since that touches policies??

With a strict policy, you need to newrole to do most admin functions.
You will not be able to run portage in staff_r.  Also you don't need to
specify the type as sysadm_t is already the default type.

> I log in as root and the  id  command says i'm in context
> root:system_r:unconfined_t

This means you are using the targeted policy, in which case there is
only one role, so you don't newrole.  The docs need to be updated on
this fact.

> Mike Edenfield wrote:
> > John Huttley wrote:
> >
> >> I would figure that if I logged in as root, I could stay in the
> >> sysadm_r and change between sysadm_t and staff_t
> >
> >> If a role is a set of permitted types, why should I have to change my
> >> role????
> >
> > By default, when you log in as root, you don't get assigned the
> > sysadm_r role.  You're put into staff_r instead.  This role is
> > permitted to transition to the types you need for routine system
> > management -- log files and such.  But there's a lot that staff_r
> > doesn't have access to.  For example, changing the SELinux policy
> > itself :)
> >
> > Similar to how standard best practices would have you log in as a
> > non-root user, and sudo when you need root access, SELinux best
> > practices says that you log into staff_r, and only change to the
> > sysadm_r role when needed, and only for as long as necessary.
> >
-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243