The following is a mixed bag of comments/questions related to SElinux... 1. I noticed that when I login as root from a VT I get the choice of 3 different roles (staff_r, sysadm_r, and system_r) but when I login as a sysadm_r user and then "su -" to root, I only get two roles (staff_r and sysadm_r). Whe the difference? Better still, is this intentional? 2. If I login a VT or su to a user who has multiple roles defined, I get the option to select which role (when su - is working). On the other hand, if I login via gdm I do not get such a choice. Question: should gdm be enhanced to offer to option to select a role for users with multiple roles defined? 3. In the /etc/security/selinux/src/policy/users file there are two examples of defining a user having sysadm_r: # sample for administrative user #user jadmin roles { staff_r sysadm_r ifdef(`direct_sysadm_daemon', \ `system_r') }; # sample for regular user #user jdoe roles { user_r ifdef(`user_canbe_sysadm', `sysadm_r system_r') }; Which one is the "right" one to use? 4. In the above, I notice that if I login from gdm I get sysadm_r in the first case and user_r in the second case. However, if I login from a VT, the default role is sysadm_r in both cases. Is this operating correctly? Why the difference? It seems to me that the correct operation should be the same in both cases. 5. Why is the system_r role only available from the VT? 6. Is there some command that will list the roles available for a user? 7. The packages libselinux has a lot of /usr/bin/ files which have no documentation (e.g., setfilecon). Is there some reason for this (other than we have not got around to that yet)? 8. Is there someplace that describes the differences between the various policy versions (15, 16, 17, etc.)? 9. Is there some additional documentation concerning the /etc/security/selinux/src/policy/tunable.te file (besides the comments in the file itself)? 10. Is there any documentation planned (but maybe not in FC2) which will make recommendations on how to lock a system down using the tunable.te file? 11. For the record, my "vote" is for FC2 final to default to selinux=1, enforcing=1 but with a policy that is very "loose" by default (it would more or less work as if selinux was not really installed for most users). I would also like to see an option for a more restrictive policy which could then be worked with for those inclined to do so. 12. I noticed that if I login as a user defined in users as above case 2 and then "su -" to root, I am given no role options. However, if I login as a sysadm_r user (case 1 above) and then "su -" to root, I am given a choice of role. Why the difference? If this operating correctly? ------------------------------------------------------------------------------------ I am sure that more questions will occur to me but that is enough for now. Gene