Chapter 3

1. There is an intermediate step needed to associate a role with a Linux account, and that is the SELinux user. A Linux account (or login) is mapped to an SELinux user. The SELinux user is then mapped to one or more SELinux roles that that SELinux user can be in.

   If we want to assign an additional role to a Linux user, we need to add it to the SELinux role that that Linux account is mapped to. However, if more Linux accounts are mapped to the same SELinux user, then we first need to make sure that all these accounts are indeed allowed to use this role. If not, a dedicated SELinux user has to be created for the Linux account.

2. Yes, the mappings are considered when a user logs in through a particular service. It is possible for administrators to tune the mappings to be dependent on the service, as seen in the Customizing logins toward services section.
3. Most SELinux domains do not allow the SELinux user of a context to be changed. This allows the tracking of activities...