New security policy mandates that system administrators on RHEL systems must be mapped to either sysadm_U or staff_u role and 'normal' users must be mapped to user_u roles. Previous to this we utilized the out-of-the-box configuration with all users having the unconfined_u.
Upon running a small test with mapping a system administrator group to the sysadm_u role I found that these users were initially unable to log in via SSH. After digging into the SELinux policy source I found that there was a boolean, ssh_sysadm_login, that needed to be set to allow this function.
I also tried mapping this same group to the staff_u role. This role happened to be able to SSH just fine but, by coincidence, I discovered that they were unable to perform SSH port forwarding operations. Again, I was able to find the boolean, user_tcp_server which fixed this.
In any case these two immediate effects on common (critical) administrator functions has me concerned what other "gotchas" I might expect to run in to when rolling out this change. It was noted that this change could impact deployed applications which could make the scope of this question very broad. Therefore, let's focus the answers on the impacts one would expect to see on a base OS install affecting core functionality (e.g. the aforementioned SSH issues).
