document role and type defaults for SELinux

diff --git a/sudoers.pod b/sudoers.pod
index dd5babc1c197ce64899b8de11e7b262d047a3dd7..def8c4f5b262b4c1c40a6b8adce5a49de5d29236 100644 (file)
--- a/sudoers.pod
+++ b/sudoers.pod
@@ -869,6 +869,13 @@ two consecutive C<%> characters are collapsed into a single C<%> character
 
 The default value is C<@passprompt@>.
 
+=item role
+
+The default SELinux role to use when constructing a new security
+context to run the command.  The default role may be overridden on
+a per-command basis in I<sudoers> or via command line options.
+This option is only available whe B<sudo> is built with SELinux support.
+
 =item runas_default
 
 The default user to run commands as if the B<-u> flag is not specified
@@ -896,6 +903,13 @@ The default is F<@timedir@>.
 The owner of the timestamp directory and the timestamps stored therein.
 The default is C<root>.
 
+=item type
+
+The default SELinux type to use when constructing a new security
+context to run the command.  The default type may be overridden on
+a per-command basis in I<sudoers> or via command line options.
+This option is only available whe B<sudo> is built with SELinux support.
+
 =back
 
 B<Strings that can be used in a boolean context>: