Hello, this is originally reported at https://github.com/SELinuxProject/selinux/issues/437 There a question why kernel blocks changing SELinux label to some unknown label and requires CAP_MAC_ADMIN even in permissive mode? Reproducer: $ id -u 1000 $ getenforce Permissive $ chcon -t bin_t /var/lib/mock/fedora-rawhide-x86_64/root/usr/lib/systemd/system-generators/systemd-ssh-generator $ chcon -t selinux_unknown_type_t /var/lib/mock/fedora-rawhide-x86_64/root/usr/lib/systemd/system-generators/systemd-ssh-generator chcon: failed to change context of '/var/lib/mock/fedora-rawhide-x86_64/root/usr/lib/systemd/system-generators/systemd-ssh-generator' to ‘system_u:object_r:selinux_unknown_type_t:s0’: Invalid argument Quotes from the issue: This is happening on a system with SELinux in permissive mode. Applying your suggestion does not change the result. I assume this is gated behind CAP_MAC_ADMIN for unprivileged users. Is there any way to make this work without needing root privileges? Hmm so the kernel blocks unknown labels unless the user has CAP_MAC_ADMIN in the initial user namespace. I'm assuming this is for a good reason and it would be unsafe to allow any user to do this so I don't think there's anything that can be done here One thing that's not clear to me, why is an unprivileged user allowed to write labels known by the host but not labels that are not known to the host? What specifically is unsafe about unknown labels that's not an issue with known labels? Petr
