In permissive setting labels that are not in host policy when running unprivileged fails with EINVAL

[Petr Lautrbach <lautrbach@redhat.com>]

Hello,

this is originally reported at
https://github.com/SELinuxProject/selinux/issues/437

There a question why kernel blocks changing SELinux label to some
unknown label and requires CAP_MAC_ADMIN even in permissive mode?

Reproducer:

$ id -u
1000

$ getenforce 
Permissive

$ chcon -t bin_t /var/lib/mock/fedora-rawhide-x86_64/root/usr/lib/systemd/system-generators/systemd-ssh-generator

$ chcon -t selinux_unknown_type_t /var/lib/mock/fedora-rawhide-x86_64/root/usr/lib/systemd/system-generators/systemd-ssh-generator
chcon: failed to change context of '/var/lib/mock/fedora-rawhide-x86_64/root/usr/lib/systemd/system-generators/systemd-ssh-generator' to ‘system_u:object_r:selinux_unknown_type_t:s0’: Invalid argument


Quotes from the issue:

This is happening on a system with SELinux in permissive mode. Applying
your suggestion does not change the result. I assume this is gated
behind CAP_MAC_ADMIN for unprivileged users. Is there any way to make
this work without needing root privileges?

Hmm so the kernel blocks unknown labels unless the user has
CAP_MAC_ADMIN in the initial user namespace. I'm assuming this is for a
good reason and it would be unsafe to allow any user to do this so I
don't think there's anything that can be done here

One thing that's not clear to me, why is an unprivileged user allowed to
write labels known by the host but not labels that are not known to the
host? What specifically is unsafe about unknown labels that's not an
issue with known labels?

Petr