What were you trying to do that didn't work?

Start a service with selinux set to permissive mode.

What is the impact of this issue to you?

We are not able to create CentOS Stream 10 images with the latest selinux-policy

Please provide the package NVR for which the bug is seen:

systemd-257-9.el10

How reproducible is this bug?:

100%

Steps to reproduce

1. Set the machine to permissive mode (setenforce 0)
2. Have a service, whose startup files are labeled with a label not known to the system.
3. Start that service with systemctl (systemctl start foo.service)

Expected results

The service should start, with a log that says that it is improperly labeled.

Actual results

The service fails with the error "Failed to determine SELinux label"