Remotectl: /usr/bin/chcon: can't apply partial context to unlabeled file ‘/etc/cockpit/ws-certs.d/99-nethserver.cert’

Support
1

I have this in var/log/messages:

XXX XX XX:XX:XX server remotectl: /usr/bin/chcon: can't apply partial context to unlabeled file ‘/etc/cockpit/ws-certs.d/99-nethserver.cert’

XXX XX XX:XX:XX server remotectl: remotectl: couldn't change SELinux type context 'etc_t' for certificate: /etc/cockpit/ws-certs.d/99-nethserver.cert: Child process exited with code 1
2

What is your output of getenforce ?

3 
[root@server ~]# getenforce
Disabled
[root@server ~]#
4

That is oke, it needs to be Disabled

I think is a upstream bug,
It does a check for SElinux, if not installed it skips the cron section of the cockpit.service
How ever it does not seem to take a Disabled SElinux in to account…

For reference:
removing --selinux-type=etc_t in systemd’s unit for the cockpit service (note not socket) on this line

ExecStartPre=/usr/sbin/remotectl certificate --ensure --user=root --group=cockpit-ws --selinux-type=etc_t

Mitigates the warning…

5

You can safely ignore the warning.
If you want to mitigate the warning, just create a custom systemd unit as suggest by Mark.