Bug 1363657

I can confirm the behavior:

   [root@omiday selinux]# ausearch -m avc -ts recent | tee recent
   ----
   time->Thu Aug 11 17:21:56 2016
   type=AVC msg=audit(1470957716.488:664): avc:  denied  { sys_admin } for  pid=21703 comm="chromium-browse" capability=21  scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1
   ----
   time->Thu Aug 11 17:21:57 2016
   type=AVC msg=audit(1470957717.146:665): avc:  denied  { sys_chroot } for  pid=21721 comm="nacl_helper" capability=18  scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1
 

   [root@omiday selinux]# sealert -a recent
   100% done
   found 2 alerts in recent
   --------------------------------------------------------------------------------

   SELinux is preventing chromium-browse from sys_admin access on the cap_userns Unknown.

   *****  Plugin catchall (100. confidence) suggests   **************************

   If you believe that chromium-browse should be allowed sys_admin access on the Unknown cap_userns by default.
   Then you should report this as a bug.
   You can generate a local policy module to allow this access.
   Do
   allow this access for now by executing:
   # ausearch -c 'chromium-browse' --raw | audit2allow -M my-chromiumbrowse
   # semodule -X 300 -i my-chromiumbrowse.pp


   Additional Information:
   Source Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                                 023
   Target Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                                 023
   Target Objects                Unknown [ cap_userns ]
   Source                        chromium-browse
   Source Path                   chromium-browse
   Port                          <Unknown>
   Host                          <Unknown>
   Source RPM Packages           
   Target RPM Packages           
   Policy RPM                    selinux-policy-3.13.1-207.fc25.noarch
   Selinux Enabled               True
   Policy Type                   targeted
   Enforcing Mode                Enforcing
   Host Name                     omiday.can.local
   Platform                      Linux omiday.can.local
                                 4.8.0-0.rc1.git3.1.fc25.x86_64 #1 SMP Thu Aug 11
                                 04:08:28 UTC 2016 x86_64 x86_64
   Alert Count                   1
   First Seen                    2016-08-11 17:21:56 MDT
   Last Seen                     2016-08-11 17:21:56 MDT
   Local ID                      0f1dc86b-77c6-46b2-a6e1-8c2c4d6adc39

   Raw Audit Messages
   type=AVC msg=audit(1470957716.488:664): avc:  denied  { sys_admin } for  pid=21703 comm="chromium-browse" capability=21  scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1


   Hash: chromium-browse,unconfined_t,unconfined_t,cap_userns,sys_admin

   --------------------------------------------------------------------------------

   SELinux is preventing nacl_helper from sys_chroot access on the cap_userns Unknown.

   *****  Plugin catchall (100. confidence) suggests   **************************

   If you believe that nacl_helper should be allowed sys_chroot access on the Unknown cap_userns by default.
   Then you should report this as a bug.
   You can generate a local policy module to allow this access.
   Do
   allow this access for now by executing:
   # ausearch -c 'nacl_helper' --raw | audit2allow -M my-naclhelper
   # semodule -X 300 -i my-naclhelper.pp


   Additional Information:
   Source Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                                 023
   Target Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                                 023
   Target Objects                Unknown [ cap_userns ]
   Source                        nacl_helper
   Source Path                   nacl_helper
   Port                          <Unknown>
   Host                          <Unknown>
   Source RPM Packages           
   Target RPM Packages           
   Policy RPM                    selinux-policy-3.13.1-207.fc25.noarch
   Selinux Enabled               True
   Policy Type                   targeted
   Enforcing Mode                Enforcing
   Host Name                     omiday.can.local
   Platform                      Linux omiday.can.local
                                 4.8.0-0.rc1.git3.1.fc25.x86_64 #1 SMP Thu Aug 11
                                 04:08:28 UTC 2016 x86_64 x86_64
   Alert Count                   1
   First Seen                    2016-08-11 17:21:57 MDT
   Last Seen                     2016-08-11 17:21:57 MDT
   Local ID                      f88227fb-8b1e-427c-a4c7-049a4e033250

   Raw Audit Messages
   type=AVC msg=audit(1470957717.146:665): avc:  denied  { sys_chroot } for  pid=21721 comm="nacl_helper" capability=18  scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1


   Hash: nacl_helper,unconfined_t,unconfined_t,cap_userns,sys_chroot

This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.

selinux-policy-3.13.1-225.10.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-31d4ea5eb1

selinux-policy-3.13.1-225.10.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.