Do you have the boolean domain_kernel_load_modules set? It's not active by default on Tumbleweed and the reason why this fails to start for me. Please show the output of sesearch -s systemd_ssh_generator_t -t kernel_t -p module_request -AT and semanage boolean -l | grep domain_kernel_load_modules