The answer would depend on the entropy of the set of bits $M$. Let's say $M$ is a set of all-zero bits; in that case there would be only $1$ possible set of bits you could choose - every bit in every position is zero. If, however, you had a random set of bits for $M$ you'd approach ideal security; ideal security meaning $m\, P\, (n-(n/2))$ possible keys to brute-force.
How we calculate ideal security:
We know why we use the permutation function, but why use $n-(n/2)$? Let's imagine we have a random set of bytes, each unique; we have less than 256 bytes in our set so we can avoid repeats. The possible unique states would become $\infty$ meaning $m\, P\, (n-(n/\infty))=m\, P\, n$. But if we get each byte twice we end up with half the possible unique sets of choices - for every byte I select I could just as well select another byte and get the same result. As such, for $n$ bits the repeats will be defined by $n / 2$ since there are $2$ unique possible states for each bit. For sets of bytes it would be defined by $n/256$ meaning the complexity would me $m\, P\, (n-(n/256))$. This is because the frequency of repeats is based on the number of possible non-repeating states.
Therefore, if you want the scheme to be secure you should make $M$ as random as possible. A nonrandom value $M$, or a value specifically chosen to be weak would cripple the entire system; if $M$ is all-zeroes that's effectively a base-1 system which means each (bit-like-thing-with-only-one-state) has only $1$ possible state, giving me $m\, P\, (n-(n/1))=m\, P\, 0=1$ possible key.
CPA attack possibilities:
If the attacker can find the value $N$ for 1 block, they now know the position of $n$ bits within $M$. If they repeat this for multiple blocks, they will eventually get enough bits to brute-force the rest; so the difficulty of a CPA comes down to whether the value $N$ can be figured out from the plaintext-ciphertext relationship, which is dependent on the specifics of your FEC. This applies in the same way to known-plaintext attacks. Thus, your system would be secure from chosen-plaintext attacks iff (if and only if) it is secure against known-plaintext attacks.
I noticed an error where I forget to account for the fact that the repeating bits can themselves be permutated. This lowers the number of possible states significantly. I have updated the formulas accordingly, and the information should be correct now.