Description of problem:

SELinux is preventing nmcli from using the sys_nice capability.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that nmcli should have the sys_nice capability by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'nmcli' --raw | audit2allow -M my-nmcli
# semodule -X 300 -i my-nmcli.pp

Additional Information:
Source Context                system_u:system_r:tlp_t:s0-s0:c0.c1023
Target Context                system_u:system_r:tlp_t:s0-s0:c0.c1023
Target Objects                Unknown [ capability ]
Source                        nmcli
Source Path                   nmcli
Port                          <Unknown>
Host                          x1c.cipherboy.com
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-3.14.5-32.fc32.noarch
Local Policy RPM              selinux-policy-targeted-3.14.5-32.fc32.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     x1c.cipherboy.com
Platform                      Linux x1c.cipherboy.com 5.6.6-300.fc32.x86_64 #1
                              SMP Tue Apr 21 13:44:19 UTC 2020 x86_64 x86_64
Alert Count                   2
First Seen                    2020-04-28 15:59:24 EDT
Last Seen                     2020-04-29 10:53:32 EDT
Local ID                      f7f90f6a-0e9d-4364-b406-74302f3d31e9

Raw Audit Messages
type=AVC msg=audit(1588172012.904:659): avc:  denied  { sys_nice } for  pid=107110 comm="nmcli" capability=23  scontext=system_u:system_r:tlp_t:s0-s0:c0.c1023 tcontext=system_u:system_r:tlp_t:s0-s0:c0.c1023 tclass=capability permissive=1


Hash: nmcli,tlp_t,tlp_t,capability,sys_nice


Version-Release number of selected component (if applicable):

NetworkManager-openvpn-1.8.12-1.fc32.x86_64
NetworkManager-ssh-gnome-1.2.11-1.fc32.x86_64
cockpit-networkmanager-217-1.fc32.noarch
NetworkManager-openconnect-1.2.6-3.fc32.x86_64
NetworkManager-openconnect-gnome-1.2.6-3.fc32.x86_64
NetworkManager-wwan-1.22.10-1.fc32.x86_64
NetworkManager-bluetooth-1.22.10-1.fc32.x86_64
NetworkManager-1.22.10-1.fc32.x86_64
NetworkManager-openvpn-gnome-1.8.12-1.fc32.x86_64
NetworkManager-ssh-1.2.11-1.fc32.x86_64
NetworkManager-wifi-1.22.10-1.fc32.x86_64
NetworkManager-libnm-1.22.10-1.fc32.x86_64
NetworkManager-team-1.22.10-1.fc32.x86_64
NetworkManager-vpnc-gnome-1.2.6-4.fc32.x86_64
NetworkManager-adsl-1.22.10-1.fc32.x86_64
NetworkManager-vpnc-1.2.6-4.fc32.x86_64
NetworkManager-pptp-gnome-1.2.8-1.fc32.3.x86_64
NetworkManager-pptp-1.2.8-1.fc32.3.x86_64

selinux-policy-minimum-3.14.5-32.fc32.noarch
libselinux-debugsource-2.9-1.fc30.x86_64
libselinux-utils-3.0-3.fc32.x86_64
flatpak-selinux-1.6.3-1.fc32.noarch
rpm-plugin-selinux-4.15.1-2.fc32.1.x86_64
selinux-policy-3.14.5-32.fc32.noarch
libselinux-3.0-3.fc32.i686
container-selinux-2.132.0-1.fc32.noarch
python3-libselinux-3.0-3.fc32.x86_64
libselinux-debuginfo-2.9-1.fc30.x86_64
libselinux-3.0-3.fc32.x86_64
selinux-policy-targeted-3.14.5-32.fc32.noarch
libselinux-devel-3.0-3.fc32.x86_64



How reproducible:

Seems to occur frequently, not sure how to reproduce it. I believe it has to do with locking/unlocking the system. I've tried an autorelabel. 

Steps to Reproduce:
1. 
2.
3.

Actual results:


Expected results:


Additional info:

Seems to be a regression of https://bugzilla.redhat.com/show_bug.cgi?id=882696