Description:

On Fedora 42, SELinux is preventing the tuned-ppd process from creating a file named ppd_base_profile under the tuned_etc_t context. This may indicate missing or incorrect policy rules for this use case.

Audit Log:

type=AVC msg=audit(1744748083.896:2432): avc:  denied  { create } for  pid=3052 comm="tuned-ppd" name="ppd_base_profile" scontext=system_u:system_r:tuned_ppd_t:s0 tcontext=system_u:object_r:tuned_etc_t:s0 tclass=file permissive=1

System Info:

    SELinux Policy: selinux-policy-targeted-41.36-1.fc42.noarch

    Kernel: 6.14.1-300.fc42.x86_64

    Enforcing Mode: Enforcing

    System: Fedora 42, x86_64

    Alert Count: 3

    Host: laptop

Steps to Reproduce:

    Run tuned-ppd under typical system conditions.

    Monitor audit logs for AVC denials.

Expected Results:
tuned-ppd should be able to create ppd_base_profile if it is designed to manage such files under /etc/tuned.

Actual Results:
The action is denied by SELinux unless a custom module is manually created.

Temporary Workaround:

ausearch -c 'tuned-ppd' --raw | audit2allow -M my-tunedppd
semodule -X 300 -i my-tunedppd.pp

Policy Hash:
tuned-ppd,tuned_ppd_t,tuned_etc_t,file,create