Description of problem:
Summary:

SELinux denies access to tuned-ppd after switching power profiles from the GNOME top-right system menu on a fresh Fedora 42 install.
Steps to Reproduce:

    Perform a clean install of Fedora 42 Workstation.

    Boot into the GNOME desktop and open the top-right system menu.

    Click the Power Mode option and change from "Performance" to "Power Saver".

    Observe SELinux denial messages related to tuned-ppd (via GUI notification or sealert -b).

Actual Results:

SELinux prevents tuned-ppd from performing actions such as:

    write access on the tuned directory

    add_name access on ppd_base_profile

    create access on ppd_base_profile

These are flagged as potential intrusions.
Expected Results:

Power profile changes via the default GNOME interface should apply cleanly without triggering SELinux denials.
Additional Info:

    This appears to be related to the transition from power-profiles-daemon to tuned + tuned-ppd for power management in Fedora 42.

    tuned-ppd is acting as a compatibility layer but lacks proper SELinux policy coverage.

    Workaround using audit2allow resolves the issue:

sudo ausearch -c 'tuned-ppd' --raw | audit2allow -M my-tunedppd
sudo semodule -X 300 -i my-tunedppd.pp

SELinux denial logged via sealert -b.
This error occurs for 'add_name', 'create' and 'write', but I have included the one.  It appears to do with the recent transition from power-profiles-daemon to tuned, and is caused when the top-right quick menu cycles power profiles (I went from "performance" to "power saver".

SELinux is preventing tuned-ppd from 'add_name' accesses on the directory ppd_base_profile.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that tuned-ppd should be allowed add_name access on the ppd_base_profile directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'tuned-ppd' --raw | audit2allow -M my-tunedppd
# semodule -X 300 -i my-tunedppd.pp

Additional Information:
Source Context                system_u:system_r:tuned_ppd_t:s0
Target Context                system_u:object_r:tuned_etc_t:s0
Target Objects                ppd_base_profile [ dir ]
Source                        tuned-ppd
Source Path                   tuned-ppd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-41.36-1.fc42.noarch
Local Policy RPM              selinux-policy-targeted-41.36-1.fc42.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 6.14.2-300.fc42.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Thu Apr 10 21:50:55 UTC 2025
                              x86_64
Alert Count                   1
First Seen                    2025-04-15 17:58:26 MDT
Last Seen                     2025-04-15 17:58:26 MDT
Local ID                      9c9aa1a4-cb2e-44b9-ba18-fd29983abb4c

Raw Audit Messages
type=AVC msg=audit(1744761506.770:1819): avc:  denied  { add_name } for  pid=1456 comm="tuned-ppd" name="ppd_base_profile" scontext=system_u:system_r:tuned_ppd_t:s0 tcontext=system_u:object_r:tuned_etc_t:s0 tclass=dir permissive=1


Hash: tuned-ppd,tuned_ppd_t,tuned_etc_t,dir,add_name

Version-Release number of selected component:
selinux-policy-targeted-41.36-1.fc42.noarch

Additional info:
reporter:       libreport-2.17.15
reason:         SELinux is preventing tuned-ppd from 'add_name' accesses on the directory ppd_base_profile.
package:        selinux-policy-targeted-41.36-1.fc42.noarch
component:      selinux-policy
hashmarkername: setroubleshoot
type:           libreport
kernel:         6.14.2-300.fc42.x86_64
component:      selinux-policy