diff --git a/0003-update-default-configuration.patch b/0003-update-default-configuration.patch index a0c961a..dfe119b 100644 --- a/0003-update-default-configuration.patch +++ b/0003-update-default-configuration.patch @@ -66,7 +66,7 @@ index 916de769f9..2f270d4940 100644 ;app_tls_skip_verify_insecure = false # Enter a comma-separated list of plugin identifiers to identify plugins to load even if they are unsigned. Plugins with modified signatures are never loaded. -;allow_loading_unsigned_plugins = -+allow_loading_unsigned_plugins = performancecopilot-pcp-app,pcp-redis-datasource,pcp-vector-datasource,pcp-bpftrace-datasource,pcp-flamegraph-panel,pcp-breadcrumbs-panel,pcp-troubleshooting-panel,performancecopilot-redis-datasource,performancecopilot-vector-datasource,performancecopilot-bpftrace-datasource,performancecopilot-flamegraph-panel,performancecopilot-breadcrumbs-panel,performancecopilot-troubleshooting-panel ++allow_loading_unsigned_plugins = performancecopilot-pcp-app,pcp-valkey-datasource,pcp-vector-datasource,pcp-bpftrace-datasource,pcp-flamegraph-panel,pcp-breadcrumbs-panel,pcp-troubleshooting-panel,performancecopilot-valkey-datasource,performancecopilot-vector-datasource,performancecopilot-bpftrace-datasource,performancecopilot-flamegraph-panel,performancecopilot-breadcrumbs-panel,performancecopilot-troubleshooting-panel # Enable or disable installing / uninstalling / updating plugins directly from within Grafana. ;plugin_admin_enabled = false ;plugin_admin_external_manage_enabled = false diff --git a/0011-fix-dompurify-CVE.patch b/0011-fix-dompurify-CVE.patch new file mode 100644 index 0000000..47f906e --- /dev/null +++ b/0011-fix-dompurify-CVE.patch @@ -0,0 +1,58 @@ +From: Sam Feifer +Subject: [PATCH] fix dompurify CVE + +diff --git a/package.json b/package.json +index 38deb6d7dee..010a24fb451 100644 +--- a/package.json ++++ b/package.json +@@ -432,7 +432,8 @@ + "react-split-pane@0.1.92": "patch:react-split-pane@npm:0.1.92#.yarn/patches/react-split-pane-npm-0.1.92-93dbf51dff.patch", + "@storybook/blocks@7.4.5": "patch:@storybook/blocks@npm%3A7.4.5#./.yarn/patches/@storybook-blocks-npm-7.4.5-5a2374564a.patch", + "history@4.10.1": "patch:history@npm%3A4.10.1#./.yarn/patches/history-npm-4.10.1-ee217563ae.patch", +- "history@^4.9.0": "patch:history@npm%3A4.10.1#./.yarn/patches/history-npm-4.10.1-ee217563ae.patch" ++ "history@^4.9.0": "patch:history@npm%3A4.10.1#./.yarn/patches/history-npm-4.10.1-ee217563ae.patch", ++ "dompurify": "^2.5.0" + }, + "workspaces": { + "packages": [ +diff --git a/packages/grafana-data/package.json b/packages/grafana-data/package.json +index 2182744e61b..4201ef58dda 100644 +--- a/packages/grafana-data/package.json ++++ b/packages/grafana-data/package.json +@@ -41,7 +41,7 @@ + "@types/string-hash": "1.1.1", + "d3-interpolate": "3.0.1", + "date-fns": "2.30.0", +- "dompurify": "^2.4.3", ++ "dompurify": "^2.5.0", + "eventemitter3": "5.0.1", + "fast_array_intersect": "1.1.0", + "history": "4.10.1", +diff --git a/yarn.lock b/yarn.lock +index bf22ba52a17..88fc4d3fbfb 100644 +--- a/yarn.lock ++++ b/yarn.lock +@@ -2953,7 +2953,7 @@ __metadata: + "@types/tinycolor2": "npm:1.4.3" + d3-interpolate: "npm:3.0.1" + date-fns: "npm:2.30.0" +- dompurify: "npm:^2.4.3" ++ dompurify: "npm:^2.5.0" + esbuild: "npm:0.18.12" + eventemitter3: "npm:5.0.1" + fast_array_intersect: "npm:1.1.0" +@@ -14478,10 +14478,10 @@ __metadata: + languageName: node + linkType: hard + +-"dompurify@npm:^2.2.0, dompurify@npm:^2.4.3": +- version: 2.4.5 +- resolution: "dompurify@npm:2.4.5" +- checksum: d764c2ff126b3749dad35bc34eed40f51141d7dfd620e938c92f08d68c32beeb259d06abadeee91f6e2a8c8737ce670e2124ac9a257ba3bcdc666598cebcde01 ++"dompurify@npm:^2.5.0": ++ version: 2.5.7 ++ resolution: "dompurify@npm:2.5.7" ++ checksum: b150ca1e28083252cd51097162dc96cb45203f7e2af1fbaa8ef32b4f4d6b605e4aa8915190d38bd0635cbbf14d13a200138cd3ec1b084096819b14c718355122 + languageName: node + linkType: hard + diff --git a/0012-fix-jwt-CVE.patch b/0012-fix-jwt-CVE.patch new file mode 100644 index 0000000..a937bb1 --- /dev/null +++ b/0012-fix-jwt-CVE.patch @@ -0,0 +1,31 @@ +From: Sam Feifer +Subject: [PATCH] fix jwt CVE + +diff --git a/go.mod b/go.mod +index fcbc09da5e6..1771902bc1c 100644 +--- a/go.mod ++++ b/go.mod +@@ -164,7 +164,7 @@ require ( + github.com/go-openapi/spec v0.20.9 // indirect + github.com/go-openapi/swag v0.22.4 // indirect + github.com/go-openapi/validate v0.22.1 // indirect +- github.com/golang-jwt/jwt/v4 v4.5.0 // @grafana/backend-platform ++ github.com/golang-jwt/jwt/v4 v4.5.2 // @grafana/backend-platform + github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect + github.com/golang/glog v1.1.2 // indirect + github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect +diff --git a/go.sum b/go.sum +index d05dfb55fd4..3a045f712eb 100644 +--- a/go.sum ++++ b/go.sum +@@ -1593,8 +1593,9 @@ github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzw + github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg= + github.com/golang-jwt/jwt/v4 v4.4.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= + github.com/golang-jwt/jwt/v4 v4.4.3/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= +-github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg= + github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= ++github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI= ++github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= + github.com/golang-migrate/migrate/v4 v4.7.0 h1:gONcHxHApDTKXDyLH/H97gEHmpu1zcnnbAaq2zgrPrs= + github.com/golang-migrate/migrate/v4 v4.7.0/go.mod h1:Qvut3N4xKWjoH3sokBccML6WyHSnggXm/DvMMnTsQIc= + github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0= diff --git a/0013-fix-CVE-2025-4123.patch b/0013-fix-CVE-2025-4123.patch new file mode 100644 index 0000000..5204e37 --- /dev/null +++ b/0013-fix-CVE-2025-4123.patch @@ -0,0 +1,32 @@ +From 2d4314b5ca1e527a3420fad11d3f1a25351700d4 Mon Sep 17 00:00:00 2001 +From: Sam Feifer +Date: Wed, 7 May 2025 16:27:08 -0400 +Subject: [PATCH] fix CVE-2025-4123 + + +diff --git a/conf/defaults.ini b/conf/defaults.ini +index e1e5468bfa3..4221144bf54 100644 +--- a/conf/defaults.ini ++++ b/conf/defaults.ini +@@ -363,7 +363,7 @@ x_xss_protection = true + + # Enable adding the Content-Security-Policy header to your requests. + # CSP allows to control resources the user agent is allowed to load and helps prevent XSS attacks. +-content_security_policy = false ++content_security_policy = true + + # Set Content Security Policy template used when adding the Content-Security-Policy header to your requests. + # $NONCE in the template includes a random nonce. +diff --git a/conf/sample.ini b/conf/sample.ini +index 51d2b6c512b..fd588b48225 100644 +--- a/conf/sample.ini ++++ b/conf/sample.ini +@@ -364,7 +364,7 @@ + + # Enable adding the Content-Security-Policy header to your requests. + # CSP allows to control resources the user agent is allowed to load and helps prevent XSS attacks. +-;content_security_policy = false ++;content_security_policy = true + + # Set Content Security Policy template used when adding the Content-Security-Policy header to your requests. + # $NONCE in the template includes a random nonce. diff --git a/ci.fmf b/ci.fmf index 24f8837..1418a0c 100644 --- a/ci.fmf +++ b/ci.fmf @@ -1,2 +1,5 @@ ---- -resultsdb-testcase: separate +/gating: + plan: + import: + name: /plans/gating + url: https://gitlab.com/redhat/centos-stream/tests/grafana.git diff --git a/create_bundles.sh b/create_bundles.sh index feb9994..f4105d0 100755 --- a/create_bundles.sh +++ b/create_bundles.sh @@ -21,6 +21,7 @@ pushd "${SOURCE_DIR}" # Vendor Go dependencies patch -p1 --fuzz=0 < ../0004-remove-unused-backend-dependencies.patch +patch -p1 --fuzz=0 < ../0012-fix-jwt-CVE.patch go mod vendor # Generate Go files @@ -59,6 +60,7 @@ awk '$2 ~ /^v/ && $4 != "indirect" {print "Provides: bundled(golang(" $1 ")) = " # Vendor Node.js dependencies patch -p1 --fuzz=0 < ../0005-remove-unused-frontend-crypto.patch +patch -p1 --fuzz=0 < ../0011-fix-dompurify-CVE.patch export HUSKY=0 yarn install --frozen-lockfile diff --git a/gating.yaml b/gating.yaml index 116ac6c..282e16b 100644 --- a/gating.yaml +++ b/gating.yaml @@ -4,4 +4,4 @@ product_versions: decision_context: bodhi_update_push_stable subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/gating.functional} + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} diff --git a/grafana.fc b/grafana.fc index ae17d09..d66da55 100644 --- a/grafana.fc +++ b/grafana.fc @@ -3,9 +3,9 @@ /etc/grafana(/.*)? gen_context(system_u:object_r:grafana_conf_t,s0) -/usr/sbin/grafana-cli -- gen_context(system_u:object_r:grafana_exec_t,s0) -/usr/sbin/grafana-server -- gen_context(system_u:object_r:grafana_exec_t,s0) -/usr/sbin/grafana -- gen_context(system_u:object_r:grafana_exec_t,s0) +/usr/bin/grafana-cli -- gen_context(system_u:object_r:grafana_exec_t,s0) +/usr/bin/grafana-server -- gen_context(system_u:object_r:grafana_exec_t,s0) +/usr/bin/grafana -- gen_context(system_u:object_r:grafana_exec_t,s0) /var/lib/grafana(/.*)? gen_context(system_u:object_r:grafana_var_lib_t,s0) #/var/lib/grafana/grafana.db -- gen_context(system_u:object_r:grafana_db_t,s0) @@ -22,4 +22,5 @@ #define context for pcp plugin #/usr/share/performancecopilot-pcp-app/datasources/redis/pcp_redis_datasource_(.*) -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0) -/usr/libexec/grafana-pcp/datasources/redis/pcp_redis_datasource_(.*) -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0) \ No newline at end of file +/usr/libexec/grafana-pcp/datasources/redis/pcp_redis_datasource_(.*) -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0) +/usr/libexec/grafana-pcp/datasources/valkey/pcp_valkey_datasource_(.*) -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0) \ No newline at end of file diff --git a/grafana.spec b/grafana.spec index 17a34ba..c2867b0 100644 --- a/grafana.spec +++ b/grafana.spec @@ -19,13 +19,14 @@ end} %global gomodulesmode GO111MODULE=auto -%global gotestflags %{gotestflags} -tags=integration +%global _gotestflags_save %{?gotestflags} +%global gotestflags %{?_gotestflags_save} -tags=integration %global selinux_variants mls targeted Name: grafana Version: 10.2.6 -Release: 4%{?dist} +Release: 22%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -36,13 +37,13 @@ Source0: https://github.com/grafana/grafana/archive/v%{version}/%{name} # Source1 contains the bundled Go and Node.js dependencies # Note: In case there were no changes to this tarball, the NVR of this tarball # lags behind the NVR of this package. -Source1: grafana-vendor-%{version}-2.tar.xz +Source1: grafana-vendor-%{version}-12.tar.xz %if %{compile_frontend} == 0 # Source2 contains the precompiled frontend # Note: In case there were no changes to this tarball, the NVR of this tarball # lags behind the NVR of this package. -Source2: grafana-webpack-%{version}-2.tar.gz +Source2: grafana-webpack-%{version}-12.tar.gz %endif # Source3 contains the systemd-sysusers configuration @@ -77,6 +78,9 @@ Patch8: 0008-replace-faulty-slices-sort.patch Patch9: 0009-update-wrappers-and-systemd-with-distro-paths.patch # https://github.com/grafana/grafana/commit/bae86dbeb0ad68a205454e98e76985dc393183d4 Patch10: 0010-remove-bcrypt-references.patch +Patch11: 0011-fix-dompurify-CVE.patch +Patch12: 0012-fix-jwt-CVE.patch +Patch13: 0013-fix-CVE-2025-4123.patch # Patches affecting the vendor tarball Patch1001: 1001-vendor-patch-removed-backend-crypto.patch @@ -89,7 +93,7 @@ ExclusiveArch: %{grafana_arches} BuildRequires: systemd BuildRequires: systemd-rpm-macros -BuildRequires: golang >= 1.17 +BuildRequires: golang BuildRequires: go-srpm-macros BuildRequires: go-rpm-macros @@ -107,7 +111,11 @@ BuildRequires: openssl-devel # grafana-server service daemon uses systemd %{?systemd_requires} + +%if 0%{?fedora} >= 42 +%elif 0%{?fedora} || 0%{?rhel} >= 9 Requires(pre): shadow-utils +%endif # Grafana queries the mime database (through mime.TypeByExtension, in a unit test and at runtime) BuildRequires: shared-mime-info @@ -116,7 +124,7 @@ Requires: shared-mime-info %if 0%{?fedora} >= 35 || 0%{?rhel} >= 8 # This ensures that the grafana-selinux package and all its dependencies are # not pulled into containers and other systems that do not use SELinux -Requires: (grafana-selinux = %{version}-%{release} if selinux-policy-targeted) +Requires: (grafana-selinux = %{version}-%{release} if selinux-policy-any) %else Requires: grafana-selinux = %{version}-%{release} %endif @@ -246,7 +254,7 @@ Provides: bundled(golang(github.com/andybalholm/brotli)) = 1.0.4 Provides: bundled(golang(github.com/go-kit/log)) = 0.2.1 Provides: bundled(golang(github.com/go-openapi/loads)) = 0.21.2 Provides: bundled(golang(github.com/go-openapi/runtime)) = 0.26.0 -Provides: bundled(golang(github.com/golang-jwt/jwt/v4)) = 4.5.0 +Provides: bundled(golang(github.com/golang-jwt/jwt/v4)) = 4.5.2 Provides: bundled(golang(github.com/golang/protobuf)) = 1.5.3 Provides: bundled(golang(github.com/googleapis/gax-go/v2)) = 2.12.0 Provides: bundled(golang(github.com/gorilla/mux)) = 1.8.0 @@ -535,7 +543,7 @@ Provides: bundled(npm(date-fns)) = 2.30.0 Provides: bundled(npm(debounce-promise)) = 3.1.2 Provides: bundled(npm(devtools-protocol)) = 0.0.927104 Provides: bundled(npm(diff)) = 4.0.2 -Provides: bundled(npm(dompurify)) = 2.4.5 +Provides: bundled(npm(dompurify)) = 2.5.7 Provides: bundled(npm(emotion)) = 10.0.27 Provides: bundled(npm(esbuild)) = 0.17.19 Provides: bundled(npm(esbuild-loader)) = 3.0.1 @@ -738,15 +746,12 @@ Graphite, InfluxDB & OpenTSDB. # SELinux package %package selinux -Summary: SELinux policy module supporting grafana -BuildRequires: checkpolicy, selinux-policy-devel, selinux-policy-targeted -%if "%{_selinux_policy_version}" != "" -Requires: selinux-policy >= %{_selinux_policy_version} -%endif -Requires: %{name} = %{version}-%{release} -Requires: selinux-policy-targeted -Requires(post): /usr/sbin/semodule, /usr/sbin/semanage, /sbin/restorecon, /sbin/fixfiles, grafana -Requires(postun): /usr/sbin/semodule, /usr/sbin/semanage, /sbin/restorecon, /sbin/fixfiles, /sbin/service, grafana +Summary: SELinux policy module supporting grafana +BuildArch: noarch +Requires: selinux-policy-any +Requires(post): selinux-policy-any, /usr/sbin/semanage +Requires(postun): /usr/sbin/semanage +BuildRequires: selinux-policy-devel %description selinux SELinux policy module supporting grafana @@ -761,10 +766,6 @@ rm -r plugins-bundled %setup -q -T -D -b 2 %endif -# SELinux policy -mkdir SELinux -cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} SELinux - %patch -P 1 -p1 %patch -P 2 -p1 %patch -P 3 -p1 @@ -775,6 +776,9 @@ cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} SELinux %patch -P 8 -p1 %patch -P 9 -p1 %patch -P 10 -p1 +%patch -P 11 -p1 +%patch -P 12 -p1 +%patch -P 13 -p1 %patch -P 1001 -p1 %if %{enable_fips_mode} @@ -804,15 +808,11 @@ for cmd in grafana grafana-cli grafana-server; do done # SELinux policy -cd SELinux -for selinuxvariant in %{selinux_variants} -do - make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile - mv grafana.pp grafana.pp.${selinuxvariant} - make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile clean -done -cd - +mkdir selinux +cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} selinux +make -f %{_datadir}/selinux/devel/Makefile grafana.pp +bzip2 -9 grafana.pp %install # dirs, shared files, public html, webpack @@ -877,17 +877,18 @@ echo "d %{_rundir}/%{name} 0755 %{GRAFANA_USER} %{GRAFANA_GROUP} -" \ install -p -m 644 -D %{SOURCE3} %{buildroot}%{_sysusersdir}/%{name}.conf # SELinux policy -cd SELinux for selinuxvariant in %{selinux_variants} do - install -d %{buildroot}%{_datadir}/selinux/${selinuxvariant} - install -p -m 644 grafana.pp.${selinuxvariant} \ - %{buildroot}%{_datadir}/selinux/${selinuxvariant}/grafana.pp + install -D -m 0644 grafana.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/${selinuxvariant}/grafana.pp.bz2 + install -D -p -m 0644 selinux/grafana.if \ + %{buildroot}%{_datadir}/selinux/devel/include/distributed/grafana.if done -cd - +%if 0%{?fedora} >= 42 +%elif 0%{?fedora} || 0%{?rhel} >= 9 %pre %sysusers_create_compat %{SOURCE3} +%endif %preun %systemd_preun grafana-server.service @@ -990,39 +991,94 @@ export GOEXPERIMENT=boringcrypto %doc README.md ROADMAP.md SECURITY.md SUPPORT.md UPGRADING_DEPENDENCIES.md WORKFLOW.md # SELinux policy +%pre selinux +%selinux_relabel_pre + %post selinux for selinuxvariant in %{selinux_variants} do - /usr/sbin/semodule -s ${selinuxvariant} -i \ - %{_datadir}/selinux/${selinuxvariant}/grafana.pp &> /dev/null || : + %selinux_modules_install -s ${selinuxvariant} %{_datadir}/selinux/packages/${selinuxvariant}/grafana.pp.bz2 &>/dev/null + /usr/sbin/semanage port -a -t grafana_port_t -p tcp 3000 &> /dev/null || : + semodule -X400 -r grafana &>/dev/null || true done -/sbin/restorecon -RvF /usr/sbin/grafana* &> /dev/null || : -/sbin/restorecon -RvF /etc/grafana &> /dev/null || : -/sbin/restorecon -RvF /var/log/grafana &> /dev/null || : -/sbin/restorecon -RvF /var/lib/grafana &> /dev/null || : -/sbin/restorecon -RvF /usr/libexec/grafana-pcp &> /dev/null || : -/usr/sbin/semanage port -a -t grafana_port_t -p tcp 3000 &> /dev/null || : +%selinux_relabel_post -%postun selinux -if [ $1 -eq 0 ] ; then -/usr/sbin/semanage port -d -p tcp 3000 &> /dev/null || : - for selinuxvariant in %{selinux_variants} - do - /usr/sbin/semodule -s ${selinuxvariant} -r grafana &> /dev/null || : - done - /sbin/restorecon -RvF /usr/sbin/grafana* &> /dev/null || : - /sbin/restorecon -RvF /etc/grafana &> /dev/null || : - /sbin/restorecon -RvF /var/log/grafana &> /dev/null || : - /sbin/restorecon -RvF /var/lib/grafana &> /dev/null || : - /sbin/restorecon -RvF /usr/libexec/grafana-pcp &> /dev/null || : +if [ "$1" -le "1" ]; then # First install + # The daemon needs to be restarted for the custom label to be applied. + # This will fail in case "post selinux" is executed before the service file is installed, + # but then it is safe to ignore since the service will first start with the proper label + %systemd_postun_with_restart grafana.service &> /dev/null || : fi +%postun selinux +for selinuxvariant in %{selinux_variants} +do + if [ $1 -eq 0 ]; then + /usr/sbin/semanage port -d -p tcp 3000 &> /dev/null || : + %selinux_modules_uninstall -s ${selinuxvariant} grafana + %selinux_relabel_post -s ${selinuxvariant} + fi +done + %files selinux -%defattr(-,root,root,0755) -%doc SELinux/* -%{_datadir}/selinux/*/grafana.pp +%{_datadir}/selinux/packages/*/grafana.pp.* +%{_datadir}/selinux/devel/include/distributed/grafana.if +%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana %changelog +* Wed Dec 3 2025 Sam Feifer - 10.2.6-22 +- Fix recursive macro definition causing rpminspect failure + +* Tue Dec 2 2025 Sam Feifer - 10.2.6-21 +- Fix grafana-selinux cgroups denials + +* Fri Oct 10 2025 Alejandro Sáez - 10.2.6-20 +- rebuild + +* Fri Aug 15 2025 Maxwell G - 10.2.6-19 +- Rebuild for golang-1.25.0 + +* Thu Jul 24 2025 Fedora Release Engineering - 10.2.6-18 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Wed Jul 16 2025 Sam Feifer - 10.2.6-17 +- Backport selinux policy changes +- Backport selinux packaging changes in the spec file + +* Tue May 13 2025 Sam Feifer - 10.2.6-14 +- fix CVE-2025-4123 + +* Fri May 2 2025 Sam Feifer - 10.2.6-13 +- Added selinux rules for ldap and other observed selinux denials +- Reworked the spec file selinux sections +- Fixed the priority of the selinux policy + +* Wed Mar 26 2025 Sam Feifer - 10.2.6-12 +- fix CVE-2025-30204 +- fix CVE-2024-47875 +- move grafana home directory from /usr/share/grafana to /var/lib/grafana + +* Thu Feb 13 2025 Sam Feifer - 10.2.6-11 +- Conditionally drop call to %sysusers_create_compat + +* Fri Jan 17 2025 Fedora Release Engineering - 10.2.6-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Tue Nov 26 2024 Sam Feifer 10.2.6-9 +- Revert changes to configuration file that break older custom dashboards + +* Mon Nov 25 2024 Sam Feifer 10.2.6-8 +- Clean up configuration file + +* Fri Nov 22 2024 Sam Feifer 10.2.6-7 +- Update configurations to allow loading the valkey datasource + +* Fri Nov 8 2024 Sam Feifer 10.2.6-6 +- Update selinux policy for the new valkey executable + +* Wed Jul 17 2024 Sam Feifer 10.2.6-4 +- Resolve issue in selinux policy due to unification of bin and sbin + * Wed Jul 17 2024 Sam Feifer 10.2.6-4 - Fixes CVE-2024-6104 diff --git a/grafana.sysusers b/grafana.sysusers index 7c4a4d5..8948dff 100644 --- a/grafana.sysusers +++ b/grafana.sysusers @@ -1,2 +1,2 @@ #Type Name ID GECOS Home directory -u grafana - "Grafana user account" /usr/share/grafana +u grafana - "Grafana user account" /var/lib/grafana diff --git a/grafana.te b/grafana.te index 2910322..a536e21 100644 --- a/grafana.te +++ b/grafana.te @@ -27,13 +27,6 @@ gen_tunable(grafana_can_tcp_connect_elasticsearch_port, false) ## gen_tunable(grafana_can_tcp_connect_mysql_port, false) -## -##

-## Allow grafana to connect to postgresql's default tcp port of 5432 -##

-## -gen_tunable(grafana_can_tcp_connect_postgresql_port, false) - ## ##

## Allow grafana to connect to prometheus' default tcp port of 9090 @@ -41,6 +34,19 @@ gen_tunable(grafana_can_tcp_connect_postgresql_port, false) ## gen_tunable(grafana_can_tcp_connect_prometheus_port, false) +## +##

+## Allow grafana to connect to postgresql's default tcp port of 5432 +##

+## +gen_tunable(grafana_can_tcp_connect_postgresql_port, false) + +## +##

+## Allow grafana to connect to ldap's tcp port +##

+## +gen_tunable(grafana_can_tcp_connect_ldap_port, false) type grafana_t; type grafana_exec_t; @@ -95,10 +101,23 @@ allow grafana_t self:unix_dgram_socket create_socket_perms; allow grafana_t grafana_port_t:tcp_socket { name_bind name_connect }; +allow grafana_t grafana_var_lib_t:file { execute execute_no_trans }; +allow grafana_t grafana_var_lib_t:file map; + allow grafana_t self:unix_stream_socket connectto; allow grafana_t self:netlink_route_socket { create bind getattr nlmsg_read }; +optional_policy(` + require { + type cgroup_t; + class dir { search }; + class file { open read }; + } + allow grafana_t cgroup_t:dir search; + allow grafana_t cgroup_t:file { open read }; +') + optional_policy(` require { type smtp_port_t; @@ -108,13 +127,20 @@ optional_policy(` ') optional_policy(` - require { - type usr_t; - class file { execute execute_no_trans }; - } - allow grafana_t usr_t:file { execute execute_no_trans }; + require { + type ntop_port_t; + class tcp_socket { name_bind }; + } + allow grafana_t ntop_port_t:tcp_socket name_bind; ') +optional_policy(` + require { + type usr_t; + class file { execute execute_no_trans }; + } + allow grafana_t usr_t:file { execute execute_no_trans }; +') optional_policy(` require { @@ -127,6 +153,30 @@ optional_policy(` allow grafana_t postgresql_var_run_t:sock_file write; ') +optional_policy(` + require { + type proc_net_t; + class lnk_file { read }; + } + allow grafana_t proc_net_t:lnk_file read; +') + +optional_policy(` + require { + type autofs_t; + class dir {getattr}; + } + allow grafana_t autofs_t:dir getattr; +') + +optional_policy(` + require { + type postfix_local_t; + class dir { search }; + } + allow postfix_local_t grafana_var_lib_t:dir search; +') + manage_dirs_pattern(grafana_t, grafana_conf_t, grafana_conf_t) manage_files_pattern(grafana_t, grafana_conf_t, grafana_conf_t) @@ -190,12 +240,16 @@ tunable_policy(`grafana_can_tcp_connect_mysql_port',` # Mysql default tcp port 3 corenet_tcp_connect_mysqld_port(grafana_t) ') +tunable_policy(`grafana_can_tcp_connect_prometheus_port',` # Prometheus default tcp port 9090 + corenet_tcp_connect_websm_port(grafana_t) +') + tunable_policy(`grafana_can_tcp_connect_postgresql_port',` # Postgresql default tcp port 5432 corenet_tcp_connect_postgresql_port(grafana_t) ') -tunable_policy(`grafana_can_tcp_connect_prometheus_port',` # Prometheus default tcp port 9090 - corenet_tcp_connect_websm_port(grafana_t) +tunable_policy(`grafana_can_tcp_connect_ldap_port',` + corenet_tcp_connect_ldap_port(grafana_t) ') optional_policy(` diff --git a/plans/gating.fmf b/plans/gating.fmf deleted file mode 100644 index 5b0d2a0..0000000 --- a/plans/gating.fmf +++ /dev/null @@ -1,7 +0,0 @@ -summary: CI Gating Plan -discover: - how: fmf - filter: tag:gating - url: https://src.fedoraproject.org/tests/grafana -execute: - how: tmt diff --git a/sources b/sources index 5f2ecd4..85e21f5 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (grafana-vendor-10.2.6-2.tar.xz) = d5146a709b1ecfb1756732897ab1921146170d89b0d85f55e3f0a443568bc285f01fda087b8a8527f8c2afdee8205dd9a6d627cff9bda055f5e527c3290aaab7 -SHA512 (grafana-webpack-10.2.6-2.tar.gz) = 25b844194da58fa4fd45b5cdb562ed4ca40ec69cbd479b567ffe745d4813925e603ecc72101ee736cff0ab49ae33eb9ae934ab6669397a074b95ef28a5c70176 +SHA512 (grafana-vendor-10.2.6-12.tar.xz) = 289235d9345db6dd8522b974d975ab1511f05b22c752c9183f3aaaf51b277f865a661fe34861a4e4eb303ace6c716a72c0bab41fa22a33b9d95af063e73727f4 +SHA512 (grafana-webpack-10.2.6-12.tar.gz) = 18add624478ce7337d560dc81589e5ce06c6d15cad9edc77f2292b747e75f597793a8ad0364961afe564e21b897090d7b5912fa16f631d9f7f80efd63e106282 SHA512 (grafana-10.2.6.tar.gz) = 7244f4cb6572fe0403e6224f7247fbb273bbd1f359ee706a82001f0d409fb375d113f1cb24a657e845b93eb55ee98e1d7ae713e767c219f4d3b00eaf5c73d28e