From a83c749afa7ac8cd50ce112032c37e0cdc1a94b3 Mon Sep 17 00:00:00 2001 From: Sam Feifer Date: Thu, 1 Aug 2024 12:02:42 -0400 Subject: [PATCH 01/22] fix selinux issue caused by unification of sbin and bin --- grafana.fc | 6 +++++- grafana.spec | 7 ++++++- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/grafana.fc b/grafana.fc index ae17d09..83aa975 100644 --- a/grafana.fc +++ b/grafana.fc @@ -7,6 +7,10 @@ /usr/sbin/grafana-server -- gen_context(system_u:object_r:grafana_exec_t,s0) /usr/sbin/grafana -- gen_context(system_u:object_r:grafana_exec_t,s0) +/usr/bin/grafana-cli -- gen_context(system_u:object_r:grafana_exec_t,s0) +/usr/bin/grafana-server -- gen_context(system_u:object_r:grafana_exec_t,s0) +/usr/bin/grafana -- gen_context(system_u:object_r:grafana_exec_t,s0) + /var/lib/grafana(/.*)? gen_context(system_u:object_r:grafana_var_lib_t,s0) #/var/lib/grafana/grafana.db -- gen_context(system_u:object_r:grafana_db_t,s0) @@ -22,4 +26,4 @@ #define context for pcp plugin #/usr/share/performancecopilot-pcp-app/datasources/redis/pcp_redis_datasource_(.*) -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0) -/usr/libexec/grafana-pcp/datasources/redis/pcp_redis_datasource_(.*) -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0) \ No newline at end of file +/usr/libexec/grafana-pcp/datasources/redis/pcp_redis_datasource_(.*) -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0) diff --git a/grafana.spec b/grafana.spec index 17a34ba..e30d0f6 100644 --- a/grafana.spec +++ b/grafana.spec @@ -25,7 +25,7 @@ end} Name: grafana Version: 10.2.6 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -997,6 +997,7 @@ do %{_datadir}/selinux/${selinuxvariant}/grafana.pp &> /dev/null || : done /sbin/restorecon -RvF /usr/sbin/grafana* &> /dev/null || : +/sbin/restorecon -RvF /usr/bin/grafana* &> /dev/null || : /sbin/restorecon -RvF /etc/grafana &> /dev/null || : /sbin/restorecon -RvF /var/log/grafana &> /dev/null || : /sbin/restorecon -RvF /var/lib/grafana &> /dev/null || : @@ -1011,6 +1012,7 @@ if [ $1 -eq 0 ] ; then /usr/sbin/semodule -s ${selinuxvariant} -r grafana &> /dev/null || : done /sbin/restorecon -RvF /usr/sbin/grafana* &> /dev/null || : + /sbin/restorecon -RvF /usr/bin/grafana* &> /dev/null || : /sbin/restorecon -RvF /etc/grafana &> /dev/null || : /sbin/restorecon -RvF /var/log/grafana &> /dev/null || : /sbin/restorecon -RvF /var/lib/grafana &> /dev/null || : @@ -1023,6 +1025,9 @@ fi %{_datadir}/selinux/*/grafana.pp %changelog +* Wed Jul 17 2024 Sam Feifer 10.2.6-4 +- Resolve issue in selinux policy due to unification of bin and sbin + * Wed Jul 17 2024 Sam Feifer 10.2.6-4 - Fixes CVE-2024-6104 From 9d54ca90a86f239b2b0bcdf39d221aac566cb4c4 Mon Sep 17 00:00:00 2001 From: Sam Feifer Date: Fri, 8 Nov 2024 11:18:23 -0500 Subject: [PATCH 02/22] Update selinux policy for valkey --- grafana.fc | 1 + grafana.spec | 7 +++++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/grafana.fc b/grafana.fc index 83aa975..0000c0b 100644 --- a/grafana.fc +++ b/grafana.fc @@ -27,3 +27,4 @@ #define context for pcp plugin #/usr/share/performancecopilot-pcp-app/datasources/redis/pcp_redis_datasource_(.*) -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0) /usr/libexec/grafana-pcp/datasources/redis/pcp_redis_datasource_(.*) -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0) +/usr/libexec/grafana-pcp/datasources/valkey/pcp_valkey_datasource_(.*) -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0) diff --git a/grafana.spec b/grafana.spec index e30d0f6..fa23509 100644 --- a/grafana.spec +++ b/grafana.spec @@ -25,7 +25,7 @@ end} Name: grafana Version: 10.2.6 -Release: 5%{?dist} +Release: 6%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -89,7 +89,7 @@ ExclusiveArch: %{grafana_arches} BuildRequires: systemd BuildRequires: systemd-rpm-macros -BuildRequires: golang >= 1.17 +BuildRequires: golang BuildRequires: go-srpm-macros BuildRequires: go-rpm-macros @@ -1025,6 +1025,9 @@ fi %{_datadir}/selinux/*/grafana.pp %changelog +* Fri Nov 8 2024 Sam Feifer 10.2.6-6 +- Update selinux policy for the new valkey executable + * Wed Jul 17 2024 Sam Feifer 10.2.6-4 - Resolve issue in selinux policy due to unification of bin and sbin From 8807b5661add558ef5f4f37abf860497e7b1d4b3 Mon Sep 17 00:00:00 2001 From: Sam Feifer Date: Fri, 22 Nov 2024 10:26:03 -0500 Subject: [PATCH 03/22] Allow loading valkey datasource --- 0003-update-default-configuration.patch | 2 +- grafana.spec | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/0003-update-default-configuration.patch b/0003-update-default-configuration.patch index a0c961a..dfe119b 100644 --- a/0003-update-default-configuration.patch +++ b/0003-update-default-configuration.patch @@ -66,7 +66,7 @@ index 916de769f9..2f270d4940 100644 ;app_tls_skip_verify_insecure = false # Enter a comma-separated list of plugin identifiers to identify plugins to load even if they are unsigned. Plugins with modified signatures are never loaded. -;allow_loading_unsigned_plugins = -+allow_loading_unsigned_plugins = performancecopilot-pcp-app,pcp-redis-datasource,pcp-vector-datasource,pcp-bpftrace-datasource,pcp-flamegraph-panel,pcp-breadcrumbs-panel,pcp-troubleshooting-panel,performancecopilot-redis-datasource,performancecopilot-vector-datasource,performancecopilot-bpftrace-datasource,performancecopilot-flamegraph-panel,performancecopilot-breadcrumbs-panel,performancecopilot-troubleshooting-panel ++allow_loading_unsigned_plugins = performancecopilot-pcp-app,pcp-valkey-datasource,pcp-vector-datasource,pcp-bpftrace-datasource,pcp-flamegraph-panel,pcp-breadcrumbs-panel,pcp-troubleshooting-panel,performancecopilot-valkey-datasource,performancecopilot-vector-datasource,performancecopilot-bpftrace-datasource,performancecopilot-flamegraph-panel,performancecopilot-breadcrumbs-panel,performancecopilot-troubleshooting-panel # Enable or disable installing / uninstalling / updating plugins directly from within Grafana. ;plugin_admin_enabled = false ;plugin_admin_external_manage_enabled = false diff --git a/grafana.spec b/grafana.spec index fa23509..fea961d 100644 --- a/grafana.spec +++ b/grafana.spec @@ -25,7 +25,7 @@ end} Name: grafana Version: 10.2.6 -Release: 6%{?dist} +Release: 7%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -1025,6 +1025,9 @@ fi %{_datadir}/selinux/*/grafana.pp %changelog +* Fri Nov 22 2024 Sam Feifer 10.2.6-7 +- Update configurations to allow loading the valkey datasource + * Fri Nov 8 2024 Sam Feifer 10.2.6-6 - Update selinux policy for the new valkey executable From de6f87df84c469e15d5fa1b89f1d83181f880b13 Mon Sep 17 00:00:00 2001 From: Sam Feifer Date: Mon, 25 Nov 2024 14:33:20 -0500 Subject: [PATCH 04/22] Clean up grafana.ini file --- 0003-update-default-configuration.patch | 2 +- grafana.spec | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/0003-update-default-configuration.patch b/0003-update-default-configuration.patch index dfe119b..34fed58 100644 --- a/0003-update-default-configuration.patch +++ b/0003-update-default-configuration.patch @@ -66,7 +66,7 @@ index 916de769f9..2f270d4940 100644 ;app_tls_skip_verify_insecure = false # Enter a comma-separated list of plugin identifiers to identify plugins to load even if they are unsigned. Plugins with modified signatures are never loaded. -;allow_loading_unsigned_plugins = -+allow_loading_unsigned_plugins = performancecopilot-pcp-app,pcp-valkey-datasource,pcp-vector-datasource,pcp-bpftrace-datasource,pcp-flamegraph-panel,pcp-breadcrumbs-panel,pcp-troubleshooting-panel,performancecopilot-valkey-datasource,performancecopilot-vector-datasource,performancecopilot-bpftrace-datasource,performancecopilot-flamegraph-panel,performancecopilot-breadcrumbs-panel,performancecopilot-troubleshooting-panel ++allow_loading_unsigned_plugins = performancecopilot-pcp-app,performancecopilot-valkey-datasource,performancecopilot-vector-datasource,performancecopilot-bpftrace-datasource,performancecopilot-flamegraph-panel,performancecopilot-breadcrumbs-panel,performancecopilot-troubleshooting-panel # Enable or disable installing / uninstalling / updating plugins directly from within Grafana. ;plugin_admin_enabled = false ;plugin_admin_external_manage_enabled = false diff --git a/grafana.spec b/grafana.spec index fea961d..724fece 100644 --- a/grafana.spec +++ b/grafana.spec @@ -25,7 +25,7 @@ end} Name: grafana Version: 10.2.6 -Release: 7%{?dist} +Release: 8%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -1025,6 +1025,9 @@ fi %{_datadir}/selinux/*/grafana.pp %changelog +* Mon Nov 25 2024 Sam Feifer 10.2.6-8 +- Clean up configuration file + * Fri Nov 22 2024 Sam Feifer 10.2.6-7 - Update configurations to allow loading the valkey datasource From 4839459068119ffacfa19565ac9cd33ab2ad5550 Mon Sep 17 00:00:00 2001 From: Sam Feifer Date: Tue, 26 Nov 2024 11:28:48 -0500 Subject: [PATCH 05/22] Revert changes that break custom dashboards --- 0003-update-default-configuration.patch | 2 +- grafana.spec | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/0003-update-default-configuration.patch b/0003-update-default-configuration.patch index 34fed58..dfe119b 100644 --- a/0003-update-default-configuration.patch +++ b/0003-update-default-configuration.patch @@ -66,7 +66,7 @@ index 916de769f9..2f270d4940 100644 ;app_tls_skip_verify_insecure = false # Enter a comma-separated list of plugin identifiers to identify plugins to load even if they are unsigned. Plugins with modified signatures are never loaded. -;allow_loading_unsigned_plugins = -+allow_loading_unsigned_plugins = performancecopilot-pcp-app,performancecopilot-valkey-datasource,performancecopilot-vector-datasource,performancecopilot-bpftrace-datasource,performancecopilot-flamegraph-panel,performancecopilot-breadcrumbs-panel,performancecopilot-troubleshooting-panel ++allow_loading_unsigned_plugins = performancecopilot-pcp-app,pcp-valkey-datasource,pcp-vector-datasource,pcp-bpftrace-datasource,pcp-flamegraph-panel,pcp-breadcrumbs-panel,pcp-troubleshooting-panel,performancecopilot-valkey-datasource,performancecopilot-vector-datasource,performancecopilot-bpftrace-datasource,performancecopilot-flamegraph-panel,performancecopilot-breadcrumbs-panel,performancecopilot-troubleshooting-panel # Enable or disable installing / uninstalling / updating plugins directly from within Grafana. ;plugin_admin_enabled = false ;plugin_admin_external_manage_enabled = false diff --git a/grafana.spec b/grafana.spec index 724fece..c53769d 100644 --- a/grafana.spec +++ b/grafana.spec @@ -25,7 +25,7 @@ end} Name: grafana Version: 10.2.6 -Release: 8%{?dist} +Release: 9%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -1025,6 +1025,9 @@ fi %{_datadir}/selinux/*/grafana.pp %changelog +* Tue Nov 26 2024 Sam Feifer 10.2.6-9 +- Revert changes to configuration file that break older custom dashboards + * Mon Nov 25 2024 Sam Feifer 10.2.6-8 - Clean up configuration file From b70e3c2d3320698b0ca6f82dedfe1918b073fe1c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jan 2025 05:04:48 +0000 Subject: [PATCH 06/22] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- grafana.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/grafana.spec b/grafana.spec index c53769d..08dda51 100644 --- a/grafana.spec +++ b/grafana.spec @@ -25,7 +25,7 @@ end} Name: grafana Version: 10.2.6 -Release: 9%{?dist} +Release: 10%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -1025,6 +1025,9 @@ fi %{_datadir}/selinux/*/grafana.pp %changelog +* Fri Jan 17 2025 Fedora Release Engineering - 10.2.6-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Tue Nov 26 2024 Sam Feifer 10.2.6-9 - Revert changes to configuration file that break older custom dashboards From 8803dd55d3dbf4491c4c35ff26bb05c7a4a9cc6c Mon Sep 17 00:00:00 2001 From: Sam Feifer Date: Thu, 13 Feb 2025 17:21:39 -0500 Subject: [PATCH 07/22] drop call to %sysusers_create_compat --- grafana.spec | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/grafana.spec b/grafana.spec index 08dda51..d9bc2d3 100644 --- a/grafana.spec +++ b/grafana.spec @@ -25,7 +25,7 @@ end} Name: grafana Version: 10.2.6 -Release: 10%{?dist} +Release: 11%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -107,7 +107,11 @@ BuildRequires: openssl-devel # grafana-server service daemon uses systemd %{?systemd_requires} + +%if 0%{?fedora} >= 42 +%elif 0%{?fedora} || 0%{?rhel} >= 9 Requires(pre): shadow-utils +%endif # Grafana queries the mime database (through mime.TypeByExtension, in a unit test and at runtime) BuildRequires: shared-mime-info @@ -886,8 +890,11 @@ do done cd - +%if 0%{?fedora} >= 42 +%elif 0%{?fedora} || 0%{?rhel} >= 9 %pre %sysusers_create_compat %{SOURCE3} +%endif %preun %systemd_preun grafana-server.service @@ -1025,6 +1032,9 @@ fi %{_datadir}/selinux/*/grafana.pp %changelog +* Thu Feb 13 2025 Sam Feifer - 10.2.6-11 +- Conditionally drop call to %sysusers_create_compat + * Fri Jan 17 2025 Fedora Release Engineering - 10.2.6-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 575c462570283a9c4eb16a36299c63b3f2c74e19 Mon Sep 17 00:00:00 2001 From: Sam Feifer Date: Wed, 26 Mar 2025 17:18:37 -0400 Subject: [PATCH 08/22] Move home directory and resolve CVEs --- 0011-fix-dompurify-CVE.patch | 55 ++++++++++++++++++++++++++++++++++++ 0012-fix-jwt-CVE.patch | 28 ++++++++++++++++++ create_bundles.sh | 2 ++ grafana.spec | 19 +++++++++---- grafana.sysusers | 2 +- sources | 4 +-- 6 files changed, 102 insertions(+), 8 deletions(-) create mode 100644 0011-fix-dompurify-CVE.patch create mode 100644 0012-fix-jwt-CVE.patch diff --git a/0011-fix-dompurify-CVE.patch b/0011-fix-dompurify-CVE.patch new file mode 100644 index 0000000..9be0fdf --- /dev/null +++ b/0011-fix-dompurify-CVE.patch @@ -0,0 +1,55 @@ +diff --git a/package.json b/package.json +index 38deb6d7dee..010a24fb451 100644 +--- a/package.json ++++ b/package.json +@@ -432,7 +432,8 @@ + "react-split-pane@0.1.92": "patch:react-split-pane@npm:0.1.92#.yarn/patches/react-split-pane-npm-0.1.92-93dbf51dff.patch", + "@storybook/blocks@7.4.5": "patch:@storybook/blocks@npm%3A7.4.5#./.yarn/patches/@storybook-blocks-npm-7.4.5-5a2374564a.patch", + "history@4.10.1": "patch:history@npm%3A4.10.1#./.yarn/patches/history-npm-4.10.1-ee217563ae.patch", +- "history@^4.9.0": "patch:history@npm%3A4.10.1#./.yarn/patches/history-npm-4.10.1-ee217563ae.patch" ++ "history@^4.9.0": "patch:history@npm%3A4.10.1#./.yarn/patches/history-npm-4.10.1-ee217563ae.patch", ++ "dompurify": "^2.5.0" + }, + "workspaces": { + "packages": [ +diff --git a/packages/grafana-data/package.json b/packages/grafana-data/package.json +index 2182744e61b..4201ef58dda 100644 +--- a/packages/grafana-data/package.json ++++ b/packages/grafana-data/package.json +@@ -41,7 +41,7 @@ + "@types/string-hash": "1.1.1", + "d3-interpolate": "3.0.1", + "date-fns": "2.30.0", +- "dompurify": "^2.4.3", ++ "dompurify": "^2.5.0", + "eventemitter3": "5.0.1", + "fast_array_intersect": "1.1.0", + "history": "4.10.1", +diff --git a/yarn.lock b/yarn.lock +index bf22ba52a17..88fc4d3fbfb 100644 +--- a/yarn.lock ++++ b/yarn.lock +@@ -2953,7 +2953,7 @@ __metadata: + "@types/tinycolor2": "npm:1.4.3" + d3-interpolate: "npm:3.0.1" + date-fns: "npm:2.30.0" +- dompurify: "npm:^2.4.3" ++ dompurify: "npm:^2.5.0" + esbuild: "npm:0.18.12" + eventemitter3: "npm:5.0.1" + fast_array_intersect: "npm:1.1.0" +@@ -14478,10 +14478,10 @@ __metadata: + languageName: node + linkType: hard + +-"dompurify@npm:^2.2.0, dompurify@npm:^2.4.3": +- version: 2.4.5 +- resolution: "dompurify@npm:2.4.5" +- checksum: d764c2ff126b3749dad35bc34eed40f51141d7dfd620e938c92f08d68c32beeb259d06abadeee91f6e2a8c8737ce670e2124ac9a257ba3bcdc666598cebcde01 ++"dompurify@npm:^2.5.0": ++ version: 2.5.7 ++ resolution: "dompurify@npm:2.5.7" ++ checksum: b150ca1e28083252cd51097162dc96cb45203f7e2af1fbaa8ef32b4f4d6b605e4aa8915190d38bd0635cbbf14d13a200138cd3ec1b084096819b14c718355122 + languageName: node + linkType: hard + diff --git a/0012-fix-jwt-CVE.patch b/0012-fix-jwt-CVE.patch new file mode 100644 index 0000000..04fc58e --- /dev/null +++ b/0012-fix-jwt-CVE.patch @@ -0,0 +1,28 @@ +diff --git a/go.mod b/go.mod +index fcbc09da5e6..1771902bc1c 100644 +--- a/go.mod ++++ b/go.mod +@@ -164,7 +164,7 @@ require ( + github.com/go-openapi/spec v0.20.9 // indirect + github.com/go-openapi/swag v0.22.4 // indirect + github.com/go-openapi/validate v0.22.1 // indirect +- github.com/golang-jwt/jwt/v4 v4.5.0 // @grafana/backend-platform ++ github.com/golang-jwt/jwt/v4 v4.5.2 // @grafana/backend-platform + github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect + github.com/golang/glog v1.1.2 // indirect + github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect +diff --git a/go.sum b/go.sum +index d05dfb55fd4..3a045f712eb 100644 +--- a/go.sum ++++ b/go.sum +@@ -1593,8 +1593,9 @@ github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzw + github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg= + github.com/golang-jwt/jwt/v4 v4.4.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= + github.com/golang-jwt/jwt/v4 v4.4.3/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= +-github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg= + github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= ++github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI= ++github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= + github.com/golang-migrate/migrate/v4 v4.7.0 h1:gONcHxHApDTKXDyLH/H97gEHmpu1zcnnbAaq2zgrPrs= + github.com/golang-migrate/migrate/v4 v4.7.0/go.mod h1:Qvut3N4xKWjoH3sokBccML6WyHSnggXm/DvMMnTsQIc= + github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0= diff --git a/create_bundles.sh b/create_bundles.sh index feb9994..f4105d0 100755 --- a/create_bundles.sh +++ b/create_bundles.sh @@ -21,6 +21,7 @@ pushd "${SOURCE_DIR}" # Vendor Go dependencies patch -p1 --fuzz=0 < ../0004-remove-unused-backend-dependencies.patch +patch -p1 --fuzz=0 < ../0012-fix-jwt-CVE.patch go mod vendor # Generate Go files @@ -59,6 +60,7 @@ awk '$2 ~ /^v/ && $4 != "indirect" {print "Provides: bundled(golang(" $1 ")) = " # Vendor Node.js dependencies patch -p1 --fuzz=0 < ../0005-remove-unused-frontend-crypto.patch +patch -p1 --fuzz=0 < ../0011-fix-dompurify-CVE.patch export HUSKY=0 yarn install --frozen-lockfile diff --git a/grafana.spec b/grafana.spec index d9bc2d3..d4d5f7d 100644 --- a/grafana.spec +++ b/grafana.spec @@ -25,7 +25,7 @@ end} Name: grafana Version: 10.2.6 -Release: 11%{?dist} +Release: 12%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -36,13 +36,13 @@ Source0: https://github.com/grafana/grafana/archive/v%{version}/%{name} # Source1 contains the bundled Go and Node.js dependencies # Note: In case there were no changes to this tarball, the NVR of this tarball # lags behind the NVR of this package. -Source1: grafana-vendor-%{version}-2.tar.xz +Source1: grafana-vendor-%{version}-12.tar.xz %if %{compile_frontend} == 0 # Source2 contains the precompiled frontend # Note: In case there were no changes to this tarball, the NVR of this tarball # lags behind the NVR of this package. -Source2: grafana-webpack-%{version}-2.tar.gz +Source2: grafana-webpack-%{version}-12.tar.gz %endif # Source3 contains the systemd-sysusers configuration @@ -77,6 +77,8 @@ Patch8: 0008-replace-faulty-slices-sort.patch Patch9: 0009-update-wrappers-and-systemd-with-distro-paths.patch # https://github.com/grafana/grafana/commit/bae86dbeb0ad68a205454e98e76985dc393183d4 Patch10: 0010-remove-bcrypt-references.patch +Patch11: 0011-fix-dompurify-CVE.patch +Patch12: 0012-fix-jwt-CVE.patch # Patches affecting the vendor tarball Patch1001: 1001-vendor-patch-removed-backend-crypto.patch @@ -250,7 +252,7 @@ Provides: bundled(golang(github.com/andybalholm/brotli)) = 1.0.4 Provides: bundled(golang(github.com/go-kit/log)) = 0.2.1 Provides: bundled(golang(github.com/go-openapi/loads)) = 0.21.2 Provides: bundled(golang(github.com/go-openapi/runtime)) = 0.26.0 -Provides: bundled(golang(github.com/golang-jwt/jwt/v4)) = 4.5.0 +Provides: bundled(golang(github.com/golang-jwt/jwt/v4)) = 4.5.2 Provides: bundled(golang(github.com/golang/protobuf)) = 1.5.3 Provides: bundled(golang(github.com/googleapis/gax-go/v2)) = 2.12.0 Provides: bundled(golang(github.com/gorilla/mux)) = 1.8.0 @@ -539,7 +541,7 @@ Provides: bundled(npm(date-fns)) = 2.30.0 Provides: bundled(npm(debounce-promise)) = 3.1.2 Provides: bundled(npm(devtools-protocol)) = 0.0.927104 Provides: bundled(npm(diff)) = 4.0.2 -Provides: bundled(npm(dompurify)) = 2.4.5 +Provides: bundled(npm(dompurify)) = 2.5.7 Provides: bundled(npm(emotion)) = 10.0.27 Provides: bundled(npm(esbuild)) = 0.17.19 Provides: bundled(npm(esbuild-loader)) = 3.0.1 @@ -779,6 +781,8 @@ cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} SELinux %patch -P 8 -p1 %patch -P 9 -p1 %patch -P 10 -p1 +%patch -P 11 -p1 +%patch -P 12 -p1 %patch -P 1001 -p1 %if %{enable_fips_mode} @@ -1032,6 +1036,11 @@ fi %{_datadir}/selinux/*/grafana.pp %changelog +* Wed Mar 26 2025 Sam Feifer - 10.2.6-12 +- fix CVE-2025-30204 +- fix CVE-2024-47875 +- move grafana home directory from /usr/share/grafana to /var/lib/grafana + * Thu Feb 13 2025 Sam Feifer - 10.2.6-11 - Conditionally drop call to %sysusers_create_compat diff --git a/grafana.sysusers b/grafana.sysusers index 7c4a4d5..8948dff 100644 --- a/grafana.sysusers +++ b/grafana.sysusers @@ -1,2 +1,2 @@ #Type Name ID GECOS Home directory -u grafana - "Grafana user account" /usr/share/grafana +u grafana - "Grafana user account" /var/lib/grafana diff --git a/sources b/sources index 5f2ecd4..85e21f5 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (grafana-vendor-10.2.6-2.tar.xz) = d5146a709b1ecfb1756732897ab1921146170d89b0d85f55e3f0a443568bc285f01fda087b8a8527f8c2afdee8205dd9a6d627cff9bda055f5e527c3290aaab7 -SHA512 (grafana-webpack-10.2.6-2.tar.gz) = 25b844194da58fa4fd45b5cdb562ed4ca40ec69cbd479b567ffe745d4813925e603ecc72101ee736cff0ab49ae33eb9ae934ab6669397a074b95ef28a5c70176 +SHA512 (grafana-vendor-10.2.6-12.tar.xz) = 289235d9345db6dd8522b974d975ab1511f05b22c752c9183f3aaaf51b277f865a661fe34861a4e4eb303ace6c716a72c0bab41fa22a33b9d95af063e73727f4 +SHA512 (grafana-webpack-10.2.6-12.tar.gz) = 18add624478ce7337d560dc81589e5ce06c6d15cad9edc77f2292b747e75f597793a8ad0364961afe564e21b897090d7b5912fa16f631d9f7f80efd63e106282 SHA512 (grafana-10.2.6.tar.gz) = 7244f4cb6572fe0403e6224f7247fbb273bbd1f359ee706a82001f0d409fb375d113f1cb24a657e845b93eb55ee98e1d7ae713e767c219f4d3b00eaf5c73d28e From dcbaef147dba2a59042b89a4d8c8769522b1473e Mon Sep 17 00:00:00 2001 From: Sam Feifer Date: Fri, 2 May 2025 13:46:04 -0400 Subject: [PATCH 09/22] Rework selinux policy packaging and add rules --- 0011-fix-dompurify-CVE.patch | 3 ++ 0012-fix-jwt-CVE.patch | 3 ++ grafana.spec | 100 +++++++++++++++++------------------ grafana.te | 70 ++++++++++++++++++------ 4 files changed, 107 insertions(+), 69 deletions(-) diff --git a/0011-fix-dompurify-CVE.patch b/0011-fix-dompurify-CVE.patch index 9be0fdf..47f906e 100644 --- a/0011-fix-dompurify-CVE.patch +++ b/0011-fix-dompurify-CVE.patch @@ -1,3 +1,6 @@ +From: Sam Feifer +Subject: [PATCH] fix dompurify CVE + diff --git a/package.json b/package.json index 38deb6d7dee..010a24fb451 100644 --- a/package.json diff --git a/0012-fix-jwt-CVE.patch b/0012-fix-jwt-CVE.patch index 04fc58e..a937bb1 100644 --- a/0012-fix-jwt-CVE.patch +++ b/0012-fix-jwt-CVE.patch @@ -1,3 +1,6 @@ +From: Sam Feifer +Subject: [PATCH] fix jwt CVE + diff --git a/go.mod b/go.mod index fcbc09da5e6..1771902bc1c 100644 --- a/go.mod diff --git a/grafana.spec b/grafana.spec index d4d5f7d..f17d330 100644 --- a/grafana.spec +++ b/grafana.spec @@ -25,7 +25,7 @@ end} Name: grafana Version: 10.2.6 -Release: 12%{?dist} +Release: 13%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -744,15 +744,13 @@ Graphite, InfluxDB & OpenTSDB. # SELinux package %package selinux -Summary: SELinux policy module supporting grafana -BuildRequires: checkpolicy, selinux-policy-devel, selinux-policy-targeted -%if "%{_selinux_policy_version}" != "" -Requires: selinux-policy >= %{_selinux_policy_version} -%endif -Requires: %{name} = %{version}-%{release} -Requires: selinux-policy-targeted -Requires(post): /usr/sbin/semodule, /usr/sbin/semanage, /sbin/restorecon, /sbin/fixfiles, grafana -Requires(postun): /usr/sbin/semodule, /usr/sbin/semanage, /sbin/restorecon, /sbin/fixfiles, /sbin/service, grafana +Summary: SELinux policy module supporting grafana +BuildArch: noarch +Requires: %{name} = %{version}-%{release} +Requires: selinux-policy-targeted +Requires(post): selinux-policy-targeted, /usr/sbin/semanage +Requires(postun): /usr/sbin/semanage +BuildRequires: selinux-policy-devel %description selinux SELinux policy module supporting grafana @@ -767,10 +765,6 @@ rm -r plugins-bundled %setup -q -T -D -b 2 %endif -# SELinux policy -mkdir SELinux -cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} SELinux - %patch -P 1 -p1 %patch -P 2 -p1 %patch -P 3 -p1 @@ -812,15 +806,11 @@ for cmd in grafana grafana-cli grafana-server; do done # SELinux policy -cd SELinux -for selinuxvariant in %{selinux_variants} -do - make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile - mv grafana.pp grafana.pp.${selinuxvariant} - make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile clean -done -cd - +mkdir selinux +cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} selinux +make -f %{_datadir}/selinux/devel/Makefile grafana.pp +bzip2 -9 grafana.pp %install # dirs, shared files, public html, webpack @@ -885,14 +875,12 @@ echo "d %{_rundir}/%{name} 0755 %{GRAFANA_USER} %{GRAFANA_GROUP} -" \ install -p -m 644 -D %{SOURCE3} %{buildroot}%{_sysusersdir}/%{name}.conf # SELinux policy -cd SELinux for selinuxvariant in %{selinux_variants} do - install -d %{buildroot}%{_datadir}/selinux/${selinuxvariant} - install -p -m 644 grafana.pp.${selinuxvariant} \ - %{buildroot}%{_datadir}/selinux/${selinuxvariant}/grafana.pp + install -D -m 0644 grafana.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/${selinuxvariant}/grafana.pp.bz2 + install -D -p -m 0644 selinux/grafana.if \ + %{buildroot}%{_datadir}/selinux/devel/include/distributed/grafana.if done -cd - %if 0%{?fedora} >= 42 %elif 0%{?fedora} || 0%{?rhel} >= 9 @@ -1001,41 +989,49 @@ export GOEXPERIMENT=boringcrypto %doc README.md ROADMAP.md SECURITY.md SUPPORT.md UPGRADING_DEPENDENCIES.md WORKFLOW.md # SELinux policy +%pre selinux +for selinuxvariant in %{selinux_variants} +do + %selinux_relabel_pre -s ${selinuxvariant} +done + %post selinux for selinuxvariant in %{selinux_variants} do - /usr/sbin/semodule -s ${selinuxvariant} -i \ - %{_datadir}/selinux/${selinuxvariant}/grafana.pp &> /dev/null || : + %selinux_modules_install -s ${selinuxvariant} %{_datadir}/selinux/packages/${selinuxvariant}/grafana.pp.bz2 &>/dev/null + /usr/sbin/semanage port -a -t grafana_port_t -p tcp 3000 &> /dev/null || : + semodule -X400 -r grafana &>/dev/null || true + %selinux_relabel_post -s ${selinuxvariant} done -/sbin/restorecon -RvF /usr/sbin/grafana* &> /dev/null || : -/sbin/restorecon -RvF /usr/bin/grafana* &> /dev/null || : -/sbin/restorecon -RvF /etc/grafana &> /dev/null || : -/sbin/restorecon -RvF /var/log/grafana &> /dev/null || : -/sbin/restorecon -RvF /var/lib/grafana &> /dev/null || : -/sbin/restorecon -RvF /usr/libexec/grafana-pcp &> /dev/null || : -/usr/sbin/semanage port -a -t grafana_port_t -p tcp 3000 &> /dev/null || : -%postun selinux -if [ $1 -eq 0 ] ; then -/usr/sbin/semanage port -d -p tcp 3000 &> /dev/null || : - for selinuxvariant in %{selinux_variants} - do - /usr/sbin/semodule -s ${selinuxvariant} -r grafana &> /dev/null || : - done - /sbin/restorecon -RvF /usr/sbin/grafana* &> /dev/null || : - /sbin/restorecon -RvF /usr/bin/grafana* &> /dev/null || : - /sbin/restorecon -RvF /etc/grafana &> /dev/null || : - /sbin/restorecon -RvF /var/log/grafana &> /dev/null || : - /sbin/restorecon -RvF /var/lib/grafana &> /dev/null || : - /sbin/restorecon -RvF /usr/libexec/grafana-pcp &> /dev/null || : +if [ "$1" -le "1" ]; then # First install + # The daemon needs to be restarted for the custom label to be applied. + # This will fail in case "post selinux" is executed before the service file is installed, + # but then it is safe to ignore since the service will first start with the proper label + %systemd_postun_with_restart grafana.service &> /dev/null || : fi +%postun selinux +for selinuxvariant in %{selinux_variants} +do + if [ $1 -eq 0 ]; then + /usr/sbin/semanage port -d -p tcp 3000 &> /dev/null || : + %selinux_modules_uninstall -s ${selinuxvariant} grafana + %selinux_relabel_post -s ${selinuxvariant} + fi +done + %files selinux -%defattr(-,root,root,0755) -%doc SELinux/* -%{_datadir}/selinux/*/grafana.pp +%{_datadir}/selinux/packages/*/grafana.pp.* +%{_datadir}/selinux/devel/include/distributed/grafana.if +%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana %changelog +* Fri May 2 2025 Sam Feifer - 10.2.6-13 +- Added selinux rules for ldap and other observed selinux denials +- Reworked the spec file selinux sections +- Fixed the priority of the selinux policy + * Wed Mar 26 2025 Sam Feifer - 10.2.6-12 - fix CVE-2025-30204 - fix CVE-2024-47875 diff --git a/grafana.te b/grafana.te index 2910322..4f1150c 100644 --- a/grafana.te +++ b/grafana.te @@ -27,13 +27,6 @@ gen_tunable(grafana_can_tcp_connect_elasticsearch_port, false) ## gen_tunable(grafana_can_tcp_connect_mysql_port, false) -## -##

-## Allow grafana to connect to postgresql's default tcp port of 5432 -##

-## -gen_tunable(grafana_can_tcp_connect_postgresql_port, false) - ## ##

## Allow grafana to connect to prometheus' default tcp port of 9090 @@ -41,6 +34,19 @@ gen_tunable(grafana_can_tcp_connect_postgresql_port, false) ## gen_tunable(grafana_can_tcp_connect_prometheus_port, false) +## +##

+## Allow grafana to connect to postgresql's default tcp port of 5432 +##

+## +gen_tunable(grafana_can_tcp_connect_postgresql_port, false) + +## +##

+## Allow grafana to connect to ldap's tcp port +##

+## +gen_tunable(grafana_can_tcp_connect_ldap_port, false) type grafana_t; type grafana_exec_t; @@ -95,6 +101,9 @@ allow grafana_t self:unix_dgram_socket create_socket_perms; allow grafana_t grafana_port_t:tcp_socket { name_bind name_connect }; +allow grafana_t grafana_var_lib_t:file { execute execute_no_trans }; +allow grafana_t grafana_var_lib_t:file map; + allow grafana_t self:unix_stream_socket connectto; allow grafana_t self:netlink_route_socket { create bind getattr nlmsg_read }; @@ -108,13 +117,20 @@ optional_policy(` ') optional_policy(` - require { - type usr_t; - class file { execute execute_no_trans }; - } - allow grafana_t usr_t:file { execute execute_no_trans }; + require { + type ntop_port_t; + class tcp_socket { name_bind }; + } + allow grafana_t ntop_port_t:tcp_socket name_bind; ') +optional_policy(` + require { + type usr_t; + class file { execute execute_no_trans }; + } + allow grafana_t usr_t:file { execute execute_no_trans }; +') optional_policy(` require { @@ -127,6 +143,22 @@ optional_policy(` allow grafana_t postgresql_var_run_t:sock_file write; ') +optional_policy(` + require { + type autofs_t; + class dir { getattr }; + } + allow grafana_t autofs_t:dir getattr; +') + +optional_policy(` + require { + type postfix_local_t; + class dir { search }; + } + allow postfix_local_t grafana_var_lib_t:dir search; +') + manage_dirs_pattern(grafana_t, grafana_conf_t, grafana_conf_t) manage_files_pattern(grafana_t, grafana_conf_t, grafana_conf_t) @@ -190,14 +222,18 @@ tunable_policy(`grafana_can_tcp_connect_mysql_port',` # Mysql default tcp port 3 corenet_tcp_connect_mysqld_port(grafana_t) ') -tunable_policy(`grafana_can_tcp_connect_postgresql_port',` # Postgresql default tcp port 5432 - corenet_tcp_connect_postgresql_port(grafana_t) -') - tunable_policy(`grafana_can_tcp_connect_prometheus_port',` # Prometheus default tcp port 9090 corenet_tcp_connect_websm_port(grafana_t) ') +tunable_policy(`grafana_can_tcp_connect_postgresql_port',` # Postgresql default tcp port 5432 + corenet_tcp_connect_postgresql_port(grafana_t) +') + +tunable_policy(`grafana_can_tcp_connect_ldap_port',` + corenet_tcp_connect_ldap_port(grafana_t) +') + optional_policy(` systemd_private_tmp(grafana_tmp_t) -') +') \ No newline at end of file From 5d2ccd6839a7a8b76535717a98235e1d8a2df7b0 Mon Sep 17 00:00:00 2001 From: Sam Feifer Date: Tue, 13 May 2025 10:31:56 -0400 Subject: [PATCH 10/22] Fix CVE-2025-4123 --- 0013-fix-CVE-2025-4123.patch | 32 ++++++++++++++++++++++++++++++++ grafana.spec | 7 ++++++- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 0013-fix-CVE-2025-4123.patch diff --git a/0013-fix-CVE-2025-4123.patch b/0013-fix-CVE-2025-4123.patch new file mode 100644 index 0000000..5204e37 --- /dev/null +++ b/0013-fix-CVE-2025-4123.patch @@ -0,0 +1,32 @@ +From 2d4314b5ca1e527a3420fad11d3f1a25351700d4 Mon Sep 17 00:00:00 2001 +From: Sam Feifer +Date: Wed, 7 May 2025 16:27:08 -0400 +Subject: [PATCH] fix CVE-2025-4123 + + +diff --git a/conf/defaults.ini b/conf/defaults.ini +index e1e5468bfa3..4221144bf54 100644 +--- a/conf/defaults.ini ++++ b/conf/defaults.ini +@@ -363,7 +363,7 @@ x_xss_protection = true + + # Enable adding the Content-Security-Policy header to your requests. + # CSP allows to control resources the user agent is allowed to load and helps prevent XSS attacks. +-content_security_policy = false ++content_security_policy = true + + # Set Content Security Policy template used when adding the Content-Security-Policy header to your requests. + # $NONCE in the template includes a random nonce. +diff --git a/conf/sample.ini b/conf/sample.ini +index 51d2b6c512b..fd588b48225 100644 +--- a/conf/sample.ini ++++ b/conf/sample.ini +@@ -364,7 +364,7 @@ + + # Enable adding the Content-Security-Policy header to your requests. + # CSP allows to control resources the user agent is allowed to load and helps prevent XSS attacks. +-;content_security_policy = false ++;content_security_policy = true + + # Set Content Security Policy template used when adding the Content-Security-Policy header to your requests. + # $NONCE in the template includes a random nonce. diff --git a/grafana.spec b/grafana.spec index f17d330..ed952d7 100644 --- a/grafana.spec +++ b/grafana.spec @@ -25,7 +25,7 @@ end} Name: grafana Version: 10.2.6 -Release: 13%{?dist} +Release: 14%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -79,6 +79,7 @@ Patch9: 0009-update-wrappers-and-systemd-with-distro-paths.patch Patch10: 0010-remove-bcrypt-references.patch Patch11: 0011-fix-dompurify-CVE.patch Patch12: 0012-fix-jwt-CVE.patch +Patch13: 0013-fix-CVE-2025-4123.patch # Patches affecting the vendor tarball Patch1001: 1001-vendor-patch-removed-backend-crypto.patch @@ -777,6 +778,7 @@ rm -r plugins-bundled %patch -P 10 -p1 %patch -P 11 -p1 %patch -P 12 -p1 +%patch -P 13 -p1 %patch -P 1001 -p1 %if %{enable_fips_mode} @@ -1027,6 +1029,9 @@ done %ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana %changelog +* Tue May 13 2025 Sam Feifer - 10.2.6-14 +- fix CVE-2025-4123 + * Fri May 2 2025 Sam Feifer - 10.2.6-13 - Added selinux rules for ldap and other observed selinux denials - Reworked the spec file selinux sections From 848bb46373e30dd1cb2f607657ab3664a6553a16 Mon Sep 17 00:00:00 2001 From: Sam Feifer Date: Wed, 16 Jul 2025 11:56:15 -0400 Subject: [PATCH 11/22] backport changes to selinux policy --- grafana.fc | 6 +----- grafana.te | 12 ++++++++++-- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/grafana.fc b/grafana.fc index 0000c0b..a84f8b4 100644 --- a/grafana.fc +++ b/grafana.fc @@ -7,10 +7,6 @@ /usr/sbin/grafana-server -- gen_context(system_u:object_r:grafana_exec_t,s0) /usr/sbin/grafana -- gen_context(system_u:object_r:grafana_exec_t,s0) -/usr/bin/grafana-cli -- gen_context(system_u:object_r:grafana_exec_t,s0) -/usr/bin/grafana-server -- gen_context(system_u:object_r:grafana_exec_t,s0) -/usr/bin/grafana -- gen_context(system_u:object_r:grafana_exec_t,s0) - /var/lib/grafana(/.*)? gen_context(system_u:object_r:grafana_var_lib_t,s0) #/var/lib/grafana/grafana.db -- gen_context(system_u:object_r:grafana_db_t,s0) @@ -27,4 +23,4 @@ #define context for pcp plugin #/usr/share/performancecopilot-pcp-app/datasources/redis/pcp_redis_datasource_(.*) -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0) /usr/libexec/grafana-pcp/datasources/redis/pcp_redis_datasource_(.*) -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0) -/usr/libexec/grafana-pcp/datasources/valkey/pcp_valkey_datasource_(.*) -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0) +/usr/libexec/grafana-pcp/datasources/valkey/pcp_valkey_datasource_(.*) -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0) \ No newline at end of file diff --git a/grafana.te b/grafana.te index 4f1150c..41f0cb3 100644 --- a/grafana.te +++ b/grafana.te @@ -143,10 +143,18 @@ optional_policy(` allow grafana_t postgresql_var_run_t:sock_file write; ') +optional_policy(` + require { + type proc_net_t; + class lnk_file { read }; + } + allow grafana_t proc_net_t:lnk_file read; +') + optional_policy(` require { type autofs_t; - class dir { getattr }; + class dir {getattr}; } allow grafana_t autofs_t:dir getattr; ') @@ -236,4 +244,4 @@ tunable_policy(`grafana_can_tcp_connect_ldap_port',` optional_policy(` systemd_private_tmp(grafana_tmp_t) -') \ No newline at end of file +') From 92a8f286a484db3855bae26f86110336673e2734 Mon Sep 17 00:00:00 2001 From: Sam Feifer Date: Wed, 16 Jul 2025 12:02:15 -0400 Subject: [PATCH 12/22] backport selinux packaging changes --- grafana.spec | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/grafana.spec b/grafana.spec index ed952d7..debe729 100644 --- a/grafana.spec +++ b/grafana.spec @@ -25,7 +25,7 @@ end} Name: grafana Version: 10.2.6 -Release: 14%{?dist} +Release: 15%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -123,7 +123,7 @@ Requires: shared-mime-info %if 0%{?fedora} >= 35 || 0%{?rhel} >= 8 # This ensures that the grafana-selinux package and all its dependencies are # not pulled into containers and other systems that do not use SELinux -Requires: (grafana-selinux = %{version}-%{release} if selinux-policy-targeted) +Requires: (grafana-selinux = %{version}-%{release} if selinux-policy-any) %else Requires: grafana-selinux = %{version}-%{release} %endif @@ -746,10 +746,8 @@ Graphite, InfluxDB & OpenTSDB. # SELinux package %package selinux Summary: SELinux policy module supporting grafana -BuildArch: noarch -Requires: %{name} = %{version}-%{release} -Requires: selinux-policy-targeted -Requires(post): selinux-policy-targeted, /usr/sbin/semanage +Requires: selinux-policy-any +Requires(post): selinux-policy-any, /usr/sbin/semanage Requires(postun): /usr/sbin/semanage BuildRequires: selinux-policy-devel @@ -992,10 +990,7 @@ export GOEXPERIMENT=boringcrypto # SELinux policy %pre selinux -for selinuxvariant in %{selinux_variants} -do - %selinux_relabel_pre -s ${selinuxvariant} -done +%selinux_relabel_pre %post selinux for selinuxvariant in %{selinux_variants} @@ -1003,8 +998,8 @@ do %selinux_modules_install -s ${selinuxvariant} %{_datadir}/selinux/packages/${selinuxvariant}/grafana.pp.bz2 &>/dev/null /usr/sbin/semanage port -a -t grafana_port_t -p tcp 3000 &> /dev/null || : semodule -X400 -r grafana &>/dev/null || true - %selinux_relabel_post -s ${selinuxvariant} done +%selinux_relabel_post if [ "$1" -le "1" ]; then # First install # The daemon needs to be restarted for the custom label to be applied. @@ -1029,6 +1024,11 @@ done %ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana %changelog +* Wed Jul 16 2025 Sam Feifer - 10.2.6-15 +- Backport selinux policy changes +- Backport selinux packaging changes in the spec file + + * Tue May 13 2025 Sam Feifer - 10.2.6-14 - fix CVE-2025-4123 From ee9685a734e400fe1c0bec4a3545a737702029bf Mon Sep 17 00:00:00 2001 From: Sam Feifer Date: Thu, 17 Jul 2025 12:28:36 -0400 Subject: [PATCH 13/22] revert removal of noarch grafana-selinux --- grafana.spec | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/grafana.spec b/grafana.spec index debe729..998745b 100644 --- a/grafana.spec +++ b/grafana.spec @@ -25,7 +25,7 @@ end} Name: grafana Version: 10.2.6 -Release: 15%{?dist} +Release: 16%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -746,6 +746,7 @@ Graphite, InfluxDB & OpenTSDB. # SELinux package %package selinux Summary: SELinux policy module supporting grafana +BuildArch: noarch Requires: selinux-policy-any Requires(post): selinux-policy-any, /usr/sbin/semanage Requires(postun): /usr/sbin/semanage @@ -1024,7 +1025,7 @@ done %ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana %changelog -* Wed Jul 16 2025 Sam Feifer - 10.2.6-15 +* Wed Jul 16 2025 Sam Feifer - 10.2.6-16 - Backport selinux policy changes - Backport selinux packaging changes in the spec file From 2d4bd8e98d18461c18a0054e8e57da0563c3f4e4 Mon Sep 17 00:00:00 2001 From: Sam Feifer Date: Thu, 17 Jul 2025 16:16:04 -0400 Subject: [PATCH 14/22] change sbin to bin in grafana-selinux --- grafana.fc | 6 +++--- grafana.spec | 5 ++--- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/grafana.fc b/grafana.fc index a84f8b4..d66da55 100644 --- a/grafana.fc +++ b/grafana.fc @@ -3,9 +3,9 @@ /etc/grafana(/.*)? gen_context(system_u:object_r:grafana_conf_t,s0) -/usr/sbin/grafana-cli -- gen_context(system_u:object_r:grafana_exec_t,s0) -/usr/sbin/grafana-server -- gen_context(system_u:object_r:grafana_exec_t,s0) -/usr/sbin/grafana -- gen_context(system_u:object_r:grafana_exec_t,s0) +/usr/bin/grafana-cli -- gen_context(system_u:object_r:grafana_exec_t,s0) +/usr/bin/grafana-server -- gen_context(system_u:object_r:grafana_exec_t,s0) +/usr/bin/grafana -- gen_context(system_u:object_r:grafana_exec_t,s0) /var/lib/grafana(/.*)? gen_context(system_u:object_r:grafana_var_lib_t,s0) #/var/lib/grafana/grafana.db -- gen_context(system_u:object_r:grafana_db_t,s0) diff --git a/grafana.spec b/grafana.spec index 998745b..e3cc772 100644 --- a/grafana.spec +++ b/grafana.spec @@ -25,7 +25,7 @@ end} Name: grafana Version: 10.2.6 -Release: 16%{?dist} +Release: 17%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -1025,11 +1025,10 @@ done %ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana %changelog -* Wed Jul 16 2025 Sam Feifer - 10.2.6-16 +* Wed Jul 16 2025 Sam Feifer - 10.2.6-17 - Backport selinux policy changes - Backport selinux packaging changes in the spec file - * Tue May 13 2025 Sam Feifer - 10.2.6-14 - fix CVE-2025-4123 From 872b376f01f83633ed0b59c21e454c3dba360038 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 16:34:03 +0000 Subject: [PATCH 15/22] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- grafana.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/grafana.spec b/grafana.spec index e3cc772..e28d5f6 100644 --- a/grafana.spec +++ b/grafana.spec @@ -25,7 +25,7 @@ end} Name: grafana Version: 10.2.6 -Release: 17%{?dist} +Release: 18%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -1025,6 +1025,9 @@ done %ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 10.2.6-18 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Wed Jul 16 2025 Sam Feifer - 10.2.6-17 - Backport selinux policy changes - Backport selinux packaging changes in the spec file From 23e030d974cce9c7b87272012abef7bc86e52dd6 Mon Sep 17 00:00:00 2001 From: Maxwell G Date: Fri, 15 Aug 2025 17:54:06 -0500 Subject: [PATCH 16/22] Rebuild for golang-1.25.0 --- grafana.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/grafana.spec b/grafana.spec index e28d5f6..1ba8ff3 100644 --- a/grafana.spec +++ b/grafana.spec @@ -25,7 +25,7 @@ end} Name: grafana Version: 10.2.6 -Release: 18%{?dist} +Release: 19%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -1025,6 +1025,9 @@ done %ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana %changelog +* Fri Aug 15 2025 Maxwell G - 10.2.6-19 +- Rebuild for golang-1.25.0 + * Thu Jul 24 2025 Fedora Release Engineering - 10.2.6-18 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From 28c9808c05b568ac9262a7dbf00f2cc194923448 Mon Sep 17 00:00:00 2001 From: Jan Kurik Date: Thu, 25 Sep 2025 07:29:59 +0200 Subject: [PATCH 17/22] Reworked gating to use CentOS test repository --- ci.fmf | 7 ++++++- gating.yaml | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/ci.fmf b/ci.fmf index 24f8837..b2f9ff9 100644 --- a/ci.fmf +++ b/ci.fmf @@ -1,2 +1,7 @@ ---- resultsdb-testcase: separate + +/gating: + plan: + import: + name: /plans/gating + url: https://gitlab.com/redhat/centos-stream/tests/grafana.git diff --git a/gating.yaml b/gating.yaml index 116ac6c..8a24c10 100644 --- a/gating.yaml +++ b/gating.yaml @@ -4,4 +4,4 @@ product_versions: decision_context: bodhi_update_push_stable subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/gating.functional} + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./ci/gating.functional} From a1291fb28eb4b74dd165242cb4d98de3c0bf4daa Mon Sep 17 00:00:00 2001 From: Jan Kurik Date: Thu, 25 Sep 2025 08:40:57 +0200 Subject: [PATCH 18/22] Reworked gating to use CentOS test repository --- plans/gating.fmf | 7 ------- 1 file changed, 7 deletions(-) delete mode 100644 plans/gating.fmf diff --git a/plans/gating.fmf b/plans/gating.fmf deleted file mode 100644 index 5b0d2a0..0000000 --- a/plans/gating.fmf +++ /dev/null @@ -1,7 +0,0 @@ -summary: CI Gating Plan -discover: - how: fmf - filter: tag:gating - url: https://src.fedoraproject.org/tests/grafana -execute: - how: tmt From a806424a305577f75f68e73f8a8ee10687bacb69 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alejandro=20S=C3=A1ez?= Date: Fri, 10 Oct 2025 14:37:22 +0200 Subject: [PATCH 19/22] rebuild --- grafana.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/grafana.spec b/grafana.spec index 1ba8ff3..1da9773 100644 --- a/grafana.spec +++ b/grafana.spec @@ -25,7 +25,7 @@ end} Name: grafana Version: 10.2.6 -Release: 19%{?dist} +Release: 20%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -1025,6 +1025,9 @@ done %ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana %changelog +* Fri Oct 10 2025 Alejandro Sáez - 10.2.6-20 +- rebuild + * Fri Aug 15 2025 Maxwell G - 10.2.6-19 - Rebuild for golang-1.25.0 From 46b52069d0e987bc73a8d1e2e259d61b859144c7 Mon Sep 17 00:00:00 2001 From: Jan Kurik Date: Wed, 15 Oct 2025 10:17:59 +0200 Subject: [PATCH 20/22] Use default gating config --- ci.fmf | 2 -- gating.yaml | 2 +- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/ci.fmf b/ci.fmf index b2f9ff9..1418a0c 100644 --- a/ci.fmf +++ b/ci.fmf @@ -1,5 +1,3 @@ -resultsdb-testcase: separate - /gating: plan: import: diff --git a/gating.yaml b/gating.yaml index 8a24c10..282e16b 100644 --- a/gating.yaml +++ b/gating.yaml @@ -4,4 +4,4 @@ product_versions: decision_context: bodhi_update_push_stable subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./ci/gating.functional} + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} From 7b0c1da45432d52100a34ac9a18d6cd1edb0ad40 Mon Sep 17 00:00:00 2001 From: Sam Feifer Date: Tue, 2 Dec 2025 15:16:24 -0500 Subject: [PATCH 21/22] Fix grafana-selinux cgroups denials --- grafana.spec | 5 ++++- grafana.te | 10 ++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/grafana.spec b/grafana.spec index 1da9773..0e60c23 100644 --- a/grafana.spec +++ b/grafana.spec @@ -25,7 +25,7 @@ end} Name: grafana Version: 10.2.6 -Release: 20%{?dist} +Release: 21%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -1025,6 +1025,9 @@ done %ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana %changelog +* Tue Dec 2 2025 Sam Feifer - 10.2.6-21 +- Fix grafana-selinux cgroups denials + * Fri Oct 10 2025 Alejandro Sáez - 10.2.6-20 - rebuild diff --git a/grafana.te b/grafana.te index 41f0cb3..a536e21 100644 --- a/grafana.te +++ b/grafana.te @@ -108,6 +108,16 @@ allow grafana_t self:unix_stream_socket connectto; allow grafana_t self:netlink_route_socket { create bind getattr nlmsg_read }; +optional_policy(` + require { + type cgroup_t; + class dir { search }; + class file { open read }; + } + allow grafana_t cgroup_t:dir search; + allow grafana_t cgroup_t:file { open read }; +') + optional_policy(` require { type smtp_port_t; From 3a728b088c254ca9b9b0093466fe1ab53fd88fa0 Mon Sep 17 00:00:00 2001 From: Sam Feifer Date: Wed, 3 Dec 2025 10:13:04 -0500 Subject: [PATCH 22/22] Fix recursive macro definition error in rpminspect --- grafana.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/grafana.spec b/grafana.spec index 0e60c23..c2867b0 100644 --- a/grafana.spec +++ b/grafana.spec @@ -19,13 +19,14 @@ end} %global gomodulesmode GO111MODULE=auto -%global gotestflags %{gotestflags} -tags=integration +%global _gotestflags_save %{?gotestflags} +%global gotestflags %{?_gotestflags_save} -tags=integration %global selinux_variants mls targeted Name: grafana Version: 10.2.6 -Release: 21%{?dist} +Release: 22%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -1025,6 +1026,9 @@ done %ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana %changelog +* Wed Dec 3 2025 Sam Feifer - 10.2.6-22 +- Fix recursive macro definition causing rpminspect failure + * Tue Dec 2 2025 Sam Feifer - 10.2.6-21 - Fix grafana-selinux cgroups denials