Fix recursive macro definition error in rpminspect

0003-update-default-configuration.patch

@@ -66,7 +66,7 @@ index 916de769f9..2f270d4940 100644
  ;app_tls_skip_verify_insecure = false
  # Enter a comma-separated list of plugin identifiers to identify plugins to load even if they are unsigned. Plugins with modified signatures are never loaded.
 -;allow_loading_unsigned_plugins =
-+allow_loading_unsigned_plugins = performancecopilot-pcp-app,pcp-redis-datasource,pcp-vector-datasource,pcp-bpftrace-datasource,pcp-flamegraph-panel,pcp-breadcrumbs-panel,pcp-troubleshooting-panel,performancecopilot-redis-datasource,performancecopilot-vector-datasource,performancecopilot-bpftrace-datasource,performancecopilot-flamegraph-panel,performancecopilot-breadcrumbs-panel,performancecopilot-troubleshooting-panel
++allow_loading_unsigned_plugins = performancecopilot-pcp-app,pcp-valkey-datasource,pcp-vector-datasource,pcp-bpftrace-datasource,pcp-flamegraph-panel,pcp-breadcrumbs-panel,pcp-troubleshooting-panel,performancecopilot-valkey-datasource,performancecopilot-vector-datasource,performancecopilot-bpftrace-datasource,performancecopilot-flamegraph-panel,performancecopilot-breadcrumbs-panel,performancecopilot-troubleshooting-panel
  # Enable or disable installing / uninstalling / updating plugins directly from within Grafana.
  ;plugin_admin_enabled = false
  ;plugin_admin_external_manage_enabled = false

0011-fix-dompurify-CVE.patch

@@ -0,0 +1,58 @@
+From: Sam Feifer <sfeifer@redhat.com>
+Subject: [PATCH] fix dompurify CVE
+
+diff --git a/package.json b/package.json
+index 38deb6d7dee..010a24fb451 100644
+--- a/package.json
++++ b/package.json
+@@ -432,7 +432,8 @@
+     "react-split-pane@0.1.92": "patch:react-split-pane@npm:0.1.92#.yarn/patches/react-split-pane-npm-0.1.92-93dbf51dff.patch",
+     "@storybook/blocks@7.4.5": "patch:@storybook/blocks@npm%3A7.4.5#./.yarn/patches/@storybook-blocks-npm-7.4.5-5a2374564a.patch",
+     "history@4.10.1": "patch:history@npm%3A4.10.1#./.yarn/patches/history-npm-4.10.1-ee217563ae.patch",
+-    "history@^4.9.0": "patch:history@npm%3A4.10.1#./.yarn/patches/history-npm-4.10.1-ee217563ae.patch"
++    "history@^4.9.0": "patch:history@npm%3A4.10.1#./.yarn/patches/history-npm-4.10.1-ee217563ae.patch",
++    "dompurify": "^2.5.0"
+   },
+   "workspaces": {
+     "packages": [
+diff --git a/packages/grafana-data/package.json b/packages/grafana-data/package.json
+index 2182744e61b..4201ef58dda 100644
+--- a/packages/grafana-data/package.json
++++ b/packages/grafana-data/package.json
+@@ -41,7 +41,7 @@
+     "@types/string-hash": "1.1.1",
+     "d3-interpolate": "3.0.1",
+     "date-fns": "2.30.0",
+-    "dompurify": "^2.4.3",
++    "dompurify": "^2.5.0",
+     "eventemitter3": "5.0.1",
+     "fast_array_intersect": "1.1.0",
+     "history": "4.10.1",
+diff --git a/yarn.lock b/yarn.lock
+index bf22ba52a17..88fc4d3fbfb 100644
+--- a/yarn.lock
++++ b/yarn.lock
+@@ -2953,7 +2953,7 @@ __metadata:
+     "@types/tinycolor2": "npm:1.4.3"
+     d3-interpolate: "npm:3.0.1"
+     date-fns: "npm:2.30.0"
+-    dompurify: "npm:^2.4.3"
++    dompurify: "npm:^2.5.0"
+     esbuild: "npm:0.18.12"
+     eventemitter3: "npm:5.0.1"
+     fast_array_intersect: "npm:1.1.0"
+@@ -14478,10 +14478,10 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"dompurify@npm:^2.2.0, dompurify@npm:^2.4.3":
+-  version: 2.4.5
+-  resolution: "dompurify@npm:2.4.5"
+-  checksum: d764c2ff126b3749dad35bc34eed40f51141d7dfd620e938c92f08d68c32beeb259d06abadeee91f6e2a8c8737ce670e2124ac9a257ba3bcdc666598cebcde01
++"dompurify@npm:^2.5.0":
++  version: 2.5.7
++  resolution: "dompurify@npm:2.5.7"
++  checksum: b150ca1e28083252cd51097162dc96cb45203f7e2af1fbaa8ef32b4f4d6b605e4aa8915190d38bd0635cbbf14d13a200138cd3ec1b084096819b14c718355122
+   languageName: node
+   linkType: hard
+ 

0012-fix-jwt-CVE.patch

@@ -0,0 +1,31 @@
+From: Sam Feifer <sfeifer@redhat.com>
+Subject: [PATCH] fix jwt CVE
+
+diff --git a/go.mod b/go.mod
+index fcbc09da5e6..1771902bc1c 100644
+--- a/go.mod
++++ b/go.mod
+@@ -164,7 +164,7 @@ require (
+ 	github.com/go-openapi/spec v0.20.9 // indirect
+ 	github.com/go-openapi/swag v0.22.4 // indirect
+ 	github.com/go-openapi/validate v0.22.1 // indirect
+-	github.com/golang-jwt/jwt/v4 v4.5.0 // @grafana/backend-platform
++	github.com/golang-jwt/jwt/v4 v4.5.2 // @grafana/backend-platform
+ 	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
+ 	github.com/golang/glog v1.1.2 // indirect
+ 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+diff --git a/go.sum b/go.sum
+index d05dfb55fd4..3a045f712eb 100644
+--- a/go.sum
++++ b/go.sum
+@@ -1593,8 +1593,9 @@ github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzw
+ github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
+ github.com/golang-jwt/jwt/v4 v4.4.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+ github.com/golang-jwt/jwt/v4 v4.4.3/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+-github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
+ github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
++github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
++github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+ github.com/golang-migrate/migrate/v4 v4.7.0 h1:gONcHxHApDTKXDyLH/H97gEHmpu1zcnnbAaq2zgrPrs=
+ github.com/golang-migrate/migrate/v4 v4.7.0/go.mod h1:Qvut3N4xKWjoH3sokBccML6WyHSnggXm/DvMMnTsQIc=
+ github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=

0013-fix-CVE-2025-4123.patch

@@ -0,0 +1,32 @@
+From 2d4314b5ca1e527a3420fad11d3f1a25351700d4 Mon Sep 17 00:00:00 2001
+From: Sam Feifer <sfeifer@redhat.com>
+Date: Wed, 7 May 2025 16:27:08 -0400
+Subject: [PATCH] fix CVE-2025-4123
+
+
+diff --git a/conf/defaults.ini b/conf/defaults.ini
+index e1e5468bfa3..4221144bf54 100644
+--- a/conf/defaults.ini
++++ b/conf/defaults.ini
+@@ -363,7 +363,7 @@ x_xss_protection = true
+ 
+ # Enable adding the Content-Security-Policy header to your requests.
+ # CSP allows to control resources the user agent is allowed to load and helps prevent XSS attacks.
+-content_security_policy = false
++content_security_policy = true
+ 
+ # Set Content Security Policy template used when adding the Content-Security-Policy header to your requests.
+ # $NONCE in the template includes a random nonce.
+diff --git a/conf/sample.ini b/conf/sample.ini
+index 51d2b6c512b..fd588b48225 100644
+--- a/conf/sample.ini
++++ b/conf/sample.ini
+@@ -364,7 +364,7 @@
+ 
+ # Enable adding the Content-Security-Policy header to your requests.
+ # CSP allows to control resources the user agent is allowed to load and helps prevent XSS attacks.
+-;content_security_policy = false
++;content_security_policy = true
+ 
+ # Set Content Security Policy template used when adding the Content-Security-Policy header to your requests.
+ # $NONCE in the template includes a random nonce.

ci.fmf

@@ -1,2 +1,5 @@
----
-resultsdb-testcase: separate
+/gating:
+  plan:
+    import:
+      name: /plans/gating
+      url: https://gitlab.com/redhat/centos-stream/tests/grafana.git

create_bundles.sh

@@ -21,6 +21,7 @@ pushd "${SOURCE_DIR}"
 
 # Vendor Go dependencies
 patch -p1 --fuzz=0 < ../0004-remove-unused-backend-dependencies.patch
+patch -p1 --fuzz=0 < ../0012-fix-jwt-CVE.patch
 go mod vendor
 
 # Generate Go files
@@ -59,6 +60,7 @@ awk '$2 ~ /^v/ && $4 != "indirect" {print "Provides: bundled(golang(" $1 ")) = "
 
 # Vendor Node.js dependencies
 patch -p1 --fuzz=0 < ../0005-remove-unused-frontend-crypto.patch
+patch -p1 --fuzz=0 < ../0011-fix-dompurify-CVE.patch
 export HUSKY=0
 yarn install --frozen-lockfile
 

gating.yaml

@@ -4,4 +4,4 @@ product_versions:
 decision_context: bodhi_update_push_stable
 subject_type: koji_build
 rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/gating.functional}
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}

grafana.fc

@@ -3,9 +3,9 @@
 
 /etc/grafana(/.*)?						gen_context(system_u:object_r:grafana_conf_t,s0)
 
-/usr/sbin/grafana-cli					--	gen_context(system_u:object_r:grafana_exec_t,s0)
-/usr/sbin/grafana-server				--	gen_context(system_u:object_r:grafana_exec_t,s0)
-/usr/sbin/grafana				        --	gen_context(system_u:object_r:grafana_exec_t,s0)
+/usr/bin/grafana-cli                    --    gen_context(system_u:object_r:grafana_exec_t,s0)
+/usr/bin/grafana-server                 --    gen_context(system_u:object_r:grafana_exec_t,s0)
+/usr/bin/grafana                        --    gen_context(system_u:object_r:grafana_exec_t,s0)
 
 /var/lib/grafana(/.*)?						gen_context(system_u:object_r:grafana_var_lib_t,s0)
 #/var/lib/grafana/grafana.db				--	gen_context(system_u:object_r:grafana_db_t,s0)
@@ -22,4 +22,5 @@
 
 #define context for pcp plugin
 #/usr/share/performancecopilot-pcp-app/datasources/redis/pcp_redis_datasource_(.*)           -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0)
-/usr/libexec/grafana-pcp/datasources/redis/pcp_redis_datasource_(.*)           -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0)
+/usr/libexec/grafana-pcp/datasources/redis/pcp_redis_datasource_(.*)           -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0)
+/usr/libexec/grafana-pcp/datasources/valkey/pcp_valkey_datasource_(.*)         -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0)

grafana.spec

@@ -19,13 +19,14 @@
 end}
 
 %global gomodulesmode GO111MODULE=auto
-%global gotestflags   %{gotestflags} -tags=integration
+%global _gotestflags_save %{?gotestflags}
+%global gotestflags %{?_gotestflags_save} -tags=integration
 
 %global selinux_variants mls targeted
 
 Name:             grafana
 Version:          10.2.6
-Release:          4%{?dist}
+Release:          22%{?dist}
 Summary:          Metrics dashboard and graph editor
 License:          AGPL-3.0-only
 URL:              https://grafana.org
@@ -36,13 +37,13 @@ Source0:          https://github.com/grafana/grafana/archive/v%{version}/%{name}
 # Source1 contains the bundled Go and Node.js dependencies
 # Note: In case there were no changes to this tarball, the NVR of this tarball
 # lags behind the NVR of this package.
-Source1:          grafana-vendor-%{version}-2.tar.xz
+Source1:          grafana-vendor-%{version}-12.tar.xz
 
 %if %{compile_frontend} == 0
 # Source2 contains the precompiled frontend
 # Note: In case there were no changes to this tarball, the NVR of this tarball
 # lags behind the NVR of this package.
-Source2:          grafana-webpack-%{version}-2.tar.gz
+Source2:          grafana-webpack-%{version}-12.tar.gz
 %endif
 
 # Source3 contains the systemd-sysusers configuration
@@ -77,6 +78,9 @@ Patch8:           0008-replace-faulty-slices-sort.patch
 Patch9:           0009-update-wrappers-and-systemd-with-distro-paths.patch
 # https://github.com/grafana/grafana/commit/bae86dbeb0ad68a205454e98e76985dc393183d4
 Patch10:          0010-remove-bcrypt-references.patch
+Patch11:          0011-fix-dompurify-CVE.patch
+Patch12:          0012-fix-jwt-CVE.patch
+Patch13:          0013-fix-CVE-2025-4123.patch
 
 # Patches affecting the vendor tarball
 Patch1001:        1001-vendor-patch-removed-backend-crypto.patch
@@ -89,7 +93,7 @@ ExclusiveArch:    %{grafana_arches}
 
 BuildRequires:    systemd
 BuildRequires:    systemd-rpm-macros
-BuildRequires:    golang >= 1.17
+BuildRequires:    golang
 BuildRequires:    go-srpm-macros
 BuildRequires:    go-rpm-macros
 
@@ -107,7 +111,11 @@ BuildRequires:    openssl-devel
 
 # grafana-server service daemon uses systemd
 %{?systemd_requires}
+
+%if 0%{?fedora} >= 42
+%elif 0%{?fedora} || 0%{?rhel} >= 9
 Requires(pre):    shadow-utils
+%endif
 
 # Grafana queries the mime database (through mime.TypeByExtension, in a unit test and at runtime)
 BuildRequires:    shared-mime-info
@@ -116,7 +124,7 @@ Requires:         shared-mime-info
 %if 0%{?fedora} >= 35 || 0%{?rhel} >= 8
 # This ensures that the grafana-selinux package and all its dependencies are
 # not pulled into containers and other systems that do not use SELinux
-Requires: (grafana-selinux = %{version}-%{release} if selinux-policy-targeted)
+Requires: (grafana-selinux = %{version}-%{release} if selinux-policy-any)
 %else
 Requires: grafana-selinux = %{version}-%{release}
 %endif
@@ -246,7 +254,7 @@ Provides: bundled(golang(github.com/andybalholm/brotli)) = 1.0.4
 Provides: bundled(golang(github.com/go-kit/log)) = 0.2.1
 Provides: bundled(golang(github.com/go-openapi/loads)) = 0.21.2
 Provides: bundled(golang(github.com/go-openapi/runtime)) = 0.26.0
-Provides: bundled(golang(github.com/golang-jwt/jwt/v4)) = 4.5.0
+Provides: bundled(golang(github.com/golang-jwt/jwt/v4)) = 4.5.2
 Provides: bundled(golang(github.com/golang/protobuf)) = 1.5.3
 Provides: bundled(golang(github.com/googleapis/gax-go/v2)) = 2.12.0
 Provides: bundled(golang(github.com/gorilla/mux)) = 1.8.0
@@ -535,7 +543,7 @@ Provides: bundled(npm(date-fns)) = 2.30.0
 Provides: bundled(npm(debounce-promise)) = 3.1.2
 Provides: bundled(npm(devtools-protocol)) = 0.0.927104
 Provides: bundled(npm(diff)) = 4.0.2
-Provides: bundled(npm(dompurify)) = 2.4.5
+Provides: bundled(npm(dompurify)) = 2.5.7
 Provides: bundled(npm(emotion)) = 10.0.27
 Provides: bundled(npm(esbuild)) = 0.17.19
 Provides: bundled(npm(esbuild-loader)) = 3.0.1
@@ -738,15 +746,12 @@ Graphite, InfluxDB & OpenTSDB.
 
 # SELinux package
 %package selinux
-Summary:        SELinux policy module supporting grafana
-BuildRequires: checkpolicy, selinux-policy-devel, selinux-policy-targeted
-%if "%{_selinux_policy_version}" != ""
-Requires:       selinux-policy >= %{_selinux_policy_version}
-%endif
-Requires:       %{name} = %{version}-%{release}
-Requires:	selinux-policy-targeted
-Requires(post):   /usr/sbin/semodule, /usr/sbin/semanage, /sbin/restorecon, /sbin/fixfiles, grafana
-Requires(postun): /usr/sbin/semodule, /usr/sbin/semanage, /sbin/restorecon, /sbin/fixfiles, /sbin/service, grafana
+Summary:             SELinux policy module supporting grafana
+BuildArch:           noarch
+Requires:	           selinux-policy-any
+Requires(post):      selinux-policy-any, /usr/sbin/semanage
+Requires(postun):    /usr/sbin/semanage
+BuildRequires:       selinux-policy-devel
 
 %description selinux
 SELinux policy module supporting grafana
@@ -761,10 +766,6 @@ rm -r plugins-bundled
 %setup -q -T -D -b 2
 %endif
 
-# SELinux policy
-mkdir SELinux
-cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} SELinux
-
 %patch -P 1 -p1
 %patch -P 2 -p1
 %patch -P 3 -p1
@@ -775,6 +776,9 @@ cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} SELinux
 %patch -P 8 -p1
 %patch -P 9 -p1
 %patch -P 10 -p1
+%patch -P 11 -p1
+%patch -P 12 -p1
+%patch -P 13 -p1
 
 %patch -P 1001 -p1
 %if %{enable_fips_mode}
@@ -804,15 +808,11 @@ for cmd in grafana grafana-cli grafana-server; do
 done
 
 # SELinux policy
-cd SELinux
-for selinuxvariant in %{selinux_variants}
-do
-  make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile
-  mv grafana.pp grafana.pp.${selinuxvariant}
-  make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile clean
-done
-cd -
+mkdir selinux
+cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} selinux
 
+make -f %{_datadir}/selinux/devel/Makefile grafana.pp
+bzip2 -9 grafana.pp
 
 %install
 # dirs, shared files, public html, webpack
@@ -877,17 +877,18 @@ echo "d %{_rundir}/%{name} 0755 %{GRAFANA_USER} %{GRAFANA_GROUP} -" \
 install -p -m 644 -D %{SOURCE3} %{buildroot}%{_sysusersdir}/%{name}.conf
 
 # SELinux policy
-cd SELinux
 for selinuxvariant in %{selinux_variants}
 do
-  install -d %{buildroot}%{_datadir}/selinux/${selinuxvariant}
-  install -p -m 644 grafana.pp.${selinuxvariant} \
-    %{buildroot}%{_datadir}/selinux/${selinuxvariant}/grafana.pp
+  install -D -m 0644 grafana.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/${selinuxvariant}/grafana.pp.bz2
+  install -D -p -m 0644 selinux/grafana.if \
+    %{buildroot}%{_datadir}/selinux/devel/include/distributed/grafana.if
 done
-cd -
 
+%if 0%{?fedora} >= 42
+%elif 0%{?fedora} || 0%{?rhel} >= 9
 %pre
 %sysusers_create_compat %{SOURCE3}
+%endif
 
 %preun
 %systemd_preun grafana-server.service
@@ -990,39 +991,94 @@ export GOEXPERIMENT=boringcrypto
 %doc README.md ROADMAP.md SECURITY.md SUPPORT.md UPGRADING_DEPENDENCIES.md WORKFLOW.md
 
 # SELinux policy
+%pre selinux
+%selinux_relabel_pre
+
 %post selinux
 for selinuxvariant in %{selinux_variants}
 do
-  /usr/sbin/semodule -s ${selinuxvariant} -i \
-    %{_datadir}/selinux/${selinuxvariant}/grafana.pp &> /dev/null || :
+  %selinux_modules_install -s ${selinuxvariant} %{_datadir}/selinux/packages/${selinuxvariant}/grafana.pp.bz2 &>/dev/null
+  /usr/sbin/semanage port -a -t grafana_port_t -p tcp 3000 &> /dev/null || :
+  semodule -X400 -r grafana &>/dev/null || true
 done
-/sbin/restorecon -RvF /usr/sbin/grafana* &> /dev/null || :
-/sbin/restorecon -RvF /etc/grafana &> /dev/null || :
-/sbin/restorecon -RvF /var/log/grafana &> /dev/null || :
-/sbin/restorecon -RvF /var/lib/grafana &> /dev/null || :
-/sbin/restorecon -RvF /usr/libexec/grafana-pcp &> /dev/null || :
-/usr/sbin/semanage port -a -t grafana_port_t -p tcp 3000 &> /dev/null || :
+%selinux_relabel_post
 
-%postun selinux
-if [ $1 -eq 0 ] ; then
-/usr/sbin/semanage port -d -p tcp 3000 &> /dev/null || :
-  for selinuxvariant in %{selinux_variants}
-  do
-    /usr/sbin/semodule -s ${selinuxvariant} -r grafana &> /dev/null || :
-  done
-  /sbin/restorecon -RvF /usr/sbin/grafana* &> /dev/null || :
-  /sbin/restorecon -RvF /etc/grafana &> /dev/null || :
-  /sbin/restorecon -RvF /var/log/grafana &> /dev/null || :
-  /sbin/restorecon -RvF /var/lib/grafana &> /dev/null || :
-  /sbin/restorecon -RvF /usr/libexec/grafana-pcp &> /dev/null || :
+if [ "$1" -le "1" ]; then # First install
+   # The daemon needs to be restarted for the custom label to be applied.
+   # This will fail in case "post selinux" is executed before the service file is installed,
+   # but then it is safe to ignore since the service will first start with the proper label
+   %systemd_postun_with_restart grafana.service &> /dev/null || :
 fi
 
+%postun selinux
+for selinuxvariant in %{selinux_variants}
+do
+  if [ $1 -eq 0 ]; then
+    /usr/sbin/semanage port -d -p tcp 3000 &> /dev/null || :
+    %selinux_modules_uninstall -s ${selinuxvariant} grafana
+    %selinux_relabel_post -s ${selinuxvariant}
+  fi
+done
+
 %files selinux
-%defattr(-,root,root,0755)
-%doc SELinux/*
-%{_datadir}/selinux/*/grafana.pp
+%{_datadir}/selinux/packages/*/grafana.pp.*
+%{_datadir}/selinux/devel/include/distributed/grafana.if
+%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana
 
 %changelog
+* Wed Dec 3 2025 Sam Feifer <sfeifer@redhat.com> - 10.2.6-22
+- Fix recursive macro definition causing rpminspect failure
+
+* Tue Dec 2 2025 Sam Feifer <sfeifer@redhat.com> - 10.2.6-21
+- Fix grafana-selinux cgroups denials
+
+* Fri Oct 10 2025 Alejandro Sáez <asm@redhat.com> - 10.2.6-20
+- rebuild
+
+* Fri Aug 15 2025 Maxwell G <maxwell@gtmx.me> - 10.2.6-19
+- Rebuild for golang-1.25.0
+
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 10.2.6-18
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Wed Jul 16 2025 Sam Feifer <sfeifer@redhat.com> - 10.2.6-17
+- Backport selinux policy changes
+- Backport selinux packaging changes in the spec file
+
+* Tue May 13 2025 Sam Feifer <sfeifer@redhat.com> - 10.2.6-14
+- fix CVE-2025-4123
+
+* Fri May 2 2025 Sam Feifer <sfeifer@redhat.com> - 10.2.6-13
+- Added selinux rules for ldap and other observed selinux denials
+- Reworked the spec file selinux sections
+- Fixed the priority of the selinux policy
+
+* Wed Mar 26 2025 Sam Feifer <sfeifer@redhat.com> - 10.2.6-12
+- fix CVE-2025-30204
+- fix CVE-2024-47875
+- move grafana home directory from /usr/share/grafana to /var/lib/grafana
+
+* Thu Feb 13 2025 Sam Feifer <sfeifer@redhat.com> - 10.2.6-11
+- Conditionally drop call to %sysusers_create_compat
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 10.2.6-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Tue Nov 26 2024 Sam Feifer <sfeifer@redhat.com> 10.2.6-9
+- Revert changes to configuration file that break older custom dashboards
+
+* Mon Nov 25 2024 Sam Feifer <sfeifer@redhat.com> 10.2.6-8
+- Clean up configuration file
+
+* Fri Nov 22 2024 Sam Feifer <sfeifer@redhat.com> 10.2.6-7
+- Update configurations to allow loading the valkey datasource
+
+* Fri Nov 8 2024 Sam Feifer <sfeifer@redhat.com> 10.2.6-6
+- Update selinux policy for the new valkey executable
+
+* Wed Jul 17 2024 Sam Feifer <sfeifer@redhat.com> 10.2.6-4
+- Resolve issue in selinux policy due to unification of bin and sbin
+
 * Wed Jul 17 2024 Sam Feifer <sfeifer@redhat.com> 10.2.6-4
 - Fixes CVE-2024-6104
 

grafana.sysusers

@@ -1,2 +1,2 @@
 #Type Name    ID GECOS                  Home directory
-u     grafana -  "Grafana user account" /usr/share/grafana
+u     grafana -  "Grafana user account" /var/lib/grafana

grafana.te

@@ -27,13 +27,6 @@ gen_tunable(grafana_can_tcp_connect_elasticsearch_port, false)
 ## </desc>
 gen_tunable(grafana_can_tcp_connect_mysql_port, false)
 
-## <desc>
-## <p>
-## Allow grafana to connect to postgresql's default tcp port of 5432
-## </p>
-## </desc>
-gen_tunable(grafana_can_tcp_connect_postgresql_port, false)
-
 ## <desc>
 ## <p>
 ## Allow grafana to connect to prometheus' default tcp port of 9090
@@ -41,6 +34,19 @@ gen_tunable(grafana_can_tcp_connect_postgresql_port, false)
 ## </desc>
 gen_tunable(grafana_can_tcp_connect_prometheus_port, false)
 
+## <desc>            
+## <p>
+## Allow grafana to connect to postgresql's default tcp port of 5432            
+## </p>            
+## </desc>            
+gen_tunable(grafana_can_tcp_connect_postgresql_port, false)
+
+## <desc>            
+## <p>
+## Allow grafana to connect to ldap's tcp port           
+## </p>            
+## </desc>  
+gen_tunable(grafana_can_tcp_connect_ldap_port, false)
 
 type grafana_t;
 type grafana_exec_t;
@@ -95,10 +101,23 @@ allow grafana_t self:unix_dgram_socket create_socket_perms;
 
 allow grafana_t grafana_port_t:tcp_socket { name_bind name_connect };
 
+allow grafana_t grafana_var_lib_t:file { execute execute_no_trans };
+allow grafana_t grafana_var_lib_t:file map;
+
 allow grafana_t self:unix_stream_socket connectto;
 
 allow grafana_t self:netlink_route_socket { create bind getattr nlmsg_read };
 
+optional_policy(`
+	require {
+		type cgroup_t;
+		class dir { search };
+		class file { open read };
+	}
+	allow grafana_t cgroup_t:dir search;
+	allow grafana_t cgroup_t:file { open read };
+')
+
 optional_policy(`
 	require {
 		type smtp_port_t;
@@ -108,13 +127,20 @@ optional_policy(`
 ')
 
 optional_policy(`
-        require {
-                type usr_t;
-                class file { execute execute_no_trans };
-        }
-        allow grafana_t usr_t:file { execute execute_no_trans };
+	require {
+		type ntop_port_t;
+		class tcp_socket { name_bind };
+	}
+	allow grafana_t ntop_port_t:tcp_socket name_bind;
 ')
 
+optional_policy(`
+	require {
+		type usr_t;
+		class file { execute execute_no_trans };
+	}
+	allow grafana_t usr_t:file { execute execute_no_trans };
+')
 
 optional_policy(`
 	require {
@@ -127,6 +153,30 @@ optional_policy(`
 	allow grafana_t postgresql_var_run_t:sock_file write;
 ')
 
+optional_policy(`
+	require {
+		type proc_net_t;
+		class lnk_file { read };
+	}
+	allow grafana_t proc_net_t:lnk_file read;
+')
+
+optional_policy(`
+	require {
+		type autofs_t;
+		class dir {getattr};
+	}
+	allow grafana_t autofs_t:dir getattr;
+')
+
+optional_policy(`
+	require {
+		type postfix_local_t;
+		class dir { search };
+	}
+	allow postfix_local_t grafana_var_lib_t:dir search;
+')
+
 manage_dirs_pattern(grafana_t, grafana_conf_t, grafana_conf_t)
 manage_files_pattern(grafana_t, grafana_conf_t, grafana_conf_t)
 
@@ -190,12 +240,16 @@ tunable_policy(`grafana_can_tcp_connect_mysql_port',` # Mysql default tcp port 3
 	corenet_tcp_connect_mysqld_port(grafana_t)
 ')
 
+tunable_policy(`grafana_can_tcp_connect_prometheus_port',` # Prometheus default tcp port 9090
+	corenet_tcp_connect_websm_port(grafana_t)
+')
+
 tunable_policy(`grafana_can_tcp_connect_postgresql_port',` # Postgresql default tcp port 5432
 	corenet_tcp_connect_postgresql_port(grafana_t)
 ')
 
-tunable_policy(`grafana_can_tcp_connect_prometheus_port',` # Prometheus default tcp port 9090
-	corenet_tcp_connect_websm_port(grafana_t)
+tunable_policy(`grafana_can_tcp_connect_ldap_port',`
+	corenet_tcp_connect_ldap_port(grafana_t)
 ')
 
 optional_policy(`

plans/gating.fmf

@@ -1,7 +0,0 @@
-summary: CI Gating Plan
-discover:
-    how: fmf
-    filter: tag:gating
-    url: https://src.fedoraproject.org/tests/grafana
-execute:
-    how: tmt

sources

@@ -1,3 +1,3 @@
-SHA512 (grafana-vendor-10.2.6-2.tar.xz) = d5146a709b1ecfb1756732897ab1921146170d89b0d85f55e3f0a443568bc285f01fda087b8a8527f8c2afdee8205dd9a6d627cff9bda055f5e527c3290aaab7
-SHA512 (grafana-webpack-10.2.6-2.tar.gz) = 25b844194da58fa4fd45b5cdb562ed4ca40ec69cbd479b567ffe745d4813925e603ecc72101ee736cff0ab49ae33eb9ae934ab6669397a074b95ef28a5c70176
+SHA512 (grafana-vendor-10.2.6-12.tar.xz) = 289235d9345db6dd8522b974d975ab1511f05b22c752c9183f3aaaf51b277f865a661fe34861a4e4eb303ace6c716a72c0bab41fa22a33b9d95af063e73727f4
+SHA512 (grafana-webpack-10.2.6-12.tar.gz) = 18add624478ce7337d560dc81589e5ce06c6d15cad9edc77f2292b747e75f597793a8ad0364961afe564e21b897090d7b5912fa16f631d9f7f80efd63e106282
 SHA512 (grafana-10.2.6.tar.gz) = 7244f4cb6572fe0403e6224f7247fbb273bbd1f359ee706a82001f0d409fb375d113f1cb24a657e845b93eb55ee98e1d7ae713e767c219f4d3b00eaf5c73d28e