From 0a301faf67f988456700838b1a2a434c8b039fee Mon Sep 17 00:00:00 2001 From: Sam Feifer Date: Mon, 18 Dec 2023 10:42:57 -0500 Subject: [PATCH] Fix postgresql AVC denials --- grafana.spec | 5 ++++- grafana.te | 11 +++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/grafana.spec b/grafana.spec index ccc617d..b0dec21 100644 --- a/grafana.spec +++ b/grafana.spec @@ -25,7 +25,7 @@ end} Name: grafana Version: 9.2.10 -Release: 13%{?dist} +Release: 14%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -1006,6 +1006,9 @@ fi %{_datadir}/selinux/*/grafana.pp %changelog +* Mon Dec 18 2023 Sam Feifer 9.2.10-14 +- Fixes postgresql AVC denials + * Fri Dec 15 2023 Sam Feifer 9.2.10-13 - Fixes coredump issue introduced by selinux - Patches out call to panic when trying to walk "/" directory diff --git a/grafana.te b/grafana.te index 1d7c206..6684a37 100644 --- a/grafana.te +++ b/grafana.te @@ -106,6 +106,17 @@ optional_policy(` ') +optional_policy(` + require { + type postgresql_t; + type postgresql_var_run_t; + class unix_stream_socket { connectto }; + class sock_file { write }; + } + allow grafana_t postgresql_t:unix_stream_socket connectto; + allow grafana_t postgresql_var_run_t:sock_file write; +') + manage_dirs_pattern(grafana_t, grafana_conf_t, grafana_conf_t) manage_files_pattern(grafana_t, grafana_conf_t, grafana_conf_t)