diff --git a/grafana.spec b/grafana.spec index 0dfb3cf..838208b 100644 --- a/grafana.spec +++ b/grafana.spec @@ -1026,6 +1026,7 @@ fi %changelog * Mon Dec 1 2025 Sam Feifer 9.2.10-26 - Resolves RHEL-125664: CVE-2025-58183 +- Resolves RHEL-132759: Grafana-selinux prevents plugins from searching cgroups * Wed Jun 4 2025 Sam Feifer 9.2.10-25 - Resolves RHEL-89269: CVE-2025-22871 diff --git a/grafana.te b/grafana.te index 8e1b117..5e79cab 100644 --- a/grafana.te +++ b/grafana.te @@ -99,6 +99,16 @@ allow grafana_t self:unix_stream_socket connectto; allow grafana_t self:netlink_route_socket { create bind getattr nlmsg_read }; +optional_policy(` + require { + type cgroup_t; + class dir { search }; + class file { open read }; + } + allow grafana_t cgroup_t:dir search; + allow grafana_t cgroup_t:file { open read }; +') + optional_policy(` require { type smtp_port_t;