From 3473016880a1852b0b030ff506ff851d744bfea1 Mon Sep 17 00:00:00 2001
From: Sam Feifer <sfeifer@redhat.com>
Date: Tue, 2 Dec 2025 16:38:55 -0500
Subject: [PATCH] Resolves: RHEL-132759

---
 grafana.spec |  1 +
 grafana.te   | 10 ++++++++++
 2 files changed, 11 insertions(+)

diff --git a/grafana.spec b/grafana.spec
index 0dfb3cf..838208b 100644
--- a/grafana.spec
+++ b/grafana.spec
@@ -1026,6 +1026,7 @@ fi
 %changelog
 * Mon Dec 1 2025 Sam Feifer <sfeifer@redhat.com> 9.2.10-26
 - Resolves RHEL-125664: CVE-2025-58183
+- Resolves RHEL-132759: Grafana-selinux prevents plugins from searching cgroups
 
 * Wed Jun 4 2025 Sam Feifer <sfeifer@redhat.com> 9.2.10-25
 - Resolves RHEL-89269: CVE-2025-22871
diff --git a/grafana.te b/grafana.te
index 8e1b117..5e79cab 100644
--- a/grafana.te
+++ b/grafana.te
@@ -99,6 +99,16 @@ allow grafana_t self:unix_stream_socket connectto;
 
 allow grafana_t self:netlink_route_socket { create bind getattr nlmsg_read };
 
+optional_policy(`
+	require {
+		type cgroup_t;
+		class dir { search };
+		class file { open read };
+	}
+	allow grafana_t cgroup_t:dir search;
+	allow grafana_t cgroup_t:file { open read };
+')
+
 optional_policy(`
 	require {
 		type smtp_port_t;