From 3e3e9b64f7a0d811c44ece816bbfff5cf14404e2 Mon Sep 17 00:00:00 2001 From: Sam Feifer Date: Tue, 17 Jun 2025 13:37:44 -0400 Subject: [PATCH] Resolves: RHEL-97518 --- grafana.spec | 93 ++++++++++++++++++++++++---------------------------- grafana.te | 32 ++++++++++++++---- 2 files changed, 67 insertions(+), 58 deletions(-) diff --git a/grafana.spec b/grafana.spec index 31472f9..e8941df 100644 --- a/grafana.spec +++ b/grafana.spec @@ -25,7 +25,7 @@ end} Name: grafana Version: 10.2.6 -Release: 13%{?dist} +Release: 14%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -121,7 +121,7 @@ Requires: shared-mime-info %if 0%{?fedora} >= 35 || 0%{?rhel} >= 8 # This ensures that the grafana-selinux package and all its dependencies are # not pulled into containers and other systems that do not use SELinux -Requires: (grafana-selinux = %{version}-%{release} if selinux-policy-targeted) +Requires: (grafana-selinux = %{version}-%{release} if selinux-policy-any) %else Requires: grafana-selinux = %{version}-%{release} %endif @@ -743,15 +743,11 @@ Graphite, InfluxDB & OpenTSDB. # SELinux package %package selinux -Summary: SELinux policy module supporting grafana -BuildRequires: checkpolicy, selinux-policy-devel, selinux-policy-targeted -%if "%{_selinux_policy_version}" != "" -Requires: selinux-policy >= %{_selinux_policy_version} -%endif -Requires: %{name} = %{version}-%{release} -Requires: selinux-policy-targeted -Requires(post): /usr/sbin/semodule, /usr/sbin/semanage, /sbin/restorecon, /sbin/fixfiles, grafana -Requires(postun): /usr/sbin/semodule, /usr/sbin/semanage, /sbin/restorecon, /sbin/fixfiles, /sbin/service, grafana +Summary: SELinux policy module supporting grafana +Requires: selinux-policy-any +Requires(post): selinux-policy-any, /usr/sbin/semanage +Requires(postun): /usr/sbin/semanage +BuildRequires: selinux-policy-devel %description selinux SELinux policy module supporting grafana @@ -766,10 +762,6 @@ rm -r plugins-bundled %setup -q -T -D -b 2 %endif -# SELinux policy -mkdir SELinux -cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} SELinux - %patch -P 1 -p1 %patch -P 2 -p1 %patch -P 3 -p1 @@ -813,15 +805,11 @@ for cmd in grafana grafana-cli grafana-server; do done # SELinux policy -cd SELinux -for selinuxvariant in %{selinux_variants} -do - make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile - mv grafana.pp grafana.pp.${selinuxvariant} - make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile clean -done -cd - +mkdir selinux +cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} selinux +make -f %{_datadir}/selinux/devel/Makefile grafana.pp +bzip2 -9 grafana.pp %install # dirs, shared files, public html, webpack @@ -886,14 +874,12 @@ echo "d %{_rundir}/%{name} 0755 %{GRAFANA_USER} %{GRAFANA_GROUP} -" \ install -p -m 644 -D %{SOURCE3} %{buildroot}%{_sysusersdir}/%{name}.conf # SELinux policy -cd SELinux for selinuxvariant in %{selinux_variants} do - install -d %{buildroot}%{_datadir}/selinux/${selinuxvariant} - install -p -m 644 grafana.pp.${selinuxvariant} \ - %{buildroot}%{_datadir}/selinux/${selinuxvariant}/grafana.pp + install -D -m 0644 grafana.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/${selinuxvariant}/grafana.pp.bz2 + install -D -p -m 0644 selinux/grafana.if \ + %{buildroot}%{_datadir}/selinux/devel/include/distributed/grafana.if done -cd - %pre %sysusers_create_compat %{SOURCE3} @@ -999,39 +985,44 @@ export TZ=GMT %doc README.md ROADMAP.md SECURITY.md SUPPORT.md UPGRADING_DEPENDENCIES.md WORKFLOW.md # SELinux policy +%pre selinux +%selinux_relabel_pre + %post selinux for selinuxvariant in %{selinux_variants} do - /usr/sbin/semodule -s ${selinuxvariant} -i \ - %{_datadir}/selinux/${selinuxvariant}/grafana.pp &> /dev/null || : + %selinux_modules_install -s ${selinuxvariant} %{_datadir}/selinux/packages/${selinuxvariant}/grafana.pp.bz2 &>/dev/null + /usr/sbin/semanage port -a -t grafana_port_t -p tcp 3000 &> /dev/null || : + semodule -X400 -r grafana &>/dev/null || true done -/sbin/restorecon -RvF /usr/sbin/grafana* &> /dev/null || : -/sbin/restorecon -RvF /etc/grafana &> /dev/null || : -/sbin/restorecon -RvF /var/log/grafana &> /dev/null || : -/sbin/restorecon -RvF /var/lib/grafana &> /dev/null || : -/sbin/restorecon -RvF /usr/libexec/grafana-pcp &> /dev/null || : -/usr/sbin/semanage port -a -t grafana_port_t -p tcp 3000 &> /dev/null || : +%selinux_relabel_post -%postun selinux -if [ $1 -eq 0 ] ; then -/usr/sbin/semanage port -d -p tcp 3000 &> /dev/null || : - for selinuxvariant in %{selinux_variants} - do - /usr/sbin/semodule -s ${selinuxvariant} -r grafana &> /dev/null || : - done - /sbin/restorecon -RvF /usr/sbin/grafana* &> /dev/null || : - /sbin/restorecon -RvF /etc/grafana &> /dev/null || : - /sbin/restorecon -RvF /var/log/grafana &> /dev/null || : - /sbin/restorecon -RvF /var/lib/grafana &> /dev/null || : - /sbin/restorecon -RvF /usr/libexec/grafana-pcp &> /dev/null || : +if [ "$1" -le "1" ]; then # First install + # The daemon needs to be restarted for the custom label to be applied. + # This will fail in case "post selinux" is executed before the service file is installed, + # but then it is safe to ignore since the service will first start with the proper label + %systemd_postun_with_restart grafana.service &> /dev/null || : fi +%postun selinux +for selinuxvariant in %{selinux_variants} +do + if [ $1 -eq 0 ]; then + /usr/sbin/semanage port -d -p tcp 3000 &> /dev/null || : + %selinux_modules_uninstall -s ${selinuxvariant} grafana + %selinux_relabel_post -s ${selinuxvariant} + fi +done + %files selinux -%defattr(-,root,root,0755) -%doc SELinux/* -%{_datadir}/selinux/*/grafana.pp +%{_datadir}/selinux/packages/*/grafana.pp.* +%{_datadir}/selinux/devel/include/distributed/grafana.if +%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana %changelog +* Tue Jun 17 2025 Sam Feifer 10.2.6-14 +- Resolves RHEL-97518: Rework grafana-selinux spec file sections + * Tue May 13 2025 Sam Feifer 10.2.6-13 - Resolves RHEL-89953: CVE-2025-4123 diff --git a/grafana.te b/grafana.te index 910fd54..1b301c4 100644 --- a/grafana.te +++ b/grafana.te @@ -27,13 +27,6 @@ gen_tunable(grafana_can_tcp_connect_elasticsearch_port, false) ## gen_tunable(grafana_can_tcp_connect_mysql_port, false) -## -##

-## Allow grafana to connect to postgresql's default tcp port of 5432 -##

-## -gen_tunable(grafana_can_tcp_connect_postgresql_port, false) - ## ##

## Allow grafana to connect to prometheus' default tcp port of 9090 @@ -41,6 +34,12 @@ gen_tunable(grafana_can_tcp_connect_postgresql_port, false) ## gen_tunable(grafana_can_tcp_connect_prometheus_port, false) +## +##

+## Allow grafana to connect to postgresql's default tcp port of 5432 +##

+## +gen_tunable(grafana_can_tcp_connect_postgresql_port, false) type grafana_t; type grafana_exec_t; @@ -95,6 +94,9 @@ allow grafana_t self:unix_dgram_socket create_socket_perms; allow grafana_t grafana_port_t:tcp_socket { name_bind name_connect }; +allow grafana_t grafana_var_lib_t:file { execute execute_no_trans }; +allow grafana_t grafana_var_lib_t:file map; + allow grafana_t self:unix_stream_socket connectto; allow grafana_t self:netlink_route_socket { create bind getattr nlmsg_read }; @@ -107,6 +109,14 @@ optional_policy(` allow grafana_t smtp_port_t:tcp_socket name_connect; ') +optional_policy(` + require { + type ntop_port_t; + class tcp_socket { name_bind }; + } + allow grafana_t ntop_port_t:tcp_socket name_bind; +') + optional_policy(` require { type usr_t; @@ -142,6 +152,14 @@ optional_policy(` allow grafana_t autofs_t:dir getattr; ') +optional_policy(` + require { + type postfix_local_t; + class dir { search }; + } + allow postfix_local_t grafana_var_lib_t:dir search; +') + manage_dirs_pattern(grafana_t, grafana_conf_t, grafana_conf_t) manage_files_pattern(grafana_t, grafana_conf_t, grafana_conf_t)