From 4a5e32fdd994e8bf681eecc13e90ac300616cfa8 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Mon, 30 Mar 2026 10:31:23 -0400 Subject: [PATCH] import CS grafana-10.2.6-20.el9 --- .gitignore | 4 +- .grafana.metadata | 4 +- SOURCES/0012-fix-jwt-CVE.patch | 28 ++++++ SOURCES/0013-fix-CVE-2025-4123.patch | 32 +++++++ SOURCES/0014-Fix-CVE-2026-21721.patch | 49 ++++++++++ SOURCES/create_bundles.sh | 1 + SOURCES/grafana.sysusers | 2 +- SOURCES/grafana.te | 53 +++++++++-- SPECS/grafana.spec | 131 +++++++++++++++----------- 9 files changed, 237 insertions(+), 67 deletions(-) create mode 100644 SOURCES/0012-fix-jwt-CVE.patch create mode 100644 SOURCES/0013-fix-CVE-2025-4123.patch create mode 100644 SOURCES/0014-Fix-CVE-2026-21721.patch diff --git a/.gitignore b/.gitignore index cf6336a..6aeacdf 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,3 @@ SOURCES/grafana-10.2.6.tar.gz -SOURCES/grafana-vendor-10.2.6-8.tar.xz -SOURCES/grafana-webpack-10.2.6-8.tar.gz +SOURCES/grafana-vendor-10.2.6-11.tar.xz +SOURCES/grafana-webpack-10.2.6-11.tar.gz diff --git a/.grafana.metadata b/.grafana.metadata index 159b93f..cc46226 100644 --- a/.grafana.metadata +++ b/.grafana.metadata @@ -1,3 +1,3 @@ 5c65a9460e0d0ecff29e397b5889b4167f046142 SOURCES/grafana-10.2.6.tar.gz -2b4545a05745a2d2abb719ea9bd86b87f045cf42 SOURCES/grafana-vendor-10.2.6-8.tar.xz -3d7618ff21be2346cf59955487aa766f06e7a18c SOURCES/grafana-webpack-10.2.6-8.tar.gz +80512e6390fd349f9511269026061a2342f3f613 SOURCES/grafana-vendor-10.2.6-11.tar.xz +128ba33fc426b99ef66e9230a9c68925b9822b85 SOURCES/grafana-webpack-10.2.6-11.tar.gz diff --git a/SOURCES/0012-fix-jwt-CVE.patch b/SOURCES/0012-fix-jwt-CVE.patch new file mode 100644 index 0000000..04fc58e --- /dev/null +++ b/SOURCES/0012-fix-jwt-CVE.patch @@ -0,0 +1,28 @@ +diff --git a/go.mod b/go.mod +index fcbc09da5e6..1771902bc1c 100644 +--- a/go.mod ++++ b/go.mod +@@ -164,7 +164,7 @@ require ( + github.com/go-openapi/spec v0.20.9 // indirect + github.com/go-openapi/swag v0.22.4 // indirect + github.com/go-openapi/validate v0.22.1 // indirect +- github.com/golang-jwt/jwt/v4 v4.5.0 // @grafana/backend-platform ++ github.com/golang-jwt/jwt/v4 v4.5.2 // @grafana/backend-platform + github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect + github.com/golang/glog v1.1.2 // indirect + github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect +diff --git a/go.sum b/go.sum +index d05dfb55fd4..3a045f712eb 100644 +--- a/go.sum ++++ b/go.sum +@@ -1593,8 +1593,9 @@ github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzw + github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg= + github.com/golang-jwt/jwt/v4 v4.4.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= + github.com/golang-jwt/jwt/v4 v4.4.3/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= +-github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg= + github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= ++github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI= ++github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= + github.com/golang-migrate/migrate/v4 v4.7.0 h1:gONcHxHApDTKXDyLH/H97gEHmpu1zcnnbAaq2zgrPrs= + github.com/golang-migrate/migrate/v4 v4.7.0/go.mod h1:Qvut3N4xKWjoH3sokBccML6WyHSnggXm/DvMMnTsQIc= + github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0= diff --git a/SOURCES/0013-fix-CVE-2025-4123.patch b/SOURCES/0013-fix-CVE-2025-4123.patch new file mode 100644 index 0000000..5204e37 --- /dev/null +++ b/SOURCES/0013-fix-CVE-2025-4123.patch @@ -0,0 +1,32 @@ +From 2d4314b5ca1e527a3420fad11d3f1a25351700d4 Mon Sep 17 00:00:00 2001 +From: Sam Feifer +Date: Wed, 7 May 2025 16:27:08 -0400 +Subject: [PATCH] fix CVE-2025-4123 + + +diff --git a/conf/defaults.ini b/conf/defaults.ini +index e1e5468bfa3..4221144bf54 100644 +--- a/conf/defaults.ini ++++ b/conf/defaults.ini +@@ -363,7 +363,7 @@ x_xss_protection = true + + # Enable adding the Content-Security-Policy header to your requests. + # CSP allows to control resources the user agent is allowed to load and helps prevent XSS attacks. +-content_security_policy = false ++content_security_policy = true + + # Set Content Security Policy template used when adding the Content-Security-Policy header to your requests. + # $NONCE in the template includes a random nonce. +diff --git a/conf/sample.ini b/conf/sample.ini +index 51d2b6c512b..fd588b48225 100644 +--- a/conf/sample.ini ++++ b/conf/sample.ini +@@ -364,7 +364,7 @@ + + # Enable adding the Content-Security-Policy header to your requests. + # CSP allows to control resources the user agent is allowed to load and helps prevent XSS attacks. +-;content_security_policy = false ++;content_security_policy = true + + # Set Content Security Policy template used when adding the Content-Security-Policy header to your requests. + # $NONCE in the template includes a random nonce. diff --git a/SOURCES/0014-Fix-CVE-2026-21721.patch b/SOURCES/0014-Fix-CVE-2026-21721.patch new file mode 100644 index 0000000..6e47e8b --- /dev/null +++ b/SOURCES/0014-Fix-CVE-2026-21721.patch @@ -0,0 +1,49 @@ +From 3efa5e004426fed8f25ec513f2dce4658e3b6564 Mon Sep 17 00:00:00 2001 +From: Sam Feifer +Date: Mon, 16 Feb 2026 15:35:19 -0500 +Subject: [PATCH] Fix CVE-2026-21721 + +--- + pkg/api/api.go | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/pkg/api/api.go b/pkg/api/api.go +index 3db3cbafe73..b8c1dd5736e 100644 +--- a/pkg/api/api.go ++++ b/pkg/api/api.go +@@ -461,12 +461,13 @@ func (hs *HTTPServer) registerRoutes() { + dashboardRoute.Get("/uid/:uid", authorize(ac.EvalPermission(dashboards.ActionDashboardsRead)), routing.Wrap(hs.GetDashboard)) + dashboardRoute.Delete("/uid/:uid", authorize(ac.EvalPermission(dashboards.ActionDashboardsDelete)), routing.Wrap(hs.DeleteDashboardByUID)) + dashboardRoute.Group("/uid/:uid", func(dashUidRoute routing.RouteRegister) { ++ dashUIDScope := dashboards.ScopeDashboardsProvider.GetResourceScopeUID(ac.Parameter(":uid")) + dashUidRoute.Get("/versions", authorize(ac.EvalPermission(dashboards.ActionDashboardsWrite)), routing.Wrap(hs.GetDashboardVersions)) + dashUidRoute.Post("/restore", authorize(ac.EvalPermission(dashboards.ActionDashboardsWrite)), routing.Wrap(hs.RestoreDashboardVersion)) + dashUidRoute.Get("/versions/:id", authorize(ac.EvalPermission(dashboards.ActionDashboardsWrite)), routing.Wrap(hs.GetDashboardVersion)) + dashUidRoute.Group("/permissions", func(dashboardPermissionRoute routing.RouteRegister) { +- dashboardPermissionRoute.Get("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsRead)), routing.Wrap(hs.GetDashboardPermissionList)) +- dashboardPermissionRoute.Post("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsWrite)), routing.Wrap(hs.UpdateDashboardPermissions)) ++ dashboardPermissionRoute.Get("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsRead, dashUIDScope)), routing.Wrap(hs.GetDashboardPermissionList)) ++ dashboardPermissionRoute.Post("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsWrite, dashUIDScope)), routing.Wrap(hs.UpdateDashboardPermissions)) + }) + }) + +@@ -481,13 +482,14 @@ func (hs *HTTPServer) registerRoutes() { + + // Deprecated: use /uid/:uid API instead. + dashboardRoute.Group("/id/:dashboardId", func(dashIdRoute routing.RouteRegister) { ++ dashIDScope := dashboards.ScopeDashboardsProvider.GetResourceScope(ac.Parameter(":dashboardId")) + dashIdRoute.Get("/versions", authorize(ac.EvalPermission(dashboards.ActionDashboardsWrite)), routing.Wrap(hs.GetDashboardVersions)) + dashIdRoute.Get("/versions/:id", authorize(ac.EvalPermission(dashboards.ActionDashboardsWrite)), routing.Wrap(hs.GetDashboardVersion)) + dashIdRoute.Post("/restore", authorize(ac.EvalPermission(dashboards.ActionDashboardsWrite)), routing.Wrap(hs.RestoreDashboardVersion)) + + dashIdRoute.Group("/permissions", func(dashboardPermissionRoute routing.RouteRegister) { +- dashboardPermissionRoute.Get("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsRead)), routing.Wrap(hs.GetDashboardPermissionList)) +- dashboardPermissionRoute.Post("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsWrite)), routing.Wrap(hs.UpdateDashboardPermissions)) ++ dashboardPermissionRoute.Get("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsRead, dashIDScope)), routing.Wrap(hs.GetDashboardPermissionList)) ++ dashboardPermissionRoute.Post("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsWrite, dashIDScope)), routing.Wrap(hs.UpdateDashboardPermissions)) + }) + }) + }) +-- +2.52.0 + diff --git a/SOURCES/create_bundles.sh b/SOURCES/create_bundles.sh index d3c97c1..f4105d0 100755 --- a/SOURCES/create_bundles.sh +++ b/SOURCES/create_bundles.sh @@ -21,6 +21,7 @@ pushd "${SOURCE_DIR}" # Vendor Go dependencies patch -p1 --fuzz=0 < ../0004-remove-unused-backend-dependencies.patch +patch -p1 --fuzz=0 < ../0012-fix-jwt-CVE.patch go mod vendor # Generate Go files diff --git a/SOURCES/grafana.sysusers b/SOURCES/grafana.sysusers index 7c4a4d5..8948dff 100644 --- a/SOURCES/grafana.sysusers +++ b/SOURCES/grafana.sysusers @@ -1,2 +1,2 @@ #Type Name ID GECOS Home directory -u grafana - "Grafana user account" /usr/share/grafana +u grafana - "Grafana user account" /var/lib/grafana diff --git a/SOURCES/grafana.te b/SOURCES/grafana.te index 910fd54..a536e21 100644 --- a/SOURCES/grafana.te +++ b/SOURCES/grafana.te @@ -27,13 +27,6 @@ gen_tunable(grafana_can_tcp_connect_elasticsearch_port, false) ## gen_tunable(grafana_can_tcp_connect_mysql_port, false) -## -##

-## Allow grafana to connect to postgresql's default tcp port of 5432 -##

-## -gen_tunable(grafana_can_tcp_connect_postgresql_port, false) - ## ##

## Allow grafana to connect to prometheus' default tcp port of 9090 @@ -41,6 +34,19 @@ gen_tunable(grafana_can_tcp_connect_postgresql_port, false) ## gen_tunable(grafana_can_tcp_connect_prometheus_port, false) +## +##

+## Allow grafana to connect to postgresql's default tcp port of 5432 +##

+## +gen_tunable(grafana_can_tcp_connect_postgresql_port, false) + +## +##

+## Allow grafana to connect to ldap's tcp port +##

+## +gen_tunable(grafana_can_tcp_connect_ldap_port, false) type grafana_t; type grafana_exec_t; @@ -95,10 +101,23 @@ allow grafana_t self:unix_dgram_socket create_socket_perms; allow grafana_t grafana_port_t:tcp_socket { name_bind name_connect }; +allow grafana_t grafana_var_lib_t:file { execute execute_no_trans }; +allow grafana_t grafana_var_lib_t:file map; + allow grafana_t self:unix_stream_socket connectto; allow grafana_t self:netlink_route_socket { create bind getattr nlmsg_read }; +optional_policy(` + require { + type cgroup_t; + class dir { search }; + class file { open read }; + } + allow grafana_t cgroup_t:dir search; + allow grafana_t cgroup_t:file { open read }; +') + optional_policy(` require { type smtp_port_t; @@ -107,6 +126,14 @@ optional_policy(` allow grafana_t smtp_port_t:tcp_socket name_connect; ') +optional_policy(` + require { + type ntop_port_t; + class tcp_socket { name_bind }; + } + allow grafana_t ntop_port_t:tcp_socket name_bind; +') + optional_policy(` require { type usr_t; @@ -142,6 +169,14 @@ optional_policy(` allow grafana_t autofs_t:dir getattr; ') +optional_policy(` + require { + type postfix_local_t; + class dir { search }; + } + allow postfix_local_t grafana_var_lib_t:dir search; +') + manage_dirs_pattern(grafana_t, grafana_conf_t, grafana_conf_t) manage_files_pattern(grafana_t, grafana_conf_t, grafana_conf_t) @@ -213,6 +248,10 @@ tunable_policy(`grafana_can_tcp_connect_postgresql_port',` # Postgresql default corenet_tcp_connect_postgresql_port(grafana_t) ') +tunable_policy(`grafana_can_tcp_connect_ldap_port',` + corenet_tcp_connect_ldap_port(grafana_t) +') + optional_policy(` systemd_private_tmp(grafana_tmp_t) ') diff --git a/SPECS/grafana.spec b/SPECS/grafana.spec index a4207c4..2bb06cd 100644 --- a/SPECS/grafana.spec +++ b/SPECS/grafana.spec @@ -19,13 +19,14 @@ end} %global gomodulesmode GO111MODULE=auto -%global gotestflags %{gotestflags} -tags=integration +%global _gotestflags_save %{?gotestflags} +%global gotestflags %{?_gotestflags_save} -tags=integration %global selinux_variants mls targeted Name: grafana Version: 10.2.6 -Release: 10%{?dist} +Release: 20%{?dist} Summary: Metrics dashboard and graph editor License: AGPL-3.0-only URL: https://grafana.org @@ -36,13 +37,13 @@ Source0: https://github.com/grafana/grafana/archive/v%{version}/%{name} # Source1 contains the bundled Go and Node.js dependencies # Note: In case there were no changes to this tarball, the NVR of this tarball # lags behind the NVR of this package. -Source1: grafana-vendor-%{version}-8.tar.xz +Source1: grafana-vendor-%{version}-11.tar.xz %if %{compile_frontend} == 0 # Source2 contains the precompiled frontend # Note: In case there were no changes to this tarball, the NVR of this tarball # lags behind the NVR of this package. -Source2: grafana-webpack-%{version}-8.tar.gz +Source2: grafana-webpack-%{version}-11.tar.gz %endif # Source3 contains the systemd-sysusers configuration @@ -78,6 +79,9 @@ Patch9: 0009-update-wrappers-and-systemd-with-distro-paths.patch # https://github.com/grafana/grafana/commit/bae86dbeb0ad68a205454e98e76985dc393183d4 Patch10: 0010-remove-bcrypt-references.patch Patch11: 0011-fix-dompurify-CVE.patch +Patch12: 0012-fix-jwt-CVE.patch +Patch13: 0013-fix-CVE-2025-4123.patch +Patch14: 0014-Fix-CVE-2026-21721.patch # Patches affecting the vendor tarball Patch1001: 1001-vendor-patch-removed-backend-crypto.patch @@ -119,7 +123,7 @@ Requires: shared-mime-info %if 0%{?fedora} >= 35 || 0%{?rhel} >= 8 # This ensures that the grafana-selinux package and all its dependencies are # not pulled into containers and other systems that do not use SELinux -Requires: (grafana-selinux = %{version}-%{release} if selinux-policy-targeted) +Requires: (grafana-selinux = %{version}-%{release} if selinux-policy-any) %else Requires: grafana-selinux = %{version}-%{release} %endif @@ -249,7 +253,7 @@ Provides: bundled(golang(github.com/andybalholm/brotli)) = 1.0.4 Provides: bundled(golang(github.com/go-kit/log)) = 0.2.1 Provides: bundled(golang(github.com/go-openapi/loads)) = 0.21.2 Provides: bundled(golang(github.com/go-openapi/runtime)) = 0.26.0 -Provides: bundled(golang(github.com/golang-jwt/jwt/v4)) = 4.5.0 +Provides: bundled(golang(github.com/golang-jwt/jwt/v4)) = 4.5.2 Provides: bundled(golang(github.com/golang/protobuf)) = 1.5.3 Provides: bundled(golang(github.com/googleapis/gax-go/v2)) = 2.12.0 Provides: bundled(golang(github.com/gorilla/mux)) = 1.8.0 @@ -741,15 +745,11 @@ Graphite, InfluxDB & OpenTSDB. # SELinux package %package selinux -Summary: SELinux policy module supporting grafana -BuildRequires: checkpolicy, selinux-policy-devel, selinux-policy-targeted -%if "%{_selinux_policy_version}" != "" -Requires: selinux-policy >= %{_selinux_policy_version} -%endif -Requires: %{name} = %{version}-%{release} -Requires: selinux-policy-targeted -Requires(post): /usr/sbin/semodule, /usr/sbin/semanage, /sbin/restorecon, /sbin/fixfiles, grafana -Requires(postun): /usr/sbin/semodule, /usr/sbin/semanage, /sbin/restorecon, /sbin/fixfiles, /sbin/service, grafana +Summary: SELinux policy module supporting grafana +Requires: selinux-policy-any +Requires(post): selinux-policy-any, /usr/sbin/semanage +Requires(postun): /usr/sbin/semanage +BuildRequires: selinux-policy-devel %description selinux SELinux policy module supporting grafana @@ -764,10 +764,6 @@ rm -r plugins-bundled %setup -q -T -D -b 2 %endif -# SELinux policy -mkdir SELinux -cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} SELinux - %patch -P 1 -p1 %patch -P 2 -p1 %patch -P 3 -p1 @@ -779,6 +775,9 @@ cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} SELinux %patch -P 9 -p1 %patch -P 10 -p1 %patch -P 11 -p1 +%patch -P 12 -p1 +%patch -P 13 -p1 +%patch -P 14 -p1 %patch -P 1001 -p1 %if %{enable_fips_mode} @@ -809,15 +808,11 @@ for cmd in grafana grafana-cli grafana-server; do done # SELinux policy -cd SELinux -for selinuxvariant in %{selinux_variants} -do - make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile - mv grafana.pp grafana.pp.${selinuxvariant} - make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile clean -done -cd - +mkdir selinux +cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} selinux +make -f %{_datadir}/selinux/devel/Makefile grafana.pp +bzip2 -9 grafana.pp %install # dirs, shared files, public html, webpack @@ -882,14 +877,12 @@ echo "d %{_rundir}/%{name} 0755 %{GRAFANA_USER} %{GRAFANA_GROUP} -" \ install -p -m 644 -D %{SOURCE3} %{buildroot}%{_sysusersdir}/%{name}.conf # SELinux policy -cd SELinux for selinuxvariant in %{selinux_variants} do - install -d %{buildroot}%{_datadir}/selinux/${selinuxvariant} - install -p -m 644 grafana.pp.${selinuxvariant} \ - %{buildroot}%{_datadir}/selinux/${selinuxvariant}/grafana.pp + install -D -m 0644 grafana.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/${selinuxvariant}/grafana.pp.bz2 + install -D -p -m 0644 selinux/grafana.if \ + %{buildroot}%{_datadir}/selinux/devel/include/distributed/grafana.if done -cd - %pre %sysusers_create_compat %{SOURCE3} @@ -995,39 +988,67 @@ export TZ=GMT %doc README.md ROADMAP.md SECURITY.md SUPPORT.md UPGRADING_DEPENDENCIES.md WORKFLOW.md # SELinux policy +%pre selinux +%selinux_relabel_pre + %post selinux for selinuxvariant in %{selinux_variants} do - /usr/sbin/semodule -s ${selinuxvariant} -i \ - %{_datadir}/selinux/${selinuxvariant}/grafana.pp &> /dev/null || : + %selinux_modules_install -s ${selinuxvariant} %{_datadir}/selinux/packages/${selinuxvariant}/grafana.pp.bz2 &>/dev/null + /usr/sbin/semanage port -a -t grafana_port_t -p tcp 3000 &> /dev/null || : + semodule -X400 -r grafana &>/dev/null || true done -/sbin/restorecon -RvF /usr/sbin/grafana* &> /dev/null || : -/sbin/restorecon -RvF /etc/grafana &> /dev/null || : -/sbin/restorecon -RvF /var/log/grafana &> /dev/null || : -/sbin/restorecon -RvF /var/lib/grafana &> /dev/null || : -/sbin/restorecon -RvF /usr/libexec/grafana-pcp &> /dev/null || : -/usr/sbin/semanage port -a -t grafana_port_t -p tcp 3000 &> /dev/null || : +%selinux_relabel_post -%postun selinux -if [ $1 -eq 0 ] ; then -/usr/sbin/semanage port -d -p tcp 3000 &> /dev/null || : - for selinuxvariant in %{selinux_variants} - do - /usr/sbin/semodule -s ${selinuxvariant} -r grafana &> /dev/null || : - done - /sbin/restorecon -RvF /usr/sbin/grafana* &> /dev/null || : - /sbin/restorecon -RvF /etc/grafana &> /dev/null || : - /sbin/restorecon -RvF /var/log/grafana &> /dev/null || : - /sbin/restorecon -RvF /var/lib/grafana &> /dev/null || : - /sbin/restorecon -RvF /usr/libexec/grafana-pcp &> /dev/null || : +if [ "$1" -le "1" ]; then # First install + # The daemon needs to be restarted for the custom label to be applied. + # This will fail in case "post selinux" is executed before the service file is installed, + # but then it is safe to ignore since the service will first start with the proper label + %systemd_postun_with_restart grafana.service &> /dev/null || : fi +%postun selinux +for selinuxvariant in %{selinux_variants} +do + if [ $1 -eq 0 ]; then + /usr/sbin/semanage port -d -p tcp 3000 &> /dev/null || : + %selinux_modules_uninstall -s ${selinuxvariant} grafana + %selinux_relabel_post -s ${selinuxvariant} + fi +done + %files selinux -%defattr(-,root,root,0755) -%doc SELinux/* -%{_datadir}/selinux/*/grafana.pp +%{_datadir}/selinux/packages/*/grafana.pp.* +%{_datadir}/selinux/devel/include/distributed/grafana.if +%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana %changelog +* Tue Feb 17 2026 Sam Feifer 10.2.6-20 +- Resolves RHEL-144960: CVE-2026-21721 +- Resolves RHEL-145419: CVE-2025-61728 +- Resolves RHEL-146103: CVE-2025-61726 +- Resolves RHEL-149639: CVE-2025-68121 + +* Mon Jan 26 2026 Sam Feifer 10.2.6-19 +- Resolves RHEL-140549: CVE-2025-61729 + +* Mon Dec 1 2025 Sam Feifer 10.2.6-18 +- Resolves RHEL-125696: CVE-2025-58183 +- Resolves RHEL-132757: Grafana-selinux prevents plugins from searching cgroups + +* Wed Jun 18 2025 Sam Feifer 10.2.6-15 +- Resolves RHEL-97518: Rework grafana-selinux spec file sections +- Resolves RHEL-87861: Add additional SELinux rules for grafana-selinux package to allow LDAP connections + +* Tue May 13 2025 Sam Feifer 10.2.6-13 +- Resolves RHEL-89953: CVE-2025-4123 + +* Tue Apr 29 2025 Sam Feifer 10.2.6-12 +- Resolves RHEL-85419: Move grafana home directory to /var/lib/grafana + +* Tue Mar 25 2025 Sam Feifer 10.2.6-11 +- Resolves RHEL-84636: CVE-2025-30204 + * Wed Jan 29 2025 Sam Feifer 10.2.6-10 - Resolves RHEL-75919: grafana selinux issue with autofs_t