From 55585d25c68f1d7070bf3d11da79500e2ec7c40e Mon Sep 17 00:00:00 2001 From: Sam Feifer Date: Tue, 2 Dec 2025 16:33:04 -0500 Subject: [PATCH] Resolves: RHEL-132757 --- grafana.spec | 1 + grafana.te | 10 ++++++++++ 2 files changed, 11 insertions(+) diff --git a/grafana.spec b/grafana.spec index 5cffcbc..a798e10 100644 --- a/grafana.spec +++ b/grafana.spec @@ -1023,6 +1023,7 @@ done %changelog * Mon Dec 1 2025 Sam Feifer 10.2.6-18 - Resolves RHEL-125696: CVE-2025-58183 +- Resolves RHEL-132757: Grafana-selinux prevents plugins from searching cgroups * Wed Jun 18 2025 Sam Feifer 10.2.6-15 - Resolves RHEL-97518: Rework grafana-selinux spec file sections diff --git a/grafana.te b/grafana.te index 41f0cb3..a536e21 100644 --- a/grafana.te +++ b/grafana.te @@ -108,6 +108,16 @@ allow grafana_t self:unix_stream_socket connectto; allow grafana_t self:netlink_route_socket { create bind getattr nlmsg_read }; +optional_policy(` + require { + type cgroup_t; + class dir { search }; + class file { open read }; + } + allow grafana_t cgroup_t:dir search; + allow grafana_t cgroup_t:file { open read }; +') + optional_policy(` require { type smtp_port_t;