From 8288d3330abbc7fa83c4bd0a5a34155089017d61 Mon Sep 17 00:00:00 2001
From: Sam Feifer <sfeifer@redhat.com>
Date: Tue, 17 Jun 2025 13:47:21 -0400
Subject: [PATCH] Resolves: RHEL-87861

---
 grafana.spec |  1 +
 grafana.te   | 11 +++++++++++
 2 files changed, 12 insertions(+)

diff --git a/grafana.spec b/grafana.spec
index e8941df..b83c47f 100644
--- a/grafana.spec
+++ b/grafana.spec
@@ -1022,6 +1022,7 @@ done
 %changelog
 * Tue Jun 17 2025 Sam Feifer <sfeifer@redhat.com> 10.2.6-14
 - Resolves RHEL-97518: Rework grafana-selinux spec file sections
+- Resolves RHEL-87861: Add additional SELinux rules for grafana-selinux package to allow LDAP connections
 
 * Tue May 13 2025 Sam Feifer <sfeifer@redhat.com> 10.2.6-13
 - Resolves RHEL-89953: CVE-2025-4123
diff --git a/grafana.te b/grafana.te
index 1b301c4..41f0cb3 100644
--- a/grafana.te
+++ b/grafana.te
@@ -41,6 +41,13 @@ gen_tunable(grafana_can_tcp_connect_prometheus_port, false)
 ## </desc>            
 gen_tunable(grafana_can_tcp_connect_postgresql_port, false)
 
+## <desc>            
+## <p>
+## Allow grafana to connect to ldap's tcp port           
+## </p>            
+## </desc>  
+gen_tunable(grafana_can_tcp_connect_ldap_port, false)
+
 type grafana_t;
 type grafana_exec_t;
 init_daemon_domain(grafana_t, grafana_exec_t)
@@ -231,6 +238,10 @@ tunable_policy(`grafana_can_tcp_connect_postgresql_port',` # Postgresql default
 	corenet_tcp_connect_postgresql_port(grafana_t)
 ')
 
+tunable_policy(`grafana_can_tcp_connect_ldap_port',`
+	corenet_tcp_connect_ldap_port(grafana_t)
+')
+
 optional_policy(`
     systemd_private_tmp(grafana_tmp_t)
 ')