9 changed files with 592 additions and 57 deletions
--- a/SOURCES/0001-update-grafana-cli-script-with-distro-specific-paths.patch
+++ b/SOURCES/0001-update-grafana-cli-script-with-distro-specific-paths.patch
@ -52,7 +52,7 @@ index dafa075a2c..eda358c425 100755
 +                         cfg:default.paths.logs=${LOG_DIR} \
 +                         cfg:default.paths.plugins=${PLUGINS_DIR}")
 +
-+if [ "$(id -u)" -eq 0 ]; then
+if [ "$(id -u)" -eq 0 -o "$(id -g)" -eq 0 ]; then
 +  cd "${GRAFANA_HOME}"
 +  exec runuser -u "${GRAFANA_USER}" -- "$EXECUTABLE" "${OPTS[@]}" "$@"
 +elif [ "$(id -u -n)" = "${GRAFANA_USER}" ]; then
--- a/SOURCES/0008-graphite-functions-xss.patch
+++ b/SOURCES/0008-graphite-functions-xss.patch
@ -1,15 +1,14 @@
-From 05df8dcac715113517b81b1995ab1f0b69017f4a Mon Sep 17 00:00:00 2001
 From: ismail simsek <ismailsimsek09@gmail.com>
-Date: Thu, 16 Mar 2023 23:16:03 +0100
+Date:   Thu Mar 16 23:16:03 2023 +0100
 Subject: [PATCH] graphite functions xss

 commit e59427c074
    [v9.2.x] Fix xss in Graphite functions tooltip (#810)
-
+    
    Fix xss in Graphite functions tooltip (#804)
-
+    
    (cherry picked from commit 87aad3f11836f810ee1fdfee27827e746ef36055)
-
+    
    Co-authored-by: Ludovic Viaud <ludovic.viaud@gmail.com>

 diff --git a/public/app/plugins/datasource/graphite/components/FunctionEditorControls.tsx b/public/app/plugins/datasource/graphite/components/FunctionEditorControls.tsx
--- a/SOURCES/0009-redact-weak-ciphers.patch
+++ b/SOURCES/0009-redact-weak-ciphers.patch
@ -0,0 +1,30 @@
+From 3236aa416f6d1b109bff1fdd4127292988fb199c Mon Sep 17 00:00:00 2001
+From: Stan Cox <scox@redhat.com>
+Date: Wed, 22 Jun 2022 17:05:48 +0200
+Subject: [PATCH] redact weak ciphers
+
+
+diff --git a/pkg/api/http_server.go b/pkg/api/http_server.go
+index 2d6e1235b6..f0eff6d2ac 100644
+--- a/pkg/api/http_server.go	2023-01-24 14:44:19.000000000 -0500
+++ b/pkg/api/http_server.go	2023-04-21 13:14:02.684857018 -0400
+@@ -489,13 +489,13 @@
+ 			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+ 			tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+ 			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+-			tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+//			tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+ 			tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+-			tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+-			tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
+-			tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
+-			tls.TLS_RSA_WITH_AES_128_CBC_SHA,
+-			tls.TLS_RSA_WITH_AES_256_CBC_SHA,
+//			tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+//			tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
+//			tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
+//			tls.TLS_RSA_WITH_AES_128_CBC_SHA,
+//			tls.TLS_RSA_WITH_AES_256_CBC_SHA,
+ 		},
+ 	}
+ 
--- a/SOURCES/0012-coredump-selinux-error.patch
+++ b/SOURCES/0012-coredump-selinux-error.patch
@ -0,0 +1,13 @@
+diff --git a/pkg/framework/coremodel/helpers.go b/pkg/framework/coremodel/helpers.go
+index 20d111edba..6655f81cee 100644
+--- a/pkg/framework/coremodel/helpers.go
+++ b/pkg/framework/coremodel/helpers.go
+@@ -26,7 +26,7 @@ func init() {
+ 	var err error
+ 	defaultFramework, err = doLoadFrameworkCUE(cuectx.ProvideCUEContext())
+ 	if err != nil {
+-		panic(err)
+//		panic(err)
+ 	}
+ }
+ 
--- a/SOURCES/create_bundles_in_container.sh
+++ b/SOURCES/create_bundles_in_container.sh
@ -6,7 +6,7 @@
 #

 cat <<EOF | podman build -t grafana-build -f - .
-FROM fedora:35
+FROM fedora:36

 RUN dnf upgrade -y && \
    dnf install -y rpmdevtools python3-packaging python3-pyyaml make golang nodejs yarnpkg
--- a/SOURCES/grafana.fc
+++ b/SOURCES/grafana.fc
@ -0,0 +1,24 @@
+/etc/systemd/system/grafana-server.service		--	gen_context(system_u:object_r:grafana_unit_file_t,s0)
+/usr/lib/systemd/system/grafana-server.service		--	gen_context(system_u:object_r:grafana_unit_file_t,s0)
+
+/etc/grafana(/.*)?						gen_context(system_u:object_r:grafana_conf_t,s0)
+
+/usr/sbin/grafana-cli					--	gen_context(system_u:object_r:grafana_exec_t,s0)
+/usr/sbin/grafana-server				--	gen_context(system_u:object_r:grafana_exec_t,s0)
+
+/var/lib/grafana(/.*)?						gen_context(system_u:object_r:grafana_var_lib_t,s0)
+#/var/lib/grafana/grafana.db				--	gen_context(system_u:object_r:grafana_db_t,s0)
+
+/var/log/grafana(/.*)?						gen_context(system_u:object_r:grafana_log_t,s0)
+
+/var/run/grafana(/.*)?			--	gen_context(system_u:object_r:grafana_var_run_t,s0)
+
+#/var/lib/grafana/plugins(/.*)?					gen_context(system_u:object_r:grafana_plugin_t,s0)
+
+/usr/share/grafana/bin/grafana				--	gen_context(system_u:object_r:grafana_exec_t,s0)
+/usr/share/grafana/bin/grafana-cli			--	gen_context(system_u:object_r:grafana_exec_t,s0)
+/usr/share/grafana/bin/grafana-server			--	gen_context(system_u:object_r:grafana_exec_t,s0)
+
+#define context for pcp plugin
+#/usr/share/performancecopilot-pcp-app/datasources/redis/pcp_redis_datasource_(.*)           -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0)
+/usr/libexec/grafana-pcp/datasources/redis/pcp_redis_datasource_(.*)           -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0)
--- a/SOURCES/grafana.if
+++ b/SOURCES/grafana.if
@ -0,0 +1,141 @@
+## <summary>policy for grafana</summary>
+
+########################################
+## <summary>
+##	Execute grafana_exec_t in the grafana domain.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`grafana_domtrans',`
+	gen_require(`
+		type grafana_t, grafana_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, grafana_exec_t, grafana_t)
+')
+
+########################################
+## <summary>
+##      Allow domain to name_connect to grafana port. Default :3000
+## </summary>
+## <param name="domain">
+## <summary>
+##      Domain allowed access
+## </summary>
+## </param>
+#
+interface(`connect_grafana_port',`
+        gen_require(`
+		class tcp_socket name_connect;
+                type grafana_port_t;
+        ')
+
+	allow $1 grafana_port_t:tcp_socket name_connect;
+')
+
+#######################################
+## <summary>
+##	Read grafana database.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`grafana_read_db',`
+	gen_require(`
+		type grafana_db_t;
+	')
+
+	files_search_var_lib($1)
+	search_dirs_pattern($1, grafana_var_lib_t, grafana_var_lib_t)	
+	read_files_pattern($1, grafana_db_t, grafana_db_t)
+')
+
+######################################
+## <summary>
+##	Execute grafana in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`grafana_exec',`
+	gen_require(`
+		type grafana_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	can_exec($1, grafana_exec_t)
+')
+########################################
+## <summary>
+##	Execute grafana server in the grafana domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`grafana_systemctl',`
+	gen_require(`
+		type grafana_t;
+		type grafana_unit_file_t;
+	')
+
+	systemd_exec_systemctl($1)
+        systemd_read_fifo_file_passwd_run($1)
+	allow $1 grafana_unit_file_t:file read_file_perms;
+	allow $1 grafana_unit_file_t:service manage_service_perms;
+
+	ps_process_pattern($1, grafana_t)
+')
+
+
+########################################
+## <summary>
+##	All of the rules required to administrate
+##	an grafana environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`grafana_admin',`
+	gen_require(`
+	type grafana_t;
+	type grafana_unit_file_t;
+	')
+
+	allow $1 grafana_t:process { signal_perms };
+	ps_process_pattern($1, grafana_t)
+
+	tunable_policy(`deny_ptrace',`',`
+        	allow $1 grafana_t:process ptrace;
+    	')
+
+	grafana_systemctl($1)
+	admin_pattern($1, grafana_unit_file_t)
+	allow $1 grafana_unit_file_t:service all_service_perms;
+	optional_policy(`
+		systemd_passwd_agent_exec($1)
+		systemd_read_fifo_file_passwd_run($1)
+	')
+')
--- a/SOURCES/grafana.te
+++ b/SOURCES/grafana.te
@ -0,0 +1,199 @@
+policy_module(grafana, 1.0.4)
+
+########################################
+#
+# Declarations
+#
+#permissive grafana_t;
+
+## <desc>
+## <p>
+## Allow grafana to be used with a reverse proxy
+## </p>
+## </desc>
+gen_tunable(grafana_can_reverse_proxy, false)
+
+## <desc>
+## <p>
+## Allow grafana to connect to elasticsearch's default tcp port of 9200
+## </p>
+## </desc>
+gen_tunable(grafana_can_tcp_connect_elasticsearch_port, false)
+
+## <desc>
+## <p>
+## Allow grafana to connect to mysql's default tcp port of 3306
+## </p>
+## </desc>
+gen_tunable(grafana_can_tcp_connect_mysql_port, false)
+
+## <desc>
+## <p>
+## Allow grafana to connect to postgresql's default tcp port of 5432
+## </p>
+## </desc>
+gen_tunable(grafana_can_tcp_connect_postgresql_port, false)
+
+## <desc>
+## <p>
+## Allow grafana to connect to prometheus' default tcp port of 9090
+## </p>
+## </desc>
+gen_tunable(grafana_can_tcp_connect_prometheus_port, false)
+
+
+type grafana_t;
+type grafana_exec_t;
+init_daemon_domain(grafana_t, grafana_exec_t)
+init_nnp_daemon_domain(grafana_t)
+
+type grafana_unit_file_t;
+systemd_unit_file(grafana_unit_file_t)
+
+type grafana_conf_t;
+files_config_file(grafana_conf_t)
+
+type grafana_db_t;
+files_config_file(grafana_db_t)
+
+type grafana_tmp_t;
+files_tmp_file(grafana_tmp_t)
+
+type grafana_tmpfs_t;
+files_tmpfs_file(grafana_tmpfs_t)
+
+type grafana_log_t;
+logging_log_file(grafana_log_t)
+
+type grafana_var_run_t;
+files_pid_file(grafana_var_run_t)
+
+type grafana_var_lib_t;
+files_type(grafana_var_lib_t)
+
+type grafana_port_t;
+corenet_port(grafana_port_t)
+
+type grafana_pcp_exec_t;
+corecmd_executable_file(grafana_pcp_exec_t)
+can_exec(grafana_t, grafana_pcp_exec_t)
+
+# Ports 32768-60999 (pcp port is 44322)
+corenet_tcp_connect_all_ephemeral_ports(grafana_t)
+grafana_exec(grafana_t)
+
+########################################
+#
+# grafana local policy
+#
+allow grafana_t self:tcp_socket create_stream_socket_perms;
+allow grafana_t self:udp_socket create_stream_socket_perms;
+allow grafana_t self:unix_dgram_socket create_socket_perms;
+
+allow grafana_t grafana_port_t:tcp_socket { name_bind name_connect };
+
+allow grafana_t self:unix_stream_socket connectto;
+
+allow grafana_t self:netlink_route_socket { create bind getattr nlmsg_read };
+
+optional_policy(`
+	require {
+		type smtp_port_t;
+		class tcp_socket { name_connect };
+	}
+	allow grafana_t smtp_port_t:tcp_socket name_connect;
+')
+
+optional_policy(`
+	require {
+		type usr_t;
+		class file { execute execute_no_trans };
+	}
+	allow grafana_t usr_t:file { execute execute_no_trans };
+')
+
+optional_policy(`
+	require {
+		type postgresql_t;
+		type postgresql_var_run_t;
+		class unix_stream_socket { connectto };
+		class sock_file { write };
+	}
+	allow grafana_t postgresql_t:unix_stream_socket connectto;
+	allow grafana_t postgresql_var_run_t:sock_file write;
+')
+
+manage_dirs_pattern(grafana_t, grafana_conf_t, grafana_conf_t)
+manage_files_pattern(grafana_t, grafana_conf_t, grafana_conf_t)
+
+manage_dirs_pattern(grafana_t, grafana_db_t, grafana_db_t)
+manage_files_pattern(grafana_t, grafana_db_t, grafana_db_t)
+
+manage_dirs_pattern(grafana_t, grafana_tmp_t, grafana_tmp_t)
+manage_files_pattern(grafana_t, grafana_tmp_t, grafana_tmp_t)
+manage_sock_files_pattern(grafana_t, grafana_tmp_t, grafana_tmp_t)
+files_tmp_filetrans(grafana_t, grafana_tmp_t, { dir file sock_file })
+
+manage_dirs_pattern(grafana_t, grafana_tmpfs_t, grafana_tmpfs_t)
+manage_files_pattern(grafana_t, grafana_tmpfs_t, grafana_tmpfs_t)
+fs_tmpfs_filetrans(grafana_t, grafana_tmpfs_t, {dir file})
+
+manage_dirs_pattern(grafana_t, grafana_log_t, grafana_log_t)
+manage_files_pattern(grafana_t, grafana_log_t, grafana_log_t)
+logging_log_filetrans(grafana_t, grafana_log_t, { dir file })
+
+manage_dirs_pattern(grafana_t, grafana_var_run_t, grafana_var_run_t)
+manage_files_pattern(grafana_t, grafana_var_run_t, grafana_var_run_t)
+files_pid_filetrans(grafana_t, grafana_var_run_t, { dir file })
+
+manage_dirs_pattern(grafana_t, grafana_var_lib_t, grafana_var_lib_t)
+manage_files_pattern(grafana_t, grafana_var_lib_t, grafana_var_lib_t)
+manage_lnk_files_pattern(grafana_t, grafana_var_lib_t, grafana_var_lib_t)
+files_var_lib_filetrans(grafana_t, grafana_var_lib_t, { dir file })
+
+
+corenet_tcp_connect_http_port(grafana_t)
+corenet_tcp_bind_generic_node(grafana_t)
+
+kernel_dgram_send(grafana_t)
+kernel_read_net_sysctls(grafana_t)
+kernel_read_system_state(grafana_t)
+
+auth_read_passwd(grafana_t)
+
+dev_read_sysfs(grafana_t)
+
+sysnet_read_config(grafana_t)
+
+logging_send_syslog_msg(grafana_t)
+
+miscfiles_read_generic_certs(grafana_t)
+
+tunable_policy(`grafana_can_reverse_proxy',`
+	gen_require(`
+		type httpd_t;
+	')
+
+	connect_grafana_port(httpd_t) # Reverse proxy support
+	corenet_tcp_connect_http_port(grafana_t)
+')
+
+tunable_policy(`grafana_can_tcp_connect_elasticsearch_port',` # Elasticsearch default tcp port 9200
+	corenet_tcp_connect_wap_wsp_port(grafana_t)
+')
+
+tunable_policy(`grafana_can_tcp_connect_mysql_port',` # Mysql default tcp port 3306
+	corenet_tcp_connect_mysqld_port(grafana_t)
+')
+
+tunable_policy(`grafana_can_tcp_connect_postgresql_port',` # Postgresql default tcp port 5432
+	corenet_tcp_connect_postgresql_port(grafana_t)
+')
+
+tunable_policy(`grafana_can_tcp_connect_prometheus_port',` # Prometheus default tcp port 9090
+	corenet_tcp_connect_websm_port(grafana_t)
+')
+
+optional_policy(`
+    systemd_private_tmp(grafana_tmp_t)
+')
--- a/SPECS/grafana.spec
+++ b/SPECS/grafana.spec
@ -1,13 +1,3 @@
-# gobuild and gotest macros are not available on CentOS Stream
-# remove once BZ 1965292 is resolved
-# definitions lifted from Fedora 34 podman.spec
-%if ! 0%{?gobuild:1}
-%define gobuild(o:) GO111MODULE=off go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '-Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld '" -a -v -x %{?**};
-%endif
-%if ! 0%{?gotest:1}
-%define gotest() GO111MODULE=off go test -buildmode pie -compiler gc -ldflags "${LDFLAGS:-} -extldflags '-Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld '" %{?**};
-%endif
-
 # Specify if the frontend will be compiled as part of the build or
 # is attached as a webpack tarball (in case of an unsuitable nodejs version on the build system)
 %define compile_frontend 0
@ -31,11 +21,13 @@ end}
 %global gomodulesmode GO111MODULE=auto
 %global gotestflags   %{gotestflags} -tags=integration

+%global selinux_variants mls targeted
+
 Name:             grafana
 Version:          9.2.10
-Release:          6%{?dist}
+Release:          15%{?dist}
 Summary:          Metrics dashboard and graph editor
-License:          AGPLv3
+License:          AGPL-3.0-only
 URL:              https://grafana.org

 # Source0 contains the tagged upstream sources
@ -68,6 +60,11 @@ Source6:          list_bundled_nodejs_packages.py
 # Source7 contains the script to create the vendor and webpack bundles in a container
 Source7:          create_bundles_in_container.sh

+# Source8 - Source10  contain the grafana-selinux policy
+Source8:          grafana.te
+Source9:          grafana.fc
+Source10:         grafana.if
+
 # Patches affecting the source tarball
 Patch1:           0001-update-grafana-cli-script-with-distro-specific-paths.patch
 Patch2:           0002-add-manpages.patch
@ -77,8 +74,10 @@ Patch5:           0005-remove-unused-frontend-crypto.patch
 Patch6:           0006-skip-marketplace-plugin-install-test.patch
 Patch7:           0007-fix-alert-test.patch
 Patch8:           0008-graphite-functions-xss.patch
+Patch9:           0009-redact-weak-ciphers.patch
 Patch10:          0010-skip-tests.patch
 Patch11:          0011-remove-email-lookup.patch
+Patch12:          0012-coredump-selinux-error.patch

 # Patches affecting the vendor tarball
 Patch1001:        1001-vendor-patch-removed-backend-crypto.patch
@ -90,7 +89,7 @@ ExclusiveArch:    %{grafana_arches}

 BuildRequires:    systemd
 BuildRequires:    systemd-rpm-macros
-BuildRequires:    golang >= 1.17
+BuildRequires:    golang
 BuildRequires:    go-srpm-macros
 %if 0%{?rhel} >= 9
 BuildRequires:    go-rpm-macros
@ -116,6 +115,14 @@ Requires(pre):    shadow-utils
 BuildRequires:    shared-mime-info
 Requires:         shared-mime-info

+%if 0%{?fedora} >= 35 || 0%{?rhel} >= 8
+# This ensures that the grafana-selinux package and all its dependencies are
+# not pulled into containers and other systems that do not use SELinux
+Requires: (grafana-selinux = %{version}-%{release} if selinux-policy-targeted)
+%else
+Requires: grafana-selinux = %{version}-%{release}
+%endif
+
 %if 0%{?fedora} || 0%{?rhel} > 7
 Recommends: grafana-pcp
 %endif
@ -717,6 +724,20 @@ Provides: bundled(npm(yaml)) = 1.10.2
 Grafana is an open source, feature rich metrics dashboard and graph editor for
 Graphite, InfluxDB & OpenTSDB.

+# SELinux package
+%package selinux
+Summary:        SELinux policy module supporting grafana
+BuildRequires: checkpolicy, selinux-policy-devel, selinux-policy-targeted
+%if "%{_selinux_policy_version}" != ""
+Requires:       selinux-policy >= %{_selinux_policy_version}
+%endif
+Requires:       %{name} = %{version}-%{release}
+Requires:	selinux-policy-targeted
+Requires(post):   /usr/sbin/semodule, /usr/sbin/semanage, /sbin/restorecon, /sbin/fixfiles, grafana
+Requires(postun): /usr/sbin/semodule, /usr/sbin/semanage, /sbin/restorecon, /sbin/fixfiles, /sbin/service, grafana
+
+%description selinux
+SELinux policy module supporting grafana

 %prep
 %setup -q -T -D -b 0
@ -728,6 +749,10 @@ rm -r plugins-bundled
 %setup -q -T -D -b 2
 %endif

+# SELinux policy
+mkdir SELinux
+cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} SELinux
+
 %patch -P 1 -p1
 %patch -P 2 -p1
 %patch -P 3 -p1
@ -736,8 +761,10 @@ rm -r plugins-bundled
 %patch -P 6 -p1
 %patch -P 7 -p1
 %patch -P 8 -p1
+%patch -P 9 -p1
 %patch -P 10 -p1
 %patch -P 11 -p1
+%patch -P 12 -p1

 %patch -P 1001 -p1
 %if %{enable_fips_mode}
@ -766,6 +793,16 @@ for cmd in grafana-cli grafana-server; do
    %gobuild -o %{_builddir}/bin/${cmd} ./pkg/cmd/${cmd}
 done

+# SELinux policy
+cd SELinux
+for selinuxvariant in %{selinux_variants}
+do
+  make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile
+  mv grafana.pp grafana.pp.${selinuxvariant}
+  make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile clean
+done
+cd -
+

 %install
 # dirs, shared files, public html, webpack
@ -825,11 +862,18 @@ echo "d %{_rundir}/%{name} 0755 %{GRAFANA_USER} %{GRAFANA_GROUP} -" \
 # systemd-sysusers configuration
 install -p -m 644 -D %{SOURCE3} %{buildroot}%{_sysusersdir}/%{name}.conf

+# SELinux policy
+cd SELinux
+for selinuxvariant in %{selinux_variants}
+do
+  install -d %{buildroot}%{_datadir}/selinux/${selinuxvariant}
+  install -p -m 644 grafana.pp.${selinuxvariant} \
+    %{buildroot}%{_datadir}/selinux/${selinuxvariant}/grafana.pp
+done
+cd -
+
 %pre
-# sysusers_create_compat macro is not present in rhel8
-# SOURCE3 may not be available in %%prein stage so specify on command line via --replace
-# instead of "systemd-sysusers %%{SOURCE3}"
-echo 'u     grafana -  "Grafana user account" /usr/share/grafana' | systemd-sysusers --replace=/usr/lib/sysusers.d/grafana.conf -
+%sysusers_create_compat %{SOURCE3}

 %preun
 %systemd_preun grafana-server.service
@ -877,13 +921,12 @@ export TZ=GMT
 # required since RHEL 8.8 to fix the following error:
 # "imports crypto/boring: build constraints exclude all Go files in /usr/lib/golang/src/crypto/boring"
 # can be removed in a future Go release
-export GOEXPERIMENT=boringcrypto
+#export GOEXPERIMENT=boringcrypto
+#% gotest ./pkg/...

-%gotest ./pkg/...
-
-%if %{enable_fips_mode}
-OPENSSL_FORCE_FIPS_MODE=1 GOLANG_FIPS=1 go test -v ./pkg/util -run TestEncryption
-%endif
+#%if %{enable_fips_mode}
+#OPENSSL_FORCE_FIPS_MODE=1 GOLANG_FIPS=1 go test -v ./pkg/util -run TestEncryption
+#%endif

 %files
 # binaries and wrappers
@ -931,35 +974,99 @@ OPENSSL_FORCE_FIPS_MODE=1 GOLANG_FIPS=1 go test -v ./pkg/util -run TestEncryptio
 %doc CHANGELOG.md CODE_OF_CONDUCT.md CONTRIBUTING.md GOVERNANCE.md HALL_OF_FAME.md ISSUE_TRIAGE.md MAINTAINERS.md
 %doc PLUGIN_DEV.md README.md ROADMAP.md SECURITY.md SUPPORT.md UPGRADING_DEPENDENCIES.md WORKFLOW.md

+# SELinux policy
+%post selinux
+for selinuxvariant in %{selinux_variants}
+do
+  /usr/sbin/semodule -s ${selinuxvariant} -i \
+    %{_datadir}/selinux/${selinuxvariant}/grafana.pp &> /dev/null || :
+done
+/sbin/restorecon -RvF /usr/sbin/grafana-* &> /dev/null || :
+/sbin/restorecon -RvF /etc/grafana &> /dev/null || :
+/sbin/restorecon -RvF /var/log/grafana &> /dev/null || :
+/sbin/restorecon -RvF /var/lib/grafana &> /dev/null || :
+/sbin/restorecon -RvF /usr/libexec/grafana-pcp &> /dev/null || :
+/usr/sbin/semanage port -a -t grafana_port_t -p tcp 3000 &> /dev/null || :
+
+%postun selinux
+if [ $1 -eq 0 ] ; then
+/usr/sbin/semanage port -d -p tcp 3000 &> /dev/null || :
+  for selinuxvariant in %{selinux_variants}
+  do
+    /usr/sbin/semodule -s ${selinuxvariant} -r grafana &> /dev/null || :
+  done
+  /sbin/restorecon -RvF /usr/sbin/grafana-* &> /dev/null || :
+  /sbin/restorecon -RvF /etc/grafana &> /dev/null || :
+  /sbin/restorecon -RvF /var/log/grafana &> /dev/null || :
+  /sbin/restorecon -RvF /var/lib/grafana &> /dev/null || :
+  /sbin/restorecon -RvF /usr/libexec/grafana-pcp &> /dev/null || :
+fi
+
+%files selinux
+%defattr(-,root,root,0755)
+%doc SELinux/*
+%{_datadir}/selinux/*/grafana.pp

 %changelog
-* Fri Jul 21 2023 Stan Cox <scox@redhat.com> 9.2.10-6
- Add /usr/share/grafana to systemd-sysusers --replace
+* Wed Jan 31 2024 Sam Feifer <sfeifer@redhat.com> 9.2.10-15
+- Resolves RHEL-23468
+- Allows for gid to be 0
+- Allows for postgreSQL datasource in selinux policy
+
+* Tue Dec 19 2023 Sam Feifer <sfeifer@redhat.com> 9.2.10-14
+- Fixes postgresql AVC denial
+- Related RHEL-7505
+
+* Thu Dec 14 2023 Sam Feifer <sfeifer@redhat.com> 9.2.10-13
+- Resolves RHEL-19296
+- Fixes coredump issue introduced by selinux
+- Patches out call to panic when trying to walk "/" directory
+
+* Thu Nov 30 2023 Sam Feifer <sfeifer@redhat.com> 9.2.10-12
+- Resolves RHEL-7505
+- Fixes additional selinux denials found when testing on certain architectures
+
+* Tue Nov 21 2023 Sam Feifer <sfeifer@redhat.com> 9.2.10-11
+- Resolves RHEL-7505
+- Fixes selinux denials found when testing on certain architectures
+
+* Wed Nov 15 2023 Sam Feifer <sfeifer@redhat.com> 9.2.10-10
+- Resolves RHEL-7505
+- Adds a selinux policy for grafana
+- Resolves RHEL-12666
+- fix CVE-2023-39325 CVE-2023-44487 rapid stream resets can cause excessive work

 * Thu Jul 20 2023 Stan Cox <scox@redhat.com> 9.2.10-5
 - resolve CVE-2023-3128 grafana: account takeover possible when using Azure AD OAuth

-* Thu Jun 8 2023 Stan Cox <scox@redhat.com> 9.2.10-4
- bumps exporter-toolkit to v0.7.3, sanitize-url@npm to 6.0.2, skip problematic s390 tests.
+* Thu Jun 8 2023 Stan Cox <scox@redhat.com> 9.2.10-3
+- bumps exporter-toolkit to v0.7.3, sanitize-url@npm to 6.0.2, skip problematic s390 tests, License AGPL-3.0-only.

-* Thu May 25 2023 Stan Cox <scox@redhat.com> 9.2.10-3
- Use systemd-sysusers --replace
-
-* Tue May 23 2023 Jan Kurik <jkurik@redhat.com> 9.2.10-2
- Use systemd-sysusers instead of sysusers_create_compat, which is not available in RHEL-8
+* Mon May 15 2023 Stan Cox <scox@redhat.com> 9.2.10-2
+- Update to 9.2.10

 * Thu May 04 2023 Stan Cox <scox@redhat.com> 9.2.10-1
 - Update to 9.2.10

-* Mon Oct 31 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-4
- resolve CVE-2022-39229 grafana: using email as a username can block other users from signing in
- resolve CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY
- resolve CVE-2022-41715 golang: regexp/syntax: limit memory used by parsing regexps
- resolve CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters
- run integration tests in check phase
- update FIPS patch with latest changes in Go packaging
+* Tue Nov 01 2022 Stan Cox <scox@redhat.com> 9.0.9-2
+- resolve CVE-2022-39229 grafana: Using email as a username can prevent other users from signing in
+- resolve CVE-2022-2880 CVE-2022-41715 grafana: various flaws

-* Wed Aug 10 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-3
+* Wed Sep 21 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 9.0.9-1
+- update to 9.0.9 tagged upstream community sources, see CHANGELOG
+- resolve CVE-2022-35957 grafana: Escalation from admin to server admin when auth proxy is used (rhbz#2125530)
+
+* Tue Sep 20 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 9.0.8-2
+- bump NVR
+
+* Thu Sep 15 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 9.0.8-1
+- update to 9.0.8 tagged upstream community sources, see CHANGELOG
+- do not list /usr/share/grafana/conf twice
+- drop makefile in favor of create_bundles.sh script
+- sync provides/obsoletes with CentOS versions
+- drop husky patch
+
+* Thu Aug 11 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-3
 - resolve CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse* functions
 - resolve CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header
 - resolve CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
@ -970,7 +1077,7 @@ OPENSSL_FORCE_FIPS_MODE=1 GOLANG_FIPS=1 go test -v ./pkg/util -run TestEncryptio
 - resolve CVE-2022-28131 golang: encoding/xml: stack exhaustion in Decoder.Skip
 - resolve CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal

-* Wed Jul 20 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-2
+* Tue Jul 26 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-2
 - resolve CVE-2022-31107 grafana: OAuth account takeover

 * Fri Apr 22 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-1
@ -984,6 +1091,10 @@ OPENSSL_FORCE_FIPS_MODE=1 GOLANG_FIPS=1 go test -v ./pkg/util -run TestEncryptio
 - declare Node.js dependencies of subpackages
 - make vendor and webpack tarballs reproducible

+* Tue Jan 18 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.11-3
+- use HMAC-SHA-256 instead of SHA-1 to generate password reset tokens
+- update FIPS tests in check phase
+
 * Thu Dec 16 2021 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.11-2
 - resolve CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache
 - resolve CVE-2021-43813 grafana: directory traversal vulnerability for *.md files
@ -995,8 +1106,9 @@ OPENSSL_FORCE_FIPS_MODE=1 GOLANG_FIPS=1 go test -v ./pkg/util -run TestEncryptio
 * Thu Sep 30 2021 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.10-1
 - update to 7.5.10 tagged upstream community sources, see CHANGELOG

-* Mon Aug 16 2021 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.9-3
- rebuild to resolve CVE-2021-34558
+* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 7.5.9-3
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688

 * Thu Jul 08 2021 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.9-2
 - remove unused dependency property-information
@ -1005,6 +1117,10 @@ OPENSSL_FORCE_FIPS_MODE=1 GOLANG_FIPS=1 go test -v ./pkg/util -run TestEncryptio
 * Fri Jun 25 2021 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.9-1
 - update to 7.5.9 tagged upstream community sources, see CHANGELOG

+* Tue Jun 22 2021 Mohan Boddu <mboddu@redhat.com> - 7.5.8-2
+- Rebuilt for RHEL 9 BETA for openssl 3.0
+  Related: rhbz#1971065
+
 * Mon Jun 21 2021 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.8-1
 - update to 7.5.8 tagged upstream community sources, see CHANGELOG
 - remove unused dependencies selfsigned, http-signature and gofpdf
@ -1016,6 +1132,12 @@ OPENSSL_FORCE_FIPS_MODE=1 GOLANG_FIPS=1 go test -v ./pkg/util -run TestEncryptio
 * Tue May 25 2021 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.7-1
 - update to 7.5.7 tagged upstream community sources, see CHANGELOG

+* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 7.3.6-4
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 7.3.6-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
 * Fri Jan 22 2021 Andreas Gerstmayr <agerstmayr@redhat.com> 7.3.6-2
 - change working dir to $GRAFANA_HOME in grafana-cli wrapper (fixes Red Hat BZ #1916083)
 - add pcp-redis-datasource to allow_loading_unsigned_plugins config option
@ -1026,17 +1148,24 @@ OPENSSL_FORCE_FIPS_MODE=1 GOLANG_FIPS=1 go test -v ./pkg/util -run TestEncryptio

 * Wed Nov 25 2020 Andreas Gerstmayr <agerstmayr@redhat.com> 7.3.4-1
 - update to 7.3.4 tagged upstream community sources, see CHANGELOG
- bundle golang dependencies
+
+* Tue Nov 10 2020 Andreas Gerstmayr <agerstmayr@redhat.com> 7.3.1-1
+- update to 7.3.1 tagged upstream community sources, see CHANGELOG
 - optionally bundle node.js dependencies and build and test frontend as part of the specfile
- merge all datasources into main grafana package
- change default provisioning path to /etc/grafana/provisioning
+- change default provisioning path to /etc/grafana/provisioning (changed in version 7.1.1-1)
 - resolve https://bugzilla.redhat.com/show_bug.cgi?id=1843170

-* Thu Aug 20 2020 Andreas Gerstmayr <agerstmayr@redhat.com> 6.7.4-3
- apply patch for CVE-2020-13430 also to sources, not only to compiled webpack
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 7.1.1-2
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

-* Wed Aug 19 2020 Andreas Gerstmayr <agerstmayr@redhat.com> 6.7.4-2
- security fix for CVE-2020-13430
+* Thu Jul 30 2020 Andreas Gerstmayr <agerstmayr@redhat.com> 7.1.1-1
+- update to 7.1.1 tagged upstream community sources, see CHANGELOG
+- merge all datasources into main grafana package
+- bundle golang dependencies
+
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 6.7.4-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

 * Fri Jun 05 2020 Andreas Gerstmayr <agerstmayr@redhat.com> 6.7.4-1
 - update to 6.7.4 tagged upstream community sources, see CHANGELOG