{"id":25791154,"url":"https://github.com/performancecopilot/grafana-selinux","last_synced_at":"2026-02-13T17:04:50.967Z","repository":{"id":195614188,"uuid":"693287211","full_name":"performancecopilot/grafana-selinux","owner":"performancecopilot","description":null,"archived":false,"fork":false,"pushed_at":"2025-12-04T16:32:08.000Z","size":40,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2026-02-12T06:58:36.359Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/performancecopilot.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-09-18T18:12:50.000Z","updated_at":"2025-12-04T16:32:13.000Z","dependencies_parsed_at":"2024-04-17T05:21:14.324Z","dependency_job_id":"90c95050-f734-45f5-a37a-e922d8c0810c","html_url":"https://github.com/performancecopilot/grafana-selinux","commit_stats":{"total_commits":35,"total_committers":3,"mean_commits":"11.666666666666666","dds":0.4,"last_synced_commit":"ae90d33869108d50d6131aae65635aff0c94522c"},"previous_names":["performancecopilot/grafana-selinux"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/performancecopilot/grafana-selinux","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/performancecopilot%2Fgrafana-selinux","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/performancecopilot%2Fgrafana-selinux/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/performancecopilot%2Fgrafana-selinux/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/performancecopilot%2Fgrafana-selinux/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/performancecopilot","download_url":"https://codeload.github.com/performancecopilot/grafana-selinux/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/performancecopilot%2Fgrafana-selinux/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29412673,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-13T06:24:03.484Z","status":"ssl_error","status_checked_at":"2026-02-13T06:23:12.830Z","response_time":78,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-02-27T12:54:48.121Z","updated_at":"2026-02-13T17:04:50.951Z","avatar_url":"https://github.com/performancecopilot.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# grafana-selinux\n\nGrafana selinux policy module for CentOS 7 and RHEL 7. Recently updated to CentOS Stream 9 - Grafana 10.0.3-1.\n\nAt present, from my testing this should be working for all basic functions of Grafana. This hasn't been extensively tested(at present. I will change this when I do) by me and should be considered in an early beta state.\n\nThe policy assumes that you used the rpm from Grafana to install it. Thus all the file locations should adhere to the rpm or make sure to change them as needed.\n\n\n### Untested:\n* Anything outside the scope of using it at the most basic level - keep an eye on that AVC log!\n\n### Future considerations:\n* Add a grafana_plugin_t label to contain plugins.\n\n\n## Installation\n```sh\n# Clone the repo\ngit clone https://github.com/performancecopilot/grafana-selinux.git\n\n# Copy relevant .if interface file to /usr/share/selinux/devel/include to expose them when building and for future modules.\n# May need to use full path for grafana.if if not working.\ninstall -Dp -m 0664 -o root -g root grafana.if /usr/share/selinux/devel/include/myapplications/grafana.if\n\n# Compile the selinux module (see below)\n\n# Install the SELinux policy module. Compile it before hand to ensure proper compatibility (see below)\nsemodule -i grafana.pp\n\n# Add grafana ports\nsemanage port -a -t grafana_port_t -p tcp 3000\n\n# Restore all the correct context labels\nrestorecon -RvF /usr/sbin/grafana* \\\n\t\t/etc/grafana \\\n\t\t/var/log/grafana \\\n\t\t/var/lib/grafana \\\n\t\t/usr/libexec/grafana-pcp \\\n#\t\t/usr/share/performancecopilot-pcp-app \\\n\n# Start grafana\nsystemctl start grafana-server.service\n\n# Ensure it's working in the proper confinement\nps -eZ | grep grafana\n```\n\n## How To Compile The Module Locally (Needed before installing)\nEnsure you have the `selinux-policy-devel` package installed.\n```sh\n# Ensure you have the devel packages\nyum install selinux-policy-devel setools-console\n# Change to the directory containing the .if, .fc \u0026 .te files\ncd grafana-selinux\nmake -f /usr/share/selinux/devel/Makefile grafana.pp\nsemodule -i grafana.pp\n```\n\n## Debugging and Troubleshooting\n\n* If you're getting permission errors, uncomment permissive in the .te file and try again. Re-check logs for any issues. Or `semanage permissive -a grafana_t`\n* Easy way to add in allow rules is the below command, then copy or redirect into the .te module. Rebuild and re-install:\n* Don't forget to actually look at what is suggested. audit2allow will most likely go for a coarse grained permission!\n\n```sh\nausearch -m avc,user_avc,selinux_err -ts recent | audit2allow -R\n```\nIf you get a could not open interface info [/var/lib/sepolgen/interface_info] error. \nEnsure policycoreutils-devel is installed and/or run: `sepolgen-ifgen`\n\n## Removing the policy\n\n* When removing the policy, first stop the grafana-server\n```sh\nsystemctl stop grafana-server\n```\n* To remove the policy, the added port must first be removed\n```sh\nsudo semanage port -d -p tcp 3000\n```\n* Now, to remove the policy run\n```sh\nsudo semodule -r grafana\n```\n* Restore the contexts of the files\n```sh\nrestorecon -RvF /usr/sbin/grafana* \\\n\t\t/etc/grafana \\\n\t\t/var/log/grafana \\\n\t\t/var/lib/grafana \\\n\t\t/usr/libexec/grafana-pcp \\\n#\t\t/usr/share/performancecopilot-pcp-app\n```\n* Restart grafana-server\n```sh\nsystemctl restart grafana-server\n```\n## Compatibility Notes\nBuilt on CentOS Stream 9 at the time with:\n```\nselinux-policy-38.1.20-1.el9.noarch\nselinux-policy-targeted-38.1.20-1.el9.noarch\nselinux-policy-devel-38.1.20-1.el9.noarch\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fperformancecopilot%2Fgrafana-selinux","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fperformancecopilot%2Fgrafana-selinux","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fperformancecopilot%2Fgrafana-selinux/lists"}