Hi,

I found some issues with the policy when playing around with Grafana and SELINUX,
but was able to solve/circumvent the issues.

My configuration uses Grafana with icinga2/icingaweb and with influxdb as backend;
Grafana sesssion/dashboards/settings are stored in mysql.

My modifications to your policy 1.0.0.0:
gen_require(`
type httpd_t;
type mysqld_port_t;
type devlog_t;
type fonts_t;
type fs_t;
type ld_so_cache_t;
type locale_t;
type usr_t;
type unreserved_port_t;
class file entrypoint;
')
..

MG: 00 - fixes connection with mysql

allow grafanad_t kernel_t:system module_request;
allow grafanad_t mysqld_port_t:tcp_socket name_connect;
allow grafanad_t self:netlink_route_socket { bind create getattr nlmsg_read };

MG: 01 - fixes grafana logging to syslog

allow grafanad_t devlog_t:sock_file write;

MG: 02 - phantomjs binary execution

note: /usr/share/grafana/tools/phantomjs/phantomjs needs relabeling

allow grafanad_t usr_t:file execute;
allow grafanad_t fonts_t:file execute;
allow grafanad_t grafanad_port_t:tcp_socket name_connect;
allow grafanad_t fs_t:filesystem getattr;
allow grafanad_t ld_so_cache_t:file execute;
allow grafanad_t locale_t:file execute;
allow grafanad_t self:process { execmem setrlimit };

MG: 03 - grafana connect to itself

allow grafanad_t unreserved_port_t:tcp_socket name_connect;

If you need further info about my setting -please contact me.

regards

MG

Hi!

I am working on developing a selinux policy for grafana and this seemed like a good spot to start. Is there interest in collaborating on this?