Since grafana-10.2.6-4.fc41 build, the grafana-server service runs as unconfined type. This is a regression from the previous build. This issue does not appear on grafana-10.2.6-4.fc40 (and F40) build. Reproducible: Always Steps to Reproduce: 1. Install grafana-10.2.6-4.fc41 on rawhide 2. Start the grafana-server service # systemctl start grafana-server 3. Check if the service is unconfined # ps -efZ | grep grafana-server Actual Results: system_u:system_r:unconfined_service_t:s0 grafana 1886 1 0 14:18 ? 00:00:01 /usr/sbin/grafana server --config=/etc/grafana/grafana.ini --pidfile=/var/run/grafana/grafana-server.pid --packaging=rpm cfg:default.paths.logs=/var/log/grafana cfg:default.paths.data=/var/lib/grafana cfg:default.paths.plugins=/var/lib/grafana/plugins cfg:default.paths.provisioning=/etc/grafana/provisioning unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 1942 1570 0 14:30 pts/0 00:00:00 grep --color=auto grafana-server Expected Results: system_u:system_r:grafana_t:s0 grafana 1704 1 14 14:34 ? 00:00:00 /usr/sbin/grafana server --config=/etc/grafana/grafana.ini --pidfile=/var/run/grafana/grafana-server.pid --packaging=rpm cfg:default.paths.logs=/var/log/grafana cfg:default.paths.data=/var/lib/grafana cfg:default.paths.plugins=/var/lib/grafana/plugins cfg:default.paths.provisioning=/etc/grafana/provisioning unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 1729 1534 0 14:35 pts/0 00:00:00 grep --color=auto grafana-server
After some discussion with selinux maintainers I was pointed to this Change: https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin which is causing the issue. As such, we need to extend the grafana selinux policy with the following records: /usr/bin/grafana-cli -- gen_context(system_u:object_r:grafana_exec_t,s0) /usr/bin/grafana-server -- gen_context(system_u:object_r:grafana_exec_t,s0)
Actually we need also a record for /usr/bin/grafana. So the complete list of rules will look like this: /usr/bin/grafana-cli -- gen_context(system_u:object_r:grafana_exec_t,s0) /usr/bin/grafana-server -- gen_context(system_u:object_r:grafana_exec_t,s0) /usr/bin/grafana -- gen_context(system_u:object_r:grafana_exec_t,s0) As a workaround, before the policy is extended, this works for me: cat << EOF > grafana_tmp.cil (filecon "/usr/bin/grafana-cli" file (system_u object_r grafana_exec_t ((s0) (s0)))) (filecon "/usr/bin/grafana-server" file (system_u object_r grafana_exec_t ((s0) (s0)))) (filecon "/usr/bin/grafana" file (system_u object_r grafana_exec_t ((s0) (s0)))) EOF sudo semodule -i grafana_tmp.cil
Fixed in grafana-10.2.6-5.fc41 build.
This bug appears to have been reported against 'rawhide' during the Fedora Linux 42 development cycle. Changing version to 42.