From 01a9b198353ec634ba85344eca9d707b91920f35 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ois=C3=ADn=20Kyne?= Date: Mon, 26 Oct 2026 15:30:49 +0000 Subject: [PATCH] grafana: allow the plugins Grafana 13 preinstalls in security-check.sh Grafana 13 downloads and keeps updating 18 plugins on every start, including core datasources it now ships separately (prometheus, tempo, elasticsearch, ...). On an untouched pre-hardening install, 12 of them are in data/grafana/plugins, so the check reported 8 false findings and asked every upgraded operator to email security@obol.tech. Use Grafana's full preinstall list, taken from the "Installing plugins" line in Grafana 13.2.4's startup log. An untouched v0.3.11 install now reports no issues, while a planted service account and plugin are still flagged. Co-Authored-By: Claude Opus 5.5 --- grafana/security-check.sh | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/grafana/security-check.sh b/grafana/security-check.sh index 0e2f6e51..bf025fc8 100755 --- a/grafana/security-check.sh +++ b/grafana/security-check.sh @@ -14,8 +14,12 @@ set -uo pipefail DB="${GRAFANA_DB:-data/grafana/grafana.db}" PLUGINS_DIR="${GRAFANA_PLUGINS_DIR:-data/grafana/plugins}" EXPECTED_DATASOURCES="Prometheus Loki Tempo" -# Grafana Labs apps that Grafana preinstalls itself. -EXPECTED_PLUGINS="grafana-lokiexplore-app grafana-exploretraces-app grafana-metricsdrilldown-app grafana-pyroscope-app" +# Plugins that Grafana 13 preinstalls and keeps updated in data/grafana/plugins by itself, including core +# datasources that Grafana now ships as separate plugins. See "Installing plugins" in Grafana's startup log. +EXPECTED_PLUGINS="elasticsearch grafana-advisor-app grafana-exploretraces-app grafana-lokiexplore-app +grafana-metricsdrilldown-app grafana-postgresql-datasource grafana-pyroscope-app grafana-pyroscope-datasource +influxdb jaeger loki mssql mysql opentsdb prometheus stackdriver tempo zipkin" +EXPECTED_PLUGINS="${EXPECTED_PLUGINS//$'\n'/ }" findings=0 warn() {