Backend plugins: Unsigned external plugins should not be loaded by default

[bergquist]

Unsigned external plugins should not be loaded by default since it can be considered a security issue. Grafana should provide a setting to override this behavior for specified plugins.

External plugins means plugins installed into the plugins directory (configured via paths.plugins).

EX

[plugins]
allow_loading_unsigned_plugins = "plugin1, plugin2, plugin3"

Note by Arve:
According to @ryantxu we should only validate the signatures of back-end plugins for now.

[Shannanigans]

@bergquist As I am quite new to Grafana I am unsure, but it would seem that the backend plugin tutorial does not account for this recent update.

https://grafana.com/tutorials/build-a-data-source-backend-plugin/#3

Which I believe is now the cause of:

t=2020-05-21T16:04:21+0000 lvl=eror msg="Failed to load plugin" logger=plugins error="plugin \"myorg-my-backend-data-source-plugin\" is unsigned" pluginPath=/var/lib/grafana/plugins/my-backend-data-source-plugin/dist

[aknuds1]

@Shannanigans thanks for reporting that, it does look as if it needs to be updated. Would you mind creating an issue for updating the tutorial?

[Shannanigans]

@aknuds1 Am I correct in assuming that the issue should be created in the tutorials repo?

[aknuds1]

@Shannanigans That looks correct to me. BTW you can use the setting plugins.allow_loading_unsigned_plugins to allow loading your plugin without having signed it first (we don't have support for signing community plugins yet).

[Shannanigans]

In case anyone lands here with a similar issue and is using docker you can add you plugin to the unsigned whitelist like so:

docker run -d \
-p 3000:3000 \
-v "$(pwd)"/grafana-plugins:/var/lib/grafana/plugins \
--name=grafana \
-e "GF_PLUGINS_ALLOW_LOADING_UNSIGNED_PLUGINS=myorg-my-backend-data-source-plugin" \
grafana/grafana

Plugin config docs
Configuration via env vars

[laurianops]

None of the above options work, whoever has this problem will have to add the environment variables like this:
<-e "GF_INSTALL_PLUGINS = alexanderzobnin-zabbix-app" -e "GF_PLUGINS_ALLOW_LOADING_UNSIGNED_PLUGINS = alexanderzobnin-zabbix-datasource">

[jadbaz]

@LaurianoElmiroDuarte you're a lifesaver
It just so happens I'm actually looking for this exact plugin
Thanks a million!

[laurianops]

I found this topic yesterday, hugs

…

On Fri, Aug 28, 2020 at 10:01 AM Jad Baz ***@***.***> wrote: @LaurianoElmiroDuarte <https://github.com/LaurianoElmiroDuarte> you're a lifesaver It just so happens I'm actually looking for this exact plugin Thanks a million! — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#24027 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFBBWIQGRMMLT5DDTL63LI3SC6TBFANCNFSM4MTOJ3HQ> .

[jfelpel]

@LaurianoElmiroDuarte How would I add those environment variables when running grafana installed on centos8?

I am running into the same issue with it not loading the zabbix plugin, and like you, nothing I have tried from these forums has worked...

Thoughts? Ideas?

-JF

[laurianops]

do like this: docker run -d -p 3000:3000 --name=grafana -e "GF_INSTALL_PLUGINS=alexanderzobnin-zabbix-app" -e "GF_PLUGINS_ALLOW_LOADING_UNSIGNED_PLUGINS=alexanderzobnin-zabbix-datasource" -v dados:/var/lib/grafana grafana/grafana

…

On Mon, Aug 31, 2020 at 3:39 PM Jeremy Felpel ***@***.***> wrote: @LaurianoElmiroDuarte <https://github.com/LaurianoElmiroDuarte> How would I add those environment variables when running grafana installed on centos8? I am running into the same issue with it not loading the zabbix plugin, and like you, nothing I have tried from these forums has worked... Thoughts? Ideas? -JF — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#24027 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFBBWIT43DUPI7W6KDBMBRTSDPU6XANCNFSM4MTOJ3HQ> .

[jczinger]

adding the following to /var/grafana/grafana.ini in the [plugins] section is how I did it on a non-docker install.
allow_loading_unsigned_plugins=NAME_OF_PLUGIN

Here is my log entry before making the change:

sudo cat /var/log/grafana/grafana.log | grep zabbix
t=2020-09-04T15:31:38-0600 lvl=eror msg="Failed to load plugin" logger=plugins error="plugin \"alexanderzobnin-zabbix-datasource\" is unsigned" pluginPath=/var/lib/grafana/plugins/dist/alexanderzobnin-zabbix-app/datasource-zabbix
t=2020-09-04T15:31:38-0600 lvl=warn msg="Some plugins failed to load" logger=plugins errors="[plugin \"alexanderzobnin-zabbix-datasource\" is unsigned]"

And after:

sudo cat /var/log/grafana/grafana.log | grep zabbix
t=2020-09-04T15:33:46-0600 lvl=warn msg="Running an unsigned backend plugin" logger=plugins pluginID=alexanderzobnin-zabbix-datasource pluginDir=/var/lib/grafana/plugins/dist/alexanderzobnin-zabbix-app/datasource-zabbix
t=2020-09-04T15:33:47-0600 lvl=info msg=Profiler logger=plugins.backend pluginId=alexanderzobnin-zabbix-datasource enabled=false

The datasource showed up after this.

[dlopes7]

Any news about allowing the community to sign plugins?

[MohdRashid01]

How to pass this command <-e "GF_INSTALL_PLUGINS = grafana-kubernetes-app" -e "GF_PLUGINS_ALLOW_LOADING_UNSIGNED_PLUGINS = grafana-kubernetes-app"> in Kubernetes grafana.yaml file