diff --git a/.fmf/version b/.fmf/version deleted file mode 100644 index d00491f..0000000 --- a/.fmf/version +++ /dev/null @@ -1 +0,0 @@ -1 diff --git a/.gitignore b/.gitignore index cf2dbe2..b594754 100644 --- a/.gitignore +++ b/.gitignore @@ -67,60 +67,4 @@ zabbix-1.8.2.tar.gz /zabbix-4.0.16.tar.gz /zabbix-4.0.19.tar.gz /zabbix-4.0.22.tar.gz -/zabbix-5.0.2.tar.gz -/zabbix-5.0.3.tar.gz -/zabbix-5.0.6.tar.gz -/zabbix-5.0.7.tar.gz -/zabbix-5.0.8.tar.gz -/zabbix-5.0.9.tar.gz -/zabbix-5.0.10.tar.gz -/zabbix-5.0.14.tar.gz -/zabbix-5.0.16.tar.gz -/zabbix-5.0.17.tar.gz -/zabbix-5.0.18.tar.gz -/zabbix-5.0.19.tar.gz -/zabbix-5.0.21.tar.gz -/zabbix-6.0.2.tar.gz -/zabbix-6.0.3.tar.gz -/zabbix-6.0.4.tar.gz -/zabbix-6.0.5.tar.gz -/zabbix-6.0.6.tar.gz -/zabbix-6.0.8.tar.gz -/zabbix-6.0.12.tar.gz -/zabbix-6.0.13.tar.gz -/zabbix-6.0.14.tar.gz -/zabbix-6.0.15.tar.gz -/zabbix-6.0.16.tar.gz -/zabbix-6.0.17.tar.gz -/zabbix-6.0.18.tar.gz -/zabbix-6.0.19.tar.gz -/zabbix-6.0.20.tar.gz -/zabbix-6.0.22.tar.gz -/zabbix-6.0.25.tar.gz -/zabbix-6.0.27.tar.gz -/zabbix-6.0.29.tar.gz -/zabbix-6.0.30.tar.gz -/zabbix-6.0.33.tar.gz -/zabbix-7.0.2.tar.gz -/zabbix-7.0.3.tar.gz -/zabbix-7.0.4.tar.gz -/zabbix-7.0.5.tar.gz -/zabbix-7.0.6.tar.gz -/zabbix-7.2.0.tar.gz -/zabbix-7.2.2.tar.gz -/zabbix-7.2.5.tar.gz -/zabbix-7.2.9.tar.gz -/zabbix-7.2.10.tar.gz -/zabbix-7.2.11.tar.gz -/zabbix-7.4.1.tar.gz -/zabbix-7.4.2.tar.gz -/zabbix-7.4.3.tar.gz -/zabbix-7.4.4.tar.gz -/zabbix-7.4.5.tar.gz -/zabbix-7.4.6.tar.gz -/zabbix-7.4.7.tar.gz -/zabbix-7.4.8.tar.gz -/zabbix-7.4.9.tar.gz -/zabbix-7.4.12.tar.gz -/zabbix-7.4.13.tar.gz -/zabbix-7.4.14.tar.gz +/zabbix-4.0.27.tar.gz diff --git a/plans/dsp.fmf b/plans/dsp.fmf deleted file mode 100644 index 9fefb8a..0000000 --- a/plans/dsp.fmf +++ /dev/null @@ -1,22 +0,0 @@ -summary: DSP test suite -discover: - - name: DSP_test - how: fmf - url: https://github.com/fedora-selinux/DSP_test.git - ref: main - -execute: - how: tmt - -environment: - trigger: FedoraCI - # DSP_test specific variables: - TEST_RPM: "zabbix-selinux" - TEST_POLICY: "zabbix" - -prepare: - how: install - package: - - zabbix-selinux - - autoconf - - automake diff --git a/sources b/sources index 5e8c08d..b50ae85 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (zabbix-7.4.14.tar.gz) = 98b26bfcd3b1803b23d85af70094fe875d138263cabbc4f6fa5c63ea9b07c4bedaa86eeed79ede74919f55515d6c17408391ea999ed204948320dc8ec29bbdc6 +SHA512 (zabbix-4.0.27.tar.gz) = 54690dd778d09d7309c2e2ea3f0bfc6053ef097888bfccd140484e4677766ded829757eb4dfde7da8ce19335307ddbfbb1c132feabc13cc6727a6d28c1591cfa diff --git a/zabbix-4.0.3-config.patch b/zabbix-4.0.3-config.patch new file mode 100644 index 0000000..5c82b48 --- /dev/null +++ b/zabbix-4.0.3-config.patch @@ -0,0 +1,57 @@ +diff --git a/frontends/php/include/classes/core/CConfigFile.php b/frontends/php/include/classes/core/CConfigFile.php +index 091ff50..8c76c27 100644 +--- a/frontends/php/include/classes/core/CConfigFile.php ++++ b/frontends/php/include/classes/core/CConfigFile.php +@@ -24,7 +24,7 @@ class CConfigFile { + const CONFIG_NOT_FOUND = 1; + const CONFIG_ERROR = 2; + +- const CONFIG_FILE_PATH = '/conf/zabbix.conf.php'; ++ const CONFIG_FILE_PATH = '/etc/zabbix/web/zabbix.conf.php'; + + private static $supported_db_types = [ + ZBX_DB_DB2 => true, +diff --git a/frontends/php/include/classes/core/ZBase.php b/frontends/php/include/classes/core/ZBase.php +index 5a867f2..59bf522 100644 +--- a/frontends/php/include/classes/core/ZBase.php ++++ b/frontends/php/include/classes/core/ZBase.php +@@ -273,7 +273,7 @@ class ZBase { + * @throws Exception + */ + protected function setMaintenanceMode() { +- require_once $this->getRootDir().'/conf/maintenance.inc.php'; ++ require_once '/etc/zabbix/web/maintenance.inc.php'; + + if (defined('ZBX_DENY_GUI_ACCESS')) { + $user_ip = (isset($_SERVER['HTTP_X_FORWARDED_FOR']) && !empty($_SERVER['HTTP_X_FORWARDED_FOR'])) +@@ -289,7 +289,7 @@ class ZBase { + * Load zabbix config file. + */ + protected function loadConfigFile() { +- $configFile = $this->getRootDir().CConfigFile::CONFIG_FILE_PATH; ++ $configFile = CConfigFile::CONFIG_FILE_PATH; + $config = new CConfigFile($configFile); + $this->config = $config->load(); + } +diff --git a/frontends/php/include/classes/setup/CSetupWizard.php b/frontends/php/include/classes/setup/CSetupWizard.php +index e2e9756..7ad9190 100644 +--- a/frontends/php/include/classes/setup/CSetupWizard.php ++++ b/frontends/php/include/classes/setup/CSetupWizard.php +@@ -333,7 +333,7 @@ class CSetupWizard extends CForm { + function stage5() { + $this->setConfig('ZBX_CONFIG_FILE_CORRECT', true); + +- $config_file_name = Z::getInstance()->getRootDir().CConfigFile::CONFIG_FILE_PATH; ++ $config_file_name = CConfigFile::CONFIG_FILE_PATH; + $config = new CConfigFile($config_file_name); + $config->config = [ + 'DB' => [ +@@ -502,7 +502,7 @@ class CSetupWizard extends CForm { + // make zabbix.conf.php downloadable + header('Content-Type: application/x-httpd-php'); + header('Content-Disposition: attachment; filename="'.basename(CConfigFile::CONFIG_FILE_PATH).'"'); +- $config = new CConfigFile(Z::getInstance()->getRootDir().CConfigFile::CONFIG_FILE_PATH); ++ $config = new CConfigFile(CConfigFile::CONFIG_FILE_PATH); + $config->config = [ + 'DB' => [ + 'TYPE' => $this->getConfig('DB_TYPE'), diff --git a/zabbix-config.patch b/zabbix-config.patch deleted file mode 100644 index 5d61074..0000000 --- a/zabbix-config.patch +++ /dev/null @@ -1,48 +0,0 @@ -diff --git a/ui/include/classes/core/CConfigFile.php b/ui/include/classes/core/CConfigFile.php -index d7ad93a..88b7d5f 100644 ---- a/ui/include/classes/core/CConfigFile.php -+++ b/ui/include/classes/core/CConfigFile.php -@@ -20,7 +20,7 @@ class CConfigFile { - const CONFIG_ERROR = 2; - const CONFIG_VAULT_ERROR = 3; - -- const CONFIG_FILE_PATH = '/conf/zabbix.conf.php'; -+ const CONFIG_FILE_PATH = '/etc/zabbix/web/zabbix.conf.php'; - - private static $supported_db_types = [ - ZBX_DB_MYSQL => true, -diff --git a/ui/include/classes/core/ZBase.php b/ui/include/classes/core/ZBase.php -index 51b2165..e57e5a8 100644 ---- a/ui/include/classes/core/ZBase.php -+++ b/ui/include/classes/core/ZBase.php -@@ -392,7 +392,7 @@ class ZBase { - * @throws Exception - */ - protected function setMaintenanceMode() { -- require_once 'conf/maintenance.inc.php'; -+ require_once '/etc/zabbix/web/maintenance.inc.php'; - - if (defined('ZBX_DENY_GUI_ACCESS')) { - if (!isset($ZBX_GUI_ACCESS_IP_RANGE) || !in_array(CWebUser::getIp(), $ZBX_GUI_ACCESS_IP_RANGE)) { -@@ -405,7 +405,7 @@ class ZBase { - * Load zabbix config file. - */ - protected function loadConfigFile(): void { -- $configFile = $this->root_dir.CConfigFile::CONFIG_FILE_PATH; -+ $configFile = CConfigFile::CONFIG_FILE_PATH; - - $config = new CConfigFile($configFile); - -diff --git a/ui/include/classes/setup/CSetupWizard.php b/ui/include/classes/setup/CSetupWizard.php -index 8574868..79d0c72 100644 ---- a/ui/include/classes/setup/CSetupWizard.php -+++ b/ui/include/classes/setup/CSetupWizard.php -@@ -328,7 +328,7 @@ class CSetupWizard extends CForm { - // make zabbix.conf.php downloadable - header('Content-Type: application/x-httpd-php'); - header('Content-Disposition: attachment; filename="'.basename(CConfigFile::CONFIG_FILE_PATH).'"'); -- $config = new CConfigFile(APP::getRootDir().CConfigFile::CONFIG_FILE_PATH); -+ $config = new CConfigFile(CConfigFile::CONFIG_FILE_PATH); - $config->config = [ - 'DB' => [ - 'TYPE' => $this->getConfig('DB_TYPE'), diff --git a/zabbix-configure-sscanf.patch b/zabbix-configure-sscanf.patch deleted file mode 100644 index 8117635..0000000 --- a/zabbix-configure-sscanf.patch +++ /dev/null @@ -1,17 +0,0 @@ -sscanf needs for the prototype. Submitted upstream here: - - - -diff --git a/configure.ac b/configure.ac -index 0588004f9f89cdd5..bbc60e3a28369f9f 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -952,6 +952,7 @@ dnl FreeBSD 4.x does not support %llu - AC_MSG_CHECKING(for long long format) - AC_RUN_IFELSE([AC_LANG_SOURCE([[ - #include -+#include - int main() - { - uint64_t i; - diff --git a/zabbix-crypto-policy.patch b/zabbix-crypto-policy.patch deleted file mode 100644 index 4f9f49a..0000000 --- a/zabbix-crypto-policy.patch +++ /dev/null @@ -1,44 +0,0 @@ -diff --git a/src/go/pkg/tls/tls.go b/src/go/pkg/tls/tls.go -index b7ddff4..063eb02 100644 ---- a/src/go/pkg/tls/tls.go -+++ b/src/go/pkg/tls/tls.go -@@ -406,6 +406,8 @@ static void *tls_new_context(const char *ca_file, const char *crl_file, const ch - #endif - if (NULL != cipher) - ciphers = cipher; -+ else -+ ciphers = "PROFILE=SYSTEM"; - - if (1 != SSL_CTX_set_cipher_list(ctx, ciphers)) - goto out; -diff --git a/src/libs/zbxcomms/tls_openssl.c b/src/libs/zbxcomms/tls_openssl.c -index 40394a3..b2eb0f0 100644 ---- a/src/libs/zbxcomms/tls_openssl.c -+++ b/src/libs/zbxcomms/tls_openssl.c -@@ -1212,7 +1212,7 @@ void zbx_tls_init_child(const zbx_config_tls_t *config_tls, zbx_get_program_type - goto out; - } - } -- else if (1 != SSL_CTX_set_cipher_list(ctx_cert, ciphers)) -+ else if (1 != SSL_CTX_set_cipher_list(ctx_cert, "PROFILE=SYSTEM")) - { - zbx_snprintf_alloc(&error, &error_alloc, &error_offset, "cannot set list of certificate" - " ciphersuites:"); -@@ -1302,7 +1302,7 @@ void zbx_tls_init_child(const zbx_config_tls_t *config_tls, zbx_get_program_type - goto out; - } - } -- else if (1 != SSL_CTX_set_cipher_list(ctx_psk, ciphers)) -+ else if (1 != SSL_CTX_set_cipher_list(ctx_psk, "PROFILE=SYSTEM")) - { - zbx_snprintf_alloc(&error, &error_alloc, &error_offset, "cannot set list of PSK ciphersuites:"); - goto out; -@@ -1360,7 +1360,7 @@ void zbx_tls_init_child(const zbx_config_tls_t *config_tls, zbx_get_program_type - goto out; - } - } -- else if (1 != SSL_CTX_set_cipher_list(ctx_all, ciphers)) -+ else if (1 != SSL_CTX_set_cipher_list(ctx_all, "PROFILE=SYSTEM")) - { - zbx_snprintf_alloc(&error, &error_alloc, &error_offset, "cannot set list of all ciphersuites:"); - goto out; diff --git a/zabbix-drop-des.patch b/zabbix-drop-des.patch deleted file mode 100644 index 41fbe5b..0000000 --- a/zabbix-drop-des.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 2d5e3532b2313e9c70e5125101bc27c99115a85d Mon Sep 17 00:00:00 2001 -From: Morten Stevens -Date: Mon, 26 Jul 2021 10:17:48 +0200 -Subject: [PATCH] Drop support for usmDESPrivProtocol - ---- - src/zabbix_server/poller/checks_snmp.c | 5 ----- - 1 file changed, 5 deletions(-) - -diff --git a/src/zabbix_server/poller/checks_snmp.c b/src/zabbix_server/poller/checks_snmp.c -index 40d6eb23699..17f668eeb28 100644 ---- a/src/zabbix_server/poller/checks_snmp.c -+++ b/src/zabbix_server/poller/checks_snmp.c -@@ -568,11 +568,6 @@ static struct snmp_session *zbx_snmp_open_session(const DC_ITEM *item, char *err - - switch (item->snmpv3_privprotocol) - { -- case ITEM_SNMPV3_PRIVPROTOCOL_DES: -- /* set the privacy protocol to DES */ -- session.securityPrivProto = usmDESPrivProtocol; -- session.securityPrivProtoLen = USM_PRIV_PROTO_DES_LEN; -- break; - case ITEM_SNMPV3_PRIVPROTOCOL_AES: - /* set the privacy protocol to AES */ - session.securityPrivProto = usmAESPrivProtocol; diff --git a/zabbix-fedora-epel.README b/zabbix-fedora-epel.README index 38268ad..1ffecb5 100644 --- a/zabbix-fedora-epel.README +++ b/zabbix-fedora-epel.README @@ -99,7 +99,14 @@ ownership. ==No Java bridge== -The Zabbix Java bridge can not be included now, due to missing dependencies. +The Zabbix Java bridge can not be included now, due to legal issue with one of +the modules (json). See https://support.zabbix.com/browse/ZBX-4800 and feel free +to vote on it. + + +==No SQLite front-end or server implementation== + +Sadly it doesn't work with how Fedora's/EPEL's PHP is compiled. =SELinux= @@ -127,7 +134,6 @@ If you're using ping from the frontend: echo "avc: denied { setpgid } for pid=31880 comm="zabbix_server_p" scontext=system_u:system_r:zabbix_t:s0 tcontext=system_u:system_r:zabbix_t:s0 tclass=process" | audit2allow -M zabbix_ping_frontend; sudo semodule -i zabbix_ping_frontend.pp - =Additional packaging changes in Fedora/EPEL since 3.0= ==Configuration files contain the actual defaults== @@ -214,4 +220,24 @@ Be sure to read the upgrades notes of the latest minor release too! The schema conversion should finish within minutes or hours +=Guide for upgrading to 2.0 from 1.8= + +https://www.zabbix.com/documentation/2.0/manual/installation/upgrade_notes?s[]=upgrade&s[]=notes&s[]=2&s[]=0 + +Be sure to read the upgrades notes of the latest minor release too! + +The below should be the relevant steps, picked from +http://www.zabbix.com/documentation/2.0/manual/installation/upgrade + +- Review all rpmnew and rpmsave files; merge where necessary +- Review permissions, ownerships and group memberships for zabbixsrv +- Back up the Zabbix database (really!) +- Remove custom database changes, if any +- Make sure the database user has sufficing permissions + (ALTER TABLE, DROP INDEX, DROP TABLE, ...) +- Run the fitting database update script/s +- The scripts can run very long, depending on the content of your database and + your hardware; +- Check the output of the script for errors + Volker Fröhlich volker27@gmx.at Jan 5 2013 diff --git a/zabbix-out-of-tree.patch b/zabbix-out-of-tree.patch deleted file mode 100644 index b584193..0000000 --- a/zabbix-out-of-tree.patch +++ /dev/null @@ -1,157 +0,0 @@ -diff --git a/src/go/Makefile.am b/src/go/Makefile.am -index 3e24aa0..308e34b 100644 ---- a/src/go/Makefile.am -+++ b/src/go/Makefile.am -@@ -89,9 +90,9 @@ install-bin/zabbix_agent2: bin/zabbix_agent2 - $(INSTALL) -d "$(DESTDIR)$(sbindir)" - $(INSTALL_PROGRAM) bin/zabbix_agent2 "$(DESTDIR)$(sbindir)" - $(INSTALL) -d "$(DESTDIR)$(AGENT2_PLUGIN_CONFIG_DIR)" -- $(INSTALL_DATA) conf/zabbix_agent2.conf "$(DESTDIR)$(sysconfdir)" -+ $(INSTALL_DATA) $(top_srcdir)/src/go/conf/zabbix_agent2.conf "$(DESTDIR)$(sysconfdir)" - $(INSTALL) -d "$(DESTDIR)$(AGENT2_PLUGIN_CONFIG_DIR)" -- (cd conf/zabbix_agent2.d/plugins.d && \ -+ (cd $(top_srcdir)/conf/zabbix_agent2.d/plugins.d && \ - for _f in *.conf; do \ - $(INSTALL_DATA) $${_f} "$(DESTDIR)$(AGENT2_PLUGIN_CONFIG_DIR)"; \ - done) -diff --git a/src/zabbix_agent/Makefile.am b/src/zabbix_agent/Makefile.am -index b217fb5..945a673 100644 ---- a/src/zabbix_agent/Makefile.am -+++ b/src/zabbix_agent/Makefile.am -@@ -69,4 +69,4 @@ zabbix_agentd_CFLAGS = \ - install-data-hook: - $(MKDIR_P) "$(DESTDIR)$(AGENT_CONFIG_FILE).d" - $(MKDIR_P) "$(DESTDIR)$(LOAD_MODULE_PATH)" -- test -f "$(DESTDIR)$(AGENT_CONFIG_FILE)" || cp "../../conf/zabbix_agentd.conf" "$(DESTDIR)$(AGENT_CONFIG_FILE)" -+ test -f "$(DESTDIR)$(AGENT_CONFIG_FILE)" || cp "$(top_srcdir)/conf/zabbix_agentd.conf" "$(DESTDIR)$(AGENT_CONFIG_FILE)" -diff --git a/src/zabbix_proxy/Makefile.am b/src/zabbix_proxy/Makefile.am -index b56f8a8..44800a0 100644 ---- a/src/zabbix_proxy/Makefile.am -+++ b/src/zabbix_proxy/Makefile.am -@@ -151,4 +151,4 @@ install-data-hook: - $(MKDIR_P) "$(DESTDIR)$(PROXY_CONFIG_FILE).d" - $(MKDIR_P) "$(DESTDIR)$(EXTERNAL_SCRIPTS_PATH)" - $(MKDIR_P) "$(DESTDIR)$(LOAD_MODULE_PATH)" -- test -f "$(DESTDIR)$(PROXY_CONFIG_FILE)" || cp "../../conf/zabbix_proxy.conf" "$(DESTDIR)$(PROXY_CONFIG_FILE)" -+ test -f "$(DESTDIR)$(PROXY_CONFIG_FILE)" || cp "$(top_srcdir)/conf/zabbix_proxy.conf" "$(DESTDIR)$(PROXY_CONFIG_FILE)" -diff --git a/src/zabbix_server/Makefile.am b/src/zabbix_server/Makefile.am -index 0a55934..a7f6a28 100644 ---- a/src/zabbix_server/Makefile.am -+++ b/src/zabbix_server/Makefile.am -@@ -186,4 +186,4 @@ install-data-hook: - $(MKDIR_P) "$(DESTDIR)$(EXTERNAL_SCRIPTS_PATH)" - $(MKDIR_P) "$(DESTDIR)$(ALERT_SCRIPTS_PATH)" - $(MKDIR_P) "$(DESTDIR)$(LOAD_MODULE_PATH)" -- test -f "$(DESTDIR)$(SERVER_CONFIG_FILE)" || cp "../../conf/zabbix_server.conf" "$(DESTDIR)$(SERVER_CONFIG_FILE)" -+ test -f "$(DESTDIR)$(SERVER_CONFIG_FILE)" || cp "$(top_srcdir)/conf/zabbix_server.conf" "$(DESTDIR)$(SERVER_CONFIG_FILE)" -diff -up zabbix-7.2.0/configure.ac.out-of-tree zabbix-7.2.0/configure.ac ---- zabbix-7.2.0/configure.ac.out-of-tree 2024-12-09 04:53:54.274588489 -0700 -+++ zabbix-7.2.0/configure.ac 2024-12-11 20:31:44.684746169 -0700 -@@ -22,7 +22,7 @@ AC_CONFIG_MACRO_DIR([m4]) - AC_CONFIG_SRCDIR([src/zabbix_server/server.c]) - AC_CONFIG_HEADERS([include/common/config.h]) - --AC_SUBST(DEFAULT_INCLUDES, ['-I$(top_srcdir)/include/common -I$(top_srcdir)/include']) -+AC_SUBST(DEFAULT_INCLUDES, ['-I$(top_builddir)/include/common -I$(top_srcdir)/include/common -I$(top_srcdir)/include']) - - AC_CANONICAL_BUILD - AC_CANONICAL_HOST ---- zabbix-7.4.3/src/go/Makefile.am~ 2025-10-01 09:49:27.351910250 -0500 -+++ zabbix-7.4.3/src/go/Makefile.am 2025-10-01 10:33:26.662210424 -0500 -@@ -64,6 +64,7 @@ - clean-go-build: - -$(GO) clean ./... - -$(GO) clean -cache -+ -$(GO) clean $(srcdir)/... - -rm -f bin/mock_server - -rm -f bin/zabbix_agent2 - -rm -f bin/zabbix_web_service ---- a/src/zabbix_java/Makefile.am~ 2026-07-07 09:04:30.341683492 -0500 -+++ b/src/zabbix_java/Makefile.am 2026-07-09 10:47:55.481651595 -0500 -@@ -9,23 +9,23 @@ - startup.sh - - ZJG = bin/zabbix-java-gateway-$(VERSION).jar --LIB = lib/android-json-4.3_r3.1.jar:lib/logback-core-1.5.16.jar:lib/logback-classic-1.5.16.jar:lib/slf4j-api-2.0.16.jar:lib/dnsjava-3.6.4.jar -+LIB = $(srcdir)lib/android-json-4.3_r3.1.jar:$(srcdir)lib/logback-core-1.5.16.jar:$(srcdir)lib/logback-classic-1.5.16.jar:$(srcdir)lib/slf4j-api-2.0.16.jar:$(srcdir)lib/dnsjava-3.6.4.jar - --JUNIT = tests/junit-4.8.2.jar -+JUNIT = $(srcdir)tests/junit-4.8.2.jar - - ZJG_DEST = $(DESTDIR)$(sbindir)/zabbix_java - - all: $(ZJG) - --$(ZJG): class src/com/zabbix/gateway/*.java -- $(JAVAC) -d class/src -classpath $(LIB) src/com/zabbix/gateway/*.java -+$(ZJG): class $(srcdir)src/com/zabbix/gateway/*.java -+ $(JAVAC) -d class/src -classpath $(LIB) $(srcdir)src/com/zabbix/gateway/*.java - $(JAR) cf $(ZJG) -C class/src . - - test: class - echo "badger useruser" > tests/com/zabbix/gateway/jmx_test_beans/jmxremote.password - chmod 600 tests/com/zabbix/gateway/jmx_test_beans/jmxremote.password -- $(JAVAC) tests/com/zabbix/gateway/jmx_test_beans/*.java -- $(JAVAC) -d class/tests -classpath class/src:$(JUNIT) tests/com/zabbix/gateway/*.java -+ $(JAVAC) tests/com/zabbix/gateway/jmx_$(srcdir)/test_beans/*.java -+ $(JAVAC) -d class/tests -classpath class/src:$(JUNIT) $(srcdir)tests/com/zabbix/gateway/*.java - java -classpath class/tests:$(LIB):$(ZJG):$(JUNIT) com.zabbix.gateway.AllTestRunner - - class: ---- a/src/zabbix_js/Makefile.am.orig 2026-07-09 10:49:49.036634968 -0500 -+++ b/src/zabbix_js/Makefile.am 2026-07-09 10:50:03.475753570 -0500 -@@ -5,30 +5,30 @@ - zabbix_js_SOURCES = zabbix_js.c - - zabbix_js_LDADD = \ -- $(top_srcdir)/src/libs/zbxlog/libzbxlog.a \ -- $(top_srcdir)/src/libs/zbxembed/libzbxembed.a \ -- $(top_srcdir)/src/libs/zbxjson/libzbxjson.a \ -- $(top_srcdir)/src/libs/zbxregexp/libzbxregexp.a \ -- $(top_srcdir)/src/libs/zbxthreads/libzbxthreads.a \ -- $(top_srcdir)/src/libs/zbxmutexs/libzbxmutexs.a \ -- $(top_srcdir)/src/libs/zbxprof/libzbxprof.a \ -- $(top_srcdir)/src/libs/zbxnix/libzbxnix.a \ -- $(top_srcdir)/src/libs/zbxcomms/libzbxcomms.a \ -- $(top_srcdir)/src/libs/zbxip/libzbxip.a \ -- $(top_srcdir)/src/libs/zbxgetopt/libzbxgetopt.a \ -- $(top_srcdir)/src/libs/zbxhash/libzbxhash.a \ -- $(top_srcdir)/src/libs/zbxcrypto/libzbxcrypto.a \ -- $(top_srcdir)/src/libs/zbxcompress/libzbxcompress.a \ -- $(top_srcdir)/src/libs/zbxhttp/libzbxhttp.a \ -- $(top_srcdir)/src/libs/zbxvariant/libzbxvariant.a \ -- $(top_srcdir)/src/libs/zbxxml/libzbxxml.a \ -- $(top_srcdir)/src/libs/zbxalgo/libzbxalgo.a \ -- $(top_srcdir)/src/libs/zbxstr/libzbxstr.a \ -- $(top_srcdir)/src/libs/zbxnum/libzbxnum.a \ -- $(top_srcdir)/src/libs/zbxtime/libzbxtime.a \ -- $(top_srcdir)/src/libs/zbxcommon/libzbxcommon.a \ -- $(top_srcdir)/src/libs/zbxbincommon/libzbxbincommon.a \ -- $(top_srcdir)/src/libs/zbxcurl/libzbxcurl.a -+ $(top_builddir)/src/libs/zbxlog/libzbxlog.a \ -+ $(top_builddir)/src/libs/zbxembed/libzbxembed.a \ -+ $(top_builddir)/src/libs/zbxjson/libzbxjson.a \ -+ $(top_builddir)/src/libs/zbxregexp/libzbxregexp.a \ -+ $(top_builddir)/src/libs/zbxthreads/libzbxthreads.a \ -+ $(top_builddir)/src/libs/zbxmutexs/libzbxmutexs.a \ -+ $(top_builddir)/src/libs/zbxprof/libzbxprof.a \ -+ $(top_builddir)/src/libs/zbxnix/libzbxnix.a \ -+ $(top_builddir)/src/libs/zbxcomms/libzbxcomms.a \ -+ $(top_builddir)/src/libs/zbxip/libzbxip.a \ -+ $(top_builddir)/src/libs/zbxgetopt/libzbxgetopt.a \ -+ $(top_builddir)/src/libs/zbxhash/libzbxhash.a \ -+ $(top_builddir)/src/libs/zbxcrypto/libzbxcrypto.a \ -+ $(top_builddir)/src/libs/zbxcompress/libzbxcompress.a \ -+ $(top_builddir)/src/libs/zbxhttp/libzbxhttp.a \ -+ $(top_builddir)/src/libs/zbxvariant/libzbxvariant.a \ -+ $(top_builddir)/src/libs/zbxxml/libzbxxml.a \ -+ $(top_builddir)/src/libs/zbxalgo/libzbxalgo.a \ -+ $(top_builddir)/src/libs/zbxstr/libzbxstr.a \ -+ $(top_builddir)/src/libs/zbxnum/libzbxnum.a \ -+ $(top_builddir)/src/libs/zbxtime/libzbxtime.a \ -+ $(top_builddir)/src/libs/zbxcommon/libzbxcommon.a \ -+ $(top_builddir)/src/libs/zbxbincommon/libzbxbincommon.a \ -+ $(top_builddir)/src/libs/zbxcurl/libzbxcurl.a - - zabbix_js_LDADD += @ZBXJS_LIBS@ $(LIBXML2_LIBS) - diff --git a/zabbix-php-fpm.conf b/zabbix-php-fpm.conf deleted file mode 100644 index fa38188..0000000 --- a/zabbix-php-fpm.conf +++ /dev/null @@ -1,24 +0,0 @@ -[zabbix] -user = apache -group = apache - -listen = /run/php-fpm/zabbix.sock -listen.acl_users = apache,nginx -listen.allowed_clients = 127.0.0.1 - -pm = dynamic -pm.max_children = 50 -pm.start_servers = 5 -pm.min_spare_servers = 5 -pm.max_spare_servers = 35 - -php_value[session.save_handler] = files -php_value[session.save_path] = /var/lib/php/session - -php_value[max_execution_time] = 300 -php_value[memory_limit] = 128M -php_value[post_max_size] = 16M -php_value[upload_max_filesize] = 2M -php_value[max_input_time] = 300 -php_value[max_input_vars] = 10000 -; php_value[date.timezone] = Europe/Riga diff --git a/zabbix-web.conf b/zabbix-web.conf index 34c38b4..31e4826 100644 --- a/zabbix-web.conf +++ b/zabbix-web.conf @@ -7,29 +7,56 @@ Alias /zabbix /usr/share/zabbix Options FollowSymLinks AllowOverride None - Require all granted - - DirectoryIndex index.php + + # Apache 2.4 + Require all granted + + + + # Apache 2.2 + Order allow,deny + Allow from all - - SetHandler "proxy:unix:/run/php-fpm/zabbix.sock|fcgi://localhost" - + + php_value max_execution_time 300 + php_value memory_limit 128M + php_value post_max_size 16M + php_value upload_max_filesize 2M + php_value max_input_time 300 + + # Removed in PHP 7 + php_value always_populate_raw_post_data -1 + + php_flag session.auto_start off + php_value mbstring.func_overload 0 + # php_value date.timezone UTC + - - Require all denied - + + + # Apache 2.4 + Require all denied + - - Require all denied - + + # Apache 2.2 + Order deny,allow + Deny from all + - - Require all denied - + + + # Apache 2.4 + Require all denied + - - Require all denied + + Order deny,allow + Deny from all + + + diff --git a/zabbix.fc b/zabbix.fc index a1e3556..c384947 100644 --- a/zabbix.fc +++ b/zabbix.fc @@ -14,11 +14,11 @@ /usr/sbin/zabbix_proxy_pgsql -- gen_context(system_u:object_r:zabbix_exec_t,s0) /usr/sbin/zabbix_proxy_sqlite3 -- gen_context(system_u:object_r:zabbix_exec_t,s0) -/var/lib/zabbix(/.*)? gen_context(system_u:object_r:zabbix_var_lib_t,s0) +/usr/lib/zabbix/externalscripts(/.*)? gen_context(system_u:object_r:zabbix_script_exec_t,s0) /var/lib/zabbixsrv(/.*)? gen_context(system_u:object_r:zabbix_var_lib_t,s0) -/var/lib/zabbixsrv/.*scripts(/.*)? gen_context(system_u:object_r:zabbix_script_exec_t,s0) -/var/lib/zabbixsrv/tmp(/.*)? gen_context(system_u:object_r:zabbix_tmp_t,s0) +/var/lib/zabbix(/.*)? gen_context(system_u:object_r:zabbix_var_lib_t,s0) +/var/lib/zabbix/externalscripts(/.*)? gen_context(system_u:object_r:zabbix_script_exec_t,s0) /var/log/zabbix.* gen_context(system_u:object_r:zabbix_log_t,s0) diff --git a/zabbix.spec b/zabbix.spec index d01b2d9..9dd0917 100644 --- a/zabbix.spec +++ b/zabbix.spec @@ -8,44 +8,18 @@ %global srcname zabbix %global with_selinux 1 %global selinuxtype targeted -# go is needed for agent2, but there are missing deps -%bcond_with go -# Missing dependencies for the java connector -%bcond_with java #%%global prerelease rc2 Name: zabbix Epoch: 1 -Version: 7.4.14 +Version: 4.0.27 Release: 1%{?dist} Summary: Open-source monitoring solution for your IT infrastructure -# TODO - Note additional licenses in src/go when we start building with go -# src/libs/zbxembed/duktape.c: MIT License -# src/libs/zbxembed/duktape.h: MIT License -# src/libs/zbxgetopt/getopt.c: GNU General Public License v2.0 or later -# src/libs/zbxhash/md5.c: zlib License -# ui/vendor/composer/LICENSE: MIT License -# ui/js/vendors/D3/LICENSE: ISC License -# ui/js/vendors/Leaflet/LICENSE: BSD 2-Clause License -# ui/js/vendors/Leaflet.markercluster/LICENSE: MIT License -# ui/js/vendors/jQueryUI/LICENSE: MIT License -# ui/js/vendors/qrcode/LICENSE: MIT License -# ui/vendor/duosecurity/duo_universal_php/LICENSE: BSD 3-Clause License -# ui/vendor/firebase/php-jwt/LICENSE: BSD 3-Clause License -# ui/vendor/onelogin/php-saml/LICENSE: MIT License -# ui/vendor/paragonie/constant_time_encoding/LICENSE.txt: MIT License -# ui/vendor/pragmarx/google2fa/LICENSE.md: MIT License -# ui/vendor/symfony/deprecation-contracts/LICENSE: MIT License -# ui/vendor/symfony/polyfill-ctype/LICENSE: MIT License -# ui/vendor/symfony/yaml/LICENSE: MIT License -# ui/assets/styles/vendors/Leaflet/LICENSE: BSD 2-Clause License -# ui/vendor/paragonie/constant_time_encoding/src/*.php: MIT License -License: AGPL-3.0-only AND MIT AND GPL-2.0-or-later AND Zlib AND BSD-3-Clause AND BSD-2-Clause AND ISC +License: GPLv2+ URL: https://www.zabbix.com -Source0: https://cdn.zabbix.com/zabbix/sources/stable/7.4/zabbix-%{version}.tar.gz +Source0: https://cdn.zabbix.com/zabbix/sources/stable/4.0/zabbix-%{version}.tar.gz Source1: %{srcname}-web.conf -Source2: %{srcname}-php-fpm.conf Source5: %{srcname}-logrotate.in Source9: %{srcname}-tmpfiles-zabbix.conf # systemd units -- Alternatives switches between them (they state their dependencies) @@ -64,20 +38,12 @@ Source20: %{srcname}.fc # This is not a symlink, because we don't want the webserver to possibly ever serve it. # local rules for config files -Patch0: %{srcname}-config.patch -# Allow out-of-tree builds -# https://support.zabbix.com/browse/ZBXNEXT-6077 -Patch1: %{srcname}-out-of-tree.patch -# Enforce Fedora Crypto Policy -Patch2: %{srcname}-crypto-policy.patch -# Add to sscanf check -# https://support.zabbix.com/browse/ZBX-21946 -Patch3: %{srcname}-configure-sscanf.patch - -# Patch1 patches automake files so we need to autoreconf -BuildRequires: libtool -BuildRequires: make +Patch0: %{srcname}-4.0.3-config.patch +%if 0%{?fedora} >= 28 BuildRequires: mariadb-connector-c-devel +%else +BuildRequires: mysql-devel +%endif BuildRequires: libpq-devel BuildRequires: sqlite-devel BuildRequires: net-snmp-devel @@ -90,43 +56,27 @@ BuildRequires: OpenIPMI-devel BuildRequires: libssh2-devel BuildRequires: libxml2-devel BuildRequires: libevent-devel -BuildRequires: pcre2-devel +BuildRequires: pcre-devel BuildRequires: gcc -# For Agent 2 - has missing deps -%if %{with go} -BuildRequires: gcc-go -#BuildRequires: golang(github.com/alimy/mc/v2) -BuildRequires: golang(github.com/docker/go-connections) -#BuildRequires: golang(github.com/dustin/gomemcached) -BuildRequires: golang(github.com/fsnotify/fsnotify) -BuildRequires: golang(github.com/go-ldap/ldap) -#BuildRequires: golang(github.com/go-ole/go-ole) -BuildRequires: golang(github.com/go-sql-driver/mysql) -BuildRequires: golang(github.com/godbus/dbus) -#BuildRequires: golang(github.com/jackc/pgx/v4) -BuildRequires: golang(github.com/mattn/go-sqlite3) -#BuildRequires: golang(github.com/mediocregopher/radix/v3) -#BuildRequires: golang(github.com/natefinch/npipe) -#BuildRequires: golang(github.com/testcontainers/testcontainers-go) -#BuildRequires: golang(golang.org/x/sys) -%endif BuildRequires: systemd -# Needed to determine path to link to -BuildRequires: dejavu-sans-fonts Requires: logrotate - %if 0%{?with_selinux} # This ensures that the *-selinux package and all it’s dependencies are not pulled # into containers and other systems that do not use SELinux Requires: (%{srcname}-selinux if selinux-policy-%{selinuxtype}) -%endif - +%endif # if with_selinux Provides: bundled(md5-deutsch) # Could alternatively be conditional on Fedora/EL %if "x%{?srcname}" != "x%{name}" Provides: %{srcname} = %{version}-%{release} -Conflicts: %{srcname} < 6.0 +Conflicts: %{srcname} < 3.0 +Conflicts: %{srcname}20 +Conflicts: %{srcname}22 +%else +Obsoletes: %{srcname}-docs < 1.8.15-2 +Obsoletes: %{srcname}-web-sqlite3 < 2.0.3-3 +Obsoletes: %{srcname}-server-sqlite3 < 2.0.3-3 %endif %description @@ -176,11 +126,10 @@ Requires: %{name} = %{?epoch:%{epoch}:}%{version}-%{release} Requires: %{name}-server-implementation = %{?epoch:%{epoch}:}%{version}-%{release} Requires: fping Requires: traceroute +Requires(pre): shadow-utils Requires(post): systemd Requires(preun): systemd Requires(postun): systemd -Provides: user(zabbixsrv) -Provides: group(zabbixsrv) %description server Zabbix server common files @@ -191,6 +140,7 @@ Requires: %{name} = %{?epoch:%{epoch}:}%{version}-%{release} Requires: %{name}-dbfiles-mysql Requires: %{name}-server = %{?epoch:%{epoch}:}%{version}-%{release} Requires(post): %{_sbindir}/update-alternatives +Requires(preun): %{_sbindir}/alternatives Requires(postun): %{_sbindir}/update-alternatives Provides: %{name}-server-implementation = %{?epoch:%{epoch}:}%{version}-%{release} @@ -203,6 +153,7 @@ Requires: %{name} = %{?epoch:%{epoch}:}%{version}-%{release} Requires: %{name}-server = %{?epoch:%{epoch}:}%{version}-%{release} Requires: %{name}-dbfiles-pgsql Requires(post): %{_sbindir}/update-alternatives +Requires(preun): %{_sbindir}/alternatives Requires(postun): %{_sbindir}/update-alternatives Provides: %{name}-server-implementation = %{?epoch:%{epoch}:}%{version}-%{release} @@ -212,6 +163,7 @@ Zabbix server compiled to use PostgreSQL %package agent Summary: Zabbix agent Requires: %{name} = %{?epoch:%{epoch}:}%{version}-%{release} +Requires(pre): shadow-utils Requires(post): systemd Requires(preun): systemd Requires(postun): systemd @@ -224,6 +176,7 @@ Summary: Zabbix proxy common files BuildArch: noarch Requires: %{name} = %{?epoch:%{epoch}:}%{version}-%{release} Requires: %{name}-proxy-implementation = %{?epoch:%{epoch}:}%{version}-%{release} +Requires(pre): shadow-utils Requires(post): systemd Requires(preun): systemd Requires(postun): systemd @@ -238,6 +191,7 @@ Requires: %{name}-proxy = %{?epoch:%{epoch}:}%{version}-%{release} Requires: %{name}-dbfiles-mysql Provides: %{name}-proxy-implementation = %{?epoch:%{epoch}:}%{version}-%{release} Requires(post): %{_sbindir}/update-alternatives +Requires(preun): %{_sbindir}/alternatives Requires(postun): %{_sbindir}/update-alternatives %description proxy-mysql @@ -249,6 +203,7 @@ Requires: %{name}-proxy = %{?epoch:%{epoch}:}%{version}-%{release} Requires: %{name}-dbfiles-pgsql Provides: %{name}-proxy-implementation = %{?epoch:%{epoch}:}%{version}-%{release} Requires(post): %{_sbindir}/update-alternatives +Requires(preun): %{_sbindir}/alternatives Requires(postun): %{_sbindir}/update-alternatives %description proxy-pgsql @@ -260,6 +215,7 @@ Requires: %{name}-proxy = %{?epoch:%{epoch}:}%{version}-%{release} Requires: %{name}-dbfiles-sqlite3 Provides: %{name}-proxy-implementation = %{?epoch:%{epoch}:}%{version}-%{release} Requires(post): %{_sbindir}/update-alternatives +Requires(preun): %{_sbindir}/alternatives Requires(postun): %{_sbindir}/update-alternatives %description proxy-sqlite3 @@ -268,17 +224,19 @@ Zabbix proxy compiled to use SQLite %package web Summary: Zabbix Web Frontend BuildArch: noarch -Requires: php-bcmath -Requires: php-fpm +# Don't remove "php". Everything else only depends on php-common +# and you'll end up with no module for Apache! +Requires: php Requires: php-gd -Requires: php-gettext -Requires: php-json +Requires: php-bcmath Requires: php-ldap Requires: php-mbstring Requires: php-xml -# jquery 3.6.0 and jquery-ui 1.13.2 in the sources -Requires: js-jquery >= 3.6.0 -Provides: bundled(js-jquery-ui) = 1.13.2 +Requires: php-gettext +Requires: php-fpm +# jquery 3.3.1 and jquery-ui 1.12.1 in the sources +Requires: js-jquery3 +Provides: bundled(js-jquery-ui) = 1.12.1 # prototype 1.6.1 in the sources, Fedora package is dead #Requires: prototype Requires: dejavu-sans-fonts @@ -294,6 +252,7 @@ BuildArch: noarch Requires: %{name}-web = %{?epoch:%{epoch}:}%{version}-%{release} Requires: php-mysqli Provides: %{name}-web-database = %{?epoch:%{epoch}:}%{version}-%{release} +Obsoletes: %{name}-web <= 1.5.3-0.1 %description web-mysql Zabbix web frontend for MySQL @@ -308,19 +267,6 @@ Provides: %{name}-web-database = %{?epoch:%{epoch}:}%{version}-%{release} %description web-pgsql Zabbix web frontend for PostgreSQL -%if %{with java} -%package -n java-%{srcname} -Summary: Zabbix Java connector -BuildArch: noarch -BuildRequires: java-devel -BuildRequires: osgi(org.junit) -BuildRequires: osgi(slf4j.api) -BuildRequires: osgi(logback) - -%description -n java-%{srcname} -Zabbix Java connector. -%endif - %if 0%{?with_selinux} # SELinux subpackage %package selinux @@ -333,30 +279,35 @@ BuildRequires: selinux-policy-devel %description selinux Custom SELinux policy module -%endif +%endif # if with_selinux %prep -%autosetup -p1 -autoreconf +%setup0 -q -n %{srcname}-%{version}%{?prerelease:.%{prerelease}} +%patch0 -p1 # Remove bundled java libs -find -name \*.jar -delete +rm -rf src/zabbix_java/lib/*.jar # Remove prebuilt Windows binaries rm -rf bin # Override creation of statically named directory for alertscripts and externalscripts +# and ssl certs/keys # https://support.zabbix.com/browse/ZBX-6159 sed -i '/CURL_SSL_.*_LOCATION\|SCRIPTS_PATH/s|\${datadir}/zabbix|/var/lib/zabbixsrv|' \ configure # Kill off .htaccess files, options set in SOURCE1 -find -name .htaccess -delete +rm -f frontends/php/app/.htaccess +rm -f frontends/php/conf/.htaccess +rm -f frontends/php/include/.htaccess +rm -f frontends/php/local/.htaccess -# Fix path to traceroute utility (on all Linux targets) +# Fix path to traceroute utility find database -name 'data.sql' -exec sed -i 's|/usr/bin/traceroute|/bin/traceroute|' {} \; + # Common # Settings with hard-coded defaults that are not suitable for Fedora # are explicitly set, leaving the comment with the default value in place. @@ -367,10 +318,10 @@ find database -name 'data.sql' -exec sed -i 's|/usr/bin/traceroute|/bin/tracerou sed -i \ -e '\|^# LogFileSize=.*|a LogFileSize=0' \ -e 's|^DBUser=root|DBUser=zabbix|' \ - -e 's|^# DBSocket=.*|DBSocket=%{_sharedstatedir}/mysql/mysql.sock|' \ + -e 's|^# DBSocket=/tmp/mysql.sock|# DBSocket=%{_sharedstatedir}/mysql/mysql.sock|' \ -e '\|^# ExternalScripts=|a ExternalScripts=%{_sharedstatedir}/zabbixsrv/externalscripts' \ - -e '\|^# AlertScriptsPath=|a AlertScriptsPath=%{_sharedstatedir}/zabbixsrv/alertscripts' \ - -e '\|^# TmpDir=\/tmp|a TmpDir=%{_sharedstatedir}/zabbixsrv/tmp' \ + -e '\|^# AlertScripts=|a AlertScripts=%{_sharedstatedir}/zabbixsrv/alertscripts' \ + -e '\|^# TmpDir=|a TmpDir=%{_sharedstatedir}/zabbixsrv/tmp' \ -e 's|/usr/local||' \ -e 's|\${datadir}|/usr/share|' \ conf/zabbix_agentd.conf conf/zabbix_proxy.conf conf/zabbix_server.conf @@ -394,18 +345,15 @@ sed -i \ # Install README file install -m 0644 -p %{SOURCE16} . -# Create a sysusers.d config file -cat >zabbix.sysusers.conf < \ $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/zabbix-agent sed -e 's|COMPONENT|server|g; s|USER|zabbixsrv|g' %{SOURCE5} > \ @@ -527,7 +466,6 @@ sed -e 's|COMPONENT|proxy|g; s|USER|zabbixsrv|g' %{SOURCE5} > \ $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/zabbix-proxy # Install different systemd units because of the requirements for DBMS daemons -mkdir -p $RPM_BUILD_ROOT%{_unitdir} install -m 0644 -p %{SOURCE10} $RPM_BUILD_ROOT%{_unitdir}/zabbix-agent.service install -m 0644 -p %{SOURCE11} $RPM_BUILD_ROOT%{_unitdir}/zabbix-proxy-mysql.service install -m 0644 -p %{SOURCE12} $RPM_BUILD_ROOT%{_unitdir}/zabbix-proxy-pgsql.service @@ -539,6 +477,15 @@ install -m 0644 -p %{SOURCE15} $RPM_BUILD_ROOT%{_unitdir}/zabbix-server-pgsql.se touch $RPM_BUILD_ROOT%{_unitdir}/zabbix-server.service touch $RPM_BUILD_ROOT%{_unitdir}/zabbix-proxy.service +# Install compatibility links for config files +#TODO: Switch to .wants files instead! +ln -sf ../zabbix_agentd.conf $RPM_BUILD_ROOT%{_sysconfdir}/%{srcname}/zabbix_agentd.conf +ln -sf ../zabbix_server.conf $RPM_BUILD_ROOT%{_sysconfdir}/%{srcname}/zabbix_server.conf +ln -sf ../zabbix_proxy.conf $RPM_BUILD_ROOT%{_sysconfdir}/%{srcname}/zabbix_proxy.conf +ln -sf ../../%{_sharedstatedir}/zabbixsrv/externalscripts $RPM_BUILD_ROOT%{_sysconfdir}/%{srcname}/externalscripts +ln -sf ../../%{_sharedstatedir}/zabbixsrv/alertscripts $RPM_BUILD_ROOT%{_sysconfdir}/%{srcname}/alertscripts +#TODO: What does that do to existing directories? + # Directory for fping spooling files mkdir -p $RPM_BUILD_ROOT%{_sharedstatedir}/zabbixsrv/tmp @@ -553,10 +500,7 @@ cp -p database/sqlite3/schema.sql $RPM_BUILD_ROOT%{_datadir}/%{srcname}-sqlite3 %if 0%{?with_selinux} install -D -m 0644 %{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 -install -D -p -m 0644 selinux/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{name}.if -%endif - -install -m0644 -D zabbix.sysusers.conf %{buildroot}%{_sysusersdir}/zabbix.conf +%endif # if with_selinux %post server @@ -572,25 +516,13 @@ fi %post server-mysql %{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_server \ %{srcname}-server %{_sbindir}/%{srcname}_server_mysql 10 \ - --slave %{_unitdir}/zabbix-server.service %{srcname}-server.service \ - %{_unitdir}/zabbix-server-mysql.service -# This needs to be run twice to rename from old slave name in zabbix < 6.0.33-2 -# due to a bug in alternatives. Remove in F45 -%{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_server \ - %{srcname}-server %{_sbindir}/%{srcname}_server_mysql 10 \ - --slave %{_unitdir}/zabbix-server.service %{srcname}-server.service \ + --slave %{_unitdir}/zabbix-server.service %{srcname}-server-systemd \ %{_unitdir}/zabbix-server-mysql.service %post server-pgsql %{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_server \ %{srcname}-server %{_sbindir}/%{srcname}_server_pgsql 10 \ - --slave %{_unitdir}/zabbix-server.service %{srcname}-server.service \ - %{_unitdir}/zabbix-server-pgsql.service -# This needs to be run twice to rename from old slave name in zabbix < 6.0.33-2 -# due to a bug in alternatives. Remove in F45 -%{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_server \ - %{srcname}-server %{_sbindir}/%{srcname}_server_pgsql 10 \ - --slave %{_unitdir}/zabbix-server.service %{srcname}-server.service \ + --slave %{_unitdir}/zabbix-server.service %{srcname}-server-systemd \ %{_unitdir}/zabbix-server-pgsql.service %post proxy @@ -606,37 +538,19 @@ fi %post proxy-mysql %{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_proxy \ %{srcname}-proxy %{_sbindir}/%{srcname}_proxy_mysql 10 \ - --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy.service \ - %{_unitdir}/zabbix-proxy-mysql.service -# This needs to be run twice to rename from old slave name in zabbix < 6.0.33-2 -# due to a bug in alternatives. Remove in F45 -%{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_proxy \ - %{srcname}-proxy %{_sbindir}/%{srcname}_proxy_mysql 10 \ - --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy.service \ + --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy-systemd \ %{_unitdir}/zabbix-proxy-mysql.service %post proxy-pgsql %{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_proxy \ %{srcname}-proxy %{_sbindir}/%{srcname}_proxy_pgsql 10 \ - --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy.service \ - %{_unitdir}/zabbix-proxy-pgsql.service -# This needs to be run twice to rename from old slave name in zabbix < 6.0.33-2 -# due to a bug in alternatives. Remove in F45 -%{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_proxy \ - %{srcname}-proxy %{_sbindir}/%{srcname}_proxy_pgsql 10 \ - --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy.service \ + --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy-systemd \ %{_unitdir}/zabbix-proxy-pgsql.service %post proxy-sqlite3 %{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_proxy \ %{srcname}-proxy %{_sbindir}/%{srcname}_proxy_sqlite3 10 \ - --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy.service \ - %{_unitdir}/zabbix-proxy-sqlite3.service -# This needs to be run twice to rename from old slave name in zabbix < 6.0.33-2 -# due to a bug in alternatives. Remove in F45 -%{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_proxy \ - %{srcname}-proxy %{_sbindir}/%{srcname}_proxy_sqlite3 10 \ - --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy.service \ + --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy-systemd \ %{_unitdir}/zabbix-proxy-sqlite3.service %if 0%{?with_selinux} @@ -655,8 +569,14 @@ fi %posttrans selinux %selinux_relabel_post -s %{selinuxtype} -%endif +%endif # if with_selinux +%pre agent +getent group zabbix > /dev/null || groupadd -r zabbix +getent passwd zabbix > /dev/null || \ + useradd -r -g zabbix -d %{_sharedstatedir}/zabbix -s /sbin/nologin \ + -c "Zabbix Monitoring System" zabbix +: %post agent %systemd_post zabbix-agent.service @@ -738,8 +658,8 @@ fi %doc AUTHORS ChangeLog NEWS README zabbix-fedora-epel.README %dir %{_sysconfdir}/%{srcname} %config(noreplace) %{_sysconfdir}/zabbix_agentd.conf +%config(noreplace) %{_sysconfdir}/%{srcname}/zabbix_agentd.conf %{_bindir}/zabbix_get -%{_bindir}/zabbix_js %{_bindir}/zabbix_sender %{_mandir}/man1/zabbix_get.1* %{_mandir}/man1/zabbix_sender.1* @@ -762,6 +682,9 @@ fi %{_prefix}/lib/tmpfiles.d/zabbixsrv.conf %attr(0640,root,zabbixsrv) %config(noreplace) %{_sysconfdir}/zabbix_server.conf %attr(0775,root,zabbixsrv) %dir %{_localstatedir}/log/zabbixsrv +%config(noreplace) %{_sysconfdir}/%{srcname}/zabbix_server.conf +%config(noreplace) %{_sysconfdir}/%{srcname}/externalscripts +%config(noreplace) %{_sysconfdir}/%{srcname}/alertscripts %config(noreplace) %{_sysconfdir}/logrotate.d/zabbix-server %ghost %{_sbindir}/zabbix_server %attr(0750,zabbixsrv,zabbixsrv) %dir %{_sharedstatedir}/zabbixsrv @@ -782,9 +705,8 @@ fi %if 0%{?with_selinux} %files selinux %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.* -%{_datadir}/selinux/devel/include/distributed/%{name}.if -%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} -%endif +%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} +%endif # if with_selinux %files agent %doc conf/zabbix_agentd/*.conf @@ -792,12 +714,12 @@ fi %{_prefix}/lib/tmpfiles.d/zabbix.conf %attr(0775,root,zabbix) %dir %{_localstatedir}/log/zabbix %config(noreplace) %{_sysconfdir}/zabbix_agentd.conf +%config(noreplace) %{_sysconfdir}/%{srcname}/zabbix_agentd.conf %config(noreplace) %{_sysconfdir}/logrotate.d/zabbix-agent %attr(750,zabbix,zabbix) %dir %{_sharedstatedir}/zabbix %{_unitdir}/zabbix-agent.service %{_sbindir}/zabbix_agentd %{_mandir}/man8/zabbix_agentd.8* -%{_sysusersdir}/zabbix.conf %files proxy %doc misc/snmptrap/zabbix_trap_receiver.pl @@ -805,6 +727,8 @@ fi %{_prefix}/lib/tmpfiles.d/zabbixsrv.conf %attr(0640,root,zabbixsrv) %config(noreplace) %{_sysconfdir}/zabbix_proxy.conf %attr(0775,root,zabbixsrv) %dir %{_localstatedir}/log/zabbixsrv +%config(noreplace) %{_sysconfdir}/%{srcname}/zabbix_proxy.conf +%config(noreplace) %{_sysconfdir}/%{srcname}/externalscripts %config(noreplace) %{_sysconfdir}/logrotate.d/zabbix-proxy %ghost %{_sbindir}/zabbix_proxy %attr(0750,zabbixsrv,zabbixsrv) %dir %{_sharedstatedir}/zabbixsrv @@ -831,289 +755,17 @@ fi %ghost %attr(0644,apache,apache) %config(noreplace) %{_sysconfdir}/%{srcname}/web/zabbix.conf.php %attr(0644,apache,apache) %config(noreplace) %{_sysconfdir}/%{srcname}/web/maintenance.inc.php %config(noreplace) %{_sysconfdir}/httpd/conf.d/zabbix.conf -%config(noreplace) %{_sysconfdir}/php-fpm.d/zabbix.conf -%{_datadir}/%{srcname}/ +%{_datadir}/%{srcname} %files web-mysql %files web-pgsql %changelog -* Tue Aug 25 2026 Gwyn Ciesla - 1:7.4.14-1 -- 7.4.14 +* Sun Jan 24 2021 Orion Poplawski - 1:4.0.27-1 +- Update to 4.0.27 -* Thu Aug 20 2026 Gwyn Ciesla - 1:7.4.13-1 -- 7.4.13 - -* Fri Jul 17 2026 Fedora Release Engineering - 1:7.4.12-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild - -* Thu Jul 09 2026 Gwyn Ciesla - 1:7.4.12-1 -- 7.4.12 - -* Sat Jun 13 2026 Yaakov Selkowitz - 1:7.4.9-3 -- Rebuilt for openssl 4.0 - -* Mon Apr 13 2026 Gwyn Ciesla - 1:7.4.9-2 -- Openssl rebuild - -* Thu Apr 09 2026 Gwyn Ciesla - 1:7.4.9-1 -- 7.4.9 - -* Fri Mar 13 2026 Gwyn Ciesla - 1:7.4.8-1 -- 7.4.8 - -* Fri Feb 13 2026 Gwyn Ciesla - 1:7.4.7-1 -- 7.4.7 - -* Fri Jan 23 2026 Benjamin A. Beasley - 1:7.4.6-3 -- Rebuilt for net-snmp 5.9.5.2 - -* Sat Jan 17 2026 Fedora Release Engineering - 1:7.4.6-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - -* Thu Dec 18 2025 Gwyn Ciesla - 1:7.4.6-1 -- 7.4.6 - -* Mon Nov 03 2025 Gwyn Ciesla - 1:7.4.5-1 -- 7.4.5 - -* Wed Oct 29 2025 Gwyn Ciesla - 1:7.4.4-1 -- 7.4.4 - -* Wed Oct 01 2025 Gwyn Ciesla - 1:7.4.3-1 -- 7.4.3 - -* Mon Aug 25 2025 Gwyn Ciesla - 1:7.4.2-1 -- 7.4.2 - -* Thu Jul 31 2025 Gwyn Ciesla - 1:7.4.1-1 -- 7.4.1 - -* Fri Jul 25 2025 Fedora Release Engineering - 1:7.2.11-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Tue Jul 22 2025 Gwyn Ciesla - 1:7.2.11-1 -- 7.2.11 - -* Fri Jun 27 2025 Gwyn Ciesla - 1:7.2.10-1 -- 7.2.10 - -* Fri Jun 20 2025 Gwyn Ciesla - 1:7.2.9-1 -- 7.2.9 - -* Wed Apr 09 2025 Gwyn Ciesla - 1:7.2.5-2 -- Add user/group provides to -server to fix FTI - -* Wed Apr 02 2025 Orion Poplawski - 1:7.2.5-1 -- Update to 7.2.5 (CVE-2024-36469, CVE-2024-42325, CVE-2024-45700) - -* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 1:7.2.2-3 -- Add sysusers.d config file to allow rpm to create users/groups automatically - -* Sun Jan 19 2025 Fedora Release Engineering - 1:7.2.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Mon Jan 06 2025 Orion Poplawski - 1:7.2.2-1 -- Update to 7.2.2 - -* Thu Dec 12 2024 Orion Poplawski - 1:7.2.0-1 -- Update to 7.2.0 - -* Sat Nov 30 2024 Orion Poplawski - 1:7.0.6-1 -- Update to 7.0.6 - -* Tue Oct 22 2024 Orion Poplawski - 1:7.0.5-1 -- Update to 7.0.5 - -* Mon Oct 07 2024 Orion Poplawski - 1:7.0.4-2 -- Fix typo in crypto policy patch that broke SSL connections - -* Thu Sep 26 2024 Orion Poplawski - 1:7.0.4-1 -- Update to 7.0.4 - -* Sat Aug 24 2024 Orion Poplawski - 1:7.0.3-1 -- Update to 7.0.3 -- License changed upstream to AGPL-3.0-only, note other licenses in source - -* Mon Aug 19 2024 Orion Poplawski - 1:6.0.33-2 -- Use alternatives name that systemd likes for units (bz#2305855) - -* Thu Aug 15 2024 Gwyn Ciesla - 1:6.0.33-1 -- 6.0.33 - -* Mon Jul 29 2024 Miroslav Suchý - 1:6.0.30-3 -- convert license to SPDX - -* Sat Jul 20 2024 Fedora Release Engineering - 1:6.0.30-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Tue May 21 2024 Gwyn Ciesla - 1:6.0.30-1 -- 6.0.30 - -* Fri May 03 2024 Orion Poplawski - 1:6.0.29-1 -- Update to 6.0.29 -- Hopefully really get the zabbix_run_sudo SELinux boolean working for - zabbix-agent and allow it to run lvm when enabled - -* Wed Feb 28 2024 Morten Stevens - 1:6.0.27-1 -- Update to 6.0.27 - -* Sat Jan 27 2024 Fedora Release Engineering - 1:6.0.25-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Thu Jan 04 2024 Orion Poplawski - 1:6.0.25-1 -- Update to 6.0.25 - -* Fri Dec 01 2023 Gwyn Ciesla - 1:6.0.22-3 -- Patch for libxml2 2.12.x - -* Sat Oct 28 2023 Orion Poplawski - 1:6.0.22-2 -- Add dontaudit SELinux rules for spurious AVC denial messages (bz#2170630) - -* Wed Oct 04 2023 Morten Stevens - 1:6.0.22-1 -- Update to 6.0.22 - -* Mon Aug 07 2023 Morten Stevens - 1:6.0.20-1 -- Update to 6.0.20 - -* Sat Jul 22 2023 Fedora Release Engineering - 1:6.0.19-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Thu Jul 06 2023 Morten Stevens - 1:6.0.19-1 -- Update to 6.0.19 - -* Thu Jun 15 2023 Morten Stevens - 1:6.0.18-1 -- Update to 6.0.18 - -* Tue Apr 25 2023 Morten Stevens - 1:6.0.17-1 -- Update to 6.0.17 - -* Tue Apr 11 2023 Morten Stevens - 1:6.0.16-1 -- Update to 6.0.16 - -* Tue Apr 04 2023 Morten Stevens - 1:6.0.15-1 -- Update to 6.0.15 - -* Tue Mar 21 2023 Morten Stevens - 1:6.0.14-1 -- Update to 6.0.14 - -* Wed Mar 01 2023 Gwyn Ciesla - 1:6.0.13-2 -- migrated to SPDX license - -* Thu Feb 16 2023 Orion Poplawski - 1:6.0.13-1 -- Update to 6.0.13 -- Add policy to allow zabbix scripts to run chronyc as chronyc_t (bz#2160180) -- Add policy to allow zabbix agent to run rpm read-only - -* Sun Jan 22 2023 Orion Poplawski - 1:6.0.12-1 -- Update to 6.0.12 - -* Sat Jan 21 2023 Fedora Release Engineering - 1:6.0.8-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Thu Nov 17 2022 Florian Weimer - 1:6.0.8-2 -- Include in configure for sscanf prototype - -* Wed Sep 14 2022 Gwyn Ciesla - 1:6.0.8-1 -- 6.0.8 - -* Fri Jul 22 2022 Gwyn Ciesla -1:6.0.6-2 -- Move to pcre2 - -* Fri Jul 08 2022 Orion Poplawski - 1:6.0.6-1 -- Update to 6.0.6 - -* Tue May 31 2022 Gwyn Ciesla - 1:6.0.5-1 -- 6.0.5 - -* Mon May 09 2022 Orion Poplawski - 1:6.0.4-1 -- Update to 6.0.4 - -* Mon Apr 04 2022 Gwyn Ciesla - 1:6.0.3-1 -- 6.0.3 - -* Wed Mar 23 2022 Orion Poplawski - 1:6.0.2-1 -- Update to 6.0.2 - -* Fri Mar 11 2022 Gwyn Ciesla - 1:5.0.21-1 -- 5.0.21 - -* Sat Jan 22 2022 Fedora Release Engineering - 1:5.0.19-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Fri Jan 14 2022 Gwyn Ciesla - 1:5.0.19-1 -- 5.0.19 -- Fixed CVE-2022-23132, CVE-2022-23133, CVE-2022-23134. - -* Wed Dec 01 2021 Orion Poplawski - 1:5.0.18-1 -- Update to 5.0.18 - -* Mon Nov 01 2021 Orion Poplawski - 1:5.0.17-1 -- Update to 5.0.17 - -* Sat Oct 16 2021 Morten Stevens - 1:5.0.16-1 -- Update to 5.0.16 - -* Tue Sep 14 2021 Sahana Prasad - 1:5.0.14-2 -- Rebuilt with OpenSSL 3.0.0 - -* Mon Jul 26 2021 Morten Stevens - 1:5.0.14-1 -- Update to 5.0.14 - -* Mon Jul 26 2021 Morten Stevens - 1:5.0.10-3 -- Dropped support for DES - -* Fri Jul 23 2021 Fedora Release Engineering - 1:5.0.10-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Tue Apr 20 2021 Orion Poplawski - 1:5.0.10-1 -- Update to 5.0.10 -- SELinux: Allow fping to read the zabbix ping list - -* Fri Mar 05 2021 Orion Poplawski - 1:5.0.9-1 -- Update to 5.0.9 - -* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 1:5.0.8-2 -- Rebuilt for updated systemd-rpm-macros - See https://pagure.io/fesco/issue/2583. - -* Mon Feb 15 2021 Orion Poplawski - 1:5.0.8-1 -- Update to 5.0.8 -- Update php configuration for php-fpm (bz#1928386) - -* Mon Feb 08 2021 Pavel Raiskup - 1:5.0.7-4 -- rebuild for libpq ABI fix rhbz#1908268 - -* Thu Jan 28 2021 Orion Poplawski - 1:5.0.7-3 -- Handle new dejavu-sans-fonts directory (bz#1921010) - -* Thu Jan 28 2021 Fedora Release Engineering - 1:5.0.7-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Sun Jan 24 2021 Orion Poplawski - 1:5.0.7-1 -- Update to 5.0.7 - -* Sun Dec 13 2020 Orion Poplawski - 1:5.0.6-1 -- Update to 5.0.6 - -* Tue Sep 15 2020 Volker Froehlich - 1:5.0.3-2 -- Rebuild for libevent soname bump - -* Tue Sep 1 2020 Orion Poplawski - 1:5.0.3-1 -- Update to 5.0.3 - -* Tue Sep 1 2020 Orion Poplawski - 1:5.0.2-1 -- Update to 5.0.2 -- Enforce Fedora crypto policy - -* Thu Aug 27 2020 Josef Řídký - 1:4.0.22-3 -- Rebuilt for new net-snmp release - -* Wed Jul 29 2020 Fedora Release Engineering - 1:4.0.22-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Sat Jul 18 2020 Orion Poplawski - 1:4.0.22-1 +* Sat Jul 18 17:11:45 GMT 2020 Orion Poplawski - 1:4.0.22-1 - Update to 4.0.22 (bz#1858259) CVE-2020-15803 - Fix alert/external scripts directories diff --git a/zabbix.te b/zabbix.te index 4ff1bb7..273e394 100644 --- a/zabbix.te +++ b/zabbix.te @@ -1,4 +1,4 @@ -policy_module(zabbix, 1.7.0) +policy_module(zabbix, 1.6.0) ######################################## # @@ -284,53 +284,22 @@ zabbix_tcp_connect(zabbix_agent_t) zabbix_script_domtrans(zabbix_agent_t) -# These are triggered by vfs.dev.discovery enumerating everyting in /dev -gen_require(` - type devlog_t; -') -dontaudit zabbix_agent_t devlog_t:sock_file getattr; -init_dontaudit_getattr_initctl(zabbix_agent_t) -kernel_dontaudit_getattr_core_if(zabbix_agent_t) - -gen_require(` - type kernel_t, sudo_log_t; -') tunable_policy(`zabbix_run_sudo',` - allow zabbix_agent_t self:capability { chown dac_read_search setgid setuid sys_resource }; + allow zabbix_agent_t self:capability { setgid setuid sys_resource }; allow zabbix_agent_t self:process { setrlimit setsched }; allow zabbix_agent_t self:key write; allow zabbix_agent_t self:passwd { passwd rootok }; - allow zabbix_agent_t sudo_log_t:dir { add_name create setattr write }; - allow zabbix_agent_t sudo_log_t:file { create open read setattr write }; - - allow zabbix_agent_t devlog_t:sock_file write; - allow zabbix_agent_t kernel_t:unix_dgram_socket sendto; - allow zabbix_agent_t self:unix_dgram_socket { connect create }; - - auth_domtrans_chkpwd(zabbix_agent_t) auth_rw_lastlog(zabbix_agent_t) auth_rw_faillog(zabbix_agent_t) - - logging_send_audit_msgs(zabbix_agent_t) + auth_exec_chkpwd(zabbix_agent_t) selinux_compute_access_vector(zabbix_agent_t) - sssd_read_config(zabbix_agent_t) - systemd_write_inherited_logind_sessions_pipes(zabbix_agent_t) systemd_dbus_chat_logind(zabbix_agent_t) xserver_exec_xauth(zabbix_agent_t) - - # Conceivably this could be under a separate boolean, but the reason to allow sudo - # is to allow check like this - lvm_domtrans(zabbix_agent_t) -') - -optional_policy(` - rpm_exec(zabbix_agent_t) - rpm_read_db(zabbix_agent_t) ') optional_policy(` @@ -361,10 +330,6 @@ allow zabbix_t zabbix_script_t:process signal; init_domtrans_script(zabbix_script_t) -optional_policy(` - chronyd_domtrans_chronyc(zabbix_script_t) -') - optional_policy(` mta_send_mail(zabbix_script_t) ')