7.4.14

The test repo was migrated to github due to Pagure being retired.
https://communityblog.fedoraproject.org/the-forge-is-our-new-home/

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -65,3 +65,62 @@ zabbix-1.8.2.tar.gz
 /zabbix-4.0.14.tar.gz
 /zabbix-4.0.15.tar.gz
 /zabbix-4.0.16.tar.gz
+/zabbix-4.0.19.tar.gz
+/zabbix-4.0.22.tar.gz
+/zabbix-5.0.2.tar.gz
+/zabbix-5.0.3.tar.gz
+/zabbix-5.0.6.tar.gz
+/zabbix-5.0.7.tar.gz
+/zabbix-5.0.8.tar.gz
+/zabbix-5.0.9.tar.gz
+/zabbix-5.0.10.tar.gz
+/zabbix-5.0.14.tar.gz
+/zabbix-5.0.16.tar.gz
+/zabbix-5.0.17.tar.gz
+/zabbix-5.0.18.tar.gz
+/zabbix-5.0.19.tar.gz
+/zabbix-5.0.21.tar.gz
+/zabbix-6.0.2.tar.gz
+/zabbix-6.0.3.tar.gz
+/zabbix-6.0.4.tar.gz
+/zabbix-6.0.5.tar.gz
+/zabbix-6.0.6.tar.gz
+/zabbix-6.0.8.tar.gz
+/zabbix-6.0.12.tar.gz
+/zabbix-6.0.13.tar.gz
+/zabbix-6.0.14.tar.gz
+/zabbix-6.0.15.tar.gz
+/zabbix-6.0.16.tar.gz
+/zabbix-6.0.17.tar.gz
+/zabbix-6.0.18.tar.gz
+/zabbix-6.0.19.tar.gz
+/zabbix-6.0.20.tar.gz
+/zabbix-6.0.22.tar.gz
+/zabbix-6.0.25.tar.gz
+/zabbix-6.0.27.tar.gz
+/zabbix-6.0.29.tar.gz
+/zabbix-6.0.30.tar.gz
+/zabbix-6.0.33.tar.gz
+/zabbix-7.0.2.tar.gz
+/zabbix-7.0.3.tar.gz
+/zabbix-7.0.4.tar.gz
+/zabbix-7.0.5.tar.gz
+/zabbix-7.0.6.tar.gz
+/zabbix-7.2.0.tar.gz
+/zabbix-7.2.2.tar.gz
+/zabbix-7.2.5.tar.gz
+/zabbix-7.2.9.tar.gz
+/zabbix-7.2.10.tar.gz
+/zabbix-7.2.11.tar.gz
+/zabbix-7.4.1.tar.gz
+/zabbix-7.4.2.tar.gz
+/zabbix-7.4.3.tar.gz
+/zabbix-7.4.4.tar.gz
+/zabbix-7.4.5.tar.gz
+/zabbix-7.4.6.tar.gz
+/zabbix-7.4.7.tar.gz
+/zabbix-7.4.8.tar.gz
+/zabbix-7.4.9.tar.gz
+/zabbix-7.4.12.tar.gz
+/zabbix-7.4.13.tar.gz
+/zabbix-7.4.14.tar.gz

plans/dsp.fmf

@@ -0,0 +1,22 @@
+summary: DSP test suite
+discover:
+  - name: DSP_test
+    how: fmf
+    url: https://github.com/fedora-selinux/DSP_test.git
+    ref: main
+
+execute:
+    how: tmt
+
+environment:
+    trigger: FedoraCI
+    # DSP_test specific variables:
+    TEST_RPM: "zabbix-selinux"
+    TEST_POLICY: "zabbix"
+
+prepare:
+    how: install
+    package:
+        - zabbix-selinux
+        - autoconf
+        - automake

sources

@@ -1 +1 @@
-SHA512 (zabbix-4.0.16.tar.gz) = e5a0b13790ef082d63c879ebf989739ffde448161d45eb16ccf4100473556ef39d00466687ecce69e3430e54ec32015c2d00461b81f51510d08d8e38284e2ee6
+SHA512 (zabbix-7.4.14.tar.gz) = 98b26bfcd3b1803b23d85af70094fe875d138263cabbc4f6fa5c63ea9b07c4bedaa86eeed79ede74919f55515d6c17408391ea999ed204948320dc8ec29bbdc6

zabbix-4.0.3-config.patch

@@ -1,57 +0,0 @@
-diff --git a/frontends/php/include/classes/core/CConfigFile.php b/frontends/php/include/classes/core/CConfigFile.php
-index 091ff50..8c76c27 100644
---- a/frontends/php/include/classes/core/CConfigFile.php
-+++ b/frontends/php/include/classes/core/CConfigFile.php
-@@ -24,7 +24,7 @@ class CConfigFile {
- 	const CONFIG_NOT_FOUND = 1;
- 	const CONFIG_ERROR = 2;
- 
--	const CONFIG_FILE_PATH = '/conf/zabbix.conf.php';
-+	const CONFIG_FILE_PATH = '/etc/zabbix/web/zabbix.conf.php';
- 
- 	private static $supported_db_types = [
- 		ZBX_DB_DB2 => true,
-diff --git a/frontends/php/include/classes/core/ZBase.php b/frontends/php/include/classes/core/ZBase.php
-index 5a867f2..59bf522 100644
---- a/frontends/php/include/classes/core/ZBase.php
-+++ b/frontends/php/include/classes/core/ZBase.php
-@@ -273,7 +273,7 @@ class ZBase {
- 	 * @throws Exception
- 	 */
- 	protected function setMaintenanceMode() {
--		require_once $this->getRootDir().'/conf/maintenance.inc.php';
-+		require_once '/etc/zabbix/web/maintenance.inc.php';
- 
- 		if (defined('ZBX_DENY_GUI_ACCESS')) {
- 			$user_ip = (isset($_SERVER['HTTP_X_FORWARDED_FOR']) && !empty($_SERVER['HTTP_X_FORWARDED_FOR']))
-@@ -289,7 +289,7 @@ class ZBase {
- 	 * Load zabbix config file.
- 	 */
- 	protected function loadConfigFile() {
--		$configFile = $this->getRootDir().CConfigFile::CONFIG_FILE_PATH;
-+		$configFile = CConfigFile::CONFIG_FILE_PATH;
- 		$config = new CConfigFile($configFile);
- 		$this->config = $config->load();
- 	}
-diff --git a/frontends/php/include/classes/setup/CSetupWizard.php b/frontends/php/include/classes/setup/CSetupWizard.php
-index e2e9756..7ad9190 100644
---- a/frontends/php/include/classes/setup/CSetupWizard.php
-+++ b/frontends/php/include/classes/setup/CSetupWizard.php
-@@ -333,7 +333,7 @@ class CSetupWizard extends CForm {
- 	function stage5() {
- 		$this->setConfig('ZBX_CONFIG_FILE_CORRECT', true);
- 
--		$config_file_name = Z::getInstance()->getRootDir().CConfigFile::CONFIG_FILE_PATH;
-+		$config_file_name = CConfigFile::CONFIG_FILE_PATH;
- 		$config = new CConfigFile($config_file_name);
- 		$config->config = [
- 			'DB' => [
-@@ -502,7 +502,7 @@ class CSetupWizard extends CForm {
- 				// make zabbix.conf.php downloadable
- 				header('Content-Type: application/x-httpd-php');
- 				header('Content-Disposition: attachment; filename="'.basename(CConfigFile::CONFIG_FILE_PATH).'"');
--				$config = new CConfigFile(Z::getInstance()->getRootDir().CConfigFile::CONFIG_FILE_PATH);
-+				$config = new CConfigFile(CConfigFile::CONFIG_FILE_PATH);
- 				$config->config = [
- 					'DB' => [
- 						'TYPE' => $this->getConfig('DB_TYPE'),

zabbix-config.patch

@@ -0,0 +1,48 @@
+diff --git a/ui/include/classes/core/CConfigFile.php b/ui/include/classes/core/CConfigFile.php
+index d7ad93a..88b7d5f 100644
+--- a/ui/include/classes/core/CConfigFile.php
++++ b/ui/include/classes/core/CConfigFile.php
+@@ -20,7 +20,7 @@ class CConfigFile {
+ 	const CONFIG_ERROR = 2;
+ 	const CONFIG_VAULT_ERROR = 3;
+ 
+-	const CONFIG_FILE_PATH = '/conf/zabbix.conf.php';
++	const CONFIG_FILE_PATH = '/etc/zabbix/web/zabbix.conf.php';
+ 
+ 	private static $supported_db_types = [
+ 		ZBX_DB_MYSQL => true,
+diff --git a/ui/include/classes/core/ZBase.php b/ui/include/classes/core/ZBase.php
+index 51b2165..e57e5a8 100644
+--- a/ui/include/classes/core/ZBase.php
++++ b/ui/include/classes/core/ZBase.php
+@@ -392,7 +392,7 @@ class ZBase {
+ 	 * @throws Exception
+ 	 */
+ 	protected function setMaintenanceMode() {
+-		require_once 'conf/maintenance.inc.php';
++		require_once '/etc/zabbix/web/maintenance.inc.php';
+ 
+ 		if (defined('ZBX_DENY_GUI_ACCESS')) {
+ 			if (!isset($ZBX_GUI_ACCESS_IP_RANGE) || !in_array(CWebUser::getIp(), $ZBX_GUI_ACCESS_IP_RANGE)) {
+@@ -405,7 +405,7 @@ class ZBase {
+ 	 * Load zabbix config file.
+ 	 */
+ 	protected function loadConfigFile(): void {
+-		$configFile = $this->root_dir.CConfigFile::CONFIG_FILE_PATH;
++		$configFile = CConfigFile::CONFIG_FILE_PATH;
+ 
+ 		$config = new CConfigFile($configFile);
+ 
+diff --git a/ui/include/classes/setup/CSetupWizard.php b/ui/include/classes/setup/CSetupWizard.php
+index 8574868..79d0c72 100644
+--- a/ui/include/classes/setup/CSetupWizard.php
++++ b/ui/include/classes/setup/CSetupWizard.php
+@@ -328,7 +328,7 @@ class CSetupWizard extends CForm {
+ 				// make zabbix.conf.php downloadable
+ 				header('Content-Type: application/x-httpd-php');
+ 				header('Content-Disposition: attachment; filename="'.basename(CConfigFile::CONFIG_FILE_PATH).'"');
+-				$config = new CConfigFile(APP::getRootDir().CConfigFile::CONFIG_FILE_PATH);
++				$config = new CConfigFile(CConfigFile::CONFIG_FILE_PATH);
+ 				$config->config = [
+ 					'DB' => [
+ 						'TYPE' => $this->getConfig('DB_TYPE'),

zabbix-configure-sscanf.patch

@@ -0,0 +1,17 @@
+sscanf needs <stdio.h> for the prototype.  Submitted upstream here:
+
+  <https://support.zabbix.com/browse/ZBX-21946>
+
+diff --git a/configure.ac b/configure.ac
+index 0588004f9f89cdd5..bbc60e3a28369f9f 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -952,6 +952,7 @@ dnl FreeBSD 4.x does not support %llu
+ AC_MSG_CHECKING(for long long format)
+ AC_RUN_IFELSE([AC_LANG_SOURCE([[
+ #include <sys/types.h>
++#include <stdio.h>
+ int main()
+ {
+         uint64_t i;
+

zabbix-crypto-policy.patch

@@ -0,0 +1,44 @@
+diff --git a/src/go/pkg/tls/tls.go b/src/go/pkg/tls/tls.go
+index b7ddff4..063eb02 100644
+--- a/src/go/pkg/tls/tls.go
++++ b/src/go/pkg/tls/tls.go
+@@ -406,6 +406,8 @@ static void *tls_new_context(const char *ca_file, const char *crl_file, const ch
+ #endif
+ 	if (NULL != cipher)
+ 		ciphers = cipher;
++	else
++		ciphers = "PROFILE=SYSTEM";
+ 
+ 	if (1 != SSL_CTX_set_cipher_list(ctx, ciphers))
+ 		goto out;
+diff --git a/src/libs/zbxcomms/tls_openssl.c b/src/libs/zbxcomms/tls_openssl.c
+index 40394a3..b2eb0f0 100644
+--- a/src/libs/zbxcomms/tls_openssl.c
++++ b/src/libs/zbxcomms/tls_openssl.c
+@@ -1212,7 +1212,7 @@ void	zbx_tls_init_child(const zbx_config_tls_t *config_tls, zbx_get_program_type
+ 				goto out;
+ 			}
+ 		}
+-		else if (1 != SSL_CTX_set_cipher_list(ctx_cert, ciphers))
++		else if (1 != SSL_CTX_set_cipher_list(ctx_cert, "PROFILE=SYSTEM"))
+ 		{
+ 			zbx_snprintf_alloc(&error, &error_alloc, &error_offset, "cannot set list of certificate"
+ 					" ciphersuites:");
+@@ -1302,7 +1302,7 @@ void	zbx_tls_init_child(const zbx_config_tls_t *config_tls, zbx_get_program_type
+ 				goto out;
+ 			}
+ 		}
+-		else if (1 != SSL_CTX_set_cipher_list(ctx_psk, ciphers))
++		else if (1 != SSL_CTX_set_cipher_list(ctx_psk, "PROFILE=SYSTEM"))
+ 		{
+ 			zbx_snprintf_alloc(&error, &error_alloc, &error_offset, "cannot set list of PSK ciphersuites:");
+ 			goto out;
+@@ -1360,7 +1360,7 @@ void	zbx_tls_init_child(const zbx_config_tls_t *config_tls, zbx_get_program_type
+ 				goto out;
+ 			}
+ 		}
+-		else if (1 != SSL_CTX_set_cipher_list(ctx_all, ciphers))
++		else if (1 != SSL_CTX_set_cipher_list(ctx_all, "PROFILE=SYSTEM"))
+ 		{
+ 			zbx_snprintf_alloc(&error, &error_alloc, &error_offset, "cannot set list of all ciphersuites:");
+ 			goto out;

zabbix-drop-des.patch

@@ -0,0 +1,25 @@
+From 2d5e3532b2313e9c70e5125101bc27c99115a85d Mon Sep 17 00:00:00 2001
+From: Morten Stevens <mstevens@fedoraproject.org>
+Date: Mon, 26 Jul 2021 10:17:48 +0200
+Subject: [PATCH] Drop support for usmDESPrivProtocol
+
+---
+ src/zabbix_server/poller/checks_snmp.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/src/zabbix_server/poller/checks_snmp.c b/src/zabbix_server/poller/checks_snmp.c
+index 40d6eb23699..17f668eeb28 100644
+--- a/src/zabbix_server/poller/checks_snmp.c
++++ b/src/zabbix_server/poller/checks_snmp.c
+@@ -568,11 +568,6 @@ static struct snmp_session	*zbx_snmp_open_session(const DC_ITEM *item, char *err
+ 
+ 				switch (item->snmpv3_privprotocol)
+ 				{
+-					case ITEM_SNMPV3_PRIVPROTOCOL_DES:
+-						/* set the privacy protocol to DES */
+-						session.securityPrivProto = usmDESPrivProtocol;
+-						session.securityPrivProtoLen = USM_PRIV_PROTO_DES_LEN;
+-						break;
+ 					case ITEM_SNMPV3_PRIVPROTOCOL_AES:
+ 						/* set the privacy protocol to AES */
+ 						session.securityPrivProto = usmAESPrivProtocol;

zabbix-fedora-epel.README

@@ -99,14 +99,7 @@ ownership.
 
 ==No Java bridge==
 
-The Zabbix Java bridge can not be included now, due to legal issue with one of
-the modules (json). See https://support.zabbix.com/browse/ZBX-4800 and feel free
-to vote on it.
-
-
-==No SQLite front-end or server implementation==
-
-Sadly it doesn't work with how Fedora's/EPEL's PHP is compiled.
+The Zabbix Java bridge can not be included now, due to missing dependencies.
 
 
 =SELinux=
@@ -134,6 +127,7 @@ If you're using ping from the frontend:
 
 echo "avc:  denied  { setpgid } for  pid=31880 comm="zabbix_server_p" scontext=system_u:system_r:zabbix_t:s0 tcontext=system_u:system_r:zabbix_t:s0 tclass=process" | audit2allow -M zabbix_ping_frontend; sudo semodule -i zabbix_ping_frontend.pp
 
+
 =Additional packaging changes in Fedora/EPEL since 3.0=
 
 ==Configuration files contain the actual defaults==
@@ -220,24 +214,4 @@ Be sure to read the upgrades notes of the latest minor release too!
   The schema conversion should finish within minutes or hours
 
 
-=Guide for upgrading to 2.0 from 1.8=
-
-https://www.zabbix.com/documentation/2.0/manual/installation/upgrade_notes?s[]=upgrade&s[]=notes&s[]=2&s[]=0
-
-Be sure to read the upgrades notes of the latest minor release too!
-
-The below should be the relevant steps, picked from
-http://www.zabbix.com/documentation/2.0/manual/installation/upgrade
-
-- Review all rpmnew and rpmsave files; merge where necessary
-- Review permissions, ownerships and group memberships for zabbixsrv
-- Back up the Zabbix database (really!)
-- Remove custom database changes, if any
-- Make sure the database user has sufficing permissions
-  (ALTER TABLE, DROP INDEX, DROP TABLE, ...)
-- Run the fitting database update script/s
-- The scripts can run very long, depending on the content of your database and
-  your hardware;
-- Check the output of the script for errors
-
 Volker Fröhlich volker27@gmx.at Jan  5 2013

zabbix-out-of-tree.patch

@@ -0,0 +1,157 @@
+diff --git a/src/go/Makefile.am b/src/go/Makefile.am
+index 3e24aa0..308e34b 100644
+--- a/src/go/Makefile.am
++++ b/src/go/Makefile.am
+@@ -89,9 +90,9 @@ install-bin/zabbix_agent2: bin/zabbix_agent2
+ 	$(INSTALL) -d "$(DESTDIR)$(sbindir)"
+ 	$(INSTALL_PROGRAM) bin/zabbix_agent2 "$(DESTDIR)$(sbindir)"
+ 	$(INSTALL) -d "$(DESTDIR)$(AGENT2_PLUGIN_CONFIG_DIR)"
+-	$(INSTALL_DATA) conf/zabbix_agent2.conf "$(DESTDIR)$(sysconfdir)"
++	$(INSTALL_DATA) $(top_srcdir)/src/go/conf/zabbix_agent2.conf "$(DESTDIR)$(sysconfdir)"
+ 	$(INSTALL) -d "$(DESTDIR)$(AGENT2_PLUGIN_CONFIG_DIR)"
+-	(cd conf/zabbix_agent2.d/plugins.d && \
++	(cd $(top_srcdir)/conf/zabbix_agent2.d/plugins.d && \
+ 	for _f in *.conf; do \
+ 		$(INSTALL_DATA) $${_f} "$(DESTDIR)$(AGENT2_PLUGIN_CONFIG_DIR)"; \
+ 	done)
+diff --git a/src/zabbix_agent/Makefile.am b/src/zabbix_agent/Makefile.am
+index b217fb5..945a673 100644
+--- a/src/zabbix_agent/Makefile.am
++++ b/src/zabbix_agent/Makefile.am
+@@ -69,4 +69,4 @@ zabbix_agentd_CFLAGS = \
+ install-data-hook:
+ 	$(MKDIR_P) "$(DESTDIR)$(AGENT_CONFIG_FILE).d"
+ 	$(MKDIR_P) "$(DESTDIR)$(LOAD_MODULE_PATH)"
+-	test -f "$(DESTDIR)$(AGENT_CONFIG_FILE)" || cp "../../conf/zabbix_agentd.conf" "$(DESTDIR)$(AGENT_CONFIG_FILE)"
++	test -f "$(DESTDIR)$(AGENT_CONFIG_FILE)" || cp "$(top_srcdir)/conf/zabbix_agentd.conf" "$(DESTDIR)$(AGENT_CONFIG_FILE)"
+diff --git a/src/zabbix_proxy/Makefile.am b/src/zabbix_proxy/Makefile.am
+index b56f8a8..44800a0 100644
+--- a/src/zabbix_proxy/Makefile.am
++++ b/src/zabbix_proxy/Makefile.am
+@@ -151,4 +151,4 @@ install-data-hook:
+ 	$(MKDIR_P) "$(DESTDIR)$(PROXY_CONFIG_FILE).d"
+ 	$(MKDIR_P) "$(DESTDIR)$(EXTERNAL_SCRIPTS_PATH)"
+ 	$(MKDIR_P) "$(DESTDIR)$(LOAD_MODULE_PATH)"
+-	test -f "$(DESTDIR)$(PROXY_CONFIG_FILE)" || cp "../../conf/zabbix_proxy.conf" "$(DESTDIR)$(PROXY_CONFIG_FILE)"
++	test -f "$(DESTDIR)$(PROXY_CONFIG_FILE)" || cp "$(top_srcdir)/conf/zabbix_proxy.conf" "$(DESTDIR)$(PROXY_CONFIG_FILE)"
+diff --git a/src/zabbix_server/Makefile.am b/src/zabbix_server/Makefile.am
+index 0a55934..a7f6a28 100644
+--- a/src/zabbix_server/Makefile.am
++++ b/src/zabbix_server/Makefile.am
+@@ -186,4 +186,4 @@ install-data-hook:
+ 	$(MKDIR_P) "$(DESTDIR)$(EXTERNAL_SCRIPTS_PATH)"
+ 	$(MKDIR_P) "$(DESTDIR)$(ALERT_SCRIPTS_PATH)"
+ 	$(MKDIR_P) "$(DESTDIR)$(LOAD_MODULE_PATH)"
+-	test -f "$(DESTDIR)$(SERVER_CONFIG_FILE)" || cp "../../conf/zabbix_server.conf" "$(DESTDIR)$(SERVER_CONFIG_FILE)"
++	test -f "$(DESTDIR)$(SERVER_CONFIG_FILE)" || cp "$(top_srcdir)/conf/zabbix_server.conf" "$(DESTDIR)$(SERVER_CONFIG_FILE)"
+diff -up zabbix-7.2.0/configure.ac.out-of-tree zabbix-7.2.0/configure.ac
+--- zabbix-7.2.0/configure.ac.out-of-tree	2024-12-09 04:53:54.274588489 -0700
++++ zabbix-7.2.0/configure.ac	2024-12-11 20:31:44.684746169 -0700
+@@ -22,7 +22,7 @@ AC_CONFIG_MACRO_DIR([m4])
+ AC_CONFIG_SRCDIR([src/zabbix_server/server.c])
+ AC_CONFIG_HEADERS([include/common/config.h])
+ 
+-AC_SUBST(DEFAULT_INCLUDES, ['-I$(top_srcdir)/include/common -I$(top_srcdir)/include'])
++AC_SUBST(DEFAULT_INCLUDES, ['-I$(top_builddir)/include/common -I$(top_srcdir)/include/common -I$(top_srcdir)/include'])
+ 
+ AC_CANONICAL_BUILD
+ AC_CANONICAL_HOST
+--- zabbix-7.4.3/src/go/Makefile.am~	2025-10-01 09:49:27.351910250 -0500
++++ zabbix-7.4.3/src/go/Makefile.am	2025-10-01 10:33:26.662210424 -0500
+@@ -64,6 +64,7 @@
+ clean-go-build:
+ 	-$(GO) clean ./...
+ 	-$(GO) clean -cache
++	-$(GO) clean $(srcdir)/...
+ 	-rm -f bin/mock_server
+ 	-rm -f bin/zabbix_agent2
+ 	-rm -f bin/zabbix_web_service
+--- a/src/zabbix_java/Makefile.am~	2026-07-07 09:04:30.341683492 -0500
++++ b/src/zabbix_java/Makefile.am	2026-07-09 10:47:55.481651595 -0500
+@@ -9,23 +9,23 @@
+ 	startup.sh
+ 
+ ZJG = bin/zabbix-java-gateway-$(VERSION).jar
+-LIB = lib/android-json-4.3_r3.1.jar:lib/logback-core-1.5.16.jar:lib/logback-classic-1.5.16.jar:lib/slf4j-api-2.0.16.jar:lib/dnsjava-3.6.4.jar
++LIB = $(srcdir)lib/android-json-4.3_r3.1.jar:$(srcdir)lib/logback-core-1.5.16.jar:$(srcdir)lib/logback-classic-1.5.16.jar:$(srcdir)lib/slf4j-api-2.0.16.jar:$(srcdir)lib/dnsjava-3.6.4.jar
+ 
+-JUNIT = tests/junit-4.8.2.jar
++JUNIT = $(srcdir)tests/junit-4.8.2.jar
+ 
+ ZJG_DEST = $(DESTDIR)$(sbindir)/zabbix_java
+ 
+ all: $(ZJG)
+ 
+-$(ZJG): class src/com/zabbix/gateway/*.java
+-	$(JAVAC) -d class/src -classpath $(LIB) src/com/zabbix/gateway/*.java
++$(ZJG): class $(srcdir)src/com/zabbix/gateway/*.java
++	$(JAVAC) -d class/src -classpath $(LIB) $(srcdir)src/com/zabbix/gateway/*.java
+ 	$(JAR) cf $(ZJG) -C class/src .
+ 
+ test: class
+ 	echo "badger useruser" > tests/com/zabbix/gateway/jmx_test_beans/jmxremote.password
+ 	chmod 600 tests/com/zabbix/gateway/jmx_test_beans/jmxremote.password
+-	$(JAVAC) tests/com/zabbix/gateway/jmx_test_beans/*.java
+-	$(JAVAC) -d class/tests -classpath class/src:$(JUNIT) tests/com/zabbix/gateway/*.java
++	$(JAVAC) tests/com/zabbix/gateway/jmx_$(srcdir)/test_beans/*.java
++	$(JAVAC) -d class/tests -classpath class/src:$(JUNIT) $(srcdir)tests/com/zabbix/gateway/*.java
+ 	java -classpath class/tests:$(LIB):$(ZJG):$(JUNIT) com.zabbix.gateway.AllTestRunner
+ 
+ class:
+--- a/src/zabbix_js/Makefile.am.orig	2026-07-09 10:49:49.036634968 -0500
++++ b/src/zabbix_js/Makefile.am	2026-07-09 10:50:03.475753570 -0500
+@@ -5,30 +5,30 @@
+ zabbix_js_SOURCES = zabbix_js.c
+ 
+ zabbix_js_LDADD = \
+-	$(top_srcdir)/src/libs/zbxlog/libzbxlog.a \
+-	$(top_srcdir)/src/libs/zbxembed/libzbxembed.a \
+-	$(top_srcdir)/src/libs/zbxjson/libzbxjson.a \
+-	$(top_srcdir)/src/libs/zbxregexp/libzbxregexp.a \
+-	$(top_srcdir)/src/libs/zbxthreads/libzbxthreads.a \
+-	$(top_srcdir)/src/libs/zbxmutexs/libzbxmutexs.a \
+-	$(top_srcdir)/src/libs/zbxprof/libzbxprof.a \
+-	$(top_srcdir)/src/libs/zbxnix/libzbxnix.a \
+-	$(top_srcdir)/src/libs/zbxcomms/libzbxcomms.a \
+-	$(top_srcdir)/src/libs/zbxip/libzbxip.a \
+-	$(top_srcdir)/src/libs/zbxgetopt/libzbxgetopt.a \
+-	$(top_srcdir)/src/libs/zbxhash/libzbxhash.a \
+-	$(top_srcdir)/src/libs/zbxcrypto/libzbxcrypto.a \
+-	$(top_srcdir)/src/libs/zbxcompress/libzbxcompress.a \
+-	$(top_srcdir)/src/libs/zbxhttp/libzbxhttp.a \
+-	$(top_srcdir)/src/libs/zbxvariant/libzbxvariant.a \
+-	$(top_srcdir)/src/libs/zbxxml/libzbxxml.a \
+-	$(top_srcdir)/src/libs/zbxalgo/libzbxalgo.a \
+-	$(top_srcdir)/src/libs/zbxstr/libzbxstr.a \
+-	$(top_srcdir)/src/libs/zbxnum/libzbxnum.a \
+-	$(top_srcdir)/src/libs/zbxtime/libzbxtime.a \
+-	$(top_srcdir)/src/libs/zbxcommon/libzbxcommon.a \
+-	$(top_srcdir)/src/libs/zbxbincommon/libzbxbincommon.a \
+-	$(top_srcdir)/src/libs/zbxcurl/libzbxcurl.a
++	$(top_builddir)/src/libs/zbxlog/libzbxlog.a \
++	$(top_builddir)/src/libs/zbxembed/libzbxembed.a \
++	$(top_builddir)/src/libs/zbxjson/libzbxjson.a \
++	$(top_builddir)/src/libs/zbxregexp/libzbxregexp.a \
++	$(top_builddir)/src/libs/zbxthreads/libzbxthreads.a \
++	$(top_builddir)/src/libs/zbxmutexs/libzbxmutexs.a \
++	$(top_builddir)/src/libs/zbxprof/libzbxprof.a \
++	$(top_builddir)/src/libs/zbxnix/libzbxnix.a \
++	$(top_builddir)/src/libs/zbxcomms/libzbxcomms.a \
++	$(top_builddir)/src/libs/zbxip/libzbxip.a \
++	$(top_builddir)/src/libs/zbxgetopt/libzbxgetopt.a \
++	$(top_builddir)/src/libs/zbxhash/libzbxhash.a \
++	$(top_builddir)/src/libs/zbxcrypto/libzbxcrypto.a \
++	$(top_builddir)/src/libs/zbxcompress/libzbxcompress.a \
++	$(top_builddir)/src/libs/zbxhttp/libzbxhttp.a \
++	$(top_builddir)/src/libs/zbxvariant/libzbxvariant.a \
++	$(top_builddir)/src/libs/zbxxml/libzbxxml.a \
++	$(top_builddir)/src/libs/zbxalgo/libzbxalgo.a \
++	$(top_builddir)/src/libs/zbxstr/libzbxstr.a \
++	$(top_builddir)/src/libs/zbxnum/libzbxnum.a \
++	$(top_builddir)/src/libs/zbxtime/libzbxtime.a \
++	$(top_builddir)/src/libs/zbxcommon/libzbxcommon.a \
++	$(top_builddir)/src/libs/zbxbincommon/libzbxbincommon.a \
++	$(top_builddir)/src/libs/zbxcurl/libzbxcurl.a
+ 
+ zabbix_js_LDADD += @ZBXJS_LIBS@ $(LIBXML2_LIBS)
+ 

zabbix-php-fpm.conf

@@ -0,0 +1,24 @@
+[zabbix]
+user = apache
+group = apache
+
+listen = /run/php-fpm/zabbix.sock
+listen.acl_users = apache,nginx
+listen.allowed_clients = 127.0.0.1
+
+pm = dynamic
+pm.max_children = 50
+pm.start_servers = 5
+pm.min_spare_servers = 5
+pm.max_spare_servers = 35
+
+php_value[session.save_handler] = files
+php_value[session.save_path]    = /var/lib/php/session
+
+php_value[max_execution_time] = 300
+php_value[memory_limit] = 128M
+php_value[post_max_size] = 16M
+php_value[upload_max_filesize] = 2M
+php_value[max_input_time] = 300
+php_value[max_input_vars] = 10000
+; php_value[date.timezone] = Europe/Riga

zabbix-web.conf

@@ -7,56 +7,29 @@ Alias /zabbix /usr/share/zabbix
 <Directory "/usr/share/zabbix">
     Options FollowSymLinks
     AllowOverride None
+    Require all granted
 
-    <IfModule mod_authz_core.c>
-      # Apache 2.4
-      Require all granted
-    </IfModule>
-   
-    <IfModule !mod_authz_core.c>
-      # Apache 2.2
-      Order allow,deny
-      Allow from all
+    <IfModule dir_module>
+        DirectoryIndex index.php
     </IfModule>
 
-    <IfModule mod_php5.c>
-        php_value max_execution_time 300
-        php_value memory_limit 128M
-        php_value post_max_size 16M
-        php_value upload_max_filesize 2M
-        php_value max_input_time 300
-
-        # Removed in PHP 7
-        php_value always_populate_raw_post_data -1
-
-        php_flag session.auto_start off
-        php_value mbstring.func_overload 0
-        # php_value date.timezone UTC
-    </IfModule>
+    <FilesMatch \.(php|phar)$>
+        SetHandler "proxy:unix:/run/php-fpm/zabbix.sock|fcgi://localhost"
+    </FilesMatch>
 </Directory>
 
-<Directory ~ "^/usr/share/zabbix/(conf|app|include|local)/">
-    <IfModule mod_authz_core.c>
-      # Apache 2.4
-      Require all denied
-    </IfModule>
+<Directory "/usr/share/zabbix/conf">
+    Require all denied
+</Directory>
 
-    <IfModule !mod_authz_core.c>
-      # Apache 2.2
-      Order deny,allow
-      Deny from all
-    </IfModule>
+<Directory "/usr/share/zabbix/app">
+    Require all denied
+</Directory>
 
-    <files *.php>
-      <IfModule mod_authz_core.c>
-        # Apache 2.4
-        Require all denied
-      </IfModule>
+<Directory "/usr/share/zabbix/include">
+    Require all denied
+</Directory>
 
-      <IfModule !mod_authz_core.c>
-        Order deny,allow
-        Deny from all
-      </IfModule>
-
-    </files>
+<Directory "/usr/share/zabbix/local">
+    Require all denied
 </Directory>

zabbix.fc

@@ -0,0 +1,25 @@
+/etc/rc\.d/init\.d/(zabbix|zabbix-server)	--	gen_context(system_u:object_r:zabbix_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/zabbix-agentd	--	gen_context(system_u:object_r:zabbix_agent_initrc_exec_t,s0)
+
+/usr/bin/zabbix_server	--	gen_context(system_u:object_r:zabbix_exec_t,s0)
+/usr/bin/zabbix_agentd	--	gen_context(system_u:object_r:zabbix_agent_exec_t,s0)
+
+/usr/sbin/zabbix_agentd	--	gen_context(system_u:object_r:zabbix_agent_exec_t,s0)
+/usr/sbin/zabbix_server	--	gen_context(system_u:object_r:zabbix_exec_t,s0)
+/usr/sbin/zabbix_server_mysql	--	gen_context(system_u:object_r:zabbix_exec_t,s0)
+/usr/sbin/zabbix_server_pgsql	--	gen_context(system_u:object_r:zabbix_exec_t,s0)
+/usr/sbin/zabbix_server_sqlite3	--	gen_context(system_u:object_r:zabbix_exec_t,s0)
+/usr/sbin/zabbix_proxy	        --	gen_context(system_u:object_r:zabbix_exec_t,s0)
+/usr/sbin/zabbix_proxy_mysql   --  gen_context(system_u:object_r:zabbix_exec_t,s0)
+/usr/sbin/zabbix_proxy_pgsql   --  gen_context(system_u:object_r:zabbix_exec_t,s0)
+/usr/sbin/zabbix_proxy_sqlite3 --  gen_context(system_u:object_r:zabbix_exec_t,s0)
+
+/var/lib/zabbix(/.*)?    gen_context(system_u:object_r:zabbix_var_lib_t,s0)
+
+/var/lib/zabbixsrv(/.*)?	gen_context(system_u:object_r:zabbix_var_lib_t,s0)
+/var/lib/zabbixsrv/.*scripts(/.*)?    gen_context(system_u:object_r:zabbix_script_exec_t,s0)
+/var/lib/zabbixsrv/tmp(/.*)?	gen_context(system_u:object_r:zabbix_tmp_t,s0)
+
+/var/log/zabbix.*	gen_context(system_u:object_r:zabbix_log_t,s0)
+
+/var/run/zabbix(/.*)?	gen_context(system_u:object_r:zabbix_var_run_t,s0)

zabbix.if

@@ -0,0 +1,199 @@
+## <summary>Distributed infrastructure monitoring</summary>
+
+########################################
+## <summary>
+##	Execute a domain transition to run zabbix.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`zabbix_domtrans',`
+	gen_require(`
+		type zabbix_t, zabbix_exec_t;
+	')
+
+	domtrans_pattern($1, zabbix_exec_t, zabbix_t)
+')
+
+########################################
+## <summary>
+##	Execute a domain transition to run zabbix_script.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`zabbix_script_domtrans',`
+	gen_require(`
+		type zabbix_script_t, zabbix_script_exec_t;
+	')
+
+	domtrans_pattern($1, zabbix_script_exec_t, zabbix_script_t)
+')
+
+########################################
+## <summary>
+## 	Allow connectivity to the zabbix server
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`zabbix_tcp_connect',`
+	gen_require(`
+		type zabbix_t;
+	')
+
+	corenet_sendrecv_zabbix_agent_client_packets($1)
+	corenet_tcp_connect_zabbix_port($1)
+	corenet_tcp_recvfrom_labeled($1, zabbix_t)
+	corenet_tcp_sendrecv_zabbix_port($1)
+')
+
+########################################
+## <summary>
+##	Allow the specified domain to read zabbix's log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`zabbix_read_log',`
+	gen_require(`
+		type zabbix_log_t;
+	')
+
+	logging_search_logs($1)
+	read_files_pattern($1, zabbix_log_t, zabbix_log_t)
+')
+
+########################################
+## <summary>
+##	Allow the specified domain to read zabbix's tmp files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`zabbix_read_tmp',`
+	gen_require(`
+		type zabbix_tmp_t;
+	')
+
+	files_search_tmp($1)
+	read_files_pattern($1, zabbix_tmp_t, zabbix_tmp_t)
+')
+
+########################################
+## <summary>
+##	Allow the specified domain to append
+##	zabbix log files.
+## </summary>
+## <param name="domain">
+## 	<summary>
+##	Domain allowed access.
+## 	</summary>
+## </param>
+#
+interface(`zabbix_append_log',`
+	gen_require(`
+		type zabbix_log_t;
+	')
+
+	logging_search_logs($1)
+	append_files_pattern($1, zabbix_log_t, zabbix_log_t)
+')
+
+########################################
+## <summary>
+##	Read zabbix PID files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`zabbix_read_pid_files',`
+	gen_require(`
+		type zabbix_var_run_t;
+	')
+
+	files_search_pids($1)
+	allow $1 zabbix_var_run_t:file read_file_perms;
+')
+
+########################################
+## <summary>
+## 	Allow connectivity to a zabbix agent
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`zabbix_agent_tcp_connect',`
+	gen_require(`
+		type zabbix_t, zabbix_agent_t;
+	')
+
+	corenet_sendrecv_zabbix_agent_client_packets($1)
+	corenet_tcp_connect_zabbix_agent_port($1)
+	corenet_tcp_recvfrom_labeled($1, zabbix_t)
+	corenet_tcp_sendrecv_zabbix_agent_port($1)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate
+##	an zabbix environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the zabbix domain.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`zabbix_admin',`
+	gen_require(`
+		type zabbix_t, zabbix_log_t, zabbix_var_run_t;
+		type zabbix_initrc_exec_t;
+	')
+
+	allow $1 zabbix_t:process signal_perms;
+	ps_process_pattern($1, zabbix_t)
+	tunable_policy(`deny_ptrace',`',`
+		allow $1 zabbix_t:process ptrace;
+	')
+
+	init_labeled_script_domtrans($1, zabbix_initrc_exec_t)
+	domain_system_change_exemption($1)
+	role_transition $2 zabbix_initrc_exec_t system_r;
+	allow $2 system_r;
+
+	logging_list_logs($1)
+	admin_pattern($1, zabbix_log_t)
+
+	files_list_pids($1)
+	admin_pattern($1, zabbix_var_run_t)
+')

zabbix.te

@@ -0,0 +1,374 @@
+policy_module(zabbix, 1.7.0)
+
+########################################
+#
+# Declarations
+#
+
+## <desc>
+##  <p>
+##	Determine whether zabbix can
+##	connect to all TCP ports
+##	</p>
+## </desc>
+gen_tunable(zabbix_can_network, false)
+
+
+## <desc>
+## <p>
+## Allow Zabbix to run su/sudo.
+## </p>
+## </desc>
+gen_tunable(zabbix_run_sudo, false)
+
+gen_require(`
+    class passwd rootok;
+    class passwd passwd;
+')
+
+attribute zabbix_domain;
+
+type zabbix_t, zabbix_domain;
+type zabbix_exec_t;
+init_daemon_domain(zabbix_t, zabbix_exec_t)
+
+type zabbix_initrc_exec_t;
+init_script_file(zabbix_initrc_exec_t)
+
+type zabbix_agent_t, zabbix_domain;
+type zabbix_agent_exec_t;
+init_daemon_domain(zabbix_agent_t, zabbix_agent_exec_t)
+
+type zabbix_agent_initrc_exec_t;
+init_script_file(zabbix_agent_initrc_exec_t)
+
+type zabbixd_var_lib_t;
+files_type(zabbixd_var_lib_t)
+
+type zabbix_log_t;
+logging_log_file(zabbix_log_t)
+
+type zabbix_tmp_t;
+files_tmp_file(zabbix_tmp_t)
+
+type zabbix_tmpfs_t;
+files_tmpfs_file(zabbix_tmpfs_t)
+
+type zabbix_var_lib_t;
+files_type(zabbix_var_lib_t)
+
+type zabbix_var_run_t;
+files_pid_file(zabbix_var_run_t)
+
+type zabbix_script_t;
+type zabbix_script_exec_t;
+domain_type(zabbix_script_t)
+domain_entry_file(zabbix_script_t, zabbix_script_exec_t)
+application_executable_file(zabbix_script_exec_t)
+role system_r types zabbix_script_t;
+
+########################################
+#
+# zabbix domain local policy
+#
+
+allow zabbix_domain self:capability { setgid setuid };
+allow zabbix_domain self:process { getsched setpgid setsched signal_perms };
+allow zabbix_domain self:fifo_file rw_fifo_file_perms;
+allow zabbix_domain self:sem create_sem_perms;
+allow zabbix_domain self:shm create_shm_perms;
+allow zabbix_domain self:tcp_socket { accept listen };
+allow zabbix_domain self:unix_stream_socket create_stream_socket_perms;
+
+kernel_read_all_sysctls(zabbix_domain)
+kernel_read_network_state(zabbix_domain)
+
+corenet_tcp_sendrecv_generic_if(zabbix_domain)
+corenet_tcp_sendrecv_generic_node(zabbix_domain)
+corenet_tcp_bind_generic_node(zabbix_domain)
+
+corecmd_exec_shell(zabbix_domain)
+corecmd_exec_bin(zabbix_domain)
+
+dev_read_sysfs(zabbix_domain)
+dev_read_urand(zabbix_domain)
+
+########################################
+#
+# Local policy
+#
+
+allow zabbix_t self:capability { dac_read_search  };
+allow zabbix_t self:process { setrlimit };
+allow zabbix_t self:unix_stream_socket connectto;
+
+manage_dirs_pattern(zabbix_t, zabbix_var_lib_t, zabbix_var_lib_t)
+manage_files_pattern(zabbix_t, zabbix_var_lib_t, zabbix_var_lib_t)
+manage_lnk_files_pattern(zabbix_t, zabbix_var_lib_t, zabbix_var_lib_t)
+manage_sock_files_pattern(zabbix_t, zabbix_var_lib_t, zabbix_var_lib_t)
+files_var_lib_filetrans(zabbix_t, zabbix_var_lib_t, dir, "zabbixsrv")
+
+manage_dirs_pattern(zabbix_t, zabbix_log_t, zabbix_log_t)
+manage_files_pattern(zabbix_t, zabbix_log_t, zabbix_log_t)
+manage_lnk_files_pattern(zabbix_t, zabbix_log_t, zabbix_log_t)
+logging_log_filetrans(zabbix_t, zabbix_log_t, { dir file })
+
+manage_dirs_pattern(zabbix_t, zabbix_tmp_t, zabbix_tmp_t)
+manage_files_pattern(zabbix_t, zabbix_tmp_t, zabbix_tmp_t)
+manage_sock_files_pattern(zabbix_t, zabbix_tmp_t, zabbix_tmp_t)
+files_tmp_filetrans(zabbix_t, zabbix_tmp_t, { dir file sock_file })
+
+rw_files_pattern(zabbix_t, zabbix_tmpfs_t, zabbix_tmpfs_t)
+fs_tmpfs_filetrans(zabbix_t, zabbix_tmpfs_t, file)
+
+manage_dirs_pattern(zabbix_t, zabbix_var_run_t, zabbix_var_run_t)
+manage_files_pattern(zabbix_t, zabbix_var_run_t, zabbix_var_run_t)
+manage_sock_files_pattern(zabbix_t, zabbix_var_run_t, zabbix_var_run_t)
+files_pid_filetrans(zabbix_t, zabbix_var_run_t, { dir file sock_file })
+
+kernel_read_system_state(zabbix_t)
+
+corenet_all_recvfrom_unlabeled(zabbix_t)
+corenet_all_recvfrom_netlabel(zabbix_t)
+
+corenet_sendrecv_ftp_client_packets(zabbix_t)
+corenet_tcp_connect_ftp_port(zabbix_t)
+corenet_tcp_sendrecv_ftp_port(zabbix_t)
+
+corenet_sendrecv_http_client_packets(zabbix_t)
+corenet_tcp_connect_http_port(zabbix_t)
+corenet_tcp_sendrecv_http_port(zabbix_t)
+corenet_tcp_connect_smtp_port(zabbix_t)
+
+corenet_sendrecv_zabbix_server_packets(zabbix_t)
+corenet_tcp_bind_zabbix_port(zabbix_t)
+corenet_tcp_sendrecv_zabbix_port(zabbix_t)
+
+auth_use_nsswitch(zabbix_t)
+
+zabbix_agent_tcp_connect(zabbix_t)
+
+logging_send_syslog_msg(zabbix_t)
+
+tunable_policy(`zabbix_can_network',`
+	corenet_sendrecv_all_client_packets(zabbix_t)
+	corenet_tcp_connect_all_ports(zabbix_t)
+	corenet_tcp_sendrecv_all_ports(zabbix_t)
+')
+
+tunable_policy(`zabbix_run_sudo',`
+    allow zabbix_t self:capability { setgid setuid sys_resource };
+    allow zabbix_t self:process { setrlimit setsched };
+    allow zabbix_t self:key write;
+    allow zabbix_t self:passwd { passwd rootok };
+
+    auth_rw_lastlog(zabbix_t)
+    auth_rw_faillog(zabbix_t)
+    auth_exec_chkpwd(zabbix_t)
+
+    selinux_compute_access_vector(zabbix_t)
+
+    systemd_write_inherited_logind_sessions_pipes(zabbix_t)
+    systemd_dbus_chat_logind(zabbix_t)
+
+    xserver_exec_xauth(zabbix_t)
+')
+
+optional_policy(`
+    tunable_policy(`zabbix_run_sudo',`
+        sudo_exec(zabbix_t)
+        su_exec(zabbix_t)
+    ')
+')
+
+optional_policy(`
+	mysql_stream_connect(zabbix_t)
+')
+
+optional_policy(`
+	netutils_domtrans_ping(zabbix_t)
+')
+
+optional_policy(`
+	postgresql_stream_connect(zabbix_t)
+	postgresql_tcp_connect(zabbix_t)
+')
+
+optional_policy(`
+	snmp_read_snmp_var_lib_files(zabbix_t)
+	snmp_read_snmp_var_lib_dirs(zabbix_t)
+')
+
+########################################
+#
+# Agent local policy
+#
+
+allow zabbix_agent_t self:process { setrlimit };
+
+manage_files_pattern(zabbix_agent_t, zabbix_log_t, zabbix_log_t)
+
+rw_files_pattern(zabbix_agent_t, zabbix_tmpfs_t, zabbix_tmpfs_t)
+fs_tmpfs_filetrans(zabbix_agent_t, zabbix_tmpfs_t, file)
+
+manage_files_pattern(zabbix_agent_t, zabbix_var_run_t, zabbix_var_run_t)
+files_pid_filetrans(zabbix_agent_t, zabbix_var_run_t, file)
+
+kernel_read_system_state(zabbix_agent_t)
+kernel_read_network_state(zabbix_agent_t)
+
+corenet_all_recvfrom_unlabeled(zabbix_agent_t)
+corenet_all_recvfrom_netlabel(zabbix_agent_t)
+
+corecmd_read_all_executables(zabbix_agent_t)
+
+corenet_sendrecv_zabbix_agent_server_packets(zabbix_agent_t)
+corenet_tcp_bind_zabbix_agent_port(zabbix_agent_t)
+corenet_tcp_sendrecv_zabbix_agent_port(zabbix_agent_t)
+
+corenet_sendrecv_ssh_client_packets(zabbix_agent_t)
+corenet_tcp_connect_ssh_port(zabbix_agent_t)
+corenet_tcp_sendrecv_ssh_port(zabbix_agent_t)
+
+corenet_sendrecv_ftp_client_packets(zabbix_agent_t)
+corenet_tcp_connect_ftp_port(zabbix_agent_t)
+corenet_tcp_sendrecv_ftp_port(zabbix_agent_t)
+
+corenet_sendrecv_http_client_packets(zabbix_agent_t)
+corenet_tcp_connect_http_port(zabbix_agent_t)
+corenet_tcp_sendrecv_http_port(zabbix_agent_t)
+
+corenet_sendrecv_innd_client_packets(zabbix_agent_t)
+corenet_tcp_connect_innd_port(zabbix_agent_t)
+corenet_tcp_sendrecv_innd_port(zabbix_agent_t)
+
+corenet_sendrecv_pop_client_packets(zabbix_agent_t)
+corenet_tcp_connect_pop_port(zabbix_agent_t)
+corenet_tcp_sendrecv_pop_port(zabbix_agent_t)
+
+corenet_sendrecv_postgresql_client_packets(zabbix_agent_t)
+corenet_tcp_connect_postgresql_port(zabbix_agent_t)
+corenet_tcp_sendrecv_postgresql_port(zabbix_agent_t)
+
+corenet_sendrecv_smtp_client_packets(zabbix_agent_t)
+corenet_tcp_connect_smtp_port(zabbix_agent_t)
+corenet_tcp_sendrecv_smtp_port(zabbix_agent_t)
+
+corenet_sendrecv_zabbix_client_packets(zabbix_agent_t)
+corenet_tcp_connect_zabbix_port(zabbix_agent_t)
+corenet_tcp_sendrecv_zabbix_port(zabbix_agent_t)
+
+corenet_tcp_connect_redis_port(zabbix_agent_t)
+corenet_tcp_sendrecv_redis_port(zabbix_agent_t)
+
+dev_getattr_all_blk_files(zabbix_agent_t)
+dev_getattr_all_chr_files(zabbix_agent_t)
+
+domain_read_all_domains_state(zabbix_agent_t)
+
+files_getattr_all_dirs(zabbix_agent_t)
+files_getattr_all_files(zabbix_agent_t)
+files_read_all_symlinks(zabbix_agent_t)
+
+fs_getattr_all_fs(zabbix_agent_t)
+
+auth_use_nsswitch(zabbix_agent_t)
+
+init_read_utmp(zabbix_agent_t)
+
+logging_search_logs(zabbix_agent_t)
+
+sysnet_dns_name_resolve(zabbix_agent_t)
+
+zabbix_tcp_connect(zabbix_agent_t)
+
+zabbix_script_domtrans(zabbix_agent_t)
+
+# These are triggered by vfs.dev.discovery enumerating everyting in /dev
+gen_require(`
+    type devlog_t;
+')
+dontaudit zabbix_agent_t devlog_t:sock_file getattr;
+init_dontaudit_getattr_initctl(zabbix_agent_t)
+kernel_dontaudit_getattr_core_if(zabbix_agent_t)
+
+gen_require(`
+    type kernel_t, sudo_log_t;
+')
+tunable_policy(`zabbix_run_sudo',`
+    allow zabbix_agent_t self:capability { chown dac_read_search setgid setuid sys_resource };
+    allow zabbix_agent_t self:process { setrlimit setsched };
+    allow zabbix_agent_t self:key write;
+    allow zabbix_agent_t self:passwd { passwd rootok };
+
+    allow zabbix_agent_t sudo_log_t:dir { add_name create setattr write };
+    allow zabbix_agent_t sudo_log_t:file { create open read setattr write };
+
+    allow zabbix_agent_t devlog_t:sock_file write;
+    allow zabbix_agent_t kernel_t:unix_dgram_socket sendto;
+    allow zabbix_agent_t self:unix_dgram_socket { connect create };
+
+    auth_domtrans_chkpwd(zabbix_agent_t)
+    auth_rw_lastlog(zabbix_agent_t)
+    auth_rw_faillog(zabbix_agent_t)
+
+    logging_send_audit_msgs(zabbix_agent_t)
+
+    selinux_compute_access_vector(zabbix_agent_t)
+
+    sssd_read_config(zabbix_agent_t)
+
+    systemd_write_inherited_logind_sessions_pipes(zabbix_agent_t)
+    systemd_dbus_chat_logind(zabbix_agent_t)
+
+    xserver_exec_xauth(zabbix_agent_t)
+
+    # Conceivably this could be under a separate boolean, but the reason to allow sudo
+    # is to allow check like this
+    lvm_domtrans(zabbix_agent_t)
+')
+
+optional_policy(`
+    rpm_exec(zabbix_agent_t)
+    rpm_read_db(zabbix_agent_t)
+')
+
+optional_policy(`
+    tunable_policy(`zabbix_run_sudo',`
+        sudo_exec(zabbix_agent_t)
+        su_exec(zabbix_agent_t)
+    ')
+')
+
+optional_policy(`
+	dmidecode_domtrans(zabbix_agent_t)
+')
+
+optional_policy(`
+	hostname_exec(zabbix_agent_t)
+')
+
+########################################
+#
+# zabbix_script_t local policy
+#
+
+domtrans_pattern(zabbix_t, zabbix_script_exec_t, zabbix_script_t)
+
+allow zabbix_t zabbix_script_exec_t:dir list_dir_perms;
+allow zabbix_t zabbix_script_exec_t:file ioctl;
+allow zabbix_t zabbix_script_t:process signal;
+
+init_domtrans_script(zabbix_script_t)
+
+optional_policy(`
+	chronyd_domtrans_chronyc(zabbix_script_t)
+')
+
+optional_policy(`
+    mta_send_mail(zabbix_script_t)
+')
+
+optional_policy(`
+    unconfined_domain(zabbix_script_t)
+')