7.4.14

The test repo was migrated to github due to Pagure being retired.
https://communityblog.fedoraproject.org/the-forge-is-our-new-home/

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -67,3 +67,60 @@ zabbix-1.8.2.tar.gz
 /zabbix-4.0.16.tar.gz
 /zabbix-4.0.19.tar.gz
 /zabbix-4.0.22.tar.gz
+/zabbix-5.0.2.tar.gz
+/zabbix-5.0.3.tar.gz
+/zabbix-5.0.6.tar.gz
+/zabbix-5.0.7.tar.gz
+/zabbix-5.0.8.tar.gz
+/zabbix-5.0.9.tar.gz
+/zabbix-5.0.10.tar.gz
+/zabbix-5.0.14.tar.gz
+/zabbix-5.0.16.tar.gz
+/zabbix-5.0.17.tar.gz
+/zabbix-5.0.18.tar.gz
+/zabbix-5.0.19.tar.gz
+/zabbix-5.0.21.tar.gz
+/zabbix-6.0.2.tar.gz
+/zabbix-6.0.3.tar.gz
+/zabbix-6.0.4.tar.gz
+/zabbix-6.0.5.tar.gz
+/zabbix-6.0.6.tar.gz
+/zabbix-6.0.8.tar.gz
+/zabbix-6.0.12.tar.gz
+/zabbix-6.0.13.tar.gz
+/zabbix-6.0.14.tar.gz
+/zabbix-6.0.15.tar.gz
+/zabbix-6.0.16.tar.gz
+/zabbix-6.0.17.tar.gz
+/zabbix-6.0.18.tar.gz
+/zabbix-6.0.19.tar.gz
+/zabbix-6.0.20.tar.gz
+/zabbix-6.0.22.tar.gz
+/zabbix-6.0.25.tar.gz
+/zabbix-6.0.27.tar.gz
+/zabbix-6.0.29.tar.gz
+/zabbix-6.0.30.tar.gz
+/zabbix-6.0.33.tar.gz
+/zabbix-7.0.2.tar.gz
+/zabbix-7.0.3.tar.gz
+/zabbix-7.0.4.tar.gz
+/zabbix-7.0.5.tar.gz
+/zabbix-7.0.6.tar.gz
+/zabbix-7.2.0.tar.gz
+/zabbix-7.2.2.tar.gz
+/zabbix-7.2.5.tar.gz
+/zabbix-7.2.9.tar.gz
+/zabbix-7.2.10.tar.gz
+/zabbix-7.2.11.tar.gz
+/zabbix-7.4.1.tar.gz
+/zabbix-7.4.2.tar.gz
+/zabbix-7.4.3.tar.gz
+/zabbix-7.4.4.tar.gz
+/zabbix-7.4.5.tar.gz
+/zabbix-7.4.6.tar.gz
+/zabbix-7.4.7.tar.gz
+/zabbix-7.4.8.tar.gz
+/zabbix-7.4.9.tar.gz
+/zabbix-7.4.12.tar.gz
+/zabbix-7.4.13.tar.gz
+/zabbix-7.4.14.tar.gz

plans/dsp.fmf

@@ -0,0 +1,22 @@
+summary: DSP test suite
+discover:
+  - name: DSP_test
+    how: fmf
+    url: https://github.com/fedora-selinux/DSP_test.git
+    ref: main
+
+execute:
+    how: tmt
+
+environment:
+    trigger: FedoraCI
+    # DSP_test specific variables:
+    TEST_RPM: "zabbix-selinux"
+    TEST_POLICY: "zabbix"
+
+prepare:
+    how: install
+    package:
+        - zabbix-selinux
+        - autoconf
+        - automake

sources

@@ -1 +1 @@
-SHA512 (zabbix-4.0.22.tar.gz) = de6176c8f833e76da86c6a16558fa7b94fd40d87b4a2525dc91f60490ea226751bf93829f2ec2da87804ab0468c9f76e4b4e9ee7f4e620c87115a5bd9a654f53
+SHA512 (zabbix-7.4.14.tar.gz) = 98b26bfcd3b1803b23d85af70094fe875d138263cabbc4f6fa5c63ea9b07c4bedaa86eeed79ede74919f55515d6c17408391ea999ed204948320dc8ec29bbdc6

zabbix-4.0.3-config.patch

@@ -1,57 +0,0 @@
-diff --git a/frontends/php/include/classes/core/CConfigFile.php b/frontends/php/include/classes/core/CConfigFile.php
-index 091ff50..8c76c27 100644
---- a/frontends/php/include/classes/core/CConfigFile.php
-+++ b/frontends/php/include/classes/core/CConfigFile.php
-@@ -24,7 +24,7 @@ class CConfigFile {
- 	const CONFIG_NOT_FOUND = 1;
- 	const CONFIG_ERROR = 2;
- 
--	const CONFIG_FILE_PATH = '/conf/zabbix.conf.php';
-+	const CONFIG_FILE_PATH = '/etc/zabbix/web/zabbix.conf.php';
- 
- 	private static $supported_db_types = [
- 		ZBX_DB_DB2 => true,
-diff --git a/frontends/php/include/classes/core/ZBase.php b/frontends/php/include/classes/core/ZBase.php
-index 5a867f2..59bf522 100644
---- a/frontends/php/include/classes/core/ZBase.php
-+++ b/frontends/php/include/classes/core/ZBase.php
-@@ -273,7 +273,7 @@ class ZBase {
- 	 * @throws Exception
- 	 */
- 	protected function setMaintenanceMode() {
--		require_once $this->getRootDir().'/conf/maintenance.inc.php';
-+		require_once '/etc/zabbix/web/maintenance.inc.php';
- 
- 		if (defined('ZBX_DENY_GUI_ACCESS')) {
- 			$user_ip = (isset($_SERVER['HTTP_X_FORWARDED_FOR']) && !empty($_SERVER['HTTP_X_FORWARDED_FOR']))
-@@ -289,7 +289,7 @@ class ZBase {
- 	 * Load zabbix config file.
- 	 */
- 	protected function loadConfigFile() {
--		$configFile = $this->getRootDir().CConfigFile::CONFIG_FILE_PATH;
-+		$configFile = CConfigFile::CONFIG_FILE_PATH;
- 		$config = new CConfigFile($configFile);
- 		$this->config = $config->load();
- 	}
-diff --git a/frontends/php/include/classes/setup/CSetupWizard.php b/frontends/php/include/classes/setup/CSetupWizard.php
-index e2e9756..7ad9190 100644
---- a/frontends/php/include/classes/setup/CSetupWizard.php
-+++ b/frontends/php/include/classes/setup/CSetupWizard.php
-@@ -333,7 +333,7 @@ class CSetupWizard extends CForm {
- 	function stage5() {
- 		$this->setConfig('ZBX_CONFIG_FILE_CORRECT', true);
- 
--		$config_file_name = Z::getInstance()->getRootDir().CConfigFile::CONFIG_FILE_PATH;
-+		$config_file_name = CConfigFile::CONFIG_FILE_PATH;
- 		$config = new CConfigFile($config_file_name);
- 		$config->config = [
- 			'DB' => [
-@@ -502,7 +502,7 @@ class CSetupWizard extends CForm {
- 				// make zabbix.conf.php downloadable
- 				header('Content-Type: application/x-httpd-php');
- 				header('Content-Disposition: attachment; filename="'.basename(CConfigFile::CONFIG_FILE_PATH).'"');
--				$config = new CConfigFile(Z::getInstance()->getRootDir().CConfigFile::CONFIG_FILE_PATH);
-+				$config = new CConfigFile(CConfigFile::CONFIG_FILE_PATH);
- 				$config->config = [
- 					'DB' => [
- 						'TYPE' => $this->getConfig('DB_TYPE'),

zabbix-config.patch

@@ -0,0 +1,48 @@
+diff --git a/ui/include/classes/core/CConfigFile.php b/ui/include/classes/core/CConfigFile.php
+index d7ad93a..88b7d5f 100644
+--- a/ui/include/classes/core/CConfigFile.php
++++ b/ui/include/classes/core/CConfigFile.php
+@@ -20,7 +20,7 @@ class CConfigFile {
+ 	const CONFIG_ERROR = 2;
+ 	const CONFIG_VAULT_ERROR = 3;
+ 
+-	const CONFIG_FILE_PATH = '/conf/zabbix.conf.php';
++	const CONFIG_FILE_PATH = '/etc/zabbix/web/zabbix.conf.php';
+ 
+ 	private static $supported_db_types = [
+ 		ZBX_DB_MYSQL => true,
+diff --git a/ui/include/classes/core/ZBase.php b/ui/include/classes/core/ZBase.php
+index 51b2165..e57e5a8 100644
+--- a/ui/include/classes/core/ZBase.php
++++ b/ui/include/classes/core/ZBase.php
+@@ -392,7 +392,7 @@ class ZBase {
+ 	 * @throws Exception
+ 	 */
+ 	protected function setMaintenanceMode() {
+-		require_once 'conf/maintenance.inc.php';
++		require_once '/etc/zabbix/web/maintenance.inc.php';
+ 
+ 		if (defined('ZBX_DENY_GUI_ACCESS')) {
+ 			if (!isset($ZBX_GUI_ACCESS_IP_RANGE) || !in_array(CWebUser::getIp(), $ZBX_GUI_ACCESS_IP_RANGE)) {
+@@ -405,7 +405,7 @@ class ZBase {
+ 	 * Load zabbix config file.
+ 	 */
+ 	protected function loadConfigFile(): void {
+-		$configFile = $this->root_dir.CConfigFile::CONFIG_FILE_PATH;
++		$configFile = CConfigFile::CONFIG_FILE_PATH;
+ 
+ 		$config = new CConfigFile($configFile);
+ 
+diff --git a/ui/include/classes/setup/CSetupWizard.php b/ui/include/classes/setup/CSetupWizard.php
+index 8574868..79d0c72 100644
+--- a/ui/include/classes/setup/CSetupWizard.php
++++ b/ui/include/classes/setup/CSetupWizard.php
+@@ -328,7 +328,7 @@ class CSetupWizard extends CForm {
+ 				// make zabbix.conf.php downloadable
+ 				header('Content-Type: application/x-httpd-php');
+ 				header('Content-Disposition: attachment; filename="'.basename(CConfigFile::CONFIG_FILE_PATH).'"');
+-				$config = new CConfigFile(APP::getRootDir().CConfigFile::CONFIG_FILE_PATH);
++				$config = new CConfigFile(CConfigFile::CONFIG_FILE_PATH);
+ 				$config->config = [
+ 					'DB' => [
+ 						'TYPE' => $this->getConfig('DB_TYPE'),

zabbix-configure-sscanf.patch

@@ -0,0 +1,17 @@
+sscanf needs <stdio.h> for the prototype.  Submitted upstream here:
+
+  <https://support.zabbix.com/browse/ZBX-21946>
+
+diff --git a/configure.ac b/configure.ac
+index 0588004f9f89cdd5..bbc60e3a28369f9f 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -952,6 +952,7 @@ dnl FreeBSD 4.x does not support %llu
+ AC_MSG_CHECKING(for long long format)
+ AC_RUN_IFELSE([AC_LANG_SOURCE([[
+ #include <sys/types.h>
++#include <stdio.h>
+ int main()
+ {
+         uint64_t i;
+

zabbix-crypto-policy.patch

@@ -0,0 +1,44 @@
+diff --git a/src/go/pkg/tls/tls.go b/src/go/pkg/tls/tls.go
+index b7ddff4..063eb02 100644
+--- a/src/go/pkg/tls/tls.go
++++ b/src/go/pkg/tls/tls.go
+@@ -406,6 +406,8 @@ static void *tls_new_context(const char *ca_file, const char *crl_file, const ch
+ #endif
+ 	if (NULL != cipher)
+ 		ciphers = cipher;
++	else
++		ciphers = "PROFILE=SYSTEM";
+ 
+ 	if (1 != SSL_CTX_set_cipher_list(ctx, ciphers))
+ 		goto out;
+diff --git a/src/libs/zbxcomms/tls_openssl.c b/src/libs/zbxcomms/tls_openssl.c
+index 40394a3..b2eb0f0 100644
+--- a/src/libs/zbxcomms/tls_openssl.c
++++ b/src/libs/zbxcomms/tls_openssl.c
+@@ -1212,7 +1212,7 @@ void	zbx_tls_init_child(const zbx_config_tls_t *config_tls, zbx_get_program_type
+ 				goto out;
+ 			}
+ 		}
+-		else if (1 != SSL_CTX_set_cipher_list(ctx_cert, ciphers))
++		else if (1 != SSL_CTX_set_cipher_list(ctx_cert, "PROFILE=SYSTEM"))
+ 		{
+ 			zbx_snprintf_alloc(&error, &error_alloc, &error_offset, "cannot set list of certificate"
+ 					" ciphersuites:");
+@@ -1302,7 +1302,7 @@ void	zbx_tls_init_child(const zbx_config_tls_t *config_tls, zbx_get_program_type
+ 				goto out;
+ 			}
+ 		}
+-		else if (1 != SSL_CTX_set_cipher_list(ctx_psk, ciphers))
++		else if (1 != SSL_CTX_set_cipher_list(ctx_psk, "PROFILE=SYSTEM"))
+ 		{
+ 			zbx_snprintf_alloc(&error, &error_alloc, &error_offset, "cannot set list of PSK ciphersuites:");
+ 			goto out;
+@@ -1360,7 +1360,7 @@ void	zbx_tls_init_child(const zbx_config_tls_t *config_tls, zbx_get_program_type
+ 				goto out;
+ 			}
+ 		}
+-		else if (1 != SSL_CTX_set_cipher_list(ctx_all, ciphers))
++		else if (1 != SSL_CTX_set_cipher_list(ctx_all, "PROFILE=SYSTEM"))
+ 		{
+ 			zbx_snprintf_alloc(&error, &error_alloc, &error_offset, "cannot set list of all ciphersuites:");
+ 			goto out;

zabbix-drop-des.patch

@@ -0,0 +1,25 @@
+From 2d5e3532b2313e9c70e5125101bc27c99115a85d Mon Sep 17 00:00:00 2001
+From: Morten Stevens <mstevens@fedoraproject.org>
+Date: Mon, 26 Jul 2021 10:17:48 +0200
+Subject: [PATCH] Drop support for usmDESPrivProtocol
+
+---
+ src/zabbix_server/poller/checks_snmp.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/src/zabbix_server/poller/checks_snmp.c b/src/zabbix_server/poller/checks_snmp.c
+index 40d6eb23699..17f668eeb28 100644
+--- a/src/zabbix_server/poller/checks_snmp.c
++++ b/src/zabbix_server/poller/checks_snmp.c
+@@ -568,11 +568,6 @@ static struct snmp_session	*zbx_snmp_open_session(const DC_ITEM *item, char *err
+ 
+ 				switch (item->snmpv3_privprotocol)
+ 				{
+-					case ITEM_SNMPV3_PRIVPROTOCOL_DES:
+-						/* set the privacy protocol to DES */
+-						session.securityPrivProto = usmDESPrivProtocol;
+-						session.securityPrivProtoLen = USM_PRIV_PROTO_DES_LEN;
+-						break;
+ 					case ITEM_SNMPV3_PRIVPROTOCOL_AES:
+ 						/* set the privacy protocol to AES */
+ 						session.securityPrivProto = usmAESPrivProtocol;

zabbix-fedora-epel.README

@@ -99,14 +99,7 @@ ownership.
 
 ==No Java bridge==
 
-The Zabbix Java bridge can not be included now, due to legal issue with one of
-the modules (json). See https://support.zabbix.com/browse/ZBX-4800 and feel free
-to vote on it.
-
-
-==No SQLite front-end or server implementation==
-
-Sadly it doesn't work with how Fedora's/EPEL's PHP is compiled.
+The Zabbix Java bridge can not be included now, due to missing dependencies.
 
 
 =SELinux=
@@ -134,6 +127,7 @@ If you're using ping from the frontend:
 
 echo "avc:  denied  { setpgid } for  pid=31880 comm="zabbix_server_p" scontext=system_u:system_r:zabbix_t:s0 tcontext=system_u:system_r:zabbix_t:s0 tclass=process" | audit2allow -M zabbix_ping_frontend; sudo semodule -i zabbix_ping_frontend.pp
 
+
 =Additional packaging changes in Fedora/EPEL since 3.0=
 
 ==Configuration files contain the actual defaults==
@@ -220,24 +214,4 @@ Be sure to read the upgrades notes of the latest minor release too!
   The schema conversion should finish within minutes or hours
 
 
-=Guide for upgrading to 2.0 from 1.8=
-
-https://www.zabbix.com/documentation/2.0/manual/installation/upgrade_notes?s[]=upgrade&s[]=notes&s[]=2&s[]=0
-
-Be sure to read the upgrades notes of the latest minor release too!
-
-The below should be the relevant steps, picked from
-http://www.zabbix.com/documentation/2.0/manual/installation/upgrade
-
-- Review all rpmnew and rpmsave files; merge where necessary
-- Review permissions, ownerships and group memberships for zabbixsrv
-- Back up the Zabbix database (really!)
-- Remove custom database changes, if any
-- Make sure the database user has sufficing permissions
-  (ALTER TABLE, DROP INDEX, DROP TABLE, ...)
-- Run the fitting database update script/s
-- The scripts can run very long, depending on the content of your database and
-  your hardware;
-- Check the output of the script for errors
-
 Volker Fröhlich volker27@gmx.at Jan  5 2013

zabbix-out-of-tree.patch

@@ -0,0 +1,157 @@
+diff --git a/src/go/Makefile.am b/src/go/Makefile.am
+index 3e24aa0..308e34b 100644
+--- a/src/go/Makefile.am
++++ b/src/go/Makefile.am
+@@ -89,9 +90,9 @@ install-bin/zabbix_agent2: bin/zabbix_agent2
+ 	$(INSTALL) -d "$(DESTDIR)$(sbindir)"
+ 	$(INSTALL_PROGRAM) bin/zabbix_agent2 "$(DESTDIR)$(sbindir)"
+ 	$(INSTALL) -d "$(DESTDIR)$(AGENT2_PLUGIN_CONFIG_DIR)"
+-	$(INSTALL_DATA) conf/zabbix_agent2.conf "$(DESTDIR)$(sysconfdir)"
++	$(INSTALL_DATA) $(top_srcdir)/src/go/conf/zabbix_agent2.conf "$(DESTDIR)$(sysconfdir)"
+ 	$(INSTALL) -d "$(DESTDIR)$(AGENT2_PLUGIN_CONFIG_DIR)"
+-	(cd conf/zabbix_agent2.d/plugins.d && \
++	(cd $(top_srcdir)/conf/zabbix_agent2.d/plugins.d && \
+ 	for _f in *.conf; do \
+ 		$(INSTALL_DATA) $${_f} "$(DESTDIR)$(AGENT2_PLUGIN_CONFIG_DIR)"; \
+ 	done)
+diff --git a/src/zabbix_agent/Makefile.am b/src/zabbix_agent/Makefile.am
+index b217fb5..945a673 100644
+--- a/src/zabbix_agent/Makefile.am
++++ b/src/zabbix_agent/Makefile.am
+@@ -69,4 +69,4 @@ zabbix_agentd_CFLAGS = \
+ install-data-hook:
+ 	$(MKDIR_P) "$(DESTDIR)$(AGENT_CONFIG_FILE).d"
+ 	$(MKDIR_P) "$(DESTDIR)$(LOAD_MODULE_PATH)"
+-	test -f "$(DESTDIR)$(AGENT_CONFIG_FILE)" || cp "../../conf/zabbix_agentd.conf" "$(DESTDIR)$(AGENT_CONFIG_FILE)"
++	test -f "$(DESTDIR)$(AGENT_CONFIG_FILE)" || cp "$(top_srcdir)/conf/zabbix_agentd.conf" "$(DESTDIR)$(AGENT_CONFIG_FILE)"
+diff --git a/src/zabbix_proxy/Makefile.am b/src/zabbix_proxy/Makefile.am
+index b56f8a8..44800a0 100644
+--- a/src/zabbix_proxy/Makefile.am
++++ b/src/zabbix_proxy/Makefile.am
+@@ -151,4 +151,4 @@ install-data-hook:
+ 	$(MKDIR_P) "$(DESTDIR)$(PROXY_CONFIG_FILE).d"
+ 	$(MKDIR_P) "$(DESTDIR)$(EXTERNAL_SCRIPTS_PATH)"
+ 	$(MKDIR_P) "$(DESTDIR)$(LOAD_MODULE_PATH)"
+-	test -f "$(DESTDIR)$(PROXY_CONFIG_FILE)" || cp "../../conf/zabbix_proxy.conf" "$(DESTDIR)$(PROXY_CONFIG_FILE)"
++	test -f "$(DESTDIR)$(PROXY_CONFIG_FILE)" || cp "$(top_srcdir)/conf/zabbix_proxy.conf" "$(DESTDIR)$(PROXY_CONFIG_FILE)"
+diff --git a/src/zabbix_server/Makefile.am b/src/zabbix_server/Makefile.am
+index 0a55934..a7f6a28 100644
+--- a/src/zabbix_server/Makefile.am
++++ b/src/zabbix_server/Makefile.am
+@@ -186,4 +186,4 @@ install-data-hook:
+ 	$(MKDIR_P) "$(DESTDIR)$(EXTERNAL_SCRIPTS_PATH)"
+ 	$(MKDIR_P) "$(DESTDIR)$(ALERT_SCRIPTS_PATH)"
+ 	$(MKDIR_P) "$(DESTDIR)$(LOAD_MODULE_PATH)"
+-	test -f "$(DESTDIR)$(SERVER_CONFIG_FILE)" || cp "../../conf/zabbix_server.conf" "$(DESTDIR)$(SERVER_CONFIG_FILE)"
++	test -f "$(DESTDIR)$(SERVER_CONFIG_FILE)" || cp "$(top_srcdir)/conf/zabbix_server.conf" "$(DESTDIR)$(SERVER_CONFIG_FILE)"
+diff -up zabbix-7.2.0/configure.ac.out-of-tree zabbix-7.2.0/configure.ac
+--- zabbix-7.2.0/configure.ac.out-of-tree	2024-12-09 04:53:54.274588489 -0700
++++ zabbix-7.2.0/configure.ac	2024-12-11 20:31:44.684746169 -0700
+@@ -22,7 +22,7 @@ AC_CONFIG_MACRO_DIR([m4])
+ AC_CONFIG_SRCDIR([src/zabbix_server/server.c])
+ AC_CONFIG_HEADERS([include/common/config.h])
+ 
+-AC_SUBST(DEFAULT_INCLUDES, ['-I$(top_srcdir)/include/common -I$(top_srcdir)/include'])
++AC_SUBST(DEFAULT_INCLUDES, ['-I$(top_builddir)/include/common -I$(top_srcdir)/include/common -I$(top_srcdir)/include'])
+ 
+ AC_CANONICAL_BUILD
+ AC_CANONICAL_HOST
+--- zabbix-7.4.3/src/go/Makefile.am~	2025-10-01 09:49:27.351910250 -0500
++++ zabbix-7.4.3/src/go/Makefile.am	2025-10-01 10:33:26.662210424 -0500
+@@ -64,6 +64,7 @@
+ clean-go-build:
+ 	-$(GO) clean ./...
+ 	-$(GO) clean -cache
++	-$(GO) clean $(srcdir)/...
+ 	-rm -f bin/mock_server
+ 	-rm -f bin/zabbix_agent2
+ 	-rm -f bin/zabbix_web_service
+--- a/src/zabbix_java/Makefile.am~	2026-07-07 09:04:30.341683492 -0500
++++ b/src/zabbix_java/Makefile.am	2026-07-09 10:47:55.481651595 -0500
+@@ -9,23 +9,23 @@
+ 	startup.sh
+ 
+ ZJG = bin/zabbix-java-gateway-$(VERSION).jar
+-LIB = lib/android-json-4.3_r3.1.jar:lib/logback-core-1.5.16.jar:lib/logback-classic-1.5.16.jar:lib/slf4j-api-2.0.16.jar:lib/dnsjava-3.6.4.jar
++LIB = $(srcdir)lib/android-json-4.3_r3.1.jar:$(srcdir)lib/logback-core-1.5.16.jar:$(srcdir)lib/logback-classic-1.5.16.jar:$(srcdir)lib/slf4j-api-2.0.16.jar:$(srcdir)lib/dnsjava-3.6.4.jar
+ 
+-JUNIT = tests/junit-4.8.2.jar
++JUNIT = $(srcdir)tests/junit-4.8.2.jar
+ 
+ ZJG_DEST = $(DESTDIR)$(sbindir)/zabbix_java
+ 
+ all: $(ZJG)
+ 
+-$(ZJG): class src/com/zabbix/gateway/*.java
+-	$(JAVAC) -d class/src -classpath $(LIB) src/com/zabbix/gateway/*.java
++$(ZJG): class $(srcdir)src/com/zabbix/gateway/*.java
++	$(JAVAC) -d class/src -classpath $(LIB) $(srcdir)src/com/zabbix/gateway/*.java
+ 	$(JAR) cf $(ZJG) -C class/src .
+ 
+ test: class
+ 	echo "badger useruser" > tests/com/zabbix/gateway/jmx_test_beans/jmxremote.password
+ 	chmod 600 tests/com/zabbix/gateway/jmx_test_beans/jmxremote.password
+-	$(JAVAC) tests/com/zabbix/gateway/jmx_test_beans/*.java
+-	$(JAVAC) -d class/tests -classpath class/src:$(JUNIT) tests/com/zabbix/gateway/*.java
++	$(JAVAC) tests/com/zabbix/gateway/jmx_$(srcdir)/test_beans/*.java
++	$(JAVAC) -d class/tests -classpath class/src:$(JUNIT) $(srcdir)tests/com/zabbix/gateway/*.java
+ 	java -classpath class/tests:$(LIB):$(ZJG):$(JUNIT) com.zabbix.gateway.AllTestRunner
+ 
+ class:
+--- a/src/zabbix_js/Makefile.am.orig	2026-07-09 10:49:49.036634968 -0500
++++ b/src/zabbix_js/Makefile.am	2026-07-09 10:50:03.475753570 -0500
+@@ -5,30 +5,30 @@
+ zabbix_js_SOURCES = zabbix_js.c
+ 
+ zabbix_js_LDADD = \
+-	$(top_srcdir)/src/libs/zbxlog/libzbxlog.a \
+-	$(top_srcdir)/src/libs/zbxembed/libzbxembed.a \
+-	$(top_srcdir)/src/libs/zbxjson/libzbxjson.a \
+-	$(top_srcdir)/src/libs/zbxregexp/libzbxregexp.a \
+-	$(top_srcdir)/src/libs/zbxthreads/libzbxthreads.a \
+-	$(top_srcdir)/src/libs/zbxmutexs/libzbxmutexs.a \
+-	$(top_srcdir)/src/libs/zbxprof/libzbxprof.a \
+-	$(top_srcdir)/src/libs/zbxnix/libzbxnix.a \
+-	$(top_srcdir)/src/libs/zbxcomms/libzbxcomms.a \
+-	$(top_srcdir)/src/libs/zbxip/libzbxip.a \
+-	$(top_srcdir)/src/libs/zbxgetopt/libzbxgetopt.a \
+-	$(top_srcdir)/src/libs/zbxhash/libzbxhash.a \
+-	$(top_srcdir)/src/libs/zbxcrypto/libzbxcrypto.a \
+-	$(top_srcdir)/src/libs/zbxcompress/libzbxcompress.a \
+-	$(top_srcdir)/src/libs/zbxhttp/libzbxhttp.a \
+-	$(top_srcdir)/src/libs/zbxvariant/libzbxvariant.a \
+-	$(top_srcdir)/src/libs/zbxxml/libzbxxml.a \
+-	$(top_srcdir)/src/libs/zbxalgo/libzbxalgo.a \
+-	$(top_srcdir)/src/libs/zbxstr/libzbxstr.a \
+-	$(top_srcdir)/src/libs/zbxnum/libzbxnum.a \
+-	$(top_srcdir)/src/libs/zbxtime/libzbxtime.a \
+-	$(top_srcdir)/src/libs/zbxcommon/libzbxcommon.a \
+-	$(top_srcdir)/src/libs/zbxbincommon/libzbxbincommon.a \
+-	$(top_srcdir)/src/libs/zbxcurl/libzbxcurl.a
++	$(top_builddir)/src/libs/zbxlog/libzbxlog.a \
++	$(top_builddir)/src/libs/zbxembed/libzbxembed.a \
++	$(top_builddir)/src/libs/zbxjson/libzbxjson.a \
++	$(top_builddir)/src/libs/zbxregexp/libzbxregexp.a \
++	$(top_builddir)/src/libs/zbxthreads/libzbxthreads.a \
++	$(top_builddir)/src/libs/zbxmutexs/libzbxmutexs.a \
++	$(top_builddir)/src/libs/zbxprof/libzbxprof.a \
++	$(top_builddir)/src/libs/zbxnix/libzbxnix.a \
++	$(top_builddir)/src/libs/zbxcomms/libzbxcomms.a \
++	$(top_builddir)/src/libs/zbxip/libzbxip.a \
++	$(top_builddir)/src/libs/zbxgetopt/libzbxgetopt.a \
++	$(top_builddir)/src/libs/zbxhash/libzbxhash.a \
++	$(top_builddir)/src/libs/zbxcrypto/libzbxcrypto.a \
++	$(top_builddir)/src/libs/zbxcompress/libzbxcompress.a \
++	$(top_builddir)/src/libs/zbxhttp/libzbxhttp.a \
++	$(top_builddir)/src/libs/zbxvariant/libzbxvariant.a \
++	$(top_builddir)/src/libs/zbxxml/libzbxxml.a \
++	$(top_builddir)/src/libs/zbxalgo/libzbxalgo.a \
++	$(top_builddir)/src/libs/zbxstr/libzbxstr.a \
++	$(top_builddir)/src/libs/zbxnum/libzbxnum.a \
++	$(top_builddir)/src/libs/zbxtime/libzbxtime.a \
++	$(top_builddir)/src/libs/zbxcommon/libzbxcommon.a \
++	$(top_builddir)/src/libs/zbxbincommon/libzbxbincommon.a \
++	$(top_builddir)/src/libs/zbxcurl/libzbxcurl.a
+ 
+ zabbix_js_LDADD += @ZBXJS_LIBS@ $(LIBXML2_LIBS)
+ 

zabbix-php-fpm.conf

@@ -0,0 +1,24 @@
+[zabbix]
+user = apache
+group = apache
+
+listen = /run/php-fpm/zabbix.sock
+listen.acl_users = apache,nginx
+listen.allowed_clients = 127.0.0.1
+
+pm = dynamic
+pm.max_children = 50
+pm.start_servers = 5
+pm.min_spare_servers = 5
+pm.max_spare_servers = 35
+
+php_value[session.save_handler] = files
+php_value[session.save_path]    = /var/lib/php/session
+
+php_value[max_execution_time] = 300
+php_value[memory_limit] = 128M
+php_value[post_max_size] = 16M
+php_value[upload_max_filesize] = 2M
+php_value[max_input_time] = 300
+php_value[max_input_vars] = 10000
+; php_value[date.timezone] = Europe/Riga

zabbix-web.conf

@@ -7,56 +7,29 @@ Alias /zabbix /usr/share/zabbix
 <Directory "/usr/share/zabbix">
     Options FollowSymLinks
     AllowOverride None
+    Require all granted
 
-    <IfModule mod_authz_core.c>
-      # Apache 2.4
-      Require all granted
-    </IfModule>
-   
-    <IfModule !mod_authz_core.c>
-      # Apache 2.2
-      Order allow,deny
-      Allow from all
+    <IfModule dir_module>
+        DirectoryIndex index.php
     </IfModule>
 
-    <IfModule mod_php5.c>
-        php_value max_execution_time 300
-        php_value memory_limit 128M
-        php_value post_max_size 16M
-        php_value upload_max_filesize 2M
-        php_value max_input_time 300
-
-        # Removed in PHP 7
-        php_value always_populate_raw_post_data -1
-
-        php_flag session.auto_start off
-        php_value mbstring.func_overload 0
-        # php_value date.timezone UTC
-    </IfModule>
+    <FilesMatch \.(php|phar)$>
+        SetHandler "proxy:unix:/run/php-fpm/zabbix.sock|fcgi://localhost"
+    </FilesMatch>
 </Directory>
 
-<Directory ~ "^/usr/share/zabbix/(conf|app|include|local)/">
-    <IfModule mod_authz_core.c>
-      # Apache 2.4
-      Require all denied
-    </IfModule>
+<Directory "/usr/share/zabbix/conf">
+    Require all denied
+</Directory>
 
-    <IfModule !mod_authz_core.c>
-      # Apache 2.2
-      Order deny,allow
-      Deny from all
-    </IfModule>
+<Directory "/usr/share/zabbix/app">
+    Require all denied
+</Directory>
 
-    <files *.php>
-      <IfModule mod_authz_core.c>
-        # Apache 2.4
-        Require all denied
-      </IfModule>
+<Directory "/usr/share/zabbix/include">
+    Require all denied
+</Directory>
 
-      <IfModule !mod_authz_core.c>
-        Order deny,allow
-        Deny from all
-      </IfModule>
-
-    </files>
+<Directory "/usr/share/zabbix/local">
+    Require all denied
 </Directory>

zabbix.fc

@@ -14,11 +14,11 @@
 /usr/sbin/zabbix_proxy_pgsql   --  gen_context(system_u:object_r:zabbix_exec_t,s0)
 /usr/sbin/zabbix_proxy_sqlite3 --  gen_context(system_u:object_r:zabbix_exec_t,s0)
 
-/usr/lib/zabbix/externalscripts(/.*)?    gen_context(system_u:object_r:zabbix_script_exec_t,s0)
+/var/lib/zabbix(/.*)?    gen_context(system_u:object_r:zabbix_var_lib_t,s0)
 
 /var/lib/zabbixsrv(/.*)?	gen_context(system_u:object_r:zabbix_var_lib_t,s0)
-/var/lib/zabbix(/.*)?    gen_context(system_u:object_r:zabbix_var_lib_t,s0)
-/var/lib/zabbix/externalscripts(/.*)?    gen_context(system_u:object_r:zabbix_script_exec_t,s0)
+/var/lib/zabbixsrv/.*scripts(/.*)?    gen_context(system_u:object_r:zabbix_script_exec_t,s0)
+/var/lib/zabbixsrv/tmp(/.*)?	gen_context(system_u:object_r:zabbix_tmp_t,s0)
 
 /var/log/zabbix.*	gen_context(system_u:object_r:zabbix_log_t,s0)
 

zabbix.spec

@@ -8,18 +8,44 @@
 %global srcname zabbix
 %global with_selinux 1
 %global selinuxtype targeted
+# go is needed for agent2, but there are missing deps
+%bcond_with go
+# Missing dependencies for the java connector
+%bcond_with java
 #%%global prerelease rc2
 
 Name:           zabbix
 Epoch:          1
-Version:        4.0.22
+Version:        7.4.14
 Release:        1%{?dist}
 Summary:        Open-source monitoring solution for your IT infrastructure
 
-License:        GPLv2+
+# TODO - Note additional licenses in src/go when we start building with go
+# src/libs/zbxembed/duktape.c: MIT License
+# src/libs/zbxembed/duktape.h: MIT License
+# src/libs/zbxgetopt/getopt.c: GNU General Public License v2.0 or later
+# src/libs/zbxhash/md5.c: zlib License
+# ui/vendor/composer/LICENSE: MIT License
+# ui/js/vendors/D3/LICENSE: ISC License
+# ui/js/vendors/Leaflet/LICENSE: BSD 2-Clause License
+# ui/js/vendors/Leaflet.markercluster/LICENSE: MIT License
+# ui/js/vendors/jQueryUI/LICENSE: MIT License
+# ui/js/vendors/qrcode/LICENSE: MIT License
+# ui/vendor/duosecurity/duo_universal_php/LICENSE: BSD 3-Clause License
+# ui/vendor/firebase/php-jwt/LICENSE: BSD 3-Clause License
+# ui/vendor/onelogin/php-saml/LICENSE: MIT License
+# ui/vendor/paragonie/constant_time_encoding/LICENSE.txt: MIT License
+# ui/vendor/pragmarx/google2fa/LICENSE.md: MIT License
+# ui/vendor/symfony/deprecation-contracts/LICENSE: MIT License
+# ui/vendor/symfony/polyfill-ctype/LICENSE: MIT License
+# ui/vendor/symfony/yaml/LICENSE: MIT License
+# ui/assets/styles/vendors/Leaflet/LICENSE: BSD 2-Clause License
+# ui/vendor/paragonie/constant_time_encoding/src/*.php: MIT License
+License:        AGPL-3.0-only AND MIT AND GPL-2.0-or-later AND Zlib AND BSD-3-Clause AND BSD-2-Clause AND ISC
 URL:            https://www.zabbix.com
-Source0:        https://cdn.zabbix.com/zabbix/sources/stable/4.0/zabbix-%{version}.tar.gz
+Source0:        https://cdn.zabbix.com/zabbix/sources/stable/7.4/zabbix-%{version}.tar.gz
 Source1:        %{srcname}-web.conf
+Source2:        %{srcname}-php-fpm.conf
 Source5:        %{srcname}-logrotate.in
 Source9:        %{srcname}-tmpfiles-zabbix.conf
 # systemd units -- Alternatives switches between them (they state their dependencies)
@@ -38,12 +64,20 @@ Source20:       %{srcname}.fc
 
 # This is not a symlink, because we don't want the webserver to possibly ever serve it.
 # local rules for config files
-Patch0:         %{srcname}-4.0.3-config.patch
-%if 0%{?fedora} >= 28
+Patch0:         %{srcname}-config.patch
+# Allow out-of-tree builds
+# https://support.zabbix.com/browse/ZBXNEXT-6077
+Patch1:         %{srcname}-out-of-tree.patch
+# Enforce Fedora Crypto Policy
+Patch2:         %{srcname}-crypto-policy.patch
+# Add <stdio> to sscanf check
+# https://support.zabbix.com/browse/ZBX-21946
+Patch3:         %{srcname}-configure-sscanf.patch
+
+# Patch1 patches automake files so we need to autoreconf
+BuildRequires:   libtool
+BuildRequires:   make
 BuildRequires:   mariadb-connector-c-devel
-%else
-BuildRequires:   mysql-devel
-%endif
 BuildRequires:   libpq-devel
 BuildRequires:   sqlite-devel
 BuildRequires:   net-snmp-devel
@@ -56,27 +90,43 @@ BuildRequires:   OpenIPMI-devel
 BuildRequires:   libssh2-devel
 BuildRequires:   libxml2-devel
 BuildRequires:   libevent-devel
-BuildRequires:   pcre-devel
+BuildRequires:   pcre2-devel
 BuildRequires:   gcc
+# For Agent 2 - has missing deps
+%if %{with go}
+BuildRequires:   gcc-go
+#BuildRequires:   golang(github.com/alimy/mc/v2)
+BuildRequires:   golang(github.com/docker/go-connections)
+#BuildRequires:   golang(github.com/dustin/gomemcached)
+BuildRequires:   golang(github.com/fsnotify/fsnotify)
+BuildRequires:   golang(github.com/go-ldap/ldap)
+#BuildRequires:   golang(github.com/go-ole/go-ole)
+BuildRequires:   golang(github.com/go-sql-driver/mysql)
+BuildRequires:   golang(github.com/godbus/dbus)
+#BuildRequires:   golang(github.com/jackc/pgx/v4)
+BuildRequires:   golang(github.com/mattn/go-sqlite3)
+#BuildRequires:   golang(github.com/mediocregopher/radix/v3)
+#BuildRequires:   golang(github.com/natefinch/npipe)
+#BuildRequires:   golang(github.com/testcontainers/testcontainers-go)
+#BuildRequires:   golang(golang.org/x/sys)
+%endif
 BuildRequires:   systemd
+# Needed to determine path to link to
+BuildRequires:   dejavu-sans-fonts
 
 Requires:        logrotate
+
 %if 0%{?with_selinux}
 # This ensures that the *-selinux package and all it’s dependencies are not pulled
 # into containers and other systems that do not use SELinux
 Requires:        (%{srcname}-selinux if selinux-policy-%{selinuxtype})
-%endif # if with_selinux
+%endif
+
 Provides:        bundled(md5-deutsch)
 # Could alternatively be conditional on Fedora/EL
 %if "x%{?srcname}" != "x%{name}"
 Provides:        %{srcname} = %{version}-%{release}
-Conflicts:       %{srcname} < 3.0
-Conflicts:       %{srcname}20
-Conflicts:       %{srcname}22
-%else
-Obsoletes:       %{srcname}-docs < 1.8.15-2
-Obsoletes:       %{srcname}-web-sqlite3 < 2.0.3-3
-Obsoletes:       %{srcname}-server-sqlite3 < 2.0.3-3
+Conflicts:       %{srcname} < 6.0
 %endif
 
 %description
@@ -126,10 +176,11 @@ Requires:            %{name} = %{?epoch:%{epoch}:}%{version}-%{release}
 Requires:            %{name}-server-implementation = %{?epoch:%{epoch}:}%{version}-%{release}
 Requires:            fping
 Requires:            traceroute
-Requires(pre):       shadow-utils
 Requires(post):      systemd
 Requires(preun):     systemd
 Requires(postun):    systemd
+Provides:            user(zabbixsrv)
+Provides:            group(zabbixsrv)
 
 %description server
 Zabbix server common files
@@ -140,7 +191,6 @@ Requires:            %{name} = %{?epoch:%{epoch}:}%{version}-%{release}
 Requires:            %{name}-dbfiles-mysql
 Requires:            %{name}-server = %{?epoch:%{epoch}:}%{version}-%{release}
 Requires(post):      %{_sbindir}/update-alternatives
-Requires(preun):     %{_sbindir}/alternatives
 Requires(postun):    %{_sbindir}/update-alternatives
 Provides:            %{name}-server-implementation = %{?epoch:%{epoch}:}%{version}-%{release}
 
@@ -153,7 +203,6 @@ Requires:            %{name} = %{?epoch:%{epoch}:}%{version}-%{release}
 Requires:            %{name}-server = %{?epoch:%{epoch}:}%{version}-%{release}
 Requires:            %{name}-dbfiles-pgsql
 Requires(post):      %{_sbindir}/update-alternatives
-Requires(preun):     %{_sbindir}/alternatives
 Requires(postun):    %{_sbindir}/update-alternatives
 Provides:            %{name}-server-implementation = %{?epoch:%{epoch}:}%{version}-%{release}
 
@@ -163,7 +212,6 @@ Zabbix server compiled to use PostgreSQL
 %package agent
 Summary:             Zabbix agent
 Requires:            %{name} = %{?epoch:%{epoch}:}%{version}-%{release}
-Requires(pre):       shadow-utils
 Requires(post):      systemd
 Requires(preun):     systemd
 Requires(postun):    systemd
@@ -176,7 +224,6 @@ Summary:             Zabbix proxy common files
 BuildArch:           noarch
 Requires:            %{name} = %{?epoch:%{epoch}:}%{version}-%{release}
 Requires:            %{name}-proxy-implementation = %{?epoch:%{epoch}:}%{version}-%{release}
-Requires(pre):       shadow-utils
 Requires(post):      systemd
 Requires(preun):     systemd
 Requires(postun):    systemd
@@ -191,7 +238,6 @@ Requires:            %{name}-proxy = %{?epoch:%{epoch}:}%{version}-%{release}
 Requires:            %{name}-dbfiles-mysql
 Provides:            %{name}-proxy-implementation = %{?epoch:%{epoch}:}%{version}-%{release}
 Requires(post):      %{_sbindir}/update-alternatives
-Requires(preun):     %{_sbindir}/alternatives
 Requires(postun):    %{_sbindir}/update-alternatives
 
 %description proxy-mysql
@@ -203,7 +249,6 @@ Requires:            %{name}-proxy = %{?epoch:%{epoch}:}%{version}-%{release}
 Requires:            %{name}-dbfiles-pgsql
 Provides:            %{name}-proxy-implementation = %{?epoch:%{epoch}:}%{version}-%{release}
 Requires(post):      %{_sbindir}/update-alternatives
-Requires(preun):     %{_sbindir}/alternatives
 Requires(postun):    %{_sbindir}/update-alternatives
 
 %description proxy-pgsql
@@ -215,7 +260,6 @@ Requires:            %{name}-proxy = %{?epoch:%{epoch}:}%{version}-%{release}
 Requires:            %{name}-dbfiles-sqlite3
 Provides:            %{name}-proxy-implementation = %{?epoch:%{epoch}:}%{version}-%{release}
 Requires(post):      %{_sbindir}/update-alternatives
-Requires(preun):     %{_sbindir}/alternatives
 Requires(postun):    %{_sbindir}/update-alternatives
 
 %description proxy-sqlite3
@@ -224,19 +268,17 @@ Zabbix proxy compiled to use SQLite
 %package web
 Summary:         Zabbix Web Frontend
 BuildArch:       noarch
-# Don't remove "php". Everything else only depends on php-common
-# and you'll end up with no module for Apache!
-Requires:        php
-Requires:        php-gd
 Requires:        php-bcmath
+Requires:        php-fpm
+Requires:        php-gd
+Requires:        php-gettext
+Requires:        php-json
 Requires:        php-ldap
 Requires:        php-mbstring
 Requires:        php-xml
-Requires:        php-gettext
-Requires:        php-fpm
-# jquery 3.3.1 and jquery-ui 1.12.1 in the sources
-Requires:        js-jquery3
-Provides:        bundled(js-jquery-ui) = 1.12.1
+# jquery 3.6.0 and jquery-ui 1.13.2 in the sources
+Requires:        js-jquery >= 3.6.0
+Provides:        bundled(js-jquery-ui) = 1.13.2
 # prototype 1.6.1 in the sources, Fedora package is dead
 #Requires:        prototype
 Requires:        dejavu-sans-fonts
@@ -252,7 +294,6 @@ BuildArch:       noarch
 Requires:        %{name}-web = %{?epoch:%{epoch}:}%{version}-%{release}
 Requires:        php-mysqli
 Provides:        %{name}-web-database = %{?epoch:%{epoch}:}%{version}-%{release}
-Obsoletes:       %{name}-web <= 1.5.3-0.1
 
 %description web-mysql
 Zabbix web frontend for MySQL
@@ -267,6 +308,19 @@ Provides:        %{name}-web-database = %{?epoch:%{epoch}:}%{version}-%{release}
 %description web-pgsql
 Zabbix web frontend for PostgreSQL
 
+%if %{with java}
+%package -n java-%{srcname}
+Summary:         Zabbix Java connector
+BuildArch:       noarch
+BuildRequires:   java-devel
+BuildRequires:   osgi(org.junit)
+BuildRequires:   osgi(slf4j.api)
+BuildRequires:   osgi(logback)
+
+%description -n java-%{srcname}
+Zabbix Java connector.
+%endif
+
 %if 0%{?with_selinux}
 # SELinux subpackage
 %package selinux
@@ -279,15 +333,15 @@ BuildRequires:       selinux-policy-devel
 
 %description selinux
 Custom SELinux policy module
-%endif # if with_selinux
+%endif
 
 
 %prep
-%setup0 -q -n %{srcname}-%{version}%{?prerelease:.%{prerelease}}
-%patch0 -p1
+%autosetup -p1
+autoreconf
 
 # Remove bundled java libs
-rm -rf src/zabbix_java/lib/*.jar
+find -name \*.jar -delete
 
 # Remove prebuilt Windows binaries
 rm -rf bin
@@ -298,15 +352,11 @@ sed -i '/CURL_SSL_.*_LOCATION\|SCRIPTS_PATH/s|\${datadir}/zabbix|/var/lib/zabbix
     configure
 
 # Kill off .htaccess files, options set in SOURCE1
-rm -f frontends/php/app/.htaccess
-rm -f frontends/php/conf/.htaccess
-rm -f frontends/php/include/.htaccess
-rm -f frontends/php/local/.htaccess
+find -name .htaccess -delete
 
-# Fix path to traceroute utility
+# Fix path to traceroute utility (on all Linux targets)
 find database -name 'data.sql' -exec sed -i 's|/usr/bin/traceroute|/bin/traceroute|' {} \;
 
-
 # Common
 # Settings with hard-coded defaults that are not suitable for Fedora
 # are explicitly set, leaving the comment with the default value in place.
@@ -317,9 +367,9 @@ find database -name 'data.sql' -exec sed -i 's|/usr/bin/traceroute|/bin/tracerou
 sed -i \
     -e '\|^# LogFileSize=.*|a LogFileSize=0' \
     -e 's|^DBUser=root|DBUser=zabbix|' \
-    -e 's|^# DBSocket=/tmp/mysql.sock|# DBSocket=%{_sharedstatedir}/mysql/mysql.sock|' \
+    -e 's|^# DBSocket=.*|DBSocket=%{_sharedstatedir}/mysql/mysql.sock|' \
     -e '\|^# ExternalScripts=|a ExternalScripts=%{_sharedstatedir}/zabbixsrv/externalscripts' \
-    -e '\|^# AlertScripts=|a AlertScripts=%{_sharedstatedir}/zabbixsrv/alertscripts' \
+    -e '\|^# AlertScriptsPath=|a AlertScriptsPath=%{_sharedstatedir}/zabbixsrv/alertscripts' \
     -e '\|^# TmpDir=\/tmp|a TmpDir=%{_sharedstatedir}/zabbixsrv/tmp' \
     -e 's|/usr/local||' \
     -e 's|\${datadir}|/usr/share|' \
@@ -344,15 +394,18 @@ sed -i \
 # Install README file
 install -m 0644 -p %{SOURCE16} .
 
+# Create a sysusers.d config file
+cat >zabbix.sysusers.conf <<EOF
+u zabbix - 'Zabbix Monitoring System' %{_sharedstatedir}/zabbix -
+EOF
+
 
 %build
 
 common_flags="
     --enable-dependency-tracking
-    --enable-agent
     --enable-proxy
     --enable-ipv6
-    --disable-java
     --with-net-snmp
     --with-ldap
     --with-libcurl
@@ -361,30 +414,34 @@ common_flags="
     --with-ssh2
     --with-libxml2
     --with-libevent
-    --with-libpcre
+    --with-libpcre2
     --with-openssl
 "
+# Setup out of tree builds
+%global _configure ../configure
+
+%if %{with java}
+export CLASSPATH=$(build-classpath junit slf4j-api logback-core logback-classic android-json)
+%endif
 
 # Frontend doesn't work for SQLite, thus don't build server
-%configure $common_flags --with-sqlite3
-make %{?_smp_mflags}
-mv src/zabbix_proxy/zabbix_proxy src/zabbix_proxy/zabbix_proxy_sqlite3
+mkdir -p build-frontend
+cd build-frontend
+%configure $common_flags --enable-agent --with-sqlite3 %{?with_go:--enable-agent2} %{?with_java:--enable-java}
+%make_build
+cd -
 
+mkdir -p build-server-mysql
+cd build-server-mysql
 %configure $common_flags --with-mysql --enable-server
-make clean
-make %{?_smp_mflags}
-mv src/zabbix_server/zabbix_server src/zabbix_server/zabbix_server_mysql
-mv src/zabbix_proxy/zabbix_proxy src/zabbix_proxy/zabbix_proxy_mysql
+%make_build
+cd -
 
+mkdir -p build-server-postgresql
+cd build-server-postgresql
 %configure $common_flags --with-postgresql --enable-server
-make clean
-make %{?_smp_mflags}
-mv src/zabbix_server/zabbix_server src/zabbix_server/zabbix_server_pgsql
-mv src/zabbix_proxy/zabbix_proxy src/zabbix_proxy/zabbix_proxy_pgsql
-
-# Ghosted alternatives
-touch src/zabbix_server/zabbix_server
-touch src/zabbix_proxy/zabbix_proxy
+%make_build
+cd -
 
 %if 0%{?with_selinux}
 # SELinux policy (originally from selinux-policy-contrib)
@@ -396,18 +453,30 @@ cp -p %{SOURCE20} selinux/
 
 make -f %{_datadir}/selinux/devel/Makefile %{srcname}.pp
 bzip2 -9 %{srcname}.pp
-%endif # if with_selinux
+%endif
 
 
 %install
-# Configuration, runtime and start-up
-mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/%{srcname}
-mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/%{srcname}/web
-mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d
-mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d
+# Install binaries
+%make_install -C build-frontend
+mv $RPM_BUILD_ROOT%{_sbindir}/zabbix_proxy{,_sqlite3}
+%make_install -C build-server-mysql
+mv $RPM_BUILD_ROOT%{_sbindir}/zabbix_proxy{,_mysql}
+mv $RPM_BUILD_ROOT%{_sbindir}/zabbix_server{,_mysql}
+%make_install -C build-server-postgresql
+mv $RPM_BUILD_ROOT%{_sbindir}/zabbix_proxy{,_pgsql}
+mv $RPM_BUILD_ROOT%{_sbindir}/zabbix_server{,_pgsql}
+
+# Ghosted alternatives
+touch $RPM_BUILD_ROOT%{_sbindir}/zabbix_{proxy,server}
+
+# Home directory for the agent;
+# The other home directory is created during installation
+mkdir -p $RPM_BUILD_ROOT%{_sharedstatedir}/zabbix
+
+# Log directories
 mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/log/zabbix
 mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/log/zabbixsrv
-mkdir -p $RPM_BUILD_ROOT%{_unitdir}
 
 # systemd tmpfiles
 mkdir -p $RPM_BUILD_ROOT%{_prefix}/lib/tmpfiles.d
@@ -417,46 +486,39 @@ mkdir -p $RPM_BUILD_ROOT%{_rundir}
 install -d -m 0755 $RPM_BUILD_ROOT%{_rundir}/zabbix/
 install -d -m 0755 $RPM_BUILD_ROOT%{_rundir}/zabbixsrv/
 
-# Frontend
-mkdir -p $RPM_BUILD_ROOT%{_datadir}/%{srcname}
-
-# Home directory for the agent;
-# The other home directory is created during installation
-mkdir -p $RPM_BUILD_ROOT%{_sharedstatedir}/zabbix
-
-# Install binaries
-make DESTDIR=$RPM_BUILD_ROOT install
-install -m 0755 -p src/zabbix_server/zabbix_server_* $RPM_BUILD_ROOT%{_sbindir}/
-install -m 0755 -p src/zabbix_proxy/zabbix_proxy_* $RPM_BUILD_ROOT%{_sbindir}/
-
 # Install the frontend after removing backup files from patching
-find frontends/php -name '*.orig' -exec rm {} \;
-cp -a frontends/php/* $RPM_BUILD_ROOT%{_datadir}/%{srcname}
+find ui -name '*.orig' -delete
+mkdir -p $RPM_BUILD_ROOT%{_datadir}/%{srcname}
+cp -a ui/* $RPM_BUILD_ROOT%{_datadir}/%{srcname}/
 
 # Prepare ghosted config file
+mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/%{srcname}/web
 touch $RPM_BUILD_ROOT%{_sysconfdir}/%{srcname}/web/zabbix.conf.php
 
-# Replace bundled font and JS libraries
-# There is no jquery-ui package yet
-#pushd $RPM_BUILD_ROOT%{_datadir}/%{srcname}/fonts/
-#rm DejaVuSans.ttf && ln -sf %{_datadir}/fonts/dejavu/DejaVuSans.ttf
-#popd
-pushd $RPM_BUILD_ROOT%{_datadir}/%{srcname}/js/vendors/
-rm jquery.js && ln -sf %{_datadir}/javascript/jquery/3/jquery.min.js jquery.js
-popd
+# Replace bundled font
+[ -d %{_fontbasedir}/dejavu ] &&
+  ln -sf ../../../fonts/dejavu/DejaVuSans.ttf $RPM_BUILD_ROOT%{_datadir}/%{srcname}/assets/fonts/
+[ -d %{_fontbasedir}/dejavu-sans-fonts ] &&
+  ln -sf ../../../fonts/dejavu-sans-fonts/DejaVuSans.ttf $RPM_BUILD_ROOT%{_datadir}/%{srcname}/assets/fonts/
 
-# Move MVC override directory out; We are not owning or creating this directory!
-#TODO: README dort
-rm -r frontends/php/local/ && ln -sf %{_usr}/local/share/zabbix/local $RPM_BUILD_ROOT%{_datadir}/%{srcname}/local
-#TODO: local vielleicht doch unter /etc/zabbix/web?
+# Replace JS libraries
+# There is no jquery-ui package yet
+ln -sf ../../../javascript/jquery/3/jquery.min.js $RPM_BUILD_ROOT%{_datadir}/%{srcname}/js/vendors/jquery.js
+#ln -sf ../../../javascript/jquery-ui/1/jquery-ui.min.js $RPM_BUILD_ROOT%{_datadir}/%{srcname}/js/vendors/jquery-ui.js
 
 # This file is used to switch the frontend to maintenance mode
-mv $RPM_BUILD_ROOT%{_datadir}/%{srcname}/conf/maintenance.inc.php $RPM_BUILD_ROOT%{_sysconfdir}/%{srcname}/web/maintenance.inc.php
+mv $RPM_BUILD_ROOT%{_datadir}/%{srcname}/conf/maintenance.inc.php $RPM_BUILD_ROOT%{_sysconfdir}/%{srcname}/web/maintenance.inc.php || :
 
 # Drop Apache config file in place
+mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d
 install -m 0644 -p %{SOURCE1} $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d/%{srcname}.conf
 
+# Drop php-fpm config file in place
+mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/php-fpm.d
+install -m 0644 -p %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/php-fpm.d/%{srcname}.conf
+
 # Install log rotation
+mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d
 sed -e 's|COMPONENT|agentd|g; s|USER|zabbix|g' %{SOURCE5} > \
      $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/zabbix-agent
 sed -e 's|COMPONENT|server|g; s|USER|zabbixsrv|g' %{SOURCE5} > \
@@ -465,6 +527,7 @@ sed -e 's|COMPONENT|proxy|g; s|USER|zabbixsrv|g' %{SOURCE5} > \
      $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/zabbix-proxy
 
 # Install different systemd units because of the requirements for DBMS daemons
+mkdir -p $RPM_BUILD_ROOT%{_unitdir}
 install -m 0644 -p %{SOURCE10} $RPM_BUILD_ROOT%{_unitdir}/zabbix-agent.service
 install -m 0644 -p %{SOURCE11} $RPM_BUILD_ROOT%{_unitdir}/zabbix-proxy-mysql.service
 install -m 0644 -p %{SOURCE12} $RPM_BUILD_ROOT%{_unitdir}/zabbix-proxy-pgsql.service
@@ -476,15 +539,6 @@ install -m 0644 -p %{SOURCE15} $RPM_BUILD_ROOT%{_unitdir}/zabbix-server-pgsql.se
 touch $RPM_BUILD_ROOT%{_unitdir}/zabbix-server.service
 touch $RPM_BUILD_ROOT%{_unitdir}/zabbix-proxy.service
 
-# Install compatibility links for config files
-#TODO: Switch to .wants files instead!
-ln -sf ../zabbix_agentd.conf $RPM_BUILD_ROOT%{_sysconfdir}/%{srcname}/zabbix_agentd.conf
-ln -sf ../zabbix_server.conf $RPM_BUILD_ROOT%{_sysconfdir}/%{srcname}/zabbix_server.conf
-ln -sf ../zabbix_proxy.conf $RPM_BUILD_ROOT%{_sysconfdir}/%{srcname}/zabbix_proxy.conf
-ln -sf ../../%{_sharedstatedir}/zabbixsrv/externalscripts $RPM_BUILD_ROOT%{_sysconfdir}/%{srcname}/externalscripts
-ln -sf ../../%{_sharedstatedir}/zabbixsrv/alertscripts $RPM_BUILD_ROOT%{_sysconfdir}/%{srcname}/alertscripts
-#TODO: What does that do to existing directories?
-
 # Directory for fping spooling files 
 mkdir -p $RPM_BUILD_ROOT%{_sharedstatedir}/zabbixsrv/tmp
 
@@ -499,7 +553,10 @@ cp -p database/sqlite3/schema.sql $RPM_BUILD_ROOT%{_datadir}/%{srcname}-sqlite3
 
 %if 0%{?with_selinux}
 install -D -m 0644 %{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
-%endif # if with_selinux
+install -D -p -m 0644 selinux/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{name}.if
+%endif
+
+install -m0644 -D zabbix.sysusers.conf %{buildroot}%{_sysusersdir}/zabbix.conf
 
 
 %post server
@@ -515,13 +572,25 @@ fi
 %post server-mysql
 %{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_server \
     %{srcname}-server %{_sbindir}/%{srcname}_server_mysql 10 \
-        --slave %{_unitdir}/zabbix-server.service %{srcname}-server-systemd \
+        --slave %{_unitdir}/zabbix-server.service %{srcname}-server.service \
+            %{_unitdir}/zabbix-server-mysql.service
+# This needs to be run twice to rename from old slave name in zabbix < 6.0.33-2
+# due to a bug in alternatives. Remove in F45
+%{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_server \
+    %{srcname}-server %{_sbindir}/%{srcname}_server_mysql 10 \
+        --slave %{_unitdir}/zabbix-server.service %{srcname}-server.service \
             %{_unitdir}/zabbix-server-mysql.service
 
 %post server-pgsql
 %{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_server \
     %{srcname}-server %{_sbindir}/%{srcname}_server_pgsql 10 \
-        --slave %{_unitdir}/zabbix-server.service %{srcname}-server-systemd \
+        --slave %{_unitdir}/zabbix-server.service %{srcname}-server.service \
+            %{_unitdir}/zabbix-server-pgsql.service
+# This needs to be run twice to rename from old slave name in zabbix < 6.0.33-2
+# due to a bug in alternatives. Remove in F45
+%{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_server \
+    %{srcname}-server %{_sbindir}/%{srcname}_server_pgsql 10 \
+        --slave %{_unitdir}/zabbix-server.service %{srcname}-server.service \
             %{_unitdir}/zabbix-server-pgsql.service
 
 %post proxy
@@ -537,19 +606,37 @@ fi
 %post proxy-mysql
 %{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_proxy \
     %{srcname}-proxy %{_sbindir}/%{srcname}_proxy_mysql 10 \
-        --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy-systemd \
+        --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy.service \
+            %{_unitdir}/zabbix-proxy-mysql.service
+# This needs to be run twice to rename from old slave name in zabbix < 6.0.33-2
+# due to a bug in alternatives. Remove in F45
+%{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_proxy \
+    %{srcname}-proxy %{_sbindir}/%{srcname}_proxy_mysql 10 \
+        --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy.service \
             %{_unitdir}/zabbix-proxy-mysql.service
 
 %post proxy-pgsql
 %{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_proxy \
     %{srcname}-proxy %{_sbindir}/%{srcname}_proxy_pgsql 10 \
-        --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy-systemd \
+        --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy.service \
+            %{_unitdir}/zabbix-proxy-pgsql.service
+# This needs to be run twice to rename from old slave name in zabbix < 6.0.33-2
+# due to a bug in alternatives. Remove in F45
+%{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_proxy \
+    %{srcname}-proxy %{_sbindir}/%{srcname}_proxy_pgsql 10 \
+        --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy.service \
             %{_unitdir}/zabbix-proxy-pgsql.service
 
 %post proxy-sqlite3
 %{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_proxy \
     %{srcname}-proxy %{_sbindir}/%{srcname}_proxy_sqlite3 10 \
-        --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy-systemd \
+        --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy.service \
+            %{_unitdir}/zabbix-proxy-sqlite3.service
+# This needs to be run twice to rename from old slave name in zabbix < 6.0.33-2
+# due to a bug in alternatives. Remove in F45
+%{_sbindir}/update-alternatives --install %{_sbindir}/%{srcname}_proxy \
+    %{srcname}-proxy %{_sbindir}/%{srcname}_proxy_sqlite3 10 \
+        --slave %{_unitdir}/zabbix-proxy.service %{srcname}-proxy.service \
             %{_unitdir}/zabbix-proxy-sqlite3.service
 
 %if 0%{?with_selinux}
@@ -568,14 +655,8 @@ fi
 
 %posttrans selinux
 %selinux_relabel_post -s %{selinuxtype}
-%endif # if with_selinux
+%endif
 
-%pre agent
-getent group zabbix > /dev/null || groupadd -r zabbix
-getent passwd zabbix > /dev/null || \
-    useradd -r -g zabbix -d %{_sharedstatedir}/zabbix -s /sbin/nologin \
-    -c "Zabbix Monitoring System" zabbix
-:
 
 %post agent
 %systemd_post zabbix-agent.service
@@ -657,8 +738,8 @@ fi
 %doc AUTHORS ChangeLog NEWS README zabbix-fedora-epel.README
 %dir %{_sysconfdir}/%{srcname}
 %config(noreplace) %{_sysconfdir}/zabbix_agentd.conf
-%config(noreplace) %{_sysconfdir}/%{srcname}/zabbix_agentd.conf
 %{_bindir}/zabbix_get
+%{_bindir}/zabbix_js
 %{_bindir}/zabbix_sender
 %{_mandir}/man1/zabbix_get.1*
 %{_mandir}/man1/zabbix_sender.1*
@@ -681,9 +762,6 @@ fi
 %{_prefix}/lib/tmpfiles.d/zabbixsrv.conf
 %attr(0640,root,zabbixsrv) %config(noreplace) %{_sysconfdir}/zabbix_server.conf
 %attr(0775,root,zabbixsrv) %dir %{_localstatedir}/log/zabbixsrv
-%config(noreplace) %{_sysconfdir}/%{srcname}/zabbix_server.conf
-%config(noreplace) %{_sysconfdir}/%{srcname}/externalscripts
-%config(noreplace) %{_sysconfdir}/%{srcname}/alertscripts
 %config(noreplace) %{_sysconfdir}/logrotate.d/zabbix-server
 %ghost %{_sbindir}/zabbix_server
 %attr(0750,zabbixsrv,zabbixsrv) %dir %{_sharedstatedir}/zabbixsrv
@@ -704,8 +782,9 @@ fi
 %if 0%{?with_selinux}
 %files selinux
 %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.*
-%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
-%endif # if with_selinux
+%{_datadir}/selinux/devel/include/distributed/%{name}.if
+%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
+%endif
 
 %files agent
 %doc conf/zabbix_agentd/*.conf
@@ -713,12 +792,12 @@ fi
 %{_prefix}/lib/tmpfiles.d/zabbix.conf
 %attr(0775,root,zabbix) %dir %{_localstatedir}/log/zabbix
 %config(noreplace) %{_sysconfdir}/zabbix_agentd.conf
-%config(noreplace) %{_sysconfdir}/%{srcname}/zabbix_agentd.conf
 %config(noreplace) %{_sysconfdir}/logrotate.d/zabbix-agent
 %attr(750,zabbix,zabbix) %dir %{_sharedstatedir}/zabbix
 %{_unitdir}/zabbix-agent.service
 %{_sbindir}/zabbix_agentd
 %{_mandir}/man8/zabbix_agentd.8*
+%{_sysusersdir}/zabbix.conf
 
 %files proxy
 %doc misc/snmptrap/zabbix_trap_receiver.pl
@@ -726,8 +805,6 @@ fi
 %{_prefix}/lib/tmpfiles.d/zabbixsrv.conf
 %attr(0640,root,zabbixsrv) %config(noreplace) %{_sysconfdir}/zabbix_proxy.conf
 %attr(0775,root,zabbixsrv) %dir %{_localstatedir}/log/zabbixsrv
-%config(noreplace) %{_sysconfdir}/%{srcname}/zabbix_proxy.conf
-%config(noreplace) %{_sysconfdir}/%{srcname}/externalscripts
 %config(noreplace) %{_sysconfdir}/logrotate.d/zabbix-proxy
 %ghost %{_sbindir}/zabbix_proxy
 %attr(0750,zabbixsrv,zabbixsrv) %dir %{_sharedstatedir}/zabbixsrv
@@ -754,14 +831,289 @@ fi
 %ghost %attr(0644,apache,apache) %config(noreplace) %{_sysconfdir}/%{srcname}/web/zabbix.conf.php
 %attr(0644,apache,apache) %config(noreplace) %{_sysconfdir}/%{srcname}/web/maintenance.inc.php
 %config(noreplace) %{_sysconfdir}/httpd/conf.d/zabbix.conf
-%{_datadir}/%{srcname}
+%config(noreplace) %{_sysconfdir}/php-fpm.d/zabbix.conf
+%{_datadir}/%{srcname}/
 
 %files web-mysql
 
 %files web-pgsql
 
 %changelog
-* Sat Jul 18 17:11:45 GMT 2020 Orion Poplawski <orion@nwra.com> - 1:4.0.22-1
+* Tue Aug 25 2026 Gwyn Ciesla <gwync@protonmail.com> - 1:7.4.14-1
+- 7.4.14
+
+* Thu Aug 20 2026 Gwyn Ciesla <gwync@protonmail.com> - 1:7.4.13-1
+- 7.4.13
+
+* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1:7.4.12-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
+
+* Thu Jul 09 2026 Gwyn Ciesla <gwync@protonmail.com> - 1:7.4.12-1
+- 7.4.12
+
+* Sat Jun 13 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 1:7.4.9-3
+- Rebuilt for openssl 4.0
+
+* Mon Apr 13 2026 Gwyn Ciesla <gwync@protonmail.com> - 1:7.4.9-2
+- Openssl rebuild
+
+* Thu Apr 09 2026 Gwyn Ciesla <gwync@protonmail.com> - 1:7.4.9-1
+- 7.4.9
+
+* Fri Mar 13 2026 Gwyn Ciesla <gwync@protonmail.com> - 1:7.4.8-1
+- 7.4.8
+
+* Fri Feb 13 2026 Gwyn Ciesla <gwync@protonmail.com> - 1:7.4.7-1
+- 7.4.7
+
+* Fri Jan 23 2026 Benjamin A. Beasley <code@musicinmybrain.net> - 1:7.4.6-3
+- Rebuilt for net-snmp 5.9.5.2
+
+* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1:7.4.6-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Thu Dec 18 2025 Gwyn Ciesla <gwync@protonmail.com> - 1:7.4.6-1
+- 7.4.6
+
+* Mon Nov 03 2025 Gwyn Ciesla <gwync@protonmail.com> - 1:7.4.5-1
+- 7.4.5
+
+* Wed Oct 29 2025 Gwyn Ciesla <gwync@protonmail.com> - 1:7.4.4-1
+- 7.4.4
+
+* Wed Oct 01 2025 Gwyn Ciesla <gwync@protonmail.com> - 1:7.4.3-1
+- 7.4.3
+
+* Mon Aug 25 2025 Gwyn Ciesla <gwync@protonmail.com> - 1:7.4.2-1
+- 7.4.2
+
+* Thu Jul 31 2025 Gwyn Ciesla <gwync@protonmail.com> - 1:7.4.1-1
+- 7.4.1
+
+* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1:7.2.11-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Tue Jul 22 2025 Gwyn Ciesla <gwync@protonmail.com> - 1:7.2.11-1
+- 7.2.11
+
+* Fri Jun 27 2025 Gwyn Ciesla <gwync@protonmail.com> - 1:7.2.10-1
+- 7.2.10
+
+* Fri Jun 20 2025 Gwyn Ciesla <gwync@protonmail.com> - 1:7.2.9-1
+- 7.2.9
+
+* Wed Apr 09 2025 Gwyn Ciesla <gwync@protonmail.com> - 1:7.2.5-2
+- Add user/group provides to -server to fix FTI
+
+* Wed Apr 02 2025 Orion Poplawski <orion@nwra.com> - 1:7.2.5-1
+- Update to 7.2.5 (CVE-2024-36469, CVE-2024-42325, CVE-2024-45700)
+
+* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1:7.2.2-3
+- Add sysusers.d config file to allow rpm to create users/groups automatically
+
+* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1:7.2.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Mon Jan 06 2025 Orion Poplawski <orion@nwra.com> - 1:7.2.2-1
+- Update to 7.2.2
+
+* Thu Dec 12 2024 Orion Poplawski <orion@nwra.com> - 1:7.2.0-1
+- Update to 7.2.0
+
+* Sat Nov 30 2024 Orion Poplawski <orion@nwra.com> - 1:7.0.6-1
+- Update to 7.0.6
+
+* Tue Oct 22 2024 Orion Poplawski <orion@nwra.com> - 1:7.0.5-1
+- Update to 7.0.5
+
+* Mon Oct 07 2024 Orion Poplawski <orion@nwra.com> - 1:7.0.4-2
+- Fix typo in crypto policy patch that broke SSL connections
+
+* Thu Sep 26 2024 Orion Poplawski <orion@nwra.com> - 1:7.0.4-1
+- Update to 7.0.4
+
+* Sat Aug 24 2024 Orion Poplawski <orion@nwra.com> - 1:7.0.3-1
+- Update to 7.0.3
+- License changed upstream to AGPL-3.0-only, note other licenses in source
+
+* Mon Aug 19 2024 Orion Poplawski <orion@nwra.com> - 1:6.0.33-2
+- Use alternatives name that systemd likes for units (bz#2305855)
+
+* Thu Aug 15 2024 Gwyn Ciesla <gwync@protonmail.com> - 1:6.0.33-1
+- 6.0.33
+
+* Mon Jul 29 2024 Miroslav Suchý <msuchy@redhat.com> - 1:6.0.30-3
+- convert license to SPDX
+
+* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1:6.0.30-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Tue May 21 2024 Gwyn Ciesla <gwync@protonmail.com> - 1:6.0.30-1
+- 6.0.30
+
+* Fri May 03 2024 Orion Poplawski <orion@nwra.com> - 1:6.0.29-1
+- Update to 6.0.29
+- Hopefully really get the zabbix_run_sudo SELinux boolean working for
+  zabbix-agent and allow it to run lvm when enabled
+
+* Wed Feb 28 2024 Morten Stevens <mstevens@fedoraproject.org> - 1:6.0.27-1
+- Update to 6.0.27
+
+* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1:6.0.25-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Thu Jan 04 2024 Orion Poplawski <orion@nwra.com> - 1:6.0.25-1
+- Update to 6.0.25
+
+* Fri Dec 01 2023 Gwyn Ciesla <gwync@protonmail.com> - 1:6.0.22-3
+- Patch for libxml2 2.12.x
+
+* Sat Oct 28 2023 Orion Poplawski <orion@nwra.com> - 1:6.0.22-2
+- Add dontaudit SELinux rules for spurious AVC denial messages (bz#2170630)
+
+* Wed Oct 04 2023 Morten Stevens <mstevens@fedoraproject.org> - 1:6.0.22-1
+- Update to 6.0.22
+
+* Mon Aug 07 2023 Morten Stevens <mstevens@fedoraproject.org> - 1:6.0.20-1
+- Update to 6.0.20
+
+* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1:6.0.19-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Thu Jul 06 2023 Morten Stevens <mstevens@fedoraproject.org> - 1:6.0.19-1
+- Update to 6.0.19
+
+* Thu Jun 15 2023 Morten Stevens <mstevens@fedoraproject.org> - 1:6.0.18-1
+- Update to 6.0.18
+
+* Tue Apr 25 2023 Morten Stevens <mstevens@fedoraproject.org> - 1:6.0.17-1
+- Update to 6.0.17
+
+* Tue Apr 11 2023 Morten Stevens <mstevens@fedoraproject.org> - 1:6.0.16-1
+- Update to 6.0.16
+
+* Tue Apr 04 2023 Morten Stevens <mstevens@fedoraproject.org> - 1:6.0.15-1
+- Update to 6.0.15
+
+* Tue Mar 21 2023 Morten Stevens <mstevens@fedoraproject.org> - 1:6.0.14-1
+- Update to 6.0.14
+
+* Wed Mar 01 2023 Gwyn Ciesla <gwync@protonmail.com> - 1:6.0.13-2
+- migrated to SPDX license
+
+* Thu Feb 16 2023 Orion Poplawski <orion@nwra.com> - 1:6.0.13-1
+- Update to 6.0.13
+- Add policy to allow zabbix scripts to run chronyc as chronyc_t (bz#2160180)
+- Add policy to allow zabbix agent to run rpm read-only
+
+* Sun Jan 22 2023 Orion Poplawski <orion@nwra.com> - 1:6.0.12-1
+- Update to 6.0.12
+
+* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1:6.0.8-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Thu Nov 17 2022 Florian Weimer <fweimer@redhat.com> - 1:6.0.8-2
+- Include <stdio.h> in configure for sscanf prototype
+
+* Wed Sep 14 2022 Gwyn Ciesla <gwync@protonmail.com> - 1:6.0.8-1
+- 6.0.8
+
+* Fri Jul 22 2022 Gwyn Ciesla <gwync@protonmail.com> -1:6.0.6-2
+- Move to pcre2
+
+* Fri Jul 08 2022 Orion Poplawski <orion@nwra.com> - 1:6.0.6-1
+- Update to 6.0.6
+
+* Tue May 31 2022 Gwyn Ciesla <gwync@protonmail.com> - 1:6.0.5-1
+- 6.0.5
+
+* Mon May 09 2022 Orion Poplawski <orion@cora.nwra.com> - 1:6.0.4-1
+- Update to 6.0.4
+
+* Mon Apr 04 2022 Gwyn Ciesla <gwync@protonmail.com> - 1:6.0.3-1
+- 6.0.3
+
+* Wed Mar 23 2022 Orion Poplawski <orion@nwra.com> - 1:6.0.2-1
+- Update to 6.0.2
+
+* Fri Mar 11 2022 Gwyn Ciesla <gwync@protonmail.com> - 1:5.0.21-1
+- 5.0.21
+
+* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1:5.0.19-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Fri Jan 14 2022 Gwyn Ciesla <gwync@protonmail.com> - 1:5.0.19-1
+- 5.0.19
+- Fixed CVE-2022-23132, CVE-2022-23133, CVE-2022-23134.
+
+* Wed Dec 01 2021 Orion Poplawski <orion@nwra.com> - 1:5.0.18-1
+- Update to 5.0.18
+
+* Mon Nov 01 2021 Orion Poplawski <orion@cora.nwra.com> - 1:5.0.17-1
+- Update to 5.0.17
+
+* Sat Oct 16 2021 Morten Stevens <mstevens@fedoraproject.org> - 1:5.0.16-1
+- Update to 5.0.16
+
+* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 1:5.0.14-2
+- Rebuilt with OpenSSL 3.0.0
+
+* Mon Jul 26 2021 Morten Stevens <mstevens@fedoraproject.org> - 1:5.0.14-1
+- Update to 5.0.14
+
+* Mon Jul 26 2021 Morten Stevens <mstevens@fedoraproject.org> - 1:5.0.10-3
+- Dropped support for DES
+
+* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1:5.0.10-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Tue Apr 20 2021 Orion Poplawski <orion@nwra.com> - 1:5.0.10-1
+- Update to 5.0.10
+- SELinux: Allow fping to read the zabbix ping list
+
+* Fri Mar 05 2021 Orion Poplawski <orion@nwra.com> - 1:5.0.9-1
+- Update to 5.0.9
+
+* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1:5.0.8-2
+- Rebuilt for updated systemd-rpm-macros
+  See https://pagure.io/fesco/issue/2583.
+
+* Mon Feb 15 2021 Orion Poplawski <orion@nwra.com> - 1:5.0.8-1
+- Update to 5.0.8
+- Update php configuration for php-fpm (bz#1928386)
+
+* Mon Feb 08 2021 Pavel Raiskup <praiskup@redhat.com> - 1:5.0.7-4
+- rebuild for libpq ABI fix rhbz#1908268
+
+* Thu Jan 28 2021 Orion Poplawski <orion@nwra.com> - 1:5.0.7-3
+- Handle new dejavu-sans-fonts directory (bz#1921010)
+
+* Thu Jan 28 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1:5.0.7-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Sun Jan 24 2021 Orion Poplawski <orion@nwra.com> - 1:5.0.7-1
+- Update to 5.0.7
+
+* Sun Dec 13 2020 Orion Poplawski <orion@nwra.com> - 1:5.0.6-1
+- Update to 5.0.6
+
+* Tue Sep 15 2020 Volker Froehlich <volker27@gmx.at> - 1:5.0.3-2
+- Rebuild for libevent soname bump
+
+* Tue Sep  1 2020 Orion Poplawski <orion@nwra.com> - 1:5.0.3-1
+- Update to 5.0.3
+
+* Tue Sep  1 2020 Orion Poplawski <orion@nwra.com> - 1:5.0.2-1
+- Update to 5.0.2
+- Enforce Fedora crypto policy
+
+* Thu Aug 27 2020 Josef Řídký <jridky@redhat.com> - 1:4.0.22-3
+- Rebuilt for new net-snmp release
+
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1:4.0.22-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Sat Jul 18 2020 Orion Poplawski <orion@nwra.com> - 1:4.0.22-1
 - Update to 4.0.22 (bz#1858259) CVE-2020-15803
 - Fix alert/external scripts directories
 

zabbix.te

@@ -1,4 +1,4 @@
-policy_module(zabbix, 1.6.0)
+policy_module(zabbix, 1.7.0)
 
 ########################################
 #
@@ -72,8 +72,8 @@ role system_r types zabbix_script_t;
 # zabbix domain local policy
 #
 
-allow zabbix_domain self:capability { setuid setgid };
-allow zabbix_domain self:process { setpgid setsched getsched signal_perms };
+allow zabbix_domain self:capability { setgid setuid };
+allow zabbix_domain self:process { getsched setpgid setsched signal_perms };
 allow zabbix_domain self:fifo_file rw_fifo_file_perms;
 allow zabbix_domain self:sem create_sem_perms;
 allow zabbix_domain self:shm create_shm_perms;
@@ -157,7 +157,7 @@ tunable_policy(`zabbix_can_network',`
 ')
 
 tunable_policy(`zabbix_run_sudo',`
-    allow zabbix_t self:capability { setuid setgid sys_resource };
+    allow zabbix_t self:capability { setgid setuid sys_resource };
     allow zabbix_t self:process { setrlimit setsched };
     allow zabbix_t self:key write;
     allow zabbix_t self:passwd { passwd rootok };
@@ -284,22 +284,53 @@ zabbix_tcp_connect(zabbix_agent_t)
 
 zabbix_script_domtrans(zabbix_agent_t)
 
+# These are triggered by vfs.dev.discovery enumerating everyting in /dev
+gen_require(`
+    type devlog_t;
+')
+dontaudit zabbix_agent_t devlog_t:sock_file getattr;
+init_dontaudit_getattr_initctl(zabbix_agent_t)
+kernel_dontaudit_getattr_core_if(zabbix_agent_t)
+
+gen_require(`
+    type kernel_t, sudo_log_t;
+')
 tunable_policy(`zabbix_run_sudo',`
-    allow zabbix_agent_t self:capability { setuid setgid sys_resource };
+    allow zabbix_agent_t self:capability { chown dac_read_search setgid setuid sys_resource };
     allow zabbix_agent_t self:process { setrlimit setsched };
     allow zabbix_agent_t self:key write;
     allow zabbix_agent_t self:passwd { passwd rootok };
 
+    allow zabbix_agent_t sudo_log_t:dir { add_name create setattr write };
+    allow zabbix_agent_t sudo_log_t:file { create open read setattr write };
+
+    allow zabbix_agent_t devlog_t:sock_file write;
+    allow zabbix_agent_t kernel_t:unix_dgram_socket sendto;
+    allow zabbix_agent_t self:unix_dgram_socket { connect create };
+
+    auth_domtrans_chkpwd(zabbix_agent_t)
     auth_rw_lastlog(zabbix_agent_t)
     auth_rw_faillog(zabbix_agent_t)
-    auth_exec_chkpwd(zabbix_agent_t)
+
+    logging_send_audit_msgs(zabbix_agent_t)
 
     selinux_compute_access_vector(zabbix_agent_t)
 
+    sssd_read_config(zabbix_agent_t)
+
     systemd_write_inherited_logind_sessions_pipes(zabbix_agent_t)
     systemd_dbus_chat_logind(zabbix_agent_t)
 
     xserver_exec_xauth(zabbix_agent_t)
+
+    # Conceivably this could be under a separate boolean, but the reason to allow sudo
+    # is to allow check like this
+    lvm_domtrans(zabbix_agent_t)
+')
+
+optional_policy(`
+    rpm_exec(zabbix_agent_t)
+    rpm_read_db(zabbix_agent_t)
 ')
 
 optional_policy(`
@@ -324,13 +355,16 @@ optional_policy(`
 
 domtrans_pattern(zabbix_t, zabbix_script_exec_t, zabbix_script_t)
 
-allow zabbix_t zabbix_script_exec_t:dir search_dir_perms;
-allow zabbix_t zabbix_script_exec_t:dir read_file_perms;
+allow zabbix_t zabbix_script_exec_t:dir list_dir_perms;
 allow zabbix_t zabbix_script_exec_t:file ioctl;
 allow zabbix_t zabbix_script_t:process signal;
 
 init_domtrans_script(zabbix_script_t)
 
+optional_policy(`
+	chronyd_domtrans_chronyc(zabbix_script_t)
+')
+
 optional_policy(`
     mta_send_mail(zabbix_script_t)
 ')