diff --git a/.fmf/version b/.fmf/version
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/.fmf/version
@@ -0,0 +1 @@
+1
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..7c2856c
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+/modsecurity-v2.9.14.tar.gz
diff --git a/10-mod_security.conf b/10-mod_security.conf
new file mode 100644
index 0000000..dfe0955
--- /dev/null
+++ b/10-mod_security.conf
@@ -0,0 +1,5 @@
+LoadModule security2_module modules/mod_security2.so
+
+
+ LoadModule unique_id_module modules/mod_unique_id.so
+
diff --git a/README.md b/README.md
deleted file mode 100644
index 24b9ea2..0000000
--- a/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# Package Not Available
-This package is not available on CentOS Stream 10.
-It may be available on another branch.
\ No newline at end of file
diff --git a/dead.package b/dead.package
deleted file mode 100644
index f15568c..0000000
--- a/dead.package
+++ /dev/null
@@ -1 +0,0 @@
-mod_security package is retired on branch c10s for CS-2551
\ No newline at end of file
diff --git a/gating.yaml b/gating.yaml
new file mode 100644
index 0000000..034ef0d
--- /dev/null
+++ b/gating.yaml
@@ -0,0 +1,6 @@
+--- !Policy
+product_versions:
+ - rhel-*
+decision_context: osci_compose_gate
+rules:
+ - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/appstream.functional}
diff --git a/mod_security-2.9.3-remote-rules-timeout.patch b/mod_security-2.9.3-remote-rules-timeout.patch
new file mode 100644
index 0000000..cddae98
--- /dev/null
+++ b/mod_security-2.9.3-remote-rules-timeout.patch
@@ -0,0 +1,83 @@
+diff --git a/apache2/apache2_config.c b/apache2/apache2_config.c
+index ca21893..26870a2 100644
+--- a/apache2/apache2_config.c
++++ b/apache2/apache2_config.c
+@@ -2690,6 +2690,22 @@ static const char *cmd_remote_rules(cmd_parms *cmd, void *_dcfg, const char *p1,
+ return NULL;
+ }
+
++static const char *cmd_remote_timeout(cmd_parms *cmd, void *_dcfg, const char *p1)
++{
++ directory_config *dcfg = (directory_config *)_dcfg;
++ long int timeout;
++
++ if (dcfg == NULL) return NULL;
++
++ timeout = strtol(p1, NULL, 10);
++ if ((timeout == LONG_MAX)||(timeout == LONG_MIN)||(timeout < 0)) {
++ return apr_psprintf(cmd->pool, "ModSecurity: Invalid value for SecRemoteTimeout: %s", p1);
++ }
++
++ remote_rules_timeout = timeout;
++
++ return NULL;
++}
+
+ static const char *cmd_status_engine(cmd_parms *cmd, void *_dcfg, const char *p1)
+ {
+@@ -4215,6 +4231,14 @@ const command_rec module_directives[] = {
+ "Abort or Warn"
+ ),
+
++ AP_INIT_TAKE1 (
++ "SecRemoteTimeout",
++ cmd_remote_timeout,
++ NULL,
++ CMD_SCOPE_ANY,
++ "timeout in seconds"
++ ),
++
+
+ AP_INIT_TAKE1 (
+ "SecXmlExternalEntity",
+diff --git a/apache2/mod_security2.c b/apache2/mod_security2.c
+index 1850191..1df6f0b 100644
+--- a/apache2/mod_security2.c
++++ b/apache2/mod_security2.c
+@@ -77,6 +77,8 @@ msc_remote_rules_server DSOLOCAL *remote_rules_server = NULL;
+ #endif
+ int DSOLOCAL remote_rules_fail_action = REMOTE_RULES_ABORT_ON_FAIL;
+ char DSOLOCAL *remote_rules_fail_message = NULL;
++unsigned long int DSOLOCAL remote_rules_timeout = NOT_SET;
++
+
+ int DSOLOCAL status_engine_state = STATUS_ENGINE_DISABLED;
+
+diff --git a/apache2/modsecurity.h b/apache2/modsecurity.h
+index d1aa1d8..134ed86 100644
+--- a/apache2/modsecurity.h
++++ b/apache2/modsecurity.h
+@@ -154,6 +154,7 @@ extern DSOLOCAL msc_remote_rules_server *remote_rules_server;
+ #endif
+ extern DSOLOCAL int remote_rules_fail_action;
+ extern DSOLOCAL char *remote_rules_fail_message;
++extern DSOLOCAL unsigned long int remote_rules_timeout;
+
+ extern DSOLOCAL int status_engine_state;
+
+diff --git a/apache2/msc_remote_rules.c b/apache2/msc_remote_rules.c
+index 37b8864..12890a2 100644
+--- a/apache2/msc_remote_rules.c
++++ b/apache2/msc_remote_rules.c
+@@ -358,6 +358,11 @@ int msc_remote_download_content(apr_pool_t *mp, const char *uri, const char *key
+ /* We want Curl to return error in case there is an HTTP error code */
+ curl_easy_setopt(curl, CURLOPT_FAILONERROR, 1);
+
++ /* In case we want different timeout than a default one */
++ if (remote_rules_timeout != NOT_SET){
++ curl_easy_setopt(curl, CURLOPT_TIMEOUT, remote_rules_timeout);
++ }
++
+ res = curl_easy_perform(curl);
+
+ if (res != CURLE_OK)
diff --git a/mod_security-2.9.7-pipedlogs.patch b/mod_security-2.9.7-pipedlogs.patch
new file mode 100644
index 0000000..ad61d5b
--- /dev/null
+++ b/mod_security-2.9.7-pipedlogs.patch
@@ -0,0 +1,192 @@
+
+https://github.com/owasp-modsecurity/ModSecurity/pull/2823
+
+From bec33810e95ac9ae4d05c74a7fd8cedb61224ca2 Mon Sep 17 00:00:00 2001
+From: Tomas Korbar
+Date: Wed, 9 Oct 2024 14:39:14 +0200
+Subject: [PATCH] Move log opening to appropriate execution phase
+
+When piped logs are opened during parsing of configuration
+it results in unexpected situations in apache httpd
+and can cause hang of process which is trying to log
+into auditlog.
+
+Code should work as before, with the exception of
+one additional condition evaluation when primary
+audit log is not set and secondary audit log
+path to piped executable is now not relative
+to server root.
+---
+ apache2/apache2_config.c | 58 ----------------------------------------
+ apache2/mod_security2.c | 1 +
+ apache2/msc_logging.c | 52 +++++++++++++++++++++++++++++++++++
+ apache2/msc_logging.h | 3 +++
+ 4 files changed, 56 insertions(+), 58 deletions(-)
+
+diff --git a/apache2/apache2_config.c b/apache2/apache2_config.c
+index da10b4bfe..8c2ebe3ba 100644
+--- a/apache2/apache2_config.c
++++ b/apache2/apache2_config.c
+@@ -1239,35 +1239,6 @@ static const char *cmd_audit_log(cmd_parms *cmd, void *_dcfg, const char *p1)
+ directory_config *dcfg = _dcfg;
+
+ dcfg->auditlog_name = (char *)p1;
+-
+- if (dcfg->auditlog_name[0] == '|') {
+- const char *pipe_name = dcfg->auditlog_name + 1;
+- piped_log *pipe_log;
+-
+- pipe_log = ap_open_piped_log(cmd->pool, pipe_name);
+- if (pipe_log == NULL) {
+- return apr_psprintf(cmd->pool, "ModSecurity: Failed to open the audit log pipe: %s",
+- pipe_name);
+- }
+- dcfg->auditlog_fd = ap_piped_log_write_fd(pipe_log);
+- }
+- else {
+- const char *file_name = ap_server_root_relative(cmd->pool, dcfg->auditlog_name);
+- apr_status_t rc;
+-
+- if (dcfg->auditlog_fileperms == NOT_SET) {
+- dcfg->auditlog_fileperms = CREATEMODE;
+- }
+- rc = apr_file_open(&dcfg->auditlog_fd, file_name,
+- APR_WRITE | APR_APPEND | APR_CREATE | APR_BINARY,
+- dcfg->auditlog_fileperms, cmd->pool);
+-
+- if (rc != APR_SUCCESS) {
+- return apr_psprintf(cmd->pool, "ModSecurity: Failed to open the audit log file: %s",
+- file_name);
+- }
+- }
+-
+ return NULL;
+ }
+
+@@ -1283,35 +1254,6 @@ static const char *cmd_audit_log2(cmd_parms *cmd, void *_dcfg, const char *p1)
+ }
+
+ dcfg->auditlog2_name = (char *)p1;
+-
+- if (dcfg->auditlog2_name[0] == '|') {
+- const char *pipe_name = ap_server_root_relative(cmd->pool, dcfg->auditlog2_name + 1);
+- piped_log *pipe_log;
+-
+- pipe_log = ap_open_piped_log(cmd->pool, pipe_name);
+- if (pipe_log == NULL) {
+- return apr_psprintf(cmd->pool, "ModSecurity: Failed to open the secondary audit log pipe: %s",
+- pipe_name);
+- }
+- dcfg->auditlog2_fd = ap_piped_log_write_fd(pipe_log);
+- }
+- else {
+- const char *file_name = ap_server_root_relative(cmd->pool, dcfg->auditlog2_name);
+- apr_status_t rc;
+-
+- if (dcfg->auditlog_fileperms == NOT_SET) {
+- dcfg->auditlog_fileperms = CREATEMODE;
+- }
+- rc = apr_file_open(&dcfg->auditlog2_fd, file_name,
+- APR_WRITE | APR_APPEND | APR_CREATE | APR_BINARY,
+- dcfg->auditlog_fileperms, cmd->pool);
+-
+- if (rc != APR_SUCCESS) {
+- return apr_psprintf(cmd->pool, "ModSecurity: Failed to open the secondary audit log file: %s",
+- file_name);
+- }
+- }
+-
+ return NULL;
+ }
+
+diff --git a/apache2/mod_security2.c b/apache2/mod_security2.c
+index 1850191eb..e257978b8 100644
+--- a/apache2/mod_security2.c
++++ b/apache2/mod_security2.c
+@@ -1735,6 +1735,7 @@ static void register_hooks(apr_pool_t *mp) {
+
+ /* Logging */
+ ap_hook_error_log(hook_error_log, NULL, NULL, APR_HOOK_MIDDLE);
++ ap_hook_open_logs(modsec_open_logs, NULL, NULL, APR_HOOK_MIDDLE);
+ ap_hook_log_transaction(hook_log_transaction, NULL, transaction_afterme_list, APR_HOOK_MIDDLE);
+
+ /* Filter hooks */
+diff --git a/apache2/msc_logging.c b/apache2/msc_logging.c
+index 39588b10f..b07732adb 100644
+--- a/apache2/msc_logging.c
++++ b/apache2/msc_logging.c
+@@ -2316,3 +2316,55 @@ void sec_audit_logger(modsec_rec *msr) {
+ }
+ #endif
+ }
++
++static int open_audit_log(char *auditlog_name, unsigned char primary, apr_file_t **auditlog_fd,
++ apr_fileperms_t *auditlog_fileperms, apr_pool_t *p) {
++ if (auditlog_name == NOT_SET_P) {
++ return OK;
++ }
++ if (auditlog_name[0] == '|') {
++ const char *pipe_name = auditlog_name + 1;
++ piped_log *pipe_log;
++
++ pipe_log = ap_open_piped_log(p, pipe_name);
++ if (pipe_log == NULL) {
++ ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL,
++ "ModSecurity: Failed to open the %saudit log pipe: %s",
++ primary ? "" : "secondary ", pipe_name);
++ return primary ? DONE : OK;
++ }
++ *auditlog_fd = ap_piped_log_write_fd(pipe_log);
++ }
++ else {
++ const char *file_name = ap_server_root_relative(p, auditlog_name);
++ apr_status_t rc;
++
++ if (*auditlog_fileperms == NOT_SET) {
++ *auditlog_fileperms = CREATEMODE;
++ }
++ rc = apr_file_open(auditlog_fd, file_name,
++ APR_WRITE | APR_APPEND | APR_CREATE | APR_BINARY,
++ *auditlog_fileperms, p);
++
++ if (rc != APR_SUCCESS) {
++ ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL,
++ "ModSecurity: Failed to open the %saudit log file: %s",
++ primary ? "" : "secondary ", file_name);
++ return primary ? DONE : OK;
++ }
++ }
++
++ return OK;
++}
++
++int modsec_open_logs(apr_pool_t *pconf, apr_pool_t *p, apr_pool_t *ptemp, server_rec *s_main) {
++ directory_config *dcfg = ap_get_module_config(s_main->lookup_defaults, &security2_module);
++
++ int primary_log_rc = open_audit_log(dcfg->auditlog_name, 1,
++ &dcfg->auditlog_fd, &dcfg->auditlog_fileperms, p);
++ if (primary_log_rc != OK) {
++ return primary_log_rc;
++ }
++ return open_audit_log(dcfg->auditlog2_name, 0,
++ &dcfg->auditlog2_fd, &dcfg->auditlog_fileperms, p);
++}
+diff --git a/apache2/msc_logging.h b/apache2/msc_logging.h
+index 5378ddc65..d2e17fe23 100644
+--- a/apache2/msc_logging.h
++++ b/apache2/msc_logging.h
+@@ -43,6 +43,7 @@
+ #define AUDITLOG_PART_ENDMARKER 'Z'
+
+ #include "modsecurity.h"
++#include "httpd.h"
+ #include "apr_pools.h"
+
+ int DSOLOCAL is_valid_parts_specification(char *p);
+@@ -51,4 +52,6 @@ char DSOLOCAL *construct_log_vcombinedus_limited(modsec_rec *msr, int _limit, in
+
+ void DSOLOCAL sec_audit_logger(modsec_rec *msr);
+
++int modsec_open_logs(apr_pool_t *pconf, apr_pool_t *p, apr_pool_t *ptemp, server_rec *s_main);
++
+ #endif
diff --git a/mod_security-2.9.7-send_error_bucket.patch b/mod_security-2.9.7-send_error_bucket.patch
new file mode 100644
index 0000000..7691507
--- /dev/null
+++ b/mod_security-2.9.7-send_error_bucket.patch
@@ -0,0 +1,30 @@
+From b2fa083522c70368c7ab911696dcb87dde5dc688 Mon Sep 17 00:00:00 2001
+From: Tomas Korbar
+Date: Thu, 22 Dec 2022 14:49:34 +0100
+Subject: [PATCH] Clear original response code in send_error_bucket function
+
+If this is left intact, then apache thinks that this code
+was generated during processing of ErrorDocument and does not
+handle it properly
+
+Fix #2849
+---
+ apache2/apache2_util.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/apache2/apache2_util.c b/apache2/apache2_util.c
+index cdae2b580..520a30f2f 100644
+--- a/apache2/apache2_util.c
++++ b/apache2/apache2_util.c
+@@ -31,6 +31,11 @@ apr_status_t send_error_bucket(modsec_rec *msr, ap_filter_t *f, int status) {
+ /* Set the status line explicitly for the error document */
+ f->r->status_line = ap_get_status_line(status);
+
++ /* Clear previously set response code to make clear that this is
++ * not a recursive error
++ */
++ f->r->status = 200;
++
+ brigade = apr_brigade_create(f->r->pool, f->r->connection->bucket_alloc);
+ if (brigade == NULL) return APR_EGENERAL;
+
diff --git a/mod_security.conf b/mod_security.conf
new file mode 100644
index 0000000..e9fe3dd
--- /dev/null
+++ b/mod_security.conf
@@ -0,0 +1,56 @@
+
+ # Default recommended configuration
+ SecRuleEngine On
+ SecRequestBodyAccess On
+ SecRule REQUEST_HEADERS:Content-Type "text/xml" \
+ "id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
+ SecRequestBodyLimit 13107200
+ SecRequestBodyNoFilesLimit 131072
+ SecRequestBodyInMemoryLimit 131072
+ SecRequestBodyLimitAction Reject
+ SecRule REQBODY_ERROR "!@eq 0" \
+ "id:'200001', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"
+ SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
+ "id:'200002',phase:2,t:none,log,deny,status:400,msg:'Multipart request body \
+ failed strict validation: \
+ PE %{REQBODY_PROCESSOR_ERROR}, \
+ BQ %{MULTIPART_BOUNDARY_QUOTED}, \
+ BW %{MULTIPART_BOUNDARY_WHITESPACE}, \
+ DB %{MULTIPART_DATA_BEFORE}, \
+ DA %{MULTIPART_DATA_AFTER}, \
+ HF %{MULTIPART_HEADER_FOLDING}, \
+ LF %{MULTIPART_LF_LINE}, \
+ SM %{MULTIPART_MISSING_SEMICOLON}, \
+ IQ %{MULTIPART_INVALID_QUOTING}, \
+ IP %{MULTIPART_INVALID_PART}, \
+ IH %{MULTIPART_INVALID_HEADER_FOLDING}, \
+ FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"
+
+ SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \
+ "id:'200003',phase:2,t:none,log,deny,status:44,msg:'Multipart parser detected a possible unmatched boundary.'"
+
+ SecPcreMatchLimit 1000
+ SecPcreMatchLimitRecursion 1000
+
+ SecRule TX:/^MSC_/ "!@streq 0" \
+ "id:'200004',phase:2,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'"
+
+ SecResponseBodyAccess Off
+ SecDebugLog /var/log/httpd/modsec_debug.log
+ SecDebugLogLevel 0
+ SecAuditEngine RelevantOnly
+ SecAuditLogRelevantStatus "^(?:5|4(?!04))"
+ SecAuditLogParts ABIJDEFHZ
+ SecAuditLogType Serial
+ SecAuditLog /var/log/httpd/modsec_audit.log
+ SecArgumentSeparator &
+ SecCookieFormat 0
+ SecTmpDir /var/lib/mod_security
+ SecDataDir /var/lib/mod_security
+
+ # ModSecurity Core Rules Set and Local configuration
+ Include modsecurity.d/*.conf
+ Include modsecurity.d/activated_rules/*.conf
+ Include modsecurity.d/local_rules/*.conf
+
+
diff --git a/mod_security.spec b/mod_security.spec
new file mode 100644
index 0000000..df48e08
--- /dev/null
+++ b/mod_security.spec
@@ -0,0 +1,155 @@
+%{!?_httpd_apxs: %{expand: %%global _httpd_apxs %%{_sbindir}/apxs}}
+%{!?_httpd_mmn: %{expand: %%global _httpd_mmn %%(cat %{_includedir}/httpd/.mmn || echo 0-0)}}
+# /etc/httpd/conf.d with httpd < 2.4 and defined as /etc/httpd/conf.modules.d with httpd >= 2.4
+%{!?_httpd_modconfdir: %{expand: %%global _httpd_modconfdir %%{_sysconfdir}/httpd/conf.d}}
+%{!?_httpd_confdir: %{expand: %%global _httpd_confdir %%{_sysconfdir}/httpd/conf.d}}
+%{!?_httpd_moddir: %{expand: %%global _httpd_moddir %%{_libdir}/httpd/modules}}
+
+%bcond_without mlogc
+%bcond ssdeep %{undefined rhel}
+%bcond yajl %[0%{?rhel} < 10]
+
+Summary: Security module for the Apache HTTP Server
+Name: mod_security
+Version: 2.9.14
+Release: 1%{?dist}
+License: Apache-2.0
+URL: http://www.modsecurity.org/
+Source: https://github.com/owasp-modsecurity/ModSecurity/releases/download/v%{version}/modsecurity-v%{version}.tar.gz
+Source1: mod_security.conf
+Source2: 10-mod_security.conf
+Source3: modsecurity_localrules.conf
+Patch1: modsecurity-2.9.3-apulibs.patch
+Patch2: mod_security-2.9.3-remote-rules-timeout.patch
+Patch3: mod_security-2.9.7-send_error_bucket.patch
+Patch4: mod_security-2.9.7-pipedlogs.patch
+
+# Security patches
+# Patch100: mod_security-2.9.13-.....patch
+
+Requires: httpd httpd-mmn = %{_httpd_mmn}
+%if 0%{?fedora} || 0%{?rhel} > 7
+# Ensure apache user exists for file ownership
+Requires(pre): httpd-filesystem
+%endif
+
+BuildRequires: gcc, make, autoconf, automake, libtool, git-core
+BuildRequires: httpd-devel
+BuildRequires: perl-generators
+BuildRequires: pcre2-devel
+BuildRequires: pkgconfig(libcurl)
+BuildRequires: pkgconfig(libxml-2.0)
+BuildRequires: pkgconfig(lua)
+BuildRequires: libxcrypt-devel
+%if %{with ssdeep}
+BuildRequires: ssdeep-devel
+%endif
+%if %{with yajl}
+BuildRequires: pkgconfig(yajl)
+%endif
+
+%description
+ModSecurity is an open source intrusion detection and prevention engine
+for web applications. It operates embedded into the web server, acting
+as a powerful umbrella - shielding web applications from attacks.
+
+%if %{with mlogc}
+%package mlogc
+Summary: ModSecurity Audit Log Collector
+Requires: mod_security
+%if 0%{?fedora} || 0%{?rhel} > 7
+# Ensure apache user exists for file ownership
+Requires(pre): httpd-filesystem
+%endif
+
+%description mlogc
+This package contains the ModSecurity Audit Log Collector.
+%endif
+
+%prep
+%autosetup -p1 -n modsecurity-v%{version} -S git
+
+: Building with YAJL=%{with yajl} ssdeep=%{with ssdeep}
+
+%build
+./autogen.sh
+%configure --enable-pcre-match-limit=1000000 \
+ --enable-pcre-match-limit-recursion=1000000 \
+ --with-apxs=%{_httpd_apxs} \
+ --with-yajl \
+ --with-pcre2 \
+ --disable-static
+
+# remove rpath
+sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
+sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
+
+make %{_smp_mflags}
+
+%check
+# Test suite does not start because of some issue in shipped httpd config (fix upstreamed in PR #669)
+# After the fix, the test suite starts but still fails
+#make test
+#make test-regression
+
+%install
+install -d %{buildroot}%{_sbindir}
+install -d %{buildroot}%{_bindir}
+install -d %{buildroot}%{_httpd_moddir}
+install -d %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/
+install -d %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/activated_rules
+install -d %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/local_rules
+
+install -m0755 apache2/.libs/mod_security2.so %{buildroot}%{_httpd_moddir}/mod_security2.so
+
+%if "%{_httpd_modconfdir}" != "%{_httpd_confdir}"
+# 2.4-style
+install -Dp -m0644 %{SOURCE2} %{buildroot}%{_httpd_modconfdir}/10-mod_security.conf
+install -Dp -m0644 %{SOURCE1} %{buildroot}%{_httpd_confdir}/mod_security.conf
+sed -i 's/Include/IncludeOptional/' %{buildroot}%{_httpd_confdir}/mod_security.conf
+%else
+# 2.2-style
+install -d -m0755 %{buildroot}%{_httpd_confdir}
+cat %{SOURCE2} %{SOURCE1} > %{buildroot}%{_httpd_confdir}/mod_security.conf
+%endif
+install -m 700 -d $RPM_BUILD_ROOT%{_localstatedir}/lib/%{name}
+
+# Local rules example
+install -Dp -m0644 %{SOURCE3} %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/local_rules/
+
+# mlogc
+%if %{with mlogc}
+install -d %{buildroot}%{_localstatedir}/log/mlogc
+install -d %{buildroot}%{_localstatedir}/log/mlogc/data
+install -m0755 mlogc/mlogc %{buildroot}%{_bindir}/mlogc
+install -m0755 mlogc/mlogc-batch-load.pl %{buildroot}%{_bindir}/mlogc-batch-load
+install -m0644 mlogc/mlogc-default.conf %{buildroot}%{_sysconfdir}/mlogc.conf
+%endif
+
+
+%files
+%doc CHANGES LICENSE README.* NOTICE
+%{_httpd_moddir}/mod_security2.so
+%config(noreplace) %{_httpd_confdir}/*.conf
+%if "%{_httpd_modconfdir}" != "%{_httpd_confdir}"
+%config(noreplace) %{_httpd_modconfdir}/*.conf
+%endif
+%dir %{_sysconfdir}/httpd/modsecurity.d
+%dir %{_sysconfdir}/httpd/modsecurity.d/activated_rules
+%dir %{_sysconfdir}/httpd/modsecurity.d/local_rules
+%config(noreplace) %{_sysconfdir}/httpd/modsecurity.d/local_rules/*.conf
+%attr(770,apache,root) %dir %{_localstatedir}/lib/%{name}
+
+%if %{with mlogc}
+%files mlogc
+%doc mlogc/INSTALL
+%attr(0640,root,apache) %config(noreplace) %{_sysconfdir}/mlogc.conf
+%attr(0755,root,root) %dir %{_localstatedir}/log/mlogc
+%attr(0770,root,apache) %dir %{_localstatedir}/log/mlogc/data
+%attr(0755,root,root) %{_bindir}/mlogc
+%attr(0755,root,root) %{_bindir}/mlogc-batch-load
+%endif
+
+%changelog
+* Wed Jul 22 2026 Luboš Uhliarik - 2.9.14-1
+- Resolves: RHEL-172046 - add mod_security
diff --git a/modsecurity-2.9.3-apulibs.patch b/modsecurity-2.9.3-apulibs.patch
new file mode 100644
index 0000000..bde44bb
--- /dev/null
+++ b/modsecurity-2.9.3-apulibs.patch
@@ -0,0 +1,14 @@
+
+Strip redundant APR-util dependent libraries, it is sufficient to link against -laprutil-1.
+
+--- modsecurity-2.9.3/build/find_apu.m4.apulibs
++++ modsecurity-2.9.3/build/find_apu.m4
+@@ -59,7 +59,7 @@
+ APU_CFLAGS="`${APU_CONFIG} --includes`"
+ if test "$verbose_output" -eq 1; then AC_MSG_NOTICE(apu CFLAGS: $APU_CFLAGS); fi
+ APU_LDFLAGS="`${APU_CONFIG} --ldflags`"
+- APU_LDFLAGS="$APU_LDFLAGS `${APU_CONFIG} --libs`"
++ APU_LDFLAGS="$APU_LDFLAGS `${APU_CONFIG} --avoid-ldap --avoid-dbm --libs`"
+ if test "$verbose_output" -eq 1; then AC_MSG_NOTICE(apu LDFLAGS: $APU_LDFLAGS); fi
+ APU_LDADD="`${APU_CONFIG} --link-libtool`"
+ if test "$verbose_output" -eq 1; then AC_MSG_NOTICE(apu LDADD: $APU_LDADD); fi
diff --git a/modsecurity_localrules.conf b/modsecurity_localrules.conf
new file mode 100644
index 0000000..983d7df
--- /dev/null
+++ b/modsecurity_localrules.conf
@@ -0,0 +1,9 @@
+# User defined rules and settings .
+#
+# You can use this file/directory to drop your local rules or
+# to remove some rules provided by mod_security_crs package with SecRuleRemoveById
+#
+# You can also disable mod_security for some incompatible web applications (eg. phpMyAdmin).
+#
+#
+
diff --git a/plans.fmf b/plans.fmf
new file mode 100644
index 0000000..2d49cff
--- /dev/null
+++ b/plans.fmf
@@ -0,0 +1,9 @@
+/appstream:
+ adjust:
+ - enabled: false
+ when: distro == centos-stream-10
+ because: "These tests should not run on CentOS Stream 10"
+ plan:
+ import:
+ url: https://gitlab.com/redhat/rhel/tests/mod_security.git
+ name: "/plans/mod_security$"
diff --git a/rpminspect.yaml b/rpminspect.yaml
new file mode 100644
index 0000000..239b859
--- /dev/null
+++ b/rpminspect.yaml
@@ -0,0 +1,5 @@
+badfuncs:
+ allowed:
+ '/usr/lib*/httpd/modules/mod_security2.so':
+ - gethostbyname
+ - inet_ntoa
\ No newline at end of file
diff --git a/sources b/sources
new file mode 100644
index 0000000..d0e35b8
--- /dev/null
+++ b/sources
@@ -0,0 +1 @@
+SHA512 (modsecurity-v2.9.14.tar.gz) = 788acc877295daa82d8e1aed7845e904194e54fda66ee5f6c24e57b2d9cf073feff124048942f1551ea1730e3d288818c57f6db27ea2b2c21d841267680535ff