diff --git a/rsyslog-8.2310.0-omprog-binary-path.patch b/rsyslog-8.2310.0-omprog-binary-path.patch
new file mode 100644
index 0000000..fccef4d
--- /dev/null
+++ b/rsyslog-8.2310.0-omprog-binary-path.patch
@@ -0,0 +1,41 @@
+diff -up rsyslog-8.2310.0/doc/configuration/modules/omprog.html.orig rsyslog-8.2310.0/doc/configuration/modules/omprog.html
+--- rsyslog-8.2310.0/doc/configuration/modules/omprog.html.orig	2024-01-05 13:21:14.474252913 +0100
++++ rsyslog-8.2310.0/doc/configuration/modules/omprog.html	2024-01-05 13:25:09.128562192 +0100
+@@ -144,8 +144,11 @@ passed to the external program.</p>
+ </tr>
+ </tbody>
+ </table>
+-<p>Full path and command line parameters of the external program to execute.</p>
+-<p>In legacy config, it is <strong>not possible</strong> to specify command line parameters.</p>
++<p>Full path and command line parameters of the external program to execute.
++  Arbitrary external programs should be placed under the /usr/libexec/rsyslog directory.
++  That is, the binaries put in this namespaced directory are meant for the consumption
++  of rsyslog, and are not intended to be executed by users.
++  In legacy config, it is <strong>not possible</strong> to specify command line parameters.</p>
+ </div>
+ <div class="section" id="confirmmessages">
+ <span id="id1"></span><h4>confirmMessages<a class="headerlink" href="#confirmmessages" title="Permalink to this headline">¶</a></h4>
+@@ -587,12 +590,12 @@ multiple processes.</p>
+ <div class="section" id="example-command-line-arguments">
+ <h3>Example: command line arguments<a class="headerlink" href="#example-command-line-arguments" title="Permalink to this headline">¶</a></h3>
+ <p>In the following example, logs will be sent to a program <code class="docutils literal notranslate"><span class="pre">log.sh</span></code> located
+-in <code class="docutils literal notranslate"><span class="pre">/path/to</span></code>. The program will receive the command line arguments
++in <code class="docutils literal notranslate"><span class="pre">/usr/libexec/rsyslog</span></code>. The program will receive the command line arguments
+ <code class="docutils literal notranslate"><span class="pre">p1</span></code>, <code class="docutils literal notranslate"><span class="pre">p2</span></code> and <code class="docutils literal notranslate"><span class="pre">--param3=&quot;value</span> <span class="pre">3&quot;</span></code>.</p>
+ <div class="highlight-none notranslate"><div class="highlight"><pre><span></span>module(load=&quot;omprog&quot;)
+ 
+ action(type=&quot;omprog&quot;
+-       binary=&quot;/path/to/log.sh p1 p2 --param3=\&quot;value 3\&quot;&quot;
++       binary=&quot;/usr/libexec/rsyslog/log.sh p1 p2 --param3=\&quot;value 3\&quot;&quot;
+        template=&quot;RSYSLOG_TraditionalFileFormat&quot;)
+ </pre></div>
+ </div>
+@@ -618,7 +621,7 @@ rsyslog will kill and restart it.</p>
+ 
+ action(type=&quot;omprog&quot;
+        name=&quot;db_forward&quot;
+-       binary=&quot;/usr/share/logging/db_forward.py&quot;
++       binary=&quot;/usr/libexec/rsyslog/db_forward.py&quot;
+        confirmMessages=&quot;on&quot;
+        confirmTimeout=&quot;30000&quot;
+        queue.type=&quot;LinkedList&quot;
diff --git a/rsyslog.spec b/rsyslog.spec
index a99ea89..d09e5d4 100644
--- a/rsyslog.spec
+++ b/rsyslog.spec
@@ -5,7 +5,7 @@
 Summary: Enhanced system logging and kernel message trapping daemon
 Name: rsyslog
 Version: 8.2310.0
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: (GPLv3+ and ASL 2.0)
 URL: http://www.rsyslog.com/
 Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz
@@ -23,6 +23,7 @@ Patch2: rsyslog-8.2102.0-rhbz1886400-reduce-default-timeout.patch
 Patch3: rsyslog-8.2310.0-do-not-preserve-statefile-on-file-move.patch
 Patch4: rsyslog-8.2310.0-do-not-preserve-statefile-on-file-move-doc.patch
 Patch5: rsyslog-8.2310.0-remove-state-on-file-delete.patch
+Patch6: rsyslog-8.2310.0-omprog-binary-path.patch
 
 BuildRequires: make
 BuildRequires: gcc
@@ -43,7 +44,7 @@ BuildRequires: systemd-devel >= 204-8
 BuildRequires: zlib-devel
 BuildRequires: libcap-ng-devel
 
-Conflicts: selinux-policy < 38.1.3-1
+Conflicts: selinux-policy < 38.1.29-1
 
 Recommends: %{name}-logrotate = %version-%release
 Requires: bash >= 2.0
@@ -264,6 +265,7 @@ mv build doc
 %patch -P 3 -p1
 %patch -P 4 -p1
 %patch -P 5 -p1
+%patch -P 6 -p1
 
 %build
 # Add additional flags as per https://one.redhat.com/rhel-developer-guide/#_what_are_the_required_flags
@@ -368,6 +370,7 @@ install -d -m 755 %{buildroot}%{_sysconfdir}/rsyslog.d
 install -d -m 700 %{buildroot}%{rsyslog_statedir}
 install -d -m 700 %{buildroot}%{rsyslog_pkidir}
 install -d -m 755 %{buildroot}%{rsyslog_docdir}/html
+install -d -m 755 %{buildroot}%{_libexecdir}/%{name}
 
 install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/rsyslog.conf
 install -p -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/sysconfig/rsyslog
@@ -412,6 +415,7 @@ done
 %dir %{_sysconfdir}/rsyslog.d
 %dir %{rsyslog_statedir}
 %dir %{rsyslog_pkidir}
+%dir %{_libexecdir}/%{name}
 %{_sbindir}/rsyslogd
 %{_mandir}/man5/rsyslog.conf.5.gz
 %{_mandir}/man8/rsyslogd.8.gz
@@ -525,6 +529,10 @@ done
 
 
 %changelog
+* Tue Dec 12 2023 Attila Lakatos <alakatos@redhat.com> - 8.2310.0-4
+- new directory for arbitrary external programs needed by omprog module
+  Resolves: RHEL-8676
+
 * Mon Nov 06 2023 Attila Lakatos <alakatos@redhat.com> - 8.2310.0-3
 - Rebase to 8.2310.0
   Resolves: RHEL-5196