OK, first we need to understand what are we missing. Anybody can provide the list of things to add (possibly) here?

https://github.com/fedora-selinux/selinux-policy-contrib/blob/b35f071eace9e06117f78cdda3dd6692388dff6f/zabbix.te

That's a lengthy policy, what is it's scope - is it something that is in / will go in RHEL, or something to be used as an example, or some other purpose?
Also, is that Zabbix server, agent, both?

On the agent side, the zabbix_run_sudo boolean is often needed, available since RHEL 7.6.

Other things we've found to be useful on the agent side (notice the sssd part, not detectable unless sssd is used):

require {
        type sssd_conf_t;
        type chkpwd_exec_t;
        type zabbix_agent_t;
        type devlog_t;
        type shadow_t;
        type kernel_t;
        class unix_dgram_socket { create connect sendto };
        class file { execute_no_trans read open };
        class netlink_audit_socket create;
        class capability { dac_override dac_read_search };
        class sock_file write;
}

#============= zabbix_agent_t ==============
allow zabbix_agent_t chkpwd_exec_t:file execute_no_trans;
allow zabbix_agent_t self:netlink_audit_socket create;
allow zabbix_agent_t self:unix_dgram_socket { create connect };
allow zabbix_agent_t sssd_conf_t:file { read open };
allow zabbix_agent_t self:capability { dac_override dac_read_search };
allow zabbix_agent_t devlog_t:sock_file write;
allow zabbix_agent_t shadow_t:file { read open };
allow zabbix_agent_t kernel_t:unix_dgram_socket sendto;

On the server side, these booleans are often needed:

• httpd_can_connect_zabbix
• zabbix_can_network

And the following was useful (the Postfix part related to simple email sending)

require {
        type zabbix_var_run_t;
        type tmp_t;
        type fs_t;
        type zabbix_t;
        type reserved_port_t;
        type unreserved_port_t;
        type postfix_local_t;
        type zabbix_var_lib_t;
        type zabbix_script_t;
        class sock_file { create unlink write };
        class unix_stream_socket connectto;
        class process { setrlimit signal };
        class tcp_socket name_connect;
        class filesystem getattr;
        class dir search;
}

#============= zabbix_t ==============

allow zabbix_t self:process setrlimit;
allow zabbix_t self:unix_stream_socket connectto;
allow zabbix_t tmp_t:sock_file { create unlink write };
allow zabbix_t zabbix_var_run_t:sock_file { create unlink write };
allow zabbix_t reserved_port_t:tcp_socket name_connect;
allow zabbix_t unreserved_port_t:tcp_socket name_connect;
allow zabbix_t fs_t:filesystem getattr;
allow zabbix_t zabbix_script_t:process signal;

#============= postfix_local_t ==============
allow postfix_local_t zabbix_var_lib_t:dir search;

I can confirm that on a fresh zabbix-server 4.0 installation on CentOS Linux release 8.0.1905  after enabling

• httpd_can_connect_zabbix
• zabbix_can_network

booleans, I needed at least to get zabbix-server started:

require {
 type zabbix_t;
 type zabbix_var_run_t;
 class capability dac_override;
 class unix_stream_socket connectto;
 class sock_file { create unlink write };
}
#============= zabbix_t ==============
allow zabbix_t self:capability dac_override;
allow zabbix_t self:unix_stream_socket connectto;
allow zabbix_t zabbix_var_run_t:sock_file { create unlink write };

Tried on zabbix 4.4.8 and Centos 8 and got

type=AVC msg=audit(1589985848.013:1015): avc: denied { dac_override } for pid=5965 comm="zabbix_proxy" capability=1 scontext=system_u:system_r:zabbix_t:s0 tcontext=system_u:system_r:zabbix_t:s0 tclass=capability permissive=0
type=SYSCALL msg=audit(1589985848.013:1015): arch=c000003e syscall=21 success=no exit=-13 a0=55b848eb3d40 a1=6 a2=7ffeb16aebe0 a3=55b848ead010 items=1 ppid=1 pid=5965 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="zabbix_proxy" exe="/usr/sbin/zabbix_proxy_sqlite3" subj=system_u:system_r:zabbix_t:s0 key=(null)ARCH=x86_64 SYSCALL=access AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"

Problem arises as zabbix is requesting dac_override, which it doesn't have, because it is trying to access /var/run/zabbix as root before dropping to zabbix user
by default  /var/run/zabbix is 755 and owned by zabbix:zabbix, so root apparently isn't allowed to write there

giving dac_override to zabbix is too dangerous, if i have understood correctly what this permission really grants

fast workaround is to chmod o+w on /var/run/zabbix
or more secure way 
chgrp root /var/run/zabbix
chmod g+w /var/run/zabbix

correct fix would be for zabbix process to drop privileges to zabbix user before accessing folders

zabbix-proxy is starting with root-privileges which it never needs.

So letting it start without root-privileges fixes the problem.

So the one Line patch to fix that issue (and making zabbix more secure) is:

/lib/systemd/system/zabbix-proxy.service

27a28
> User=zabbix

A patch-file with context:

zabbix-proxy.service.patch

This should work similar for zabbix-server.